diff --git a/crates/freshell-freshagent/src/lib.rs b/crates/freshell-freshagent/src/lib.rs
index 8714f7486..720eb209e 100644
--- a/crates/freshell-freshagent/src/lib.rs
+++ b/crates/freshell-freshagent/src/lib.rs
@@ -68,6 +68,28 @@ pub use spawn_gate::{SpawnGate, SpawnGateError};
 /// Defaults to "always false" (behavior-preserving for constructors that don't wire it).
 pub type TerminalLivenessProbe = std::sync::Arc<dyn Fn(&str, &str) -> bool + Send + Sync>;
 
+/// Door 3 (resume-validation): the gate-fired callback shape --
+/// `(provider, stale_session_id)`. In production, `freshell-server`'s main.rs
+/// implements it as pane-ledger `retire_missing` + `tracing::warn!`.
+pub type OnStaleResume = std::sync::Arc<dyn Fn(&str, &str) + Send + Sync>;
+
+/// Door 3 (resume-validation): the injected ASYNC sidecar-liveness probe --
+/// `(mode, session_id) -> is that session live inside a fresh-agent sidecar`.
+/// The REST create gate's registry consult is `TerminalRegistry`/PTY-scoped
+/// and structurally BLIND to sessions live inside the fresh-agent sidecars
+/// (sidecars never get PTY rows), so the in-gate liveness precondition needs
+/// this second arm. Precedent: [`TerminalLivenessProbe`] solves the SAME
+/// cross-crate liveness problem in the opposite direction -- same shape, made
+/// async. Constructed by `freshell-server`'s `main.rs` over the SAME sidecar
+/// instances the WS door's D7 join consults, so this crate never imports
+/// `freshell-ws`. `None` (not wired, e.g. bare unit-test states) => the arm
+/// contributes false.
+pub type SidecarLivenessProbe = std::sync::Arc<
+    dyn Fn(&str, &str) -> std::pin::Pin<Box<dyn std::future::Future<Output = bool> + Send>>
+        + Send
+        + Sync,
+>;
+
 /// Handle pairing the shared gate with the permit-wait timeout
 /// (`CreateProtectConfig.spawn_timeout_ms`, resolved once in main.rs so both
 /// doors share one env snapshot).
@@ -224,6 +246,20 @@ pub struct FreshAgentState {
     /// `identity_sink`). `None` = ungated (unwired unit tests keep legacy
     /// behavior; production always wires it).
     spawn_gate: Arc<std::sync::OnceLock<RestSpawnGate>>,
+    /// Door 3 (resume-validation): the disk-existence probe consulted before
+    /// a REST create turns a cached resume id into resume argv. Injected as
+    /// [`freshell_platform::resume_gate::ResumeProbeFn`] because this crate
+    /// must NOT depend on `freshell-ws` (whose probe trait would be circular
+    /// -- see this Cargo.toml's freshell-sessions comment). `None` = feature
+    /// off = today's behavior (every pre-existing test).
+    pub(crate) resume_probe: Option<freshell_platform::resume_gate::ResumeProbeFn>,
+    /// Door 3: called with `(provider, stale_session_id)` when the gate
+    /// fires. `freshell-server`'s main.rs implements it as pane-ledger
+    /// `retire_missing` + `tracing::warn!`. `None` = no-op.
+    pub(crate) on_stale_resume: Option<OnStaleResume>,
+    /// Door 3: arm 2 of the in-gate liveness precondition (see
+    /// [`SidecarLivenessProbe`]). `None` = arm contributes false.
+    pub(crate) sidecar_liveness: Option<SidecarLivenessProbe>,
 }
 
 /// A fresh-agent pane (the `paneContent` subset the opencode T2 path needs).
@@ -292,6 +328,9 @@ impl FreshAgentState {
             codex_locator: None,
             identity_sink: Arc::new(std::sync::OnceLock::new()),
             spawn_gate: Arc::new(std::sync::OnceLock::new()),
+            resume_probe: None,
+            on_stale_resume: None,
+            sidecar_liveness: None,
         }
     }
 
@@ -480,6 +519,37 @@ impl FreshAgentState {
         self
     }
 
+    /// Door 3 (resume-validation): wire the disk-existence probe the REST
+    /// create pipeline consults before turning a cached resume id into
+    /// resume argv. `freshell-server`'s main.rs builds it over the SAME
+    /// `SessionExistenceProbe` the WS doors use. Unwired = feature off =
+    /// today's behavior.
+    pub fn with_resume_probe(
+        mut self,
+        probe: freshell_platform::resume_gate::ResumeProbeFn,
+    ) -> Self {
+        self.resume_probe = Some(probe);
+        self
+    }
+
+    /// Door 3: wire the gate-fired callback (`(provider, stale_session_id)`),
+    /// implemented by `freshell-server`'s main.rs as pane-ledger
+    /// `retire_missing` + `tracing::warn!`.
+    pub fn with_on_stale_resume(mut self, cb: OnStaleResume) -> Self {
+        self.on_stale_resume = Some(cb);
+        self
+    }
+
+    /// Door 3: wire arm 2 of the in-gate liveness precondition (see
+    /// [`SidecarLivenessProbe`]). MUST stay a consuming `with_*` builder like
+    /// its siblings, NOT a `set_*`/`OnceLock` late-bind: `FreshOpencodeState`
+    /// holds a `FreshAgentState` clone by value, so a late-bound handle back
+    /// to the sidecars would create a real Arc cycle.
+    pub fn with_sidecar_liveness(mut self, probe: SidecarLivenessProbe) -> Self {
+        self.sidecar_liveness = Some(probe);
+        self
+    }
+
     /// SESSION-09 fix-forward: replace this state's own `sessions_revision`
     /// counter with a SHARED one -- in production, `freshell-server` wires
     /// this to the SAME `Arc<AtomicI64>` as `freshell_ws::WsState::sessions_revision`
diff --git a/crates/freshell-freshagent/src/terminal_tabs.rs b/crates/freshell-freshagent/src/terminal_tabs.rs
index 8593f7408..edeac17e2 100644
--- a/crates/freshell-freshagent/src/terminal_tabs.rs
+++ b/crates/freshell-freshagent/src/terminal_tabs.rs
@@ -529,6 +529,102 @@ pub(crate) fn derive_resume_identity(
     ))
 }
 
+/// Door 3 (resume-validation): what [`validate_rest_resume`] decided for a
+/// REST create's cached resume id. Mirrors `freshell-ws`'s
+/// `ResumeValidationOutcome` (Task 6), including the claude-prealloc flag
+/// (the healed pane_content stamping falls out of
+/// `plausible_resume_session_id` on the minted id instead).
+struct RestResumeOutcome {
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+    /// True when the gate minted a fresh claude id as an absence fallback.
+    /// The REST consumer must run the PIN 2 pre-spawn ledger write exactly
+    /// as a natural fresh-claude create would (main #584), even though a
+    /// resume_session_id is present (it is minted, not resumed).
+    claude_fresh_prealloc: bool,
+    /// Some(stale_id) iff the gate fired: caller clears the accepted wire
+    /// ref (never stamp the stale sessionRef), invokes `on_stale_resume`,
+    /// and injects the notice into the returned `paneContent`.
+    stale_session_id: Option<String>,
+    notice: Option<String>,
+}
+
+/// The Proceed shape — shared by [`validate_rest_resume`] and the wiring
+/// site's live-candidate skip (a LIVE session must never be gated).
+fn rest_resume_passthrough(
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+) -> RestResumeOutcome {
+    RestResumeOutcome {
+        resume_session_id,
+        launch_intent,
+        claude_fresh_prealloc: false,
+        stale_session_id: None,
+        notice: None,
+    }
+}
+
+/// Door 3 gate (resume-validation): before the REST create pipeline turns a
+/// cached session id into resume argv, ask the disk-existence probe. On
+/// POSITIVE absence, fall back to the same shape a genuinely fresh pane of
+/// that mode uses (claude → new UUID + `Start`; amplifier → new UUID +
+/// `Resume`; codex/opencode → `None`). Unknown/unavailable, unvalidated
+/// providers, and `probe: None` (feature not wired — bare unit-test states)
+/// all fail open. Body mirrors `freshell_ws::resume_validation::
+/// validate_wire_resume`, using the `ResumeProbeFn` injection shape because
+/// this crate must not depend on `freshell-ws`. SYNC by design: the wiring
+/// site runs it inside `tokio::task::spawn_blocking` (A13 — the probe does
+/// real filesystem walks). Minted UUIDs MUST be RFC-4122 v4 (`Uuid::new_v4()`,
+/// the crate's existing mint convention) — `is_canonical_claude_session_id`
+/// enforces version 1..=5 + RFC-4122 variant, so a v7 or nil UUID would fail
+/// [`plausible_resume_session_id`] and break the healed identity stamping.
+fn validate_rest_resume(
+    mode: &str,
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+    probe: Option<&freshell_platform::resume_gate::ResumeProbeFn>,
+) -> RestResumeOutcome {
+    use freshell_platform::resume_gate::{
+        evaluate_resume_gate, provider_validated, stale_resume_notice, ResumeGateDecision,
+    };
+    let Some(probe) = probe else {
+        return rest_resume_passthrough(resume_session_id, launch_intent);
+    };
+    let Some(sid) = resume_session_id.clone().filter(|s| !s.is_empty()) else {
+        return rest_resume_passthrough(resume_session_id, launch_intent);
+    };
+    if !provider_validated(mode) {
+        return rest_resume_passthrough(resume_session_id, launch_intent);
+    }
+    let answer = probe(mode, &sid);
+    match evaluate_resume_gate(mode, answer.existence, answer.ever_observed_on_disk) {
+        ResumeGateDecision::Proceed => rest_resume_passthrough(resume_session_id, launch_intent),
+        ResumeGateDecision::SpawnFresh => {
+            let notice = stale_resume_notice(mode, &sid);
+            let (fresh_id, intent, claude_fresh_prealloc) = match mode {
+                // Mirror the genuine fresh-pane shapes (same per-provider
+                // fallbacks as the WS door's validate_wire_resume). The
+                // claude arm MINTS a fresh id, so it must also carry the
+                // prealloc marker (PIN 2 coupling, main #584).
+                "claude" => (Some(Uuid::new_v4().to_string()), LaunchIntent::Start, true),
+                "amplifier" => (
+                    Some(Uuid::new_v4().to_string()),
+                    LaunchIntent::Resume,
+                    false,
+                ),
+                _ => (None, LaunchIntent::Resume, false),
+            };
+            RestResumeOutcome {
+                resume_session_id: fresh_id,
+                launch_intent: intent,
+                claude_fresh_prealloc,
+                stale_session_id: Some(sid),
+                notice: Some(notice),
+            }
+        }
+    }
+}
+
 /// The successful result of [`spawn_terminal_pane`]: the `paneContent` JSON + the
 /// resolved `mode`/`shell`/`cwd`/`terminal_id`, everything a caller (tab-create or
 /// pane-split) needs to build its own `ui.command` payload and success envelope
@@ -792,9 +888,91 @@ pub(crate) async fn spawn_terminal_pane(
         }
     }
 
-    let (mut resume_session_id, accepted_session_ref, session_ref_locator_present) =
+    let (mut resume_session_id, mut accepted_session_ref, session_ref_locator_present) =
         derive_resume_identity(body, &mode)?;
 
+    // Door 3 (resume-validation): gate the cached resume id on disk existence
+    // BEFORE the amplifier ensure_session below (or the re-stub would
+    // resurrect the stale dir) and before CliLaunchInputs is built.
+    //
+    // In-gate liveness precondition (MANDATORY — ordering hazard, the A11
+    // door-1 hazard with the constraint INVERTED: in THIS pipeline the
+    // amplifier ensure comes BEFORE the REST D7 live-session guard and the D8
+    // lease, so the gate cannot get liveness protection by after-D7 placement;
+    // placed here, a gate fire on a LIVE candidate would clear
+    // accepted_session_ref / replace resume_session_id and FALSIFY the D7-REST
+    // applicability filter — its loud RESTORE_UNAVAILABLE/CONFLICT reject and
+    // the D8 lease silently bypassed, and on_stale_resume → retire_missing
+    // would destroy the Bound ledger row of a RUNNING session. Reachable: a
+    // live zero-turn codex session genuinely has no rollout on disk.):
+    // a LIVE session must never be gated. TWO ARMS, both load-bearing:
+    // the registry arm reuses the REST D7 guard's own consult (below, which
+    // owns the loud reject for registry-live sessions downstream); the
+    // sidecar arm exists because that consult is PTY-scoped and blind to
+    // sessions live inside the fresh-agent sidecars — the very
+    // live-zero-turn-with-no-rollout-on-disk case. Dropping either arm
+    // silently un-protects a class of live sessions (the live-session tests
+    // pin BOTH arms).
+    let candidate_is_live = match resume_session_id.as_deref() {
+        None => false,
+        Some(sid) => {
+            // Arm 1 (registry): the SAME consult the REST D7 guard below
+            // performs — shared, not reimplemented.
+            let registry_live = registry
+                .live_session_owner(state.session_identity.as_deref(), &mode, sid)
+                .is_some();
+            // Arm 2 (sidecar): the injected async probe. None (not wired,
+            // e.g. bare unit-test states) => arm contributes false.
+            let sidecar_live = if registry_live {
+                true // short-circuit: already live
+            } else {
+                match &state.sidecar_liveness {
+                    Some(probe) => probe(&mode, sid).await,
+                    None => false,
+                }
+            };
+            registry_live || sidecar_live
+        }
+    };
+    // Today's hardcoded intent for this pipeline (see the CliLaunchInputs
+    // comment in settle_gated_create) — the gate's claude fallback is the
+    // one path that rewrites it to Start.
+    let launch_intent = LaunchIntent::Resume;
+    // Probe does real filesystem walks — never inline on the async runtime
+    // (A13); run the sync helper in spawn_blocking. A LIVE candidate skips
+    // the gate entirely (passthrough — same shape validate_rest_resume
+    // returns for Proceed), so the unchanged create flows into the D7-REST
+    // guard and D8 lease exactly as today.
+    let rest_outcome = if candidate_is_live {
+        rest_resume_passthrough(resume_session_id.take(), launch_intent)
+    } else {
+        let probe = state.resume_probe.clone();
+        let mode_for_gate = mode.clone();
+        let rid = resume_session_id.take();
+        let intent = launch_intent;
+        tokio::task::spawn_blocking(move || {
+            validate_rest_resume(&mode_for_gate, rid, intent, probe.as_ref())
+        })
+        .await
+        .expect("resume validation task panicked")
+    };
+    let mut resume_session_id = rest_outcome.resume_session_id;
+    let launch_intent = rest_outcome.launch_intent;
+    if let Some(stale) = rest_outcome.stale_session_id.as_deref() {
+        // MANDATORY stale-ref guard (V7 row 10): the pane_content identity
+        // stamping PREFERS accepted_session_ref — left in place, the STALE
+        // wire ref would be stamped into the new tab's pane_content,
+        // poisoning client persistence + tabs-sync replay and re-firing the
+        // gate every restart. Clearing it makes stamping fall through to the
+        // minted-ref branch, so gate-fired claude/amplifier panes are born
+        // with the HEALED ref and codex/opencode panes with no ref.
+        accepted_session_ref = None;
+        if let Some(cb) = &state.on_stale_resume {
+            cb(&mode, stale);
+        }
+    }
+    let resume_notice = rest_outcome.notice;
+
     // Fresh-claude preallocation (kata hbsa): WS parity. The WS door's
     // fresh-claude special case (freshell-ws/src/terminal.rs, LIVE-PATH LAW
     // spec §2.1(3)) mints a server-preallocated --session-id for every fresh
@@ -806,15 +984,25 @@ pub(crate) async fn spawn_terminal_pane(
     // the id — the pre-spawn ledger write and its spawn-failure delete (Task 5
     // call sites in settle_gated_create) are BOTH gated on this exact flag,
     // never on `mode == "claude"`.
-    let claude_fresh_prealloc = freshell_platform::should_preallocate_fresh_claude(
+    //
+    // The MINT stays keyed on main's raw predicate ("no resume id"): a
+    // gate-fired create already carries the gate-minted id, and re-minting
+    // would overwrite it with a second UUID.
+    let claude_prealloc_mint = freshell_platform::should_preallocate_fresh_claude(
         &mode,
         body.get("restore").and_then(serde_json::Value::as_bool),
         session_ref_locator_present,
         resume_session_id.as_deref(),
     );
-    if claude_fresh_prealloc {
+    if claude_prealloc_mint {
         resume_session_id = Some(Uuid::new_v4().to_string());
     }
+    // Door 3 (resume-validation) × PIN 2: a gate-fired claude fallback ALSO
+    // minted a fresh id (in `validate_rest_resume`), so it must get the same
+    // PIN 2 pre-spawn write / failure delete / `Start` intent as a natural
+    // fresh claude create — fold the outcome flag in (WS door parity:
+    // freshell-ws/src/terminal.rs does this exact OR-fold).
+    let claude_fresh_prealloc = claude_prealloc_mint || rest_outcome.claude_fresh_prealloc;
 
     // Hoisted spawn-environment inputs, computed ONCE (Task 8's WS pattern,
     // REST twin): the amplifier windows-arm guard below and the spawn-spec
@@ -1109,6 +1297,8 @@ pub(crate) async fn spawn_terminal_pane(
         shell_str,
         cwd,
         resume_session_id,
+        launch_intent,
+        resume_notice,
         accepted_session_ref,
         claude_fresh_prealloc,
         pane_identity: state.pane_identity.clone(),
@@ -1144,6 +1334,13 @@ struct GatedSettleInputs {
     shell_str: Option<String>,
     cwd: Option<String>,
     resume_session_id: Option<String>,
+    /// Door 3 (resume-validation): the gate's outcome intent — today's
+    /// hardcoded `Resume` everywhere EXCEPT the gate-fired claude fallback,
+    /// whose minted fresh id launches with `Start`.
+    launch_intent: LaunchIntent,
+    /// Door 3: the operator-visible stale-resume notice when the gate fired,
+    /// injected into the returned `paneContent` as `reconcileNotice`.
+    resume_notice: Option<String>,
     accepted_session_ref: Option<SessionLocator>,
     /// Fresh-claude preallocation (kata hbsa): `true` iff THIS create minted
     /// its own `--session-id` (the [`freshell_platform::should_preallocate_fresh_claude`]
@@ -1194,6 +1391,8 @@ async fn settle_gated_create(inputs: GatedSettleInputs) -> Result<TerminalSpawnR
         shell_str,
         cwd,
         mut resume_session_id,
+        launch_intent,
+        resume_notice,
         accepted_session_ref,
         claude_fresh_prealloc,
         pane_identity,
@@ -1365,10 +1564,20 @@ async fn settle_gated_create(inputs: GatedSettleInputs) -> Result<TerminalSpawnR
             // `Start` would hard-error `StartIntentUnsupported`,
             // cli_launch.rs:496-510). Mirrors the WS door
             // (freshell-ws/src/terminal.rs fresh-claude special case).
+            //
+            // Door 3 (resume-validation): the non-prealloc arm threads the
+            // gate outcome through `GatedSettleInputs.launch_intent` — the
+            // gate-fired claude fallback's minted fresh id must launch with
+            // `Start` (the claude spec's `createSessionArgs`); every
+            // non-gated `Some(resume_session_id)` is still a genuine resume
+            // (accepted `sessionRef` or legacy `resumeSessionId`), exactly
+            // as before. (A gate-fired claude fallback yields `Start` via
+            // the outcome anyway; the prealloc override only matters for
+            // main's no-resume-id mint path.)
             launch_intent: if claude_fresh_prealloc {
                 LaunchIntent::Start
             } else {
-                LaunchIntent::Resume
+                launch_intent
             },
             // Managed codex (flag ON): model/sandbox/permissionMode route through the
             // PLAN, not argv (legacy's spawn providerSettings for codex carry ONLY
@@ -1847,6 +2056,15 @@ async fn settle_gated_create(inputs: GatedSettleInputs) -> Result<TerminalSpawnR
     if let Some(cd) = body.get("codexDurability").filter(|v| v.is_object()) {
         pane_content["codexDurability"] = cd.clone();
     }
+    // Door 3 (resume-validation): the gate-fired stale-resume notice rides
+    // the returned `paneContent` as `reconcileNotice` — the SAME key the
+    // frozen client's reconcile chip/xterm rendering already consumes, so no
+    // client change. (Accepted caveat: a hidden/background tab defers the
+    // render until a later visible attach pass — the notice is preserved in
+    // pane content, never dropped.)
+    if let Some(notice) = &resume_notice {
+        pane_content["reconcileNotice"] = json!(notice);
+    }
     // `paneContent` sessionRef/resumeSessionId, still mutually exclusive like
     // `router.ts:762-771` -- but with the EDEV-07 upgrade over legacy: a legacy
     // `resumeSessionId` for a known session provider is PROMOTED to the
@@ -4660,6 +4878,416 @@ mod tests {
 
     // ── REST spawn-gate tests (kata enn3) ──────────────────────────────────
 
+    // ── Door 3: REST create resume validation (resume-validation Task 8) ────
+
+    fn probe_answering(
+        existence: freshell_platform::resume_gate::ResumeExistence,
+        ever_on_disk: bool,
+    ) -> freshell_platform::resume_gate::ResumeProbeFn {
+        std::sync::Arc::new(move |_provider: &str, _sid: &str| {
+            freshell_platform::resume_gate::ResumeProbeAnswer {
+                existence,
+                ever_observed_on_disk: ever_on_disk,
+            }
+        })
+    }
+
+    #[test]
+    fn rest_resume_amplifier_absent_mints_fresh_and_notices() {
+        use freshell_platform::resume_gate::ResumeExistence;
+        let probe = probe_answering(ResumeExistence::Absent, true);
+        let out = validate_rest_resume(
+            "amplifier",
+            Some("stale-amp".into()),
+            LaunchIntent::Resume,
+            Some(&probe),
+        );
+        assert_ne!(out.resume_session_id.as_deref(), Some("stale-amp"));
+        assert!(out.resume_session_id.is_some());
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-amp"));
+        assert!(out.notice.as_deref().unwrap().contains("stale-amp"));
+    }
+
+    #[test]
+    fn rest_resume_without_probe_is_passthrough() {
+        let out = validate_rest_resume(
+            "amplifier",
+            Some("anything".into()),
+            LaunchIntent::Resume,
+            None,
+        );
+        assert_eq!(out.resume_session_id.as_deref(), Some("anything"));
+        assert!(out.stale_session_id.is_none());
+        assert!(out.notice.is_none());
+    }
+
+    #[test]
+    fn rest_resume_unknown_and_present_fail_open() {
+        use freshell_platform::resume_gate::ResumeExistence;
+        for e in [ResumeExistence::Unknown, ResumeExistence::Present] {
+            let probe = probe_answering(e, false);
+            let out = validate_rest_resume(
+                "opencode",
+                Some("ses_x".into()),
+                LaunchIntent::Resume,
+                Some(&probe),
+            );
+            assert_eq!(out.resume_session_id.as_deref(), Some("ses_x"));
+            assert!(out.notice.is_none());
+        }
+    }
+
+    #[test]
+    fn rest_resume_codex_absent_drops_resume() {
+        use freshell_platform::resume_gate::ResumeExistence;
+        let probe = probe_answering(ResumeExistence::Absent, true);
+        let out = validate_rest_resume(
+            "codex",
+            Some("stale-cx".into()),
+            LaunchIntent::Resume,
+            Some(&probe),
+        );
+        assert!(out.resume_session_id.is_none());
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-cx"));
+    }
+
+    #[test]
+    fn rest_resume_minted_claude_id_is_v4_and_plausible() {
+        // Pins the Uuid::new_v4() requirement (V9): is_canonical_claude_
+        // session_id enforces version 1..=5 + RFC-4122 variant — v7/nil
+        // would fail and the healed pane_content stamping would silently
+        // fall through.
+        use freshell_platform::resume_gate::ResumeExistence;
+        let probe = probe_answering(ResumeExistence::Absent, true);
+        let out = validate_rest_resume(
+            "claude",
+            Some("stale-cl".into()),
+            LaunchIntent::Resume,
+            Some(&probe),
+        );
+        assert_eq!(out.launch_intent, LaunchIntent::Start);
+        let minted = out.resume_session_id.expect("fresh claude id minted");
+        assert!(plausible_resume_session_id("claude", &minted));
+    }
+
+    /// Invocation counter + callback pair returned by `counting_on_stale_resume`.
+    type CountingStaleResume = (
+        std::sync::Arc<std::sync::atomic::AtomicUsize>,
+        std::sync::Arc<dyn Fn(&str, &str) + Send + Sync>,
+    );
+
+    /// Counting `on_stale_resume` fake: the Bound ledger row of a running
+    /// session must survive, so the live-session tests pin "never invoked".
+    fn counting_on_stale_resume() -> CountingStaleResume {
+        let count = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let cb = {
+            let count = std::sync::Arc::clone(&count);
+            std::sync::Arc::new(move |_provider: &str, _sid: &str| {
+                count.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            }) as std::sync::Arc<dyn Fn(&str, &str) + Send + Sync>
+        };
+        (count, cb)
+    }
+
+    /// A recording claude spec with the REAL manifest's `createSessionArgs`
+    /// (`extensions/claude-code/freshell.json:11`) so the gate's `Start` +
+    /// minted-id fallback resolves (V9 — no `StartIntentUnsupported`).
+    fn claude_recording_cli_spec_with_start(
+        argv_file: &std::path::Path,
+    ) -> freshell_platform::CliCommandSpec {
+        let mut spec = recording_cli_spec("claude", argv_file);
+        spec.create_session_args = Some(vec![
+            "--session-id".to_string(),
+            "{{sessionId}}".to_string(),
+        ]);
+        spec
+    }
+
+    /// Gate fires (claude, positive absence): the built pane_content carries
+    /// the notice AND the HEALED ref — `sessionRef.sessionId` equals the
+    /// minted fresh id, NOT the stale wire ref (pins the stale-ref guard's
+    /// fall-through to the minted-ref stamping branch).
+    #[tokio::test]
+    async fn rest_gate_fire_heals_pane_content_ref_and_injects_notice() {
+        const STALE: &str = "99999999-8888-4777-8666-555555555555";
+        let argv_file = unique_argv_file("door3-claude-heal");
+        let (stale_count, on_stale) = counting_on_stale_resume();
+        let state = state_with_registry()
+            .with_cli_commands(Arc::new(vec![claude_recording_cli_spec_with_start(
+                &argv_file,
+            )]))
+            .with_resume_probe(probe_answering(
+                freshell_platform::resume_gate::ResumeExistence::Absent,
+                true,
+            ))
+            .with_on_stale_resume(on_stale);
+        let registry = state.terminal_registry.clone().unwrap();
+        let mut rx = state.broadcast_tx.subscribe();
+
+        let (status, body) = post(
+            app(state),
+            "/api/tabs",
+            json!({
+                "mode": "claude",
+                "cwd": std::env::temp_dir().to_string_lossy(),
+                "sessionRef": { "provider": "claude", "sessionId": STALE },
+            }),
+            true,
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK, "{body}");
+        let terminal_id = body["data"]["terminalId"].as_str().unwrap().to_string();
+
+        let frame = rx.recv().await.expect("ui.command frame broadcast");
+        let msg: Value = serde_json::from_str(&frame).unwrap();
+        let pane_content = &msg["payload"]["paneContent"];
+        let notice = pane_content["reconcileNotice"]
+            .as_str()
+            .expect("gate fire injects reconcileNotice");
+        assert!(
+            notice.contains(STALE),
+            "notice names the stale id: {notice}"
+        );
+        let healed = pane_content["sessionRef"]["sessionId"]
+            .as_str()
+            .expect("healed sessionRef stamped");
+        assert_ne!(healed, STALE, "stale wire ref must never be stamped");
+        assert!(
+            plausible_resume_session_id("claude", healed),
+            "healed ref is a canonical claude id: {healed}"
+        );
+        assert_eq!(
+            stale_count.load(std::sync::atomic::Ordering::SeqCst),
+            1,
+            "on_stale_resume invoked exactly once"
+        );
+        // The claude fallback launches with Start: createSessionArgs argv,
+        // carrying the MINTED id (never the stale one).
+        let argv = read_argv_file_eventually(&argv_file).await;
+        assert!(argv.contains("--session-id"), "Start argv: {argv}");
+        assert!(argv.contains(healed), "minted id in argv: {argv}");
+        assert!(
+            !argv.contains(STALE),
+            "stale id must not reach argv: {argv}"
+        );
+
+        registry.kill(&terminal_id);
+        let _ = std::fs::remove_file(&argv_file);
+    }
+
+    /// PIN 2 coupling (main #584 × Door 3): a gate-fired claude fallback
+    /// carries a gate-MINTED `resume_session_id`, so main's
+    /// `should_preallocate_fresh_claude` (keyed on "no resume id") returns
+    /// false — without the outcome's `claude_fresh_prealloc` fold the minted
+    /// fresh pane silently skips the pre-spawn ledger binding every natural
+    /// fresh claude create gets.
+    #[tokio::test(flavor = "multi_thread")]
+    async fn rest_gate_fired_claude_fallback_preallocates_fresh_identity() {
+        // Same arrangement as rest_gate_fire_heals_pane_content_ref_and_
+        // injects_notice (claude REST create carrying a stale resume id,
+        // probe answers Absent + ever_observed_on_disk=true, gate fires and
+        // mints a fresh id) — PLUS the #584 identity seam wired so the PIN 2
+        // write is observable (skipped entirely when no binder is wired).
+        const STALE: &str = "99999999-8888-4777-8666-555555555555";
+        let argv_file = unique_argv_file("door3-claude-prealloc");
+        let (stale_count, on_stale) = counting_on_stale_resume();
+        let binder = std::sync::Arc::new(RecordingBinder::default());
+        let state = state_with_registry()
+            .with_cli_commands(Arc::new(vec![claude_recording_cli_spec_with_start(
+                &argv_file,
+            )]))
+            .with_resume_probe(probe_answering(
+                freshell_platform::resume_gate::ResumeExistence::Absent,
+                true,
+            ))
+            .with_on_stale_resume(on_stale)
+            .with_pane_identity_binder(binder.clone());
+        let registry = state.terminal_registry.clone().unwrap();
+        let mut rx = state.broadcast_tx.subscribe();
+
+        let (status, body) = post(
+            app(state),
+            "/api/tabs",
+            json!({
+                "mode": "claude",
+                "cwd": std::env::temp_dir().to_string_lossy(),
+                "sessionRef": { "provider": "claude", "sessionId": STALE },
+            }),
+            true,
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK, "{body}");
+        let tid = body["data"]["terminalId"].as_str().unwrap().to_string();
+        assert_eq!(
+            stale_count.load(std::sync::atomic::Ordering::SeqCst),
+            1,
+            "precondition: the gate fired"
+        );
+
+        // Extract the minted id from the healed pane content, as the
+        // neighbor test does.
+        let frame = rx.recv().await.expect("ui.command frame broadcast");
+        let msg: Value = serde_json::from_str(&frame).unwrap();
+        let minted = msg["payload"]["paneContent"]["sessionRef"]["sessionId"]
+            .as_str()
+            .expect("healed sessionRef stamped")
+            .to_string();
+        assert_ne!(minted, STALE, "stale wire ref must never be stamped");
+
+        // The gate-minted fresh claude pane must get the same PIN 2
+        // pre-spawn treatment as a natural fresh claude create.
+        let events = binder.events();
+        let prespawn = events
+            .iter()
+            .position(|e| e == &format!("prespawn:{tid}:{minted}"))
+            .unwrap_or_else(|| {
+                panic!(
+                    "gate-minted fresh claude id must receive the PIN 2 pre-spawn \
+                     identity binding: {events:?}"
+                )
+            });
+        let register = events
+            .iter()
+            .position(|e| e == &format!("register:{tid}:claude:{minted}"))
+            .unwrap_or_else(|| panic!("register event missing: {events:?}"));
+        assert!(
+            prespawn < register,
+            "PIN 2: durability before registration: {events:?}"
+        );
+        assert!(
+            !events.iter().any(|e| e.starts_with("delete:")),
+            "no failure-delete on success: {events:?}"
+        );
+
+        registry.kill(&tid);
+        let _ = std::fs::remove_file(&argv_file);
+    }
+
+    /// MANDATORY liveness precondition, arm 1 (registry): a REGISTRY-LIVE
+    /// candidate skips the gate entirely — the D7-REST guard then issues its
+    /// loud reject exactly as today, `on_stale_resume` is never invoked (the
+    /// Bound ledger row of the running session survives), and no notice is
+    /// injected. Fails RED if the gate runs before the liveness check.
+    #[tokio::test]
+    async fn rest_gate_skips_registry_live_candidate_d7_reject_still_fires() {
+        let argv_file = unique_argv_file("door3-live-skip");
+        let (stale_count, on_stale) = counting_on_stale_resume();
+        let state = state_with_registry()
+            .with_cli_commands(Arc::new(vec![recording_cli_spec("claude", &argv_file)]))
+            .with_resume_probe(probe_answering(
+                freshell_platform::resume_gate::ResumeExistence::Absent,
+                true,
+            ))
+            .with_on_stale_resume(on_stale);
+        let registry = state.terminal_registry.clone().unwrap();
+        forge_live_owner(&registry, "t-live-owner-door3");
+        let rows_before = registry.identity_probe_rows().len();
+
+        let (status, body) = post(
+            app(state),
+            "/api/tabs",
+            json!({
+                "mode": "claude",
+                "cwd": std::env::temp_dir().to_string_lossy(),
+                "sessionRef": { "provider": "claude", "sessionId": LIVE_SESSION },
+            }),
+            true,
+        )
+        .await;
+
+        // The D7-REST loud reject, NOT a gate-fired fresh spawn.
+        assert_eq!(status, StatusCode::CONFLICT, "{body}");
+        assert_eq!(body["code"], json!("RESTORE_UNAVAILABLE"), "{body}");
+        assert_eq!(
+            stale_count.load(std::sync::atomic::Ordering::SeqCst),
+            0,
+            "on_stale_resume must never fire for a live session"
+        );
+        assert_eq!(
+            registry.identity_probe_rows().len(),
+            rows_before,
+            "no new terminal (no gate-fired fresh spawn)"
+        );
+
+        registry.kill("t-live-owner-door3");
+    }
+
+    /// MANDATORY liveness precondition, arm 2 (sidecar — mirrors Task 6 case
+    /// 6): the registry holds NO row for the candidate, but a fresh-agent
+    /// sidecar owns it live. The registry-live test above stays GREEN if this
+    /// arm is dropped, so it cannot pin it. The create must proceed UNCHANGED
+    /// (resume id reaches CliLaunchInputs intact — today's behavior for a
+    /// sidecar-live resume; no D7-REST reject since the registry has no row),
+    /// `on_stale_resume` never invoked, no notice injected.
+    #[tokio::test]
+    async fn rest_gate_skips_sidecar_live_candidate_create_proceeds_unchanged() {
+        // DEV-0006 S5.e: the managed-launch default is ON; this suite exercises the
+        // plain-CLI codex path (recording CLI spec, no app-server), so pin OFF.
+        std::env::set_var("FRESHELL_CODEX_MANAGED_LAUNCH", "0");
+        const SIDECAR_LIVE: &str = "stale-cx";
+        let argv_file = unique_argv_file("door3-sidecar-skip");
+        let (stale_count, on_stale) = counting_on_stale_resume();
+        let sidecar: crate::SidecarLivenessProbe =
+            std::sync::Arc::new(move |mode: &str, sid: &str| {
+                let live = mode == "codex" && sid == SIDECAR_LIVE;
+                Box::pin(async move { live })
+                    as std::pin::Pin<Box<dyn std::future::Future<Output = bool> + Send>>
+            });
+        let state = state_with_registry()
+            .with_cli_commands(Arc::new(vec![recording_cli_spec("codex", &argv_file)]))
+            .with_resume_probe(probe_answering(
+                freshell_platform::resume_gate::ResumeExistence::Absent,
+                true,
+            ))
+            .with_on_stale_resume(on_stale)
+            .with_sidecar_liveness(sidecar);
+        let registry = state.terminal_registry.clone().unwrap();
+        let mut rx = state.broadcast_tx.subscribe();
+
+        let (status, body) = post(
+            app(state),
+            "/api/tabs",
+            json!({
+                "mode": "codex",
+                "cwd": std::env::temp_dir().to_string_lossy(),
+                "sessionRef": { "provider": "codex", "sessionId": SIDECAR_LIVE },
+            }),
+            true,
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK, "{body}");
+        let terminal_id = body["data"]["terminalId"].as_str().unwrap().to_string();
+
+        // The resume id reaching CliLaunchInputs is STILL the live one — the
+        // registry row records it, and no gate-fired fresh spawn happened.
+        let entry = registry
+            .directory()
+            .into_iter()
+            .find(|e| e.terminal_id == terminal_id)
+            .expect("directory entry");
+        assert_eq!(entry.resume_session_id.as_deref(), Some(SIDECAR_LIVE));
+        assert_eq!(
+            stale_count.load(std::sync::atomic::Ordering::SeqCst),
+            0,
+            "on_stale_resume must never fire for a sidecar-live session"
+        );
+        let frame = rx.recv().await.expect("ui.command frame broadcast");
+        let msg: Value = serde_json::from_str(&frame).unwrap();
+        let pane_content = &msg["payload"]["paneContent"];
+        assert!(
+            pane_content.get("reconcileNotice").is_none(),
+            "no notice for a skipped (live) candidate: {pane_content}"
+        );
+        assert_eq!(
+            pane_content["sessionRef"],
+            json!({ "provider": "codex", "sessionId": SIDECAR_LIVE }),
+            "wire ref stamped unchanged: {pane_content}"
+        );
+
+        registry.kill(&terminal_id);
+        let _ = std::fs::remove_file(&argv_file);
+    }
+
     fn shell_create_body() -> Value {
         json!({
             "mode": "shell",
diff --git a/crates/freshell-platform/src/lib.rs b/crates/freshell-platform/src/lib.rs
index 98bfc113c..5d2054cc9 100644
--- a/crates/freshell-platform/src/lib.rs
+++ b/crates/freshell-platform/src/lib.rs
@@ -56,6 +56,7 @@ pub mod detect;
 pub mod mcp_inject;
 pub mod opencode_plugin;
 pub mod path;
+pub mod resume_gate;
 pub mod spawn;
 
 // ---- Live-process modules (Phase 3, step 14) — builders + injected CommandRunner ----
diff --git a/crates/freshell-platform/src/resume_gate.rs b/crates/freshell-platform/src/resume_gate.rs
new file mode 100644
index 000000000..ace5a442d
--- /dev/null
+++ b/crates/freshell-platform/src/resume_gate.rs
@@ -0,0 +1,150 @@
+//! Pre-spawn resume validation policy (resume-validation feature).
+//!
+//! Pure decision logic: given a provider and a disk-existence answer, decide
+//! whether a cached resume id may be passed to the CLI or the pane must spawn
+//! fresh. IO-free by design (mirrors `cli_launch`'s purity rule); callers map
+//! their probe answers into [`ResumeExistence`].
+//!
+//! FAIL-OPEN INVARIANT: only a POSITIVE "store readable, session definitively
+//! absent" returns [`ResumeGateDecision::SpawnFresh`]. Unknown/unreadable
+//! stores, unvalidated providers (gemini, kimi, third-party), and the claude
+//! zero-turn carve-out all Proceed (today's behavior).
+
+use std::sync::Arc;
+
+/// Providers whose on-disk store the existence probe knows how to read.
+/// MUST stay a subset of `freshell-server`'s `KNOWN_PROVIDERS`: the probe's
+/// contract maps unknown providers to `Absent`, so callers must check this
+/// list BEFORE consulting the probe.
+pub const VALIDATED_PROVIDERS: [&str; 4] = ["claude", "codex", "opencode", "amplifier"];
+
+pub fn provider_validated(provider: &str) -> bool {
+    VALIDATED_PROVIDERS.contains(&provider)
+}
+
+/// Caller-mapped existence answer. `ProviderUnavailable` maps to `Unknown`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ResumeExistence {
+    Present,
+    Absent,
+    Unknown,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ResumeGateDecision {
+    /// Pass the resume id through unchanged (validated present, or fail-open).
+    Proceed,
+    /// Definitively absent: drop the resume, spawn fresh, notify, retire.
+    SpawnFresh,
+}
+
+pub fn evaluate_resume_gate(
+    provider: &str,
+    existence: ResumeExistence,
+    ever_observed_on_disk: bool,
+) -> ResumeGateDecision {
+    if !provider_validated(provider) {
+        return ResumeGateDecision::Proceed;
+    }
+    match existence {
+        ResumeExistence::Present | ResumeExistence::Unknown => ResumeGateDecision::Proceed,
+        ResumeExistence::Absent => {
+            // Zero-turn carve-out: a freshell-minted claude session that never
+            // conversed has no transcript on disk yet (mirrors
+            // freshell-ws/reconcile.rs claude carve-out, deliberately more
+            // fail-open: no ledger-bound requirement).
+            //
+            // Amplifier deliberately gets NO such carve-out (plan AD-5): a
+            // never-used stub GC'd at terminal exit is indistinguishable on
+            // disk from the incident's stale id, and the gate-fired fresh
+            // spawn is an equivalent empty session for a never-typed pane.
+            if provider == "claude" && !ever_observed_on_disk {
+                ResumeGateDecision::Proceed
+            } else {
+                ResumeGateDecision::SpawnFresh
+            }
+        }
+    }
+}
+
+/// The operator-visible notice line. MUST name the stale id (spec requirement).
+pub fn stale_resume_notice(provider: &str, stale_id: &str) -> String {
+    format!(
+        "Saved {provider} session {stale_id} could not be found on disk — started a fresh session instead."
+    )
+}
+
+/// Injection shape for crates that cannot depend on `freshell-ws`'s probe
+/// trait (freshell-freshagent): one call answering both existence and
+/// disk-history for `(provider, session_id)`.
+pub struct ResumeProbeAnswer {
+    pub existence: ResumeExistence,
+    pub ever_observed_on_disk: bool,
+}
+
+pub type ResumeProbeFn = Arc<dyn Fn(&str, &str) -> ResumeProbeAnswer + Send + Sync>;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ResumeExistence::*;
+    use ResumeGateDecision::*;
+
+    #[test]
+    fn amplifier_absent_spawns_fresh() {
+        // THE incident case: stale amplifier id with no session dir anywhere.
+        // Deliberately ALSO covers the never-used-stub-GC'd-at-exit shape —
+        // indistinguishable on disk from the incident (plan AD-5).
+        assert_eq!(evaluate_resume_gate("amplifier", Absent, false), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("amplifier", Absent, true), SpawnFresh);
+    }
+
+    #[test]
+    fn codex_and_opencode_absent_spawn_fresh() {
+        assert_eq!(evaluate_resume_gate("codex", Absent, true), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("opencode", Absent, true), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("codex", Absent, false), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("opencode", Absent, false), SpawnFresh);
+    }
+
+    #[test]
+    fn claude_zero_turn_carve_out_proceeds() {
+        // Never observed on disk => could be a legit zero-turn session. Fail open.
+        assert_eq!(evaluate_resume_gate("claude", Absent, false), Proceed);
+    }
+
+    #[test]
+    fn claude_absent_but_previously_on_disk_spawns_fresh() {
+        // Transcript existed once and is gone now: positive absence.
+        assert_eq!(evaluate_resume_gate("claude", Absent, true), SpawnFresh);
+    }
+
+    #[test]
+    fn present_and_unknown_always_proceed() {
+        for p in VALIDATED_PROVIDERS {
+            assert_eq!(evaluate_resume_gate(p, Present, false), Proceed);
+            assert_eq!(evaluate_resume_gate(p, Unknown, false), Proceed);
+            assert_eq!(evaluate_resume_gate(p, Present, true), Proceed);
+            assert_eq!(evaluate_resume_gate(p, Unknown, true), Proceed);
+        }
+    }
+
+    #[test]
+    fn unvalidated_providers_never_blocked() {
+        // gemini/kimi have no resumeArgs and are outside KNOWN_PROVIDERS;
+        // the probe would answer Absent for them — the gate must not care.
+        for p in ["gemini", "kimi", "some-third-party-ext", "shell"] {
+            assert_eq!(evaluate_resume_gate(p, Absent, false), Proceed);
+            assert!(!provider_validated(p));
+        }
+    }
+
+    #[test]
+    fn notice_names_the_stale_id() {
+        let n = stale_resume_notice("amplifier", "8dab420a-f76b-407c-bcbe-dfb2a971c2e1");
+        assert!(n.contains("amplifier"));
+        assert!(n.contains("8dab420a-f76b-407c-bcbe-dfb2a971c2e1"));
+        assert!(n.contains("could not be found"));
+        assert!(n.contains("fresh session"));
+    }
+}
diff --git a/crates/freshell-protocol/src/server_messages.rs b/crates/freshell-protocol/src/server_messages.rs
index f1b50ae75..758f279e1 100644
--- a/crates/freshell-protocol/src/server_messages.rs
+++ b/crates/freshell-protocol/src/server_messages.rs
@@ -967,6 +967,11 @@ pub struct TerminalCreated {
     pub clear_codex_durability: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub cwd: Option<String>,
+    /// Resume-validation feature: operator-visible notice set when the server
+    /// dropped a stale resume id and spawned fresh. The client writes it into
+    /// the pane's xterm. Optional/additive — Node never sets it.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub notice: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub restore_error: Option<TerminalRestoreError>,
     #[serde(skip_serializing_if = "Option::is_none")]
diff --git a/crates/freshell-protocol/tests/roundtrip.rs b/crates/freshell-protocol/tests/roundtrip.rs
index 004b34d9c..2188393b6 100644
--- a/crates/freshell-protocol/tests/roundtrip.rs
+++ b/crates/freshell-protocol/tests/roundtrip.rs
@@ -522,3 +522,56 @@ fn terminal_auto_resume_cancel_roundtrips() {
     }
     assert_eq!(serde_json::to_value(&msg).unwrap(), json);
 }
+
+#[test]
+fn terminal_created_notice_is_optional_and_additive() {
+    // Absent => key omitted (wire-compatible with the frozen client).
+    let created = TerminalCreated {
+        created_at: 1_700_000_000_000,
+        request_id: "req-1".into(),
+        terminal_id: "t1".into(),
+        clear_codex_durability: None,
+        cwd: None,
+        restore_error: None,
+        session_ref: None,
+        notice: None,
+    };
+    let json = serde_json::to_value(ServerMessage::TerminalCreated(created.clone())).unwrap();
+    assert!(json.get("notice").is_none());
+
+    // Present => serialized verbatim.
+    let mut with_notice = created;
+    with_notice.notice = Some(
+        "Saved amplifier session X could not be found on disk — started a fresh session instead."
+            .to_string(),
+    );
+    let json = serde_json::to_value(ServerMessage::TerminalCreated(with_notice)).unwrap();
+    assert_eq!(
+        json["notice"],
+        "Saved amplifier session X could not be found on disk — started a fresh session instead."
+    );
+}
+
+#[test]
+fn terminal_created_roundtrips_with_and_without_notice() {
+    // Base shape: notice omitted — byte-identical to today's frame on the wire.
+    let base = r#"{"type":"terminal.created","createdAt":1700000000000,"requestId":"req-1","terminalId":"t1"}"#;
+    match server_roundtrip(base, "terminal.created") {
+        ServerMessage::TerminalCreated(created) => {
+            assert_eq!(created.notice, None);
+        }
+        other => panic!("expected TerminalCreated, got {other:?}"),
+    }
+    // Resume-validation shape: the fresh-spawn notice must conform to the
+    // frozen contract too.
+    let with_notice = r#"{"type":"terminal.created","createdAt":1700000000000,"requestId":"req-1","terminalId":"t1","notice":"Saved amplifier session 8dab420a-f76b-407c-bcbe-dfb2a971c2e1 could not be found on disk — started a fresh session instead."}"#;
+    match server_roundtrip(with_notice, "terminal.created") {
+        ServerMessage::TerminalCreated(created) => {
+            assert_eq!(
+                created.notice.as_deref(),
+                Some("Saved amplifier session 8dab420a-f76b-407c-bcbe-dfb2a971c2e1 could not be found on disk — started a fresh session instead.")
+            );
+        }
+        other => panic!("expected TerminalCreated, got {other:?}"),
+    }
+}
diff --git a/crates/freshell-server/src/existence.rs b/crates/freshell-server/src/existence.rs
index 5475e9e96..2975a3162 100644
--- a/crates/freshell-server/src/existence.rs
+++ b/crates/freshell-server/src/existence.rs
@@ -73,6 +73,14 @@ pub enum OpencodeDbAnswer {
 /// `claude_transcript_locator` above.
 pub type OpencodeSessionLocator = Arc<dyn Fn(&str) -> OpencodeDbAnswer + Send + Sync>;
 
+// Resume-validation (plan Task 3): the amplifier/codex by-id locators live in
+// a focused sibling module; re-exported so the probe's whole locator surface
+// stays addressable as `existence::*` (main.rs wiring, tests).
+pub use crate::existence_by_id::{
+    amplifier_dir_locator, codex_rollout_existence_locator, AmplifierSessionLocator, ByIdAnswer,
+    CodexRolloutExistenceLocator,
+};
+
 pub struct IndexExistenceProbe {
     index: Arc<SessionIndex>,
     /// `provider:sessionId` keys ever seen in ANY snapshot this boot.
@@ -107,6 +115,20 @@ pub struct IndexExistenceProbe {
     /// finalized. `None` (tests, callers that never set it) keeps the pure
     /// index answer.
     opencode_session_locator: Option<OpencodeSessionLocator>,
+    /// Amplifier by-id fallback (resume-validation): the warm snapshot can be
+    /// STALE — a session created moments before a restart may be missing —
+    /// and it is `None` every boot while restore-time creates race the
+    /// detached sweep. When set, a warm-index Absent for provider
+    /// "amplifier" is re-checked by id on disk, and the COLD-index answer
+    /// runs the same cheap check (the incident scenario). `None` keeps the
+    /// pure index answer.
+    amplifier_session_locator: Option<AmplifierSessionLocator>,
+    /// Codex by-id fallback (resume-validation): warm-Absent adjudication
+    /// ONLY, and only from `exists_for_gate` — the rollout walk is ~1s on a
+    /// real store, so plain `exists()` (sync reconcile path, ~250ms budget)
+    /// and the cold path never consult it (AD-4: cold codex stays
+    /// `Unknown`). `None` keeps the pure index answer.
+    codex_rollout_locator: Option<CodexRolloutExistenceLocator>,
 }
 
 impl IndexExistenceProbe {
@@ -122,6 +144,8 @@ impl IndexExistenceProbe {
             provider_roots,
             claude_transcript_locator: None,
             opencode_session_locator: None,
+            amplifier_session_locator: None,
+            codex_rollout_locator: None,
         }
     }
 
@@ -140,6 +164,22 @@ impl IndexExistenceProbe {
         self
     }
 
+    /// Builder-style: install the by-id disk fallback for amplifier (see the
+    /// field doc). Chained at the single production construction site in
+    /// main.rs.
+    pub fn with_amplifier_session_locator(mut self, locator: AmplifierSessionLocator) -> Self {
+        self.amplifier_session_locator = Some(locator);
+        self
+    }
+
+    /// Builder-style: install the by-id rollout fallback for codex (see the
+    /// field doc). Chained at the single production construction site in
+    /// main.rs.
+    pub fn with_codex_rollout_locator(mut self, locator: CodexRolloutExistenceLocator) -> Self {
+        self.codex_rollout_locator = Some(locator);
+        self
+    }
+
     /// Kick a detached background refresh (never blocks the caller). No-op
     /// outside a tokio runtime — the WS handler always runs inside one.
     fn kick_refresh(&self) {
@@ -200,6 +240,47 @@ impl SessionExistenceProbe for IndexExistenceProbe {
                 {
                     return SessionExistence::ProviderUnavailable;
                 }
+                // Cold-index coverage (resume-validation, A1): the snapshot
+                // is None every boot and the warm sweep is a detached spawn —
+                // restore-time creates race it. amplifier + claude have CHEAP
+                // direct by-id locators; run them so the gate still fires in
+                // the incident scenario. codex/opencode stay Unknown when
+                // cold (AD-4: the codex walk is ~1 s on a real store —
+                // warm-Absent adjudication only).
+                if provider == "amplifier" {
+                    if let Some(locator) = &self.amplifier_session_locator {
+                        return match locator(session_id) {
+                            ByIdAnswer::Present => {
+                                // On-disk observation — feed the monotone
+                                // observed-set (module-doc invariant).
+                                self.observed
+                                    .lock()
+                                    .expect("observed set lock")
+                                    .insert(format!("{provider}:{session_id}"));
+                                SessionExistence::Present
+                            }
+                            ByIdAnswer::Absent => SessionExistence::Absent,
+                            ByIdAnswer::Unreadable => SessionExistence::Unknown,
+                        };
+                    }
+                }
+                if provider == "claude" {
+                    // Reuse the EXISTING claude transcript locator (raw-file
+                    // check — cheap), same mapping as the warm fallback
+                    // below: hit => Present, clean miss => Absent (the
+                    // Option shape has no error channel).
+                    if let Some(locator) = &self.claude_transcript_locator {
+                        return if locator(session_id).is_some() {
+                            self.observed
+                                .lock()
+                                .expect("observed set lock")
+                                .insert(format!("{provider}:{session_id}"));
+                            SessionExistence::Present
+                        } else {
+                            SessionExistence::Absent
+                        };
+                    }
+                }
                 SessionExistence::Unknown
             }
             Some(items) => {
@@ -271,6 +352,38 @@ impl SessionExistenceProbe for IndexExistenceProbe {
                         }
                     }
                 }
+                // Amplifier by-id fallback (resume-validation): a STALE warm
+                // snapshot must never adjudicate a real session absent — a
+                // session created moments before a restart may be missing
+                // from the snapshot, and `peek()` serves snapshots
+                // regardless of TTL. Same adjudication point as the claude/
+                // opencode fallbacks above: only reached when the snapshot
+                // would otherwise answer Absent. The scan is CHEAP (one
+                // read_dir + one metadata per project slug), so it stays on
+                // this sync reconcile-consulted path. After this arm,
+                // `Absent` for claude/opencode/amplifier is POSITIVE
+                // absence; codex `Absent` from `exists()` is SNAPSHOT-ONLY
+                // (non-positive) — the ~1s rollout walk lives in
+                // `exists_for_gate` (below), so positive codex absence is
+                // the gate variant's job.
+                if provider == "amplifier" {
+                    if let Some(locator) = &self.amplifier_session_locator {
+                        match locator(session_id) {
+                            ByIdAnswer::Present => {
+                                // A fallback hit is an on-disk observation:
+                                // feed the monotone observed-set (module-doc
+                                // invariant), same as the arms above.
+                                self.observed
+                                    .lock()
+                                    .expect("observed set lock")
+                                    .insert(format!("{provider}:{session_id}"));
+                                return SessionExistence::Present;
+                            }
+                            ByIdAnswer::Unreadable => return SessionExistence::Unknown,
+                            ByIdAnswer::Absent => {}
+                        }
+                    }
+                }
                 SessionExistence::Absent
             }
         }
@@ -296,6 +409,38 @@ impl SessionExistenceProbe for IndexExistenceProbe {
             .expect("observed set lock")
             .contains(&format!("{provider}:{session_id}"))
     }
+
+    /// Gate-caller variant (trait doc): `exists()` plus the EXPENSIVE codex
+    /// by-id rollout walk (~1s on a real store) on a warm-Absent answer.
+    /// The walk lives HERE and not in `exists()` because `exists()` is
+    /// consulted inline on the sync reconcile path, whose IO discipline is
+    /// ~250ms per consult (see `opencode_db_locator`); gate callers run this
+    /// variant inside `tokio::task::spawn_blocking` (A13: never inline on
+    /// the async runtime). AD-4 is preserved exactly: cold-index codex
+    /// answers `Unknown` from `exists()`, and the walk only runs on
+    /// `Absent`, so it still NEVER runs on the cold path.
+    fn exists_for_gate(&self, provider: &str, session_id: &str) -> SessionExistence {
+        let base = self.exists(provider, session_id);
+        if base == SessionExistence::Absent && provider == "codex" {
+            if let Some(locator) = &self.codex_rollout_locator {
+                return match locator(session_id) {
+                    ByIdAnswer::Present => {
+                        // A fallback hit is an on-disk observation: feed the
+                        // monotone observed-set (module-doc invariant), same
+                        // as the fallback arms in `exists()`.
+                        self.observed
+                            .lock()
+                            .expect("observed set lock")
+                            .insert(format!("{provider}:{session_id}"));
+                        SessionExistence::Present
+                    }
+                    ByIdAnswer::Unreadable => SessionExistence::Unknown,
+                    ByIdAnswer::Absent => SessionExistence::Absent,
+                };
+            }
+        }
+        base
+    }
 }
 
 #[cfg(test)]
@@ -304,7 +449,7 @@ mod tests {
     use freshell_sessions::directory_index::{ClaudeSource, OpencodeSource, SessionSource};
     use std::time::Duration;
 
-    fn temp_claude_home(tag: &str) -> std::path::PathBuf {
+    pub(super) fn temp_claude_home(tag: &str) -> std::path::PathBuf {
         let dir = std::env::temp_dir().join(format!(
             "freshell-existence-{tag}-{}-{}",
             std::process::id(),
@@ -317,7 +462,7 @@ mod tests {
         dir
     }
 
-    fn write_session(claude_home: &std::path::Path, session_id: &str) {
+    pub(super) fn write_session(claude_home: &std::path::Path, session_id: &str) {
         // Minimal claude transcript that passes the R10b cwd gate: one line
         // carrying `cwd` + timestamps; the file stem is the session id.
         let line = serde_json::json!({
@@ -336,7 +481,7 @@ mod tests {
         .expect("write session fixture");
     }
 
-    fn probe_over(home: &std::path::Path) -> (IndexExistenceProbe, Arc<SessionIndex>) {
+    pub(super) fn probe_over(home: &std::path::Path) -> (IndexExistenceProbe, Arc<SessionIndex>) {
         let index = Arc::new(SessionIndex::with_ttl_and_cache_path(
             vec![Arc::new(ClaudeSource::new(home.to_path_buf())) as Arc<dyn SessionSource>],
             Duration::from_millis(50),
@@ -388,7 +533,7 @@ mod tests {
     /// Test locator with the SAME contract as claude_snapshot::locate_transcript
     /// (Some(path) iff the transcript file exists), scoped to the temp home so
     /// tests never touch process-global CLAUDE_* env vars.
-    fn direct_locator_over(home: &std::path::Path) -> ClaudeTranscriptLocator {
+    pub(super) fn direct_locator_over(home: &std::path::Path) -> ClaudeTranscriptLocator {
         let projects = home.join("projects/proj");
         Arc::new(move |session_id: &str| {
             let p = projects.join(format!("{session_id}.jsonl"));
@@ -1291,3 +1436,11 @@ mod tests {
         let _ = std::fs::remove_dir_all(&base);
     }
 }
+
+// Resume-validation (plan Task 3) tests live in a sibling file — this module
+// is already large; same include pattern as
+// freshell-sessions/src/amplifier_stub.rs's `scan_tests`. It reuses the
+// `pub(super)` scaffolding helpers from `tests` above.
+#[cfg(test)]
+#[path = "existence_resume_validation_tests.rs"]
+mod resume_validation_tests;
diff --git a/crates/freshell-server/src/existence_by_id.rs b/crates/freshell-server/src/existence_by_id.rs
new file mode 100644
index 000000000..5b78cb6fa
--- /dev/null
+++ b/crates/freshell-server/src/existence_by_id.rs
@@ -0,0 +1,145 @@
+//! By-id disk locators for the resume-validation feature (plan Task 3):
+//! amplifier session-dir scan + gate-safe codex rollout walk, consumed by
+//! [`crate::existence::IndexExistenceProbe`]'s warm-Absent adjudication and
+//! cold-index coverage. New focused file (not appended to `existence.rs`,
+//! which is already large); `existence.rs` re-exports everything here so the
+//! probe's public surface stays `existence::*`.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// By-id disk answer for the amplifier/codex fallbacks (mirrors
+/// `OpencodeDbAnswer`'s shape). `Unreadable` is LOAD-BEARING: the probe maps
+/// it to `Unknown`, NEVER `Absent` — only positive absence (store readable,
+/// session definitively absent) may answer `Absent`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ByIdAnswer {
+    Present,
+    Absent,
+    Unreadable,
+}
+
+/// Injected by-id amplifier session-dir check (kata 09v1 pattern: the probe
+/// must agree with the attach arm — `amplifier resume <id>` finds the dir
+/// regardless of index state). A closure keeps the probe unit-testable;
+/// precedent: `ClaudeTranscriptLocator`/`OpencodeSessionLocator`.
+pub type AmplifierSessionLocator = Arc<dyn Fn(&str) -> ByIdAnswer + Send + Sync>;
+
+/// Injected by-id codex rollout check (same pattern). Warm-Absent
+/// adjudication ONLY — the walk is ~1s on a real store, so the probe never
+/// runs it on the cold path (AD-4).
+pub type CodexRolloutExistenceLocator = Arc<dyn Fn(&str) -> ByIdAnswer + Send + Sync>;
+
+/// Production amplifier locator: the read-only all-slugs scan of Task 2
+/// (`freshell_sessions::amplifier_stub::session_on_disk` — errors-seen
+/// accumulator, never `.is_dir()`-adjudicated).
+pub fn amplifier_dir_locator(amplifier_home: PathBuf) -> AmplifierSessionLocator {
+    Arc::new(move |session_id: &str| {
+        match freshell_sessions::amplifier_stub::session_on_disk(&amplifier_home, session_id) {
+            freshell_sessions::amplifier_stub::AmplifierSessionAnswer::Present => {
+                ByIdAnswer::Present
+            }
+            freshell_sessions::amplifier_stub::AmplifierSessionAnswer::Absent => ByIdAnswer::Absent,
+            freshell_sessions::amplifier_stub::AmplifierSessionAnswer::Unreadable => {
+                ByIdAnswer::Unreadable
+            }
+        }
+    })
+}
+
+/// Gate-safe tri-state codex rollout walk (resume-validation feature).
+/// Deliberately a NEW walk, NOT a reuse of the fail-soft
+/// `freshell_ws::codex_reconcile::locate_codex_rollout` — that helper
+/// silently converts per-entry IO errors into `None`, which the gate would
+/// read as positive absence (six false-Absent reproductions in V3).
+/// Errors-seen accumulator: `Present` short-circuits; a walk that completes
+/// having seen ANY per-entry error and no hit answers `Unreadable`.
+pub fn codex_rollout_on_disk(sessions_root: &Path, session_id: &str) -> ByIdAnswer {
+    // Root readability is established by read_dir itself: NotFound (parent
+    // readable) => Absent (AD-1); any other error => Unreadable. NOTE:
+    // `fs::metadata(root)` is NOT sufficient — it tests existence, not
+    // readability (a mode-111 root passes metadata but fails read_dir; V3 E3).
+    let mut stack = vec![sessions_root.to_path_buf()];
+    let mut saw_error = false;
+    let mut first_level = true;
+    while let Some(dir) = stack.pop() {
+        let entries = match std::fs::read_dir(&dir) {
+            Ok(entries) => entries,
+            Err(err) if first_level && err.kind() == std::io::ErrorKind::NotFound => {
+                return ByIdAnswer::Absent;
+            }
+            Err(_) if first_level => return ByIdAnswer::Unreadable,
+            Err(_) => {
+                saw_error = true; // unreadable subtree below the root — may hide the rollout
+                continue;
+            }
+        };
+        first_level = false;
+        for entry in entries {
+            let entry = match entry {
+                Ok(entry) => entry,
+                Err(_) => {
+                    saw_error = true; // dropped dir entry (EIO, network fs) — cannot rule out
+                    continue;
+                }
+            };
+            let path = entry.path();
+            // Never `.is_dir()` — false on EACCES (V3 E6).
+            match std::fs::metadata(&path) {
+                Ok(meta) if meta.is_dir() => stack.push(path),
+                Ok(_) => {
+                    let name = entry.file_name();
+                    let name = name.to_string_lossy();
+                    // Filename prefilter: id-in-name (verified convention,
+                    // V2: 4459/4459 real rollouts + codex source constructs
+                    // the name from the id) — accept both `.jsonl` and
+                    // `.jsonl.zst` (future codex rollout compression, V2).
+                    if name.contains(session_id)
+                        && (name.ends_with(".jsonl") || name.ends_with(".jsonl.zst"))
+                    {
+                        match first_line_owns_tri(&path, session_id) {
+                            Ok(true) => return ByIdAnswer::Present,
+                            Ok(false) => {} // valid read, id differs — keep walking
+                            Err(()) => saw_error = true,
+                        }
+                    }
+                }
+                Err(_) => saw_error = true,
+            }
+        }
+    }
+    if saw_error {
+        ByIdAnswer::Unreadable
+    } else {
+        ByIdAnswer::Absent
+    }
+}
+
+/// Tri-state first-line ownership proof: `Ok(true)` iff the first line is a
+/// `session_meta` whose `payload.id` equals `session_id` (mirror of
+/// `codex_reconcile.rs`'s `first_line_owns`), `Ok(false)` for a VALID read
+/// whose id differs (a genuine non-owner), `Err(())` for any open/read/
+/// decode failure on a candidate (incl. an undecodable `.jsonl.zst`) — an
+/// error must count toward `saw_error`, never as "not the owner".
+fn first_line_owns_tri(path: &Path, session_id: &str) -> Result<bool, ()> {
+    use std::io::{BufRead, Read};
+    let file = std::fs::File::open(path).map_err(|_| ())?;
+    let mut reader = std::io::BufReader::new(file).take(1024 * 1024);
+    let mut first = String::new();
+    reader.read_line(&mut first).map_err(|_| ())?;
+    let value = serde_json::from_str::<serde_json::Value>(first.trim()).map_err(|_| ())?;
+    Ok(
+        value.get("type").and_then(|t| t.as_str()) == Some("session_meta")
+            && value
+                .get("payload")
+                .and_then(|p| p.get("id"))
+                .and_then(|i| i.as_str())
+                == Some(session_id),
+    )
+}
+
+/// Production codex locator: wraps [`codex_rollout_on_disk`] over the same
+/// sessions root the resume-time locator walks.
+pub fn codex_rollout_existence_locator(sessions_root: PathBuf) -> CodexRolloutExistenceLocator {
+    Arc::new(move |session_id: &str| codex_rollout_on_disk(&sessions_root, session_id))
+}
diff --git a/crates/freshell-server/src/existence_resume_validation_tests.rs b/crates/freshell-server/src/existence_resume_validation_tests.rs
new file mode 100644
index 000000000..3a49821a1
--- /dev/null
+++ b/crates/freshell-server/src/existence_resume_validation_tests.rs
@@ -0,0 +1,455 @@
+//! Resume-validation feature tests (plan Task 3): amplifier + codex by-id
+//! fallbacks on the warm-Absent adjudication path, and cold-index coverage
+//! for the cheap amplifier/claude locators. Included as a sibling module of
+//! `existence.rs`'s `tests` (file-include pattern precedent:
+//! `freshell-sessions/src/amplifier_stub_scan_tests.rs`), reusing that
+//! module's `pub(super)` scaffolding helpers.
+use super::tests::{direct_locator_over, probe_over, temp_claude_home, write_session};
+use super::*;
+use crate::existence_by_id::codex_rollout_on_disk;
+
+use freshell_sessions::directory_index::{ClaudeSource, SessionSource};
+use std::sync::atomic::{AtomicU64, Ordering as TestOrdering};
+use std::time::Duration;
+
+static RV_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+fn rv_temp_dir(tag: &str) -> std::path::PathBuf {
+    let n = RV_COUNTER.fetch_add(1, TestOrdering::SeqCst);
+    let dir = std::env::temp_dir().join(format!(
+        "freshell-existence-rv-{tag}-{}-{n}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&dir).expect("mkdir rv temp dir");
+    dir
+}
+
+/// Amplifier home with `projects/-p/sessions/<id>/` created for each id.
+fn amp_home_with_sessions(tag: &str, ids: &[&str]) -> std::path::PathBuf {
+    let home = rv_temp_dir(tag);
+    for id in ids {
+        std::fs::create_dir_all(home.join("projects/-p/sessions").join(id))
+            .expect("mkdir amplifier session dir");
+    }
+    home
+}
+
+/// Write a codex rollout owned by `session_id` under the dated tree
+/// `<root>/2026/07/29/rollout-2026-07-29T10-00-00-<id>.jsonl` (first line =
+/// `session_meta` whose `payload.id` proves ownership). Returns the file path.
+fn write_codex_rollout(root: &std::path::Path, session_id: &str) -> std::path::PathBuf {
+    let dated = root.join("2026/07/29");
+    std::fs::create_dir_all(&dated).expect("mkdir codex dated dir");
+    let path = dated.join(format!("rollout-2026-07-29T10-00-00-{session_id}.jsonl"));
+    std::fs::write(
+        &path,
+        format!("{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{session_id}\"}}}}\n"),
+    )
+    .expect("write codex rollout");
+    path
+}
+
+/// Permission tests are meaningless as root (root ignores mode bits) —
+/// e.g. sandboxed/container suites. Skip (return early) when euid == 0.
+#[cfg(unix)]
+fn running_as_root() -> bool {
+    std::process::Command::new("id")
+        .arg("-u")
+        .output()
+        .map(|o| String::from_utf8_lossy(&o.stdout).trim() == "0")
+        .unwrap_or(false)
+}
+
+/// Probe over a claude-source index at `index_home` (like `probe_over`) but
+/// with caller-chosen provider roots — the cold-index tests need per-provider
+/// roots that exist so the ProviderUnavailable pre-check does not fire.
+fn probe_with_roots(
+    index_home: &std::path::Path,
+    roots: HashMap<String, PathBuf>,
+) -> (IndexExistenceProbe, Arc<SessionIndex>) {
+    let index = Arc::new(SessionIndex::with_ttl_and_cache_path(
+        vec![Arc::new(ClaudeSource::new(index_home.to_path_buf())) as Arc<dyn SessionSource>],
+        Duration::from_millis(50),
+        None,
+    ));
+    (
+        IndexExistenceProbe::new(Arc::clone(&index), None, roots),
+        index,
+    )
+}
+
+/// Warm snapshot says Absent, but the session dir exists on disk (created
+/// after the snapshot). By-id fallback must answer Present.
+#[tokio::test]
+async fn amplifier_absent_snapshot_rescued_by_dir_locator() {
+    let home = temp_claude_home("amp-rescue");
+    let amp_home = amp_home_with_sessions("amp-rescue-home", &["amp-new"]);
+    let (probe, index) = probe_over(&home);
+    let probe = probe.with_amplifier_session_locator(amplifier_dir_locator(amp_home.clone()));
+    index.warm().await;
+    assert_eq!(
+        probe.exists("amplifier", "amp-new"),
+        SessionExistence::Present,
+        "the session dir exists on disk — a stale warm snapshot must never \
+         adjudicate a real session absent"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+    let _ = std::fs::remove_dir_all(&amp_home);
+}
+
+/// Warm snapshot Absent + locator scans a readable store without the id.
+#[tokio::test]
+async fn amplifier_definitively_absent_stays_absent() {
+    let home = temp_claude_home("amp-absent");
+    let amp_home = amp_home_with_sessions("amp-absent-home", &["amp-other"]);
+    let (probe, index) = probe_over(&home);
+    let probe = probe.with_amplifier_session_locator(amplifier_dir_locator(amp_home.clone()));
+    index.warm().await;
+    assert_eq!(
+        probe.exists("amplifier", "amp-gone"),
+        SessionExistence::Absent,
+        "store readable, session definitively absent => positive Absent"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+    let _ = std::fs::remove_dir_all(&amp_home);
+}
+
+/// Locator returns Unreadable (e.g. permissions) => honest Unknown, never
+/// a false Absent.
+#[tokio::test]
+async fn amplifier_unreadable_store_answers_unknown() {
+    let home = temp_claude_home("amp-unreadable");
+    let (probe, index) = probe_over(&home);
+    let probe = probe.with_amplifier_session_locator(Arc::new(|_sid: &str| ByIdAnswer::Unreadable));
+    index.warm().await;
+    assert_eq!(
+        probe.exists("amplifier", "amp-x"),
+        SessionExistence::Unknown,
+        "read failure is honest ignorance — fail open, never Absent"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+/// No locator chained (default) => today's behavior byte-for-byte.
+#[tokio::test]
+async fn amplifier_without_locator_keeps_snapshot_answer() {
+    let home = temp_claude_home("amp-nolocator");
+    let (probe, index) = probe_over(&home);
+    index.warm().await;
+    assert_eq!(
+        probe.exists("amplifier", "amp-anything"),
+        SessionExistence::Absent,
+        "without a locator the pure warm-index answer stands"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+/// Same shape as the amplifier rescue test, with a temp codex sessions root
+/// containing `sessions/2026/07/29/rollout-...-<id>.jsonl`.
+#[tokio::test]
+async fn codex_absent_snapshot_rescued_by_rollout_locator() {
+    let home = temp_claude_home("codex-rescue");
+    let root = rv_temp_dir("codex-rescue-root");
+    let session_id = "c0dec0de-1111-4222-8333-444455556666";
+    write_codex_rollout(&root, session_id);
+    let (probe, index) = probe_over(&home);
+    let probe = probe.with_codex_rollout_locator(codex_rollout_existence_locator(root.clone()));
+    index.warm().await;
+    assert_eq!(
+        probe.exists_for_gate("codex", session_id),
+        SessionExistence::Present,
+        "the rollout exists on disk (the resume arm would find it) — a stale \
+         warm snapshot must never adjudicate it absent"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// Pins the exists()/exists_for_gate split (reconcile blocking-IO fix):
+/// plain `exists()` is consulted inline on the sync reconcile path (~250ms
+/// IO budget), so it must answer a warm-snapshot Absent for codex WITHOUT
+/// running the ~1s rollout walk; `exists_for_gate()` (spawn doors, wrapped
+/// in spawn_blocking per A13) runs the walk on the SAME probe and rescues
+/// the stale warm-Absent.
+#[tokio::test]
+async fn reconcile_exists_never_runs_codex_walk_gate_variant_does() {
+    use std::sync::atomic::AtomicBool;
+    let home = temp_claude_home("codex-gate-split");
+    let (probe, index) = probe_over(&home);
+    let walked = Arc::new(AtomicBool::new(false));
+    let walked_in = Arc::clone(&walked);
+    let probe = probe.with_codex_rollout_locator(Arc::new(move |_sid: &str| {
+        walked_in.store(true, TestOrdering::SeqCst);
+        ByIdAnswer::Present
+    }));
+    index.warm().await;
+    assert_eq!(
+        probe.exists("codex", "thread-gate-split"),
+        SessionExistence::Absent,
+        "plain exists() answers the snapshot Absent WITHOUT the ~1s walk \
+         (reconcile-path IO budget)"
+    );
+    assert!(
+        !walked.load(TestOrdering::SeqCst),
+        "the codex rollout walk must never run from exists() (reconcile path)"
+    );
+    assert_eq!(
+        probe.exists_for_gate("codex", "thread-gate-split"),
+        SessionExistence::Present,
+        "the gate variant runs the walk and rescues the stale warm-Absent"
+    );
+    assert!(
+        walked.load(TestOrdering::SeqCst),
+        "exists_for_gate must consult the codex rollout locator on warm-Absent"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+/// sessions root NotFound => Absent (AD-1: fresh install, parent readable);
+/// locator returning Unreadable => probe answers Unknown. Root readability
+/// is established via read_dir inside `codex_rollout_on_disk`, not
+/// fs::metadata — metadata tests existence, not readability (V3 E3).
+#[tokio::test]
+async fn codex_missing_sessions_root_is_absent_and_unreadable_is_unknown() {
+    let home = temp_claude_home("codex-missing-root");
+    let parent = rv_temp_dir("codex-missing-root-parent");
+    let missing_root = parent.join("sessions"); // never created
+    let (probe, index) = probe_over(&home);
+    let probe =
+        probe.with_codex_rollout_locator(codex_rollout_existence_locator(missing_root.clone()));
+    index.warm().await;
+    assert_eq!(
+        probe.exists_for_gate("codex", "thread-1"),
+        SessionExistence::Absent,
+        "missing sessions root with readable parent is positive absence (AD-1)"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+    let _ = std::fs::remove_dir_all(&parent);
+
+    let home2 = temp_claude_home("codex-unreadable");
+    let (probe2, index2) = probe_over(&home2);
+    let probe2 = probe2.with_codex_rollout_locator(Arc::new(|_sid: &str| ByIdAnswer::Unreadable));
+    index2.warm().await;
+    assert_eq!(
+        probe2.exists_for_gate("codex", "thread-2"),
+        SessionExistence::Unknown,
+        "an unreadable store is honest Unknown — fail open, never Absent"
+    );
+    let _ = std::fs::remove_dir_all(&home2);
+}
+
+/// Future codex rollout compression (V2): a `rollout-...-<id>.jsonl.zst`
+/// candidate MUST pass the filename prefilter; its first line is not plain
+/// JSONL, so the ownership read fails => counts as an error => Unreadable
+/// (the probe answers Unknown — fail open, never Absent for a
+/// CLI-resumable file).
+#[test]
+fn codex_zst_rollout_is_candidate_but_undecodable_answers_unreadable() {
+    let root = rv_temp_dir("codex-zst");
+    let session_id = "c0dec0de-2222-4222-8333-444455556666";
+    let dated = root.join("2026/07/29");
+    std::fs::create_dir_all(&dated).expect("mkdir codex dated dir");
+    // zstd magic bytes + arbitrary binary — not decodable as JSONL.
+    let mut bytes = vec![0x28u8, 0xB5, 0x2F, 0xFD];
+    bytes.extend_from_slice(&[0x00, 0xFF, 0x13, 0x37]);
+    std::fs::write(
+        dated.join(format!(
+            "rollout-2026-07-29T10-00-00-{session_id}.jsonl.zst"
+        )),
+        bytes,
+    )
+    .expect("write zst candidate");
+    assert_eq!(
+        codex_rollout_on_disk(&root, session_id),
+        ByIdAnswer::Unreadable,
+        "an undecodable candidate is an ERROR, never 'not the owner'"
+    );
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// V3 case E4: the rollout lives under `sessions/2026/07/29/` chmod 000 —
+/// the per-entry read_dir error must be accumulated (no silent skip).
+#[cfg(unix)]
+#[test]
+fn codex_unreadable_date_subdir_answers_unreadable() {
+    use std::os::unix::fs::PermissionsExt;
+    if running_as_root() {
+        return; // root ignores mode bits — test is meaningless
+    }
+    let root = rv_temp_dir("codex-locked-subdir");
+    let session_id = "c0dec0de-3333-4222-8333-444455556666";
+    write_codex_rollout(&root, session_id);
+    let locked = root.join("2026/07/29");
+    std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o000)).unwrap();
+    let answer = codex_rollout_on_disk(&root, session_id);
+    // Restore perms before asserting so cleanup works even on failure.
+    std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o755)).unwrap();
+    assert_eq!(
+        answer,
+        ByIdAnswer::Unreadable,
+        "an unreadable subtree may hide the rollout — never Absent"
+    );
+
+    // And through the probe: warm-Absent + Unreadable walk => Unknown.
+    std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o000)).unwrap();
+    let home = temp_claude_home("codex-locked-probe");
+    let (probe, index) = probe_over(&home);
+    let probe = probe.with_codex_rollout_locator(codex_rollout_existence_locator(root.clone()));
+    let rt = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    rt.block_on(index.warm());
+    let probe_answer = probe.exists_for_gate("codex", session_id);
+    std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o755)).unwrap();
+    assert_eq!(probe_answer, SessionExistence::Unknown);
+    let _ = std::fs::remove_dir_all(&home);
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// V3 case E7: the owning rollout file itself is chmod 000 — the first-line
+/// ownership read fails => error => Unreadable, never Absent.
+#[cfg(unix)]
+#[test]
+fn codex_unreadable_candidate_file_answers_unreadable() {
+    use std::os::unix::fs::PermissionsExt;
+    if running_as_root() {
+        return; // root ignores mode bits — test is meaningless
+    }
+    let root = rv_temp_dir("codex-locked-file");
+    let session_id = "c0dec0de-4444-4222-8333-444455556666";
+    let file = write_codex_rollout(&root, session_id);
+    std::fs::set_permissions(&file, std::fs::Permissions::from_mode(0o000)).unwrap();
+    let answer = codex_rollout_on_disk(&root, session_id);
+    std::fs::set_permissions(&file, std::fs::Permissions::from_mode(0o644)).unwrap();
+    assert_eq!(
+        answer,
+        ByIdAnswer::Unreadable,
+        "an unreadable candidate file is an ERROR, never 'not the owner'"
+    );
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// Cold index (peek() == None, the every-boot state) + amplifier root
+/// present + locator chained: the cheap by-id locator answers instead of
+/// Unknown. This is the incident scenario: a restore-time create racing the
+/// detached boot sweep. Plain #[test] (no tokio runtime) so kick_refresh
+/// no-ops and the index deterministically stays cold.
+#[test]
+fn cold_index_amplifier_uses_dir_locator() {
+    // (a) session dir on disk => Present.
+    let index_home = temp_claude_home("cold-amp-present");
+    let amp_home = amp_home_with_sessions("cold-amp-present-home", &["amp-cold"]);
+    let (probe, _index) = probe_with_roots(
+        &index_home,
+        HashMap::from([("amplifier".to_string(), amp_home.clone())]),
+    );
+    let probe = probe.with_amplifier_session_locator(amplifier_dir_locator(amp_home.clone()));
+    assert_eq!(
+        probe.exists("amplifier", "amp-cold"),
+        SessionExistence::Present,
+        "cold index + dir on disk => Present (the incident scenario)"
+    );
+    let _ = std::fs::remove_dir_all(&index_home);
+    let _ = std::fs::remove_dir_all(&amp_home);
+
+    // (b) readable-empty store => Absent.
+    let index_home = temp_claude_home("cold-amp-absent");
+    let amp_home = rv_temp_dir("cold-amp-absent-home");
+    let (probe, _index) = probe_with_roots(
+        &index_home,
+        HashMap::from([("amplifier".to_string(), amp_home.clone())]),
+    );
+    let probe = probe.with_amplifier_session_locator(amplifier_dir_locator(amp_home.clone()));
+    assert_eq!(
+        probe.exists("amplifier", "amp-cold"),
+        SessionExistence::Absent,
+        "cold index + readable-empty store => positive Absent"
+    );
+    let _ = std::fs::remove_dir_all(&index_home);
+    let _ = std::fs::remove_dir_all(&amp_home);
+
+    // (c) locator Unreadable => Unknown.
+    let index_home = temp_claude_home("cold-amp-unreadable");
+    let amp_home = rv_temp_dir("cold-amp-unreadable-home");
+    let (probe, _index) = probe_with_roots(
+        &index_home,
+        HashMap::from([("amplifier".to_string(), amp_home.clone())]),
+    );
+    let probe = probe.with_amplifier_session_locator(Arc::new(|_sid: &str| ByIdAnswer::Unreadable));
+    assert_eq!(
+        probe.exists("amplifier", "amp-cold"),
+        SessionExistence::Unknown
+    );
+    let _ = std::fs::remove_dir_all(&index_home);
+    let _ = std::fs::remove_dir_all(&amp_home);
+}
+
+/// Same shape via the EXISTING claude transcript locator: cold index +
+/// transcript file on disk => Present; readable store without it => Absent
+/// (the gate still Proceeds unless ever_observed_on_disk — Task 1).
+#[test]
+fn cold_index_claude_uses_transcript_locator() {
+    let home = temp_claude_home("cold-claude");
+    let session_id = "4d5e6f70-8192-4aa3-8b4c-5d6e7f809101";
+    write_session(&home, session_id);
+    let (probe, _index) = probe_over(&home);
+    let probe = probe.with_claude_transcript_locator(direct_locator_over(&home));
+    assert_eq!(
+        probe.exists("claude", session_id),
+        SessionExistence::Present,
+        "cold index + transcript on disk => Present via the cheap raw-file check"
+    );
+    assert_eq!(
+        probe.exists("claude", "5e6f7081-92a3-4bb4-8c5d-6e7f80910212"),
+        SessionExistence::Absent,
+        "cold index + readable store without the transcript => positive Absent"
+    );
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+/// Cold index + locators chained: codex/opencode must NOT run their by-id
+/// lookups when cold (AD-4 — the codex walk is ~1 s on a real store).
+/// The root-missing => ProviderUnavailable pre-check stays byte-for-byte
+/// today's behavior.
+#[test]
+fn cold_index_codex_and_opencode_answer_unknown() {
+    let index_home = temp_claude_home("cold-codex-opencode");
+    let codex_root = rv_temp_dir("cold-codex-root");
+    let opencode_root = rv_temp_dir("cold-opencode-root");
+    let (probe, _index) = probe_with_roots(
+        &index_home,
+        HashMap::from([
+            ("codex".to_string(), codex_root.clone()),
+            ("opencode".to_string(), opencode_root.clone()),
+        ]),
+    );
+    // Both locators would answer Present if (wrongly) consulted.
+    let probe = probe
+        .with_codex_rollout_locator(Arc::new(|_sid: &str| ByIdAnswer::Present))
+        .with_opencode_session_locator(Arc::new(|_sid: &str| OpencodeDbAnswer::Present));
+    assert_eq!(
+        probe.exists("codex", "thread-cold"),
+        SessionExistence::Unknown,
+        "cold codex stays Unknown — the ~1s walk must not run on early-boot creates (AD-4)"
+    );
+    assert_eq!(
+        probe.exists("opencode", "ses_cold00000000000000000000000"),
+        SessionExistence::Unknown,
+        "cold opencode stays Unknown (AD-4)"
+    );
+
+    // Root-missing pre-check untouched: even with a locator chained, a
+    // missing provider root still answers ProviderUnavailable.
+    let gone = codex_root.join("never-created");
+    let (probe2, _index2) =
+        probe_with_roots(&index_home, HashMap::from([("codex".to_string(), gone)]));
+    let probe2 = probe2.with_codex_rollout_locator(Arc::new(|_sid: &str| ByIdAnswer::Present));
+    assert_eq!(
+        probe2.exists("codex", "thread-cold"),
+        SessionExistence::ProviderUnavailable
+    );
+    let _ = std::fs::remove_dir_all(&index_home);
+    let _ = std::fs::remove_dir_all(&codex_root);
+    let _ = std::fs::remove_dir_all(&opencode_root);
+}
diff --git a/crates/freshell-server/src/main.rs b/crates/freshell-server/src/main.rs
index 5eb04b37e..99c160d44 100644
--- a/crates/freshell-server/src/main.rs
+++ b/crates/freshell-server/src/main.rs
@@ -20,6 +20,7 @@ mod boot;
 mod checkpoints;
 mod diag;
 mod existence;
+mod existence_by_id;
 mod extensions;
 mod files;
 mod identity_sink;
@@ -519,9 +520,13 @@ async fn main() -> ExitCode {
     // /api/panes/{id}/respawn). A single concurrency budget, never two
     // parallel budgets; pinned by
     // crates/freshell-ws/tests/rest_ws_shared_gate.rs. Post-construction
-    // setter (ledger precedent): create_protect resolves here, after the
-    // last fresh_agent_state builder rebinding. SpawnGate::new passes the
-    // (already env-sanitized) values straight through.
+    // setter (ledger precedent). NOTE: the LAST fresh_agent_state builder
+    // rebinding is no longer here — it is the door-3 resume-validation
+    // wiring below (just above the WsState literal), which needs pane_ledger
+    // and the hoisted session_existence probe; this set_spawn_gate is an
+    // Arc<OnceLock> shared by every clone, so the later consuming rebinding
+    // does not affect it. SpawnGate::new passes the (already env-sanitized)
+    // values straight through.
     let spawn_gate = std::sync::Arc::new(freshell_freshagent::spawn_gate::SpawnGate::new(
         create_protect.spawn_concurrency,
         create_protect.spawn_queue_cap,
@@ -570,6 +575,158 @@ async fn main() -> ExitCode {
     // after `ws_state` is assembled (the hub needs the full state).
     let (auto_resume_tx, auto_resume_rx) =
         tokio::sync::mpsc::unbounded_channel::<freshell_ws::auto_resume::CrashEvent>();
+    // Reconciliation handshake disk-truth probe (design §5.1): backed by
+    // the SAME shared session index the History surfaces read; the
+    // no-index fallback (honest `Unknown` on known providers) when no
+    // provider home resolves — mirrors `session_index`'s own `Option`
+    // convention.
+    let session_existence: freshell_ws::existence::SharedExistenceProbe = match &session_index {
+        Some(index) => {
+            let probe = existence::IndexExistenceProbe::new(
+                std::sync::Arc::clone(index),
+                // P1.8 read 2: the durable ledger backs `ever_observed`, so a
+                // transcript deleted while the server was DOWN still derives
+                // loud dead_session (per-boot observed set is empty then).
+                Some(std::sync::Arc::clone(&pane_ledger)),
+                // Provider session roots resolved with the SAME helpers the
+                // `session_index` sources above use — a known provider whose
+                // root does not exist on this machine derives an immediate
+                // `error{provider_unavailable}`, never `index_warming`.
+                session_directory::provider_home()
+                    .map(|h| {
+                        std::collections::HashMap::from([
+                            ("claude".to_string(), session_directory::claude_home(&h)),
+                            ("codex".to_string(), session_directory::codex_home(&h)),
+                            (
+                                "opencode".to_string(),
+                                freshell_sessions::parse::default_opencode_data_home(),
+                            ),
+                            (
+                                "amplifier".to_string(),
+                                freshell_sessions::amplifier::amplifier_home(&h),
+                            ),
+                        ])
+                    })
+                    .unwrap_or_default(),
+            )
+            // Kata 09v1 zero-turn claude fallback: the SAME raw-file check
+            // the attach arm trusts (claude_snapshot ordered candidate
+            // roots, CLAUDE_CONFIG_DIR > CLAUDE_HOME > $HOME/.claude), so
+            // reconcile and attach can never disagree about whether a
+            // claude transcript exists. Degenerate no-roots case (HOME
+            // unset etc.): locate_transcript answers None and the probe
+            // keeps the pure index answer — identical to pre-fix behavior.
+            .with_claude_transcript_locator(std::sync::Arc::new(|session_id: &str| {
+                freshell_freshagent::locate_transcript(session_id)
+            }))
+            // Opencode rebind fix: the SAME by-id DB truth the attach arm
+            // trusts (`opencode --session <id>` resolves children and
+            // directory-less roots the root-filtered listing hides), so
+            // reconcile and attach can never disagree about whether an
+            // opencode session exists. Points at the SAME data home the
+            // OpencodeSource above uses. Unreadable DB => Unknown
+            // (bounded deferral), never a false dead_session.
+            .with_opencode_session_locator(existence::opencode_db_locator(
+                freshell_sessions::parse::default_opencode_data_home(),
+            ));
+            // Amplifier by-id fallback (resume-validation): the SAME
+            // all-slugs disk scan the stub writer/attach arm trusts
+            // (amplifier_stub::session_on_disk), over the SAME home the
+            // stub writer resolves. Covers both a stale warm snapshot
+            // AND the cold index at boot (restore-time creates race the
+            // detached sweep). No resolvable home => probe behaves as
+            // today for amplifier.
+            let probe = match freshell_sessions::amplifier_stub::resolve_amplifier_home() {
+                Some(amplifier_home) => probe.with_amplifier_session_locator(
+                    existence::amplifier_dir_locator(amplifier_home),
+                ),
+                None => probe,
+            };
+            // Codex by-id fallback (resume-validation): the gate-safe
+            // tri-state rollout walk over the SAME sessions root the
+            // ActivityHub's resume-time locator (above) walks —
+            // warm-Absent adjudication only (AD-4: ~1s on a real
+            // store, never on the cold path). No resolvable root =>
+            // probe behaves as today for codex.
+            let probe = match freshell_ws::codex_sessions_root() {
+                Some(codex_sessions_root) => probe.with_codex_rollout_locator(
+                    existence::codex_rollout_existence_locator(codex_sessions_root),
+                ),
+                None => probe,
+            };
+            std::sync::Arc::new(probe)
+        }
+        None => std::sync::Arc::new(freshell_ws::existence::NoIndexProbe::default()),
+    };
+    // Resume-validation wiring (door 3). Deliberately the LAST fresh_agent_state
+    // rebinding: it needs pane_ledger and the hoisted session_existence probe
+    // (both constructed just above), which do not exist at the earlier builder
+    // chains. Sound because every door-3 consumer clones fresh_agent_state
+    // AFTER this point (the freshagent REST router merge and
+    // SnapshotState::new, below); the one EARLIER capture --
+    // FreshOpencodeState::new(fresh_agent_state.clone()) near the top, held
+    // by value -- already predates every door-3-relevant builder
+    // (with_cli_commands included) by existing design and never runs the REST
+    // create pipeline. The set_spawn_gate/set_identity_sink calls above are
+    // unaffected: Arc<OnceLock> cells initialized in new(), shared by every
+    // clone including this rebound value.
+    let fresh_agent_state = fresh_agent_state
+        .with_resume_probe({
+            let probe = session_existence.clone(); // the hoisted Arc'd probe
+            std::sync::Arc::new(move |provider: &str, session_id: &str| {
+                use freshell_platform::resume_gate::{ResumeExistence, ResumeProbeAnswer};
+                use freshell_ws::existence::SessionExistence;
+                let existence = match probe.exists_for_gate(provider, session_id) {
+                    SessionExistence::Present => ResumeExistence::Present,
+                    SessionExistence::Absent => ResumeExistence::Absent,
+                    SessionExistence::Unknown | SessionExistence::ProviderUnavailable => {
+                        ResumeExistence::Unknown
+                    }
+                };
+                ResumeProbeAnswer {
+                    existence,
+                    ever_observed_on_disk: probe.ever_observed_on_disk(provider, session_id),
+                }
+            })
+        })
+        .with_on_stale_resume({
+            let ledger = pane_ledger.clone(); // the Arc<PaneLedger> built above
+            std::sync::Arc::new(move |provider: &str, stale_id: &str| {
+                tracing::warn!(
+                    provider = %provider,
+                    stale_session_id = %stale_id,
+                    "resume validation (REST): cached session missing on disk; spawning fresh"
+                );
+                let _ = ledger.retire_missing(provider, stale_id);
+            })
+        })
+        .with_sidecar_liveness({
+            // MANDATORY (arm 2 of the door-3 liveness precondition): the SAME
+            // sidecar instances the WS door's D7 join consults -- built and
+            // frozen near the top of main, shared with WsState below. Same
+            // mode -> sidecar mapping as the WS door's sidecar arm
+            // (crates/freshell-ws/src/terminal.rs, Task 13b cross-kind
+            // live-guard); unknown modes contribute false.
+            let claude = fresh_claude_state.clone();
+            let codex = fresh_codex_state.clone();
+            let opencode = fresh_opencode_state.clone();
+            std::sync::Arc::new(move |mode: &str, session_id: &str| {
+                let claude = claude.clone();
+                let codex = codex.clone();
+                let opencode = opencode.clone();
+                let mode = mode.to_string();
+                let sid = session_id.to_string();
+                Box::pin(async move {
+                    match mode.as_str() {
+                        "claude" => claude.has_live_session(&sid).await,
+                        "codex" => codex.has_live_session(&sid).await,
+                        "opencode" => opencode.has_live_session(&sid).await,
+                        _ => false,
+                    }
+                })
+                    as std::pin::Pin<Box<dyn std::future::Future<Output = bool> + Send>>
+            })
+        });
     let ws_state = WsState {
         auto_resume_tx,
         auto_resume_cancels: Default::default(),
@@ -577,63 +734,7 @@ async fn main() -> ExitCode {
         identity: terminal_identity.clone(),
         opencode_locator: opencode_locator.clone(),
         codex_locator: codex_locator.clone(),
-        // Reconciliation handshake disk-truth probe (design §5.1): backed by
-        // the SAME shared session index the History surfaces read; the
-        // no-index fallback (honest `Unknown` on known providers) when no
-        // provider home resolves — mirrors `session_index`'s own `Option`
-        // convention.
-        session_existence: match &session_index {
-            Some(index) => std::sync::Arc::new(
-                existence::IndexExistenceProbe::new(
-                    std::sync::Arc::clone(index),
-                    // P1.8 read 2: the durable ledger backs `ever_observed`, so a
-                    // transcript deleted while the server was DOWN still derives
-                    // loud dead_session (per-boot observed set is empty then).
-                    Some(std::sync::Arc::clone(&pane_ledger)),
-                    // Provider session roots resolved with the SAME helpers the
-                    // `session_index` sources above use — a known provider whose
-                    // root does not exist on this machine derives an immediate
-                    // `error{provider_unavailable}`, never `index_warming`.
-                    session_directory::provider_home()
-                        .map(|h| {
-                            std::collections::HashMap::from([
-                                ("claude".to_string(), session_directory::claude_home(&h)),
-                                ("codex".to_string(), session_directory::codex_home(&h)),
-                                (
-                                    "opencode".to_string(),
-                                    freshell_sessions::parse::default_opencode_data_home(),
-                                ),
-                                (
-                                    "amplifier".to_string(),
-                                    freshell_sessions::amplifier::amplifier_home(&h),
-                                ),
-                            ])
-                        })
-                        .unwrap_or_default(),
-                )
-                // Kata 09v1 zero-turn claude fallback: the SAME raw-file check
-                // the attach arm trusts (claude_snapshot ordered candidate
-                // roots, CLAUDE_CONFIG_DIR > CLAUDE_HOME > $HOME/.claude), so
-                // reconcile and attach can never disagree about whether a
-                // claude transcript exists. Degenerate no-roots case (HOME
-                // unset etc.): locate_transcript answers None and the probe
-                // keeps the pure index answer — identical to pre-fix behavior.
-                .with_claude_transcript_locator(std::sync::Arc::new(|session_id: &str| {
-                    freshell_freshagent::locate_transcript(session_id)
-                }))
-                // Opencode rebind fix: the SAME by-id DB truth the attach arm
-                // trusts (`opencode --session <id>` resolves children and
-                // directory-less roots the root-filtered listing hides), so
-                // reconcile and attach can never disagree about whether an
-                // opencode session exists. Points at the SAME data home the
-                // OpencodeSource above uses. Unreadable DB => Unknown
-                // (bounded deferral), never a false dead_session.
-                .with_opencode_session_locator(existence::opencode_db_locator(
-                    freshell_sessions::parse::default_opencode_data_home(),
-                )),
-            ),
-            None => std::sync::Arc::new(freshell_ws::existence::NoIndexProbe::default()),
-        },
+        session_existence: session_existence.clone(),
         // §5.3 row 5: the ONE bounded index-warming deferral's budget
         // (council-pinned single deferral, default 2000ms).
         reconcile_deferral_budget_ms: freshell_ws::reconcile::RECONCILE_DEFERRAL_BUDGET_MS_DEFAULT,
diff --git a/crates/freshell-sessions/src/amplifier_stub.rs b/crates/freshell-sessions/src/amplifier_stub.rs
index bff79d6cd..9f09bf997 100644
--- a/crates/freshell-sessions/src/amplifier_stub.rs
+++ b/crates/freshell-sessions/src/amplifier_stub.rs
@@ -290,6 +290,65 @@ pub fn gc_stub_if_unused(session_dir: &Path) -> bool {
     std::fs::remove_dir_all(session_dir).is_ok()
 }
 
+/// Read-only disk-existence answer for one amplifier session id, scanning ALL
+/// project slugs under `<amplifier_home>/projects/` (a session may live under
+/// a different slug than the current cwd — see `ensure_session`'s divergent-
+/// slug handling). Never creates anything.
+///
+/// Semantics (resume-validation feature — errors-seen accumulator, V3):
+/// * session dir found under any project => `Present` (short-circuits);
+/// * `projects/` missing (NotFound, parent readable) or scanned WITHOUT any
+///   error and without a hit => `Absent` (store readable, definitively
+///   absent — AD-1: missing root is positive absence, matching today's
+///   warm-path steady state);
+/// * `projects/` unreadable at the root, OR any per-entry error during the
+///   scan (unreadable project subdir, EACCES stat, dropped dir entry) with
+///   no hit => `Unreadable` (callers must fail OPEN — treat as unknown,
+///   never as absent). NEVER adjudicate via `.is_dir()` alone: it returns
+///   `false` on EACCES and would manufacture a false Absent.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AmplifierSessionAnswer {
+    Present,
+    Absent,
+    Unreadable,
+}
+
+pub fn session_on_disk(
+    amplifier_home: &std::path::Path,
+    session_id: &str,
+) -> AmplifierSessionAnswer {
+    let projects = amplifier_home.join("projects");
+    let entries = match std::fs::read_dir(&projects) {
+        Ok(entries) => entries,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            return AmplifierSessionAnswer::Absent; // AD-1: root missing, parent readable
+        }
+        Err(_) => return AmplifierSessionAnswer::Unreadable,
+    };
+    let mut saw_error = false;
+    for entry in entries {
+        let entry = match entry {
+            Ok(entry) => entry,
+            Err(_) => {
+                saw_error = true; // dropped dir entry (EIO, network fs) — cannot rule out
+                continue;
+            }
+        };
+        let candidate = entry.path().join("sessions").join(session_id);
+        match std::fs::metadata(&candidate) {
+            Ok(meta) if meta.is_dir() => return AmplifierSessionAnswer::Present,
+            Ok(_) => {} // stray FILE named like the id — not a session dir
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => {}
+            Err(_) => saw_error = true, // EACCES etc. — the session may be hiding here
+        }
+    }
+    if saw_error {
+        AmplifierSessionAnswer::Unreadable
+    } else {
+        AmplifierSessionAnswer::Absent
+    }
+}
+
 /// Outcome of the boot-time layout canary ([`verify_amplifier_layout_contract`]).
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum CanaryOutcome {
@@ -841,3 +900,7 @@ mod tests {
         );
     }
 }
+
+#[cfg(test)]
+#[path = "amplifier_stub_scan_tests.rs"]
+mod scan_tests;
diff --git a/crates/freshell-sessions/src/amplifier_stub_scan_tests.rs b/crates/freshell-sessions/src/amplifier_stub_scan_tests.rs
new file mode 100644
index 000000000..255cdc8df
--- /dev/null
+++ b/crates/freshell-sessions/src/amplifier_stub_scan_tests.rs
@@ -0,0 +1,148 @@
+/// Tests for `session_on_disk` scanning logic.
+use super::*;
+
+use std::sync::atomic::{AtomicU64, Ordering as TestOrdering};
+
+static SCAN_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+fn scan_temp_home(label: &str) -> std::path::PathBuf {
+    let n = SCAN_COUNTER.fetch_add(1, TestOrdering::SeqCst);
+    let dir = std::env::temp_dir().join(format!(
+        "freshell-amplifier-scan-{label}-{}-{n}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+/// Permission tests are meaningless as root (root ignores mode bits) —
+/// e.g. sandboxed/container suites. Skip (return early) when euid == 0.
+fn running_as_root() -> bool {
+    std::process::Command::new("id")
+        .arg("-u")
+        .output()
+        .map(|o| String::from_utf8_lossy(&o.stdout).trim() == "0")
+        .unwrap_or(false)
+}
+
+#[test]
+fn session_on_disk_present_under_cwd_slug() {
+    let home = scan_temp_home("present");
+    let sess = home.join("projects/-home-dan-proj/sessions/sid-1");
+    std::fs::create_dir_all(&sess).unwrap();
+    assert!(matches!(
+        session_on_disk(&home, "sid-1"),
+        AmplifierSessionAnswer::Present
+    ));
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+#[test]
+fn session_on_disk_present_under_divergent_slug() {
+    // The tab may have moved cwd; the session lives under ANOTHER project
+    // slug. Scanning all project dirs must still find it (plan decision:
+    // search all projects, documented in Global Constraints).
+    let home = scan_temp_home("divergent");
+    std::fs::create_dir_all(home.join("projects/-some-other-project/sessions/sid-2")).unwrap();
+    std::fs::create_dir_all(home.join("projects/-home-dan-proj")).unwrap();
+    assert!(matches!(
+        session_on_disk(&home, "sid-2"),
+        AmplifierSessionAnswer::Present
+    ));
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+#[test]
+fn session_on_disk_absent_when_store_readable() {
+    let home = scan_temp_home("absent");
+    std::fs::create_dir_all(home.join("projects/-home-dan-proj/sessions/other-sid")).unwrap();
+    assert!(matches!(
+        session_on_disk(&home, "sid-3"),
+        AmplifierSessionAnswer::Absent
+    ));
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+#[test]
+fn session_on_disk_absent_when_projects_dir_missing() {
+    // Store root exists but amplifier has never created projects/:
+    // readable-and-empty => definitively absent.
+    let home = scan_temp_home("noprojects");
+    assert!(matches!(
+        session_on_disk(&home, "sid-4"),
+        AmplifierSessionAnswer::Absent
+    ));
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+#[cfg(unix)]
+#[test]
+fn session_on_disk_unreadable_projects_dir_fails_open() {
+    use std::os::unix::fs::PermissionsExt;
+    if running_as_root() {
+        return; // root ignores mode bits — test is meaningless
+    }
+    let home = scan_temp_home("unreadable");
+    let projects = home.join("projects");
+    std::fs::create_dir_all(&projects).unwrap();
+    std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o000)).unwrap();
+    let answer = session_on_disk(&home, "sid-5");
+    // Restore perms before asserting so cleanup works even on failure.
+    std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o755)).unwrap();
+    assert!(matches!(answer, AmplifierSessionAnswer::Unreadable));
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+#[cfg(unix)]
+#[test]
+fn session_on_disk_unreadable_project_subdir_fails_open() {
+    // V3 case E2a: a chmod-000 PROJECT dir with the session inside must
+    // answer Unreadable, never Absent (`.is_dir()` returns false on
+    // EACCES — the errors-seen accumulator catches the metadata error).
+    use std::os::unix::fs::PermissionsExt;
+    if running_as_root() {
+        return;
+    }
+    let home = scan_temp_home("locked-project");
+    let locked = home.join("projects/-locked-proj");
+    std::fs::create_dir_all(locked.join("sessions/sid-7")).unwrap();
+    std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o000)).unwrap();
+    let answer = session_on_disk(&home, "sid-7");
+    std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o755)).unwrap();
+    assert!(matches!(answer, AmplifierSessionAnswer::Unreadable));
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+#[cfg(unix)]
+#[test]
+fn session_on_disk_listable_not_traversable_projects_fails_open() {
+    // V3 case E2b: projects/ mode 444 — read_dir succeeds (needs r) but
+    // stat into children needs x, so every per-entry metadata call errors.
+    // Any-error-and-no-hit => Unreadable.
+    use std::os::unix::fs::PermissionsExt;
+    if running_as_root() {
+        return;
+    }
+    let home = scan_temp_home("no-traverse");
+    let projects = home.join("projects");
+    std::fs::create_dir_all(projects.join("-p/sessions/sid-8")).unwrap();
+    std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o444)).unwrap();
+    let answer = session_on_disk(&home, "sid-8");
+    std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o755)).unwrap();
+    assert!(matches!(answer, AmplifierSessionAnswer::Unreadable));
+    let _ = std::fs::remove_dir_all(&home);
+}
+
+#[test]
+fn session_on_disk_matches_a_file_only_as_absent() {
+    // A stray FILE named like the session id is not a session dir.
+    let home = scan_temp_home("file-not-dir");
+    let sessions = home.join("projects/-p/sessions");
+    std::fs::create_dir_all(&sessions).unwrap();
+    std::fs::write(sessions.join("sid-6"), b"junk").unwrap();
+    assert!(matches!(
+        session_on_disk(&home, "sid-6"),
+        AmplifierSessionAnswer::Absent
+    ));
+    let _ = std::fs::remove_dir_all(&home);
+}
diff --git a/crates/freshell-ws/src/existence.rs b/crates/freshell-ws/src/existence.rs
index 7814a3029..ff55cb347 100644
--- a/crates/freshell-ws/src/existence.rs
+++ b/crates/freshell-ws/src/existence.rs
@@ -57,6 +57,17 @@ pub trait SessionExistenceProbe: Send + Sync {
     fn ever_observed_on_disk(&self, provider: &str, session_id: &str) -> bool {
         self.ever_observed(provider, session_id)
     }
+
+    /// Gate-caller variant of [`Self::exists`]: may perform EXPENSIVE by-id
+    /// disk work (the codex rollout walk, ~1s on a real store) to adjudicate
+    /// a warm-snapshot Absent. Callers MUST run it inside
+    /// `tokio::task::spawn_blocking` (A13: never inline on the async
+    /// runtime). `exists()` stays bounded for the sync reconcile path (the
+    /// ~250ms reconcile IO budget). Default: delegate to `exists()`, so
+    /// fakes and [`NoIndexProbe`] need no change.
+    fn exists_for_gate(&self, provider: &str, session_id: &str) -> SessionExistence {
+        self.exists(provider, session_id)
+    }
 }
 
 /// The no-index fallback (mirrors `session_index: None` in
diff --git a/crates/freshell-ws/src/lib.rs b/crates/freshell-ws/src/lib.rs
index e95ae0bf6..60a3acd2c 100644
--- a/crates/freshell-ws/src/lib.rs
+++ b/crates/freshell-ws/src/lib.rs
@@ -41,6 +41,7 @@ pub mod pane_identity_binder;
 pub mod pane_ledger;
 pub mod reconcile;
 pub mod reconcile_freshagent;
+pub mod resume_validation;
 pub mod screenshot;
 pub mod spawn_gate;
 pub mod tabs;
diff --git a/crates/freshell-ws/src/pane_ledger.rs b/crates/freshell-ws/src/pane_ledger.rs
index b47191558..48b7c1ec3 100644
--- a/crates/freshell-ws/src/pane_ledger.rs
+++ b/crates/freshell-ws/src/pane_ledger.rs
@@ -85,6 +85,7 @@ pub enum RetiredReason {
     Superseded,
     Closed,
     GcExpired,
+    SessionMissing,
 }
 
 /// A durable identity fact — see the module doc for the schema contract.
@@ -586,6 +587,31 @@ impl PaneLedger {
         self.write_binding(root, &mut index, &row)
     }
 
+    /// Retire a Bound row as SessionMissing (session file not found on disk).
+    /// Returns true iff a Bound row was successfully retired; false if the row
+    /// does not exist or is already retired (idempotent).
+    pub fn retire_missing(&self, provider: &str, session_id: &str) -> bool {
+        let Some(root) = &self.root else {
+            return false;
+        };
+        let now_ms = crate::terminal::now_ms();
+        let mut index = self.guard();
+        let Some(mut row) = index
+            .bindings
+            .get(&(provider.to_string(), session_id.to_string()))
+            .cloned()
+        else {
+            return false;
+        };
+        if row.state != RowState::Bound {
+            return false;
+        }
+        row.state = RowState::Retired;
+        row.retired_reason = Some(RetiredReason::SessionMissing);
+        row.updated_at = now_ms;
+        self.write_binding(root, &mut index, &row).is_ok()
+    }
+
     /// Hard-delete one binding row (file first, then index — the mirror of
     /// [`Self::delete_pending`]'s atomic delete; missing file == already
     /// gone). PIN 2 (Step 4b): the ONLY caller is the spawn-failure branch
diff --git a/crates/freshell-ws/src/pane_ledger_tests.rs b/crates/freshell-ws/src/pane_ledger_tests.rs
index 6f2330eb0..120a544a5 100644
--- a/crates/freshell-ws/src/pane_ledger_tests.rs
+++ b/crates/freshell-ws/src/pane_ledger_tests.rs
@@ -1022,3 +1022,87 @@ fn rebind_to_the_same_identity_is_not_a_supersession() {
     assert_eq!(row.retired_reason, None);
     std::fs::remove_dir_all(&root).ok();
 }
+
+#[test]
+fn retire_missing_marks_bound_row_session_missing() {
+    // Setup: a ledger with a Bound binding for ("amplifier", "stale-sid")
+    let root = temp_root("retire-missing");
+    let ledger = PaneLedger::new(Some(root.clone()));
+    ledger
+        .record_binding(&write("amplifier", "stale-sid", "t1", 1_000))
+        .unwrap();
+
+    // Act: retire the binding as missing
+    let retired = ledger.retire_missing("amplifier", "stale-sid");
+
+    // Assert: retirement succeeded
+    assert!(retired);
+    let row = ledger.load_binding("amplifier", "stale-sid").unwrap();
+    assert_eq!(row.state, RowState::Retired);
+    assert_eq!(row.retired_reason, Some(RetiredReason::SessionMissing));
+    std::fs::remove_dir_all(&root).ok();
+}
+
+#[test]
+fn retire_missing_is_noop_without_binding() {
+    // Fresh ledger, no rows.
+    let root = temp_root("retire-missing-noop");
+    let ledger = PaneLedger::new(Some(root.clone()));
+
+    // Act: try to retire a non-existent binding
+    let retired = ledger.retire_missing("amplifier", "never-seen");
+
+    // Assert: no-op returns false
+    assert!(!retired);
+    // Verify no row was created
+    assert_eq!(ledger.load_binding("amplifier", "never-seen"), None);
+    std::fs::remove_dir_all(&root).ok();
+}
+
+#[test]
+fn retire_missing_does_not_reretire() {
+    // Bound row retired once => true; second call => false; reason stays
+    // SessionMissing; updated_at from the first retire is not clobbered
+    // by the failed second call.
+    let root = temp_root("retire-missing-reretire");
+    let ledger = PaneLedger::new(Some(root.clone()));
+    ledger
+        .record_binding(&write("amplifier", "sid", "t1", 1_000))
+        .unwrap();
+
+    // First retire should succeed
+    let first = ledger.retire_missing("amplifier", "sid");
+    assert!(first);
+    let row_after_first = ledger.load_binding("amplifier", "sid").unwrap();
+    let first_updated_at = row_after_first.updated_at;
+    assert_eq!(row_after_first.state, RowState::Retired);
+    assert_eq!(
+        row_after_first.retired_reason,
+        Some(RetiredReason::SessionMissing)
+    );
+
+    // Second retire should fail (already retired)
+    let second = ledger.retire_missing("amplifier", "sid");
+    assert!(!second);
+    let row_after_second = ledger.load_binding("amplifier", "sid").unwrap();
+    assert_eq!(row_after_second.state, RowState::Retired);
+    assert_eq!(
+        row_after_second.retired_reason,
+        Some(RetiredReason::SessionMissing)
+    );
+    // Verify updated_at was not clobbered
+    assert_eq!(row_after_second.updated_at, first_updated_at);
+    std::fs::remove_dir_all(&root).ok();
+}
+
+#[test]
+fn session_missing_serde_round_trips() {
+    // Test serialization
+    let reason = RetiredReason::SessionMissing;
+    let json = serde_json::to_string(&reason).expect("serialize");
+    assert_eq!(json, r#""session_missing""#);
+
+    // Test deserialization
+    let deserialized: RetiredReason = serde_json::from_str(&json).expect("deserialize");
+    assert_eq!(deserialized, RetiredReason::SessionMissing);
+}
diff --git a/crates/freshell-ws/src/resume_validation.rs b/crates/freshell-ws/src/resume_validation.rs
new file mode 100644
index 000000000..a55add20f
--- /dev/null
+++ b/crates/freshell-ws/src/resume_validation.rs
@@ -0,0 +1,258 @@
+//! Spawn-door resume validation (resume-validation feature): before a cached
+//! session id is turned into resume argv, ask the disk-existence probe. On
+//! POSITIVE absence, fall back to the same shape a genuinely fresh pane of
+//! that mode uses. Unknown/unavailable always fail open.
+//!
+//! Callers (the spawn doors in `crate::terminal`) apply the outcome: retire
+//! the stale ledger row, emit the notice, and never stamp the stale ref.
+
+use freshell_platform::cli_launch::LaunchIntent;
+use freshell_platform::resume_gate::{
+    evaluate_resume_gate, provider_validated, stale_resume_notice, ResumeExistence,
+    ResumeGateDecision,
+};
+
+use crate::existence::{SessionExistence, SessionExistenceProbe};
+
+pub struct ResumeValidationOutcome {
+    pub resume_session_id: Option<String>,
+    pub launch_intent: LaunchIntent,
+    /// True when the fallback minted a fresh claude Start id (caller must set
+    /// its claude_fresh_prealloc flag so downstream identity stamping matches
+    /// the genuine fresh-claude path).
+    pub claude_fresh_prealloc: bool,
+    /// Some(stale_id) iff the gate fired: caller retires the ledger row,
+    /// emits the notice, and must NOT stamp the stale sessionRef.
+    pub stale_session_id: Option<String>,
+    pub notice: Option<String>,
+}
+
+fn passthrough(
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+) -> ResumeValidationOutcome {
+    ResumeValidationOutcome {
+        resume_session_id,
+        launch_intent,
+        claude_fresh_prealloc: false,
+        stale_session_id: None,
+        notice: None,
+    }
+}
+
+pub fn map_existence(e: SessionExistence) -> ResumeExistence {
+    match e {
+        SessionExistence::Present => ResumeExistence::Present,
+        SessionExistence::Absent => ResumeExistence::Absent,
+        SessionExistence::Unknown | SessionExistence::ProviderUnavailable => {
+            ResumeExistence::Unknown
+        }
+    }
+}
+
+pub fn validate_wire_resume(
+    mode: &str,
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+    probe: &dyn SessionExistenceProbe,
+) -> ResumeValidationOutcome {
+    let Some(sid) = resume_session_id.clone().filter(|s| !s.is_empty()) else {
+        return passthrough(resume_session_id, launch_intent);
+    };
+    if !provider_validated(mode) {
+        return passthrough(resume_session_id, launch_intent);
+    }
+    let existence = map_existence(probe.exists_for_gate(mode, &sid));
+    let ever_on_disk = probe.ever_observed_on_disk(mode, &sid);
+    match evaluate_resume_gate(mode, existence, ever_on_disk) {
+        ResumeGateDecision::Proceed => passthrough(resume_session_id, launch_intent),
+        ResumeGateDecision::SpawnFresh => {
+            let notice = stale_resume_notice(mode, &sid);
+            let (fresh_id, intent, claude_prealloc) = match mode {
+                // Mirror the genuine fresh-pane shapes in handle_create
+                // (should_preallocate_fresh_claude / _amplifier).
+                "claude" => (
+                    Some(uuid::Uuid::new_v4().to_string()),
+                    LaunchIntent::Start,
+                    true,
+                ),
+                "amplifier" => (
+                    Some(uuid::Uuid::new_v4().to_string()),
+                    LaunchIntent::Resume,
+                    false,
+                ),
+                _ => (None, LaunchIntent::Resume, false),
+            };
+            ResumeValidationOutcome {
+                resume_session_id: fresh_id,
+                launch_intent: intent,
+                claude_fresh_prealloc: claude_prealloc,
+                stale_session_id: Some(sid),
+                notice: Some(notice),
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::existence::{SessionExistence, SessionExistenceProbe};
+    use freshell_platform::cli_launch::LaunchIntent;
+
+    struct FakeProbe {
+        answer: SessionExistence,
+        ever_on_disk: bool,
+    }
+    impl SessionExistenceProbe for FakeProbe {
+        fn exists(&self, _p: &str, _s: &str) -> SessionExistence {
+            self.answer
+        }
+        fn ever_observed(&self, _p: &str, _s: &str) -> bool {
+            false
+        }
+        fn ever_observed_on_disk(&self, _p: &str, _s: &str) -> bool {
+            self.ever_on_disk
+        }
+    }
+
+    fn absent() -> FakeProbe {
+        FakeProbe {
+            answer: SessionExistence::Absent,
+            ever_on_disk: true,
+        }
+    }
+
+    #[test]
+    fn amplifier_absent_mints_fresh_uuid_and_reports_stale() {
+        let out = validate_wire_resume(
+            "amplifier",
+            Some("stale-amp".into()),
+            LaunchIntent::Resume,
+            &absent(),
+        );
+        let fresh = out
+            .resume_session_id
+            .expect("fresh amplifier id preallocated");
+        assert_ne!(fresh, "stale-amp");
+        assert_eq!(out.launch_intent, LaunchIntent::Resume);
+        assert!(!out.claude_fresh_prealloc);
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-amp"));
+        let notice = out.notice.expect("notice set");
+        assert!(notice.contains("stale-amp"));
+    }
+
+    #[test]
+    fn claude_absent_previously_on_disk_falls_back_to_start_intent() {
+        let out = validate_wire_resume(
+            "claude",
+            Some("stale-claude".into()),
+            LaunchIntent::Resume,
+            &absent(),
+        );
+        assert!(out.resume_session_id.is_some());
+        assert_ne!(out.resume_session_id.as_deref(), Some("stale-claude"));
+        assert_eq!(out.launch_intent, LaunchIntent::Start);
+        assert!(out.claude_fresh_prealloc);
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-claude"));
+    }
+
+    #[test]
+    fn claude_zero_turn_absent_proceeds_untouched() {
+        let probe = FakeProbe {
+            answer: SessionExistence::Absent,
+            ever_on_disk: false,
+        };
+        let out = validate_wire_resume(
+            "claude",
+            Some("zero-turn".into()),
+            LaunchIntent::Resume,
+            &probe,
+        );
+        assert_eq!(out.resume_session_id.as_deref(), Some("zero-turn"));
+        assert_eq!(out.launch_intent, LaunchIntent::Resume);
+        assert!(out.stale_session_id.is_none());
+        assert!(out.notice.is_none());
+    }
+
+    #[test]
+    fn codex_and_opencode_absent_drop_resume_entirely() {
+        for mode in ["codex", "opencode"] {
+            let out = validate_wire_resume(
+                mode,
+                Some("stale-x".into()),
+                LaunchIntent::Resume,
+                &absent(),
+            );
+            assert!(out.resume_session_id.is_none());
+            assert_eq!(out.stale_session_id.as_deref(), Some("stale-x"));
+            assert!(out.notice.is_some());
+        }
+    }
+
+    #[test]
+    fn unknown_and_provider_unavailable_fail_open() {
+        for answer in [
+            SessionExistence::Unknown,
+            SessionExistence::ProviderUnavailable,
+        ] {
+            let probe = FakeProbe {
+                answer,
+                ever_on_disk: false,
+            };
+            let out = validate_wire_resume(
+                "amplifier",
+                Some("maybe".into()),
+                LaunchIntent::Resume,
+                &probe,
+            );
+            assert_eq!(out.resume_session_id.as_deref(), Some("maybe"));
+            assert!(out.stale_session_id.is_none());
+            assert!(out.notice.is_none());
+        }
+    }
+
+    #[test]
+    fn present_passes_through_untouched() {
+        let probe = FakeProbe {
+            answer: SessionExistence::Present,
+            ever_on_disk: true,
+        };
+        let out = validate_wire_resume(
+            "amplifier",
+            Some("real".into()),
+            LaunchIntent::Resume,
+            &probe,
+        );
+        assert_eq!(out.resume_session_id.as_deref(), Some("real"));
+        assert!(out.stale_session_id.is_none());
+    }
+
+    #[test]
+    fn unvalidated_providers_and_empty_ids_never_consult_probe() {
+        struct PanickingProbe;
+        impl SessionExistenceProbe for PanickingProbe {
+            fn exists(&self, _: &str, _: &str) -> SessionExistence {
+                panic!("probe must not be consulted");
+            }
+            fn ever_observed(&self, _: &str, _: &str) -> bool {
+                panic!("probe must not be consulted");
+            }
+            fn ever_observed_on_disk(&self, _: &str, _: &str) -> bool {
+                panic!("probe must not be consulted");
+            }
+        }
+        for mode in ["gemini", "kimi", "shell", "third-party"] {
+            let out = validate_wire_resume(
+                mode,
+                Some("id".into()),
+                LaunchIntent::Resume,
+                &PanickingProbe,
+            );
+            assert_eq!(out.resume_session_id.as_deref(), Some("id"));
+        }
+        let out = validate_wire_resume("amplifier", None, LaunchIntent::Resume, &PanickingProbe);
+        assert!(out.resume_session_id.is_none());
+        assert!(out.stale_session_id.is_none());
+    }
+}
diff --git a/crates/freshell-ws/src/terminal.rs b/crates/freshell-ws/src/terminal.rs
index 87c3b825c..f97c8228e 100644
--- a/crates/freshell-ws/src/terminal.rs
+++ b/crates/freshell-ws/src/terminal.rs
@@ -72,6 +72,10 @@ use crate::WsState;
 #[path = "terminal_create_ordering_tests.rs"]
 mod terminal_create_ordering_tests;
 
+#[cfg(test)]
+#[path = "terminal_launch_prep_tests.rs"]
+mod terminal_launch_prep_tests;
+
 /// The write half of a split axum WebSocket.
 pub(crate) type WsSink = SplitSink<WebSocket, Message>;
 
@@ -1465,6 +1469,12 @@ pub(crate) struct LaunchPrep {
     pub launch_intent: LaunchIntent,
     pub resume_session_id: Option<String>,
     pub claude_fresh_prealloc: bool,
+    /// Resume-validation tracker (door 1): true only when the resume id above
+    /// was derived from the WIRE (sessionRef / legacy resumeSessionId / the
+    /// claude restore ladder, which resolves persisted client state) —
+    /// server-minted prealloc ids are never gated. Set in exactly ONE place
+    /// (the wire `else` arm of derive_launch_prep); never re-computed.
+    pub resume_id_from_wire: bool,
 }
 
 /// Extraction of handle_create's PURE derivation rungs
@@ -1483,6 +1493,10 @@ pub(crate) fn derive_launch_prep(create: &TerminalCreate, mode: &str) -> LaunchP
     // failure — a resume-create's row belongs to the prior epoch and must
     // stay recoverable.
     let mut claude_fresh_prealloc = false;
+    // Resume-validation tracker (door 1): true only when the resume id below
+    // was derived from the WIRE (sessionRef / legacy resumeSessionId / the
+    // claude restore ladder) — server-minted prealloc ids are never gated.
+    let mut resume_id_from_wire = false;
     if mode != "shell" {
         let requested_ref = create.session_ref.as_ref().filter(|r| r.provider == mode);
         // Shared with the REST spawn pipeline (kata hbsa) — one predicate,
@@ -1534,12 +1548,18 @@ pub(crate) fn derive_launch_prep(create: &TerminalCreate, mode: &str) -> LaunchP
                 .map(|r| r.session_id.clone())
                 .or_else(|| create.resume_session_id.clone())
                 .filter(|s| !s.is_empty());
+            // Everything this arm can produce came from the wire (or the
+            // claude ladder in handle_create, which only runs when this arm
+            // ran and resolves persisted client state) — eligible for
+            // resume validation.
+            resume_id_from_wire = true;
         }
     }
     LaunchPrep {
         launch_intent,
         resume_session_id,
         claude_fresh_prealloc,
+        resume_id_from_wire,
     }
 }
 
@@ -1587,6 +1607,110 @@ pub(crate) struct PreparedLaunch {
     /// Some(..) ONLY when a resume session id was derived; None means
     /// "not planned pre-gate" and handle_create plans on-permit inline.
     pub codex_launch: Option<PreparedCodexLaunch>,
+    /// Some(..) iff the wire-resume gate already ran off-permit (codex
+    /// restore-class creates) — handle_create must then NOT run it again,
+    /// only apply the carried notice / stale-ref lease release.
+    pub resume_gate: Option<ResumeGateCarry>,
+}
+
+/// Outcome of the wire-resume disk-existence gate, carried from wherever the
+/// gate ran (off-permit in prepare_launch for codex; on-permit in
+/// handle_create for everything else) to the single place that emits the
+/// operator notice and releases the D8 stale-ref lease.
+pub(crate) struct ResumeGateCarry {
+    pub notice: Option<String>,
+    pub stale_session_id: Option<String>,
+}
+
+/// Resume validation (docs/plans/2026-07-29-resume-validation.md): never hand
+/// the CLI a resume id that is definitively absent from the provider's
+/// on-disk store. Fail open on Unknown/ProviderUnavailable; a LIVE session
+/// never gates (same join D7 uses: registry + async fresh-agent sidecar
+/// arms). The probe's by-id locators do real filesystem walks (~1 s for
+/// codex) — spawn-door callers only, never inline on the async runtime.
+async fn gate_wire_resume(
+    state: &WsState,
+    mode: &str,
+    resume_session_id: &mut Option<String>,
+    launch_intent: &mut LaunchIntent,
+    claude_fresh_prealloc: &mut bool,
+) -> ResumeGateCarry {
+    // In-gate liveness precondition: legacy resumeSessionId-only
+    // carriers bypass D7 in every ordering — a LIVE session must never
+    // gate. Same join D7 uses: registry.live_session_owner + the
+    // fresh-agent sidecar liveness consult. SHAPE NOTE
+    // (load-bearing): the sidecar arm is ASYNC
+    // (`has_live_session(sid).await`), so the join is computed as a
+    // plain `let` with `.await` in scope — exactly the shape D7 itself
+    // uses. BOTH arms are load-bearing: dropping the async sidecar arm
+    // silently un-protects live zero-turn sessions that have no rollout
+    // on disk yet.
+    let candidate_is_live = match resume_session_id.as_deref() {
+        None => false,
+        Some(sid) => {
+            let registry_row_live = state
+                .registry
+                .live_session_owner(Some(&state.identity), mode, sid)
+                .is_some();
+            let fresh_agent_live = !registry_row_live
+                && match mode {
+                    "claude" => state.fresh_claude.has_live_session(sid).await,
+                    "codex" => state.fresh_codex.has_live_session(sid).await,
+                    "opencode" => state.fresh_opencode.has_live_session(sid).await,
+                    _ => false,
+                };
+            registry_row_live || fresh_agent_live
+        }
+    };
+    if candidate_is_live {
+        return ResumeGateCarry {
+            notice: None,
+            stale_session_id: None,
+        };
+    }
+    // The probe's by-id locators do real filesystem walks (~1 s for
+    // codex on a real store) — never inline on the async runtime
+    // (A13). Run the sync helper in spawn_blocking.
+    let outcome = {
+        let probe = state.session_existence.clone();
+        let mode_for_gate = mode.to_string();
+        let rid = resume_session_id.take();
+        let intent = *launch_intent;
+        tokio::task::spawn_blocking(move || {
+            crate::resume_validation::validate_wire_resume(
+                &mode_for_gate,
+                rid,
+                intent,
+                probe.as_ref(),
+            )
+        })
+        .await
+        .expect("resume validation task panicked")
+    };
+    *resume_session_id = outcome.resume_session_id;
+    *launch_intent = outcome.launch_intent;
+    if outcome.claude_fresh_prealloc {
+        *claude_fresh_prealloc = true;
+    }
+    if let Some(stale) = outcome.stale_session_id.as_deref() {
+        tracing::warn!(
+            mode = %mode,
+            stale_session_id = %stale,
+            "resume validation: cached session missing on disk; spawning fresh"
+        );
+        // Don't retry the stale id forever. Same blocking-pool
+        // discipline as every other pane-ledger write in this file
+        // (~15ms p50 fsyncs — past the async-worker budget).
+        let ledger = std::sync::Arc::clone(&state.pane_ledger);
+        let retire_mode = mode.to_string();
+        let stale_id = stale.to_string();
+        let _ = tokio::task::spawn_blocking(move || ledger.retire_missing(&retire_mode, &stale_id))
+            .await;
+    }
+    ResumeGateCarry {
+        notice: outcome.notice,
+        stale_session_id: outcome.stale_session_id,
+    }
 }
 
 pub(crate) enum PrepareError {
@@ -1613,7 +1737,29 @@ pub(crate) async fn prepare_launch(
     // from handle_create's `mode` binding so the two sites can never
     // disagree).
     let mode = create.mode.clone();
-    let prep = derive_launch_prep(create, &mode);
+    let mut prep = derive_launch_prep(create, &mode);
+    // Resume-validation door 1, codex leg (reconciled with #589): codex
+    // restore-class planning happens OFF-permit right below, so the
+    // disk-existence gate for codex WIRE ids must run before it — a
+    // definitively-absent stale id must never invoke managed-launch
+    // planning nor consume a sidecar planning slot. Final ordering here:
+    // gate -> plan (off-permit) -> permit -> spawn. Non-codex modes have no
+    // off-permit plan step; they keep the on-permit gate inside
+    // handle_create (post-ladder, post-D7), byte-identical to the branch.
+    let resume_gate = if mode == "codex" && prep.resume_id_from_wire {
+        Some(
+            gate_wire_resume(
+                state,
+                &mode,
+                &mut prep.resume_session_id,
+                &mut prep.launch_intent,
+                &mut prep.claude_fresh_prealloc,
+            )
+            .await,
+        )
+    } else {
+        None
+    };
     // A4 (V2 codex-sidecar audit): pre-gate planning ONLY when a resume
     // session id was derived. A fresh plan (resume_session_id == None,
     // i.e. `require_candidate_persistence`) arms a 45s candidate-capture
@@ -1643,7 +1789,11 @@ pub(crate) async fn prepare_launch(
     } else {
         None
     };
-    Ok(PreparedLaunch { prep, codex_launch })
+    Ok(PreparedLaunch {
+        prep,
+        codex_launch,
+        resume_gate,
+    })
 }
 
 /// `terminal.create` — spawn + register the PTY in the shared registry (owned by no
@@ -1662,13 +1812,13 @@ pub(crate) async fn handle_create(
     // the TOP so `prepared_codex`'s Drop guard is alive across EVERY
     // pre-plan early return below (keyed-create adopt, D8 lease, rate
     // limit, unknown mode, claude ladder, D7 guard, opencode port).
-    let (prep, mut prepared_codex) = match prepared {
+    let (prep, mut prepared_codex, prepared_resume_gate) = match prepared {
         // p.codex_launch is None for non-codex modes AND for the A4
         // fresh-plan exclusion (no derived resume session id) — the None
         // arm of the plan site below then plans on-permit, byte-identical
         // to today.
-        Some(p) => (Some(p.prep), p.codex_launch),
-        None => (None, None),
+        Some(p) => (Some(p.prep), p.codex_launch, p.resume_gate),
+        None => (None, None, None),
     };
     // Single-flight create-dedupe (reconciliation design §5.4, the council's
     // two-tab double-respawn blocker): on `paneReconcileV1` connections ONLY,
@@ -1704,6 +1854,7 @@ pub(crate) async fn handle_create(
                     terminal_id: existing.clone(),
                     clear_codex_durability: None,
                     cwd: state.registry.probe(&existing).and_then(|row| row.cwd),
+                    notice: None,
                     restore_error: None,
                     session_ref: state.identity.session_ref_for(&existing),
                 });
@@ -1768,6 +1919,7 @@ pub(crate) async fn handle_create(
                             terminal_id: terminal_id.clone(),
                             clear_codex_durability: None,
                             cwd: state.registry.probe(&terminal_id).and_then(|row| row.cwd),
+                            notice: None,
                             restore_error: None,
                             session_ref: state
                                 .identity
@@ -1868,9 +2020,10 @@ pub(crate) async fn handle_create(
     );
 
     let LaunchPrep {
-        launch_intent,
+        mut launch_intent,
         mut resume_session_id,
-        claude_fresh_prealloc,
+        mut claude_fresh_prealloc,
+        resume_id_from_wire,
     } = match prep {
         Some(prep) => prep,
         None => derive_launch_prep(&create, &mode),
@@ -1992,6 +2145,40 @@ pub(crate) async fn handle_create(
         }
     }
 
+    // Resume validation (docs/plans/2026-07-29-resume-validation.md). The
+    // codex leg already ran OFF-permit in prepare_launch (gate-before-plan);
+    // every other wire-id create gates here — after the D7 liveness guard
+    // (a gate fire would falsify D7's applicability filter) and after the
+    // claude P0.4 ladder (ladder-resolved ids are wire-originated and must
+    // be validated), before the amplifier ensure_session re-stub (which
+    // would resurrect the stale dir).
+    let mut resume_fallback_notice: Option<String> = None;
+    let resume_gate_carry = match prepared_resume_gate {
+        Some(carry) => Some(carry),
+        None if resume_id_from_wire => Some(
+            gate_wire_resume(
+                state,
+                &mode,
+                &mut resume_session_id,
+                &mut launch_intent,
+                &mut claude_fresh_prealloc,
+            )
+            .await,
+        ),
+        None => None,
+    };
+    if let Some(carry) = resume_gate_carry {
+        if carry.stale_session_id.is_some() {
+            // Stale-ref stamping guard: this create no longer creates the
+            // wire sessionRef's session, so a D8 lease claimed for the
+            // STALE ref must be RELEASED, never completed (completing it
+            // would bind stale-ref->terminal in the registry binding map).
+            // Dropping the armed guard runs fail_session_ref_claim.
+            session_ref_lease = None;
+            resume_fallback_notice = carry.notice;
+        }
+    }
+
     // Branch selection mirrors `buildSpawnSpec` (`tr:1127-1137`): the Windows-shell
     // branches apply on native Windows AND on WSL with an explicit cmd/powershell
     // pane shell (`isWindowsLike() && !inWslWithLinuxShell`). Hoisted ABOVE the
@@ -2831,6 +3018,9 @@ pub(crate) async fn handle_create(
         clear_codex_durability: None,
         // Echo the resolved cwd (`record.cwd`) when the shell spec carries one.
         cwd: spec.cwd.clone(),
+        // Resume-validation door 1: the operator-visible stale-resume notice
+        // (Some only when the gate fired above).
+        notice: resume_fallback_notice,
         restore_error: None,
         // The canonical create-time identity, from the SAME registry every other
         // identity-stamped frame reads (shell creates have no entry -> `None`).
@@ -2937,8 +3127,80 @@ pub async fn respawn_agent_terminal(
     );
 
     // Spawn-time resume identity: intent is ALWAYS `Resume` on this path.
-    let launch_intent = LaunchIntent::Resume;
-    let resume_session_id = Some(req.session_id.clone());
+    // Resume validation (docs/plans/2026-07-29-resume-validation.md): the
+    // respawn id comes from the identity registry / pane ledger — cached
+    // state — so it gets the same disk-existence gate as door 1.
+    // CRITICAL (V8 §A9): the gate replaces these LOCALS, not merely the
+    // launch args — the post-spawn bookkeeping (registry row, identity
+    // upsert, ledger record_binding below) all read `resume_session_id` and
+    // must record the FRESH id, or the stale id is re-minted as a Bound row
+    // right after retire_missing and the respawn loop is real.
+    let outcome = {
+        // The probe's by-id locators do real filesystem walks — never inline
+        // on the async runtime (A13). Run the sync helper in spawn_blocking,
+        // the same shape as door 1.
+        let probe = state.session_existence.clone();
+        let gate_mode = mode.clone();
+        let sid = Some(req.session_id.clone());
+        tokio::task::spawn_blocking(move || {
+            crate::resume_validation::validate_wire_resume(
+                &gate_mode,
+                sid,
+                LaunchIntent::Resume,
+                probe.as_ref(),
+            )
+        })
+        .await
+        .expect("resume validation task panicked")
+    };
+    let launch_intent = outcome.launch_intent;
+    let resume_session_id = outcome.resume_session_id;
+    if let Some(stale) = outcome.stale_session_id.as_deref() {
+        tracing::warn!(
+            mode = %req.mode,
+            stale_session_id = %stale,
+            "resume validation (respawn): cached session missing on disk; respawning fresh"
+        );
+        // Don't retry the stale id forever. Same blocking-pool discipline as
+        // door 1 (~15ms p50 fsyncs — past the async-worker budget).
+        {
+            let ledger = std::sync::Arc::clone(&state.pane_ledger);
+            let retire_provider = req.provider.clone();
+            let stale_id = stale.to_string();
+            let _ = tokio::task::spawn_blocking(move || {
+                ledger.retire_missing(&retire_provider, &stale_id)
+            })
+            .await;
+        }
+        // Headless path: no per-create `out` sink. Broadcast the existing
+        // Recovering status frame (precedent: auto_resume.rs emit_recovering)
+        // with the notice as reason. Reason prose is presentational-only per
+        // the protocol doc; the typed fields carry no data change here.
+        //
+        // Deliberate decision AD-3 (accepted, documented — no behavior
+        // change): after this gate-fired respawn, the auto-resume hub's
+        // `complete_claim` keeps the STALE locator's lease bound to the FRESH
+        // terminal (auto_resume.rs → registry.complete_session_ref_claim). A
+        // later `terminal.create` carrying the stale ref then adopts the
+        // fresh terminal via `BoundElsewhere` WITHOUT door 1's notice. This
+        // is convergent (no loop, no duplicate pane, the user reaches the
+        // fresh terminal); the only cost is a missing notice on a rare
+        // second-order path. Releasing/rebinding the lease would mean new
+        // registry API surface for no user-visible gain.
+        let msg =
+            freshell_protocol::ServerMessage::TerminalStatus(freshell_protocol::TerminalStatus {
+                status: freshell_protocol::RuntimeStatus::Recovering,
+                terminal_id: terminal_id.clone(),
+                attempt: None,
+                max_attempts: None,
+                exit_code: None,
+                reason: outcome.notice.clone(),
+                resume_cycles: None,
+            });
+        if let Ok(json) = serde_json::to_string(&msg) {
+            let _ = state.broadcast_tx.send(json);
+        }
+    }
 
     // Launch params from state.settings EXACTLY as handle_create derives them
     // (BindingRow launch fields are hardcoded None for terminal panes —
@@ -3062,14 +3324,18 @@ pub async fn respawn_agent_terminal(
     };
     let child_env = build_child_env_from_process(&spec);
 
-    // Launcher-assigned amplifier identity: a respawn resumes req.session_id
-    // unconditionally — make that resume guaranteed-resumable first
-    // (ensure-after-GC; existing/used sessions are found and left
-    // untouched). Best-effort: a failure here must not veto the respawn —
-    // the CLI itself will fail loudly in-terminal if the dir is truly gone.
+    // Launcher-assigned amplifier identity: a respawn resumes the
+    // gate-validated `resume_session_id` (== req.session_id unless the gate
+    // above minted a fresh uuid) — make that resume guaranteed-resumable
+    // first (ensure-after-GC; existing/used sessions are found and left
+    // untouched). Keying off the LOCAL, not req.session_id, is load-bearing:
+    // a gate-fired respawn must stub the FRESH id, never resurrect the stale
+    // dir. Best-effort: a failure here must not veto the respawn — the CLI
+    // itself will fail loudly in-terminal if the dir is truly gone.
     let mut respawn_amplifier_stub_gc: Option<AmplifierStubGc> = None;
     if req.mode == "amplifier" {
-        if let (Some(amp_home), Some(cwd)) = (
+        if let (Some(sid), Some(amp_home), Some(cwd)) = (
+            resume_session_id.as_deref(),
             freshell_sessions::amplifier_stub::resolve_amplifier_home(),
             req.cwd
                 .as_deref()
@@ -3077,7 +3343,7 @@ pub async fn respawn_agent_terminal(
         ) {
             match freshell_sessions::amplifier_stub::ensure_session(
                 &amp_home,
-                &req.session_id,
+                sid,
                 cwd,
                 &terminal_id,
             ) {
diff --git a/crates/freshell-ws/src/terminal_launch_prep_tests.rs b/crates/freshell-ws/src/terminal_launch_prep_tests.rs
new file mode 100644
index 000000000..6d8c1c2e2
--- /dev/null
+++ b/crates/freshell-ws/src/terminal_launch_prep_tests.rs
@@ -0,0 +1,98 @@
+//! First direct unit tests for derive_launch_prep (it previously had only
+//! indirect integration coverage). Pins the ORIGIN semantics of
+//! LaunchPrep.resume_id_from_wire: true only for wire-derived resume ids,
+//! false for BOTH server-prealloc arms (claude fresh prealloc AND the
+//! amplifier launcher-assigned identity) and for mode == "shell".
+use super::*;
+
+fn create_from_json(v: serde_json::Value) -> TerminalCreate {
+    serde_json::from_value(v).expect("valid TerminalCreate json")
+}
+
+#[test]
+fn wire_session_ref_restore_is_from_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-wire-ref",
+        "mode": "codex",
+        "shell": "system",
+        "restore": true,
+        "sessionRef": { "provider": "codex", "sessionId": "stale-codex-id" }
+    }));
+    let prep = derive_launch_prep(&create, "codex");
+    assert!(
+        prep.resume_id_from_wire,
+        "sessionRef carrier is wire-originated"
+    );
+    assert_eq!(prep.resume_session_id.as_deref(), Some("stale-codex-id"));
+    assert!(!prep.claude_fresh_prealloc);
+    assert!(matches!(prep.launch_intent, LaunchIntent::Resume));
+}
+
+#[test]
+fn wire_legacy_resume_session_id_is_from_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-wire-legacy",
+        "mode": "amplifier",
+        "shell": "system",
+        "restore": true,
+        "resumeSessionId": "stale-amp-id"
+    }));
+    let prep = derive_launch_prep(&create, "amplifier");
+    assert!(
+        prep.resume_id_from_wire,
+        "legacy resumeSessionId carrier is wire-originated"
+    );
+    assert_eq!(prep.resume_session_id.as_deref(), Some("stale-amp-id"));
+}
+
+#[test]
+fn claude_fresh_prealloc_is_server_allocated_not_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-claude-fresh",
+        "mode": "claude",
+        "shell": "system"
+    }));
+    let prep = derive_launch_prep(&create, "claude");
+    assert!(prep.claude_fresh_prealloc);
+    assert!(matches!(prep.launch_intent, LaunchIntent::Start));
+    let minted = prep.resume_session_id.expect("prealloc mints a fresh id");
+    uuid::Uuid::parse_str(&minted).expect("minted id is a uuid");
+    assert!(
+        !prep.resume_id_from_wire,
+        "server-preallocated claude id must NEVER be gate-eligible"
+    );
+}
+
+#[test]
+fn amplifier_fresh_prealloc_is_server_allocated_not_wire() {
+    // THE TRAP CASE: amplifier prealloc mints a server id while
+    // claude_fresh_prealloc stays false — the flag must still be false.
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-amp-fresh",
+        "mode": "amplifier",
+        "shell": "system"
+    }));
+    let prep = derive_launch_prep(&create, "amplifier");
+    assert!(!prep.claude_fresh_prealloc);
+    assert!(matches!(prep.launch_intent, LaunchIntent::Resume));
+    let minted = prep
+        .resume_session_id
+        .expect("amplifier prealloc mints a fresh id");
+    uuid::Uuid::parse_str(&minted).expect("minted id is a uuid");
+    assert!(
+        !prep.resume_id_from_wire,
+        "server-minted amplifier id must NEVER be gate-eligible"
+    );
+}
+
+#[test]
+fn shell_mode_is_never_from_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-shell",
+        "mode": "shell",
+        "shell": "system"
+    }));
+    let prep = derive_launch_prep(&create, "shell");
+    assert!(!prep.resume_id_from_wire);
+    assert!(prep.resume_session_id.is_none());
+}
diff --git a/crates/freshell-ws/tests/auto_resume_respawn.rs b/crates/freshell-ws/tests/auto_resume_respawn.rs
index 0a7e2bd23..56f218bb7 100644
--- a/crates/freshell-ws/tests/auto_resume_respawn.rs
+++ b/crates/freshell-ws/tests/auto_resume_respawn.rs
@@ -10,12 +10,18 @@
 
 mod common;
 
+use std::sync::Arc;
 use std::time::Duration;
 
 use common::{connect_and_capture_inventory, next_frame_of_type};
 use futures_util::SinkExt;
+use serde_json::Value;
 use tokio_tungstenite::tungstenite::Message as WsMessage;
 
+use freshell_ws::existence::{SessionExistence, SessionExistenceProbe};
+use freshell_ws::pane_ledger::{BindingWrite, PaneLedger, RetiredReason, RowState};
+use freshell_ws::WsState;
+
 /// A claude-shaped CLI spec whose command records its argv (one token per
 /// line, atomically via tmp+mv) to `capture`, then exits 1 — so the first
 /// generation "crashes" immediately and a respawn's argv overwrites the
@@ -253,3 +259,358 @@ async fn respawn_is_rejected_loud_when_spawn_gate_queue_is_full() {
         let _ = w.await;
     }
 }
+
+// ── Door 2 (resume-validation): gate the headless respawn ──────────────────
+
+/// Scripted disk-truth probe (the `resume_validation_gate.rs` convention).
+#[derive(Default)]
+struct StubProbe {
+    answers: std::sync::Mutex<std::collections::HashMap<(String, String), SessionExistence>>,
+}
+
+impl StubProbe {
+    fn answering(provider: &str, session_id: &str, answer: SessionExistence) -> Arc<Self> {
+        let probe = Self::default();
+        probe
+            .answers
+            .lock()
+            .unwrap()
+            .insert((provider.to_string(), session_id.to_string()), answer);
+        Arc::new(probe)
+    }
+}
+
+impl SessionExistenceProbe for StubProbe {
+    fn exists(&self, provider: &str, session_id: &str) -> SessionExistence {
+        self.answers
+            .lock()
+            .unwrap()
+            .get(&(provider.into(), session_id.into()))
+            .copied()
+            .unwrap_or(SessionExistence::Unknown)
+    }
+    fn ever_observed(&self, _provider: &str, _session_id: &str) -> bool {
+        // Amplifier gating never consults the on-disk-history flag (only the
+        // claude zero-turn carve-out does).
+        false
+    }
+}
+
+fn now_ms() -> i64 {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("clock after epoch")
+        .as_millis() as i64
+}
+
+/// Seed a Bound ledger row for `(provider, session_id)` through the STATE'S
+/// ledger Arc (write-through index — V1.md read policy).
+fn seed_bound_row(ledger: &PaneLedger, provider: &str, session_id: &str) {
+    ledger
+        .record_binding(&BindingWrite {
+            provider,
+            session_id,
+            terminal_id: "t-prior-epoch",
+            mode: provider,
+            cwd: None,
+            create_request_id: None,
+            now_ms: now_ms(),
+        })
+        .expect("seed bound ledger row");
+    assert_eq!(
+        ledger
+            .load_binding(provider, session_id)
+            .expect("seeded row present")
+            .state,
+        RowState::Bound
+    );
+}
+
+/// Does `<amp_home>/projects/*/sessions/<session_id>` exist?
+fn amplifier_session_dir_exists(amp_home: &std::path::Path, session_id: &str) -> bool {
+    let Ok(entries) = std::fs::read_dir(amp_home.join("projects")) else {
+        return false;
+    };
+    entries
+        .flatten()
+        .any(|e| e.path().join("sessions").join(session_id).is_dir())
+}
+
+/// A directly-constructed `WsState` for driving `respawn_agent_terminal`
+/// (no WS connection needed on the headless door): injected existence probe +
+/// REAL pane ledger in a fresh temp dir, amplifier sleeper CLI spec so the
+/// respawn genuinely spawns. Field-for-field the
+/// `resume_validation_gate.rs::spawn_server_with_probe` state.
+fn respawn_state_with_probe(
+    probe: Arc<dyn SessionExistenceProbe>,
+) -> (
+    freshell_terminal::TerminalRegistry,
+    Arc<PaneLedger>,
+    WsState,
+) {
+    // F7/V9 choke point: amplifier respawns write stub dirs — never the real home.
+    let _ = common::isolate_amplifier_home();
+    let ledger_dir = std::env::temp_dir().join(format!(
+        "freshell-respawn-gate-ledger-{}-{}",
+        std::process::id(),
+        now_ms()
+    ));
+    std::fs::create_dir_all(&ledger_dir).expect("create ledger temp dir");
+    let pane_ledger = Arc::new(PaneLedger::new(Some(ledger_dir)));
+
+    let auth_token = Arc::new(common::AUTH_TOKEN.to_string());
+    let broadcast_tx = Arc::new(tokio::sync::broadcast::channel::<String>(64).0);
+    let settings = Arc::new(
+        serde_json::from_value(common::test_settings_value()).expect("valid settings fixture"),
+    );
+    let registry = freshell_terminal::TerminalRegistry::new();
+
+    let state = WsState {
+        pane_ledger: Arc::clone(&pane_ledger),
+        identity: freshell_ws::identity::TerminalIdentityRegistry::new(),
+        auth_token: Arc::clone(&auth_token),
+        server_instance_id: Arc::new("srv-test".to_string()),
+        boot_id: Arc::new("boot-test".to_string()),
+        settings,
+        broadcast_tx: Arc::clone(&broadcast_tx),
+        auto_resume_tx: tokio::sync::mpsc::unbounded_channel().0,
+        auto_resume_cancels: Default::default(),
+        fresh_codex: freshell_freshagent::FreshCodexState::new(
+            Arc::clone(&auth_token),
+            Arc::clone(&broadcast_tx),
+            serde_json::json!({ "freshAgent": { "enabled": false } }),
+        ),
+        fresh_claude: freshell_freshagent::FreshClaudeState::new(Arc::clone(&broadcast_tx)),
+        fresh_opencode: freshell_freshagent::FreshOpencodeState::new(
+            freshell_freshagent::FreshAgentState::new(
+                Arc::clone(&auth_token),
+                Arc::clone(&broadcast_tx),
+            ),
+        ),
+        registry: registry.clone(),
+        tabs: freshell_ws::tabs::TabsRegistry::new(),
+        screenshots: freshell_ws::screenshot::ScreenshotBroker::new(Arc::clone(&broadcast_tx)),
+        terminals_revision: Arc::new(std::sync::atomic::AtomicI64::new(0)),
+        sessions_revision: Arc::new(std::sync::atomic::AtomicI64::new(0)),
+        cli_commands: Arc::new(vec![common::sleeper_cli_spec("amplifier")]),
+        shutdown: Arc::new(tokio::sync::Notify::new()),
+        ping_interval_ms: 30_000,
+        hello_timeout_ms: 5_000,
+        allowed_origins: Arc::new(freshell_ws::origin::default_allowed_origins()),
+        ws_max_payload_bytes: 16 * 1024 * 1024,
+        term09: freshell_ws::backpressure::Term09Config::default(),
+        create_protect: freshell_ws::create_limit::CreateProtectConfig::default(),
+        spawn_gate: Arc::new(freshell_ws::spawn_gate::SpawnGate::new(4, 64)),
+        shutdown_started: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+        create_dedupe: Arc::new(freshell_ws::create_dedupe::CreateDedupe::default()),
+        config_fallback: None,
+        opencode_locator: None,
+        codex_locator: None,
+        activity: None,
+        session_existence: probe,
+        reconcile_deferral_budget_ms: freshell_ws::reconcile::RECONCILE_DEFERRAL_BUDGET_MS_DEFAULT,
+        fresh_agent_respawn_counts: Default::default(),
+    };
+
+    (registry, pane_ledger, state)
+}
+
+/// Drain every frame buffered on the broadcast receiver into parsed JSON.
+fn drain_broadcast_frames(rx: &mut tokio::sync::broadcast::Receiver<String>) -> Vec<Value> {
+    let mut frames = Vec::new();
+    while let Ok(json) = rx.try_recv() {
+        if let Ok(v) = serde_json::from_str::<Value>(&json) {
+            frames.push(v);
+        }
+    }
+    frames
+}
+
+/// Door 2 gate fire: a respawn of an amplifier id that is definitively absent
+/// from the store must PROCEED as a fresh spawn (the pane survives), retire
+/// the stale Bound row `SessionMissing`, never re-stub the stale dir,
+/// broadcast a `terminal.status{recovering, reason}` frame naming the stale
+/// id, and carry the FRESH id through ALL post-spawn bookkeeping (V8 §A9:
+/// registry row, identity upsert, ledger record_binding — a Bound row for the
+/// stale id must NOT be re-minted right after retire_missing).
+#[tokio::test(flavor = "multi_thread")]
+#[cfg(unix)]
+async fn respawn_with_absent_session_spawns_fresh_and_retires_binding() {
+    let amp_home = common::isolate_amplifier_home();
+    let probe = StubProbe::answering("amplifier", "stale-amp", SessionExistence::Absent);
+    let (registry, ledger, state) = respawn_state_with_probe(probe);
+    seed_bound_row(&ledger, "amplifier", "stale-amp");
+    let mut rx = state.broadcast_tx.subscribe();
+
+    let new_tid = freshell_ws::terminal::respawn_agent_terminal(
+        &state,
+        &freshell_ws::terminal::AgentRespawnRequest {
+            mode: "amplifier".into(),
+            provider: "amplifier".into(),
+            session_id: "stale-amp".into(),
+            create_request_id: "req-respawn-gate-1".into(),
+            cwd: Some(std::env::temp_dir().to_string_lossy().to_string()),
+        },
+    )
+    .await
+    .expect("a gate-fired respawn must proceed as a fresh spawn, never an error");
+
+    // 2. The stale row is retired SessionMissing — never retried forever.
+    let stale_row = ledger
+        .load_binding("amplifier", "stale-amp")
+        .expect("stale row still exists (retired, not deleted)");
+    assert_eq!(stale_row.state, RowState::Retired);
+    assert_eq!(
+        stale_row.retired_reason,
+        Some(RetiredReason::SessionMissing)
+    );
+
+    // 5. V8 §A9 pin: the NEW generation's bookkeeping carries the FRESH id.
+    let sref = state
+        .identity
+        .session_ref_for(&new_tid)
+        .expect("identity registry entry for the new terminal");
+    assert_eq!(sref.provider, "amplifier");
+    let fresh_id = sref.session_id.clone();
+    assert_ne!(fresh_id, "stale-amp", "identity must name the fresh uuid");
+    assert_eq!(
+        registry
+            .probe(&new_tid)
+            .expect("registry row")
+            .resume_session_id
+            .as_deref(),
+        Some(fresh_id.as_str()),
+        "the registry row must record the fresh id, not the stale one"
+    );
+    assert_eq!(
+        ledger
+            .load_binding("amplifier", &fresh_id)
+            .expect("fresh Bound row")
+            .state,
+        RowState::Bound
+    );
+    // record_binding must NOT have resurrected the stale id as Bound.
+    assert_eq!(
+        ledger
+            .load_binding("amplifier", "stale-amp")
+            .expect("stale row present")
+            .state,
+        RowState::Retired,
+        "record_binding re-minted a Bound row for the stale id (respawn loop)"
+    );
+
+    // 3. ensure_session must not run for the stale id.
+    assert!(
+        !amplifier_session_dir_exists(&amp_home, "stale-amp"),
+        "the amplifier pre-spawn stub must never resurrect the stale dir"
+    );
+
+    // 4. A broadcast terminal.status{recovering} frame names the stale id.
+    let frames = drain_broadcast_frames(&mut rx);
+    assert!(
+        frames.iter().any(|v| v["type"] == "terminal.status"
+            && v["status"] == "recovering"
+            && v["reason"]
+                .as_str()
+                .is_some_and(|r| r.contains("stale-amp"))),
+        "no recovering broadcast naming the stale id; frames: {frames:?}"
+    );
+
+    // #582 interplay: a gate-fired respawn is ONE ordinary recovery cycle.
+    // (a) Exactly one Recovering status frame was broadcast for this respawn —
+    //     the gate must not add a second cycle's worth of status traffic.
+    let recovering_frames = frames
+        .iter()
+        .filter(|v| {
+            v["type"] == "terminal.status"
+                && v["status"] == "recovering"
+                && v["reason"]
+                    .as_str()
+                    .is_some_and(|r| r.contains("stale-amp"))
+        })
+        .count();
+    assert_eq!(
+        recovering_frames, 1,
+        "gate-fired respawn is a single recovery cycle"
+    );
+
+    // (b) The gate itself must not emit a breaker settle: no
+    //     terminal.status{status: exited, resumeCycles: Some(_)} frame
+    //     appears as part of this respawn.
+    assert!(
+        !frames.iter().any(|v| v["type"] == "terminal.status"
+            && v["status"] == "exited"
+            && !v["resumeCycles"].is_null()),
+        "gate must not synthesize a breaker settle frame"
+    );
+
+    // (c) auto_resume_cancels bookkeeping is untouched by the gate — the
+    //     harness state's cancel set/map remains empty (no phantom cancel).
+    assert!(
+        state
+            .auto_resume_cancels
+            .lock()
+            .expect("auto_resume_cancels lock")
+            .is_empty(),
+        "gate must not record a phantom autoResumeCancel"
+    );
+
+    registry.kill_all();
+}
+
+/// Fail-open pin: Unknown existence resumes EXACTLY as today — the spawned
+/// generation carries the resume id, the row stays Bound, and no
+/// recovering-with-stale-id broadcast is emitted.
+#[tokio::test(flavor = "multi_thread")]
+#[cfg(unix)]
+async fn respawn_with_unknown_existence_resumes_exactly_as_today() {
+    let probe = StubProbe::answering("amplifier", "maybe-amp", SessionExistence::Unknown);
+    let (registry, ledger, state) = respawn_state_with_probe(probe);
+    seed_bound_row(&ledger, "amplifier", "maybe-amp");
+    let mut rx = state.broadcast_tx.subscribe();
+
+    let new_tid = freshell_ws::terminal::respawn_agent_terminal(
+        &state,
+        &freshell_ws::terminal::AgentRespawnRequest {
+            mode: "amplifier".into(),
+            provider: "amplifier".into(),
+            session_id: "maybe-amp".into(),
+            create_request_id: "req-respawn-gate-2".into(),
+            cwd: Some(std::env::temp_dir().to_string_lossy().to_string()),
+        },
+    )
+    .await
+    .expect("Unknown fails open: the respawn proceeds as a resume");
+
+    // The spawned generation still carries the resume id (the sibling test's
+    // registry-row observation point) and the row stays Bound.
+    assert_eq!(
+        registry
+            .probe(&new_tid)
+            .expect("registry row")
+            .resume_session_id
+            .as_deref(),
+        Some("maybe-amp")
+    );
+    assert_eq!(
+        ledger
+            .load_binding("amplifier", "maybe-amp")
+            .expect("row present")
+            .state,
+        RowState::Bound
+    );
+
+    // No recovering-with-stale-id broadcast on the fail-open path.
+    let frames = drain_broadcast_frames(&mut rx);
+    assert!(
+        !frames.iter().any(|v| v["type"] == "terminal.status"
+            && v["status"] == "recovering"
+            && v["reason"]
+                .as_str()
+                .is_some_and(|r| r.contains("maybe-amp"))),
+        "Unknown must never emit the stale-id recovering frame; frames: {frames:?}"
+    );
+
+    registry.kill_all();
+}
diff --git a/crates/freshell-ws/tests/resume_validation_gate.rs b/crates/freshell-ws/tests/resume_validation_gate.rs
new file mode 100644
index 000000000..304e8408a
--- /dev/null
+++ b/crates/freshell-ws/tests/resume_validation_gate.rs
@@ -0,0 +1,1051 @@
+//! Door 1 (resume-validation feature): the WS `terminal.create` restore path
+//! consults the disk-existence probe before turning a WIRE-derived resume id
+//! into resume argv. POSITIVE absence => fresh-spawn fallback + `notice` on
+//! `terminal.created` + `retire_missing` on the pane ledger. Everything else
+//! (Present/Unknown/live sessions) proceeds byte-identically to today.
+//!
+//! Harness: the `restore_spawn_gate.rs` convention — REAL axum server + REAL
+//! tokio-tungstenite client on an ephemeral loopback port — with an injected
+//! fake `SharedExistenceProbe` and a REAL pane ledger in a temp dir.
+
+mod common;
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{json, Value};
+use tokio::net::TcpListener;
+use tokio_tungstenite::tungstenite::Message as WsMessage;
+
+use freshell_ws::existence::{SessionExistence, SessionExistenceProbe};
+use freshell_ws::pane_ledger::{BindingWrite, PaneLedger, RetiredReason, RowState};
+use freshell_ws::WsState;
+
+// ── scripted disk-truth probe (pane_reconcile_freshagent.rs convention) ──────
+
+#[derive(Default)]
+struct StubProbe {
+    answers: std::sync::Mutex<std::collections::HashMap<(String, String), SessionExistence>>,
+}
+
+impl StubProbe {
+    fn answering(provider: &str, session_id: &str, answer: SessionExistence) -> Arc<Self> {
+        let probe = Self::default();
+        probe
+            .answers
+            .lock()
+            .unwrap()
+            .insert((provider.to_string(), session_id.to_string()), answer);
+        Arc::new(probe)
+    }
+}
+
+impl SessionExistenceProbe for StubProbe {
+    fn exists(&self, provider: &str, session_id: &str) -> SessionExistence {
+        self.answers
+            .lock()
+            .unwrap()
+            .get(&(provider.into(), session_id.into()))
+            .copied()
+            .unwrap_or(SessionExistence::Unknown)
+    }
+    fn ever_observed(&self, _provider: &str, _session_id: &str) -> bool {
+        // Amplifier/codex gating never consults the on-disk-history flag
+        // (only the claude zero-turn carve-out does), so the fakes keep it
+        // trivially false via the trait default.
+        false
+    }
+}
+
+/// Answers Absent-but-previously-observed for EVERY (provider, id) query —
+/// including ids minted server-side that the test cannot know in advance.
+/// `ever_observed → true` is load-bearing: it defeats the claude zero-turn
+/// carve-out (Absent + never-observed → Proceed, resume_gate.rs:100-104),
+/// so ANY gate consult on a server-allocated id — claude included —
+/// evaluates to SpawnFresh (resume_gate.rs:119), fires the notice, and
+/// fails the assertions below.
+struct AbsentButObservedProbe;
+
+impl SessionExistenceProbe for AbsentButObservedProbe {
+    fn exists(&self, _provider: &str, _session_id: &str) -> SessionExistence {
+        SessionExistence::Absent
+    }
+    fn ever_observed(&self, _provider: &str, _session_id: &str) -> bool {
+        true
+    }
+}
+
+fn now_ms() -> i64 {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("clock after epoch")
+        .as_millis() as i64
+}
+
+/// Seed a Bound ledger row for `(provider, session_id)` through the SERVER'S
+/// ledger Arc (write-through index — V1.md read policy).
+fn seed_bound_row(ledger: &PaneLedger, provider: &str, session_id: &str) {
+    ledger
+        .record_binding(&BindingWrite {
+            provider,
+            session_id,
+            terminal_id: "t-prior-epoch",
+            mode: provider,
+            cwd: None,
+            create_request_id: None,
+            now_ms: now_ms(),
+        })
+        .expect("seed bound ledger row");
+    assert_eq!(
+        ledger
+            .load_binding(provider, session_id)
+            .expect("seeded row present")
+            .state,
+        RowState::Bound
+    );
+}
+
+/// Real server with an injected existence probe + a REAL pane ledger rooted
+/// in a fresh temp dir. Returns `(ws_url, registry, ledger, state)` — the
+/// state clone lets tests seed liveness (identity upsert) the way
+/// `spawn_server_with_specs_and_state` consumers do.
+async fn spawn_server_with_probe(
+    probe: Arc<dyn SessionExistenceProbe>,
+    fresh_agent_enabled: bool,
+) -> (
+    String,
+    freshell_terminal::TerminalRegistry,
+    Arc<PaneLedger>,
+    WsState,
+) {
+    // F7/V9 choke point: amplifier creates write stub dirs — never the real home.
+    let _ = common::isolate_amplifier_home();
+    let ledger_dir = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-ledger-{}-{}",
+        std::process::id(),
+        uuid_like_suffix()
+    ));
+    std::fs::create_dir_all(&ledger_dir).expect("create ledger temp dir");
+    let pane_ledger = Arc::new(PaneLedger::new(Some(ledger_dir)));
+
+    let auth_token = Arc::new(common::AUTH_TOKEN.to_string());
+    let broadcast_tx = Arc::new(tokio::sync::broadcast::channel::<String>(64).0);
+    let mut settings_value = common::test_settings_value();
+    settings_value["freshAgent"]["enabled"] = json!(fresh_agent_enabled);
+    let settings =
+        Arc::new(serde_json::from_value(settings_value).expect("valid settings fixture"));
+    let registry = freshell_terminal::TerminalRegistry::new();
+
+    let state = WsState {
+        pane_ledger: Arc::clone(&pane_ledger),
+        identity: freshell_ws::identity::TerminalIdentityRegistry::new(),
+        auth_token: Arc::clone(&auth_token),
+        server_instance_id: Arc::new("srv-test".to_string()),
+        boot_id: Arc::new("boot-test".to_string()),
+        settings,
+        broadcast_tx: Arc::clone(&broadcast_tx),
+        auto_resume_tx: tokio::sync::mpsc::unbounded_channel().0,
+        auto_resume_cancels: Default::default(),
+        fresh_codex: freshell_freshagent::FreshCodexState::new(
+            Arc::clone(&auth_token),
+            Arc::clone(&broadcast_tx),
+            json!({ "freshAgent": { "enabled": fresh_agent_enabled } }),
+        ),
+        fresh_claude: freshell_freshagent::FreshClaudeState::new(Arc::clone(&broadcast_tx)),
+        fresh_opencode: freshell_freshagent::FreshOpencodeState::new(
+            freshell_freshagent::FreshAgentState::new(
+                Arc::clone(&auth_token),
+                Arc::clone(&broadcast_tx),
+            ),
+        ),
+        registry: registry.clone(),
+        tabs: freshell_ws::tabs::TabsRegistry::new(),
+        screenshots: freshell_ws::screenshot::ScreenshotBroker::new(Arc::clone(&broadcast_tx)),
+        terminals_revision: Arc::new(std::sync::atomic::AtomicI64::new(0)),
+        sessions_revision: Arc::new(std::sync::atomic::AtomicI64::new(0)),
+        cli_commands: Arc::new(vec![
+            common::sleeper_cli_spec("amplifier"),
+            common::sleeper_cli_spec("claude"),
+            common::sleeper_cli_spec("codex"),
+        ]),
+        shutdown: Arc::new(tokio::sync::Notify::new()),
+        ping_interval_ms: 30_000,
+        hello_timeout_ms: 5_000,
+        allowed_origins: Arc::new(freshell_ws::origin::default_allowed_origins()),
+        ws_max_payload_bytes: 16 * 1024 * 1024,
+        term09: freshell_ws::backpressure::Term09Config::default(),
+        create_protect: freshell_ws::create_limit::CreateProtectConfig::default(),
+        spawn_gate: Arc::new(freshell_ws::spawn_gate::SpawnGate::new(4, 64)),
+        shutdown_started: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+        create_dedupe: Arc::new(freshell_ws::create_dedupe::CreateDedupe::default()),
+        config_fallback: None,
+        opencode_locator: None,
+        codex_locator: None,
+        activity: None,
+        session_existence: probe,
+        reconcile_deferral_budget_ms: freshell_ws::reconcile::RECONCILE_DEFERRAL_BUDGET_MS_DEFAULT,
+        fresh_agent_respawn_counts: Default::default(),
+    };
+
+    let router = freshell_ws::router(state.clone());
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind ephemeral loopback port");
+    let addr = listener.local_addr().expect("local addr");
+    tokio::spawn(async move {
+        let _ = axum::serve(listener, router).await;
+    });
+
+    (format!("ws://{addr}/ws"), registry, pane_ledger, state)
+}
+
+// ── seam 5a pieces (DEV-0006 S5) — copied from codex_managed_launch_e2e.rs ──
+
+const RECV_TIMEOUT: Duration = Duration::from_secs(20);
+
+/// Real codex CliCommandSpec (env_var seam) — copied from
+/// codex_managed_launch_e2e.rs so the resolver takes the REAL codex branch
+/// and managed-launch planning engages.
+fn codex_cli_spec() -> freshell_platform::CliCommandSpec {
+    fn s(v: &[&str]) -> Vec<String> {
+        v.iter().map(|x| x.to_string()).collect()
+    }
+    freshell_platform::CliCommandSpec {
+        name: "codex".into(),
+        label: "Codex CLI".into(),
+        env_var: Some("CODEX_CMD".into()),
+        default_cmd: "codex".into(),
+        resume_args: Some(s(&["resume", "{{sessionId}}"])),
+        model_args: Some(s(&["--model", "{{model}}"])),
+        sandbox_args: Some(s(&["--sandbox", "{{sandbox}}"])),
+        ..Default::default()
+    }
+}
+
+/// Node dispatcher playing both codex roles — verbatim from
+/// codex_managed_launch_e2e.rs (app-server argv -> run the committed
+/// fake-app-server.mjs fixture; else dump argv JSON to
+/// $CODEX_ARGV_CAPTURE_PATH and stay alive).
+fn write_codex_dispatcher() -> std::path::PathBuf {
+    let fixture = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../../test/fixtures/coding-cli/codex-app-server/fake-app-server.mjs")
+        .canonicalize()
+        .expect("fake-app-server fixture exists");
+    let dispatcher = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-dispatcher-{}.mjs",
+        std::process::id()
+    ));
+    let script = format!(
+        "#!/usr/bin/env node\n\
+         import fs from 'node:fs'\n\
+         const args = process.argv.slice(2)\n\
+         if (args.includes('app-server')) {{\n\
+           await import('file://{fixture}')\n\
+         }} else {{\n\
+           fs.writeFileSync(process.env.CODEX_ARGV_CAPTURE_PATH, JSON.stringify(args))\n\
+           setInterval(() => undefined, 1000)\n\
+         }}\n",
+        fixture = fixture.display()
+    );
+    std::fs::write(&dispatcher, script).expect("write dispatcher");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&dispatcher, std::fs::Permissions::from_mode(0o755))
+            .expect("chmod dispatcher");
+    }
+    dispatcher
+}
+
+/// Poll the capture file the dispatcher writes until it appears, then parse
+/// the argv — verbatim from codex_managed_launch_e2e.rs (a SYNC helper).
+fn wait_for_captured_argv(path: &std::path::Path) -> Vec<String> {
+    let deadline = std::time::Instant::now() + RECV_TIMEOUT;
+    loop {
+        if let Ok(raw) = std::fs::read_to_string(path) {
+            if !raw.is_empty() {
+                return serde_json::from_str(&raw).expect("captured argv is a JSON array");
+            }
+        }
+        assert!(
+            std::time::Instant::now() < deadline,
+            "spawned codex child never wrote its argv capture at {}",
+            path.display()
+        );
+        std::thread::sleep(Duration::from_millis(50));
+    }
+}
+
+/// Managed-codex harness: modeled line-for-line on `spawn_server_with_probe`
+/// with exactly one difference — the CLI specs are the REAL codex spec only
+/// (no sleeper specs), so the resolver takes the env_var codex branch and
+/// managed-launch planning engages.
+async fn spawn_managed_codex_server_with_probe(
+    probe: Arc<dyn SessionExistenceProbe>,
+    fresh_agent_enabled: bool,
+) -> (
+    String,
+    freshell_terminal::TerminalRegistry,
+    Arc<PaneLedger>,
+    WsState,
+) {
+    // F7/V9 choke point: amplifier creates write stub dirs — never the real home.
+    let _ = common::isolate_amplifier_home();
+    let ledger_dir = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-ledger-{}-{}",
+        std::process::id(),
+        uuid_like_suffix()
+    ));
+    std::fs::create_dir_all(&ledger_dir).expect("create ledger temp dir");
+    let pane_ledger = Arc::new(PaneLedger::new(Some(ledger_dir)));
+
+    let auth_token = Arc::new(common::AUTH_TOKEN.to_string());
+    let broadcast_tx = Arc::new(tokio::sync::broadcast::channel::<String>(64).0);
+    let mut settings_value = common::test_settings_value();
+    settings_value["freshAgent"]["enabled"] = json!(fresh_agent_enabled);
+    let settings =
+        Arc::new(serde_json::from_value(settings_value).expect("valid settings fixture"));
+    let registry = freshell_terminal::TerminalRegistry::new();
+
+    let state = WsState {
+        pane_ledger: Arc::clone(&pane_ledger),
+        identity: freshell_ws::identity::TerminalIdentityRegistry::new(),
+        auth_token: Arc::clone(&auth_token),
+        server_instance_id: Arc::new("srv-test".to_string()),
+        boot_id: Arc::new("boot-test".to_string()),
+        settings,
+        broadcast_tx: Arc::clone(&broadcast_tx),
+        auto_resume_tx: tokio::sync::mpsc::unbounded_channel().0,
+        auto_resume_cancels: Default::default(),
+        fresh_codex: freshell_freshagent::FreshCodexState::new(
+            Arc::clone(&auth_token),
+            Arc::clone(&broadcast_tx),
+            json!({ "freshAgent": { "enabled": fresh_agent_enabled } }),
+        ),
+        fresh_claude: freshell_freshagent::FreshClaudeState::new(Arc::clone(&broadcast_tx)),
+        fresh_opencode: freshell_freshagent::FreshOpencodeState::new(
+            freshell_freshagent::FreshAgentState::new(
+                Arc::clone(&auth_token),
+                Arc::clone(&broadcast_tx),
+            ),
+        ),
+        registry: registry.clone(),
+        tabs: freshell_ws::tabs::TabsRegistry::new(),
+        screenshots: freshell_ws::screenshot::ScreenshotBroker::new(Arc::clone(&broadcast_tx)),
+        terminals_revision: Arc::new(std::sync::atomic::AtomicI64::new(0)),
+        sessions_revision: Arc::new(std::sync::atomic::AtomicI64::new(0)),
+        cli_commands: Arc::new(vec![codex_cli_spec()]),
+        shutdown: Arc::new(tokio::sync::Notify::new()),
+        ping_interval_ms: 30_000,
+        hello_timeout_ms: 5_000,
+        allowed_origins: Arc::new(freshell_ws::origin::default_allowed_origins()),
+        ws_max_payload_bytes: 16 * 1024 * 1024,
+        term09: freshell_ws::backpressure::Term09Config::default(),
+        create_protect: freshell_ws::create_limit::CreateProtectConfig::default(),
+        spawn_gate: Arc::new(freshell_ws::spawn_gate::SpawnGate::new(4, 64)),
+        shutdown_started: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+        create_dedupe: Arc::new(freshell_ws::create_dedupe::CreateDedupe::default()),
+        config_fallback: None,
+        opencode_locator: None,
+        codex_locator: None,
+        activity: None,
+        session_existence: probe,
+        reconcile_deferral_budget_ms: freshell_ws::reconcile::RECONCILE_DEFERRAL_BUDGET_MS_DEFAULT,
+        fresh_agent_respawn_counts: Default::default(),
+    };
+
+    let router = freshell_ws::router(state.clone());
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind ephemeral loopback port");
+    let addr = listener.local_addr().expect("local addr");
+    tokio::spawn(async move {
+        let _ = axum::serve(listener, router).await;
+    });
+
+    (format!("ws://{addr}/ws"), registry, pane_ledger, state)
+}
+
+fn uuid_like_suffix() -> String {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    format!("{nanos}-{:?}", std::thread::current().id())
+}
+
+async fn send_json(ws: &mut common::TestWs, value: &Value) {
+    ws.send(WsMessage::Text(value.to_string()))
+        .await
+        .expect("send frame");
+}
+
+/// Read frames until either a `terminal.created` or an `error` correlated to
+/// `request_id` arrives (bounded).
+async fn next_created_or_error(ws: &mut common::TestWs, request_id: &str) -> Value {
+    for _ in 0..40u8 {
+        let msg = tokio::time::timeout(Duration::from_secs(10), ws.next())
+            .await
+            .unwrap_or_else(|_| panic!("timed out waiting for a reply to {request_id}"))
+            .expect("stream not ended")
+            .expect("no ws error");
+        if let WsMessage::Text(text) = &msg {
+            let value: Value = serde_json::from_str(text).expect("json frame");
+            let frame_type = value["type"].as_str().unwrap_or("");
+            if (frame_type == "terminal.created" || frame_type == "error")
+                && value["requestId"] == json!(request_id)
+            {
+                return value;
+            }
+        }
+    }
+    panic!("no terminal.created/error for {request_id} within 40 messages");
+}
+
+fn notice_of(frame: &Value) -> Option<String> {
+    match frame.get("notice") {
+        Some(v) if !v.is_null() => v.as_str().map(str::to_string),
+        _ => None,
+    }
+}
+
+/// Does `<amp_home>/projects/*/sessions/<session_id>` exist?
+fn amplifier_session_dir_exists(amp_home: &std::path::Path, session_id: &str) -> bool {
+    let Ok(entries) = std::fs::read_dir(amp_home.join("projects")) else {
+        return false;
+    };
+    entries
+        .flatten()
+        .any(|e| e.path().join("sessions").join(session_id).is_dir())
+}
+
+fn restore_create_with_session_ref(request_id: &str, mode: &str, session_id: &str) -> Value {
+    json!({
+        "type": "terminal.create",
+        "requestId": request_id,
+        "mode": mode,
+        "shell": "system",
+        "restore": true,
+        "cwd": std::env::temp_dir().to_string_lossy(),
+        "sessionRef": { "provider": mode, "sessionId": session_id },
+    })
+}
+
+fn restore_create_with_legacy_resume_id(request_id: &str, mode: &str, session_id: &str) -> Value {
+    json!({
+        "type": "terminal.create",
+        "requestId": request_id,
+        "mode": mode,
+        "shell": "system",
+        "restore": true,
+        "cwd": std::env::temp_dir().to_string_lossy(),
+        "resumeSessionId": session_id,
+    })
+}
+
+// ── the six pinned behaviors ─────────────────────────────────────────────────
+
+/// Case 1 — THE incident shape: a restore of an amplifier id that is
+/// definitively absent from the store must SUCCEED as a fresh spawn (never an
+/// error), carry the operator notice, retire the stale Bound row as
+/// SessionMissing, and never resurrect the stale dir. NOTE (AD-5): an empty
+/// home + stale id is byte-identical on disk to a never-used stub GC'd at
+/// terminal exit — gating it is the DECIDED behavior, not an accident.
+#[tokio::test(flavor = "multi_thread")]
+async fn restore_true_amplifier_absent_spawns_fresh_with_notice() {
+    let probe = StubProbe::answering("amplifier", "stale-amp", SessionExistence::Absent);
+    let (url, registry, ledger, _state) = spawn_server_with_probe(probe, false).await;
+    seed_bound_row(&ledger, "amplifier", "stale-amp");
+    let amp_home = common::isolate_amplifier_home();
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(
+        &mut ws,
+        &restore_create_with_session_ref("req-gate-1", "amplifier", "stale-amp"),
+    )
+    .await;
+    let frame = next_created_or_error(&mut ws, "req-gate-1").await;
+
+    assert_eq!(
+        frame["type"], "terminal.created",
+        "the gate-fired create must SUCCEED as a fresh spawn, got {frame}"
+    );
+    let notice = notice_of(&frame).expect("gate fire must carry the operator notice");
+    assert!(
+        notice.contains("stale-amp"),
+        "notice must name the stale id: {notice}"
+    );
+
+    // The stale row is retired as SessionMissing — never retried forever.
+    let stale_row = ledger
+        .load_binding("amplifier", "stale-amp")
+        .expect("stale row still exists (retired, not deleted)");
+    assert_eq!(stale_row.state, RowState::Retired);
+    assert_eq!(
+        stale_row.retired_reason,
+        Some(RetiredReason::SessionMissing)
+    );
+
+    // The spawned resume id is a FRESH mint, not the stale ref.
+    let fresh_id = frame["sessionRef"]["sessionId"]
+        .as_str()
+        .expect("created frame carries the fresh sessionRef")
+        .to_string();
+    assert_ne!(fresh_id, "stale-amp");
+
+    // Disk truth: the stale dir was NOT resurrected; the fresh stub exists.
+    assert!(
+        !amplifier_session_dir_exists(&amp_home, "stale-amp"),
+        "the amplifier pre-create must never re-stub the stale id"
+    );
+    assert!(
+        amplifier_session_dir_exists(&amp_home, &fresh_id),
+        "the fresh UUID stub must exist under the temp amplifier home"
+    );
+
+    registry.kill_all();
+}
+
+/// Case 2 — Present passes through unchanged: no notice, row stays Bound.
+#[tokio::test(flavor = "multi_thread")]
+async fn restore_true_amplifier_present_resumes_unchanged() {
+    let probe = StubProbe::answering("amplifier", "present-amp", SessionExistence::Present);
+    let (url, registry, ledger, _state) = spawn_server_with_probe(probe, false).await;
+    seed_bound_row(&ledger, "amplifier", "present-amp");
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(
+        &mut ws,
+        &restore_create_with_session_ref("req-gate-2", "amplifier", "present-amp"),
+    )
+    .await;
+    let frame = next_created_or_error(&mut ws, "req-gate-2").await;
+
+    assert_eq!(frame["type"], "terminal.created", "got {frame}");
+    assert!(
+        notice_of(&frame).is_none(),
+        "a Present resume must carry NO notice: {frame}"
+    );
+    assert_eq!(
+        frame["sessionRef"]["sessionId"], "present-amp",
+        "the resume id must pass through unchanged"
+    );
+    assert_eq!(
+        ledger
+            .load_binding("amplifier", "present-amp")
+            .expect("row present")
+            .state,
+        RowState::Bound
+    );
+
+    registry.kill_all();
+}
+
+/// Case 3 — Unknown fails OPEN (today's behavior preserved): no notice, row
+/// stays Bound.
+#[tokio::test(flavor = "multi_thread")]
+async fn restore_true_unknown_fails_open() {
+    let probe = StubProbe::answering("amplifier", "unknown-amp", SessionExistence::Unknown);
+    let (url, registry, ledger, _state) = spawn_server_with_probe(probe, false).await;
+    seed_bound_row(&ledger, "amplifier", "unknown-amp");
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(
+        &mut ws,
+        &restore_create_with_session_ref("req-gate-3", "amplifier", "unknown-amp"),
+    )
+    .await;
+    let frame = next_created_or_error(&mut ws, "req-gate-3").await;
+
+    assert_eq!(frame["type"], "terminal.created", "got {frame}");
+    assert!(
+        notice_of(&frame).is_none(),
+        "Unknown must fail open with NO notice: {frame}"
+    );
+    assert_eq!(frame["sessionRef"]["sessionId"], "unknown-amp");
+    assert_eq!(
+        ledger
+            .load_binding("amplifier", "unknown-amp")
+            .expect("row present")
+            .state,
+        RowState::Bound
+    );
+
+    registry.kill_all();
+}
+
+/// Case 4 — ordering pin (V8 §A11): a LIVE session whose ref rides the wire
+/// `sessionRef` hits D7's loud "still running" reject, NOT the gate — the
+/// Bound ledger row of the running session SURVIVES. Gate-before-D7 would
+/// replace the resume id, falsify D7's applicability filter, and retire a
+/// RUNNING session's row.
+#[tokio::test(flavor = "multi_thread")]
+async fn restore_true_live_absent_sessionref_hits_d7_not_the_gate() {
+    let probe = StubProbe::answering("amplifier", "live-amp", SessionExistence::Absent);
+    let (url, registry, ledger, state) = spawn_server_with_probe(probe, false).await;
+    seed_bound_row(&ledger, "amplifier", "live-amp");
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    // A RUNNING owner for ("amplifier", "live-amp"): a live PTY whose
+    // identity-registry entry names the session (the same identity-owner arm
+    // D7's live_session_owner join consults).
+    let owner_tid = common::create_shell_terminal(&mut ws, "req-live-owner-4").await;
+    state.identity.upsert(
+        &owner_tid,
+        Some("amplifier"),
+        Some("live-amp"),
+        None,
+        now_ms(),
+    );
+
+    send_json(
+        &mut ws,
+        &restore_create_with_session_ref("req-gate-4", "amplifier", "live-amp"),
+    )
+    .await;
+    let frame = next_created_or_error(&mut ws, "req-gate-4").await;
+
+    assert_eq!(
+        frame["type"], "error",
+        "a live session must hit D7's reject, never a gate-fired fresh spawn: {frame}"
+    );
+    assert_eq!(frame["code"], "RESTORE_UNAVAILABLE");
+    assert!(
+        frame["message"]
+            .as_str()
+            .is_some_and(|m| m.contains("still running")),
+        "D7's own rejection message must answer: {frame}"
+    );
+    // The running session's Bound row SURVIVES — the gate never saw the create.
+    assert_eq!(
+        ledger
+            .load_binding("amplifier", "live-amp")
+            .expect("row present")
+            .state,
+        RowState::Bound
+    );
+
+    registry.kill_all();
+}
+
+/// Case 5 — the REGISTRY arm of the in-gate liveness precondition: a legacy
+/// `resumeSessionId`-only carrier bypasses D7 in every ordering, so the gate
+/// itself must refuse to fire on a LIVE session. Resume proceeds unchanged.
+#[tokio::test(flavor = "multi_thread")]
+async fn restore_true_live_absent_legacy_resume_id_fails_open() {
+    let probe = StubProbe::answering("amplifier", "live-amp-legacy", SessionExistence::Absent);
+    let (url, registry, ledger, state) = spawn_server_with_probe(probe, false).await;
+    seed_bound_row(&ledger, "amplifier", "live-amp-legacy");
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    let owner_tid = common::create_shell_terminal(&mut ws, "req-live-owner-5").await;
+    state.identity.upsert(
+        &owner_tid,
+        Some("amplifier"),
+        Some("live-amp-legacy"),
+        None,
+        now_ms(),
+    );
+
+    send_json(
+        &mut ws,
+        &restore_create_with_legacy_resume_id("req-gate-5", "amplifier", "live-amp-legacy"),
+    )
+    .await;
+    let frame = next_created_or_error(&mut ws, "req-gate-5").await;
+
+    assert_eq!(
+        frame["type"], "terminal.created",
+        "the legacy carrier must proceed (fail open on liveness): {frame}"
+    );
+    assert!(
+        notice_of(&frame).is_none(),
+        "a LIVE session must never gate: {frame}"
+    );
+    assert_eq!(
+        ledger
+            .load_binding("amplifier", "live-amp-legacy")
+            .expect("row present")
+            .state,
+        RowState::Bound,
+        "the live session's Bound row must survive"
+    );
+
+    registry.kill_all();
+}
+
+/// Case 6 — the ASYNC sidecar arm of the in-gate liveness join: liveness held
+/// ONLY by the fresh-agent sidecar (no registry/identity owner). This is the
+/// arm protecting live zero-turn sessions with no rollout on disk yet
+/// (`freshell-server/src/existence.rs:224-227`) — it must not be silently
+/// dropped while cases 4–5 still pass.
+#[tokio::test(flavor = "multi_thread")]
+async fn restore_true_sidecar_live_absent_legacy_resume_id_fails_open() {
+    // DEV-0006 S5.e: the managed-launch default is ON; this suite exercises the
+    // plain-CLI codex path (sleeper CLI spec, no app-server), so pin OFF.
+    std::env::set_var("FRESHELL_CODEX_MANAGED_LAUNCH", "0");
+    // The codex fake app-server fixture (the codex.rs crash-recovery tests'
+    // scripted peer), pinned to mint the exact thread id this test keys on.
+    // Env mutation is process-global; this is the ONLY test in this binary
+    // that spawns a codex sidecar, so nothing else reads these vars.
+    std::env::set_var(
+        "CODEX_CMD",
+        format!(
+            "node {}/../../test/fixtures/coding-cli/codex-app-server/fake-app-server.mjs",
+            env!("CARGO_MANIFEST_DIR")
+        ),
+    );
+    std::env::set_var(
+        "FAKE_CODEX_APP_SERVER_BEHAVIOR",
+        r#"{"threadStartThreadId":"stale-cx"}"#,
+    );
+
+    let probe = StubProbe::answering("codex", "stale-cx", SessionExistence::Absent);
+    let (url, registry, ledger, state) = spawn_server_with_probe(probe, true).await;
+    seed_bound_row(&ledger, "codex", "stale-cx");
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    // A live freshcodex sidecar owning ("codex", "stale-cx").
+    send_json(
+        &mut ws,
+        &json!({
+            "type": "freshAgent.create",
+            "requestId": "req-fa-owner-6",
+            "sessionType": "freshcodex",
+            "provider": "codex",
+            "cwd": "/tmp",
+        }),
+    )
+    .await;
+    let created = common::next_frame_of_type(&mut ws, "freshAgent.created").await;
+    assert_eq!(
+        created["sessionId"], "stale-cx",
+        "the fake app-server mints the pinned thread id"
+    );
+    assert!(
+        state.fresh_codex.has_live_session("stale-cx").await,
+        "precondition: the sidecar owns the session"
+    );
+
+    send_json(
+        &mut ws,
+        &restore_create_with_legacy_resume_id("req-gate-6", "codex", "stale-cx"),
+    )
+    .await;
+    let frame = next_created_or_error(&mut ws, "req-gate-6").await;
+
+    assert_eq!(
+        frame["type"], "terminal.created",
+        "sidecar-live legacy carrier must proceed (fail open): {frame}"
+    );
+    assert!(
+        notice_of(&frame).is_none(),
+        "a sidecar-LIVE session must never gate: {frame}"
+    );
+    assert_eq!(
+        ledger
+            .load_binding("codex", "stale-cx")
+            .expect("row present")
+            .state,
+        RowState::Bound,
+        "the live session's Bound row must survive"
+    );
+
+    registry.kill_all();
+    std::env::remove_var("CODEX_CMD");
+    std::env::remove_var("FAKE_CODEX_APP_SERVER_BEHAVIOR");
+}
+
+/// Case 7 — gate-before-plan ordering pin (managed-launch default ON): a
+/// definitively-absent codex resume id at the WS door is gated (fresh spawn
+/// + notice) BEFORE managed-launch planning — the stale id never reaches the
+/// plan, so it can never burn a sidecar planning slot. The fresh spawn still
+/// goes managed (`--remote` argv) with NO resume tokens.
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "host-gated e2e (needs node + repo node_modules); mutates process env — run alone with --ignored --test-threads=1"]
+async fn managed_default_stale_codex_id_is_gated_before_planning() {
+    // Managed leg: the flag stays UNSET (default ON). remove_var, not "1",
+    // mirroring codex_managed_launch_e2e.rs's managed phases.
+    std::env::remove_var("FRESHELL_CODEX_MANAGED_LAUNCH");
+
+    let stale_id = "0b5aa1d2-9d5c-4f6e-8f2a-1c3d5e7f9a0b"; // definitively absent
+    let capture_path = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-managed-argv-{}.json",
+        std::process::id()
+    ));
+    let _ = std::fs::remove_file(&capture_path);
+    let dispatcher = write_codex_dispatcher();
+    std::env::set_var("CODEX_CMD", &dispatcher);
+    std::env::set_var("CODEX_ARGV_CAPTURE_PATH", &capture_path);
+
+    // Probe: codex stale_id is POSITIVELY absent (store readable). The codex
+    // arm gates on positive Absent alone — no on-disk-history flag needed.
+    let probe = StubProbe::answering("codex", stale_id, SessionExistence::Absent);
+    // Hygiene: point CODEX_HOME at a temp dir so no codex-side path can ever
+    // touch the real ~/.codex (the fake app-server writes ~/.codex/sessions
+    // on turn/start when CODEX_HOME is unset; this test never sends
+    // turn/start, but pin it anyway):
+    let codex_home = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-codex-home-{}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&codex_home).expect("codex home");
+    std::env::set_var("CODEX_HOME", &codex_home);
+    let (url, registry, _ledger, _state) = spawn_managed_codex_server_with_probe(probe, true).await;
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    // terminal.create with restore:true carrying the stale codex resume id —
+    // the legacy resume-id carrier shape (case 6), minus its live-sidecar
+    // arrangement: here NOTHING is live, so the gate must fire.
+    send_json(
+        &mut ws,
+        &restore_create_with_legacy_resume_id("req-gate-7", "codex", stale_id),
+    )
+    .await;
+
+    // 1. Gate fired: terminal.created carries the operator notice naming the stale id.
+    let created = next_created_or_error(&mut ws, "req-gate-7").await;
+    assert_eq!(
+        created["type"], "terminal.created",
+        "the gate-fired create must SUCCEED as a fresh spawn, got {created}"
+    );
+    let notice = notice_of(&created).expect("gate must set the stale-resume notice");
+    assert!(
+        notice.contains(stale_id),
+        "notice names the stale id: {notice}"
+    );
+
+    // 2. The FRESH spawn still went managed (default ON): the captured TUI
+    //    argv is the --remote form...
+    let argv = wait_for_captured_argv(&capture_path);
+    assert_eq!(
+        argv[0], "--remote",
+        "fresh spawn must still plan managed launch"
+    );
+
+    // 3. ...and the stale resume NEVER reached managed planning: on a managed
+    //    RESUME the `resume <id>` pair rides last in argv (e2e Phase 3 pins
+    //    that). Absence of both tokens proves the plan was Start-intent for a
+    //    fresh session — the stale id never consumed a sidecar planning slot.
+    assert!(
+        !argv.iter().any(|a| a == "resume") && !argv.iter().any(|a| a.contains(stale_id)),
+        "stale id must not appear in managed argv: {argv:?}"
+    );
+
+    // Cleanup (mirror e2e): kill the terminal via the harness, then env.
+    registry.kill_all();
+    std::env::remove_var("CODEX_CMD");
+    std::env::remove_var("CODEX_ARGV_CAPTURE_PATH");
+    std::env::remove_var("CODEX_HOME");
+    let _ = std::fs::remove_file(&capture_path);
+}
+
+fn fresh_create(request_id: &str, mode: &str) -> serde_json::Value {
+    // Same envelope as a restore create, minus every resume carrier — this
+    // is the shape that triggers the server prealloc arms.
+    let mut v = restore_create_with_session_ref(request_id, mode, "unused");
+    let obj = v.as_object_mut().expect("create frame is an object");
+    obj.remove("restore");
+    obj.remove("sessionRef");
+    obj.remove("resumeSessionId");
+    v
+}
+
+/// A fresh claude create mints a SERVER-allocated session id (prealloc).
+/// That id is by definition absent on disk — and must NEVER be gated:
+/// no notice, plain successful create. Probe answers Absent-but-observed
+/// for everything, so any gate consult on the minted id evaluates to
+/// SpawnFresh (the claude zero-turn carve-out does NOT apply), fires the
+/// notice, and fails this test.
+#[tokio::test(flavor = "multi_thread")]
+async fn server_allocated_fresh_claude_id_is_never_gated() {
+    let (url, registry, _ledger, _state) =
+        spawn_server_with_probe(Arc::new(AbsentButObservedProbe), false).await;
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(&mut ws, &fresh_create("req-prealloc-claude", "claude")).await;
+    let frame = next_created_or_error(&mut ws, "req-prealloc-claude").await;
+
+    assert_eq!(
+        frame["type"], "terminal.created",
+        "fresh claude create must succeed, got {frame}"
+    );
+    assert!(
+        notice_of(&frame).is_none(),
+        "server-allocated claude prealloc id must never trip the gate notice"
+    );
+
+    registry.kill_all();
+}
+
+/// The amplifier sibling (THE TRAP: claude_fresh_prealloc == false here, yet
+/// the id is still server-minted): a fresh amplifier create must never gate.
+#[tokio::test(flavor = "multi_thread")]
+async fn server_allocated_fresh_amplifier_id_is_never_gated() {
+    let (url, registry, _ledger, _state) =
+        spawn_server_with_probe(Arc::new(AbsentButObservedProbe), false).await;
+    let _amp_home = common::isolate_amplifier_home();
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(&mut ws, &fresh_create("req-prealloc-amp", "amplifier")).await;
+    let frame = next_created_or_error(&mut ws, "req-prealloc-amp").await;
+
+    assert_eq!(
+        frame["type"], "terminal.created",
+        "fresh amplifier create must succeed, got {frame}"
+    );
+    assert!(
+        notice_of(&frame).is_none(),
+        "server-minted amplifier id must never trip the gate notice"
+    );
+
+    registry.kill_all();
+}
+
+// ── gate-vs-plan ORDER probe (case 7b) ──────────────────────────────────────
+
+/// [`StubProbe`] + a gate-before-plan ORDER latch: on the FIRST `exists`
+/// consult for the watched `(provider, session_id)`, records whether
+/// managed-launch planning had ALREADY spawned the codex app-server sidecar
+/// (the fixture's `FAKE_CODEX_APP_SERVER_ARG_LOG` file exists on disk).
+///
+/// Determinism: the fixture writes the arg-log SYNCHRONOUSLY at process
+/// startup, before it ever listens, and `plan_codex_managed_launch` awaits
+/// the sidecar listening — so by the time any plan completes the marker
+/// exists. Both orderings under test are sequential awaits on the same task
+/// (plan-then-gate pre-fix, gate-then-plan post-fix), so the latch value is
+/// not load-sensitive.
+struct GateOrderProbe {
+    provider: String,
+    session_id: String,
+    answer: SessionExistence,
+    planning_marker: std::path::PathBuf,
+    planning_started_before_gate: std::sync::Mutex<Option<bool>>,
+}
+
+impl SessionExistenceProbe for GateOrderProbe {
+    fn exists(&self, provider: &str, session_id: &str) -> SessionExistence {
+        if provider == self.provider && session_id == self.session_id {
+            let mut latch = self.planning_started_before_gate.lock().unwrap();
+            if latch.is_none() {
+                *latch = Some(self.planning_marker.exists());
+            }
+            return self.answer;
+        }
+        SessionExistence::Unknown
+    }
+    fn ever_observed(&self, _provider: &str, _session_id: &str) -> bool {
+        false
+    }
+}
+
+/// Case 7b — the ORDER behind case 7's pin, made directly observable: the
+/// disk-existence gate must consult the probe for a stale WIRE codex resume
+/// id BEFORE managed-launch planning spawns any app-server sidecar
+/// (gate-before-plan). Post-#589, restore-class codex planning runs
+/// OFF-permit in `prepare_launch`; without an off-permit gate the stale id
+/// undergoes sidecar planning FIRST and the gate only fires afterwards.
+/// Case 7 is blind to that ordering (the stale-planned sidecar is silently
+/// adopted and the TUI argv derives from post-gate state) — this pin is not.
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "host-gated e2e (needs node + repo node_modules); mutates process env — run alone with --ignored --test-threads=1"]
+async fn managed_default_stale_codex_id_probe_consulted_before_any_planning() {
+    // Managed leg: the flag stays UNSET (default ON), mirroring case 7.
+    std::env::remove_var("FRESHELL_CODEX_MANAGED_LAUNCH");
+
+    let stale_id = "3f9d2c81-6a4e-4b7f-9c0d-5e8a1b2c3d4f"; // definitively absent
+    let capture_path = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-order-argv-{}.json",
+        std::process::id()
+    ));
+    // The committed fake-app-server fixture writes this file synchronously at
+    // startup (before `new WebSocketServer`) when the env var is set — it
+    // exists on disk ⟺ sidecar planning has begun.
+    let planning_marker = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-order-planned-{}.json",
+        std::process::id()
+    ));
+    let _ = std::fs::remove_file(&capture_path);
+    let _ = std::fs::remove_file(&planning_marker);
+    let dispatcher = write_codex_dispatcher();
+    std::env::set_var("CODEX_CMD", &dispatcher);
+    std::env::set_var("CODEX_ARGV_CAPTURE_PATH", &capture_path);
+    std::env::set_var("FAKE_CODEX_APP_SERVER_ARG_LOG", &planning_marker);
+    let codex_home = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-order-codex-home-{}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&codex_home).expect("codex home");
+    std::env::set_var("CODEX_HOME", &codex_home);
+
+    let probe = Arc::new(GateOrderProbe {
+        provider: "codex".into(),
+        session_id: stale_id.into(),
+        answer: SessionExistence::Absent,
+        planning_marker: planning_marker.clone(),
+        planning_started_before_gate: std::sync::Mutex::new(None),
+    });
+    let (url, registry, _ledger, _state) =
+        spawn_managed_codex_server_with_probe(probe.clone(), true).await;
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(
+        &mut ws,
+        &restore_create_with_legacy_resume_id("req-gate-7b", "codex", stale_id),
+    )
+    .await;
+
+    // Preconditions (case 7's own pins): the gate fired as a fresh spawn with
+    // the operator notice…
+    let created = next_created_or_error(&mut ws, "req-gate-7b").await;
+    assert_eq!(
+        created["type"], "terminal.created",
+        "the gate-fired create must SUCCEED as a fresh spawn, got {created}"
+    );
+    let notice = notice_of(&created).expect("gate must set the stale-resume notice");
+    assert!(
+        notice.contains(stale_id),
+        "notice names the stale id: {notice}"
+    );
+
+    // …and the fresh spawn still went managed — planning DID run (this guards
+    // the ordering latch against a vacuous pass where nothing was planned).
+    let argv = wait_for_captured_argv(&capture_path);
+    assert_eq!(
+        argv[0], "--remote",
+        "fresh spawn must still plan managed launch"
+    );
+    assert!(
+        planning_marker.exists(),
+        "the codex app-server sidecar must have spawned (planning happened)"
+    );
+
+    let planning_before_gate = *probe.planning_started_before_gate.lock().unwrap();
+
+    // Cleanup BEFORE the ordering assertion so a RED run still tears down.
+    registry.kill_all();
+    std::env::remove_var("CODEX_CMD");
+    std::env::remove_var("CODEX_ARGV_CAPTURE_PATH");
+    std::env::remove_var("FAKE_CODEX_APP_SERVER_ARG_LOG");
+    std::env::remove_var("CODEX_HOME");
+    let _ = std::fs::remove_file(&capture_path);
+    let _ = std::fs::remove_file(&planning_marker);
+
+    // THE pin: gate-before-plan. `Some(true)` means the app-server sidecar
+    // was already up when the gate first consulted the probe for the stale
+    // id — i.e. the stale WIRE resume id underwent off-permit
+    // `plan_codex_managed_launch` BEFORE the disk-existence gate could drop
+    // it, and the create then silently inherited the stale-planned sidecar.
+    let planning_before_gate = planning_before_gate
+        .expect("the disk-existence gate must consult the probe for the stale codex id");
+    assert!(
+        !planning_before_gate,
+        "GATE-BEFORE-PLAN VIOLATED: managed-launch planning spawned a codex app-server \
+         sidecar BEFORE the disk-existence gate consulted the probe for stale id \
+         {stale_id} — the stale wire resume id underwent off-permit \
+         plan_codex_managed_launch ahead of the gate"
+    );
+}
diff --git a/docs/plans/2026-07-29-resume-validation.md b/docs/plans/2026-07-29-resume-validation.md
new file mode 100644
index 000000000..487049be6
--- /dev/null
+++ b/docs/plans/2026-07-29-resume-validation.md
@@ -0,0 +1,2033 @@
+# Resume Validation Implementation Plan
+
+> **For agentic workers:** This plan is executed task-by-task by the
+> workflow's execute stage: a fresh implementer per task, with a spec +
+> quality review after each task. Steps use checkbox (`- [ ]`) syntax
+> for tracking.
+
+**Goal:** Before the Rust server constructs a coding-CLI resume command from a cached session id, validate that the session actually exists in the provider's on-disk store; when it is definitively absent, spawn the CLI fresh in the same cwd/mode, surface an operator-visible notice naming the stale id, and retire the stale ledger binding so it is not retried forever.
+
+**Architecture:** A pure resume-gate policy function lives in `freshell-platform` (below both consumers). The existing tri-state disk-existence probe (`SessionExistenceProbe` / `IndexExistenceProbe`) gains by-id fallbacks for amplifier and codex so "Absent" is a trustworthy POSITIVE absence, then the gate is wired into the three spawn doors that call `resolve_coding_cli_command()`: WS `terminal.create` (restore path), headless auto-resume respawn, and the freshagent REST create pipeline. Validation only ever converts a resume into a fresh spawn on positive absence; `Unknown`/`ProviderUnavailable` always fail open (today's behavior preserved).
+
+**Tech Stack:** Rust (axum/tokio workspace under `crates/`), serde-based WS protocol in `crates/freshell-protocol`, React/TypeScript client in `src/`, Vitest for client tests, `cargo test` for Rust.
+
+## Global Constraints
+
+- Work only inside the worktree `/home/dan/code/freshell/.worktrees/resume-validation` on branch `feat/resume-validation` (branched from `origin/main` at `ca1a60d3`).
+- Do NOT open a PR, do NOT merge, do NOT restart or deploy any server. The live Rust server on port 3002 must not be touched.
+- Red-Green-Refactor TDD for every task (root `AGENTS.md`): write the failing test first, watch it fail, make it pass, refactor. Never skip the refactor.
+- Structural limits (`port/AGENTS.md`): ≤1K lines per file. New logic goes in new focused files, not appended to already-huge ones.
+- Fail-open invariant (the spec's rule 3): validation must NEVER turn a working resume into a non-resume. Only a POSITIVE "store is readable and the session is definitively absent" may block a resume. `Unknown` and `ProviderUnavailable` always proceed unchanged. ONE decided exception, recorded as AD-5 (Design Notes): an amplifier never-used-stub resume — where "working" means `ensure_session` would fabricate an equivalent EMPTY session under the same id — is deliberately gated, because on disk it is indistinguishable from the incident.
+- Providers validated: `claude`, `codex`, `opencode`, `amplifier` (the four the existence probe knows). `gemini`, `kimi`, and any unknown provider are never blocked (they are outside the probe's `KNOWN_PROVIDERS`, whose contract maps unknown providers to `Absent` — the gate must therefore check its own provider list BEFORE consulting the probe).
+- Node server (`server/`) is deliberately NOT changed: root `AGENTS.md` states the live production server is the Rust server on port 3002 and the Node server is legacy; the validation substrate (the tri-state `IndexExistenceProbe`, opencode by-id sqlite check, claude `CLAUDE_CONFIG_DIR`-aware locator) exists only in Rust, so the port is not cheap or parallel. This is an explicit scope decision, not an oversight.
+- Rust tests: plain `cargo test -p <crate>` (no coordinator gate for Rust). Client tests: `npm run test:unit` (coordinator-gated; wait for the gate, never kill a foreign holder). Raw `npx vitest` is not a coordinated workflow.
+- Known pre-existing failure on main, unrelated: `terminal-font-settings.test.tsx` — note it if it appears in suite runs, do not chase it.
+- `port/AGENTS.md` mandates a `port/oracle/DEVIATIONS.md` entry for deliberate behavior changes vs the Node original — this feature is one (Task 9).
+- Protocol change is limited to ONE additive optional field (`notice` on `terminal.created`), mirrored in `crates/freshell-protocol` AND `shared/ws-protocol.ts` (the schema's source of truth), with `port/contract/ws-server-messages.schema.json` REGENERATED via `npm run contract:generate` — never hand-edited (drift-guarded by `test/unit/port/ws-contract-freeze.test.ts`). No new message types (the `SERVER_MESSAGE_TYPES` inventory is frozen). No `server/` (Node) files change — the precedent commits for this exact pattern (`5c591843`, `a18dd4c6`) touched zero.
+- Gate calls are non-blocking (A13): the disk probe + by-id locators do real filesystem walks (the codex by-id walk measured ~0.9–1.1 s warm-cache on a real store — 20x earlier estimates), so every door runs the sync validation helper inside `tokio::task::spawn_blocking`. The pure gate policy (Task 1) stays sync/pure. This shape (sync helper, door wraps in `spawn_blocking`) is used consistently across all three doors (Tasks 6–8).
+- Amplifier existence is checked across ALL project slugs (`~/.amplifier/projects/*/sessions/<id>/`), not just the cwd-derived slug — a session may live under a different project slug than the current cwd if the tab moved. The index source already walks all projects; the new by-id fallback scans all project dirs too.
+
+## Design Notes (read before Task 1)
+
+**The incident:** after a Rust-server restart, freshell restored an Amplifier pane by resuming stored session id `8dab420a-f76b-407c-bcbe-dfb2a971c2e1`, which had no directory anywhere under `~/.amplifier/projects/*/sessions/`. The amplifier CLI silently created a brand-new empty session under that id. Root cause on the freshell side: the reconcile-time existence probe deliberately treats amplifier `Absent` as not-dead (`crates/freshell-ws/src/reconcile.rs:330-352`, because `ensure_session` re-stubs), and the spawn doors never consult the probe at all — the `restore:true` create re-trusts the client claim unvalidated.
+
+**Key existing pieces (do not rebuild):**
+- `crates/freshell-ws/src/existence.rs` — `SessionExistenceProbe` trait: `exists(provider, session_id) -> SessionExistence {Present|Absent|Unknown|ProviderUnavailable}`, plus `ever_observed(...)` and `ever_observed_on_disk(...)`. Reachable in WS handlers as `state.session_existence` (see `terminal.rs:3399`).
+- `crates/freshell-server/src/existence.rs` — `IndexExistenceProbe` (production impl over `SessionIndex`), with by-id fallbacks today for claude (raw transcript file) and opencode (sqlite `session_exists_by_id`); constructed in `crates/freshell-server/src/main.rs` (probe construction region, see `existence.rs:112-141, 170-178`).
+- `crates/freshell-platform/src/cli_launch.rs:400` — `resolve_coding_cli_command()`, the single pure argv resolver. It must stay pure; validation happens at its callers by feeding it `resume_session_id: None` (or a fresh id).
+- The three spawn doors: `handle_create` (`crates/freshell-ws/src/terminal.rs:1412`, resolver call `:2089`), `respawn_agent_terminal` (`terminal.rs:2678`, resolver `:2789`), and the freshagent REST create pipeline (`crates/freshell-freshagent/src/terminal_tabs.rs:1355`).
+- `crates/freshell-ws/src/pane_ledger.rs` — durable `BindingRow` per `(provider, sessionId)` with `RowState {Bound|Retired}` and `RetiredReason {Superseded|Closed|GcExpired}`; `retire_closed` at `:563` is the pattern to mirror.
+- Client notice surfaces: `paneContent.reconcileNotice` is rendered as a chip (`src/.../FreshAgentView.tsx:2413`) and written into xterm (`src/.../TerminalView.tsx:4336`/`:5053`); the REST create path can inject `"reconcileNotice"` directly into `pane_content` (`terminal_tabs.rs:1657`). `terminal.status.reason` is NEVER displayed by the client — do not build the notice on it.
+
+**Fresh-spawn fallback shape (mirrors how a genuinely fresh pane of each mode spawns today, per `terminal.rs:1617-1717`):**
+- `claude` → mint a new UUID, `LaunchIntent::Start` (`--session-id <new>`), `claude_fresh_prealloc = true`.
+- `amplifier` → mint a new UUID, keep `LaunchIntent::Resume` (fresh amplifier panes run `amplifier resume <new-uuid>` against a dir stubbed by `ensure_session` — identical to `should_preallocate_fresh_amplifier`).
+- `codex` / `opencode` → `resume_session_id = None` (fresh panes of these modes don't preallocate).
+
+**Carve-outs the gate must honor (fail-open bias):**
+- claude zero-turn: a claude session created by freshell that never conversed has no `.jsonl` on disk yet. `Absent` + `!ever_observed_on_disk` → Proceed (mirrors `reconcile.rs:365-403`). This is deliberately MORE fail-open than reconcile (no ledger-bound requirement). Scope (AD-2): `ever_observed_on_disk` is a per-boot in-memory set (`existence.rs:293-298`, never persisted), so claude validation covers SAME-BOOT deletions only — a transcript deleted while the server was down is indistinguishable from never-conversed and fails open forever post-restart. Deliberate: `ever_observed` is NOT a sound swap (it ORs ledger `ever_bound`, which would break the zero-turn carve-out).
+- Preallocated fresh ids (claude Start prealloc, amplifier fresh prealloc) are intentionally not on disk — the gate only runs on ids that came from the wire (sessionRef / legacy resumeSessionId / claude restore ladder), never on ids the server just minted.
+- gemini/kimi: no `resumeArgs` at all and outside `KNOWN_PROVIDERS` — gate never consults the probe for them.
+
+**Notice visibility per door:**
+- Door 1 (WS create): new optional `notice` field on the `terminal.created` success frame; small client change renders it into the pane's xterm exactly like the reconcile notice AND clears the pane's persisted `sessionRef`/`resumeSessionId` (required for codex/opencode, whose gate-fired spawns carry no `sessionRef` — see the "not retried forever" story below).
+- Door 2 (headless respawn): no `out` sink exists; broadcast the existing `terminal.status{Recovering, reason}` frame (precedent `auto_resume.rs:604-628`) + `tracing::warn!`. Reason prose is not client-rendered today; this is the best available channel on a headless crash-recovery path where `Absent` is near-impossible for claude/codex/opencode (the session was alive moments ago). EXCEPTION, deliberate (AD-5): for amplifier, the exit-hook never-used-stub GC (`terminal.rs:1381` → `gc_stub_if_unused`) deletes a never-typed terminal's stub at the very exit that triggers the respawn, so `Absent` is the EXPECTED respawn state for that class — the gate fires and the respawn proceeds under a minted id, an equivalent empty session. Documented, deliberate.
+- Door 3 (REST create): inject `reconcileNotice` into the returned `pane_content` (existing field, existing client rendering — no client change needed).
+
+**Validation findings incorporated (2026-07-29)** (9 evidence-gathering validators ran against this plan; ledger + reports in `.worktrees/.the-usual-logs/resume-validation/`):
+
+- **Non-blocking gate (A13 falsified):** the codex by-id walk measured ~0.9–1.1 s warm-cache on a real store. Validation helpers stay sync; every door runs them inside `tokio::task::spawn_blocking` (see Global Constraints). The Task 1 policy stays pure.
+- **Cold-index coverage (A1 falsified):** the index snapshot starts `None` every boot and the boot sweep is a detached task never awaited before the WS listener binds — restore-time creates can hit a cold index. Gate-facing per-provider coverage matrix:
+
+| Provider | Index COLD (`peek() == None`) | Index WARM (Absent adjudication; also covers TTL-stale snapshots) |
+|---|---|---|
+| amplifier | direct by-id dir scan (`session_on_disk`, cheap) → Present/Absent/Unknown | snapshot + by-id fallback |
+| claude | existing transcript locator (cheap) → Present/Absent/Unknown | snapshot + raw-file fallback (existing) |
+| codex | Unknown — fail open (AD-4) | snapshot + gate-safe by-id walk |
+| opencode | Unknown — fail open (AD-4) | snapshot + sqlite by-id (existing) |
+
+  The incident provider (amplifier) is covered even before warm-up. **AD-4 (accepted residual):** codex/opencode restores in the first seconds after boot fail open — the ~1 s codex walk stays on the warm-Absent adjudication path only. The cold-path `ProviderUnavailable` answer (provider root missing pre-warm) is untouched.
+- **Locator error contract (A3 falsified — six empirical false-Absent reproductions):** errors-seen accumulator. `Present` short-circuits; a scan that completes with ANY per-entry error (unreadable subdir, EACCES file, `read_dir` failure below root, first-line open/read failure) and no hit answers `Unreadable` → `Unknown` → fail open. Never adjudicate via `.is_dir()` (returns `false` on EACCES) or `fs::metadata(root)` (tests existence, not readability).
+- **Missing store root (AD-1):** store-root NotFound with a readable parent ⇒ `Absent` (positive absence — matches today's warm-path steady state and prevents the incident on fresh installs/secondary devices); any read/permission ERROR at the root ⇒ `Unreadable` (fail open).
+- **Claude scope (AD-2):** claude validation covers same-boot deletions only (per-boot in-memory `ever_observed_on_disk`; see the carve-out bullet above).
+- **Door 1 ordering (A11 falsified):** the gate runs AFTER the D7 cross-mode liveness guard and BEFORE the amplifier pre-create re-stub, with an in-gate liveness precondition for legacy carriers (Task 6). (Consequence for amplifier's designed stub GC: AD-5 below.)
+- **"Not retried forever" (A5 falsified-split):** four cooperating mechanisms — ledger `retire_missing` (server, all doors) + `terminal.created.sessionRef` overwrite (claude/amplifier, existing client fold) + notice-triggered clear of the pane's persisted `sessionRef`/`resumeSessionId` (codex/opencode, Task 5) + the mandatory `accepted_session_ref` guard at door 3 (Task 8).
+- **AD-3 (accepted):** after a gate-fired headless respawn, the auto-resume hub's `complete_claim` keeps the STALE locator's lease bound to the fresh terminal (`auto_resume.rs:529-547`) — convergent, documented with a code comment (Task 7).
+- **AD-5 (accepted, decided — the amplifier never-used-stub GC collision; fresheyes round 3):** freshell's DESIGNED amplifier lifecycle GCs a never-typed pane's session stub at terminal exit (`terminal.rs:1381` → `amplifier_stub.rs` `gc_stub_if_unused`; a stub is "unused" when metadata has no `turn_count`, the transcript is empty, and no `prompt:submit` event exists), and both spawn doors compensate by running `amplifier_stub::ensure_session` (ensure-after-GC) before spawning, re-stubbing the SAME id (`reconcile.rs:337-347`; door-1 pre-create comment `terminal.rs:1798-1815`). The gate deliberately sits BEFORE that re-stub (A11 — otherwise `ensure_session` resurrects the dir and the probe answers Present, hiding the incident forever), so after a restart EVERY never-typed open amplifier pane probes `Absent` and the gate fires: minted id + operator notice + `SessionMissing` retirement, where today the restore silently re-stubs the same id. DECIDED: ACCEPTED, for three reasons. (a) On disk a GC'd never-used stub is INDISTINGUISHABLE from the incident's stale id — both are "no session dir anywhere under any project slug", and `ever_observed_on_disk` is per-boot in-memory so post-restart both answer `false` — any carve-out that lets the stub through (e.g. mirroring claude's zero-turn carve-out for amplifier) would let the INCIDENT through too, and the incident is this feature's reason to exist ("amplifier MUST be covered"). (b) The user-visible outcome for a never-typed pane is an equivalent EMPTY amplifier session either way — same cwd, same mode, zero history to lose; the only costs are the notice line and an id change, and the minted id is healed into client persistence by the existing `terminal.created.sessionRef` overwrite fold. (c) This does NOT conflict with reconcile's amplifier Absent carve-out (`reconcile.rs:330-352`, pinned by `reconcile.rs:703-720` — both untouched): reconcile decides whether a pane gets PARKED in the dead-sessions dialog (destructive — the pane is lost), while the gate merely swaps WHICH id an already-restoring pane spawns with (the pane survives in place). Consequences recorded: Task 1's `amplifier_absent_spawns_fresh` test and Task 6's integration case 1 deliberately enshrine this exact shape, the door-2 "Absent is near-impossible" framing is scoped to non-amplifier modes (see the Door 2 bullet above), and the Task 9 DEVIATIONS entry names this consequence explicitly.
+
+## File Structure
+
+| File | Action | Responsibility |
+|---|---|---|
+| `crates/freshell-platform/src/resume_gate.rs` | Create | Pure gate policy: provider list, `ResumeExistence`, `evaluate_resume_gate`, shared probe-fn types for freshagent injection |
+| `crates/freshell-platform/src/lib.rs` | Modify | `pub mod resume_gate;` |
+| `crates/freshell-sessions/src/amplifier_stub.rs` | Modify | Read-only `session_on_disk()` existence scan across all project slugs |
+| `crates/freshell-server/src/existence.rs` | Modify | Amplifier + codex by-id fallbacks on `IndexExistenceProbe`; gate-safe tri-state codex walk (`codex_rollout_on_disk`); cold-index amplifier/claude coverage in `exists()` |
+| `crates/freshell-server/src/main.rs` | Modify | Wire new locators into the probe; wire probe + retire callback into `FreshAgentState` |
+| `crates/freshell-ws/src/pane_ledger.rs` | Modify | `RetiredReason::SessionMissing` + `retire_missing()` |
+| `crates/freshell-ws/src/pane_ledger_tests.rs` | Modify | Tests for `retire_missing` |
+| `crates/freshell-protocol/src/server_messages.rs` | Modify | Optional `notice` on `TerminalCreated` |
+| `shared/ws-protocol.ts` | Modify | Source of truth for the contract schema: optional `notice` on the `terminal.created` type (~`:725`) |
+| `port/contract/ws-server-messages.schema.json` | Regenerate | Via `npm run contract:generate` — never hand-edit (drift-guarded) |
+| `crates/freshell-protocol/tests/roundtrip.rs` | Modify | Wire test including `notice` (precedent commits `5c591843`, `a18dd4c6`) |
+| `src/components/TerminalView.tsx` | Modify | Render `terminal.created` notice into xterm (locate the create-success handler near the `[Restore failed]` handling at `:4691`) + clear the pane's persisted `sessionRef`/`resumeSessionId` when `notice` is present |
+| `crates/freshell-ws/src/resume_validation.rs` | Create | Wire-resume validation helper shared by doors 1 & 2 (probe → gate → fallback outcome); sync — doors run it inside `spawn_blocking` |
+| `crates/freshell-ws/src/terminal.rs` | Modify | Doors 1 & 2 run the helper via `spawn_blocking` (after D7, before the amplifier re-stub; in-gate liveness precondition); retire + notice emission |
+| `crates/freshell-ws/tests/resume_validation_gate.rs` | Create | Integration coverage for door 1 (and door 2 if the harness reaches it) |
+| `crates/freshell-freshagent/src/lib.rs` | Modify | `FreshAgentState`: `with_resume_probe`, `with_on_stale_resume` builders |
+| `crates/freshell-freshagent/src/terminal_tabs.rs` | Modify | Door 3 gate + `reconcileNotice` injection |
+| `port/oracle/DEVIATIONS.md` | Modify | Deviation ledger entry |
+
+---
+
+### Task 1: Pure resume-gate policy in `freshell-platform`
+
+**Files:**
+- Create: `crates/freshell-platform/src/resume_gate.rs`
+- Modify: `crates/freshell-platform/src/lib.rs` (add `pub mod resume_gate;` alongside the existing ~10 `pub mod`s)
+- Test: inline `#[cfg(test)]` in `crates/freshell-platform/src/resume_gate.rs`
+
+**Interfaces:**
+- Consumes: nothing (leaf module, pure).
+- Produces (used by Tasks 6–8):
+  - `pub const VALIDATED_PROVIDERS: [&str; 4]`
+  - `pub fn provider_validated(provider: &str) -> bool`
+  - `pub enum ResumeExistence { Present, Absent, Unknown }`
+  - `pub enum ResumeGateDecision { Proceed, SpawnFresh }`
+  - `pub fn evaluate_resume_gate(provider: &str, existence: ResumeExistence, ever_observed_on_disk: bool) -> ResumeGateDecision`
+  - `pub struct ResumeProbeAnswer { pub existence: ResumeExistence, pub ever_observed_on_disk: bool }`
+  - `pub type ResumeProbeFn = std::sync::Arc<dyn Fn(&str, &str) -> ResumeProbeAnswer + Send + Sync>`
+  - `pub fn stale_resume_notice(provider: &str, stale_id: &str) -> String`
+
+The gate policy stays synchronous and PURE — it never does IO. The disk-probe IO it consumes is gathered by the doors, which run the sync validation helpers inside `tokio::task::spawn_blocking` (Tasks 6–8; see Global Constraints).
+
+- [ ] **Step 1: Write the failing tests**
+
+Create `crates/freshell-platform/src/resume_gate.rs` with ONLY the test module first (referencing the not-yet-written items), or write tests + a `todo!()`-free skeleton — the repo convention is inline tests, so create the file with the tests below and empty stubs that don't compile yet is NOT allowed; instead write the tests and run them against a minimal non-implementing body (e.g. `evaluate_resume_gate` returning `Proceed` unconditionally) so the Absent cases FAIL:
+
+```rust
+//! Pre-spawn resume validation policy (resume-validation feature).
+//!
+//! Pure decision logic: given a provider and a disk-existence answer, decide
+//! whether a cached resume id may be passed to the CLI or the pane must spawn
+//! fresh. IO-free by design (mirrors `cli_launch`'s purity rule); callers map
+//! their probe answers into [`ResumeExistence`].
+//!
+//! FAIL-OPEN INVARIANT: only a POSITIVE "store readable, session definitively
+//! absent" returns [`ResumeGateDecision::SpawnFresh`]. Unknown/unreadable
+//! stores, unvalidated providers (gemini, kimi, third-party), and the claude
+//! zero-turn carve-out all Proceed (today's behavior).
+
+use std::sync::Arc;
+
+/// Providers whose on-disk store the existence probe knows how to read.
+/// MUST stay a subset of `freshell-server`'s `KNOWN_PROVIDERS`: the probe's
+/// contract maps unknown providers to `Absent`, so callers must check this
+/// list BEFORE consulting the probe.
+pub const VALIDATED_PROVIDERS: [&str; 4] = ["claude", "codex", "opencode", "amplifier"];
+
+pub fn provider_validated(provider: &str) -> bool {
+    VALIDATED_PROVIDERS.contains(&provider)
+}
+
+/// Caller-mapped existence answer. `ProviderUnavailable` maps to `Unknown`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ResumeExistence {
+    Present,
+    Absent,
+    Unknown,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ResumeGateDecision {
+    /// Pass the resume id through unchanged (validated present, or fail-open).
+    Proceed,
+    /// Definitively absent: drop the resume, spawn fresh, notify, retire.
+    SpawnFresh,
+}
+
+pub fn evaluate_resume_gate(
+    provider: &str,
+    existence: ResumeExistence,
+    ever_observed_on_disk: bool,
+) -> ResumeGateDecision {
+    if !provider_validated(provider) {
+        return ResumeGateDecision::Proceed;
+    }
+    match existence {
+        ResumeExistence::Present | ResumeExistence::Unknown => ResumeGateDecision::Proceed,
+        ResumeExistence::Absent => {
+            // Zero-turn carve-out: a freshell-minted claude session that never
+            // conversed has no transcript on disk yet (mirrors
+            // freshell-ws/reconcile.rs claude carve-out, deliberately more
+            // fail-open: no ledger-bound requirement).
+            //
+            // Amplifier deliberately gets NO such carve-out (plan AD-5): a
+            // never-used stub GC'd at terminal exit is indistinguishable on
+            // disk from the incident's stale id, and the gate-fired fresh
+            // spawn is an equivalent empty session for a never-typed pane.
+            if provider == "claude" && !ever_observed_on_disk {
+                ResumeGateDecision::Proceed
+            } else {
+                ResumeGateDecision::SpawnFresh
+            }
+        }
+    }
+}
+
+/// The operator-visible notice line. MUST name the stale id (spec requirement).
+pub fn stale_resume_notice(provider: &str, stale_id: &str) -> String {
+    format!(
+        "Saved {provider} session {stale_id} could not be found on disk — started a fresh session instead."
+    )
+}
+
+/// Injection shape for crates that cannot depend on `freshell-ws`'s probe
+/// trait (freshell-freshagent): one call answering both existence and
+/// disk-history for `(provider, session_id)`.
+pub struct ResumeProbeAnswer {
+    pub existence: ResumeExistence,
+    pub ever_observed_on_disk: bool,
+}
+
+pub type ResumeProbeFn = Arc<dyn Fn(&str, &str) -> ResumeProbeAnswer + Send + Sync>;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ResumeExistence::*;
+    use ResumeGateDecision::*;
+
+    #[test]
+    fn amplifier_absent_spawns_fresh() {
+        // THE incident case: stale amplifier id with no session dir anywhere.
+        // Deliberately ALSO covers the never-used-stub-GC'd-at-exit shape —
+        // indistinguishable on disk from the incident (plan AD-5).
+        assert_eq!(evaluate_resume_gate("amplifier", Absent, false), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("amplifier", Absent, true), SpawnFresh);
+    }
+
+    #[test]
+    fn codex_and_opencode_absent_spawn_fresh() {
+        assert_eq!(evaluate_resume_gate("codex", Absent, true), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("opencode", Absent, true), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("codex", Absent, false), SpawnFresh);
+        assert_eq!(evaluate_resume_gate("opencode", Absent, false), SpawnFresh);
+    }
+
+    #[test]
+    fn claude_zero_turn_carve_out_proceeds() {
+        // Never observed on disk => could be a legit zero-turn session. Fail open.
+        assert_eq!(evaluate_resume_gate("claude", Absent, false), Proceed);
+    }
+
+    #[test]
+    fn claude_absent_but_previously_on_disk_spawns_fresh() {
+        // Transcript existed once and is gone now: positive absence.
+        assert_eq!(evaluate_resume_gate("claude", Absent, true), SpawnFresh);
+    }
+
+    #[test]
+    fn present_and_unknown_always_proceed() {
+        for p in VALIDATED_PROVIDERS {
+            assert_eq!(evaluate_resume_gate(p, Present, false), Proceed);
+            assert_eq!(evaluate_resume_gate(p, Unknown, false), Proceed);
+            assert_eq!(evaluate_resume_gate(p, Present, true), Proceed);
+            assert_eq!(evaluate_resume_gate(p, Unknown, true), Proceed);
+        }
+    }
+
+    #[test]
+    fn unvalidated_providers_never_blocked() {
+        // gemini/kimi have no resumeArgs and are outside KNOWN_PROVIDERS;
+        // the probe would answer Absent for them — the gate must not care.
+        for p in ["gemini", "kimi", "some-third-party-ext", "shell"] {
+            assert_eq!(evaluate_resume_gate(p, Absent, false), Proceed);
+            assert!(!provider_validated(p));
+        }
+    }
+
+    #[test]
+    fn notice_names_the_stale_id() {
+        let n = stale_resume_notice("amplifier", "8dab420a-f76b-407c-bcbe-dfb2a971c2e1");
+        assert!(n.contains("amplifier"));
+        assert!(n.contains("8dab420a-f76b-407c-bcbe-dfb2a971c2e1"));
+        assert!(n.contains("could not be found"));
+        assert!(n.contains("fresh session"));
+    }
+}
+```
+
+For the RED phase, temporarily make `evaluate_resume_gate` return `ResumeGateDecision::Proceed` unconditionally and `stale_resume_notice` return `String::new()`.
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `cargo test -p freshell-platform resume_gate -- --nocapture`
+Expected: FAIL — `amplifier_absent_spawns_fresh`, `codex_and_opencode_absent_spawn_fresh`, `claude_absent_but_previously_on_disk_spawns_fresh`, `notice_names_the_stale_id` fail; the fail-open tests pass.
+
+- [ ] **Step 3: Implement the real bodies**
+
+Replace the stub bodies with the full implementations shown in Step 1 (the `match` in `evaluate_resume_gate` and the `format!` in `stale_resume_notice`). Add `pub mod resume_gate;` to `crates/freshell-platform/src/lib.rs`.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p freshell-platform resume_gate`
+Expected: PASS (all 7 tests). Also run `cargo clippy -p freshell-platform -- -D warnings` and `cargo fmt` — clean.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-platform/src/resume_gate.rs crates/freshell-platform/src/lib.rs
+git commit -m "feat(resume-validation): pure resume-gate policy in freshell-platform"
+```
+
+---
+
+### Task 2: Read-only amplifier session existence scan in `freshell-sessions`
+
+**Files:**
+- Modify: `crates/freshell-sessions/src/amplifier_stub.rs` (the existence scan already exists inside `ensure_session` at `:134-148` — extract a read-only variant beside it)
+- Test: inline `#[cfg(test)]` in the same file (this crate has NO `tempfile` dep — use the hand-rolled unique-temp-dir style from `crates/freshell-sessions/src/opencode_locator.rs:393-401`)
+
+**Interfaces:**
+- Consumes: `resolve_amplifier_home()` (existing, same file) — `$FRESHELL_AMPLIFIER_HOME` override, else `$HOME/.amplifier`.
+- Produces (used by Task 3):
+  - `pub enum AmplifierSessionAnswer { Present, Absent, Unreadable }`
+  - `pub fn session_on_disk(amplifier_home: &std::path::Path, session_id: &str) -> AmplifierSessionAnswer`
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to the `#[cfg(test)] mod` in `amplifier_stub.rs` (create a helper mirroring the crate's existing unique-temp-dir pattern):
+
+```rust
+    use std::sync::atomic::{AtomicU64, Ordering as TestOrdering};
+
+    static SCAN_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+    fn scan_temp_home(label: &str) -> std::path::PathBuf {
+        let n = SCAN_COUNTER.fetch_add(1, TestOrdering::SeqCst);
+        let dir = std::env::temp_dir().join(format!(
+            "freshell-amplifier-scan-{label}-{}-{n}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    /// Permission tests are meaningless as root (root ignores mode bits) —
+    /// e.g. sandboxed/container suites. Skip (return early) when euid == 0.
+    fn running_as_root() -> bool {
+        std::process::Command::new("id")
+            .arg("-u")
+            .output()
+            .map(|o| String::from_utf8_lossy(&o.stdout).trim() == "0")
+            .unwrap_or(false)
+    }
+
+    #[test]
+    fn session_on_disk_present_under_cwd_slug() {
+        let home = scan_temp_home("present");
+        let sess = home.join("projects/-home-dan-proj/sessions/sid-1");
+        std::fs::create_dir_all(&sess).unwrap();
+        assert!(matches!(
+            session_on_disk(&home, "sid-1"),
+            AmplifierSessionAnswer::Present
+        ));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+
+    #[test]
+    fn session_on_disk_present_under_divergent_slug() {
+        // The tab may have moved cwd; the session lives under ANOTHER project
+        // slug. Scanning all project dirs must still find it (plan decision:
+        // search all projects, documented in Global Constraints).
+        let home = scan_temp_home("divergent");
+        std::fs::create_dir_all(home.join("projects/-some-other-project/sessions/sid-2")).unwrap();
+        std::fs::create_dir_all(home.join("projects/-home-dan-proj")).unwrap();
+        assert!(matches!(
+            session_on_disk(&home, "sid-2"),
+            AmplifierSessionAnswer::Present
+        ));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+
+    #[test]
+    fn session_on_disk_absent_when_store_readable() {
+        let home = scan_temp_home("absent");
+        std::fs::create_dir_all(home.join("projects/-home-dan-proj/sessions/other-sid")).unwrap();
+        assert!(matches!(
+            session_on_disk(&home, "sid-3"),
+            AmplifierSessionAnswer::Absent
+        ));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+
+    #[test]
+    fn session_on_disk_absent_when_projects_dir_missing() {
+        // Store root exists but amplifier has never created projects/:
+        // readable-and-empty => definitively absent.
+        let home = scan_temp_home("noprojects");
+        assert!(matches!(
+            session_on_disk(&home, "sid-4"),
+            AmplifierSessionAnswer::Absent
+        ));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn session_on_disk_unreadable_projects_dir_fails_open() {
+        use std::os::unix::fs::PermissionsExt;
+        if running_as_root() {
+            return; // root ignores mode bits — test is meaningless
+        }
+        let home = scan_temp_home("unreadable");
+        let projects = home.join("projects");
+        std::fs::create_dir_all(&projects).unwrap();
+        std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o000)).unwrap();
+        let answer = session_on_disk(&home, "sid-5");
+        // Restore perms before asserting so cleanup works even on failure.
+        std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o755)).unwrap();
+        assert!(matches!(answer, AmplifierSessionAnswer::Unreadable));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn session_on_disk_unreadable_project_subdir_fails_open() {
+        // V3 case E2a: a chmod-000 PROJECT dir with the session inside must
+        // answer Unreadable, never Absent (`.is_dir()` returns false on
+        // EACCES — the errors-seen accumulator catches the metadata error).
+        use std::os::unix::fs::PermissionsExt;
+        if running_as_root() {
+            return;
+        }
+        let home = scan_temp_home("locked-project");
+        let locked = home.join("projects/-locked-proj");
+        std::fs::create_dir_all(locked.join("sessions/sid-7")).unwrap();
+        std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o000)).unwrap();
+        let answer = session_on_disk(&home, "sid-7");
+        std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o755)).unwrap();
+        assert!(matches!(answer, AmplifierSessionAnswer::Unreadable));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn session_on_disk_listable_not_traversable_projects_fails_open() {
+        // V3 case E2b: projects/ mode 444 — read_dir succeeds (needs r) but
+        // stat into children needs x, so every per-entry metadata call errors.
+        // Any-error-and-no-hit => Unreadable.
+        use std::os::unix::fs::PermissionsExt;
+        if running_as_root() {
+            return;
+        }
+        let home = scan_temp_home("no-traverse");
+        let projects = home.join("projects");
+        std::fs::create_dir_all(projects.join("-p/sessions/sid-8")).unwrap();
+        std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o444)).unwrap();
+        let answer = session_on_disk(&home, "sid-8");
+        std::fs::set_permissions(&projects, std::fs::Permissions::from_mode(0o755)).unwrap();
+        assert!(matches!(answer, AmplifierSessionAnswer::Unreadable));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+
+    #[test]
+    fn session_on_disk_matches_a_file_only_as_absent() {
+        // A stray FILE named like the session id is not a session dir.
+        let home = scan_temp_home("file-not-dir");
+        let sessions = home.join("projects/-p/sessions");
+        std::fs::create_dir_all(&sessions).unwrap();
+        std::fs::write(sessions.join("sid-6"), b"junk").unwrap();
+        assert!(matches!(
+            session_on_disk(&home, "sid-6"),
+            AmplifierSessionAnswer::Absent
+        ));
+        let _ = std::fs::remove_dir_all(&home);
+    }
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `cargo test -p freshell-sessions session_on_disk`
+Expected: FAIL to compile — `session_on_disk` / `AmplifierSessionAnswer` not defined.
+
+- [ ] **Step 3: Write the implementation**
+
+Add beside `ensure_session` in `amplifier_stub.rs`:
+
+```rust
+/// Read-only disk-existence answer for one amplifier session id, scanning ALL
+/// project slugs under `<amplifier_home>/projects/` (a session may live under
+/// a different slug than the current cwd — see `ensure_session`'s divergent-
+/// slug handling). Never creates anything.
+///
+/// Semantics (resume-validation feature — errors-seen accumulator, V3):
+/// * session dir found under any project => `Present` (short-circuits);
+/// * `projects/` missing (NotFound, parent readable) or scanned WITHOUT any
+///   error and without a hit => `Absent` (store readable, definitively
+///   absent — AD-1: missing root is positive absence, matching today's
+///   warm-path steady state);
+/// * `projects/` unreadable at the root, OR any per-entry error during the
+///   scan (unreadable project subdir, EACCES stat, dropped dir entry) with
+///   no hit => `Unreadable` (callers must fail OPEN — treat as unknown,
+///   never as absent). NEVER adjudicate via `.is_dir()` alone: it returns
+///   `false` on EACCES and would manufacture a false Absent.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AmplifierSessionAnswer {
+    Present,
+    Absent,
+    Unreadable,
+}
+
+pub fn session_on_disk(
+    amplifier_home: &std::path::Path,
+    session_id: &str,
+) -> AmplifierSessionAnswer {
+    let projects = amplifier_home.join("projects");
+    let entries = match std::fs::read_dir(&projects) {
+        Ok(entries) => entries,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            return AmplifierSessionAnswer::Absent; // AD-1: root missing, parent readable
+        }
+        Err(_) => return AmplifierSessionAnswer::Unreadable,
+    };
+    let mut saw_error = false;
+    for entry in entries {
+        let entry = match entry {
+            Ok(entry) => entry,
+            Err(_) => {
+                saw_error = true; // dropped dir entry (EIO, network fs) — cannot rule out
+                continue;
+            }
+        };
+        let candidate = entry.path().join("sessions").join(session_id);
+        match std::fs::metadata(&candidate) {
+            Ok(meta) if meta.is_dir() => return AmplifierSessionAnswer::Present,
+            Ok(_) => {} // stray FILE named like the id — not a session dir
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => {}
+            Err(_) => saw_error = true, // EACCES etc. — the session may be hiding here
+        }
+    }
+    if saw_error {
+        AmplifierSessionAnswer::Unreadable
+    } else {
+        AmplifierSessionAnswer::Absent
+    }
+}
+```
+
+Refactor step: `ensure_session`'s internal scan loop (`:134-148`) and this function walk the same layout — if a shared private helper falls out naturally (e.g. `fn find_session_dir(projects: &Path, session_id: &str) -> Option<(String, PathBuf)>`), extract it; if the two loops need different data (ensure_session needs the found slug), leaving them separate is acceptable. Do not change `ensure_session` behavior.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p freshell-sessions session_on_disk`
+Expected: PASS (8 tests; 5 on non-unix — the three permission tests are `#[cfg(unix)]` and additionally self-skip under root). Then `cargo test -p freshell-sessions` — full crate still green.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-sessions/src/amplifier_stub.rs
+git commit -m "feat(resume-validation): read-only amplifier session_on_disk scan"
+```
+
+---
+
+### Task 3: Amplifier + codex by-id fallbacks on `IndexExistenceProbe` + cold-index coverage
+
+Why (two problems, one probe change):
+
+1. **Stale warm snapshots.** The probe's warm snapshot can be STALE — a session created moments before a restart may be missing from the snapshot, and `peek()` serves snapshots regardless of TTL. The claude arm already has a raw-file fallback for exactly this; without equivalents, the gate could misjudge a brand-new amplifier/codex session as `Absent` and wrongly block a working resume (violating the fail-open invariant). After this task, `Absent` for all four validated providers means POSITIVE absence.
+2. **Cold index at boot (A1 falsified).** The snapshot starts `None` EVERY boot (`directory_index.rs:687`) and the boot sweep is a detached `tokio::spawn` (`main.rs:796`) never awaited before the listener binds (`main.rs:1122`) — so restore-time creates routinely race a cold index. Today's cold `exists()` answers `Unknown` (root exists) → the gate would silently no-op in the EXACT incident scenario. Fix: when the index is COLD, `exists()` still runs the cheap direct by-id locators for amplifier (Task 2's `session_on_disk`) and claude (the existing transcript locator) — both are cheap directory checks — mapping Present/Absent/Unreadable → Present/Absent/Unknown. codex and opencode answer `Unknown` when cold (fail open; accepted residual AD-4 — the ~1 s codex walk must not run on every early-boot create). The incident provider (amplifier) is therefore covered even before warm-up. The cold-path `ProviderUnavailable` answer (provider root missing) stays untouched.
+
+**Files:**
+- Modify: `crates/freshell-server/src/existence.rs`
+- Modify: `crates/freshell-server/src/main.rs` (probe construction site — where `IndexExistenceProbe::new(index, Some(pane_ledger), provider_roots)` is built and `.with_claude_transcript_locator(...)` / `.with_opencode_session_locator(opencode_db_locator(...))` are chained; codex sessions root resolution mirrors the `ActivityHub` wiring near `main.rs:474`)
+- Test: inline `#[cfg(test)]` in `existence.rs` (mirror the existing hand-rolled temp-dir helpers at `existence.rs:307-318` and the existing fallback tests for claude/opencode)
+
+**Interfaces:**
+- Consumes: `freshell_sessions::amplifier_stub::{session_on_disk, AmplifierSessionAnswer}` (Task 2). The codex rollout layout + ownership convention are taken from `freshell_ws::codex_reconcile::locate_codex_rollout`/`first_line_owns` (`codex_reconcile.rs:154-207`) as REFERENCE ONLY — that walk is fail-soft (silent `None` on per-entry errors, six false-Absent reproductions in V3) and MUST NOT be reused for the gate; reconcile's existing callers keep it unchanged.
+- Produces (wired in `main.rs`, consumed implicitly by every `probe.exists()` caller):
+  - `pub enum ByIdAnswer { Present, Absent, Unreadable }` (one shared enum for both new locators; mirror `OpencodeDbAnswer`'s shape)
+  - `pub type AmplifierSessionLocator = Arc<dyn Fn(&str) -> ByIdAnswer + Send + Sync>`
+  - `pub type CodexRolloutExistenceLocator = Arc<dyn Fn(&str) -> ByIdAnswer + Send + Sync>`
+  - `impl IndexExistenceProbe { pub fn with_amplifier_session_locator(self, l: AmplifierSessionLocator) -> Self; pub fn with_codex_rollout_locator(self, l: CodexRolloutExistenceLocator) -> Self }`
+  - `pub fn amplifier_dir_locator(amplifier_home: PathBuf) -> AmplifierSessionLocator`
+  - `pub fn codex_rollout_on_disk(sessions_root: &Path, session_id: &str) -> ByIdAnswer` — NEW gate-safe tri-state walk (errors-seen accumulator), lives in `freshell-server/src/existence.rs`
+  - `pub fn codex_rollout_existence_locator(sessions_root: PathBuf) -> CodexRolloutExistenceLocator` (wraps `codex_rollout_on_disk`)
+  - Cold-index behavior change in `exists()`: when `peek() == None` (after the untouched root-missing → `ProviderUnavailable` check), amplifier and claude consult their cheap by-id locators instead of answering `Unknown`; codex/opencode stay `Unknown` (AD-4)
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to the existing `#[cfg(test)] mod tests` in `existence.rs`, copying the construction pattern of the existing claude raw-file-fallback and opencode by-id tests in that module (same fake-index/temp-dir scaffolding; the module is `existence.rs:301-1293` — pick the nearest analogous test and clone its setup):
+
+```rust
+    #[test]
+    fn amplifier_absent_snapshot_rescued_by_dir_locator() {
+        // Warm snapshot says Absent, but the session dir exists on disk
+        // (created after the snapshot). By-id fallback must answer Present.
+        // Setup: probe with a warm snapshot NOT containing "amp-new",
+        // chained .with_amplifier_session_locator(amplifier_dir_locator(home))
+        // where home contains projects/-p/sessions/amp-new/.
+        // Assert: probe.exists("amplifier", "amp-new") == SessionExistence::Present
+    }
+
+    #[test]
+    fn amplifier_definitively_absent_stays_absent() {
+        // Warm snapshot Absent + locator scans a readable store without the id.
+        // Assert: probe.exists("amplifier", "amp-gone") == SessionExistence::Absent
+    }
+
+    #[test]
+    fn amplifier_unreadable_store_answers_unknown() {
+        // Locator returns Unreadable (e.g. permissions).
+        // Wire a hand-rolled locator: Arc::new(|_| ByIdAnswer::Unreadable).
+        // Assert: probe.exists("amplifier", "amp-x") == SessionExistence::Unknown
+    }
+
+    #[test]
+    fn amplifier_without_locator_keeps_snapshot_answer() {
+        // No locator chained (default) => today's behavior byte-for-byte.
+        // Assert: warm snapshot Absent stays Absent.
+    }
+
+    #[test]
+    fn codex_absent_snapshot_rescued_by_rollout_locator() {
+        // Same shape as the amplifier rescue test, with a temp codex sessions
+        // root containing sessions/2026/07/29/rollout-...-<id>.jsonl and
+        // codex_rollout_existence_locator(root).
+        // Assert Present.
+    }
+
+    #[test]
+    fn codex_missing_sessions_root_is_absent_and_unreadable_is_unknown() {
+        // sessions root NotFound => Absent (AD-1: fresh install, parent
+        // readable); locator returning Unreadable => probe answers Unknown.
+        // Root readability MUST be established via read_dir, not
+        // fs::metadata — metadata tests existence, not readability (V3 E3).
+    }
+
+    #[test]
+    fn codex_zst_rollout_is_candidate_but_undecodable_answers_unreadable() {
+        // Future codex rollout compression (V2): a file named
+        // rollout-...-<id>.jsonl.zst whose name contains the id MUST pass the
+        // filename prefilter; its first line is not plain JSONL, so the
+        // ownership read fails => counts as an error => Unreadable (probe
+        // answers Unknown — fail open, never Absent for a CLI-resumable file).
+        // Setup: temp root with only the .zst candidate (zstd-magic bytes or
+        // arbitrary binary). Assert codex_rollout_on_disk(...) == Unreadable.
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn codex_unreadable_date_subdir_answers_unreadable() {
+        // V3 case E4: rollout lives under sessions/2026/07/29/ chmod 000.
+        // Skip when running as root (euid==0 — mode bits ignored); use the
+        // same running_as_root() helper pattern as Task 2's tests.
+        // Assert codex_rollout_on_disk(...) == Unreadable (per-entry error
+        // accumulated, no silent skip), and probe.exists(...) == Unknown.
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn codex_unreadable_candidate_file_answers_unreadable() {
+        // V3 case E7: the owning rollout file itself is chmod 000 — the
+        // first-line ownership read fails => error => Unreadable, never
+        // Absent. Skip when euid==0.
+    }
+
+    #[test]
+    fn cold_index_amplifier_uses_dir_locator() {
+        // Probe with NO warm snapshot (peek() == None, the every-boot state)
+        // but amplifier root present and .with_amplifier_session_locator(...)
+        // chained. Assert: session dir on disk => Present; readable-empty
+        // store => Absent; locator Unreadable => Unknown. (This is the
+        // incident scenario: restore-time create racing the boot sweep.)
+    }
+
+    #[test]
+    fn cold_index_claude_uses_transcript_locator() {
+        // Same shape via the EXISTING claude transcript locator: cold index +
+        // transcript file on disk => Present; readable store without it =>
+        // Absent (gate still Proceeds unless ever_observed_on_disk — Task 1).
+    }
+
+    #[test]
+    fn cold_index_codex_and_opencode_answer_unknown() {
+        // Cold index + locators chained: codex/opencode must NOT run their
+        // by-id lookups when cold (AD-4 — the codex walk is ~1 s on a real
+        // store). Assert Unknown for both. The root-missing =>
+        // ProviderUnavailable pre-check stays byte-for-byte today's behavior.
+    }
+```
+
+Write these as REAL tests (full setup + assertions) by cloning the neighboring claude/opencode fallback tests' scaffolding — the comments above define the required behavior of each; the scaffolding (fake index snapshot seeding, probe construction) must match what those existing tests already do in this module.
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `cargo test -p freshell-server existence`
+Expected: FAIL to compile — `with_amplifier_session_locator` etc. not defined.
+
+- [ ] **Step 3: Implement the locators and fallbacks**
+
+In `existence.rs`:
+
+```rust
+/// By-id disk answer for the amplifier/codex fallbacks (mirrors OpencodeDbAnswer).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ByIdAnswer {
+    Present,
+    Absent,
+    Unreadable,
+}
+
+pub type AmplifierSessionLocator = Arc<dyn Fn(&str) -> ByIdAnswer + Send + Sync>;
+pub type CodexRolloutExistenceLocator = Arc<dyn Fn(&str) -> ByIdAnswer + Send + Sync>;
+
+pub fn amplifier_dir_locator(amplifier_home: std::path::PathBuf) -> AmplifierSessionLocator {
+    Arc::new(move |session_id: &str| {
+        match freshell_sessions::amplifier_stub::session_on_disk(&amplifier_home, session_id) {
+            freshell_sessions::amplifier_stub::AmplifierSessionAnswer::Present => ByIdAnswer::Present,
+            freshell_sessions::amplifier_stub::AmplifierSessionAnswer::Absent => ByIdAnswer::Absent,
+            freshell_sessions::amplifier_stub::AmplifierSessionAnswer::Unreadable => ByIdAnswer::Unreadable,
+        }
+    })
+}
+
+/// Gate-safe tri-state codex rollout walk (resume-validation feature).
+/// Deliberately a NEW walk, NOT a reuse of the fail-soft
+/// `freshell_ws::codex_reconcile::locate_codex_rollout` — that helper
+/// silently converts per-entry IO errors into `None`, which the gate would
+/// read as positive absence (six false-Absent reproductions in V3).
+/// Errors-seen accumulator: `Present` short-circuits; a walk that completes
+/// having seen ANY per-entry error and no hit answers `Unreadable`.
+pub fn codex_rollout_on_disk(
+    sessions_root: &std::path::Path,
+    session_id: &str,
+) -> ByIdAnswer {
+    // Root readability is established by read_dir itself: NotFound (parent
+    // readable) => Absent (AD-1); any other error => Unreadable. NOTE:
+    // `fs::metadata(root)` is NOT sufficient — it tests existence, not
+    // readability (a mode-111 root passes metadata but fails read_dir; V3 E3).
+    let mut stack = vec![sessions_root.to_path_buf()];
+    let mut saw_error = false;
+    let mut first_level = true;
+    while let Some(dir) = stack.pop() {
+        let entries = match std::fs::read_dir(&dir) {
+            Ok(entries) => entries,
+            Err(err) if first_level && err.kind() == std::io::ErrorKind::NotFound => {
+                return ByIdAnswer::Absent;
+            }
+            Err(_) if first_level => return ByIdAnswer::Unreadable,
+            Err(_) => {
+                saw_error = true; // unreadable subtree below the root — may hide the rollout
+                continue;
+            }
+        };
+        first_level = false;
+        for entry in entries {
+            let entry = match entry {
+                Ok(entry) => entry,
+                Err(_) => {
+                    saw_error = true;
+                    continue;
+                }
+            };
+            let path = entry.path();
+            // Never `.is_dir()` — false on EACCES (V3 E6).
+            match std::fs::metadata(&path) {
+                Ok(meta) if meta.is_dir() => stack.push(path),
+                Ok(_) => {
+                    let name = entry.file_name();
+                    let name = name.to_string_lossy();
+                    // Filename prefilter: id-in-name (verified convention,
+                    // V2: 4459/4459 real rollouts + codex source constructs
+                    // the name from the id) — accept both `.jsonl` and
+                    // `.jsonl.zst` (future codex rollout compression, V2).
+                    if name.contains(session_id)
+                        && (name.ends_with(".jsonl") || name.ends_with(".jsonl.zst"))
+                    {
+                        // Ownership check: first-line session_meta id ==
+                        // session_id => Present (short-circuit). Mirror
+                        // `first_line_owns` (`codex_reconcile.rs:188-207`)
+                        // but tri-state: open/read/decode failure on a
+                        // candidate (incl. an undecodable `.jsonl.zst`)
+                        // counts as an ERROR (saw_error = true), never as
+                        // "not the owner"; only a VALID read whose id
+                        // differs keeps walking as a non-owner.
+                        // (Implement as a private fn returning
+                        // Result<bool, ()> and fold Err into saw_error.)
+                    }
+                }
+                Err(_) => saw_error = true,
+            }
+        }
+    }
+    if saw_error {
+        ByIdAnswer::Unreadable
+    } else {
+        ByIdAnswer::Absent
+    }
+}
+
+pub fn codex_rollout_existence_locator(
+    sessions_root: std::path::PathBuf,
+) -> CodexRolloutExistenceLocator {
+    Arc::new(move |session_id: &str| codex_rollout_on_disk(&sessions_root, session_id))
+}
+```
+
+Add two `Option<...>` fields to `IndexExistenceProbe` plus builder methods `with_amplifier_session_locator` / `with_codex_rollout_locator` (exactly mirroring `with_claude_transcript_locator` / `with_opencode_session_locator`). In the `exists()` body's warm-snapshot-Absent adjudication section (`existence.rs:181-277`, after the claude raw-file fallback at `:226` and the opencode by-id fallback at `:254`), add the same pattern for amplifier and codex:
+
+```rust
+        // amplifier/codex by-id fallbacks (resume-validation feature):
+        // a stale warm snapshot must never adjudicate a real session absent.
+        if provider == "amplifier" {
+            if let Some(locator) = &self.amplifier_session_locator {
+                return match locator(session_id) {
+                    ByIdAnswer::Present => SessionExistence::Present,
+                    ByIdAnswer::Unreadable => SessionExistence::Unknown,
+                    ByIdAnswer::Absent => SessionExistence::Absent,
+                };
+            }
+        }
+        if provider == "codex" {
+            if let Some(locator) = &self.codex_rollout_locator {
+                return match locator(session_id) {
+                    ByIdAnswer::Present => SessionExistence::Present,
+                    ByIdAnswer::Unreadable => SessionExistence::Unknown,
+                    ByIdAnswer::Absent => SessionExistence::Absent,
+                };
+            }
+        }
+```
+
+(Place them at the same adjudication point as the existing fallbacks — only reached when the snapshot would otherwise answer `Absent`. This warm-Absent adjudication also covers TTL-stale snapshots — `peek()` serves snapshots regardless of TTL, so a session created after the last publish reads a stale Absent and is rescued here.)
+
+Cold-index coverage (`exists()`, the `peek() == None` branch at `existence.rs:182-205`): keep the existing provider-root-missing → `ProviderUnavailable` pre-check byte-for-byte. Then, instead of returning `Unknown` unconditionally:
+
+```rust
+        None => {
+            if self.provider_roots.get(provider).is_some_and(|root| !root.exists()) {
+                return SessionExistence::ProviderUnavailable; // untouched cold-path answer
+            }
+            // Cold-index coverage (resume-validation, A1): the snapshot is None
+            // every boot and the warm sweep is detached — restore-time creates
+            // race it. amplifier + claude have CHEAP direct by-id locators; run
+            // them so the gate still fires in the incident scenario. codex/
+            // opencode stay Unknown when cold (AD-4: the codex walk is ~1 s on
+            // a real store — warm-Absent adjudication only).
+            if provider == "amplifier" {
+                if let Some(locator) = &self.amplifier_session_locator {
+                    return match locator(session_id) {
+                        ByIdAnswer::Present => SessionExistence::Present,
+                        ByIdAnswer::Absent => SessionExistence::Absent,
+                        ByIdAnswer::Unreadable => SessionExistence::Unknown,
+                    };
+                }
+            }
+            if provider == "claude" {
+                // Reuse the EXISTING claude transcript locator (raw-file
+                // check — cheap), mapping its answer the same way the warm
+                // fallback at :226 does.
+            }
+            SessionExistence::Unknown
+        }
+```
+
+(Adapt the claude arm to the existing transcript-locator field/return shape at `existence.rs:226` — same mapping, hit ⇒ `Present`, clean miss ⇒ `Absent`, error ⇒ `Unknown`.)
+
+In `main.rs`, at the probe construction site, chain the new builders:
+- `with_amplifier_session_locator(amplifier_dir_locator(home))` where `home` comes from `freshell_sessions::amplifier_stub::resolve_amplifier_home()` (skip chaining when it returns `None` — probe then behaves as today for amplifier).
+- `with_codex_rollout_locator(codex_rollout_existence_locator(codex_sessions_root))` where `codex_sessions_root` is resolved exactly like the `ActivityHub` wiring near `main.rs:474` (`$CODEX_HOME` else `$HOME/.codex`, joined with `sessions`). Reuse/extract that resolution rather than duplicating it.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p freshell-server existence`
+Expected: PASS — all new tests plus the existing ~existing existence tests stay green.
+Then: `cargo test -p freshell-server` and `cargo clippy -p freshell-server -- -D warnings`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-server/src/existence.rs crates/freshell-server/src/main.rs
+git commit -m "feat(resume-validation): amplifier + codex by-id existence fallbacks"
+```
+
+---
+
+### Task 4: `RetiredReason::SessionMissing` + `PaneLedger::retire_missing`
+
+**Files:**
+- Modify: `crates/freshell-ws/src/pane_ledger.rs`
+- Test: `crates/freshell-ws/src/pane_ledger_tests.rs` (existing `#[path]` test split)
+
+**Interfaces:**
+- Consumes: existing `BindingRow`, `RowState {Bound|Retired}`, `RetiredReason {Superseded|Closed|GcExpired}` (`pane_ledger.rs:77-88`), `retire_closed` (`:563`) as the implementation template, `load_binding` (`:617`).
+- Produces (used by Tasks 6–8):
+  - `RetiredReason::SessionMissing` (serde `snake_case` → `"session_missing"`; enum is `#[serde(rename_all = "snake_case")]`)
+  - `pub fn retire_missing(&self, provider: &str, session_id: &str) -> bool` — retires a `Bound` row with `retired_reason = Some(SessionMissing)`; returns `true` iff a bound row was retired; no-op (`false`) when no row exists or the row is already `Retired`; durable atomic write like every other mutation in this module.
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `pane_ledger_tests.rs`, cloning the setup style of the existing `retire_closed` tests in that file:
+
+```rust
+#[test]
+fn retire_missing_marks_bound_row_session_missing() {
+    // Setup: a ledger with a Bound binding for ("amplifier", "stale-sid")
+    // (create it exactly the way the neighboring retire_closed test does).
+    // Act:
+    //   let retired = ledger.retire_missing("amplifier", "stale-sid");
+    // Assert:
+    //   retired == true;
+    //   let row = ledger.load_binding("amplifier", "stale-sid").unwrap();
+    //   row.state == RowState::Retired;
+    //   row.retired_reason == Some(RetiredReason::SessionMissing);
+}
+
+#[test]
+fn retire_missing_is_noop_without_binding() {
+    // Fresh ledger, no rows.
+    // Assert: ledger.retire_missing("amplifier", "never-seen") == false
+    // and no row was created (load_binding returns None).
+}
+
+#[test]
+fn retire_missing_does_not_reretire() {
+    // Bound row retired once => true; second call => false; reason stays
+    // SessionMissing; updated_at from the first retire is not clobbered
+    // by the failed second call.
+}
+
+#[test]
+fn session_missing_serde_round_trips() {
+    // serde_json::to_string(&RetiredReason::SessionMissing) == "\"session_missing\""
+    // and it deserializes back.
+}
+```
+
+Write these as REAL tests using the exact ledger-construction and row-seeding helpers the neighboring `retire_closed` tests in this file already use.
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `cargo test -p freshell-ws pane_ledger`
+Expected: FAIL to compile — `SessionMissing` / `retire_missing` not defined.
+
+- [ ] **Step 3: Implement**
+
+- Add `SessionMissing` to `RetiredReason`.
+- Implement `retire_missing` by copying `retire_closed`'s body/pattern (`pane_ledger.rs:563`) with the reason swapped and the bound-row guard as specified. Keep the module's durability discipline (atomic temp+rename via the existing write path).
+- Run `cargo check -p freshell-ws -p freshell-server` — the compiler will flag any exhaustive `match` on `RetiredReason` elsewhere; extend each arm conservatively (treat `SessionMissing` like `Closed` wherever a policy choice is needed, i.e. "not resumable, not superseded"). List every touched match site in the commit message body.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p freshell-ws pane_ledger`
+Expected: PASS. Then `cargo test -p freshell-ws` — whole crate green.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-ws/src/pane_ledger.rs crates/freshell-ws/src/pane_ledger_tests.rs
+git commit -m "feat(resume-validation): RetiredReason::SessionMissing + retire_missing"
+```
+
+---
+
+### Task 5: `notice` field on `terminal.created` + client rendering
+
+**Files:**
+- Modify: `crates/freshell-protocol/src/server_messages.rs` (the `TerminalCreated` struct, `~:956` region)
+- Modify: `shared/ws-protocol.ts` (`~:725`, the `terminal.created` type) — this is the SOURCE OF TRUTH the contract schema is generated from
+- Regenerate: `port/contract/ws-server-messages.schema.json` via `npm run contract:generate` — NEVER hand-edit the generated JSON (drift-guarded by `test/unit/port/ws-contract-freeze.test.ts`, which byte-compares the committed file against a fresh regeneration)
+- Modify: `crates/freshell-protocol/tests/roundtrip.rs` — wire test including `notice`, per the precedent of commits `5c591843` (previousSessionId) and `a18dd4c6` (persisted/persistReason)
+- Modify: `src/components/TerminalView.tsx` — the `terminal.created` success handler (it lives near the create-`error` handling that renders `[Restore failed]` at `TerminalView.tsx:4691`)
+- Test: Rust serde test inline in `server_messages.rs` (or the protocol crate's existing test module for server messages); client test added to the existing test file that covers `[Restore failed]` rendering (find it: `grep -rln "Restore failed" test/`)
+- NO `server/` (Node) files change — both precedent commits touched zero; `shared/ws-protocol.ts` is shared client/server TYPING, not the Node server.
+
+**Interfaces:**
+- Consumes: nothing new.
+- Produces (used by Task 6): `TerminalCreated { …existing fields…, notice: Option<String> }` serialized as `"notice"` only when present (`#[serde(skip_serializing_if = "Option::is_none")]`). Client behavior when `msg.notice` is a non-empty string:
+  1. write it into the pane's xterm as its own line, styled exactly like the reconcile-notice write at `TerminalView.tsx:4336`/`:5053`;
+  2. ALSO clear the pane's persisted `sessionRef`/`resumeSessionId`. Why (A5, V5): claude/amplifier gate-fired spawns self-heal — `terminal.created.sessionRef` carries the fresh id and the client unconditionally overwrites the pane ref + clears `resumeSessionId` (`TerminalView.tsx:260-281`/`:4261-4288`, verified). codex/opencode gate-fired spawns carry NO `sessionRef` (fallback is `None`), so without this clear the stale persisted ref would re-fire the gate on EVERY restart; clearing on `notice` breaks the loop, and subsequent live identity capture can then associate the fresh session unimpeded.
+
+This is one additive optional field on an existing message type — the frozen `SERVER_MESSAGE_TYPES` inventory (57 entries) is unchanged. The Node server never sets the field; it is optional end-to-end (the SPA ingests frames via plain `JSON.parse` cast — no zod on server→client).
+
+- [ ] **Step 1: Write the failing Rust serde test**
+
+In the protocol crate's server-message test module:
+
+```rust
+#[test]
+fn terminal_created_notice_is_optional_and_additive() {
+    // Absent => key omitted (wire-compatible with the frozen client).
+    let created = /* construct TerminalCreated exactly as the neighboring
+                     TerminalCreated tests in this module do */;
+    let json = serde_json::to_value(&ServerMessage::TerminalCreated(created)).unwrap();
+    assert!(json.get("notice").is_none());
+
+    // Present => serialized verbatim.
+    let mut with_notice = /* same constructor */;
+    with_notice.notice = Some("Saved amplifier session X could not be found on disk — started a fresh session instead.".to_string());
+    let json = serde_json::to_value(&ServerMessage::TerminalCreated(with_notice)).unwrap();
+    assert_eq!(
+        json["notice"],
+        "Saved amplifier session X could not be found on disk — started a fresh session instead."
+    );
+}
+```
+
+(Use the construction helper/literal style of the existing `TerminalCreated` tests in that module.)
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test -p freshell-protocol terminal_created_notice`
+Expected: FAIL to compile — no `notice` field.
+
+- [ ] **Step 3: Add the field + schema mirror**
+
+```rust
+    /// Resume-validation feature: operator-visible notice set when the server
+    /// dropped a stale resume id and spawned fresh. The client writes it into
+    /// the pane's xterm. Optional/additive — Node never sets it.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub notice: Option<String>,
+```
+
+Mirror sequence (order matters — the schema is GENERATED, and `roundtrip.rs` reads the committed schema from disk):
+
+1. Add the field to the Rust `TerminalCreated` (`crates/freshell-protocol/src/server_messages.rs`, `~:956` region) and `notice: None` at every existing `TerminalCreated { … }` construction site (`cargo check` enumerates them; expect `crates/freshell-terminal/src/registry.rs` plus ws/freshagent call sites).
+2. Add `notice?: string` to the `terminal.created` type in `shared/ws-protocol.ts` (`~:725`).
+3. REGENERATE `port/contract/ws-server-messages.schema.json` via `npm run contract:generate` and commit the regenerated file. NEVER hand-edit the JSON — `test/unit/port/ws-contract-freeze.test.ts` byte-compares it against a fresh regeneration and a hand-edit fails the drift guard. Verify the command runs cleanly in the worktree (it is repo tooling, not a Node-server change).
+4. Extend `crates/freshell-protocol/tests/roundtrip.rs` with a wire test including `notice`, per the precedent of commits `5c591843` (previousSessionId on `terminal.session.associated`) and `a18dd4c6` (persisted/persistReason on `tabs.sync.ack`).
+
+Run `cargo test -p freshell-protocol --locked` (the CI contract invocation) — green.
+
+- [ ] **Step 4: Write the failing client test, then render**
+
+RED: In the existing test file covering `[Restore failed]` rendering, add a sibling test using that file's existing harness/mocks verbatim:
+
+```typescript
+it('writes the resume-validation notice into the terminal on terminal.created', () => {
+  // Arrange exactly like the sibling "[Restore failed]" test (same mount,
+  // same xterm mock, same WS message dispatch helper), then dispatch a
+  // terminal.created message for this pane that includes:
+  //   notice: 'Saved amplifier session 8dab420a-f76b-407c-bcbe-dfb2a971c2e1 could not be found on disk — started a fresh session instead.'
+  // Assert the xterm write buffer received a line containing
+  // 'Saved amplifier session 8dab420a-f76b-407c-bcbe-dfb2a971c2e1'.
+});
+
+it('clears the persisted sessionRef/resumeSessionId when terminal.created carries a notice', () => {
+  // Same arrangement, pane pre-seeded with a persisted stale
+  // sessionRef/resumeSessionId (codex/opencode shape: the created frame
+  // carries a notice but NO sessionRef — the gate's fallback for these
+  // modes is None, so no sessionRef overwrite will heal the pane).
+  // Dispatch terminal.created with notice set and no sessionRef.
+  // Assert the pane content update cleared sessionRef and resumeSessionId
+  // (breaking the every-restart gate re-fire loop; a later live identity
+  // capture can then associate the fresh session unimpeded).
+});
+```
+
+Run them (`npm run test:vitest -- <that-file> --run`), watch them fail. GREEN: in `TerminalView.tsx`'s `terminal.created` handler, when `msg.notice` is a non-empty string, (1) write it into the pane's xterm as its own line using the exact styling/write mechanism of the reconcile-notice write at `:4336`/`:5053`, and (2) clear the pane's persisted `sessionRef`/`resumeSessionId` in the same `updateContent` pass the handler already performs (`:4261-4288` region — when the frame ALSO carries a `sessionRef`, the existing overwrite fold wins; the clear only matters for the codex/opencode no-sessionRef case). Re-run the tests — PASS. Also re-run the whole file to confirm no regressions.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-protocol/src/server_messages.rs crates/freshell-protocol/tests/roundtrip.rs shared/ws-protocol.ts port/contract/ws-server-messages.schema.json src/ test/
+git commit -m "feat(resume-validation): optional notice on terminal.created, rendered in the pane"
+```
+
+---
+
+### Task 6: Door 1 — gate the WS `terminal.create` restore path
+
+**Files:**
+- Create: `crates/freshell-ws/src/resume_validation.rs`
+- Modify: `crates/freshell-ws/src/lib.rs` (add `pub mod resume_validation;`)
+- Modify: `crates/freshell-ws/src/terminal.rs` — `handle_create`, in the `:1787→:1789` slot: AFTER the D7 cross-mode liveness guard (`:1739-1787`, a pure predicate) and BEFORE the amplifier pre-create block (starts `:1798`)
+- Test: inline `#[cfg(test)]` in `resume_validation.rs`; integration: `crates/freshell-ws/tests/resume_validation_gate.rs`
+
+**Interfaces:**
+- Consumes: Task 1 (`resume_gate::*`), Task 4 (`retire_missing`), Task 5 (`notice` field), existing `SessionExistenceProbe` (`state.session_existence`), `LaunchIntent`, `uuid::Uuid`.
+- `validate_wire_resume` stays SYNC (unit tests stay synchronous); the doors run it inside `tokio::task::spawn_blocking` because the probe's by-id locators do real filesystem walks (A13 — the codex walk is ~1 s on a real store).
+- Produces (also used by Task 7):
+
+```rust
+pub struct ResumeValidationOutcome {
+    pub resume_session_id: Option<String>,
+    pub launch_intent: LaunchIntent,
+    /// True when the fallback minted a fresh claude Start id (caller must set
+    /// its claude_fresh_prealloc flag so downstream identity stamping matches
+    /// the genuine fresh-claude path).
+    pub claude_fresh_prealloc: bool,
+    /// Some(stale_id) iff the gate fired: caller retires the ledger row,
+    /// emits the notice, and must NOT stamp the stale sessionRef.
+    pub stale_session_id: Option<String>,
+    pub notice: Option<String>,
+}
+
+pub fn validate_wire_resume(
+    mode: &str,
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+    probe: &dyn SessionExistenceProbe,
+) -> ResumeValidationOutcome
+```
+
+- [ ] **Step 1: Write the failing unit tests**
+
+`crates/freshell-ws/src/resume_validation.rs` with a stub probe:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::existence::{SessionExistence, SessionExistenceProbe};
+    use freshell_platform::cli_launch::LaunchIntent;
+
+    struct FakeProbe {
+        answer: SessionExistence,
+        ever_on_disk: bool,
+    }
+    impl SessionExistenceProbe for FakeProbe {
+        fn exists(&self, _p: &str, _s: &str) -> SessionExistence {
+            self.answer
+        }
+        fn ever_observed(&self, _p: &str, _s: &str) -> bool {
+            false
+        }
+        fn ever_observed_on_disk(&self, _p: &str, _s: &str) -> bool {
+            self.ever_on_disk
+        }
+    }
+
+    fn absent() -> FakeProbe {
+        FakeProbe { answer: SessionExistence::Absent, ever_on_disk: true }
+    }
+
+    #[test]
+    fn amplifier_absent_mints_fresh_uuid_and_reports_stale() {
+        let out = validate_wire_resume(
+            "amplifier",
+            Some("stale-amp".into()),
+            LaunchIntent::Resume,
+            &absent(),
+        );
+        let fresh = out.resume_session_id.expect("fresh amplifier id preallocated");
+        assert_ne!(fresh, "stale-amp");
+        assert_eq!(out.launch_intent, LaunchIntent::Resume);
+        assert!(!out.claude_fresh_prealloc);
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-amp"));
+        let notice = out.notice.expect("notice set");
+        assert!(notice.contains("stale-amp"));
+    }
+
+    #[test]
+    fn claude_absent_previously_on_disk_falls_back_to_start_intent() {
+        let out = validate_wire_resume(
+            "claude",
+            Some("stale-claude".into()),
+            LaunchIntent::Resume,
+            &absent(),
+        );
+        assert!(out.resume_session_id.is_some());
+        assert_ne!(out.resume_session_id.as_deref(), Some("stale-claude"));
+        assert_eq!(out.launch_intent, LaunchIntent::Start);
+        assert!(out.claude_fresh_prealloc);
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-claude"));
+    }
+
+    #[test]
+    fn claude_zero_turn_absent_proceeds_untouched() {
+        let probe = FakeProbe { answer: SessionExistence::Absent, ever_on_disk: false };
+        let out = validate_wire_resume(
+            "claude",
+            Some("zero-turn".into()),
+            LaunchIntent::Resume,
+            &probe,
+        );
+        assert_eq!(out.resume_session_id.as_deref(), Some("zero-turn"));
+        assert_eq!(out.launch_intent, LaunchIntent::Resume);
+        assert!(out.stale_session_id.is_none());
+        assert!(out.notice.is_none());
+    }
+
+    #[test]
+    fn codex_and_opencode_absent_drop_resume_entirely() {
+        for mode in ["codex", "opencode"] {
+            let out = validate_wire_resume(
+                mode,
+                Some("stale-x".into()),
+                LaunchIntent::Resume,
+                &absent(),
+            );
+            assert!(out.resume_session_id.is_none());
+            assert_eq!(out.stale_session_id.as_deref(), Some("stale-x"));
+            assert!(out.notice.is_some());
+        }
+    }
+
+    #[test]
+    fn unknown_and_provider_unavailable_fail_open() {
+        for answer in [SessionExistence::Unknown, SessionExistence::ProviderUnavailable] {
+            let probe = FakeProbe { answer, ever_on_disk: false };
+            let out = validate_wire_resume(
+                "amplifier",
+                Some("maybe".into()),
+                LaunchIntent::Resume,
+                &probe,
+            );
+            assert_eq!(out.resume_session_id.as_deref(), Some("maybe"));
+            assert!(out.stale_session_id.is_none());
+            assert!(out.notice.is_none());
+        }
+    }
+
+    #[test]
+    fn present_passes_through_untouched() {
+        let probe = FakeProbe { answer: SessionExistence::Present, ever_on_disk: true };
+        let out = validate_wire_resume(
+            "amplifier",
+            Some("real".into()),
+            LaunchIntent::Resume,
+            &probe,
+        );
+        assert_eq!(out.resume_session_id.as_deref(), Some("real"));
+        assert!(out.stale_session_id.is_none());
+    }
+
+    #[test]
+    fn unvalidated_providers_and_empty_ids_never_consult_probe() {
+        struct PanickingProbe;
+        impl SessionExistenceProbe for PanickingProbe {
+            fn exists(&self, _: &str, _: &str) -> SessionExistence {
+                panic!("probe must not be consulted");
+            }
+            fn ever_observed(&self, _: &str, _: &str) -> bool {
+                panic!("probe must not be consulted");
+            }
+            fn ever_observed_on_disk(&self, _: &str, _: &str) -> bool {
+                panic!("probe must not be consulted");
+            }
+        }
+        for mode in ["gemini", "kimi", "shell", "third-party"] {
+            let out = validate_wire_resume(
+                mode,
+                Some("id".into()),
+                LaunchIntent::Resume,
+                &PanickingProbe,
+            );
+            assert_eq!(out.resume_session_id.as_deref(), Some("id"));
+        }
+        let out = validate_wire_resume("amplifier", None, LaunchIntent::Resume, &PanickingProbe);
+        assert!(out.resume_session_id.is_none());
+        assert!(out.stale_session_id.is_none());
+    }
+}
+```
+
+(If the real `SessionExistenceProbe` trait has different required-method spellings, match the trait exactly — it is defined in `crates/freshell-ws/src/existence.rs`; `ever_observed_on_disk` has a default impl, override it in the fakes.)
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test -p freshell-ws resume_validation`
+Expected: FAIL to compile — module doesn't exist yet.
+
+- [ ] **Step 3: Implement `validate_wire_resume`**
+
+```rust
+//! Spawn-door resume validation (resume-validation feature): before a cached
+//! session id is turned into resume argv, ask the disk-existence probe. On
+//! POSITIVE absence, fall back to the same shape a genuinely fresh pane of
+//! that mode uses. Unknown/unavailable always fail open.
+//!
+//! Callers (the spawn doors in `crate::terminal`) apply the outcome: retire
+//! the stale ledger row, emit the notice, and never stamp the stale ref.
+
+use freshell_platform::cli_launch::LaunchIntent;
+use freshell_platform::resume_gate::{
+    evaluate_resume_gate, provider_validated, stale_resume_notice, ResumeExistence,
+    ResumeGateDecision,
+};
+
+use crate::existence::{SessionExistence, SessionExistenceProbe};
+
+pub struct ResumeValidationOutcome {
+    pub resume_session_id: Option<String>,
+    pub launch_intent: LaunchIntent,
+    pub claude_fresh_prealloc: bool,
+    pub stale_session_id: Option<String>,
+    pub notice: Option<String>,
+}
+
+fn passthrough(
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+) -> ResumeValidationOutcome {
+    ResumeValidationOutcome {
+        resume_session_id,
+        launch_intent,
+        claude_fresh_prealloc: false,
+        stale_session_id: None,
+        notice: None,
+    }
+}
+
+pub fn map_existence(e: SessionExistence) -> ResumeExistence {
+    match e {
+        SessionExistence::Present => ResumeExistence::Present,
+        SessionExistence::Absent => ResumeExistence::Absent,
+        SessionExistence::Unknown | SessionExistence::ProviderUnavailable => {
+            ResumeExistence::Unknown
+        }
+    }
+}
+
+pub fn validate_wire_resume(
+    mode: &str,
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+    probe: &dyn SessionExistenceProbe,
+) -> ResumeValidationOutcome {
+    let Some(sid) = resume_session_id.clone().filter(|s| !s.is_empty()) else {
+        return passthrough(resume_session_id, launch_intent);
+    };
+    if !provider_validated(mode) {
+        return passthrough(resume_session_id, launch_intent);
+    }
+    let existence = map_existence(probe.exists(mode, &sid));
+    let ever_on_disk = probe.ever_observed_on_disk(mode, &sid);
+    match evaluate_resume_gate(mode, existence, ever_on_disk) {
+        ResumeGateDecision::Proceed => passthrough(resume_session_id, launch_intent),
+        ResumeGateDecision::SpawnFresh => {
+            let notice = stale_resume_notice(mode, &sid);
+            let (fresh_id, intent, claude_prealloc) = match mode {
+                // Mirror the genuine fresh-pane shapes in handle_create
+                // (should_preallocate_fresh_claude / _amplifier).
+                "claude" => (
+                    Some(uuid::Uuid::new_v4().to_string()),
+                    LaunchIntent::Start,
+                    true,
+                ),
+                "amplifier" => (
+                    Some(uuid::Uuid::new_v4().to_string()),
+                    LaunchIntent::Resume,
+                    false,
+                ),
+                _ => (None, LaunchIntent::Resume, false),
+            };
+            ResumeValidationOutcome {
+                resume_session_id: fresh_id,
+                launch_intent: intent,
+                claude_fresh_prealloc: claude_prealloc,
+                stale_session_id: Some(sid),
+                notice: Some(notice),
+            }
+        }
+    }
+}
+```
+
+Run: `cargo test -p freshell-ws resume_validation` — PASS.
+
+- [ ] **Step 4: Write the failing integration test (RED), then wire door 1 (GREEN)**
+
+RED: create `crates/freshell-ws/tests/resume_validation_gate.rs`. Reuse the harness of `crates/freshell-ws/tests/restore_spawn_gate.rs` verbatim (same `common::*` helpers, same way it builds `WsState`, injects a probe/temp stores, sends a `terminal.create` and reads response frames). Cases to cover (each is one `#[tokio::test]`):
+
+1. `restore_true_amplifier_absent_spawns_fresh_with_notice`: state whose existence probe answers `Absent` for `("amplifier", "stale-amp")` (inject a fake `SharedExistenceProbe` — the harness sets `state.session_existence`; use a fake, not a real index) + a pane ledger containing a `Bound` row for that ref. Send `terminal.create { mode: "amplifier", restore: true, session_ref: {provider:"amplifier", sessionId:"stale-amp"}, cwd: <tempdir> }` (plus `FRESHELL_AMPLIFIER_HOME` pointed at an empty temp home so `ensure_session` runs against the temp store). Assert: the create SUCCEEDS (a `terminal.created` frame arrives, not an `error`); the `terminal.created` frame's `notice` contains `"stale-amp"`; the spawned resume id is NOT `stale-amp` (assert via the ledger: `load_binding("amplifier", "stale-amp")` is `Retired` with reason `SessionMissing`, and no amplifier session dir named `stale-amp` was created under the temp amplifier home — the fresh UUID dir exists instead). NOTE (AD-5): this empty-home + stale-id shape is byte-identical on disk to a never-used stub GC'd at terminal exit — gating it is the DECIDED behavior, not an accident (see Design Notes AD-5).
+2. `restore_true_amplifier_present_resumes_unchanged`: probe answers `Present`; assert `terminal.created` has NO `notice` and the ledger row stays `Bound`.
+3. `restore_true_unknown_fails_open`: probe answers `Unknown`; assert no `notice`, row stays `Bound` (today's behavior preserved).
+4. `restore_true_live_absent_sessionref_hits_d7_not_the_gate`: registry/identity hold a RUNNING owner for `("amplifier", "stale-amp")` (set up the liveness state the way D7's own sibling tests do), probe answers `Absent`, ledger holds a `Bound` row. Send the same restore create as case 1. Assert: (a) the response is D7's `RestoreUnavailable` error frame ("still running"), NOT a `terminal.created` fresh spawn; (b) the `Bound` ledger row of the running session SURVIVES (`load_binding` still `Bound` — the gate never saw the create). This pins the after-D7 ordering (V8 §A11).
+5. `restore_true_live_absent_legacy_resume_id_fails_open`: same live state, but the create carries the id ONLY in legacy `resumeSessionId` (no `session_ref`) — this carrier bypasses D7 in every ordering. Assert: no `notice`, the row stays `Bound`, and the resume proceeds unchanged. This pins the REGISTRY arm of the in-gate liveness precondition (case 6 pins the sidecar arm).
+6. `restore_true_sidecar_live_absent_legacy_resume_id_fails_open`: liveness held ONLY by the fresh-agent sidecar — registry/identity hold NO running owner for the ref, but the state's fresh-agent sidecar (`state.fresh_codex` for a `("codex", "stale-cx")` ref — set up the fake sidecar the way D7's own sidecar-liveness sibling tests do) answers `has_live_session("stale-cx") == true`; probe answers `Absent`; ledger holds a `Bound` row; the create carries the id only in legacy `resumeSessionId`. Assert: no `notice`, the row stays `Bound`, and the resume proceeds unchanged. This pins the ASYNC sidecar arm of the in-gate liveness join — the arm protecting live zero-turn sessions that have no rollout on disk yet (`crates/freshell-server/src/existence.rs:224-227`) — so it cannot be silently dropped while cases 4–5 still pass.
+
+Run: `cargo test -p freshell-ws --test resume_validation_gate` — tests fail (no gate wired; notice absent, row stays bound in case 1; cases 4–6 fail once the gate exists if ordering/liveness are wrong — write them RED now so the GREEN wiring must satisfy them).
+
+GREEN — wire `handle_create` (`terminal.rs`): a tracker in the resume-id derivation region (a), the gate itself in the `:1787→:1789` slot (b), then the stamping guard (c) and notice emission (d):
+
+a. In the derivation block (`:1617-1717`), add a tracker so the gate only sees wire-derived ids — in the `else` branch (the non-prealloc arm that reads `requested_ref` / `create.resume_session_id` / the claude restore ladder), set a new local `let mut resume_id_from_wire = true;` (declared `false` above the block).
+
+b. Insert the gate in the `:1787→:1789` slot — AFTER the D7 cross-mode liveness guard (`:1739-1787`) and BEFORE the amplifier pre-create block (`:1798+`). Both bounds are load-bearing (V8 §A11):
+
+- **After D7:** gate-before-D7 would let a gate fire replace the resume id, which FALSIFIES D7's applicability filter (`resume_session_id == wire sid`) — its loud "still running" reject is silently bypassed and `retire_missing` destroys the `Bound` ledger row of a RUNNING session (breaking `pre_respawn_guard`). D7 is a pure predicate with zero state mutation, so the gate sees byte-identical inputs in the later slot.
+- **Before the amplifier pre-create:** the `ensure_session` re-stub (`:1800-1802`) would resurrect the stale dir under the very id the gate exists to catch.
+
+```rust
+    // Resume validation (docs/plans/2026-07-29-resume-validation.md): never
+    // hand the CLI a resume id that is definitively absent from the
+    // provider's on-disk store. Fail open on Unknown/ProviderUnavailable.
+    // Placed AFTER the D7 liveness guard (a gate fire would falsify D7's
+    // applicability filter and retire a running session's Bound row) and
+    // BEFORE the amplifier ensure_session re-stub (which would resurrect
+    // the stale dir).
+    let mut resume_fallback_notice: Option<String> = None;
+    if resume_id_from_wire {
+        // In-gate liveness precondition: legacy resumeSessionId-only
+        // carriers bypass D7 in every ordering — a LIVE session must never
+        // gate. Same join D7 uses: registry.live_session_owner + the
+        // fresh-agent sidecar liveness consult (:1747-1758). SHAPE NOTE
+        // (load-bearing): D7's join is partly ASYNC — the sidecar arm is
+        // `state.fresh_claude/fresh_codex/fresh_opencode
+        //  .has_live_session(sid).await` — so it CANNOT live inside a sync
+        // `is_some_and` closure. Compute it as a plain `let` with `.await`
+        // in scope, exactly the shape D7 itself uses. BOTH arms are
+        // load-bearing: dropping the async sidecar arm silently un-protects
+        // live zero-turn sessions that have no rollout on disk yet
+        // (integration case 6 pins that arm).
+        let candidate_is_live = match resume_session_id.as_deref() {
+            None => false,
+            Some(sid) => {
+                /* D7's exact two-arm join, copied from :1747-1758:
+                   registry.live_session_owner(Some(&state.identity), &mode, sid)
+                       || <fresh-agent sidecar has_live_session(sid).await
+                          consults for the matching mode(s)>
+                   — copy it, do not reimplement it, and do not reduce it
+                   to the sync registry arm alone. */
+            }
+        };
+        if !candidate_is_live {
+            // The probe's by-id locators do real filesystem walks (~1 s for
+            // codex on a real store) — never inline on the async runtime
+            // (A13). Run the sync helper in spawn_blocking.
+            let outcome = {
+                let probe = state.session_existence.clone();
+                let mode_for_gate = mode.clone();
+                let rid = resume_session_id.take();
+                let intent = launch_intent;
+                tokio::task::spawn_blocking(move || {
+                    crate::resume_validation::validate_wire_resume(
+                        &mode_for_gate,
+                        rid,
+                        intent,
+                        probe.as_ref(),
+                    )
+                })
+                .await
+                .expect("resume validation task panicked")
+            };
+            resume_session_id = outcome.resume_session_id;
+            launch_intent = outcome.launch_intent;
+            if outcome.claude_fresh_prealloc {
+                claude_fresh_prealloc = true;
+            }
+            if let Some(stale) = outcome.stale_session_id.as_deref() {
+                tracing::warn!(
+                    mode = %mode,
+                    stale_session_id = %stale,
+                    "resume validation: cached session missing on disk; spawning fresh"
+                );
+                // Don't retry the stale id forever.
+                // (Use the same state.pane_ledger access pattern the claude
+                // restore ladder / binding writes in this file already use.)
+                let _ = state.pane_ledger.retire_missing(&mode, stale);
+                resume_fallback_notice = outcome.notice;
+            }
+        }
+    }
+```
+
+(Adapt the exact `state.pane_ledger` spelling to how `handle_create` already reaches the ledger — e.g. if it is an `Option`/`Arc`, follow the existing call sites in this file. Adapt the liveness join to D7's exact call shape at `:1747-1758` — do not reimplement it. `state.session_existence` is the shared `Arc<dyn SessionExistenceProbe + Send + Sync>`; clone the Arc into the closure.)
+
+c. Stale-ref stamping guard: from the gate insertion point onward, `handle_create` must not stamp the stale `create.session_ref` as the pane's identity. Grep every use of `create.session_ref` / `requested_ref` BELOW the insertion point in `handle_create`; for each one that records identity (ledger binding writes, identity registry, `terminal.created` session fields), switch it to a local `effective_session_ref` that is `None` when the gate fired (the fresh id — when one was minted — flows through `resume_session_id` exactly as the prealloc paths already do). The integration test's ledger assertions in case 1 pin this.
+
+d. Notice emission: where `handle_create` constructs the `TerminalCreated` success frame, set `notice: resume_fallback_notice` (field from Task 5).
+
+Run: `cargo test -p freshell-ws --test resume_validation_gate` — PASS. Then run the neighbors that pin this region's behavior: `cargo test -p freshell-ws --test restore_spawn_gate --test claude_restore_unavailable --test codex_session_ref_resume --test pane_reconcile` and `cargo test -p freshell-platform` (argv goldens) — all green.
+
+- [ ] **Step 5: Refactor + full-crate run**
+
+Refactor pass: keep `handle_create`'s addition to roughly the block shown above — liveness precondition, `spawn_blocking` gate call, retire + notice bookkeeping (all POLICY stays in `resume_validation.rs` / `resume_gate.rs`; the door only orchestrates). Run `cargo test -p freshell-ws` (whole crate) and `cargo clippy -p freshell-ws -- -D warnings`.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add crates/freshell-ws/src/resume_validation.rs crates/freshell-ws/src/lib.rs crates/freshell-ws/src/terminal.rs crates/freshell-ws/tests/resume_validation_gate.rs
+git commit -m "feat(resume-validation): gate WS terminal.create restore path on disk existence"
+```
+
+---
+
+### Task 7: Door 2 — gate the headless auto-resume respawn
+
+**Files:**
+- Modify: `crates/freshell-ws/src/terminal.rs` — `respawn_agent_terminal` (`:2678`), specifically the hardcoded block at `:2708-2710` (`let resume_session_id = Some(req.session_id.clone());`)
+- Test: extend the existing respawn integration coverage — `crates/freshell-ws/tests/auto_resume_respawn.rs` (reuse its harness/state setup verbatim)
+
+**Interfaces:**
+- Consumes: `validate_wire_resume` (Task 6, sync — this door too runs it inside `tokio::task::spawn_blocking`, A13), `retire_missing` (Task 4), existing `AgentRespawnRequest {mode, provider, session_id, create_request_id, cwd}` and the `emit_recovering`-style broadcast precedent (`auto_resume.rs:604-628`).
+- Produces: no new public API. Behavior contract: on positive absence the respawn proceeds WITHOUT resume args (fresh spawn, same cwd/mode), the stale ledger row is retired `SessionMissing`, a `terminal.status{Recovering, reason}` frame naming the stale id is broadcast, and a `tracing::warn!` is logged. On Present/Unknown, byte-for-byte today's behavior. CRITICAL (V8 §A9): the gate replaces the `resume_session_id` LOCAL, not merely the launch args — the post-spawn bookkeeping (registry row `~:2951`, identity upsert `:3041`, ledger `record_binding` `:3060`) all read that local and must record the FRESH id, otherwise `record_binding` re-mints a Bound row for the stale id right after `retire_missing` and the respawn loop is real.
+
+- [ ] **Step 1: Write the failing integration test**
+
+Add to `crates/freshell-ws/tests/auto_resume_respawn.rs`, cloning the setup of the existing tests in that file (fake state, fake probe injection into `state.session_existence`, temp amplifier home via `FRESHELL_AMPLIFIER_HOME`):
+
+```rust
+#[tokio::test]
+async fn respawn_with_absent_session_spawns_fresh_and_retires_binding() {
+    // Setup: harness state exactly as the sibling respawn test builds it,
+    // with: probe answering Absent for ("amplifier", "stale-amp");
+    // pane ledger holding a Bound row for that ref;
+    // FRESHELL_AMPLIFIER_HOME -> empty temp dir.
+    // Act: respawn_agent_terminal(state, AgentRespawnRequest {
+    //     mode: "amplifier", provider: "amplifier",
+    //     session_id: "stale-amp", create_request_id: <same as sibling>,
+    //     cwd: Some(<tempdir>) }).await
+    // Assert:
+    // 1. respawn returns Ok (the pane survives — fresh spawn, not an error);
+    // 2. ledger row ("amplifier","stale-amp") is Retired/SessionMissing;
+    // 3. NO amplifier stub dir for "stale-amp" was created under the temp
+    //    home (ensure_session must not run for the stale id);
+    // 4. a broadcast terminal.status frame with status "recovering" was sent
+    //    whose reason contains "stale-amp" (subscribe to state.broadcast_tx
+    //    before the call, the way sibling tests capture broadcasts);
+    // 5. the NEW generation's bookkeeping carries the FRESH id, not the stale
+    //    one (V8 §A9 pin): the identity registry entry for the new terminal
+    //    id names the fresh uuid, ledger load_binding("amplifier", <fresh>)
+    //    is Bound, and NO new Bound row exists for "stale-amp" (it stays
+    //    Retired/SessionMissing — record_binding must not resurrect it).
+}
+
+#[tokio::test]
+async fn respawn_with_unknown_existence_resumes_exactly_as_today() {
+    // Probe answers Unknown. Assert the spawned command still carries the
+    // resume id (observe via whatever the sibling test asserts on — spawn
+    // record/ledger/binding), the row stays Bound, and no recovering-with-
+    // stale-id broadcast is emitted.
+}
+```
+
+Write these as REAL tests using the file's existing helpers. Run: `cargo test -p freshell-ws --test auto_resume_respawn` — the two new tests FAIL.
+
+- [ ] **Step 2: Wire the gate into `respawn_agent_terminal`**
+
+Replace the hardcoded assignment at `terminal.rs:2708-2710`:
+
+```rust
+    // Spawn-time resume identity: intent is ALWAYS `Resume` on this path.
+    // Resume validation (docs/plans/2026-07-29-resume-validation.md): the
+    // respawn id comes from the identity registry / pane ledger — cached
+    // state — so it gets the same disk-existence gate as door 1.
+    // CRITICAL: the gate replaces this LOCAL, not merely the launch args —
+    // the post-spawn bookkeeping (registry row ~:2951, identity upsert
+    // :3041, ledger record_binding :3060) all read it and must record the
+    // FRESH id, or the stale id is re-minted as a Bound row right after
+    // retire_missing and the respawn loop is real (V8 §A9).
+    let mut launch_intent = LaunchIntent::Resume;
+    let outcome = {
+        // Probe + by-id locators do real filesystem walks — never inline on
+        // the async runtime (A13); run the sync helper in spawn_blocking.
+        let probe = state.session_existence.clone();
+        let mode = req.mode.clone();
+        let sid = Some(req.session_id.clone());
+        tokio::task::spawn_blocking(move || {
+            crate::resume_validation::validate_wire_resume(
+                &mode,
+                sid,
+                LaunchIntent::Resume,
+                probe.as_ref(),
+            )
+        })
+        .await
+        .expect("resume validation task panicked")
+    };
+    let resume_session_id = outcome.resume_session_id;
+    launch_intent = outcome.launch_intent;
+    if let Some(stale) = outcome.stale_session_id.as_deref() {
+        tracing::warn!(
+            mode = %req.mode,
+            stale_session_id = %stale,
+            "resume validation (respawn): cached session missing on disk; respawning fresh"
+        );
+        let _ = state.pane_ledger.retire_missing(&req.provider, stale);
+        // Headless path: no per-create `out` sink. Broadcast the existing
+        // Recovering status frame (precedent: auto_resume.rs emit_recovering)
+        // with the notice as reason. Reason prose is presentational-only per
+        // the protocol doc; typed fields carry no data change here.
+        let msg = freshell_protocol::ServerMessage::TerminalStatus(freshell_protocol::TerminalStatus {
+            status: freshell_protocol::RuntimeStatus::Recovering,
+            terminal_id: req.create_request_id.clone(),
+            attempt: None,
+            max_attempts: None,
+            exit_code: None,
+            reason: outcome.notice.clone(),
+        });
+        if let Ok(json) = serde_json::to_string(&msg) {
+            let _ = state.broadcast_tx.send(json);
+        }
+    }
+```
+
+Adapt the `TerminalStatus` field spellings/terminal-id source to the exact struct at `server_messages.rs:1102-1117` and to how `respawn_agent_terminal` names the terminal it is respawning (the sibling `emit_recovering` in `auto_resume.rs:604-628` is the template — if the respawned terminal id is available in scope, prefer it over `create_request_id`). Note `claude_fresh_prealloc` is intentionally unused here — for claude the outcome's `Start` intent + fresh id are honored by the same `CliLaunchInputs`, and this headless path has no prealloc bookkeeping to update (verify: the sibling tests + `cargo check` will surface any claude-specific respawn bookkeeping; if some exists, mirror door 1's handling).
+
+Downstream in this function, the amplifier `ensure_session` call (`:2846`) keys off `resume_session_id` — with the gate having replaced the stale id by a fresh UUID, it stubs the FRESH id, which is exactly the fresh-amplifier-pane shape. No further change needed there.
+
+Deliberate decision AD-3 (hub lease under the stale locator — document with a code comment at the wiring site, do NOT change behavior): after a gate-fired respawn, the auto-resume hub's `complete_claim` continues to bind the STALE locator's lease to the fresh terminal (`auto_resume.rs:529-547` → `registry.complete_session_ref_claim`). A later `terminal.create` carrying the stale ref then adopts the fresh terminal via `BoundElsewhere` WITHOUT door 1's notice. This is convergent (no loop, no duplicate pane, the user reaches the fresh terminal); the only cost is a missing notice on a rare second-order path. Accepted — releasing/rebinding the lease would mean new registry API surface for no user-visible gain.
+
+- [ ] **Step 3: Run tests to verify they pass**
+
+Run: `cargo test -p freshell-ws --test auto_resume_respawn`
+Expected: PASS (new + pre-existing tests). Also: `cargo test -p freshell-ws --test auto_resume_e2e`.
+
+- [ ] **Step 4: Refactor + full-crate run**
+
+Run `cargo test -p freshell-ws` and `cargo clippy -p freshell-ws -- -D warnings` — green.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-ws/src/terminal.rs crates/freshell-ws/tests/auto_resume_respawn.rs
+git commit -m "feat(resume-validation): gate headless auto-resume respawn on disk existence"
+```
+
+---
+
+### Task 8: Door 3 — gate the freshagent REST create pipeline
+
+**Files:**
+- Modify: `crates/freshell-freshagent/src/lib.rs` — `FreshAgentState` builders (`:406-475` region, beside `with_opencode_locator` / `with_codex_locator` / `with_session_identity`)
+- Modify: `crates/freshell-freshagent/src/terminal_tabs.rs` — after `derive_resume_identity` (`:491-509`) resolves the resume id and before `CliLaunchInputs` is built for the resolver call at `:1355`; `reconcileNotice` injection at the `pane_content` construction (`:1657` precedent)
+- Modify: `crates/freshell-server/src/main.rs` — wire the three closures when building `FreshAgentState`
+- Test: the existing `#[cfg(test)]` module(s) for `terminal_tabs.rs` (where `requested_resume_session_id_for_mode` / `plausible_resume_session_id` are tested)
+
+**Interfaces:**
+- Consumes: Task 1's `ResumeProbeFn` / `ResumeProbeAnswer` / `evaluate_resume_gate` / `provider_validated` / `stale_resume_notice` (freshell-freshagent depends on freshell-platform and must NOT depend on freshell-ws — its Cargo.toml documents the cycle).
+- Produces:
+  - `FreshAgentState::with_resume_probe(self, probe: freshell_platform::resume_gate::ResumeProbeFn) -> Self` (field `resume_probe: Option<ResumeProbeFn>`, default `None` = feature off = today's behavior)
+  - `FreshAgentState::with_on_stale_resume(self, cb: Arc<dyn Fn(&str, &str) + Send + Sync>) -> Self` — called with `(provider, stale_session_id)` when the gate fires; main.rs implements it as ledger `retire_missing` + `tracing::warn!`
+  - `FreshAgentState::with_sidecar_liveness(self, probe: SidecarLivenessProbe) -> Self` (field `sidecar_liveness: Option<SidecarLivenessProbe>`, default `None` = arm contributes false), where `pub type SidecarLivenessProbe = std::sync::Arc<dyn Fn(&str, &str) -> std::pin::Pin<Box<dyn std::future::Future<Output = bool> + Send>> + Send + Sync>` — `(mode, session_id) -> is that session live inside a fresh-agent sidecar`. Precedent: the existing `TerminalLivenessProbe` (`lib.rs:69`, built as a closure in `main.rs:310-329`, injected at `:330-332`) solves the SAME cross-crate liveness problem in the opposite direction — copy that shape, made async. MUST be a consuming `with_*` builder like the siblings, NOT a `set_*`/`OnceLock` late-bind: `FreshOpencodeState` holds a `FreshAgentState` clone (`opencode_ws.rs:94`, `main.rs:260`), so a late-bound handle back to the sidecars would create a real Arc cycle. The closure lives in `freshell-server/src/main.rs`, so no new crate edge (deps stay freshagent ← ws ← server).
+  - A module-private pure helper in `terminal_tabs.rs`:
+
+```rust
+struct RestResumeOutcome {
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+    stale_session_id: Option<String>,
+    notice: Option<String>,
+}
+
+fn validate_rest_resume(
+    mode: &str,
+    resume_session_id: Option<String>,
+    launch_intent: LaunchIntent,
+    probe: Option<&freshell_platform::resume_gate::ResumeProbeFn>,
+) -> RestResumeOutcome
+```
+
+  Behavior identical to `validate_wire_resume` (Task 6) including the per-provider fresh-fallback shapes (claude → new UUID + `Start`; amplifier → new UUID + `Resume`; codex/opencode → `None`), with one addition: `probe: None` (not wired) → passthrough. The helper stays SYNC; the wiring site runs it inside `tokio::task::spawn_blocking` (A13). Minted UUIDs MUST be RFC-4122 v4 (`Uuid::new_v4()`, the crate's existing mint convention at `terminal_tabs.rs:831`) — `is_canonical_claude_session_id` enforces version `1..=5` + RFC-4122 variant, so a v7 or nil UUID would fail `plausible_resume_session_id` and break the healed identity stamping.
+
+- [ ] **Step 1: Write the failing unit tests**
+
+Add to the existing `#[cfg(test)]` module in `terminal_tabs.rs` (or its test split), with a fake probe fn:
+
+```rust
+    fn probe_answering(
+        existence: freshell_platform::resume_gate::ResumeExistence,
+        ever_on_disk: bool,
+    ) -> freshell_platform::resume_gate::ResumeProbeFn {
+        std::sync::Arc::new(move |_provider: &str, _sid: &str| {
+            freshell_platform::resume_gate::ResumeProbeAnswer {
+                existence,
+                ever_observed_on_disk: ever_on_disk,
+            }
+        })
+    }
+
+    #[test]
+    fn rest_resume_amplifier_absent_mints_fresh_and_notices() {
+        use freshell_platform::resume_gate::ResumeExistence;
+        let probe = probe_answering(ResumeExistence::Absent, true);
+        let out = validate_rest_resume(
+            "amplifier",
+            Some("stale-amp".into()),
+            LaunchIntent::Resume,
+            Some(&probe),
+        );
+        assert_ne!(out.resume_session_id.as_deref(), Some("stale-amp"));
+        assert!(out.resume_session_id.is_some());
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-amp"));
+        assert!(out.notice.as_deref().unwrap().contains("stale-amp"));
+    }
+
+    #[test]
+    fn rest_resume_without_probe_is_passthrough() {
+        let out = validate_rest_resume(
+            "amplifier",
+            Some("anything".into()),
+            LaunchIntent::Resume,
+            None,
+        );
+        assert_eq!(out.resume_session_id.as_deref(), Some("anything"));
+        assert!(out.stale_session_id.is_none());
+        assert!(out.notice.is_none());
+    }
+
+    #[test]
+    fn rest_resume_unknown_and_present_fail_open() {
+        use freshell_platform::resume_gate::ResumeExistence;
+        for e in [ResumeExistence::Unknown, ResumeExistence::Present] {
+            let probe = probe_answering(e, false);
+            let out = validate_rest_resume(
+                "opencode",
+                Some("ses_x".into()),
+                LaunchIntent::Resume,
+                Some(&probe),
+            );
+            assert_eq!(out.resume_session_id.as_deref(), Some("ses_x"));
+            assert!(out.notice.is_none());
+        }
+    }
+
+    #[test]
+    fn rest_resume_codex_absent_drops_resume() {
+        use freshell_platform::resume_gate::ResumeExistence;
+        let probe = probe_answering(ResumeExistence::Absent, true);
+        let out = validate_rest_resume(
+            "codex",
+            Some("stale-cx".into()),
+            LaunchIntent::Resume,
+            Some(&probe),
+        );
+        assert!(out.resume_session_id.is_none());
+        assert_eq!(out.stale_session_id.as_deref(), Some("stale-cx"));
+    }
+
+    #[test]
+    fn rest_resume_minted_claude_id_is_v4_and_plausible() {
+        // Pins the Uuid::new_v4() requirement (V9): is_canonical_claude_
+        // session_id enforces version 1..=5 + RFC-4122 variant — v7/nil
+        // would fail and the healed pane_content stamping would silently
+        // fall through.
+        use freshell_platform::resume_gate::ResumeExistence;
+        let probe = probe_answering(ResumeExistence::Absent, true);
+        let out = validate_rest_resume(
+            "claude",
+            Some("stale-cl".into()),
+            LaunchIntent::Resume,
+            Some(&probe),
+        );
+        assert_eq!(out.launch_intent, LaunchIntent::Start);
+        let minted = out.resume_session_id.expect("fresh claude id minted");
+        assert!(plausible_resume_session_id("claude", &minted));
+    }
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test -p freshell-freshagent rest_resume`
+Expected: FAIL to compile — `validate_rest_resume` not defined.
+
+- [ ] **Step 3: Implement helper + wiring**
+
+Implement `validate_rest_resume` (same body shape as `validate_wire_resume`, using `ResumeProbeFn` instead of the trait; `None` probe → passthrough; reuse `evaluate_resume_gate`, `provider_validated`, `stale_resume_notice` from freshell-platform; mint UUIDs via the crate's existing uuid dependency — check `Cargo.toml`, add `uuid` with `v4` feature if absent, matching the workspace version).
+
+Wire it in the create pipeline — numbered, all steps MANDATORY:
+
+1. **Gate call** (inside `spawn_blocking` — A13): immediately after the resume id is derived (`derive_resume_identity`, before the amplifier ensure at `:895` and the `CliLaunchInputs` construction feeding `:1355`), and guarded by a MANDATORY in-gate liveness precondition. Ordering note (load-bearing — the A11 door-1 hazard with the constraint INVERTED): in THIS pipeline the amplifier ensure (`:895`) comes BEFORE the REST D7 live-session guard (`:968-988`) and the D8 session-ref lease (`:990-1040`), so door 3 cannot get liveness protection by after-D7 placement the way door 1 did — the gate must sit before `:895` (or the `ensure_session` re-stub resurrects the stale dir), yet placed there a gate fire would clear `accepted_session_ref` / replace `resume_session_id` and FALSIFY the D7-REST applicability filter (`:968-971`): its loud `RESTORE_UNAVAILABLE`/CONFLICT reject and the D8 lease would be silently bypassed, and `on_stale_resume` → `retire_missing` would destroy the Bound ledger row of a RUNNING session. This is reachable — a live zero-turn codex session genuinely has no rollout on disk (`crates/freshell-server/src/existence.rs:224-227`). Therefore: when the candidate session is LIVE, skip the gate entirely (byte-for-byte today's behavior), letting the unchanged create flow onward — for registry-live sessions the D7-REST guard then issues its loud reject exactly as today; for sidecar-live sessions the create proceeds unchanged exactly as today. LIVENESS IS A TWO-ARM JOIN, BOTH ARMS MANDATORY — the REST D7 guard's own consult alone is NOT sufficient: (arm 1, registry) the SAME consult the guard at `:968-988` performs — `registry.live_session_owner(state.session_identity.as_deref(), &mode, sid).is_some()` — hoist it into a shared helper or call it ahead of the gate; do NOT reimplement it. (arm 2, sidecar) that consult is `TerminalRegistry`/PTY-scoped and structurally BLIND to sessions live inside the fresh-agent sidecars (sidecars never get PTY rows; `register_headless` is test-only) — yet the reachable hazard above is exactly a sidecar-live case: a codex session live in the `FreshCodexState` sidecar (e.g. after "Reopen as freshcodex" of a previously terminal-bound session) still has a Bound ledger row and, at zero turns, no rollout on disk. So the precondition MUST also consult the new injected async `state.sidecar_liveness` probe (Interfaces above; main.rs wiring below), `.await`ed in the pipeline body — `spawn_terminal_pane` is already async — never inside the `spawn_blocking` closure or a sync closure:
+
+```rust
+    // In-gate liveness precondition (MANDATORY — see ordering note above):
+    // a LIVE session must never be gated. TWO ARMS, both load-bearing:
+    // the registry arm reuses the REST D7 guard's own consult (:968-988,
+    // which owns the loud reject for registry-live sessions downstream);
+    // the sidecar arm exists because that consult is PTY-scoped and blind
+    // to sessions live inside the fresh-agent sidecars — the very
+    // live-zero-turn-with-no-rollout-on-disk case. Dropping either arm
+    // silently un-protects a class of live sessions (step 4's live-session
+    // tests pin BOTH arms).
+    let candidate_is_live = match resume_session_id.as_deref() {
+        None => false,
+        Some(sid) => {
+            // Arm 1 (registry): the SAME consult the REST D7 guard at
+            // :968-988 performs — shared/hoisted, not reimplemented.
+            let registry_live = registry
+                .live_session_owner(state.session_identity.as_deref(), &mode, sid)
+                .is_some();
+            // Arm 2 (sidecar): the injected async probe. None (not wired,
+            // e.g. bare unit-test states) => arm contributes false.
+            let sidecar_live = if registry_live {
+                true // short-circuit: already live
+            } else {
+                match &state.sidecar_liveness {
+                    Some(probe) => probe(&mode, sid).await,
+                    None => false,
+                }
+            };
+            registry_live || sidecar_live
+        }
+    };
+    // Probe does real filesystem walks — never inline on the async runtime
+    // (A13); run the sync helper in spawn_blocking. A LIVE candidate skips
+    // the gate entirely (passthrough — same shape validate_rest_resume
+    // returns for Proceed), so the unchanged create flows into the D7-REST
+    // guard and D8 lease exactly as today.
+    let rest_outcome = if candidate_is_live {
+        passthrough(resume_session_id.take(), launch_intent)
+    } else {
+        let probe = state.resume_probe.clone();
+        let mode_for_gate = mode.clone();
+        let rid = resume_session_id.take();
+        let intent = launch_intent;
+        tokio::task::spawn_blocking(move || {
+            validate_rest_resume(&mode_for_gate, rid, intent, probe.as_ref())
+        })
+        .await
+        .expect("resume validation task panicked")
+    };
+    let resume_session_id = rest_outcome.resume_session_id;
+    let launch_intent = rest_outcome.launch_intent;
+    if let Some(stale) = rest_outcome.stale_session_id.as_deref() {
+        // MANDATORY stale-ref guard (V7 row 10): the pane_content identity
+        // stamping PREFERS accepted_session_ref (terminal_tabs.rs:1683-1685)
+        // — left in place, the STALE wire ref would be stamped into the new
+        // tab's pane_content, poisoning client persistence + tabs-sync
+        // replay and re-firing the gate every restart. Clearing it makes
+        // stamping fall through to the minted-ref branch (:1686-1692), so
+        // gate-fired claude/amplifier panes are born with the HEALED ref and
+        // codex/opencode panes with no ref.
+        accepted_session_ref = None;
+        if let Some(cb) = &state.on_stale_resume {
+            cb(&mode, stale);
+        }
+    }
+```
+
+(Adapt local variable names/mutability to the surrounding pipeline code — in particular the `resume_session_id`/`launch_intent` rebinding must flow out of the `if candidate_is_live { .. } else { .. }` expression, not shadow inside a block; the amplifier ensure at `:895` then keys off the fresh id, mirroring door 1. `registry` is the same `state.terminal_registry` handle the REST D7 guard itself uses (`:729`). `passthrough(..)` is the same Proceed-shape constructor `validate_rest_resume` itself uses — expose/reuse it rather than hand-building the outcome.)
+
+2. **Thread the intent**: the pipeline today HARDCODES `launch_intent: LaunchIntent::Resume` in the `CliLaunchInputs` construction (`~:1335`) — Task 8 must thread `rest_outcome.launch_intent` into the inputs explicitly so the claude fallback's `Start` reaches the resolver. Verified safe (V9): the REST pipeline consumes the SAME Arc'd `cli_commands` the WS door uses (`main.rs:363/:409/:632`), the claude spec has `createSessionArgs` (`extensions/claude-code/freshell.json:11`), so `Start` + minted id resolves — no `StartIntentUnsupported`.
+
+3. **Notice injection**: where the handler builds the response `pane_content` (the `reconcileNotice` injection precedent at `:1657`), when `rest_outcome.notice` is `Some`, insert it as `"reconcileNotice"` in the `pane_content` JSON so the existing client chip/xterm rendering shows it. (Caveat, accepted: a hidden/background tab defers the render until a later visible attach pass — the notice is preserved in pane content, never dropped.)
+
+4. **Tests for 1+3**: add/extend unit tests in the same module asserting that when the gate fires, the built `pane_content` (a) carries the notice, and (b) carries the HEALED ref — `pane_content.sessionRef.sessionId` equals the minted fresh id, NOT the stale wire ref (pin the fall-through to the `:1686-1692` minted-ref branch). Clone the existing `:1657`-area test if one exists, otherwise assert on the handler's pane-content builder function directly. ADDITIONALLY (pins the MANDATORY liveness precondition of step 1): a live-session case — clone the setup of the existing tests that pin the REST D7 guard's `RESTORE_UNAVAILABLE`/CONFLICT reject at `:968-988` (same fake liveness state), inject a probe answering `Absent` for that same live ref, and drive the create pipeline. Assert: (a) the response is the D7-REST loud reject, NOT a gate-fired fresh spawn; (b) `state.on_stale_resume` was NEVER invoked (install a counting fake — the Bound ledger row of the running session must survive); (c) no notice was injected. This test fails RED if the gate runs before the liveness check or the precondition is dropped. AND a sidecar-live case (pins the ASYNC sidecar arm — mirrors Task 6 case 6; the registry-live case above stays GREEN if the sidecar arm is dropped, so it cannot pin this): registry/identity hold NO running owner for `("codex", "stale-cx")`; inject a fake `sidecar_liveness` probe via `with_sidecar_liveness` (a closure returning `Box::pin(async move { ... })` answering `true` only for `("codex", "stale-cx")` — a fake, not a real sidecar); existence probe answers `Absent` for the same ref; ledger holds a `Bound` row; drive the create pipeline with that resume id. Assert: (a) the create proceeds UNCHANGED — the resume id reaching `CliLaunchInputs` is still `stale-cx` (NOT a gate-fired fresh spawn; and NOT a D7-REST reject, since the registry has no row — today's behavior for a sidecar-live resume); (b) `state.on_stale_resume` was NEVER invoked (counting fake — the Bound row of the sidecar-live session must survive); (c) no notice was injected. This test fails RED if the sidecar arm is dropped or the join is reduced to the registry consult alone.
+
+Add the `FreshAgentState` fields + builders in `lib.rs` — `resume_probe`, `on_stale_resume`, AND `sidecar_liveness` (type + Arc-cycle warning per Interfaces above; copy the `with_opencode_locator` builder shape exactly).
+
+In `crates/freshell-server/src/main.rs`, the probe and the ledger do NOT exist where `FreshAgentState` is first built — the last builder chain today ends at `:408-411`, but `pane_ledger` is only constructed at `:527`, and the existence probe is built INLINE and UNNAMED inside the `WsState` struct literal's `session_existence:` field initializer (`:559-610`, a `match &session_index` with an `IndexExistenceProbe` arm and a no-index fallback arm). So the wiring takes two mechanical moves plus ONE new (final) builder rebinding at a later site:
+
+1. **Hoist the probe into a named binding (pure hoist, both arms byte-identical).** Cut the entire `match &session_index { ... }` initializer out of the `WsState` literal's `session_existence:` field and bind it immediately ABOVE the literal as `let session_existence: <the exact declared type of the WsState.session_existence field> = match &session_index { ... };`, then put `session_existence.clone()` back in the struct literal field.
+
+2. **Add one more consuming rebinding** between `pane_ledger`'s construction (`:527`) / the hoisted `session_existence` binding and the `WsState` literal that consumes them — this becomes the LAST `with_*` rebinding, so update the "last builder" comment at `:486-489` to point here:
+
+```rust
+    // Resume-validation wiring. Deliberately the LAST rebinding: it needs
+    // pane_ledger (:527) and the hoisted session_existence probe, which do
+    // not exist at the earlier builder chains. Sound because every door-3
+    // consumer clones fresh_agent_state AFTER this point (the freshagent
+    // REST router at :1017, SnapshotState::new at :956); the one EARLIER
+    // capture — FreshOpencodeState::new(fresh_agent_state.clone()) at :260,
+    // held by value (opencode_ws.rs:94) — already predates every
+    // door-3-relevant builder (with_cli_commands lands at :408-411) by
+    // existing design and never runs the REST create pipeline. The
+    // set_spawn_gate/set_identity_sink calls at :494/:542 are unaffected:
+    // Arc<OnceLock> cells initialized in new(), shared by every clone
+    // including this rebound value.
+    let fresh_agent_state = fresh_agent_state
+        .with_resume_probe({
+            let probe = session_existence.clone(); // the hoisted Arc'd probe from step 1
+            std::sync::Arc::new(move |provider: &str, session_id: &str| {
+                use freshell_platform::resume_gate::{ResumeExistence, ResumeProbeAnswer};
+                use freshell_ws::existence::{SessionExistence, SessionExistenceProbe};
+                let existence = match probe.exists(provider, session_id) {
+                    SessionExistence::Present => ResumeExistence::Present,
+                    SessionExistence::Absent => ResumeExistence::Absent,
+                    SessionExistence::Unknown | SessionExistence::ProviderUnavailable => {
+                        ResumeExistence::Unknown
+                    }
+                };
+                ResumeProbeAnswer {
+                    existence,
+                    ever_observed_on_disk: probe.ever_observed_on_disk(provider, session_id),
+                }
+            })
+        })
+        .with_on_stale_resume({
+            let ledger = pane_ledger.clone(); // the Arc<PaneLedger> built earlier
+            std::sync::Arc::new(move |provider: &str, stale_id: &str| {
+                tracing::warn!(
+                    provider = %provider,
+                    stale_session_id = %stale_id,
+                    "resume validation (REST): cached session missing on disk; spawning fresh"
+                );
+                let _ = ledger.retire_missing(provider, stale_id);
+            })
+        })
+        .with_sidecar_liveness({
+            // MANDATORY (arm 2 of the door-3 liveness precondition): the
+            // SAME sidecar instances the WS door's D7 join consults — built
+            // at :221/:231/:259, frozen at :333-335, shared with WsState at
+            // :624-626. All three bindings long predate this late wiring
+            // site, so clones are in scope here.
+            let claude = fresh_claude_state.clone();
+            let codex = fresh_codex_state.clone();
+            let opencode = fresh_opencode_state.clone();
+            std::sync::Arc::new(move |mode: &str, session_id: &str| {
+                let claude = claude.clone();
+                let codex = codex.clone();
+                let opencode = opencode.clone();
+                let mode = mode.to_string();
+                let sid = session_id.to_string();
+                Box::pin(async move {
+                    match mode.as_str() {
+                        "claude" => claude.has_live_session(&sid).await,
+                        "codex" => codex.has_live_session(&sid).await,
+                        "opencode" => opencode.has_live_session(&sid).await,
+                        _ => false,
+                    }
+                })
+                    as std::pin::Pin<Box<dyn std::future::Future<Output = bool> + Send>>
+            })
+        });
+```
+
+(All `main.rs` line anchors above are PRE-CHANGE positions — re-locate them in the file as found (the hoist in step 1 shifts everything below it). Adapt the sidecar-state binding names to what `main.rs` actually calls the three Arcs, and adapt the mode→sidecar mapping to mirror the WS door's D7 sidecar arm (`crates/freshell-ws/src/terminal.rs:1748-1752`) — the same modes must consult the same sidecars, unknown modes contribute false.)
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p freshell-freshagent && cargo test -p freshell-server && cargo clippy -p freshell-freshagent -p freshell-server -- -D warnings`
+Expected: PASS, clean.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-freshagent/src/lib.rs crates/freshell-freshagent/src/terminal_tabs.rs crates/freshell-server/src/main.rs
+git commit -m "feat(resume-validation): gate freshagent REST create pipeline on disk existence"
+```
+
+---
+
+### Task 9: Deviation ledger entry + full verification sweep
+
+**Files:**
+- Modify: `port/oracle/DEVIATIONS.md` (follow the file's existing entry format)
+- No other code changes — this task is documentation + verification.
+
+**Interfaces:**
+- Consumes: everything above.
+- Produces: the deviation record `port/AGENTS.md` mandates for deliberate behavior changes vs the Node original, citing the pinning tests.
+
+- [ ] **Step 1: Write the DEVIATIONS.md entry**
+
+Append an entry in the file's existing format with this content (adapt heading/ID style to the neighboring entries):
+
+```markdown
+## Resume validation at the spawn doors (2026-07-29)
+
+**Deviation:** The Node reference passes cached resume session ids straight to
+the coding CLI (`server/terminal-registry.ts` `resolveCodingCliCommand`;
+`normalizeResumeForSpawn` is the identity function — no on-disk existence
+check exists in Node). The Rust server now validates the id against the
+provider's on-disk session store before constructing resume argv, at all three
+spawn doors (WS `terminal.create`, headless auto-resume respawn, freshagent
+REST create). On POSITIVE absence (store readable, session definitively
+absent) it spawns fresh in the same cwd/mode, surfaces an operator notice
+naming the stale id, and retires the pane-ledger binding
+(`RetiredReason::SessionMissing`). Unknown/unreadable stores fail OPEN
+(resume attempted, byte-for-byte Node behavior). Providers validated:
+claude — for SAME-BOOT deletions only (a zero-turn carve-out keeps
+Absent + never-observed-on-disk resuming, and the disk-observation signal
+is a per-boot in-memory set, so a transcript deleted while the server was
+DOWN is indistinguishable from never-conversed and fails OPEN post-restart;
+deliberate, fail-open) — codex, opencode, amplifier. gemini/kimi/third-party
+are never blocked. Known accepted consequence for amplifier (AD-5 in the
+plan): freshell's designed never-used-stub GC deletes a never-typed pane's
+session stub at terminal exit and the spawn doors re-stub the SAME id via
+`ensure_session` on the next resume — after a restart such a pane now spawns
+fresh under a minted id WITH a notice instead of silently re-stubbing the
+same id. Decided and accepted: on disk the GC'd stub is indistinguishable
+from the incident's stale id, and for a never-typed pane the outcome is an
+equivalent empty session either way (reconcile's amplifier Absent carve-out,
+which prevents PARKING such panes in the dead-sessions dialog, is untouched).
+Additive protocol field: optional `notice` on `terminal.created`.
+
+**Why:** Production incident 2026-07-29 — after a server restart, freshell
+resumed stored amplifier session id 8dab420a-f76b-407c-bcbe-dfb2a971c2e1 which
+existed nowhere under ~/.amplifier/projects/*/sessions/; the amplifier CLI
+silently created a new empty session under that id and the user saw a broken
+restore with no explanation.
+
+**Pinning tests:** `freshell-platform` `resume_gate` unit tests;
+`freshell-ws/tests/resume_validation_gate.rs` (incl. the live-session/D7
+ordering and legacy-carrier liveness cases — registry AND sidecar arms);
+`freshell-ws/tests/auto_resume_respawn.rs`
+(`respawn_with_absent_session_spawns_fresh_and_retires_binding`, incl. the
+fresh-id bookkeeping assertions);
+`freshell-freshagent` `rest_resume_*` unit tests (incl. minted-v4
+plausibility, healed pane_content stamping, and the live-session
+precondition cases — registry arm with D7-REST-reject preservation AND
+the sidecar-liveness arm);
+`freshell-server` `existence.rs` amplifier/codex by-id fallback,
+cold-index, and sub-root permission tests;
+`freshell-protocol/tests/roundtrip.rs` `notice` wire test.
+```
+
+- [ ] **Step 2: Full Rust verification**
+
+Run (long, use a generous timeout):
+```bash
+cargo fmt --all -- --check
+cargo clippy -p freshell-platform -p freshell-sessions -p freshell-server -p freshell-ws -p freshell-freshagent -p freshell-protocol -- -D warnings
+cargo test -p freshell-platform -p freshell-sessions -p freshell-protocol
+cargo test -p freshell-server -p freshell-ws -p freshell-freshagent
+```
+Expected: all green. Fix anything that isn't before proceeding (no known Rust flakes in these crates).
+
+- [ ] **Step 3: Client verification (coordinator-gated)**
+
+Run: `npm run test:unit`
+Expected: green EXCEPT the known pre-existing `terminal-font-settings.test.tsx` failure from main — if it appears, note it in the commit body and do not chase it. If the coordinator gate is held by another agent, wait (never kill a foreign holder); set `FRESHELL_TEST_SUMMARY="resume-validation final verification"` for holder visibility.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add port/oracle/DEVIATIONS.md
+git commit -m "docs(resume-validation): deviation ledger entry for spawn-door resume validation"
+```
+
+- [ ] **Step 5: Final state check**
+
+`git status` — working tree clean; branch `feat/resume-validation` contains Tasks 1–9 commits. STOP HERE: no PR, no merge, no server restart/deploy.
+
+---
+
+## Self-Review Record
+
+*(Re-run 2026-07-29 after incorporating the load-bearing-assumption validation findings — 9 validators, ledger in `.worktrees/.the-usual-logs/resume-validation/`.)*
+
+**1. Spec coverage:**
+- "Validate before constructing the resume command" → Tasks 6 (WS create/restore), 7 (auto-resume respawn), 8 (REST create) — all three call sites of `resolve_coding_cli_command` are gated, and the gate now fires even against a COLD index for amplifier/claude (Task 3 cold coverage — the incident scenario is a cold-index race). ✅
+- "If validation fails: don't pass the resume flag; spawn fresh in same cwd/mode" → fallback shapes in `validate_wire_resume`/`validate_rest_resume` mirror each mode's genuine fresh-pane spawn; cwd/mode inputs are untouched; door 3 threads the claude `Start` intent explicitly past the `~:1335` hardcode (Task 8 step 2, V9-verified). ✅
+- "Operator-visible notice naming the stale id" → Task 5 (`notice` on `terminal.created` + xterm rendering, door 1), Task 8 (`reconcileNotice` in `pane_content`, door 3); door 2 broadcasts `terminal.status{Recovering, reason}` + warn-log — documented as the best available channel on a headless path (deliberate, stated in Design Notes). AD-3 residual (missing notice on the rare stale-ref-adopts-fresh-terminal path) is recorded in Task 7. ✅
+- "Clear/mark the stale cached id so it isn't retried forever" → four cooperating mechanisms, all required with tests: Task 4 `retire_missing` (all doors) + `terminal.created.sessionRef` overwrite (claude/amplifier, existing client fold, V5-verified) + Task 5 notice-triggered clear of persisted `sessionRef`/`resumeSessionId` (codex/opencode) + Task 8's mandatory `accepted_session_ref` guard (door 3). ✅
+- "Fail open on Unknown/unreadable" — invariant now STRONGER than the original plan: gate policy (Task 1) + errors-seen accumulator locator contracts (Tasks 2–3: ANY per-entry error with no hit ⇒ `Unreadable` ⇒ `Unknown` ⇒ Proceed; never `.is_dir()`/`fs::metadata(root)` adjudication) + AD-1 root semantics (NotFound-with-readable-parent ⇒ Absent, root ERROR ⇒ Unreadable) + in-gate liveness precondition and after-D7 ordering at door 1, and the MANDATORY two-arm in-gate liveness precondition at door 3 (whose pipeline puts the amplifier ensure `:895` BEFORE the REST D7 guard `:968-988`, so ordering alone cannot protect it — Task 8 step 1 ordering note; and whose registry consult is PTY-scoped, so a NEW injected `sidecar_liveness` probe covers sidecar-live sessions the REST D7 guard is blind to) — a LIVE session (registry- OR sidecar-live) can never be gated or have its Bound row retired at any door + explicit fail-open tests at every layer incl. sub-root permission fixtures (euid-guarded). ✅
+- "Amplifier MUST be covered; store = ~/.amplifier/projects/<slug>/sessions/<id>/; search all projects (documented)" → Tasks 2–3 + Global Constraints; covered even before index warm-up (cold-coverage matrix in Design Notes). ✅
+- "Cover providers freshell already reads; fail open for others" → claude (same-boot deletions only — AD-2, honestly scoped in Design Notes + DEVIATIONS)/codex/opencode/amplifier validated; codex/opencode additionally fail open in the first seconds after boot (AD-4, accepted residual); amplifier's never-used-stub GC collision is DECIDED and documented, not defaulted into (AD-5 — gate deliberately fires on the GC'd-stub shape; pinned by Task 1's amplifier test + Task 6 case 1; DEVIATIONS names the consequence); gemini/kimi/third-party never blocked (tested). ✅
+- "Rust server REQUIRED; Node only if cheap — if skipped, say so" → Node explicitly skipped with reasons (Global Constraints); Task 5's mirror provably touches zero `server/` files (precedent commits `5c591843`/`a18dd4c6`). ✅
+- "Non-goals respected" → no amplifier-CLI changes; no indexing subsystem changes beyond the by-id fallbacks + the cold-branch consult the validation needs; protocol change limited to one additive optional field, mirrored via `shared/ws-protocol.ts` + regenerated contract schema (never hand-edited). ✅
+- "TDD, unit + e2e, coordinated test commands, worktree, no PR/deploy, known flaky test" → per-task RGR steps + Task 9 sweep + Global Constraints. ✅
+- Runtime discipline: no door blocks the async runtime — all probe/locator IO runs in `tokio::task::spawn_blocking` (one consistent shape: sync helpers, doors wrap; Tasks 6/7/8), and the expensive codex walk is confined to warm-Absent adjudication (A13/AD-4). ✅
+
+**1b. No silent deferrals:** The production outcome that proves the feature: `resume_validation_gate.rs` case 1 drives the REAL `handle_create` restore path with a stale amplifier ref against a real (temp) amplifier store and asserts fresh spawn + notice + retired binding — no stub stands in for required behavior in production code paths. Behaviors the validation pass surfaced are now REQUIRED with pinning tests, not deferred: the codex/opencode notice-triggered client clear (Task 5 test), the door-3 `accepted_session_ref` guard + healed-ref stamping (Task 8 step 4 tests), the door-2 fresh-id bookkeeping (Task 7 assertion 5), the after-D7 ordering + in-gate liveness incl. its async sidecar arm (Task 6 cases 4–6), the door-3 two-arm liveness precondition — registry arm with D7-REST-reject preservation AND the sidecar arm via the injected `sidecar_liveness` probe (Task 8 step 4 live-session tests) — and the minted-v4 plausibility pin (Task 8). The only accepted residuals are recorded decisions with rationale (AD-1…AD-5), not silent gaps. Test doubles used (fake `SessionExistenceProbe`/`ResumeProbeFn` in unit tests) are replaced in production by `IndexExistenceProbe`, whose by-id fallback, cold-index, and error-contract behavior is tested against real temp stores in Task 3; the `main.rs` wiring is exercised by `cargo test -p freshell-server` compile + probe tests and reviewed in Tasks 3/8. NO UNRESOLVED COVERAGE GAPS.
+
+**2. Placeholder scan:** Steps that intentionally clone an existing harness (Task 3 fallback/cold/permission tests, Task 6/7 integration tests, Task 5 client tests, Task 4 ledger tests) each name the exact sibling file/test whose scaffolding to copy and spell out the complete required assertions — the behavior contract is fully specified; only mechanical harness reuse is deferred to the named files. The Task 3 `codex_rollout_on_disk` snippet leaves ONE named private helper to mechanical implementation (the tri-state first-line ownership read) with its full contract spelled inline (valid-read-mismatch ⇒ non-owner; open/read/decode failure incl. `.jsonl.zst` ⇒ error). Task 6's liveness precondition explicitly copies D7's existing join (`:1747-1758`) — in an async-capable `let` shape, both arms — rather than leaving it open; Task 8's liveness precondition likewise spells out both arms rather than leaving either open — the registry arm reuses the REST D7 guard's own consult (`:968-988`, shared/hoisted, not reimplemented), and the sidecar arm is a fully-typed injected probe (`SidecarLivenessProbe` + `with_sidecar_liveness`, with its `main.rs` closure spelled inline) because the REST guard's consult is PTY-scoped and blind to sidecar-live sessions. No TBD/TODO/"handle edge cases" remain.
+
+**3. Type consistency check:** `ResumeExistence{Present,Absent,Unknown}` and `ResumeGateDecision{Proceed,SpawnFresh}` (Task 1) used identically in Tasks 6–8 — mapping unchanged by the validation edits; `ResumeProbeAnswer{existence, ever_observed_on_disk}`/`ResumeProbeFn` (Task 1) match Task 8's fake and main.rs closure; `AmplifierSessionAnswer{Present,Absent,Unreadable}` (Task 2, errors-seen accumulator) matches Task 3's `amplifier_dir_locator` mapping AND the cold-branch consult; `ByIdAnswer{Present,Absent,Unreadable}` (Task 3) is the single answer contract for both locators, with identical Unreadable⇒Unknown mapping at the warm-Absent adjudication and the cold branch; `retire_missing(&self, provider: &str, session_id: &str) -> bool` (Task 4) matches every call site in Tasks 6–8; `validate_wire_resume(mode, Option<String>, LaunchIntent, &dyn SessionExistenceProbe) -> ResumeValidationOutcome` stays SYNC and matches Task 7's call — both doors wrap it in `spawn_blocking` with an `Arc<dyn SessionExistenceProbe>` clone, and Task 8's sync `validate_rest_resume` is wrapped identically at its wiring site (one consistent async shape across all three doors; unit tests for all helpers stay synchronous); `notice: Option<String>` field name consistent across Tasks 5 and 6, and Task 5's client clear keys on the same field; `SidecarLivenessProbe` (`Arc<dyn Fn(&str, &str) -> Pin<Box<dyn Future<Output = bool> + Send>> + Send + Sync>`, Task 8) matches its `main.rs` closure and the step-4 fake, and is `.await`ed only in the async pipeline body (never inside `spawn_blocking`). ✅
diff --git a/docs/plans/2026-07-30-resume-validation-rebase-pr589.md b/docs/plans/2026-07-30-resume-validation-rebase-pr589.md
new file mode 100644
index 000000000..5320b54f3
--- /dev/null
+++ b/docs/plans/2026-07-30-resume-validation-rebase-pr589.md
@@ -0,0 +1,1318 @@
+# Resume-Validation Rebase onto Main @ 2641ada38 (#589 Reconciliation) Implementation Plan
+
+> **For agentic workers:** This plan is executed task-by-task by the
+> workflow's execute stage: a fresh implementer per task, with a spec +
+> quality review after each task. Steps use checkbox (`- [ ]`) syntax
+> for tracking.
+
+**Goal:** Rebase the already-built, twice-reviewed branch `feat/resume-validation`
+(28 commits atop `39010cb57`, tip `8b0f08162` — the count includes the docs-only
+plan commit) onto current main (`2641ada38`, which merged PR #589
+"graceful-restore-resume-s1"), resolving the one semantic conflict by carrying
+`resume_id_from_wire` through main's new `LaunchPrep` struct (locked Option A),
+restoring the gate-before-plan invariant against #589's off-permit codex planning,
+and leaving the branch fully verified — no merge, no PR, no push, no deploy.
+
+**Architecture:** This is a REBASE-RECONCILIATION pass, not a new feature. PR #589
+extracted `derive_launch_prep()` from `handle_create` (producing a `LaunchPrep`
+struct: `launch_intent` / `resume_session_id` / `claude_fresh_prealloc`) and moved
+codex restore-class launch planning BEFORE the spawn-gate permit. The branch's gate
+commit `1ed94741d` computes those same values inline plus a boolean
+`resume_id_from_wire` — hence one conflicted file (`crates/freshell-ws/src/terminal.rs`,
+one hunk). The work is: (1) replay the 28 branch commits, resolving the conflict by
+extending `LaunchPrep`/`derive_launch_prep` with a 4th field `resume_id_from_wire`
+(set in exactly one place — the wire-derivation `else` arm), (2) first-ever direct
+unit tests on `derive_launch_prep` pinning the new field's origin semantics,
+(3) a gate-level pin that server-allocated (prealloc'd) ids are NEVER gated,
+(4) a reconciliation commit that runs the codex-mode wire-resume gate OFF-permit
+inside `prepare_launch`, BEFORE `plan_codex_managed_launch` — final ordering for
+codex restore-class creates: **gate → plan (off-permit) → permit → spawn** —
+(5) docs-ledger truth-up, (6) full verification.
+
+**Tech Stack:** Rust workspace (tokio, axum; CI: `cargo fmt --all --check`,
+`cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace`).
+React/TypeScript client exists but #589 is Rust-only — client files should be
+untouched by this rebase.
+
+## Global Constraints
+
+- Work ONLY in the existing worktree `/home/dan/code/freshell/.worktrees/resume-validation` on branch `feat/resume-validation`. Do NOT create a new worktree. (A safety backup **branch ref** is allowed and required in Task 1.)
+- Rebase target is pinned to commit `2641ada382472586ce1aa7664331d384853e867d`. If `origin/main` has moved past it, still rebase onto the pinned hash and note the discrepancy in the final report — the resolution direction was locked against this exact main.
+- Do NOT push, do NOT open a PR, do NOT merge — the orchestrator lands the branch afterward.
+- Do NOT touch the live Rust server on port 3002 (never restart/stop it; `cargo build`/`cargo test` are safe and never touch it). Never use broad kill patterns (`pkill -f …`).
+- Commit author must be `Dan Shapiro <3732858+danshapiro@users.noreply.github.com>` (repo/global git config already provides this — never override it, never use `dan@danshapiro.com` as a git identity). Conventional Commits with scope (`fix(ws):`, `test(ws):`, `docs:`).
+- Broad JS/Vitest runs go through the shared coordinator gate (`npm run check` / `npm run test:unit` with `FRESHELL_TEST_SUMMARY="<why>"` set; check `npm run test:status` first; never kill a foreign gate holder; never raw `npx vitest` for broad runs). Expected to be UNNEEDED here: the rebase must not touch client files (Task 7 verifies and gates this).
+- `cargo test --workspace` is LONG — always run with a generous timeout (≥ 1800 s), never a 30 s default.
+- Host-gated `#[ignore]` e2e tests mutate process env — run them alone: `-- --ignored --test-threads=1`.
+- Several Rust e2e tests exec node fixtures that need repo `node_modules` (`tsx` for three MCP tests in the workspace suite; `ws` for the codex fake app-server used by the ignored gate tests). Missing `node_modules` produces FALSE failures (e.g. `PTY_SPAWN_FAILED: codex app-server exited before listening`). Before any test step: `test -d node_modules || npm ci` (build tooling only — no coordinator gate needed).
+- The `restore_storm` pins are LOAD-SENSITIVE on this host (validated: 0–2/5 fail with 62–70 s timeouts at 32-core load ~28; 5/5 in ~2 s at load ~11, identical commit). Before attributing a storm-pin failure to your changes: check `uptime`, re-run when load is low, and if still failing run the same pins on pristine main `2641ada38` back-to-back (e.g. in a detached temp clone) for a same-conditions baseline.
+- Known pre-existing unrelated failure on main: `test/e2e/terminal-font-settings.test.tsx` — if it ever shows up in a JS run, note it and move on; do not chase. (It is not run by `npm run test:unit`.)
+- Respect other agents' concurrent activity: Task 1 verifies the worktree is clean and no rebase is in progress before starting; if it is dirty or mid-rebase, HALT and report instead of clobbering.
+- Locked resolution direction (Option A): `resume_id_from_wire` is derived in `derive_launch_prep` as a `LaunchPrep` field. Do NOT re-compute it after extraction (divergence risk); do NOT infer it from surrounding context (fragile).
+
+## Invariants (verified by tests in Tasks 2–7)
+
+- **Branch:** gate-before-plan (a definitively-absent stale id is gated — fresh spawn + notice + `retire_missing` — without invoking codex managed-launch planning or consuming a sidecar planning slot); fail-open (Unknown/ProviderUnavailable → attempt resume); live sessions never gated (in-gate liveness join); the ~1 s codex by-id walk stays OFF hot reconnect paths (`exists_for_gate` is called only from spawn-door gate callers).
+- **Main/#589:** off-permit codex planning for restore creates and its restore-storm pins (zero error frames, off-permit fairness, prepared-sidecar discard) keep passing. Final ordering for codex restore-class creates: **gate → plan (off-permit) → permit → spawn** (Task 5). For non-codex modes there is no off-permit plan step, so the gate stays at its branch position inside `handle_create` (post-ladder, post-D7, pre-`ensure_session` re-stub) — documented in code in Task 5.
+- **Unchanged:** S5 managed-launch semantics, #582 breaker bookkeeping (pinned inside `auto_resume_respawn.rs::respawn_with_absent_session_spawns_fresh_and_retires_binding:520-556`), #584 identity threading. The replay must not regress them; Task 7's sweep proves it.
+
+## Key facts (established by read-only investigation; line numbers are for `origin/main:crates/freshell-ws/src/terminal.rs` unless noted)
+
+- `LaunchPrep` struct: `:1464-1468`. `derive_launch_prep(create: &TerminalCreate, mode: &str) -> LaunchPrep`: `:1474-1544`, `pub(crate)`, sync, pure, NO existing direct unit tests anywhere. Exactly two call sites, both in `terminal.rs`: `prepare_launch:1616` and the `handle_create` inline fallback `:1876`. The freshagent REST door (`crates/freshell-freshagent/src/terminal_tabs.rs:809`) has its OWN prep and does NOT use `derive_launch_prep` — the new field does not flow there (door 3 keeps its existing branch-side gate, which auto-merges).
+- `git merge-tree --write-tree origin/main HEAD` reports exactly ONE conflicted file: `crates/freshell-ws/src/terminal.rs` (one hunk: main's `LaunchPrep` destructure + hoisted claude P0.4 ladder vs the branch's inline derivation). `crates/freshell-freshagent/src/terminal_tabs.rs` auto-merges.
+- Branch commits touching `terminal.rs` (replay order): `5580abb62` → `1ed94741d` (THE conflict) → `ee2b7167c` → `e13a6b787`.
+- Main binds `launch_intent`/`claude_fresh_prealloc` immutably in the `handle_create` destructure (`:1870-1877`); the branch's gate mutates both — the resolution MUST add `mut`.
+- `resume_id_from_wire` semantics (branch `HEAD:terminal.rs:1637,1692,1811`): `true` iff the wire-derivation `else` arm ran — i.e. `mode != "shell"` AND neither `should_preallocate_fresh_claude` nor `should_preallocate_fresh_amplifier`. TRAP: `claude_fresh_prealloc` alone is NOT a "server-allocated" signal — the amplifier prealloc arm mints a server id with `claude_fresh_prealloc == false`. The field must be `false` for BOTH prealloc arms.
+- The claude P0.4 restore ladder runs only when the `else` arm ran (claude prealloc requires `restore != Some(true)`, the ladder requires `restore == Some(true)`), so ladder-resolved ids are always `resume_id_from_wire == true` — the flag's value is unaffected by main hoisting the ladder out of the derivation.
+- Main ordering (`origin/main:crates/freshell-ws/src/create_gate.rs`): `prepare_launch` (derive + codex `LaunchClass::Restore` plan) `:80` → permit `acquire_unbounded` `:129` → `handle_create(create, Some(prepared), …)` (7 args) `:224`. The branch's gate tests to reconcile against: `crates/freshell-ws/tests/resume_validation_gate.rs` (incl. `#[ignore]`d `managed_default_stale_codex_id_is_gated_before_planning:751`), `auto_resume_respawn.rs`, `rest_resume_*` unit tests in `terminal_tabs.rs`; main's pins: `crates/freshell-ws/tests/restore_storm.rs` (5 tests) and `restore_plan_queue_cap.rs` (1 test).
+- Validated end-to-end in sandbox rebases (load-bearing pass, evidence in `.worktrees/.the-usual-logs/resume-validation/`): the rebase stops exactly ONCE, at `1ed94741d` (commit 13/28; git auto-places the branch's gate block after the D7 guard — Step 4's "verify" arm is the real path); `LaunchIntent` is `Copy` (cli_launch.rs:85), so `*launch_intent` compiles; exactly ONE `PreparedLaunch` literal exists (the `prepare_launch` return the plan itself modifies); Task 2 + Task 5 code snippets compiled verbatim with clippy `-D warnings` clean. Every main line number cited above was re-verified exact at `2641ada38`.
+
+---
+
+### Task 1: Preflight, safety snapshot, and rebase-target verification
+
+**Files:**
+- No repo files modified. Creates git ref `backup/resume-validation-pre-589-rebase`.
+
+**Interfaces:**
+- Consumes: nothing.
+- Produces: a verified-clean worktree on `feat/resume-validation`, a backup ref, and recorded baseline facts (`N_COMMITS=28`, pre-rebase HEAD sha, pre-rebase client-file list) that Tasks 2 and 7 compare against.
+
+- [ ] **Step 1: Verify worktree state and branch**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git status --porcelain            # expect: EMPTY output (clean tree)
+git branch --show-current         # expect: feat/resume-validation
+ls .git 2>/dev/null; git rev-parse --git-dir   # informational
+test -d "$(git rev-parse --git-path rebase-merge)" -o -d "$(git rev-parse --git-path rebase-apply)" \
+  && echo "REBASE IN PROGRESS — HALT" || echo "no rebase in progress"
+```
+
+Expected: clean tree, correct branch, "no rebase in progress". **If the tree is
+dirty or a rebase is in progress, HALT the task and report — another agent may be
+mid-operation; do not clobber.**
+
+- [ ] **Step 2: Fetch and verify the pinned rebase target**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git fetch origin
+git rev-parse origin/main
+git cat-file -t 2641ada382472586ce1aa7664331d384853e867d   # expect: commit
+git merge-base HEAD origin/main                            # expect: 39010cb5709481a807377241c162d192737df965
+```
+
+Expected: `2641ada38…` exists. If `origin/main != 2641ada38`, proceed anyway —
+all later steps rebase onto the PINNED hash — and record the discrepancy for the
+final report.
+
+- [ ] **Step 3: Record baseline facts and create the backup ref**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git rev-parse HEAD                                   # record: PRE_REBASE_HEAD (expect 8b0f08162…)
+git rev-list --count 39010cb57..HEAD                 # record: N_COMMITS (expect 28)
+git diff --name-only 39010cb57..HEAD -- src/ test/ shared/ | sort   # record: PRE_CLIENT_FILES
+git branch backup/resume-validation-pre-589-rebase HEAD
+git rev-parse backup/resume-validation-pre-589-rebase  # expect: same sha as PRE_REBASE_HEAD
+```
+
+Re-pin rule: baselines are pinned at EXECUTION time, not planning time. If HEAD is
+not `8b0f08162`, inspect the extra commits (`git log --stat 318e9c295..HEAD`): if
+every extra commit is docs-only (e.g. more `docs/plans/` additions), record the
+ACTUAL sha and count and use the actual `N_COMMITS` wherever this plan says 28;
+if any extra commit touches code, HALT and report — the plan's conflict analysis
+was validated against `8b0f08162`.
+
+Expected `PRE_CLIENT_FILES` (the branch's own client footprint — the rebase must not grow it):
+
+```
+shared/ws-protocol.ts
+src/components/TerminalView.tsx
+test/unit/client/components/TerminalView.lifecycle.test.tsx
+```
+
+- [ ] **Step 4: Baseline sanity build**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo check --workspace
+```
+
+Run with timeout ≥ 900 s. Expected: exit 0 (the branch was green pre-rebase).
+No commit in this task.
+
+---
+
+### Task 2: Rebase onto 2641ada38, resolving the `terminal.rs` conflict per Option A
+
+**Files:**
+- Modify (via rebase conflict resolution): `crates/freshell-ws/src/terminal.rs`
+- All other branch files replay/auto-merge untouched.
+
+**Interfaces:**
+- Consumes: `LaunchPrep` struct (`origin/main terminal.rs:1464`), `derive_launch_prep` (`:1474`), `handle_create` destructure (`:1870-1877`), the branch's gate block (branch `HEAD:terminal.rs:1803-1889`) and its helper `crate::resume_validation::validate_wire_resume(mode, resume_session_id, launch_intent, probe) -> ResumeValidationOutcome` (fields: `resume_session_id: Option<String>`, `launch_intent: LaunchIntent`, `claude_fresh_prealloc: bool`, `stale_session_id: Option<String>`, `notice: Option<String>`).
+- Produces: a rebased branch where `LaunchPrep` has a 4th field `pub resume_id_from_wire: bool`, `derive_launch_prep` sets it in exactly one place (the wire `else` arm), and `handle_create` consumes it from the destructure. Tasks 3–5 rely on exactly these names: `LaunchPrep.resume_id_from_wire`, and the gate block keyed `if resume_id_from_wire { … }` sitting after the D7 liveness guard.
+
+- [ ] **Step 1: Start the rebase**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git rebase 2641ada382472586ce1aa7664331d384853e867d
+```
+
+Expected: stops with `CONFLICT (content): Merge conflict in crates/freshell-ws/src/terminal.rs`
+while applying `1ed94741d… gate WS terminal.create restore path on disk existence`.
+(An earlier stop at `5580abb62` is possible but not expected — if it happens, the
+commit only adds the `notice:` field plumbing on `TerminalCreated`; keep both sides:
+main's surrounding text + the branch's added `notice` plumbing, then continue.)
+
+- [ ] **Step 2: Resolve `1ed94741d` — extend `LaunchPrep` + `derive_launch_prep` (Option A)**
+
+Open `crates/freshell-ws/src/terminal.rs`. Apply FOUR precise edits, then delete
+every conflict marker. Edit 1 — the struct (currently ends with
+`claude_fresh_prealloc: bool,`):
+
+```rust
+pub(crate) struct LaunchPrep {
+    pub launch_intent: LaunchIntent,
+    pub resume_session_id: Option<String>,
+    pub claude_fresh_prealloc: bool,
+    /// Resume-validation tracker (door 1): true only when the resume id above
+    /// was derived from the WIRE (sessionRef / legacy resumeSessionId / the
+    /// claude restore ladder, which resolves persisted client state) —
+    /// server-minted prealloc ids are never gated. Set in exactly ONE place
+    /// (the wire `else` arm of derive_launch_prep); never re-computed.
+    pub resume_id_from_wire: bool,
+}
+```
+
+Edit 2 — inside `derive_launch_prep`, add the tracker declaration immediately after
+`let mut claude_fresh_prealloc = false;`:
+
+```rust
+    let mut claude_fresh_prealloc = false;
+    // Resume-validation tracker (door 1): true only when the resume id below
+    // was derived from the WIRE (sessionRef / legacy resumeSessionId / the
+    // claude restore ladder) — server-minted prealloc ids are never gated.
+    let mut resume_id_from_wire = false;
+```
+
+Edit 3 — in the same function's trailing `else` arm, immediately after the
+`resume_session_id = requested_ref…filter(|s| !s.is_empty());` statement:
+
+```rust
+            resume_session_id = requested_ref
+                .map(|r| r.session_id.clone())
+                .or_else(|| create.resume_session_id.clone())
+                .filter(|s| !s.is_empty());
+            // Everything this arm can produce came from the wire (or the
+            // claude ladder in handle_create, which only runs when this arm
+            // ran and resolves persisted client state) — eligible for
+            // resume validation.
+            resume_id_from_wire = true;
+```
+
+Edit 4 — the function's return literal:
+
+```rust
+    LaunchPrep {
+        launch_intent,
+        resume_session_id,
+        claude_fresh_prealloc,
+        resume_id_from_wire,
+    }
+}
+```
+
+Do NOT set the flag in the `should_preallocate_fresh_claude` arm or the
+`should_preallocate_fresh_amplifier` arm — both mint server ids and must stay `false`.
+
+- [ ] **Step 3: Resolve `1ed94741d` — the `handle_create` conflict hunk**
+
+The conflict hunk spans main's `LaunchPrep` destructure + hoisted claude P0.4 ladder
+(ours) vs the branch's whole inline derivation (theirs). Resolution: KEEP MAIN'S
+STRUCTURE (delete the branch's inline derivation entirely — `derive_launch_prep`
+now carries the flag), with mutability + field added to the destructure:
+
+```rust
+    let LaunchPrep {
+        mut launch_intent,
+        mut resume_session_id,
+        mut claude_fresh_prealloc,
+        resume_id_from_wire,
+    } = match prep {
+        Some(prep) => prep,
+        None => derive_launch_prep(&create, &mode),
+    };
+```
+
+Keep main's claude P0.4 ladder block that follows (the
+`if mode == "claude" && create.restore == Some(true) { … }` block with the
+`is_canonical_claude_session_id` / `resolve_claude_restore_session_id` /
+`RestoreUnavailable` rungs) EXACTLY as main has it — including its
+"Do not move it" comment. Keep main's D7 liveness guard after it, unchanged.
+Audit the closing braces by eye: the two sides close different brace depths, so
+a naive take-ours/take-theirs does not compile — the resolved region must be:
+destructure → ladder → D7 guard.
+
+- [ ] **Step 4: Resolve `1ed94741d` — the gate block itself**
+
+The branch's gate hunk (its `HEAD:1803-1889` block) inserts AFTER the D7 guard and
+BEFORE the amplifier `ensure_session` re-stub. If git placed it cleanly, verify it;
+if it landed inside conflict markers, re-insert it verbatim at that position. It must
+read exactly as on the branch (same comments), starting:
+
+```rust
+    // Resume validation (docs/plans/2026-07-29-resume-validation.md): never
+    // hand the CLI a resume id that is definitively absent from the
+    // provider's on-disk store. Fail open on Unknown/ProviderUnavailable.
+    // Placed AFTER the D7 liveness guard (a gate fire would falsify D7's
+    // applicability filter and retire a running session's Bound row) and
+    // BEFORE the amplifier ensure_session re-stub (which would resurrect
+    // the stale dir).
+    let mut resume_fallback_notice: Option<String> = None;
+    if resume_id_from_wire {
+```
+
+…followed by the branch's `candidate_is_live` join (registry + async `fresh_*`
+sidecar arms), the `spawn_blocking` call to
+`crate::resume_validation::validate_wire_resume`, the outcome application
+(`resume_session_id = outcome.resume_session_id; launch_intent = outcome.launch_intent;
+if outcome.claude_fresh_prealloc { claude_fresh_prealloc = true; }`), and the
+stale-fire arm (`tracing::warn!`, `session_ref_lease = None;`, the
+`ledger.retire_missing(...)` spawn_blocking, `resume_fallback_notice = outcome.notice;`).
+Recover the exact text with:
+
+```bash
+git -C /home/dan/code/freshell/.worktrees/resume-validation show REBASE_HEAD:crates/freshell-ws/src/terminal.rs | sed -n '1803,1889p'
+```
+
+(`REBASE_HEAD` is the commit being replayed, i.e. the branch's `1ed94741d`.)
+
+- [ ] **Step 5: Verify the resolution compiles, then continue**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+grep -n '<<<<<<<\|=======\|>>>>>>>' crates/freshell-ws/src/terminal.rs   # expect: no output
+cargo check -p freshell-ws                                              # expect: exit 0
+git add crates/freshell-ws/src/terminal.rs
+GIT_EDITOR=true git rebase --continue
+```
+
+Keep the original commit message (`GIT_EDITOR=true` makes the continue
+non-interactive while keeping it). Expected: the rebase proceeds.
+
+- [ ] **Step 6: Handle any later stops with these fixed rules**
+
+Rules, in order: (1) prefer MAIN's structural text for regions #589 rewrote
+(destructure, ladder position, plan sites, `prepare_launch`); (2) keep the branch's
+ADDITIONS (gate block, door-2 respawn gate, notice plumbing, tests, docs);
+(3) stay consistent with Steps 2–4 — the flag lives ONLY in `derive_launch_prep`;
+(4) if a replayed commit becomes empty because main already contains its change,
+verify with `git diff --cached --stat` that it is truly empty, then `git rebase --skip`
+and record which commit was skipped. Expected candidates for a stop: `e13a6b787`
+(the branch's earlier S5-reconciliation of `terminal.rs`) — for it, keep main's
+text wherever both sides express the same S5/#582/#584 reconciliation and keep any
+branch-only additions. After each resolution: the same `grep` for markers +
+`cargo check -p freshell-ws` before `git rebase --continue`.
+
+- [ ] **Step 7: Post-rebase structural verification**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git status --porcelain                       # expect: empty (rebase finished)
+git merge-base HEAD 2641ada382472586ce1aa7664331d384853e867d   # expect: 2641ada38247…
+git rev-list --count 2641ada38..HEAD         # expect: 28 (Task 1's N_COMMITS, minus recorded skips)
+git grep -n resume_id_from_wire -- crates/   # expect: exactly SIX sites, all terminal.rs — struct field, derive decl, else-arm set, return literal, destructure, gate predicate
+git diff --name-only 39010cb57..backup/resume-validation-pre-589-rebase -- src/ test/ shared/ | sort > /tmp/pre_client.txt
+git diff --name-only 2641ada38..HEAD -- src/ test/ shared/ | sort > /tmp/post_client.txt
+diff /tmp/pre_client.txt /tmp/post_client.txt && echo CLIENT-FOOTPRINT-UNCHANGED
+```
+
+Expected: all as annotated; `CLIENT-FOOTPRINT-UNCHANGED` prints.
+
+- [ ] **Step 8: Post-rebase compile + targeted non-ignored sweep**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+test -d node_modules || npm ci   # three tests exec node fixtures needing tsx/ws (see Global Constraints)
+cargo check --workspace
+cargo test -p freshell-ws --test resume_validation_gate
+cargo test -p freshell-ws --test auto_resume_respawn
+cargo test -p freshell-freshagent --lib rest_resume_
+cargo test -p freshell-ws --test restore_storm
+cargo test -p freshell-ws --test restore_plan_queue_cap
+cargo test -p freshell-ws --lib resume_validation
+cargo test -p freshell-platform --lib resume_gate
+```
+
+Run with timeout ≥ 1200 s each where needed. Expected: ALL PASS. (The `#[ignore]`d
+`managed_default_stale_codex_id_is_gated_before_planning` is deliberately NOT run
+here — the ignored pair is exercised in Task 5, whose RED is the new case-7b ORDER
+pin, and in Task 7.) If a storm pin fails, first inspect whether the
+gate fired inside the storm harness (it must not: the harness's default
+`WsState.session_existence` probe answers Unknown → fail-open); report findings
+honestly rather than papering over.
+
+No new commit — the rebase itself rewrote history. Record the post-rebase HEAD sha.
+
+---
+
+### Task 3: First direct unit tests on `derive_launch_prep` — pin `resume_id_from_wire` origin semantics
+
+**Files:**
+- Create: `crates/freshell-ws/src/terminal_launch_prep_tests.rs`
+- Modify: `crates/freshell-ws/src/terminal.rs` (one 3-line test-module hook, next to the existing `#[cfg(test)] #[path = "terminal_create_ordering_tests.rs"]` hook at `terminal.rs:71-73`)
+
+**Interfaces:**
+- Consumes: `derive_launch_prep(&TerminalCreate, &str) -> LaunchPrep` and `LaunchPrep { launch_intent, resume_session_id, claude_fresh_prealloc, resume_id_from_wire }` from Task 2; `TerminalCreate` (deserializable, `#[serde(rename_all = "camelCase")]`, fields `requestId`, `mode`, `shell` (REQUIRED — `Shell`, no serde default, per `crates/freshell-protocol/src/client_messages.rs:205`; every payload below carries `"shell": "system"`, the same value the proven builder at `resume_validation_gate.rs:407` uses), `restore`, `resumeSessionId`, `sessionRef{provider,sessionId}`); `LaunchIntent::{Start, Resume}`.
+- Produces: test module `terminal_launch_prep_tests` — Task 4's mutation-proof step reruns it by name.
+
+- [ ] **Step 1: Register the sibling test file**
+
+In `crates/freshell-ws/src/terminal.rs`, directly below the existing
+`terminal_create_ordering_tests` hook (`:71-73` region), add:
+
+```rust
+#[cfg(test)]
+#[path = "terminal_launch_prep_tests.rs"]
+mod terminal_launch_prep_tests;
+```
+
+- [ ] **Step 2: Write the failing/proving tests**
+
+Create `crates/freshell-ws/src/terminal_launch_prep_tests.rs`:
+
+```rust
+//! First direct unit tests for derive_launch_prep (it previously had only
+//! indirect integration coverage). Pins the ORIGIN semantics of
+//! LaunchPrep.resume_id_from_wire: true only for wire-derived resume ids,
+//! false for BOTH server-prealloc arms (claude fresh prealloc AND the
+//! amplifier launcher-assigned identity) and for mode == "shell".
+use super::*;
+
+fn create_from_json(v: serde_json::Value) -> TerminalCreate {
+    serde_json::from_value(v).expect("valid TerminalCreate json")
+}
+
+#[test]
+fn wire_session_ref_restore_is_from_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-wire-ref",
+        "mode": "codex",
+        "shell": "system",
+        "restore": true,
+        "sessionRef": { "provider": "codex", "sessionId": "stale-codex-id" }
+    }));
+    let prep = derive_launch_prep(&create, "codex");
+    assert!(prep.resume_id_from_wire, "sessionRef carrier is wire-originated");
+    assert_eq!(prep.resume_session_id.as_deref(), Some("stale-codex-id"));
+    assert!(!prep.claude_fresh_prealloc);
+    assert!(matches!(prep.launch_intent, LaunchIntent::Resume));
+}
+
+#[test]
+fn wire_legacy_resume_session_id_is_from_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-wire-legacy",
+        "mode": "amplifier",
+        "shell": "system",
+        "restore": true,
+        "resumeSessionId": "stale-amp-id"
+    }));
+    let prep = derive_launch_prep(&create, "amplifier");
+    assert!(prep.resume_id_from_wire, "legacy resumeSessionId carrier is wire-originated");
+    assert_eq!(prep.resume_session_id.as_deref(), Some("stale-amp-id"));
+}
+
+#[test]
+fn claude_fresh_prealloc_is_server_allocated_not_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-claude-fresh",
+        "mode": "claude",
+        "shell": "system"
+    }));
+    let prep = derive_launch_prep(&create, "claude");
+    assert!(prep.claude_fresh_prealloc);
+    assert!(matches!(prep.launch_intent, LaunchIntent::Start));
+    let minted = prep.resume_session_id.expect("prealloc mints a fresh id");
+    uuid::Uuid::parse_str(&minted).expect("minted id is a uuid");
+    assert!(
+        !prep.resume_id_from_wire,
+        "server-preallocated claude id must NEVER be gate-eligible"
+    );
+}
+
+#[test]
+fn amplifier_fresh_prealloc_is_server_allocated_not_wire() {
+    // THE TRAP CASE: amplifier prealloc mints a server id while
+    // claude_fresh_prealloc stays false — the flag must still be false.
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-amp-fresh",
+        "mode": "amplifier",
+        "shell": "system"
+    }));
+    let prep = derive_launch_prep(&create, "amplifier");
+    assert!(!prep.claude_fresh_prealloc);
+    assert!(matches!(prep.launch_intent, LaunchIntent::Resume));
+    let minted = prep.resume_session_id.expect("amplifier prealloc mints a fresh id");
+    uuid::Uuid::parse_str(&minted).expect("minted id is a uuid");
+    assert!(
+        !prep.resume_id_from_wire,
+        "server-minted amplifier id must NEVER be gate-eligible"
+    );
+}
+
+#[test]
+fn shell_mode_is_never_from_wire() {
+    let create = create_from_json(serde_json::json!({
+        "requestId": "r-shell",
+        "mode": "shell",
+        "shell": "system"
+    }));
+    let prep = derive_launch_prep(&create, "shell");
+    assert!(!prep.resume_id_from_wire);
+    assert!(prep.resume_session_id.is_none());
+}
+```
+
+Every payload above already carries `"shell": "system"` because
+`TerminalCreate.shell` is a REQUIRED field with no serde default
+(`crates/freshell-protocol/src/client_messages.rs:205`) — the same value the
+proven builder `restore_create_with_session_ref` emits at
+`crates/freshell-ws/tests/resume_validation_gate.rs:407`. Residual fallback
+only: if `serde_json::from_value` still panics on some OTHER missing required
+field, copy the exact payload shape emitted by that builder (minus the outer
+`"type": "terminal.create"` envelope if `TerminalCreate` is the payload struct)
+and add the missing fields to every JSON literal above. Adjust `use super::*;`
+imports if `uuid`/`serde_json` need explicit paths — mirror the imports of the
+neighboring `terminal_create_ordering_tests.rs`.
+
+- [ ] **Step 3: Run the new tests**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-ws --lib terminal_launch_prep_tests
+```
+
+Expected: 5 passed. (These pass immediately because Task 2 already added the field —
+Step 4 proves they are load-bearing, which is the honest "prove first" for a
+rebase-introduced field.)
+
+- [ ] **Step 4: Mutation-proof the tests (prove they bite)**
+
+Temporarily add `resume_id_from_wire = true;` inside the
+`if should_preallocate_fresh_claude {` arm of `derive_launch_prep`, then:
+
+```bash
+cargo test -p freshell-ws --lib terminal_launch_prep_tests
+```
+
+Expected: `claude_fresh_prealloc_is_server_allocated_not_wire` FAILS. Now REVERT the
+mutation (`git checkout -- crates/freshell-ws/src/terminal.rs` is NOT usable — the
+file also holds Step 1's hook; revert the one line by hand), rerun, expected: 5 passed.
+
+- [ ] **Step 5: Commit**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git add crates/freshell-ws/src/terminal.rs crates/freshell-ws/src/terminal_launch_prep_tests.rs
+git commit -m "test(ws): first direct unit tests for derive_launch_prep — pin resume_id_from_wire origin semantics"
+```
+
+---
+
+### Task 4: Gate-level pin — server-allocated ids are NEVER gated, even when absent on disk
+
+**Files:**
+- Modify: `crates/freshell-ws/tests/resume_validation_gate.rs` (append probe + 2 tests)
+
+**Interfaces:**
+- Consumes: the file's own harness — `spawn_server_with_probe(probe, fresh_agent_enabled)`, `common::isolate_amplifier_home()`, `common::connect_and_capture_inventory`, `send_json`, `next_created_or_error`, `notice_of`, `restore_create_with_session_ref(request_id, mode, session_id)`, the `SessionExistenceProbe` trait (required methods: `exists` and `ever_observed` — `exists_for_gate` is the wrapper in `resume_validation.rs` that the gate calls, not a trait method) and `SessionExistence::Absent`, plus `StubProbe` (`:28-60`) as the impl template.
+- Produces: tests `server_allocated_fresh_claude_id_is_never_gated` and `server_allocated_fresh_amplifier_id_is_never_gated`; probe type `AbsentButObservedProbe`.
+
+- [ ] **Step 1: Add an absent-but-previously-observed probe**
+
+`StubProbe` defaults unmatched keys to `Unknown` (fail-open), which would make this
+test pass for the WRONG reason. Equally important: the probe MUST answer
+`ever_observed → true`, not `false`. With `ever_observed → false`, a wrongly
+consulted gate on a claude id evaluates `evaluate_resume_gate("claude", Absent,
+false)`, which is the claude ZERO-TURN CARVE-OUT → `Proceed`
+(`crates/freshell-platform/src/resume_gate.rs:100-104`, pinned by
+`claude_zero_turn_carve_out_proceeds`) — no notice, so the claude test would pass
+vacuously and Step 4's mutation could never go red. With `Absent` +
+`ever_observed → true` the outcome is `SpawnFresh`
+(`crates/freshell-platform/src/resume_gate.rs:119`), which fires the notice for
+BOTH claude and amplifier. Add, next to `StubProbe`, a probe with exactly these
+answers — copy `StubProbe`'s `impl SessionExistenceProbe` block shape exactly
+(the trait's required methods are `exists` and `ever_observed`; validated
+against the file's `StubProbe` impl):
+
+```rust
+/// Answers Absent-but-previously-observed for EVERY (provider, id) query —
+/// including ids minted server-side that the test cannot know in advance.
+/// `ever_observed → true` is load-bearing: it defeats the claude zero-turn
+/// carve-out (Absent + never-observed → Proceed, resume_gate.rs:100-104),
+/// so ANY gate consult on a server-allocated id — claude included —
+/// evaluates to SpawnFresh (resume_gate.rs:119), fires the notice, and
+/// fails the assertions below.
+struct AbsentButObservedProbe;
+
+impl SessionExistenceProbe for AbsentButObservedProbe {
+    fn exists(&self, _provider: &str, _session_id: &str) -> SessionExistence {
+        SessionExistence::Absent
+    }
+    fn ever_observed(&self, _provider: &str, _session_id: &str) -> bool {
+        true
+    }
+}
+```
+
+(Adjust method list/signatures to match `StubProbe`'s impl verbatim — that impl is
+the source of truth in this file — but keep the ANSWERS above: `Absent` and
+`true`. The trait's `ever_observed_on_disk` has a default that delegates to
+`ever_observed` (`crates/freshell-ws/src/existence.rs:57-59`), so no third
+method is needed.)
+
+- [ ] **Step 2: Write the two failing/proving tests**
+
+Append to `crates/freshell-ws/tests/resume_validation_gate.rs`. The fresh-create
+frame is derived from the proven restore builder so the envelope shape can never
+drift:
+
+```rust
+fn fresh_create(request_id: &str, mode: &str) -> serde_json::Value {
+    // Same envelope as a restore create, minus every resume carrier — this
+    // is the shape that triggers the server prealloc arms.
+    let mut v = restore_create_with_session_ref(request_id, mode, "unused");
+    let obj = v.as_object_mut().expect("create frame is an object");
+    obj.remove("restore");
+    obj.remove("sessionRef");
+    obj.remove("resumeSessionId");
+    v
+}
+
+/// A fresh claude create mints a SERVER-allocated session id (prealloc).
+/// That id is by definition absent on disk — and must NEVER be gated:
+/// no notice, plain successful create. Probe answers Absent-but-observed
+/// for everything, so any gate consult on the minted id evaluates to
+/// SpawnFresh (the claude zero-turn carve-out does NOT apply), fires the
+/// notice, and fails this test.
+#[tokio::test(flavor = "multi_thread")]
+async fn server_allocated_fresh_claude_id_is_never_gated() {
+    let (url, registry, _ledger, _state) =
+        spawn_server_with_probe(Arc::new(AbsentButObservedProbe), false).await;
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(&mut ws, &fresh_create("req-prealloc-claude", "claude")).await;
+    let frame = next_created_or_error(&mut ws, "req-prealloc-claude").await;
+
+    assert_eq!(
+        frame["type"], "terminal.created",
+        "fresh claude create must succeed, got {frame}"
+    );
+    assert!(
+        notice_of(&frame).is_none(),
+        "server-allocated claude prealloc id must never trip the gate notice"
+    );
+
+    registry.kill_all();
+}
+
+/// The amplifier sibling (THE TRAP: claude_fresh_prealloc == false here, yet
+/// the id is still server-minted): a fresh amplifier create must never gate.
+#[tokio::test(flavor = "multi_thread")]
+async fn server_allocated_fresh_amplifier_id_is_never_gated() {
+    let (url, registry, _ledger, _state) =
+        spawn_server_with_probe(Arc::new(AbsentButObservedProbe), false).await;
+    let _amp_home = common::isolate_amplifier_home();
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(&mut ws, &fresh_create("req-prealloc-amp", "amplifier")).await;
+    let frame = next_created_or_error(&mut ws, "req-prealloc-amp").await;
+
+    assert_eq!(
+        frame["type"], "terminal.created",
+        "fresh amplifier create must succeed, got {frame}"
+    );
+    assert!(
+        notice_of(&frame).is_none(),
+        "server-minted amplifier id must never trip the gate notice"
+    );
+
+    registry.kill_all();
+}
+```
+
+`spawn_server_with_probe`'s probe parameter is `Arc<dyn SessionExistenceProbe>`
+(resume_validation_gate.rs:96-102) — all six existing call sites pass an `Arc`,
+which is why the snippet wraps the probe in `Arc::new(...)` (unsized coercion
+`Arc<AbsentButObservedProbe> → Arc<dyn SessionExistenceProbe>` happens at the call
+site; `Arc` is already imported in this file for those existing calls). Do NOT
+change the harness signature — that would break the six existing callers. If
+the signature has drifted from `Arc<dyn ...>`, match whatever the existing
+call sites in the file do verbatim.
+
+- [ ] **Step 3: Run the new tests**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-ws --test resume_validation_gate server_allocated_
+```
+
+Expected: 2 passed.
+
+- [ ] **Step 4: Mutation-proof (prove they bite)**
+
+Re-apply Task 3 Step 4's mutation (`resume_id_from_wire = true;` in the claude
+prealloc arm of `derive_launch_prep`), run:
+
+```bash
+cargo test -p freshell-ws --test resume_validation_gate server_allocated_fresh_claude_id_is_never_gated
+```
+
+Expected: FAILS — the mutated flag makes the gate consult the probe for the
+minted claude id; the probe answers `Absent` + `ever_observed → true`, so the
+claude zero-turn carve-out (`Absent` + never-observed → `Proceed`,
+`resume_gate.rs:100-104`) does NOT apply and the outcome is `SpawnFresh`
+(`resume_gate.rs:119`): the gate fires, the notice appears, and the
+`notice_of(&frame).is_none()` assertion trips. (This is exactly why Step 1's
+probe answers `ever_observed → true` — with `false`, the carve-out would
+swallow the mutation and this step could never go red.) Revert the one-line
+mutation, rerun, expected: PASS.
+
+- [ ] **Step 5: Run the whole gate suite, then commit**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-ws --test resume_validation_gate
+git add crates/freshell-ws/tests/resume_validation_gate.rs
+git commit -m "test(ws): pin server-allocated resume ids are never gated (claude + amplifier prealloc)"
+```
+
+Expected: all non-ignored tests in the target pass before committing.
+
+---
+
+### Task 5: Gate-before-plan reconciliation — run the codex wire-resume gate OFF-permit in `prepare_launch`
+
+**Files:**
+- Modify: `crates/freshell-ws/src/terminal.rs` (new `ResumeGateCarry` struct + `gate_wire_resume` helper; `PreparedLaunch` gains a field; `prepare_launch` gains the pre-plan gate; `handle_create`'s gate site becomes carry-aware)
+- Modify: `crates/freshell-ws/tests/resume_validation_gate.rs` (append the case-7b ORDER pin — the red test for this task)
+
+**Interfaces:**
+- Consumes: `PreparedLaunch { prep, codex_launch }` and `prepare_launch` (main `terminal.rs:1584-1647`), the `handle_create` top destructure (`:1665-1672`), the gate block from Task 2, `LaunchPrep.resume_id_from_wire`.
+- Produces: `pub(crate) struct ResumeGateCarry { pub notice: Option<String>, pub stale_session_id: Option<String> }`; `async fn gate_wire_resume(state: &WsState, mode: &str, resume_session_id: &mut Option<String>, launch_intent: &mut LaunchIntent, claude_fresh_prealloc: &mut bool) -> ResumeGateCarry`; `PreparedLaunch.resume_gate: Option<ResumeGateCarry>`. Task 7 relies on the final ordering this task pins.
+
+**Why (record in code comments, per the locked spec):** #589 plans codex
+restore-class launches OFF-permit in `prepare_launch`, BEFORE the permit. Task 2's
+tree therefore plans BEFORE the gate for codex wire ids — violating gate-before-plan
+(a stale id must never invoke managed-launch planning nor consume a sidecar planning
+slot). Fix: run the gate inside `prepare_launch`, before `plan_codex_managed_launch`.
+Final ordering for codex restore-class creates: **gate → plan (off-permit) → permit
+→ spawn**. Non-codex modes have NO off-permit plan step, so their gate stays at the
+branch's `handle_create` position (post-ladder, post-D7 — which also keeps
+ladder-resolved claude ids gated, and keeps the off-permit gate from ever seeing a
+pre-ladder non-canonical claude id). The codex-scoped off-permit gate never runs on
+reconnect paths — `prepare_launch` is a spawn-door (restore-create) caller only.
+Two validated notes to keep in mind: (a) the door-2 respawn seam (main
+`terminal.rs:~2962`) also plans codex permit-free, OUTSIDE `prepare_launch` — it is
+covered by the branch's separate door-2 respawn gate, not by this task; (b) on the
+unfixed rebased tree a gate-fired codex create silently ADOPTS the stale-planned
+sidecar (`terminal.rs:~2323` `guard.take()`) — the "no stale `PreparedCodexLaunch`
+can ever exist" property only holds AFTER this task's fix.
+
+- [ ] **Step 1: RED — add the case-7b ORDER pin and run it, expect FAIL**
+
+VALIDATED FINDING (do not re-litigate): the existing `#[ignore]`d case-7 test
+(`managed_default_stale_codex_id_is_gated_before_planning`) PASSES on the rebased
+tree even though the gate-before-plan violation is REAL (proven by instrumentation:
+the stale id flows through `prepare_launch`'s off-permit planning). Case 7 is BLIND
+to the ordering post-#589: the TUI argv derives from post-gate spawn-time state
+(`cli_launch.rs:479-488`) and the stale-planned sidecar is silently adopted at the
+plan site (`terminal.rs:~2323` `guard.take()`). Case 7 therefore stays as a
+both-sides behavioral pin — it is NOT this task's red. The red is the new case-7b
+ORDER pin below, which was validated red→green in a sandbox (deterministic 2/2 both
+sides, ~0.25 s, load-insensitive).
+
+Append to the END of `crates/freshell-ws/tests/resume_validation_gate.rs`
+(immediately after case 7). Test-only — no fixture or production edits (the
+`FAKE_CODEX_APP_SERVER_ARG_LOG` knob already exists in `fake-app-server.mjs`, which
+writes it synchronously at startup, before it listens):
+
+```rust
+// ── gate-vs-plan ORDER probe (case 7b) ──────────────────────────────────────
+
+/// [`StubProbe`] + a gate-before-plan ORDER latch: on the FIRST `exists`
+/// consult for the watched `(provider, session_id)`, records whether
+/// managed-launch planning had ALREADY spawned the codex app-server sidecar
+/// (the fixture's `FAKE_CODEX_APP_SERVER_ARG_LOG` file exists on disk).
+///
+/// Determinism: the fixture writes the arg-log SYNCHRONOUSLY at process
+/// startup, before it ever listens, and `plan_codex_managed_launch` awaits
+/// the sidecar listening — so by the time any plan completes the marker
+/// exists. Both orderings under test are sequential awaits on the same task
+/// (plan-then-gate pre-fix, gate-then-plan post-fix), so the latch value is
+/// not load-sensitive.
+struct GateOrderProbe {
+    provider: String,
+    session_id: String,
+    answer: SessionExistence,
+    planning_marker: std::path::PathBuf,
+    planning_started_before_gate: std::sync::Mutex<Option<bool>>,
+}
+
+impl SessionExistenceProbe for GateOrderProbe {
+    fn exists(&self, provider: &str, session_id: &str) -> SessionExistence {
+        if provider == self.provider && session_id == self.session_id {
+            let mut latch = self.planning_started_before_gate.lock().unwrap();
+            if latch.is_none() {
+                *latch = Some(self.planning_marker.exists());
+            }
+            return self.answer;
+        }
+        SessionExistence::Unknown
+    }
+    fn ever_observed(&self, _provider: &str, _session_id: &str) -> bool {
+        false
+    }
+}
+
+/// Case 7b — the ORDER behind case 7's pin, made directly observable: the
+/// disk-existence gate must consult the probe for a stale WIRE codex resume
+/// id BEFORE managed-launch planning spawns any app-server sidecar
+/// (gate-before-plan). Post-#589, restore-class codex planning runs
+/// OFF-permit in `prepare_launch`; without an off-permit gate the stale id
+/// undergoes sidecar planning FIRST and the gate only fires afterwards.
+/// Case 7 is blind to that ordering (the stale-planned sidecar is silently
+/// adopted and the TUI argv derives from post-gate state) — this pin is not.
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "host-gated e2e (needs node + repo node_modules); mutates process env — run alone with --ignored --test-threads=1"]
+async fn managed_default_stale_codex_id_probe_consulted_before_any_planning() {
+    // Managed leg: the flag stays UNSET (default ON), mirroring case 7.
+    std::env::remove_var("FRESHELL_CODEX_MANAGED_LAUNCH");
+
+    let stale_id = "3f9d2c81-6a4e-4b7f-9c0d-5e8a1b2c3d4f"; // definitively absent
+    let capture_path = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-order-argv-{}.json",
+        std::process::id()
+    ));
+    // The committed fake-app-server fixture writes this file synchronously at
+    // startup (before `new WebSocketServer`) when the env var is set — it
+    // exists on disk ⟺ sidecar planning has begun.
+    let planning_marker = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-order-planned-{}.json",
+        std::process::id()
+    ));
+    let _ = std::fs::remove_file(&capture_path);
+    let _ = std::fs::remove_file(&planning_marker);
+    let dispatcher = write_codex_dispatcher();
+    std::env::set_var("CODEX_CMD", &dispatcher);
+    std::env::set_var("CODEX_ARGV_CAPTURE_PATH", &capture_path);
+    std::env::set_var("FAKE_CODEX_APP_SERVER_ARG_LOG", &planning_marker);
+    let codex_home = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-order-codex-home-{}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&codex_home).expect("codex home");
+    std::env::set_var("CODEX_HOME", &codex_home);
+
+    let probe = Arc::new(GateOrderProbe {
+        provider: "codex".into(),
+        session_id: stale_id.into(),
+        answer: SessionExistence::Absent,
+        planning_marker: planning_marker.clone(),
+        planning_started_before_gate: std::sync::Mutex::new(None),
+    });
+    let (url, registry, _ledger, _state) =
+        spawn_managed_codex_server_with_probe(probe.clone(), true).await;
+
+    let (mut ws, _inv) = common::connect_and_capture_inventory(&url).await;
+    send_json(
+        &mut ws,
+        &restore_create_with_legacy_resume_id("req-gate-7b", "codex", stale_id),
+    )
+    .await;
+
+    // Preconditions (case 7's own pins): the gate fired as a fresh spawn with
+    // the operator notice…
+    let created = next_created_or_error(&mut ws, "req-gate-7b").await;
+    assert_eq!(
+        created["type"], "terminal.created",
+        "the gate-fired create must SUCCEED as a fresh spawn, got {created}"
+    );
+    let notice = notice_of(&created).expect("gate must set the stale-resume notice");
+    assert!(
+        notice.contains(stale_id),
+        "notice names the stale id: {notice}"
+    );
+
+    // …and the fresh spawn still went managed — planning DID run (this guards
+    // the ordering latch against a vacuous pass where nothing was planned).
+    let argv = wait_for_captured_argv(&capture_path);
+    assert_eq!(
+        argv[0], "--remote",
+        "fresh spawn must still plan managed launch"
+    );
+    assert!(
+        planning_marker.exists(),
+        "the codex app-server sidecar must have spawned (planning happened)"
+    );
+
+    let planning_before_gate = *probe.planning_started_before_gate.lock().unwrap();
+
+    // Cleanup BEFORE the ordering assertion so a RED run still tears down.
+    registry.kill_all();
+    std::env::remove_var("CODEX_CMD");
+    std::env::remove_var("CODEX_ARGV_CAPTURE_PATH");
+    std::env::remove_var("FAKE_CODEX_APP_SERVER_ARG_LOG");
+    std::env::remove_var("CODEX_HOME");
+    let _ = std::fs::remove_file(&capture_path);
+    let _ = std::fs::remove_file(&planning_marker);
+
+    // THE pin: gate-before-plan. `Some(true)` means the app-server sidecar
+    // was already up when the gate first consulted the probe for the stale
+    // id — i.e. the stale WIRE resume id underwent off-permit
+    // `plan_codex_managed_launch` BEFORE the disk-existence gate could drop
+    // it, and the create then silently inherited the stale-planned sidecar.
+    let planning_before_gate = planning_before_gate
+        .expect("the disk-existence gate must consult the probe for the stale codex id");
+    assert!(
+        !planning_before_gate,
+        "GATE-BEFORE-PLAN VIOLATED: managed-launch planning spawned a codex app-server \
+         sidecar BEFORE the disk-existence gate consulted the probe for stale id \
+         {stale_id} — the stale wire resume id underwent off-permit \
+         plan_codex_managed_launch ahead of the gate"
+    );
+}
+```
+
+Then run (prereq: repo `node_modules` present — `test -d node_modules || npm ci`;
+without it the test fails with `PTY_SPAWN_FAILED: codex app-server exited before
+listening`, a FALSE red):
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-ws --test resume_validation_gate \
+  managed_default_stale_codex_id_probe_consulted_before_any_planning \
+  -- --ignored --test-threads=1 --exact
+```
+
+Expected: FAIL with panic text beginning `GATE-BEFORE-PLAN VIOLATED: managed-launch
+planning spawned a codex app-server sidecar BEFORE the disk-existence gate consulted
+the probe for stale id 3f9d2c81-…`. Any OTHER failure (missing notice, no `--remote`
+argv, `PTY_SPAWN_FAILED`, the latch `.expect()`) is NOT the red — STOP and
+investigate; do not proceed on an unverified premise. Record the failure output.
+
+- [ ] **Step 2: Add `ResumeGateCarry` and factor the gate body into `gate_wire_resume`**
+
+In `crates/freshell-ws/src/terminal.rs`, next to `PreparedLaunch`, add:
+
+```rust
+/// Outcome of the wire-resume disk-existence gate, carried from wherever the
+/// gate ran (off-permit in prepare_launch for codex; on-permit in
+/// handle_create for everything else) to the single place that emits the
+/// operator notice and releases the D8 stale-ref lease.
+pub(crate) struct ResumeGateCarry {
+    pub notice: Option<String>,
+    pub stale_session_id: Option<String>,
+}
+```
+
+Then add the helper — its body is Task 2's gate block MOVED verbatim (liveness
+join, spawn_blocking probe, outcome application, warn + `retire_missing`), minus
+the `resume_fallback_notice` / `session_ref_lease` lines which stay in
+`handle_create`:
+
+```rust
+/// Resume validation (docs/plans/2026-07-29-resume-validation.md): never hand
+/// the CLI a resume id that is definitively absent from the provider's
+/// on-disk store. Fail open on Unknown/ProviderUnavailable; a LIVE session
+/// never gates (same join D7 uses: registry + async fresh-agent sidecar
+/// arms). The probe's by-id locators do real filesystem walks (~1 s for
+/// codex) — spawn-door callers only, never inline on the async runtime.
+async fn gate_wire_resume(
+    state: &WsState,
+    mode: &str,
+    resume_session_id: &mut Option<String>,
+    launch_intent: &mut LaunchIntent,
+    claude_fresh_prealloc: &mut bool,
+) -> ResumeGateCarry {
+    let candidate_is_live = match resume_session_id.as_deref() {
+        None => false,
+        Some(sid) => {
+            let registry_row_live = state
+                .registry
+                .live_session_owner(Some(&state.identity), mode, sid)
+                .is_some();
+            let fresh_agent_live = !registry_row_live
+                && match mode {
+                    "claude" => state.fresh_claude.has_live_session(sid).await,
+                    "codex" => state.fresh_codex.has_live_session(sid).await,
+                    "opencode" => state.fresh_opencode.has_live_session(sid).await,
+                    _ => false,
+                };
+            registry_row_live || fresh_agent_live
+        }
+    };
+    if candidate_is_live {
+        return ResumeGateCarry { notice: None, stale_session_id: None };
+    }
+    let outcome = {
+        let probe = state.session_existence.clone();
+        let mode_for_gate = mode.to_string();
+        let rid = resume_session_id.take();
+        let intent = *launch_intent;
+        tokio::task::spawn_blocking(move || {
+            crate::resume_validation::validate_wire_resume(
+                &mode_for_gate,
+                rid,
+                intent,
+                probe.as_ref(),
+            )
+        })
+        .await
+        .expect("resume validation task panicked")
+    };
+    *resume_session_id = outcome.resume_session_id;
+    *launch_intent = outcome.launch_intent;
+    if outcome.claude_fresh_prealloc {
+        *claude_fresh_prealloc = true;
+    }
+    if let Some(stale) = outcome.stale_session_id.as_deref() {
+        tracing::warn!(
+            mode = %mode,
+            stale_session_id = %stale,
+            "resume validation: cached session missing on disk; spawning fresh"
+        );
+        // Don't retry the stale id forever — retire the pane-ledger row on
+        // the blocking pool (same fsync discipline as every ledger write).
+        let ledger = std::sync::Arc::clone(&state.pane_ledger);
+        let retire_mode = mode.to_string();
+        let stale_id = stale.to_string();
+        let _ = tokio::task::spawn_blocking(move || {
+            ledger.retire_missing(&retire_mode, &stale_id)
+        })
+        .await;
+    }
+    ResumeGateCarry {
+        notice: outcome.notice,
+        stale_session_id: outcome.stale_session_id,
+    }
+}
+```
+
+Preserve the original block's inline comments (liveness SHAPE NOTE, A13
+spawn_blocking rationale, retire discipline) — move them with the code. If
+`LaunchIntent` is not `Copy`, use `.clone()` instead of `*launch_intent` for
+`intent`.
+
+- [ ] **Step 3: Extend `PreparedLaunch` and gate inside `prepare_launch`**
+
+```rust
+pub(crate) struct PreparedLaunch {
+    pub prep: LaunchPrep,
+    /// Some(..) ONLY when a resume session id was derived; None means
+    /// "not planned pre-gate" and handle_create plans on-permit inline.
+    pub codex_launch: Option<PreparedCodexLaunch>,
+    /// Some(..) iff the wire-resume gate already ran off-permit (codex
+    /// restore-class creates) — handle_create must then NOT run it again,
+    /// only apply the carried notice / stale-ref lease release.
+    pub resume_gate: Option<ResumeGateCarry>,
+}
+```
+
+In `prepare_launch`, change `let prep = derive_launch_prep(create, &mode);` to
+`let mut prep = derive_launch_prep(create, &mode);` and insert BETWEEN the derive
+and the existing `let codex_launch = if prep.resume_session_id.is_some() { … }`
+plan site:
+
+```rust
+    // Resume-validation door 1, codex leg (reconciled with #589): codex
+    // restore-class planning happens OFF-permit right below, so the
+    // disk-existence gate for codex WIRE ids must run before it — a
+    // definitively-absent stale id must never invoke managed-launch
+    // planning nor consume a sidecar planning slot. Final ordering here:
+    // gate -> plan (off-permit) -> permit -> spawn. Non-codex modes have no
+    // off-permit plan step; they keep the on-permit gate inside
+    // handle_create (post-ladder, post-D7), byte-identical to the branch.
+    let resume_gate = if mode == "codex" && prep.resume_id_from_wire {
+        Some(
+            gate_wire_resume(
+                state,
+                &mode,
+                &mut prep.resume_session_id,
+                &mut prep.launch_intent,
+                &mut prep.claude_fresh_prealloc,
+            )
+            .await,
+        )
+    } else {
+        None
+    };
+```
+
+…and change the return to `Ok(PreparedLaunch { prep, codex_launch, resume_gate })`.
+Note the emergent win: when the gate FIRES for codex it drops the resume id, so
+`prep.resume_session_id` is `None` at the plan site → no off-permit plan is made
+at all (the A4 exclusion), and `handle_create` later plans on-permit
+`LaunchClass::Interactive` exactly like a fresh create — no stale
+`PreparedCodexLaunch` can ever exist.
+
+- [ ] **Step 4: Make `handle_create`'s gate site carry-aware**
+
+In `handle_create`, extend the top destructure to extract the carry:
+
+```rust
+    let (prep, mut prepared_codex, prepared_resume_gate) = match prepared {
+        Some(p) => (Some(p.prep), p.codex_launch, p.resume_gate),
+        None => (None, None, None),
+    };
+```
+
+Replace Task 2's whole `let mut resume_fallback_notice … if resume_id_from_wire { … }`
+gate block (keeping its position: after the D7 guard, before the amplifier
+`ensure_session` re-stub) with:
+
+```rust
+    // Resume validation (docs/plans/2026-07-29-resume-validation.md). The
+    // codex leg already ran OFF-permit in prepare_launch (gate-before-plan);
+    // every other wire-id create gates here — after the D7 liveness guard
+    // (a gate fire would falsify D7's applicability filter) and after the
+    // claude P0.4 ladder (ladder-resolved ids are wire-originated and must
+    // be validated), before the amplifier ensure_session re-stub (which
+    // would resurrect the stale dir).
+    let mut resume_fallback_notice: Option<String> = None;
+    let resume_gate_carry = match prepared_resume_gate {
+        Some(carry) => Some(carry),
+        None if resume_id_from_wire => Some(
+            gate_wire_resume(
+                state,
+                &mode,
+                &mut resume_session_id,
+                &mut launch_intent,
+                &mut claude_fresh_prealloc,
+            )
+            .await,
+        ),
+        None => None,
+    };
+    if let Some(carry) = resume_gate_carry {
+        if carry.stale_session_id.is_some() {
+            // Stale-ref stamping guard: this create no longer creates the
+            // wire sessionRef's session, so a D8 lease claimed for the
+            // STALE ref must be RELEASED, never completed (completing it
+            // would bind stale-ref->terminal in the registry binding map).
+            // Dropping the armed guard runs fail_session_ref_claim.
+            session_ref_lease = None;
+            resume_fallback_notice = carry.notice;
+        }
+    }
+```
+
+- [ ] **Step 5: Compile + clippy the crate**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo check -p freshell-ws
+cargo clippy -p freshell-ws --all-targets -- -D warnings
+```
+
+Expected: exit 0 both. If any other code constructs `PreparedLaunch` literally
+(the compiler will say so), add `resume_gate: None` there.
+
+- [ ] **Step 6: GREEN — the case-7b ORDER pin now passes**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-ws --test resume_validation_gate \
+  managed_default_stale_codex_id_probe_consulted_before_any_planning \
+  -- --ignored --test-threads=1 --exact
+cargo test -p freshell-ws --test resume_validation_gate -- --ignored --test-threads=1
+cargo clippy -p freshell-ws --tests -- -D warnings
+```
+
+Expected: first command `ok. 1 passed`; second `2 passed` (case 7 stays a passing
+behavioral pin on both sides — it is NOT a red and must not be presented as one);
+clippy clean. Expected runtimes ~0.2–0.5 s per test (load-insensitive by design).
+
+- [ ] **Step 7: Re-run every interaction surface**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-ws --test resume_validation_gate
+cargo test -p freshell-ws --test auto_resume_respawn
+cargo test -p freshell-freshagent --lib rest_resume_
+cargo test -p freshell-ws --test restore_storm
+cargo test -p freshell-ws --test restore_plan_queue_cap
+cargo test -p freshell-ws --lib terminal_launch_prep_tests
+```
+
+Timeout ≥ 1200 s where needed. Expected: ALL PASS — including the five storm pins
+(their harness probe answers Unknown → the new off-permit gate fails open and only
+adds a no-op consult) and Task 4's `server_allocated_*` pins.
+
+- [ ] **Step 8: Commit**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git add crates/freshell-ws/src/terminal.rs crates/freshell-ws/tests/resume_validation_gate.rs
+git commit -m "fix(ws): run the codex wire-resume gate off-permit before planning — reconcile resume-validation gate-before-plan with #589"
+```
+
+---
+
+### Task 6: Docs truth-up — deviation ledger vs the new door-1 wiring
+
+**Files:**
+- Modify (only if false statements found): `port/oracle/DEVIATIONS.md`
+- Do NOT edit the dated plan docs (`docs/plans/2026-07-29-resume-validation.md`, `docs/plans/2026-07-30-resume-validation.md`) — they are historical records of past runs, not living docs.
+
+**Interfaces:**
+- Consumes: Task 5's final wiring (codex leg off-permit in `prepare_launch`; other modes on-permit in `handle_create`).
+- Produces: a deviation ledger that states the true door-1 ordering.
+
+- [ ] **Step 1: Find ordering claims in the ledger**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+grep -n -i "resume.validation\|resume_id_from_wire\|gate" port/oracle/DEVIATIONS.md | head -50
+```
+
+Read the branch's deviation entry (added by `4685c10c7`, reconciled by `ae05f50ad` /
+DEV-0010). Statements that are NOW FALSE and must be amended if present: claims that
+the door-1 gate runs only inside `handle_create`, or that it runs after the spawn-gate
+permit for ALL modes, or any ordering claim contradicted by "codex wire ids gate
+off-permit in `prepare_launch`, before managed-launch planning; other modes gate
+on-permit in `handle_create` post-ladder/post-D7".
+
+- [ ] **Step 2: Amend only the false sentences**
+
+Edit the specific sentences in the deviation entry to state the Task 5 ordering,
+e.g. append to the door-1 wiring description:
+
+```markdown
+(Reconciled with PR #589's off-permit restore planning: for codex restore-class
+creates the gate runs OFF-permit inside `prepare_launch`, BEFORE
+`plan_codex_managed_launch` — gate → plan (off-permit) → permit → spawn — so a
+stale id never consumes a sidecar planning slot. All other modes keep the
+on-permit gate in `handle_create` (post-ladder, post-D7); the gate outcome is
+carried via `PreparedLaunch.resume_gate` so notice emission and D8 stale-ref
+lease release stay single-sited.)
+```
+
+If NOTHING in the ledger is false (grep found no contradicted claims), record that
+finding and SKIP Step 3 — this task then produces no commit, which is the correct
+outcome per the spec ("update ONLY if they now state something false").
+
+- [ ] **Step 3: Commit (only if Step 2 changed anything)**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git add port/oracle/DEVIATIONS.md
+git commit -m "docs: reconcile deviation ledger with off-permit codex gate placement (#589 rebase)"
+```
+
+---
+
+### Task 7: Full verification and final history review
+
+**Files:**
+- None modified (verification only; any failure loops back to the offending task).
+
+**Interfaces:**
+- Consumes: everything above; Task 1's recorded baselines.
+- Produces: the final green receipt for the orchestrator (which lands the branch — this plan never pushes).
+
+- [ ] **Step 1: Formatting and lints (CI-exact)**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo fmt --all --check
+cargo clippy --workspace --all-targets -- -D warnings
+```
+
+Expected: both exit 0. Fix any fallout in place (amend into the responsible task's
+commit with `git commit --fixup=<sha>` + `git rebase --autosquash -i 2641ada38` only
+if trivial formatting; otherwise a focused follow-up commit).
+
+- [ ] **Step 2: Full Rust workspace suite (LONG)**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test --workspace
+```
+
+Run with timeout ≥ 3600 s. Expected: all pass.
+
+- [ ] **Step 3: Host-gated ignored e2e legs (run alone, serially)**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-ws --test resume_validation_gate -- --ignored --test-threads=1
+cargo test -p freshell-ws --test codex_managed_launch_e2e -- --ignored --test-threads=1
+```
+
+Timeout ≥ 1200 s each. Expected: pass (skip the second command gracefully if that
+test target does not exist post-rebase — verify with
+`ls crates/freshell-ws/tests/ | grep codex_managed` first).
+
+- [ ] **Step 4: Wire-contract check (branch touches freshell-protocol + shared/ws-protocol.ts)**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo test -p freshell-protocol --locked
+npm run contract:generate && git diff --exit-code -- port/contract
+```
+
+Expected: tests pass; `git diff` exits 0 (schema unchanged by the rebase). If
+`contract:generate` needs node deps that aren't installed in this worktree, run
+`npm ci` first (build tooling only — not a test run, no coordinator gate needed).
+
+- [ ] **Step 5: Client-suite gate — run ONLY if the rebase touched client files**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git diff --name-only 2641ada38..HEAD -- src/ test/ shared/ | sort
+```
+
+Expected output is EXACTLY Task 1's `PRE_CLIENT_FILES` list (the branch's own three
+files). If so: SKIP the JS suite (the rebase is Rust-only — #589 touched no client
+files) and record that decision. If the list grew: run the coordinated client suite —
+
+```bash
+npm run test:status   # wait politely if another agent holds the gate
+FRESHELL_TEST_SUMMARY="resume-validation #589 rebase touched client files" npm run test:unit
+```
+
+(Reminder: `terminal-font-settings.test.tsx` failing is a known pre-existing
+main-side issue — note it, don't chase it.)
+
+- [ ] **Step 6: Final history review**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git merge-base HEAD 2641ada382472586ce1aa7664331d384853e867d   # expect 2641ada38247…
+git log --oneline 2641ada38..HEAD
+git log --format='%an <%ae>' 2641ada38..HEAD | sort -u          # expect exactly: Dan Shapiro <3732858+danshapiro@users.noreply.github.com>
+git status --porcelain                                          # expect empty
+```
+
+Expected: 28 replayed commits (Task 1's N_COMMITS, minus any recorded empty-skips) + 2–4 reconciliation
+commits (Tasks 3, 4, 5, optional 6), every message Conventional-Commits-shaped, no
+stray WIP/fixup commits, clean tree. Confirm the backup ref still exists
+(`git rev-parse backup/resume-validation-pre-589-rebase`). **Do NOT push, do NOT
+open a PR, do NOT delete the backup ref** — report the final HEAD sha, the pass/fail
+table of Steps 1–5, any skipped-empty commits, and any origin/main-moved discrepancy
+from Task 1.
+
+---
+
+## Self-review record
+
+- **Spec coverage:** Required work 1 (rebase + Option A + consistent later resolutions) → Tasks 1–2. Required work 2 (TDD unit test on `derive_launch_prep` for wire-vs-server-allocated + gate-level never-gated assertion) → Tasks 3–4 (with mutation-proof steps making the "prove" honest, since the field lands during the rebase). Required work 3 (re-run branch gate tests, auto_resume, rest_resume_, managed-path characterization, #589 storm pins) → Task 2 Step 8, Task 5 Steps 1/6/7, Task 7. Required work 4 (fmt/clippy/workspace tests/client-if-touched, known font-settings caveat) → Task 7. Required work 5 (clean history, reconciliation commit messages, docs only-if-false) → Tasks 5–7. The explicit ordering interaction (gate → plan-off-permit → permit → spawn, or documented alternative) → Task 5, which implements the blessed ordering for codex and documents in code why non-codex modes gate on-permit (no off-permit plan step exists for them; ladder-resolved claude ids must be validated post-ladder). Task 5's TDD structure was re-based on validated evidence: the original red (case 7) passes pre-fix because its argv detection is blind post-#589, so the red is the new case-7b ORDER pin — sandbox-verified deterministic RED (pre-fix) → GREEN (post-fix) with the exact code inlined in Step 1.
+- **No silent deferrals:** No stubs or fakes stand in for required behavior; the only test doubles are the pre-existing harness probes (`StubProbe`, plus the new `AbsentButObservedProbe`), and the real-probe production path is exercised by the branch's existing `freshell-server` existence tests which run in Task 7's workspace sweep. No requirement was moved to "known limitations". **UNRESOLVED COVERAGE GAPS: none.**
+- **Placeholder scan:** every code step carries complete code; the one place where a repo detail could drift (the exact `SessionExistenceProbe` method list) carries a deterministic in-repo fallback (copy the named proven impl at an exact file:line), not a TBD. `TerminalCreate`'s required `shell` field WAS pinned read-only (`crates/freshell-protocol/src/client_messages.rs:205`, no serde default) and every Task 3 payload carries `"shell": "system"`.
+- **Type consistency:** `LaunchPrep.resume_id_from_wire: bool` (Tasks 2/3/5), `ResumeGateCarry { notice, stale_session_id }` + `gate_wire_resume(state, mode, &mut Option<String>, &mut LaunchIntent, &mut bool)` (Task 5 both call sites), `PreparedLaunch.resume_gate: Option<ResumeGateCarry>` (Task 5 Steps 3–4), test names in Task 4 Step 2 match Step 3/4 run filters — all cross-checked.
diff --git a/docs/plans/2026-07-30-resume-validation.md b/docs/plans/2026-07-30-resume-validation.md
new file mode 100644
index 000000000..0b842f294
--- /dev/null
+++ b/docs/plans/2026-07-30-resume-validation.md
@@ -0,0 +1,1138 @@
+# Resume-Validation Branch Reconciliation Implementation Plan
+
+> **For agentic workers:** This plan is executed task-by-task by the
+> workflow's execute stage: a fresh implementer per task, with a spec +
+> quality review after each task. Steps use checkbox (`- [ ]`) syntax
+> for tracking.
+
+**Goal:** Rebase and reconcile the already-built, already-reviewed branch
+`feat/resume-validation` onto current `main` (`39010cb57`), preserving both the
+branch's spawn-door gate semantics and main's post-fork semantics (S5 codex
+managed launch now default-ON, #582 flap-loop breaker, #584 REST identity),
+ending fully verified green — no merge, no PR, no push, no server restart.
+
+**Architecture:** This is a RECONCILIATION pass, not a new feature. The branch
+adds disk-existence validation at the three spawn doors that construct resume
+argv (`WS terminal.create` restore, headless auto-resume respawn, freshagent
+REST create). Main independently reworked overlapping regions. The work is:
+(1) a per-commit rebase with three known conflict sites resolved by explicit
+rules, (2) one small semantic coupling fix main introduced
+(`claude_fresh_prealloc` threading through the REST gate outcome), (3) test
+hardening against the flipped `FRESHELL_CODEX_MANAGED_LAUNCH` default, (4) one
+new managed-path gate test proving gate-before-plan ordering, (5) breaker
+bookkeeping re-verification, (6) docs reconciliation, (7) full verification.
+
+**Tech Stack:** Rust workspace (tokio, axum, tokio-tungstenite; CI pins Rust
+1.96.0), React/TypeScript client (vitest via a shared test coordinator),
+JSON-schema wire contract regenerated by `npm run contract:generate`.
+
+## Global Constraints
+
+- Work ONLY in the existing worktree `/home/dan/code/freshell/.worktrees/resume-validation` on branch `feat/resume-validation`. Do NOT create a new worktree or branch (backup branches excepted).
+- Rebase target is `origin/main` which MUST resolve to `39010cb57`; verify before rebasing.
+- Do NOT push, do NOT open a PR, do NOT merge to main, do NOT deploy.
+- Do NOT touch the live Rust server on port 3002 (never restart it; building is fine; do not `cargo build --release -p freshell-server` from the main checkout).
+- Commit author must be `Dan Shapiro <3732858+danshapiro@users.noreply.github.com>` (never `dan@danshapiro.com`). Conventional Commits with scope (e.g. `fix(ws):`, `docs(plans):`, `test(ws):`).
+- Broad JS test runs go through the shared coordinator gate: use the public npm scripts (`npm run check`, `npm run test:unit`, etc.) with `FRESHELL_TEST_SUMMARY="<why>"` set; check `npm run test:status` first; never kill a foreign gate holder; never run raw `npx vitest` for broad runs. Targeted single-file runs (`npm run test:unit -- <file>`) are delegated (no gate) and fine.
+- `cargo clippy` must use `--workspace --all-targets -- -D warnings` (CI convention). `cargo fmt --all --check` is CI-enforced.
+- TDD for NEW code (Tasks 2, 4, 5): failing/proving test first. The mechanical rebase (Task 1) is verified by compile + existing suites, not new tests.
+- Contract rule: `port/contract/*.schema.json` is regenerated via `npm run contract:generate`, never hand-edited. The branch touches `freshell-protocol` + `shared/ws-protocol.ts`, so the contract check in Task 7 is mandatory.
+- Known main-side caveat: `test/e2e/terminal-font-settings.test.tsx` was reported failing on main (second-hand). If it fails during `npm run check`, note it and move on — do not chase it. It is NOT run by `npm run test:unit`/`test:client`.
+- Semantics precedence: preserve main's semantics for everything S5/#582/#584 added; preserve the branch's gate semantics (definitively-absent → spawn fresh + notice + retire stale ref; unreadable/unsure → FAIL OPEN). Gate must run BEFORE codex managed-launch planning at every door so a stale-id resume never consumes a sidecar planning slot.
+
+---
+
+## Background facts (verified 2026-07-30; cite these instead of re-deriving)
+
+Ground truth gathered by three independent investigations of the worktree and
+main. An implementer should trust-but-spot-check line numbers (they drift);
+the structural facts are load-bearing.
+
+**The branch** (forked from `ca1a60d3`; 17 feature/style commits
+`0d877c1f2..f9b8aa33f`, +5648/−83 across 26 code files, topped by a run of
+docs-only plan commits — `948e52b5f` adds this plan and every later
+`docs(plans):`/`docs:` commit revises it. The docs run GROWS each time this
+plan is amended, so no step below hard-codes the total commit count: Task 1
+Step 1 measures it as `N` and every later count gate is expressed relative
+to `N`):
+
+- Door 1 (WS `terminal.create` restore): `crates/freshell-ws/src/terminal.rs:1799–1885` inside `handle_create` (@1412), keyed on `resume_id_from_wire`; must sit AFTER the D7 liveness guard and BEFORE the amplifier `ensure_session` re-stub. Emits `notice:` on the `TerminalCreated` frame (~:2704).
+- Door 2 (auto-resume respawn): `terminal.rs:2810–2884` inside `respawn_agent_terminal` (@2779); replaces the locals so post-spawn bookkeeping records the fresh id; rekeys `ensure_session` from `req.session_id` to the gate-validated local (:3005–3024). No `notice` — broadcasts `terminal.status{Recovering, reason}`.
+- Door 3 (freshagent REST): `crates/freshell-freshagent/src/terminal_tabs.rs:853–933` inside `spawn_terminal_pane` (@788), sidecar-liveness arm at :874–893; sits BEFORE the D7-REST guard and well before the spawn-gate permit acquire. Notice rides `paneContent["reconcileNotice"]`.
+- Pure policy: `crates/freshell-platform/src/resume_gate.rs` — `ResumeExistence{Present,Absent,Unknown}`, `ResumeGateDecision{Proceed,SpawnFresh}`, `evaluate_resume_gate`, `stale_resume_notice`, `ResumeProbeAnswer`, `ResumeProbeFn`.
+- Shared validation: `crates/freshell-ws/src/resume_validation.rs` (258 lines). Probes: `freshell-server/src/existence.rs` (+161), new `existence_by_id.rs`, `freshell-sessions/src/amplifier_stub.rs` (+63), `exists_for_gate` trait extension in `freshell-ws/src/existence.rs`.
+- Ledger: `RetiredReason::SessionMissing` + `retire_missing`.
+- Protocol: optional `notice` on `TerminalCreated` (`freshell-protocol/src/server_messages.rs:961–968`, `shared/ws-protocol.ts:730–734`, regenerated schema).
+- Client: `src/components/TerminalView.tsx` +15 in the `terminal.created` handler — extraction (~:4264), persisted-ref clearing (~:4277), one-shot `writeLocalXtermNotice` render (~:4343). This is an xterm write, NOT a banner component.
+- DEV-0010 ledger entry: `port/oracle/DEVIATIONS.md`, inserted before the `## E2E-discovered intentional divergences (EDEV-xx)` header; `status: proposed`.
+
+**Main since the fork** (`ca1a60d3..39010cb57`):
+
+- #582: flap-loop circuit breaker, `terminal.autoResumeCancel`, `RuntimeStatus::Exited`, `resumeCycles` protocol field, `auto_resume_cancels` bookkeeping on `WsState`, `acquire_uncancellable` on the spawn gate, client crash-trace/breaker banner (`src/components/TerminalExitBanner.tsx` — a strict 3-way precedence chain: `notice` → `settledDead` → `crashTrace` → `null`).
+- `ef3014bab` pattern: every `WsState` struct literal needs `auto_resume_cancels: Default::default(),` (placed adjacent to `auto_resume_tx`); every `TerminalStatus { .. }` literal needs `resume_cycles: None` (or `Some(n)` for breaker settles). `HubConfig` gained `max_cycles` + `cycle_window_ms`; `CrashContext` gained `recent_cycles` + `max_cycles`; `emit_settled` gained a 3rd arg; `codex_association::maybe_arm` gained a 6th arg (`managed_codex: bool`).
+- `0b3082cb1` pattern: tests that create a codex terminal but exercise the plain-CLI path pin the flag OFF as the FIRST statement of the test body (exact code in Task 3). `set_var("0")`, never `remove_var` — unset now means MANAGED ON (`codex_managed_launch_enabled(v) => v != Some("0")`, `crates/freshell-codex/src/launch_plan.rs:62–64`).
+- S5 (`4d99b3c3a`): every codex create/resume plans a managed launch (sidecar app-server + `CodexRemoteProxy`; TUI argv gets `--remote ws://…` tokens; on managed RESUME the `resume <id>` pair rides LAST in argv). 2-slot planning budget (`CODEX_SIDECAR_PLAN_CONCURRENCY: usize = 2`, enforced inside `plan_create_with_retry`). REST door: codex plan at `terminal_tabs.rs:1287–1327`, spawn-gate `acquire_uncancellable` at `:1513–1550` (permit AFTER plan, inside `settle_gated_create`). WS mirror: `terminal.rs:2911–2938`.
+- S5 test seams: (5a) WS/e2e — `crates/freshell-ws/tests/codex_managed_launch_e2e.rs`: `CODEX_CMD` → generated node dispatcher script (`:78–116`) that runs `test/fixtures/coding-cli/codex-app-server/fake-app-server.mjs` when argv contains `app-server`, else dumps argv JSON to `$CODEX_ARGV_CAPTURE_PATH` and stays alive; real codex `CliCommandSpec` with `env_var: Some("CODEX_CMD")` (`:60–76`); `#[ignore]` host gate; run with `--ignored --test-threads=1`. (5b) crate-level — `freshell-codex/tests/launch_lifecycle.rs`: `FakeRuntime` DI + `with_plan_budget`, `#![cfg(feature = "real-transport")]`.
+- #584: `PaneIdentityBinder` seam; REST creates write identity rows + ledger bindings. `derive_resume_identity` in `terminal_tabs.rs` now returns a 3-tuple (adds `session_ref_locator_present`) and there is a `should_preallocate_fresh_claude` mint feeding a PIN 2 pre-spawn ledger write/delete.
+- `resolve_coding_cli_command` remains the SOLE resume-argv constructor, called only behind the three doors — the branch's door model still holds.
+
+**Conflict surface** (from a real `rebase --onto` trial in a throwaway clone —
+13/17 commits replay clean — re-validated 2026-07-30 by a second full rebase
+executed per THIS plan's rules: post-fold 15/17 replayed clean, stops only at
+the two predicted commits, and main.rs auto-merged at stop 2):
+
+| Replay commit | Conflicts in | Character |
+|---|---|---|
+| #11 `65c938aad` | `crates/freshell-protocol/tests/roundtrip.rs` | Trivial: both sides appended `#[test]` fns at the same anchor (brace-straddle). Keep both groups. |
+| #14 `777eb7542` | `crates/freshell-freshagent/src/lib.rs` | Trivial: both appended `with_*` builders after `with_session_identity`. Keep all four. |
+| #14 `777eb7542` | `crates/freshell-freshagent/src/terminal_tabs.rs` | The real work — 2 hunks (rules in Task 1 Step 6). |
+| #14 `777eb7542` | `crates/freshell-server/src/main.rs` | Hidden from endpoint merge-tree: branch hoists `session_existence` out of the `WsState` literal; main inserts `auto_resume_cancels` into it. Take the hoist, re-insert main's field. |
+| #15 `2b5f46c6e` | (fmt sweep) | Conflicts iff #14's resolution reflows swept regions (it will). Eliminated by fixup-folding #15 into #14 BEFORE the rebase (Task 1 Step 3). |
+
+`crates/freshell-ws/src/terminal.rs` does NOT conflict textually — main's S5
+hunks and the branch's hunks are disjoint. The trial-merged blob already has
+correct ordering: door-1 gate (~:1810) precedes the codex plan (~:2112);
+respawn gate (~:2836) → plan (~:2913) → `acquire_uncancellable` (~:3099).
+Task 4's test pins this ordering; do not relocate anything in terminal.rs.
+
+**One semantic coupling neither side wrote:** the branch's `RestResumeOutcome`
+deliberately omitted a fresh-claude preallocation flag ("the REST pipeline has
+no fresh-claude preallocation path") — #584 falsified that assumption. After a
+gate-fired claude fallback, `resume_session_id` is already minted, so main's
+`should_preallocate_fresh_claude` returns false and the PIN 2 pre-spawn ledger
+write is silently skipped. Task 2 fixes this with TDD.
+
+---
+
+## File Structure
+
+Files this reconciliation creates or modifies (beyond what the rebase replays):
+
+- Modify: `crates/freshell-freshagent/src/terminal_tabs.rs` — conflict resolution (Task 1); `claude_fresh_prealloc` on `RestResumeOutcome` + its test (Task 2); flag pin in one test (Task 3).
+- Modify: `crates/freshell-freshagent/src/lib.rs` — conflict resolution only (Task 1).
+- Modify: `crates/freshell-server/src/main.rs` — conflict resolution only (Task 1).
+- Modify: `crates/freshell-protocol/tests/roundtrip.rs` — conflict resolution (Task 1: keep both sides' tests; add `resume_cycles` fields where main's pattern requires).
+- Modify: `crates/freshell-ws/tests/resume_validation_gate.rs` — flag pin (Task 3); new managed-path harness + gate test (Task 4).
+- Modify: `crates/freshell-ws/tests/auto_resume_respawn.rs` — post-rebase adaptation + breaker bookkeeping assertion (Task 5).
+- Modify: `port/oracle/DEVIATIONS.md` — DEV-0010 reconciliation note (Task 6).
+- No changes expected: `crates/freshell-ws/src/terminal.rs` beyond what the rebase replays (its merge is conflict-free); `src/components/TerminalView.tsx` (Task 6 verifies no double-messaging, expected outcome: no code change needed).
+
+---
+
+### Task 1: Fold the fmt sweep, rebase onto `origin/main`, resolve conflicts, compile green
+
+**Files:**
+- Modify (during rebase conflict resolution): `crates/freshell-protocol/tests/roundtrip.rs`, `crates/freshell-freshagent/src/lib.rs`, `crates/freshell-freshagent/src/terminal_tabs.rs`, `crates/freshell-server/src/main.rs`
+- Modify (post-rebase initializer fixes, only if compile demands): branch-added test harnesses in `crates/freshell-ws/tests/resume_validation_gate.rs`, `crates/freshell-ws/tests/auto_resume_respawn.rs`, and any branch-added `WsState`/`TerminalStatus` literals
+
+**Interfaces:**
+- Consumes: nothing from earlier tasks (first task).
+- Produces: branch `feat/resume-validation` rebased onto `39010cb57`, workspace compiling, with `RestResumeOutcome`, `validate_rest_resume`, `spawn_terminal_pane`'s gate block, and `derive_resume_identity`'s 3-tuple all coexisting. Later tasks rely on: `derive_resume_identity` returning main's 3-tuple `(resume_session_id, accepted_session_ref, session_ref_locator_present)` (exact names per main — verify at resolution time), the branch's gate block still keyed on the derived resume id, and `settle_gated_create`'s plan-then-`acquire_uncancellable` order untouched.
+
+- [ ] **Step 1: Preconditions and safety snapshot**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git status --short            # MUST be empty; halt if not
+git fetch origin
+git rev-parse origin/main     # MUST print 39010cb57... ; halt if not
+git branch backup/resume-validation-pre-rebase-2026-07-30
+N=$(git log --oneline ca1a60d3..HEAD | wc -l); echo "N=$N"   # record N = 17 feature/style commits + the docs-only plan commits on top (20 at the time of this revision; +1 for every later plan amendment)
+git log --format='%h %s' ca1a60d3..HEAD | head -n "$((N - 17))"   # MUST all be docs-only plan commits (docs:/docs(plans): …, touching only docs/plans/**)
+git log --format='%h %s' ca1a60d3..HEAD | sed -n "$((N - 16))p"   # MUST be f9b8aa33f fix(resume-validation): confine the ~1s codex rollout walk to gate callers via exists_for_gate
+```
+
+Expected: clean tree, `39010cb57…`, and the structural check holds: exactly
+`N − 17` docs-only plan commits sit above the feature tip `f9b8aa33f`. HALT
+if any of those top lines is not a docs-only plan commit, or if the
+`N − 16`th line is not `f9b8aa33f` — the 17-feature-commit floor is
+load-bearing for every count gate below. Record `N`; Steps 3/9 and Task 7
+Step 5 are expressed relative to it. If `origin/main` moved past
+`39010cb57`, STOP and surface it — the spec pins this exact target.
+
+- [ ] **Step 2: Confirm the fmt-sweep commit is adjacent to its parent**
+
+```bash
+git log --oneline --reverse ca1a60d3..HEAD | sed -n '14,15p'
+```
+
+Expected output (order matters — `777eb7542` then `2b5f46c6e`):
+
+```
+777eb7542 feat(resume-validation): gate freshagent REST create pipeline on disk existence
+2b5f46c6e style(resume-validation): cargo fmt sweep + sidecar-liveness doc comment placement
+```
+
+- [ ] **Step 3: Fold `2b5f46c6e` (fmt sweep) into `777eb7542` as a fixup**
+
+Rationale: the trial rebase showed #15 conflicts only because #14's resolution
+reflows the swept regions; folding eliminates that conflict entirely. The
+fixup discards only the `style:` message; its content survives inside #14.
+
+```bash
+GIT_SEQUENCE_EDITOR='sed -i "s/^pick 2b5f46c6e/fixup 2b5f46c6e/"' git rebase -i ca1a60d3
+git log --oneline ca1a60d3..HEAD | wc -l   # expect N − 1 (the fold removed exactly one commit; N from Step 1)
+```
+
+Expected: rebase completes with no conflicts (pure history rewrite of adjacent
+commits). If it DOES conflict, `git rebase --abort` and instead proceed to
+Step 4 without folding, resolving #15's fmt conflicts during replay by running
+`cargo fmt --all` and `git add -u` at that stop.
+
+- [ ] **Step 4: Start the rebase onto main**
+
+```bash
+GIT_EDITOR=true git rebase origin/main
+```
+
+(`GIT_EDITOR=true` keeps every `git rebase --continue` non-interactive — use
+it on the continues too.)
+
+Expected: replays commits until the first stop. Two stops are expected:
+`65c938aad` (roundtrip.rs) and `777eb7542` (lib.rs + terminal_tabs.rs, and
+POSSIBLY main.rs — in the 2026-07-30 validation rebase main.rs auto-merged
+correctly, so stop 2 may show 2 or 3 conflicted files; either way verify
+main.rs content per Step 6(b)). If any OTHER commit stops, resolve by the same precedence rule
+(main's S5/#582/#584 semantics + branch's gate semantics, both preserved) and
+record what happened for the commit message in Step 9.
+
+- [ ] **Step 5: Resolve stop 1 — `crates/freshell-protocol/tests/roundtrip.rs`**
+
+Both sides appended tests at the end of the file; the conflict is a
+brace-straddle. Resolution: keep BOTH groups, in this order — main's
+`terminal_status_exited_settle_frame` and `terminal_auto_resume_cancel`
+(already in the base since they're upstream now) plus the branch's
+`terminal_created_notice_is_optional_and_additive` and
+`terminal_created_roundtrips_with_and_without_notice`. Concretely: edit the
+file so every `#[test]` fn from both sides appears exactly once and the final
+`}` count balances. If the branch's tests construct any `TerminalStatus`
+literal, add `resume_cycles: None,` (main's `ef3014bab` pattern; main's own
+examples are at `roundtrip.rs:494–501`). Then:
+
+```bash
+cargo test -p freshell-protocol --test roundtrip
+git add crates/freshell-protocol/tests/roundtrip.rs
+GIT_EDITOR=true git rebase --continue
+```
+
+Expected: all roundtrip tests pass before continuing.
+
+- [ ] **Step 6: Resolve stop 2 — three files, by rule**
+
+**(a) `crates/freshell-freshagent/src/lib.rs`** — keep all four builders:
+main's `with_pane_identity_binder` AND the branch's `with_resume_probe`,
+`with_on_stale_resume`, `with_sidecar_liveness`, all after
+`with_session_identity`. The struct fields and `Default` impl auto-merged with
+all four present — verify they did.
+
+**(b) `crates/freshell-server/src/main.rs`** — NOTE: in the 2026-07-30
+validation rebase this file AUTO-MERGED correctly; if it did not conflict,
+still open it and verify the merged result matches this rule before
+continuing. Take the branch's hoist of the
+probe construction (`session_existence` built in a `let` BEFORE the `WsState`
+literal) and re-insert main's field into the literal:
+
+```rust
+        auto_resume_cancels: Default::default(),
+```
+
+placed adjacent to `auto_resume_tx`. Keep the branch's final
+`fresh_agent_state` rebinding above the literal. Main's reference literal is at
+`crates/freshell-server/src/main.rs:575` on `39010cb57` if you need the exact
+surrounding shape.
+
+**(c) `crates/freshell-freshagent/src/terminal_tabs.rs`** — two hunks:
+
+*Hunk A (in `spawn_terminal_pane`, after cwd validation, merged region
+~:874–982):* main rewrote `derive_resume_identity` to return a 3-tuple (adding
+`session_ref_locator_present`) and added the `should_preallocate_fresh_claude`
+mint; the branch kept the 2-tuple binding `mut accepted_session_ref` and
+inserted the door-3 gate. Resolution shape (adapt names to what main actually
+uses — read main's version of the region first with
+`git show 39010cb57:crates/freshell-freshagent/src/terminal_tabs.rs | sed -n '850,1000p'`):
+
+```rust
+// 1. MAIN's identity derivation, verbatim (3-tuple + locator flag).
+//    KEEP `mut` on accepted_session_ref — the branch's gate block clears it
+//    on SpawnFresh (the 2026-07-30 validation rebase confirmed the merged
+//    binding needs `mut accepted_session_ref` to compile):
+let (mut resume_session_id, mut accepted_session_ref, session_ref_locator_present) =
+    derive_resume_identity(/* main's args, verbatim */);
+
+// 2. BRANCH's door-3 gate block, verbatim, immediately after derivation and
+//    BEFORE the D7-REST guard: two-arm liveness check (registry
+//    live_session_owner + state.sidecar_liveness probe), then
+//    spawn_blocking(validate_rest_resume), then on SpawnFresh:
+//    clear the stale accepted_session_ref, call on_stale_resume
+//    (retire_missing), set resume_notice, and adopt the outcome's
+//    resume_session_id / launch intent.
+
+// 3. MAIN's should_preallocate_fresh_claude mint, verbatim, AFTER the gate —
+//    so a gate-minted claude id is what the prealloc logic sees.
+```
+
+The load-bearing rules: the gate stays BEFORE the D7-REST guard (branch
+invariant, documented inline in the branch code) and BEFORE
+`settle_gated_create` is spawned (so gate → codex plan → permit acquire holds
+without relocating main's acquire — main moved the permit acquire INSIDE
+`settle_gated_create` after the plan, at :1513–1550, and that must stay).
+
+*Hunk B (merged region ~:1531–1557, `CliLaunchInputs.launch_intent`):* main
+hardcodes `if claude_fresh_prealloc { LaunchIntent::Start } else { LaunchIntent::Resume }`;
+the branch threads the intent from the gate outcome. Reconcile as:
+
+```rust
+launch_intent: if claude_fresh_prealloc {
+    freshell_platform::LaunchIntent::Start
+} else {
+    launch_intent // the branch's variable threaded from the gate outcome
+},
+```
+
+(A gate-fired claude fallback yields `Start` via the outcome anyway; the
+prealloc override only matters for main's no-resume-id mint path. Task 2
+reconciles the deeper `claude_fresh_prealloc` coupling — do NOT attempt it in
+this task; just make both sides' code coexist and compile.)
+
+Then:
+
+```bash
+cargo check -p freshell-freshagent
+git add crates/freshell-freshagent/src/lib.rs crates/freshell-freshagent/src/terminal_tabs.rs crates/freshell-server/src/main.rs
+GIT_EDITOR=true git rebase --continue
+```
+
+(Do NOT gate this stop on `cargo check -p freshell-server`: mid-rebase it
+fails with one KNOWN E0063 — freshell-ws's `TerminalStatus` literal at
+`terminal.rs:~2881` lacks `resume_cycles` until Step 7's sweep. That error is
+expected here; only `freshell-freshagent` must check clean before continuing.)
+
+Expected: rebase runs to completion (remaining commits replay clean — the
+2026-07-30 validation rebase replayed every remaining commit, including
+`f9b8aa33f` and the docs tip `948e52b5f`, clean after this resolution).
+
+- [ ] **Step 7: Post-rebase initializer sweep (main's `ef3014bab` pattern)**
+
+```bash
+cargo check --workspace --all-targets 2>&1 | head -50
+```
+
+Expected: either clean, or `missing field` errors in branch-added literals.
+The 2026-07-30 validation rebase produced exactly THREE such errors, all
+in-pattern: `TerminalStatus` missing `resume_cycles` at
+`crates/freshell-ws/src/terminal.rs:~2881`, and `WsState` missing
+`auto_resume_cancels` in the two branch test harnesses
+(`resume_validation_gate.rs` ~:123, `auto_resume_respawn.rs` ~:369). Anything
+OUTSIDE the pattern below is unexpected — investigate before hacking at it.
+Fix every one mechanically:
+
+- `WsState { .. }` literals (branch harnesses `resume_validation_gate.rs`
+  `spawn_server_with_probe` ~:96, `auto_resume_respawn.rs`
+  `respawn_state_with_probe` ~:345): add `auto_resume_cancels: Default::default(),`
+  adjacent to `auto_resume_tx`.
+- `TerminalStatus { .. }` literals: add `resume_cycles: None,`.
+- `HubConfig` literals: add `max_cycles` + `cycle_window_ms`; `CrashContext`
+  literals: add `recent_cycles` + `max_cycles` — copy defaults from main's own
+  helpers at `crates/freshell-ws/src/auto_resume.rs:909–932`.
+- If branch code calls `emit_settled` or `codex_association::maybe_arm`, match
+  main's new arities (`maybe_arm` 6th arg is `managed_codex: bool`; pass the
+  value main's adjacent call sites pass for a non-managed spawn, i.e. derived
+  from the launch plan presence — mirror main's nearest call site verbatim).
+
+Repeat `cargo check --workspace --all-targets` until clean.
+
+- [ ] **Step 8: Run the branch's own suites + fmt**
+
+```bash
+cargo fmt --all
+cargo test -p freshell-platform resume_gate
+cargo test -p freshell-ws --lib resume_validation
+cargo test -p freshell-server existence
+cargo test -p freshell-sessions amplifier_stub
+cargo test -p freshell-ws --test resume_validation_gate
+cargo test -p freshell-freshagent --lib
+```
+
+Expected: all pass EXCEPT possibly (a) the two codex-terminal tests fixed in
+Task 3 — if `restore_true_sidecar_live_absent_legacy_resume_id_fails_open` or
+`rest_gate_skips_sidecar_live_candidate_create_proceeds_unchanged` fail by
+attempting a managed codex launch, note it and proceed (Task 3 fixes them; do
+not fix here), and (b) `rest_gate_fire_heals_pane_content_ref_and_injects_notice`
+if the PIN 2 coupling surfaces — Task 2 owns that. Any OTHER failure must be
+fixed in this task before committing.
+
+- [ ] **Step 9: Commit the reconciliation residue**
+
+The replayed commits (`N − 1` post-fold, or `N` if Step 3's fold was skipped
+per its fallback; N from Step 1) are already committed by the rebase. Commit the Step 7
+initializer fixes + Step 8 fmt as one focused commit:
+
+```bash
+git add -A
+git status --short   # review: only test-harness literals + fmt churn expected
+git commit -m "rebase(resume-validation): reconcile with main @ 39010cb57 (S5 managed launch, #582 breaker, #584 identity)
+
+Fold main's post-fork struct/initializer fields (auto_resume_cancels,
+resume_cycles, HubConfig/CrashContext breaker fields) into branch-added
+harnesses and literals after replaying onto origin/main."
+```
+
+If Step 7 required zero changes, skip this commit (the rebase alone is the
+deliverable; `git log` shows the replayed commits atop `39010cb57`).
+
+Final check: `git log --oneline origin/main..HEAD | wc -l` prints `N − 1`
+(fold done, no residue commit) or `N` (fold done + residue commit, or fold
+skipped without residue) — `N + 1` only in the fold-skipped-AND-residue
+case — and `git merge-base origin/main HEAD` prints `39010cb57…`.
+
+---
+
+### Task 2: Thread `claude_fresh_prealloc` through the REST gate outcome (PIN 2 coupling)
+
+**Files:**
+- Modify: `crates/freshell-freshagent/src/terminal_tabs.rs` (struct `RestResumeOutcome`, fn `validate_rest_resume`, the `spawn_terminal_pane`/`settle_gated_create` consumer, and `mod tests`)
+
+**Interfaces:**
+- Consumes: Task 1's reconciled `terminal_tabs.rs` — `RestResumeOutcome` (the branch's gate-outcome struct returned by `validate_rest_resume`), main's `should_preallocate_fresh_claude` + PIN 2 pre-spawn ledger write/delete, and the WS door's existing `if outcome.claude_fresh_prealloc { … }` mirror in `crates/freshell-ws/src/resume_validation.rs` / `terminal.rs` (the WS-side outcome already carries this flag — read it as the reference pattern).
+- Produces: `RestResumeOutcome.claude_fresh_prealloc: bool` — true when the gate minted a fresh claude id; REST consumer treats it exactly like main's natural fresh-claude prealloc (PIN 2 ledger write/delete fires).
+
+Why: main's `should_preallocate_fresh_claude` checks "no resume id" to decide
+the PIN 2 pre-spawn identity write. A gate-fired claude fallback ALREADY has a
+minted `resume_session_id`, so the check returns false and the fresh pane
+would skip the pre-spawn ledger binding that every other fresh claude pane
+gets — a silent #584 regression.
+
+- [ ] **Step 1: Write the failing test**
+
+Add to `mod tests` in `crates/freshell-freshagent/src/terminal_tabs.rs`,
+directly after `rest_gate_fire_heals_pane_content_ref_and_injects_notice`
+(~:4200 pre-rebase; find it by name). Model the harness on that neighbor test
+verbatim (same server/probe setup — it already exercises a claude REST create
+whose gate fires) — BUT note the neighbor cannot observe PIN 2 by itself: the
+PIN 2 write is `if let Some(binder)`-gated on the optional `pane_identity`
+seam (main terminal_tabs.rs:1560–1572; `None` = legacy no-write, :1150–1155),
+and the neighbor wires no binder. There is NO `bindings_for_session` API.
+Observe the write the way main's own #584 tests do: wire a `RecordingBinder`
+(defined in this module on main, ~:3912) via
+`state.with_pane_identity_binder(binder.clone())` (main's wiring at
+~:3967–3969) and assert on `binder.events()`:
+
+```rust
+#[tokio::test(flavor = "multi_thread")]
+async fn rest_gate_fired_claude_fallback_preallocates_fresh_identity() {
+    // Same arrangement as rest_gate_fire_heals_pane_content_ref_and_injects_notice:
+    // claude REST create carrying a stale resume id, probe answers
+    // Absent + ever_observed_on_disk=true, gate fires and mints a fresh id.
+    // (Copy that test's setup verbatim, through the create call.)
+
+    // NEW vs the neighbor: wire the #584 identity seam so the PIN 2 write is
+    // observable (the write is skipped entirely when no binder is wired):
+    //   let binder = RecordingBinder::default();           // main's test double, ~:3912
+    //   ... state = state.with_pane_identity_binder(binder.clone());  // main's wiring, ~:3967-3969
+    // Then, after the create completes and the gate has fired:
+    // 1. Extract the minted id from the healed pane content / notice, as the
+    //    neighbor test already does.
+    // 2. The gate-minted fresh claude pane must get the same PIN 2 pre-spawn
+    //    treatment as a natural fresh claude create — assert on the binder's
+    //    recorded events exactly like main's #584 tests (~:3964-4010):
+    let minted = /* extracted minted id, as neighbor test does */;
+    let events = binder.events();
+    assert!(
+        events.iter().any(|e| e == &format!("prespawn:{tid}:{minted}")),
+        "gate-minted fresh claude id must receive the PIN 2 pre-spawn identity binding: {events:?}"
+    );
+    // Mirror main's ordering/negative assertions too: the prespawn event
+    // precedes the register event for the same terminal, and no `delete:`
+    // event fired (the spawn succeeded).
+}
+```
+
+Copy the `RecordingBinder` usage and event-string shapes from main's own #584
+tests in this module (main @ 39010cb57 `terminal_tabs.rs` ~:3912 for the
+double, ~:3967–3969 for wiring, ~:3964–4010 for the assertion patterns) — do
+not invent a new API. There is no ledger-query path for this: PIN 2 is only
+observable through the binder seam.
+
+- [ ] **Step 2: Run it — verify it fails for the right reason**
+
+```bash
+cargo test -p freshell-freshagent --lib rest_gate_fired_claude_fallback_preallocates_fresh_identity
+```
+
+Expected: FAIL on the `prespawn:` assertion (no PIN 2 write happened — the
+prealloc predicate sees the gate-minted `Some(id)` and returns false),
+NOT a compile error or harness panic. If it PASSES, main's prealloc logic
+already covers the gate path — investigate (read the prealloc condition); if
+genuinely covered, delete the redundant plumbing plan for Steps 3–4, keep the
+test as the pin, and commit just the test with an explanatory message.
+
+- [ ] **Step 3: Implement — add the field and honor it**
+
+In `RestResumeOutcome` (the struct `validate_rest_resume` returns):
+
+```rust
+    /// True when the gate minted a fresh claude id as an absence fallback.
+    /// The REST consumer must run the PIN 2 pre-spawn ledger write exactly
+    /// as a natural fresh-claude create would (main #584), even though a
+    /// resume_session_id is present (it is minted, not resumed).
+    pub claude_fresh_prealloc: bool,
+```
+
+Set it in `validate_rest_resume` at the claude-absence-fallback arm (the arm
+that mints a v4 id and sets `LaunchIntent::Start` — the branch's
+`rest_resume_minted_claude_id_is_v4_and_plausible` test pins that arm); `false`
+in every other constructor site. In the consumer, fold it into main's flag:
+
+```rust
+let claude_fresh_prealloc =
+    should_preallocate_fresh_claude(/* main's args, unchanged */)
+        || gate_outcome_claude_fresh_prealloc; // from the RestResumeOutcome
+```
+
+so PIN 2 and Hunk B's `launch_intent` override both see it. Mirror the WS
+door's existing `if outcome.claude_fresh_prealloc { … }` handling — same
+field name, same semantics (the branch's WS door already does this exact
+OR-fold at branch `terminal.rs:1857–1858` — that is the reference).
+
+CRITICAL placement rule (verified 2026-07-30): the folded flag must NOT
+re-key main's MINT decision (`should_preallocate_fresh_claude` feeding the
+mint at main `terminal_tabs.rs:~810–811`) — a gate-fired create already
+carries the gate-minted id, and re-minting would overwrite it with a second
+UUID. Keep the mint on main's raw predicate; use the FOLDED flag only for
+the PIN 2 pre-spawn write (~:1560), the failure-path delete (~:1628), and
+the `launch_intent` override (~:1360).
+
+- [ ] **Step 4: Run the test — verify it passes, plus neighbors**
+
+```bash
+cargo test -p freshell-freshagent --lib rest_gate
+cargo test -p freshell-freshagent --lib rest_resume
+```
+
+Expected: PASS, including all pre-existing `rest_gate_*` / `rest_resume_*`
+tests (the fold must not fire PIN 2 for non-gate paths — `|| false` is inert).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-freshagent/src/terminal_tabs.rs
+git commit -m "fix(freshagent): run PIN 2 prealloc for gate-minted fresh claude ids
+
+Main #584 added should_preallocate_fresh_claude keyed on 'no resume id';
+a gate-fired claude fallback carries a minted id and silently skipped the
+pre-spawn ledger binding. Thread claude_fresh_prealloc through
+RestResumeOutcome and OR it into the prealloc decision."
+```
+
+---
+
+### Task 3: Pin `FRESHELL_CODEX_MANAGED_LAUNCH=0` in the branch's plain-CLI codex tests
+
+**Files:**
+- Modify: `crates/freshell-ws/tests/resume_validation_gate.rs` (test `restore_true_sidecar_live_absent_legacy_resume_id_fails_open`, ~:500)
+- Modify: `crates/freshell-freshagent/src/terminal_tabs.rs` (test `rest_gate_skips_sidecar_live_candidate_create_proceeds_unchanged`, ~:4324; also Task 2's new test if it spawns codex — it doesn't, it's claude; and any test found in Step 1)
+
+**Interfaces:**
+- Consumes: Task 1's rebased tree (the flag default flipped to ON there).
+- Produces: nothing structural — test hardening only.
+
+Why: unset now means MANAGED ON. Unpinned, these tests spawn the real `codex`
+binary from PATH post-flag-flip: `PTY_SPAWN_FAILED` + ~5×226s retry burn on
+codex-less hosts, real `~/.codex` sidecars on dev hosts.
+
+- [ ] **Step 1: Enumerate every branch test that creates a codex terminal**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git diff --name-only ca1a60d3..HEAD -- '*test*' '*tests*'
+grep -rn '"codex"' crates/freshell-ws/tests/resume_validation_gate.rs crates/freshell-ws/tests/auto_resume_respawn.rs
+grep -n 'mode.*codex\|"codex"' crates/freshell-freshagent/src/terminal_tabs.rs | grep -in test
+grep -rn 'FRESHELL_CODEX_MANAGED_LAUNCH' crates/freshell-ws/tests/resume_validation_gate.rs crates/freshell-ws/tests/auto_resume_respawn.rs crates/freshell-freshagent/src/terminal_tabs.rs
+```
+
+Expected per the pre-plan investigation: exactly two codex-terminal-creating
+branch tests, neither pinned — `restore_true_sidecar_live_absent_legacy_resume_id_fails_open`
+(`resume_validation_gate.rs:500`, sleeper CLI spec + freshcodex sidecar) and
+`rest_gate_skips_sidecar_live_candidate_create_proceeds_unchanged`
+(`terminal_tabs.rs:4324`, recording CLI spec, real spawn). If the grep finds
+MORE, pin every one the same way.
+(`rest_resume_codex_absent_drops_resume` is a pure-function test — no pin.)
+
+- [ ] **Step 2: Add the pin — main's `0b3082cb1` pattern verbatim**
+
+First statement of each test body. In `resume_validation_gate.rs:~500`:
+
+```rust
+    // DEV-0006 S5.e: the managed-launch default is ON; this suite exercises the
+    // plain-CLI codex path (sleeper CLI spec, no app-server), so pin OFF.
+    std::env::set_var("FRESHELL_CODEX_MANAGED_LAUNCH", "0");
+```
+
+In `terminal_tabs.rs:~4324`:
+
+```rust
+    // DEV-0006 S5.e: the managed-launch default is ON; this suite exercises the
+    // plain-CLI codex path (recording CLI spec, no app-server), so pin OFF.
+    std::env::set_var("FRESHELL_CODEX_MANAGED_LAUNCH", "0");
+```
+
+Use `set_var("0")`, NOT `remove_var` — unset means managed ON.
+
+- [ ] **Step 3: Verify the pin holds against a hostile ambient environment**
+
+```bash
+CODEX_CMD=/nonexistent-codex-binary cargo test -p freshell-ws --test resume_validation_gate restore_true_sidecar_live_absent_legacy_resume_id_fails_open
+```
+
+(Note: this test sets `CODEX_CMD` itself mid-test; the ambient value proves
+nothing leaks before that point.) And:
+
+```bash
+FRESHELL_CODEX_MANAGED_LAUNCH=1 cargo test -p freshell-freshagent --lib rest_gate_skips_sidecar_live_candidate_create_proceeds_unchanged
+```
+
+Expected: both PASS (the in-test `set_var("0")` overrides the ambient `1`),
+quickly — no 226s retry stalls.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add crates/freshell-ws/tests/resume_validation_gate.rs crates/freshell-freshagent/src/terminal_tabs.rs
+git commit -m "test: pin FRESHELL_CODEX_MANAGED_LAUNCH=0 in resume-validation plain-CLI codex tests
+
+Post S5.e the flag defaults ON; unpinned codex-terminal tests would spawn
+the real codex binary (226s retry burn on codex-less hosts). Mirrors
+0b3082cb's pin pattern."
+```
+
+---
+
+### Task 4: Managed-path gate test — a stale codex id never reaches managed planning
+
+**Files:**
+- Modify: `crates/freshell-ws/tests/resume_validation_gate.rs` (new harness helpers + one new `#[ignore]` test)
+
+**Interfaces:**
+- Consumes: Task 1's rebased `terminal.rs` (door-1 gate ~:1810 before codex plan ~:2112), the file's existing `StubProbe` + `spawn_server_with_probe` harness (~:96), and main's seam 5a pieces from `crates/freshell-ws/tests/codex_managed_launch_e2e.rs` (`write_codex_dispatcher` :78–116, `codex_cli_spec()` :60–76, `wait_for_captured_argv` :288–305).
+- Produces: `spawn_managed_codex_server_with_probe(probe)` harness variant and the pinning test `managed_default_stale_codex_id_is_gated_before_planning` — the permanent regression pin for gate-before-plan ordering.
+
+This is a CHARACTERIZATION test ("fail-or-prove"): the trial merge showed the
+ordering already survives the rebase, so the expected first run is GREEN —
+that green IS the proof. If it's red, the rebase broke ordering and must be
+fixed (in `terminal.rs`: the gate block must run before the managed-launch
+plan extraction), not the test.
+
+- [ ] **Step 1: Add the managed harness variant**
+
+In `resume_validation_gate.rs`, add (adapting the two helpers from
+`codex_managed_launch_e2e.rs` — copy their bodies verbatim, duplication
+between test binaries is the established pattern in this repo):
+
+```rust
+/// Real codex CliCommandSpec (env_var seam) — copied from
+/// codex_managed_launch_e2e.rs so the resolver takes the REAL codex branch
+/// and managed-launch planning engages.
+fn codex_cli_spec() -> freshell_platform::CliCommandSpec {
+    fn s(v: &[&str]) -> Vec<String> { v.iter().map(|x| x.to_string()).collect() }
+    freshell_platform::CliCommandSpec {
+        name: "codex".into(),
+        label: "Codex CLI".into(),
+        env_var: Some("CODEX_CMD".into()),
+        default_cmd: "codex".into(),
+        resume_args: Some(s(&["resume", "{{sessionId}}"])),
+        model_args: Some(s(&["--model", "{{model}}"])),
+        sandbox_args: Some(s(&["--sandbox", "{{sandbox}}"])),
+        ..Default::default()
+    }
+}
+
+/// Node dispatcher playing both codex roles — verbatim from
+/// codex_managed_launch_e2e.rs:78-116 (app-server argv -> run the committed
+/// fake-app-server.mjs fixture; else dump argv JSON to
+/// $CODEX_ARGV_CAPTURE_PATH and stay alive).
+fn write_codex_dispatcher() -> std::path::PathBuf {
+    let fixture = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../../test/fixtures/coding-cli/codex-app-server/fake-app-server.mjs")
+        .canonicalize()
+        .expect("fake-app-server fixture exists");
+    let dispatcher = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-dispatcher-{}.mjs",
+        std::process::id()
+    ));
+    let script = format!(
+        "#!/usr/bin/env node\n\
+         import fs from 'node:fs'\n\
+         const args = process.argv.slice(2)\n\
+         if (args.includes('app-server')) {{\n\
+           await import('file://{fixture}')\n\
+         }} else {{\n\
+           fs.writeFileSync(process.env.CODEX_ARGV_CAPTURE_PATH, JSON.stringify(args))\n\
+           setInterval(() => undefined, 1000)\n\
+         }}\n",
+        fixture = fixture.display()
+    );
+    std::fs::write(&dispatcher, script).expect("write dispatcher");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&dispatcher, std::fs::Permissions::from_mode(0o755))
+            .expect("chmod dispatcher");
+    }
+    dispatcher
+}
+```
+
+Then a harness fn modeled line-for-line on the existing
+`spawn_server_with_probe` (~:96) with exactly one difference — the CLI specs:
+
+```rust
+async fn spawn_managed_codex_server_with_probe(probe: StubProbe) -> Harness {
+    // identical to spawn_server_with_probe, except:
+    //   cli_commands: Arc::new(vec![codex_cli_spec()]),
+    // (no sleeper specs — the resolver must take the env_var codex branch)
+}
+```
+
+(If `spawn_server_with_probe` takes a `fresh_agent_enabled` arg, keep the
+same signature; pass what the codex sidecar test at :500 passes.)
+
+- [ ] **Step 2: Write the test**
+
+```rust
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "host-gated e2e (needs node + repo node_modules); mutates process env — run alone with --ignored --test-threads=1"]
+async fn managed_default_stale_codex_id_is_gated_before_planning() {
+    // Managed leg: the flag stays UNSET (default ON). remove_var, not "1",
+    // mirroring codex_managed_launch_e2e.rs's managed phases.
+    std::env::remove_var("FRESHELL_CODEX_MANAGED_LAUNCH");
+
+    let stale_id = "0b5aa1d2-9d5c-4f6e-8f2a-1c3d5e7f9a0b"; // definitively absent
+    let capture_path = std::env::temp_dir().join(format!(
+        "freshell-resume-gate-managed-argv-{}.json",
+        std::process::id()
+    ));
+    let _ = std::fs::remove_file(&capture_path);
+    let dispatcher = write_codex_dispatcher();
+    std::env::set_var("CODEX_CMD", &dispatcher);
+    std::env::set_var("CODEX_ARGV_CAPTURE_PATH", &capture_path);
+
+    // Probe: codex stale_id is POSITIVELY absent (store readable).
+    // Construct the StubProbe exactly as restore_true_amplifier_absent_spawns_fresh_with_notice
+    // does, keyed for provider "codex" answering Absent. (Do NOT try to make
+    // it return ever_observed_on_disk=true — StubProbe can't and codex
+    // doesn't need it; the codex arm gates on positive Absent alone.)
+    let probe = /* StubProbe answering Absent for (codex, stale_id) */;
+    // Hygiene: point CODEX_HOME at a temp dir so no codex-side path can ever
+    // touch the real ~/.codex (the fake app-server writes ~/.codex/sessions
+    // on turn/start when CODEX_HOME is unset; this test never sends
+    // turn/start, but pin it anyway):
+    let codex_home = std::env::temp_dir().join(format!("freshell-resume-gate-codex-home-{}", std::process::id()));
+    std::fs::create_dir_all(&codex_home).expect("codex home");
+    std::env::set_var("CODEX_HOME", &codex_home);
+    let harness = spawn_managed_codex_server_with_probe(probe).await;
+
+    // terminal.create with restore:true carrying the stale codex resume id —
+    // copy the create-message shape from
+    // restore_true_sidecar_live_absent_legacy_resume_id_fails_open (:500)
+    // (legacy resume-id carrier, mode "codex"), minus its live-sidecar
+    // arrangement: here NOTHING is live, so the gate must fire.
+
+    // 1. Gate fired: terminal.created carries the operator notice naming the stale id.
+    let created = /* read the terminal.created frame as sibling tests do */;
+    let notice = created.notice.expect("gate must set the stale-resume notice");
+    assert!(notice.contains(stale_id), "notice names the stale id: {notice}");
+
+    // 2. The FRESH spawn still went managed (default ON): the captured TUI
+    //    argv is the --remote form...
+    let argv = wait_for_captured_argv(&capture_path); // SYNC helper — no .await; copy from e2e ~:287-305
+    assert_eq!(argv[0], "--remote", "fresh spawn must still plan managed launch");
+
+    // 3. ...and the stale resume NEVER reached managed planning: on a managed
+    //    RESUME the `resume <id>` pair rides last in argv (e2e Phase 3 pins
+    //    that). Absence of both tokens proves the plan was Start-intent for a
+    //    fresh session — the stale id never consumed a sidecar planning slot.
+    assert!(
+        !argv.iter().any(|a| a == "resume") && !argv.iter().any(|a| a.contains(stale_id)),
+        "stale id must not appear in managed argv: {argv:?}"
+    );
+
+    // Cleanup (mirror e2e): kill the terminal via the harness, then
+    std::env::remove_var("CODEX_CMD");
+    std::env::remove_var("CODEX_ARGV_CAPTURE_PATH");
+    let _ = std::fs::remove_file(&capture_path);
+}
+```
+
+Fill the `/* ... */` holes by copying the concrete patterns from the named
+sibling tests in the SAME file (StubProbe construction, create-message shape,
+created-frame read) — they all exist there today; this test only recombines
+them with the seam-5a helpers.
+
+- [ ] **Step 3: Run it — prove (or fix) the ordering**
+
+```bash
+cargo test -p freshell-ws --test resume_validation_gate managed_default_stale_codex_id_is_gated_before_planning -- --ignored --test-threads=1
+```
+
+Expected: PASS — the trial merge showed door-1 gate (~:1810) precedes the plan
+(~:2112), and the 2026-07-30 oracle validation confirmed no plausible
+non-ordering red cause (codex positive-Absent takes the notice arm
+unconditionally; `--remote` argv is guaranteed for a managed START; timing/
+plan-budget can't bite a single-test run). If it FAILS with `resume`/stale-id
+tokens in argv or a missing notice: the rebase broke gate-before-plan ordering
+in `crates/freshell-ws/src/terminal.rs`. Fix by moving the branch's gate block
+to run before the managed-launch plan extraction in `handle_create`
+(preserving its documented AFTER-D7 / BEFORE-`ensure_session` constraints),
+then re-run to green. Do not weaken the assertions.
+
+- [ ] **Step 4: Confirm the non-ignored suite still passes and fmt is clean**
+
+```bash
+cargo test -p freshell-ws --test resume_validation_gate
+cargo fmt --all
+```
+
+Expected: PASS (the new test is `#[ignore]`d here; the others unaffected).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/freshell-ws/tests/resume_validation_gate.rs
+git commit -m "test(ws): pin gate-before-plan ordering under managed-default codex launch
+
+New host-gated e2e: a definitively-absent codex resume id at the WS door
+is gated (fresh spawn + notice) and never reaches managed planning — no
+resume tokens in the captured argv, so a stale id can't burn a sidecar
+planning slot. Uses S5's dispatcher/CODEX_CMD/argv-capture seam."
+```
+
+---
+
+### Task 5: Re-verify the gate against #582's circuit breaker at the respawn door
+
+**Files:**
+- Modify: `crates/freshell-ws/tests/auto_resume_respawn.rs` (adapt if needed; extend `respawn_with_absent_session_spawns_fresh_and_retires_binding`)
+
+**Interfaces:**
+- Consumes: Task 1's rebased respawn door (`respawn_agent_terminal`: gate ~:2836 → plan → `acquire_uncancellable`), main's breaker machinery (`crates/freshell-ws/src/auto_resume.rs` — `HubConfig{max_cycles, cycle_window_ms}`, settle frames carrying `resume_cycles`, `auto_resume_cancels` on `WsState`), and the branch harness `respawn_state_with_probe` (~:345).
+- Produces: an assertion pinning that a gate-fired respawn is single-counted — exactly one recovery cycle's bookkeeping, no synthetic breaker settle, cancel bookkeeping untouched.
+
+- [ ] **Step 1: Run the door-2 suite as rebased**
+
+```bash
+cargo test -p freshell-ws --test auto_resume_respawn
+```
+
+Expected: PASS. If a test fails on breaker interference (e.g. the absent-
+session test's respawn now trips `max_cycles` because the harness `HubConfig`
+defaults are tight), adapt the harness config — set `max_cycles`/
+`cycle_window_ms` to the permissive values main's own tests use
+(`auto_resume.rs:909–932` helpers) — WITHOUT weakening the branch's
+assertions (fresh spawn happened, binding retired with `SessionMissing`,
+fresh-id bookkeeping recorded). Fix-forward here, don't defer.
+
+- [ ] **Step 2: Extend the gate test with breaker-bookkeeping assertions**
+
+In `respawn_with_absent_session_spawns_fresh_and_retires_binding` (~:438),
+after its existing assertions, add — collecting broadcast frames the same way
+the test already does for its `terminal.status{Recovering}` assertion:
+
+```rust
+    // #582 interplay: a gate-fired respawn is ONE ordinary recovery cycle.
+    // (a) Exactly one Recovering status frame was broadcast for this respawn —
+    //     the gate must not add a second cycle's worth of status traffic.
+    let recovering_frames = frames
+        .iter()
+        .filter(|f| /* status == Recovering for this terminal, as the existing
+                       assertion in this test matches frames */)
+        .count();
+    assert_eq!(recovering_frames, 1, "gate-fired respawn is a single recovery cycle");
+
+    // (b) The gate itself must not emit a breaker settle: no
+    //     terminal.status{status: exited, resume_cycles: Some(_)} frame
+    //     appears as part of this respawn.
+    assert!(
+        !frames.iter().any(|f| /* status == exited && resume_cycles.is_some() */),
+        "gate must not synthesize a breaker settle frame"
+    );
+
+    // (c) auto_resume_cancels bookkeeping is untouched by the gate — the
+    //     harness state's cancel set/map remains empty (no phantom cancel).
+    assert!(
+        /* state.auto_resume_cancels is empty — use whatever accessor/lock
+           main's own auto_resume tests use to inspect it */,
+        "gate must not record a phantom autoResumeCancel"
+    );
+```
+
+Fill the frame-matching holes with the SAME matching code the test already
+uses for its existing status-frame assertion (verified 2026-07-30: the test
+subscribes BEFORE the respawn at ~:443 and drains ALL broadcast frames via
+`drain_broadcast_frames` ~:419 — settle frames ride the same bus, so no new
+collection mechanism is needed). For (c), `auto_resume_cancels` is a `pub`
+field on `WsState` (`crates/freshell-ws/src/lib.rs:~133`); read it with
+main's own idiom (main `terminal.rs:~4962–4968`):
+
+```rust
+state
+    .auto_resume_cancels
+    .lock()
+    .expect("auto_resume_cancels lock")
+    .is_empty()
+```
+
+- [ ] **Step 3: Run to green**
+
+```bash
+cargo test -p freshell-ws --test auto_resume_respawn
+```
+
+Expected: PASS. A failure of (a)/(b)/(c) is a REAL reconciliation bug at the
+respawn door (double-counting or bookkeeping bypass) — fix it in
+`respawn_agent_terminal`'s gate block (the gate replaces the resume locals; it
+must not touch breaker state or emit settle frames), then re-run.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add crates/freshell-ws/tests/auto_resume_respawn.rs
+git commit -m "test(ws): assert gate-fired respawn keeps #582 breaker bookkeeping single-counted
+
+One Recovering frame per gate-fired respawn, no synthetic breaker settle,
+auto_resume_cancels untouched. The gate reduces breaker trips (kills
+missing-session flap at the source) without masquerading as one."
+```
+
+---
+
+### Task 6: Docs reconciliation — DEV-0010, stale comments, client double-message check
+
+**Files:**
+- Modify: `port/oracle/DEVIATIONS.md` (DEV-0010 entry)
+- Verify (no change expected): `crates/freshell-ws/src/terminal.rs`, `crates/freshell-freshagent/src/terminal_tabs.rs` comment text; `src/components/TerminalView.tsx` + `src/components/TerminalExitBanner.tsx` interplay
+
+**Interfaces:**
+- Consumes: the rebased tree from Tasks 1–5.
+- Produces: DEV-0010 text acknowledging managed-launch default ON; verified absence of self-contradicting flag comments and of client double-messaging.
+
+- [ ] **Step 1: Sweep for stale flag-state comments**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+git grep -n "default OFF" -- crates/
+git grep -n "S4 gate" -- crates/
+```
+
+Expected: main's own comments at those sites now read S5.e/default ON and the
+rebase adopted them (the pre-plan investigation found the `DEV-0006 S4 …
+FLAG-GATED, default OFF` comments were pre-existing main text at the fork, not
+branch-authored — main has since updated its copies, and terminal.rs merged
+conflict-free, so main's text wins). For each remaining hit: if it is inside a
+region the BRANCH authored (check with `git log -L<line>,<line>:<file>` —
+branch commits are `*(resume-validation)`), update the comment to match main's
+current S5.e/default-ON phrasing at the equivalent main-side site. If it is
+main's own text elsewhere, leave it alone — not this branch's business.
+
+- [ ] **Step 2: Append the reconciliation note to DEV-0010**
+
+In `port/oracle/DEVIATIONS.md`, inside the `### DEV-0010` entry, insert this
+paragraph immediately after the `**Deviation:**` paragraph (before `**Why:**`):
+
+```markdown
+**Reconciliation note (2026-07-30, rebased onto 39010cb57):** codex managed
+launch (DEV-0006 S5.e) is now DEFAULT ON — every codex create/resume plans a
+sidecar app-server + remote proxy. The spawn-door gate runs BEFORE
+managed-launch planning at all three doors (WS create: gate → plan; headless
+respawn: gate → plan → uncancellable permit; REST: gate in
+`spawn_terminal_pane` before `settle_gated_create`'s plan-then-permit), so a
+definitively-absent codex id never consumes a sidecar planning slot; the
+fresh spawn it falls back to plans managed launch normally. Pinned by
+`managed_default_stale_codex_id_is_gated_before_planning` in
+`freshell-ws/tests/resume_validation_gate.rs`. The REST door additionally
+threads `claude_fresh_prealloc` through `RestResumeOutcome` so a gate-minted
+fresh claude id receives the #584 PIN 2 pre-spawn identity binding.
+```
+
+Leave `status: proposed` / `adjudicated_by: pending antagonist review` as-is —
+adjudication is a merge-time concern, and this branch does not merge.
+
+- [ ] **Step 3: Client double-message sanity check**
+
+The branch's notice is a ONE-SHOT xterm write inside the `terminal.created`
+handler (`writeLocalXtermNotice`, ~TerminalView.tsx:4343). Main's #582 banner
+(`TerminalExitBanner`) renders from `terminal.status` crash/settle frames via
+`activeNotice`/`crashTrace`/`settledDead` state. Different events, different
+mechanisms — no shared trigger is expected. Verify:
+
+```bash
+grep -n "writeLocalXtermNotice\|createdNotice" src/components/TerminalView.tsx
+grep -n "TerminalExitBanner" src/components/TerminalView.tsx
+```
+
+Confirm: (a) the `createdNotice` write happens only in the `terminal.created`
+handler, and (b) nothing feeds `createdNotice` into `TerminalExitBanner`
+props or `showExitBanner`'s condition. Then run the touched client tests
+(targeted runs are delegated — no coordinator gate):
+
+```bash
+npm run test:unit -- test/unit/client/components/TerminalView.lifecycle.test.tsx
+npm run test:unit -- test/unit/client/components/TerminalExitBanner.test.tsx
+```
+
+Expected: both PASS with no changes. If `TerminalView.lifecycle.test.tsx`
+fails to compile against main's reworked handler, adapt the branch's two test
+cases (`writes the resume-validation notice…`, `clears the persisted
+sessionRef/resumeSessionId…`) to the handler's current shape WITHOUT changing
+what they assert. If a real double-message path is discovered (both a
+created-notice xterm write AND a banner render from one event), gate the
+xterm write to skip when the same frame drives a banner — but the expected
+outcome is NO code change.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add port/oracle/DEVIATIONS.md
+git add -u crates/ src/ test/ 2>/dev/null || true
+git commit -m "docs: reconcile DEV-0010 with S5.e managed-launch default ON
+
+Records the gate-before-plan ordering at all three doors and the PIN 2
+prealloc threading; verifies no stale 'default OFF' comments and no
+client double-messaging between the created-notice and #582 banners."
+```
+
+---
+
+### Task 7: Full verification sweep
+
+**Files:**
+- None expected (fixes, if any, are committed as focused `fix(resume-validation):` commits).
+
+**Interfaces:**
+- Consumes: everything above.
+- Produces: the branch's final verified-green state — the workflow's stop condition.
+
+- [ ] **Step 1: Rust gates**
+
+```bash
+cd /home/dan/code/freshell/.worktrees/resume-validation
+cargo fmt --all --check
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test --workspace
+```
+
+Expected: all three exit 0. `fmt --check` is CI-enforced (a fmt violation
+just broke a main PR — zero tolerance). The 2026-07-30 validation rebase
+showed exactly one clippy lint on the merged tree (a mechanical
+`type_complexity` — fix with a type alias, it is not structural), and main
+itself passes `fmt --check` on this host (verified). Fix any failure, commit
+as `fix(resume-validation): <what>`, re-run from the top of this step.
+
+- [ ] **Step 2: Host-gated managed-path e2e (mutates process env — run alone)**
+
+```bash
+cargo test -p freshell-ws --test resume_validation_gate -- --ignored --test-threads=1
+cargo test -p freshell-ws --test codex_managed_launch_e2e -- --ignored --test-threads=1
+```
+
+Expected: PASS. The second command proves the rebase didn't regress main's own
+S5 e2e (it shares the seam our Task 4 test copied).
+
+- [ ] **Step 3: Wire-contract check (freshell-protocol + shared/ws-protocol.ts changed)**
+
+```bash
+npm run contract:generate
+git diff --exit-code -- port/contract
+npm run test:port
+```
+
+Expected: `git diff` exits 0 (the branch's regenerated schema already matches;
+if it doesn't, the regeneration output IS the fix — commit it as
+`fix(contract): regenerate for terminal.created notice after rebase`), and
+`test:port` passes.
+
+- [ ] **Step 4: Client gates**
+
+```bash
+npm run typecheck
+npm run lint
+npm run test:status    # inspect for a foreign holder; if one is running, WAIT — never kill it
+FRESHELL_TEST_COORDINATOR_MAX_WAIT_MS=7200000 \
+FRESHELL_TEST_SUMMARY="resume-validation rebase onto 39010cb57 — full client verification" npm run check
+```
+
+(Coordinator facts, verified 2026-07-30: the gate is a live unix socket keyed
+on the git common dir; crashed holders self-heal automatically — only a live
+process can hold the gate, so waiting is always safe. The wait is bounded:
+the 2h `MAX_WAIT_MS` above turns a wedged queue into a loud exit 124 instead
+of a silent day-long stall — if that fires, surface it, don't kill anything.)
+
+Expected: typecheck + lint clean; `npm run check` green through the
+coordinator gate, with ONE allowed exception:
+`test/e2e/terminal-font-settings.test.tsx` — if it fails, confirm it also
+fails on main (`git -C /home/dan/code/freshell stash list >/dev/null; cd /home/dan/code/freshell && FRESHELL_TEST_SUMMARY="baseline check terminal-font-settings" npm run test:vitest -- test/e2e/terminal-font-settings.test.tsx; cd /home/dan/code/freshell/.worktrees/resume-validation`)
+and note it in the final summary — do NOT chase it, do NOT mark it skipped.
+
+Baseline-attribution rule (added 2026-07-30; generalizes the
+terminal-font-settings note): main's npm-side gates have NO recorded
+baseline-green on this host. For any OTHER client failure that is not
+plainly caused by branch changes (i.e. the failing file/area is one the
+branch never touched), first run the SAME targeted file on the main checkout
+(`cd /home/dan/code/freshell && npm run test:unit -- <file>` — targeted runs
+are delegated, no gate) before treating it as ours. Upstream-red: note it
+like terminal-font-settings and move on. Ours (red here, green on main):
+fix, commit, re-run Step 4. Rust-side baselines were verified green on main
+2026-07-30 (`cargo fmt --all --check`; `codex_managed_launch_e2e --ignored`).
+
+- [ ] **Step 5: Final state audit**
+
+```bash
+git status --short                          # empty
+git log --oneline origin/main..HEAD         # between N − 1 and N + 6 commits (N from Task 1 Step 1: replayed commits + optional residue + up to 5 task commits + fix slack), all resume-validation work
+git merge-base origin/main HEAD             # 39010cb57...
+git log -1 --format='%an <%ae>'             # Dan Shapiro <3732858+danshapiro@users.noreply.github.com>
+```
+
+Expected: clean tree, all commits atop `39010cb57`, correct author. Do NOT
+push, do NOT open a PR, do NOT merge, do NOT touch port 3002. The branch is
+left local and verified — that is the stop condition.
+
+---
+
+## Self-Review (performed at plan-writing time)
+
+**1. Spec coverage:**
+- Required work §1 (rebase, conflict rules, semantics preservation, ef3014ba folding) → Task 1. The spec's warning that terminal_tabs.rs's gate "must be re-placed deliberately, preserving gate-BEFORE-plan ordering" is covered by Task 1 Step 6(c) (the trial merge showed main's permit moved INSIDE `settle_gated_create` after the plan, while the branch's gate sits in `spawn_terminal_pane` before it — so ordering holds without relocating main's acquire) and PINNED by Task 4's test. The spec expected terminal.rs to conflict; the trial rebase proved it doesn't — Task 1 Step 4 still instructs how to handle unexpected stops.
+- §2 (flag pinning) → Task 3, exact 0b3082cb pattern, plus a hostile-ambient verification.
+- §3 (managed-path gate test, one focused test, main's own seam) → Task 4 (seam 5a, `#[ignore]` host gate, argv-capture proof that the stale id never reached planning).
+- §4 (gate × breaker) → Task 5.
+- §5 (docs: comments, DEV-0010, TerminalView double-message check) → Task 6. Note: investigation showed the 'DEV-0006 S4 default OFF' comments were main's pre-fork text, not branch-authored, and terminal.rs merges clean, so main's updated text wins automatically — Task 6 Step 1 still sweeps and fixes any branch-authored stragglers, satisfying the spec's intent.
+- §6 (full verification incl. fmt, clippy, workspace tests, coordinated client runs, FRESHELL_TEST_SUMMARY, known-failure note) → Task 7.
+- Rebase mechanics (clean history preference) → Task 1 preserves per-commit replay (16/18 clean in the 2026-07-30 validation rebase; 2 resolved stops; fmt sweep folded) with one residue commit — cleaner than the single-squash fallback the spec permits.
+- Discovered-during-investigation gap (PIN 2 / `claude_fresh_prealloc` — a semantic conflict neither side wrote) → Task 2. This is in-scope: the spec's "preserve main's semantics for everything #584 added" requires it.
+- No UNRESOLVED COVERAGE GAPS.
+
+**1b. No silent deferrals:** Every requirement lands as production behavior verified by real tests: the gate test (Task 4) uses main's own fake-binary seam — the same seam main's S5 e2e uses as its production proof; no new stubs stand in for required behavior. The one allowed known-failure note (terminal-font-settings) is spec-mandated ("note it if seen, do not chase it") with a baseline cross-check, not a deferral of this branch's scope. DEV-0010 stays `proposed` deliberately: adjudication is a merge-time gate and the spec forbids merging.
+
+**2. Placeholder scan:** Task 2 Step 1, Task 4 Step 2, and Task 5 Step 2 contain deliberate copy-from-named-sibling holes (`/* ... */`) — each names the exact sibling test/helper and file to copy from (Task 2 now cites main's `RecordingBinder` double, wiring, and assertion patterns at concrete main-side lines; Task 5's `auto_resume_cancels` hole is filled with main's exact read idiom), which is the honest maximum for a reconciliation plan written against a tree that Task 1 will reshape; they are instructions with concrete sources, not "TBD". No "handle edge cases", no "similar to Task N" without the source named, no undefined types (every referenced symbol exists on main or the branch per the background-facts section).
+
+**3. Type consistency:** `claude_fresh_prealloc` (Tasks 2, 6) matches the WS door's existing field name. `RestResumeOutcome`, `validate_rest_resume`, `derive_resume_identity` (3-tuple), `settle_gated_create`, `acquire_uncancellable`, `auto_resume_cancels: Default::default()`, `resume_cycles: None`, `RetiredReason::SessionMissing`, `stale_resume_notice`, `ResumeExistence::Absent`, `RecordingBinder` + `with_pane_identity_binder` + `binder.events()` (`prespawn:`/`register:`/`delete:` event strings, Task 2) — all verified against the investigation reports and used consistently across tasks.
+
+## Validation pass (2026-07-30, load-bearing assumption check)
+
+The plan's load-bearing assumptions were validated (ledger:
+`.worktrees/.the-usual-logs/resume-validation/load-bearing-ledger.md`):
+9 verified, 2 falsified and fixed in this revision (branch commit counts —
+two successive fresh-eyes passes each caught a hard-coded total going stale
+the moment the plan-fix commit itself landed, so all count gates are now
+expressed relative to `N` measured in Task 1 Step 1 (17 feature commits +
+however many docs-only plan commits sit on top), structurally immune to
+further plan amendments; Task 2's observation
+mechanism — rewritten to main's `RecordingBinder` seam since PIN 2 is
+binder-gated and unobservable via any ledger query), 1 accepted residual
+(no npm-side baseline record on this host — mitigated by Task 7's
+baseline-attribution rule; Rust-side baselines verified green on main).
+A full trial rebase per this plan's rules ran green end-to-end
+(fold conflict-free; stops only at 65c938aad and 777eb7542 with main.rs
+auto-merging; 3 in-pattern initializer errors; one mechanical clippy lint;
+contract regen convergent; merged client typechecks and its targeted tests
+pass 142/142 + 8/8).
diff --git a/port/contract/ws-server-messages.schema.json b/port/contract/ws-server-messages.schema.json
index d69456d3d..f30088fa0 100644
--- a/port/contract/ws-server-messages.schema.json
+++ b/port/contract/ws-server-messages.schema.json
@@ -2214,6 +2214,9 @@
         "cwd": {
           "type": "string"
         },
+        "notice": {
+          "type": "string"
+        },
         "requestId": {
           "type": "string"
         },
diff --git a/port/oracle/DEVIATIONS.md b/port/oracle/DEVIATIONS.md
index 596825dce..d79043abd 100644
--- a/port/oracle/DEVIATIONS.md
+++ b/port/oracle/DEVIATIONS.md
@@ -716,6 +716,84 @@ path itself is intact).
   b7a1a8f0a0104fb3-20260726-232357 (distinct from adjudicating reviewer).
 - status: accepted.
 
+### DEV-0010 — Resume validation at the spawn doors (2026-07-29)
+
+**Deviation:** The Node reference passes cached resume session ids straight to
+the coding CLI (`server/terminal-registry.ts` `resolveCodingCliCommand`;
+`normalizeResumeForSpawn` is the identity function — no on-disk existence
+check exists in Node). The Rust server now validates the id against the
+provider's on-disk session store before constructing resume argv, at all three
+spawn doors (WS `terminal.create`, headless auto-resume respawn, freshagent
+REST create). On POSITIVE absence (store readable, session definitively
+absent) it spawns fresh in the same cwd/mode, surfaces an operator notice
+naming the stale id, and retires the pane-ledger binding
+(`RetiredReason::SessionMissing`). Unknown/unreadable stores fail OPEN
+(resume attempted, byte-for-byte Node behavior). Providers validated:
+claude — for SAME-BOOT deletions only (a zero-turn carve-out keeps
+Absent + never-observed-on-disk resuming, and the disk-observation signal
+is a per-boot in-memory set, so a transcript deleted while the server was
+DOWN is indistinguishable from never-conversed and fails OPEN post-restart;
+deliberate, fail-open) — codex, opencode, amplifier. gemini/kimi/third-party
+are never blocked. Known accepted consequence for amplifier (AD-5 in the
+plan): freshell's designed never-used-stub GC deletes a never-typed pane's
+session stub at terminal exit and the spawn doors re-stub the SAME id via
+`ensure_session` on the next resume — after a restart such a pane now spawns
+fresh under a minted id WITH a notice instead of silently re-stubbing the
+same id. Decided and accepted: on disk the GC'd stub is indistinguishable
+from the incident's stale id, and for a never-typed pane the outcome is an
+equivalent empty session either way (reconcile's amplifier Absent carve-out,
+which prevents PARKING such panes in the dead-sessions dialog, is untouched).
+Additive protocol field: optional `notice` on `terminal.created`.
+
+**Reconciliation note (2026-07-30, rebased onto 39010cb57):** codex managed
+sidecar app-server + remote proxy. For codex restore-class creates the gate runs OFF-permit
+inside `prepare_launch`, BEFORE `plan_codex_managed_launch` — gate ⇒ plan (off-permit) ⇒ permit ⇒ spawn — so a
+definitively-absent codex id never consumes a sidecar planning slot. All other modes (WS
+create, headless respawn, REST) keep the on-permit gate in `handle_create` (post-ladder,
+post-D7); the gate outcome is carried via `PreparedLaunch.resume_gate` so notice emission
+and D8 stale-ref lease release stay single-sited. For the fresh spawn it falls back to,
+all modes plan managed launch normally. Pinned by
+`managed_default_stale_codex_id_is_gated_before_planning` in
+`freshell-ws/tests/resume_validation_gate.rs`. The REST door additionally
+threads `claude_fresh_prealloc` through `RestResumeOutcome` so a gate-minted
+fresh claude id receives the #584 PIN 2 pre-spawn identity binding.
+
+**Why:** Production incident 2026-07-29 — after a server restart, freshell
+resumed stored amplifier session id 8dab420a-f76b-407c-bcbe-dfb2a971c2e1 which
+existed nowhere under ~/.amplifier/projects/*/sessions/; the amplifier CLI
+silently created a new empty session under that id and the user saw a broken
+restore with no explanation.
+
+**Pinning tests:** `freshell-platform` `resume_gate` unit tests;
+`freshell-ws/tests/resume_validation_gate.rs` (incl. the live-session/D7
+ordering and legacy-carrier liveness cases — registry AND sidecar arms);
+`freshell-ws/tests/auto_resume_respawn.rs`
+(`respawn_with_absent_session_spawns_fresh_and_retires_binding`, incl. the
+fresh-id bookkeeping assertions);
+`freshell-freshagent` `rest_resume_*` unit tests (incl. minted-v4
+plausibility, healed pane_content stamping, and the live-session
+precondition cases — registry arm with D7-REST-reject preservation AND
+the sidecar-liveness arm);
+`freshell-server` `existence.rs` amplifier/codex by-id fallback,
+cold-index, and sub-root permission tests;
+`freshell-protocol/tests/roundtrip.rs` `notice` wire test.
+
+- objective_defect: *corrupts data / contradicts documented restore behavior* — resuming a
+  session id that no longer exists on disk makes the coding CLI silently mint a NEW empty
+  session under that id (`server/terminal-registry.ts` `resolveCodingCliCommand` passes the
+  cached id to the CLI unchecked; `normalizeResumeForSpawn` is the identity function), so
+  the user's "restored" pane is a broken, empty impostor with no explanation (production
+  incident 2026-07-29, detailed under **Why** above).
+- original_behavior / port_behavior / pinning_test: see **Deviation** and **Pinning tests**
+  above.
+- fingerprint: spawn-door behavior — on positive on-disk absence the port constructs fresh
+  (non-resume) CLI argv where the original constructs resume argv, retires the pane-ledger
+  binding, and emits one additive optional wire field (`notice` on `terminal.created`,
+  absent whenever no stale id was detected — backward-compatible on read).
+- adjudicated_by: pending antagonist review (entry filed by the implementer per the
+  resume-validation plan, Task 9).
+- status: proposed.
+
 ## E2E-discovered intentional divergences (EDEV-xx)
 
 **Scope — READ THIS FIRST.** This section is DELIBERATELY SEPARATE from the DEV-NNNN
diff --git a/shared/ws-protocol.ts b/shared/ws-protocol.ts
index 86072889c..71a31fad2 100644
--- a/shared/ws-protocol.ts
+++ b/shared/ws-protocol.ts
@@ -738,6 +738,8 @@ export type TerminalCreatedMessage = {
   sessionRef?: SessionLocator
   clearCodexDurability?: boolean
   restoreError?: RestoreError
+  /** Resume-validation: operator-visible notice set when the server dropped a stale resume id and spawned fresh. The client writes it into the pane's xterm. Additive; Node never sets it. */
+  notice?: string
 }
 
 export type TerminalAttachReadyMessage = {
diff --git a/src/components/TerminalView.tsx b/src/components/TerminalView.tsx
index e3298c858..100e55627 100644
--- a/src/components/TerminalView.tsx
+++ b/src/components/TerminalView.tsx
@@ -4260,6 +4260,9 @@ function TerminalView({ tabId, paneId, paneContent, hidden }: TerminalViewProps)
           const createdSessionRef = (msg as { sessionRef?: TerminalPaneContent['sessionRef'] }).sessionRef
           const createdCwd = typeof msg.cwd === 'string' && msg.cwd.trim() ? msg.cwd : undefined
           const createdSessionUpdates = buildSessionAssociationContentUpdates(contentRef.current, createdSessionRef)
+          // Resume-validation: a notice means the server dropped a stale
+          // resume id and spawned fresh (never built on terminal.status.reason).
+          const createdNotice = typeof msg.notice === 'string' && msg.notice ? msg.notice : undefined
           terminalIdRef.current = newId
           // Ledger A2: remember the acquired tid so the terminal.input.blocked
           // backstop still matches after a recovery path clears terminalIdRef.
@@ -4270,6 +4273,12 @@ function TerminalView({ tabId, paneId, paneContent, hidden }: TerminalViewProps)
             streamId: undefined,
             status: 'running',
             ...(createdCwd && !contentRef.current?.initialCwd ? { initialCwd: createdCwd } : {}),
+            // Resume-validation: the notice names a stale resume id the server
+            // dropped — clear the persisted refs so codex/opencode gate-fired
+            // spawns (whose created frame carries NO sessionRef) don't re-fire
+            // the gate on every restart. When the frame also carries a
+            // sessionRef, the association fold below wins.
+            ...(createdNotice ? { sessionRef: undefined, resumeSessionId: undefined } : {}),
             ...(createdSessionUpdates ?? {}),
             ...(msg.clearCodexDurability ? { codexDurability: undefined } : {}),
             ...(msg.restoreError ? { restoreError: msg.restoreError } : {}),
@@ -4330,6 +4339,12 @@ function TerminalView({ tabId, paneId, paneContent, hidden }: TerminalViewProps)
           } else {
             attachTerminal(newId, 'viewport_hydrate', { clearViewportFirst: true })
           }
+          // Resume-validation notice: the server dropped a stale resume id and
+          // spawned fresh — surface it in the pane, same write mechanism as
+          // the reconcile notice below.
+          if (createdNotice) {
+            writeLocalXtermNotice(term, `\r\n${createdNotice}\r\n`)
+          }
           // One-shot reconcile notice (respawn/fresh verdicts): render it now
           // that the pane anchored, then clear it from the store.
           const createdReconcileNotice = contentRef.current?.reconcileNotice
diff --git a/test/unit/client/components/TerminalView.lifecycle.test.tsx b/test/unit/client/components/TerminalView.lifecycle.test.tsx
index 2d9010e6b..bc75d4d0e 100644
--- a/test/unit/client/components/TerminalView.lifecycle.test.tsx
+++ b/test/unit/client/components/TerminalView.lifecycle.test.tsx
@@ -2676,6 +2676,159 @@ describe('TerminalView lifecycle updates', () => {
     expectTerminalWriteContaining(term, 'execvp(3) failed.: No such file or directory')
   })
 
+  it('writes the resume-validation notice into the terminal on terminal.created', async () => {
+    const tabId = 'tab-resume-validation-notice'
+    const paneId = 'pane-resume-validation-notice'
+    const notice = 'Saved amplifier session 8dab420a-f76b-407c-bcbe-dfb2a971c2e1 could not be found on disk — started a fresh session instead.'
+
+    const paneContent: TerminalPaneContent = {
+      kind: 'terminal',
+      createRequestId: 'req-resume-validation-notice',
+      status: 'creating',
+      mode: 'shell',
+      shell: 'system',
+    }
+
+    const root: PaneNode = { type: 'leaf', id: paneId, content: paneContent }
+
+    const store = configureStore({
+      reducer: {
+        tabs: tabsReducer,
+        panes: panesReducer,
+        settings: settingsReducer,
+        connection: connectionReducer,
+      },
+      preloadedState: {
+        tabs: {
+          tabs: [{
+            id: tabId,
+            mode: 'shell',
+            status: 'creating',
+            title: 'Shell',
+            titleSetByUser: false,
+            createRequestId: 'req-resume-validation-notice',
+          }],
+          activeTabId: tabId,
+        },
+        panes: {
+          layouts: { [tabId]: root },
+          activePane: { [tabId]: paneId },
+          paneTitles: {},
+        },
+        settings: createSettingsState(),
+        connection: { status: 'connected', error: null },
+      },
+    })
+
+    render(
+      <Provider store={store}>
+        <TerminalView tabId={tabId} paneId={paneId} paneContent={paneContent} />
+      </Provider>
+    )
+
+    await waitFor(() => {
+      expect(messageHandler).not.toBeNull()
+    })
+
+    const term = terminalInstances[0]
+
+    act(() => {
+      messageHandler!({
+        type: 'terminal.created',
+        requestId: 'req-resume-validation-notice',
+        terminalId: 'term-resume-validation-notice',
+        createdAt: Date.now(),
+        notice,
+      })
+    })
+
+    await waitFor(() => {
+      expectTerminalWriteContaining(term, 'Saved amplifier session 8dab420a-f76b-407c-bcbe-dfb2a971c2e1')
+    })
+  })
+
+  it('clears the persisted sessionRef/resumeSessionId when terminal.created carries a notice', async () => {
+    const tabId = 'tab-resume-validation-clear'
+    const paneId = 'pane-resume-validation-clear'
+    const staleSessionRef = {
+      provider: 'codex',
+      sessionId: '8dab420a-f76b-407c-bcbe-dfb2a971c2e1',
+    }
+
+    // codex/opencode shape: the created frame carries a notice but NO
+    // sessionRef — the gate's fallback for these modes is None, so no
+    // sessionRef overwrite will heal the pane.
+    const paneContent: TerminalPaneContent = {
+      kind: 'terminal',
+      createRequestId: 'req-resume-validation-clear',
+      status: 'creating',
+      mode: 'codex',
+      shell: 'system',
+      sessionRef: staleSessionRef,
+      resumeSessionId: staleSessionRef.sessionId,
+    }
+
+    const root: PaneNode = { type: 'leaf', id: paneId, content: paneContent }
+
+    const store = configureStore({
+      reducer: {
+        tabs: tabsReducer,
+        panes: panesReducer,
+        settings: settingsReducer,
+        connection: connectionReducer,
+      },
+      preloadedState: {
+        tabs: {
+          tabs: [{
+            id: tabId,
+            mode: 'codex',
+            status: 'creating',
+            title: 'Codex',
+            titleSetByUser: false,
+            createRequestId: 'req-resume-validation-clear',
+          }],
+          activeTabId: tabId,
+        },
+        panes: {
+          layouts: { [tabId]: root },
+          activePane: { [tabId]: paneId },
+          paneTitles: {},
+        },
+        settings: createSettingsState(),
+        connection: { status: 'connected', error: null },
+      },
+    })
+
+    render(
+      <Provider store={store}>
+        <TerminalView tabId={tabId} paneId={paneId} paneContent={paneContent} />
+      </Provider>
+    )
+
+    await waitFor(() => {
+      expect(messageHandler).not.toBeNull()
+    })
+
+    act(() => {
+      messageHandler!({
+        type: 'terminal.created',
+        requestId: 'req-resume-validation-clear',
+        terminalId: 'term-resume-validation-clear',
+        createdAt: Date.now(),
+        notice: 'Saved codex session 8dab420a-f76b-407c-bcbe-dfb2a971c2e1 could not be found on disk — started a fresh session instead.',
+      })
+    })
+
+    await waitFor(() => {
+      const layout = store.getState().panes.layouts[tabId]
+      if (layout?.type !== 'leaf') throw new Error('unexpected layout')
+      if (layout.content.kind !== 'terminal') throw new Error('unexpected content')
+      expect(layout.content.terminalId).toBe('term-resume-validation-clear')
+      expect(layout.content.sessionRef).toBeUndefined()
+      expect(layout.content.resumeSessionId).toBeUndefined()
+    })
+  })
+
   it('settles a clean restored attach startup exit as exited', async () => {
     const tabId = 'tab-clean-restore-attach-exit'
     const paneId = 'pane-clean-restore-attach-exit'