diff --git a/docs/compatible-agents.md b/docs/compatible-agents.md
index b10e8f555..9a296fd08 100644
--- a/docs/compatible-agents.md
+++ b/docs/compatible-agents.md
@@ -90,7 +90,7 @@ Open a **draft pull request** with the entry, fixture, documentation, and verifi
 - **Must capture before killing the target PTYs**, within the host's bounded teardown. Each host owns the target scope; interrupt every live PTY within it, regardless of recognized command, and exclude exited PTYs. (rationale)
 - **Must write one `^C` into each target PTY per interrupt call, never signal it.** The shared machine alone decides the second press. Host interrupts must settle within their timeout. (rationale)
 - **Never finish early on quiet or replace the retry gates with a blanket second press.** Poll until every target yields or the capture budget expires; retry timing and ask detection live in the module's comments. (rationale)
-- **Must scan only bytes received after the mark taken before the first interrupt.** Never widen the scan into earlier output; buffer eviction may discard fresh bytes but must not promote stale bytes into the scan. (rationale)
+- **Must scan only output received after the mark taken before the first interrupt.** Never widen the scan into earlier output; buffer eviction may discard fresh output but must not promote stale output into the scan. (rationale)
 - **Must report each detected command immediately**, retaining earlier detections if a later target times out.
 
 Source of truth: `captureAgentRecovery` / `RecoveryHost` in `lib/src/host/recovery-capture.ts`; pinned by `lib/src/host/recovery-capture.test.ts`.
@@ -102,7 +102,7 @@ Source of truth: `captureAgentRecovery` / `RecoveryHost` in `lib/src/host/recove
 - **Must rebuild only a known invocation plus an opaque id.** The command is *rebuilt* as label, space, captured id, never sliced from the buffer, keeping the hint's executable alias; a long option's id may follow a space or `=`, and only Claude's legacy `claude --continue` omits it. The id must begin with an ASCII alphanumeric and contain only ASCII alphanumerics, hyphens, and underscores. The invocation must end on a word break but nothing stronger (rationale).
 - **Must observe a separator after the newest invocation before capturing it.** Buffer end is insufficient, even at the capture deadline; never fall back to an older hint while the newest is unterminated. Pinned by `waits through every ID split` in `lib/src/host/recovery-capture.test.ts` (rationale).
 - **Must strip the scan window as a whole, in one pass, with an unterminated control swallowing the rest of it** — the string controls (OSC, DCS, SOS, PM, APC) **in either introducer form, `ESC` or bare C1**, and equally a CSI the window was cut off *inside* (rationale). **Must match every escape by its full ECMA-48 shape**, never by the Fe range (rationale). **Must share one implementation**: `stripTerminalControls` removes string controls by running `TerminalControlStreamFilter`, so the batch and streaming readers cannot disagree.
-- **Must strip in boundary mode**: *every complete* control becomes a newline rather than vanishing, except SGR and charset designators, the two classes that neither move the cursor nor erase. **Must discard incomplete trailing presentation controls without creating a boundary** (rationale).
+- **Must strip in boundary mode**: complete non-string ESC/CSI sequences and standalone C1 controls become newlines, except SGR and charset designators. ESC and C1 counterparts must produce the same boundary. String controls and their payloads vanish; LF, CR, and TAB remain text boundaries; other C0 controls that do not move or erase text vanish. **Must discard incomplete trailing presentation controls without creating a boundary** (rationale).
 - **Must select the rightmost match in the last 50 lines**, newest *by position* and never by pattern order (rationale).
 
 Source of truth: `CODING_AGENTS` in `lib/src/lib/coding-agents.ts`; `detectResumeCommand` / `normalizeResumeCommand` in `lib/src/lib/resume-patterns.ts`; `stripTerminalControls` in `lib/src/lib/terminal-controls.ts`; pinned by `lib/src/lib/coding-agents.test.ts`, `lib/src/lib/resume-patterns.test.ts`, and `lib/src/lib/terminal-controls.test.ts`.
diff --git a/docs/compatible-agents.rationale.md b/docs/compatible-agents.rationale.md
index 58d6ba110..f246dba24 100644
--- a/docs/compatible-agents.rationale.md
+++ b/docs/compatible-agents.rationale.md
@@ -50,7 +50,7 @@ Rows 1–2 are why a blanket second press is wrong; `Press Ctrl-C again` was abs
 
 **Why the Fe range is not enough to match an escape.** `ESC 7` / `ESC 8` and `ESC c` have final bytes outside it, so a matcher keyed on the introducer alone strips the ESC and leaks the final byte into the text.
 
-**Why boundary-mode stripping inverts the rule.** Observed in the wild: a stored `claude --resume <uuid>codex`. Deleting controls instead of replacing them with a newline welded two fragments never adjacent on screen into one id-shaped token, which then passed the id grammar. Erasures count too — `\x1b[2K` means the text before it on that line is gone — while SGR and charset designators are the only classes where the text either side really is contiguous.
+**Why boundary-mode stripping inverts the rule.** Observed in the wild: a stored `claude --resume <uuid>codex`. Deleting controls instead of replacing them with a newline welded two fragments never adjacent on screen into one id-shaped token, which then passed the id grammar. Erasures count too — `\x1b[2K` means the text before it on that line is gone. Among the non-string ESC/CSI presentation sequences, SGR and charset designators leave the surrounding text contiguous. String payloads are removed by the earlier framing pass; this policy does not imply that every string protocol leaves the cursor unchanged.
 
 ## Recovery record
 
diff --git a/docs/specs/alert.md b/docs/specs/alert.md
index 4b6b75172..85a67cd49 100644
--- a/docs/specs/alert.md
+++ b/docs/specs/alert.md
@@ -155,7 +155,7 @@ An **await** parks on one Session until it finishes what it is doing, then repor
 
 **An await crosses from the renderer to the host process that holds the manager**, and the wait itself never leaves the host:
 
-- The renderer asks to park (`await`, under an `awaitId` its client mints) and, if it gives up, to cancel (`awaitCancel`); **the host answers exactly one `alert:awaitResult {awaitId, outcome}` per await, to the realm that parked it**, a cancel included. **A realm's repeated `awaitId` is ignored, never answered twice**; a malformed `id` or `until` is answered `cancelled`.
+- The renderer asks to park (`await`, under an `awaitId` its client mints) and, if it gives up, to cancel (`awaitCancel`); **the host answers exactly one `alert:awaitResult {awaitId, outcome}` per await, to the realm that parked it**, a cancel included. **An `awaitId` already parked in that realm is ignored**; a malformed `id` or `until` is answered `cancelled`.
 - **A realm that ends — a disposed or recreated webview, a reloaded or closed window — has everything it parked cancelled and answered by the host, *synchronously*** (rationale); a disposing adapter settles its own.
 - `cancelled` has no wire outcome of its own: the renderer reports it to `dor` as an error, which is also what forgets the in-flight control request.
 - The fake adapter runs the same host in process. The Pocket phone adapter has no `dor` and protocol-v1 carries no await, so it settles every request `cancelled` at once.
@@ -175,7 +175,7 @@ Source of truth: `awaitCompletion` in `lib/src/lib/alert-manager.ts`; `AlertComm
 
 Rules:
 
-- **The key is `commandWatchKey(rawCommandLine)`**: the last command of a list (`&&`, `||`, `;`, `&`, newline) and the first stage of its pipeline, grouping dropped, leading `VAR=value` words and transparent wrappers (`sudo`, `npx`, …) skipped, then argv[0]'s basename minus any launcher suffix (`docs/specs/terminal-state.md`). **Reserved words are grammar, fish's included**: a leading `do`, `then`, `if`, `!`, `and`, `not`, `begin`, … is stripped, a segment a closer (`done`, `fi`, `esac`, `end`) leads is skipped with its redirection or pipe, and a `for` header, a case pattern, and fish's `case` line are dropped, so `for f in *; do make; done` keys on `make` (rationale). **A redirection is never the program or a runner's script**, a separate target skipped with it (rationale). **An unknown wrapper flag stops the skip**, keying the wrapper itself. **A script runner keys as `<runner> <script>`**, a leading `run` dropped, so `cd web && pnpm run dev` keys on `pnpm dev`; a script that is no valid key (a path) keys the runner (rationale). Where bash's `E` falls back to a line's first simple command (`docs/specs/terminal-escapes.md` → Shell-integration injection), that command keys. Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
+- **Must derive the key only from the shell-reported raw command line through `commandWatchKey`**, never the display title or keystroke fallback; its lexical grammar belongs to that function. Where bash's `E` falls back to the line's first simple command, that command keys (`docs/specs/terminal-escapes.md` → Shell-integration injection; rationale). Pinned by `WATCHING key` in `lib/src/lib/terminal-state.test.ts`.
 - **A rule covers a key it equals, and a bare runner rule covers every `<runner> <script>` key of that runner** (rationale). `watchRuleFor` is the one matcher, for WATCHING, rule-removal silencing, and the terminal context's row.
 - **Every command boundary resets the detector** — `commandStart`, `commandFinish`, `promptStart`, `promptEnd`, and PTY exit — even without a command watch. Pinned by `resets unwatched output history on %s without a command watch` in `lib/src/lib/alert-manager.test.ts`.
 - **Editing the rule set re-derives WATCHING across every live Session immediately**, never restarting the detector (rationale).
@@ -185,27 +185,15 @@ Rules:
 
 **Limitation:** WATCHING needs the shell to report its command line — `OSC 633 ; E`, or `cmdline_url` / `cmdline` on `OSC 133 ; C` (fish ≥ 4) — beside the boundaries. A shell reporting bare `OSC 133` boundaries, or none (`docs/specs/terminal-escapes.md`), never names a command, so WATCHING never engages and the terminal context reports `No command running`. Terminal reports still work; command-exit alerting also requires semantic command boundaries. **Never route the keystroke fallback in `docs/specs/terminal-state.md` into the `AlertManager`** (rationale).
 
-| State | Meaning |
-|---|---|
-| `WATCHING_DISABLED` | No rule matches, so the detector's state is not shown. |
-| `NOTHING_TO_SHOW` | A rule matches, but no reminder is owed. |
-| `MIGHT_BE_BUSY` | Output may be turning into ongoing work. Debounce. |
-| `BUSY` | Enough output to treat the Session as doing work. |
-| `MIGHT_NEED_ATTENTION` | A busy Session went quiet. Debounce. |
-| `ALERT_RINGING` | Likely completion observed while the Session was not engaged. |
-
 Meaningful output excludes resize redraw noise during `T_RESIZE_DEBOUNCE`, **a grace the host opens before it resizes the PTY**, a Client's resize included; theme changes, remounts, DOM reparenting, selection, and focus changes are not output. Invariants:
 
-- Output drives the detector up `NOTHING_TO_SHOW` -> `MIGHT_BE_BUSY` -> `BUSY`; silence drives it down `BUSY` -> `MIGHT_NEED_ATTENTION` -> settled. The `MIGHT_*` states are debounce windows in both directions.
-- First output starts candidate tracking without changing status; unconfirmed `MIGHT_BE_BUSY` returns to `NOTHING_TO_SHOW`.
 - **Must discard unconfirmed candidate history after an output gap beyond `busyCandidateGap + busyConfirmGap`, including when a timer runs late** (rationale). Pinned by `forgets stale candidate history` and `expires candidate history even when the confirmation timer has not run` in `lib/src/lib/quiesce-detector.test.ts`.
-- **The detector never holds `ALERT_RINGING`.** It reports each settle once and returns to `NOTHING_TO_SHOW`; the ring latches instead.
 - **Must preserve an owed `watching` source when output resumes**; Completion events owns animation pauses (rationale).
 - **A settle rings only if** a rule matches the foreground command; an engaged Session holds it (Completion events).
 - **Never reset the detector for engagement alone**; settles must reach awaits. **Must reset to `NOTHING_TO_SHOW` when a user verb or an await clears a ring with a `watching` source**, preventing its output tail from settling again; resumed work and rule removal leave it running.
 - **New WATCHING summons must be caused by a fresh settle**, never rerender, theme change, remount, minimize, or reattach; Completion events owns resuming a paused summons.
 
-Source of truth: `commandWatchKey` / `watchRuleFor` in `lib/src/lib/terminal-state.ts`; `QuiesceDetector` in `lib/src/lib/quiesce-detector.ts`; `onSettled` / `isPaused` in `lib/src/lib/alert-manager.ts` (pinned by `lib/src/lib/alert-resumed-output.test.ts`); renderer mirror `lib/src/lib/watched-commands.ts`, multi-renderer coordinator `lib/src/lib/watched-command-host.ts`.
+Source of truth: `commandWatchKey` / `watchRuleFor` in `lib/src/lib/terminal-state.ts`; `QuiesceDetector` / `QuiesceStatus` in `lib/src/lib/quiesce-detector.ts`; `onSettled` / `isPaused` in `lib/src/lib/alert-manager.ts` (pinned by `lib/src/lib/alert-resumed-output.test.ts`); renderer mirror `lib/src/lib/watched-commands.ts`, multi-renderer coordinator `lib/src/lib/watched-command-host.ts`.
 
 ## Terminal reports
 
@@ -291,12 +279,7 @@ Source of truth: `teardownSession` in `lib/src/lib/terminal-lifecycle.ts`; `plan
 
 Application alarm defaults live beside the WATCHING rule set, edited in **Settings** (below). **Every other store reached from Settings stays its own — never fold one into `AlertSettings`**, which is relayed wholesale to the host. Both stores run the same two classes in either host (`lib/src/lib/watched-command-host.ts`, `lib/src/lib/alert-settings-host.ts`), bound to its manager by `createAlertHost`; the shape, its defaults and its validation are the platform-free `lib/src/lib/alert-settings-model.ts`.
 
-| Field | Meaning |
-|---|---|
-| `inactivityTimeoutMs` | The presence window (Engagement), and nothing else; only the renderer's presence tracker reads it. |
-| `deferAlertsUntilQuiet` | Gates animation deferral and pauses (Completion events). Default on. (rationale) |
-| `speakEnabled` / `speakDelayMs` | Spoken alarms, below. |
-| `pushEnabled` / `pushDelayMs` | Push notifications, below. |
+**Must use `AlertSettings` and its documented fields, defaults, and bounds from `lib/src/lib/alert-settings-model.ts`.** Engagement and Completion events own detection behavior; the sink sections below own speech and push.
 
 The speech row's managed-voice link follows
 [website-docs.md](./website-docs.md) -> `/hosted` preview.
@@ -332,7 +315,7 @@ Neither sink ever carries the ringing `ActivityNotification`.
 | Failure | A refused or unavailable engine produces no marker. | Warn on non-2xx, partial, or zero delivery; **never retry** stale alarms. |
 | Authority | The renderer plays host-fetched managed-voice audio, else invokes `window.speechSynthesis`. | The host names Session and title; the Burrow selects active ACL devices, the Relay intersects subscriptions. |
 
-Source of truth: `AlertSettings` in `lib/src/lib/alert-settings.ts` (renderer mirror, persisted at `dormouse:alert-settings`); `lib/src/lib/alert-settings-host.ts`.
+Source of truth: `AlertSettings` / `DEFAULT_ALERT_SETTINGS` / `normalizeAlertSettings` in `lib/src/lib/alert-settings-model.ts`; renderer mirror in `lib/src/lib/alert-settings.ts` (persisted at `dormouse:alert-settings`); `AlertSettingsHost` in `lib/src/lib/alert-settings-host.ts`.
 
 ### Spoken alarms
 
@@ -369,10 +352,10 @@ Source of truth: `SpeechEngine` / `webSpeechEngine` / `withFallback` in `lib/src
 
 - **The label is sanitized by `toPushText` at send time, in the Burrow, and not by `toSpokenText`'s rule** (rationale). It keeps angle brackets and instead strips control characters and the Unicode bidi and zero-width format characters (including the Arabic letter mark); the cap counts code points, so a cut never ships half a surrogate pair. `toPushText` is only this sink's limit and fallback over `boundedPushText` in `remote-lib-common/src/security/push.ts`.
 - **The Burrow bounds, then seals; the worker re-bounds at the render sink.** Title, body, and tag are sealed to each recipient's own Client static and the Relay forwards ciphertext, so the second pass runs in `lib/src/remote/pocket-app/sw.ts`, which imports the *same* `boundedPushText` rather than mirroring it (`docs/specs/remote-security-model.md` -> Push sealing).
-- **The Burrow names its targets; the Relay rejects a send that does not.** Targets are the Burrow's *active* ACL records, read at send time so a revocation during the delay takes effect, and the Relay intersects them with its own subscriptions (rationale). **One sealed envelope per recipient** — a Client static is not a group key — so a send names each `deliveryId` beside the ciphertext only that phone can open, **clamped to `MAX_PUSH_QUERY_DELIVERY_IDS`** because the route refuses the whole POST past it. The Burrow does **not** ask which devices are subscribed first (rationale).
-- **The settings dialog re-reads the device list when it opens; the transient preview never refreshes.** The list is the Burrow's join of the Relay's subscriptions against its own ACL labels. **A disarmed enrolled gate invalidates every in-flight refresh and clears the list**, so nothing already on the wire can repopulate the dialog with phones there is no longer anything to push to.
+- **The Burrow names its targets; the Relay rejects a send that does not.** Targets are the Burrow's newest active ACL records in approval order, read at send time so a revocation during the delay takes effect, and the Relay intersects them with its own subscriptions (rationale). **One sealed envelope per recipient** — a Client static is not a group key — so a send names each `deliveryId` beside the ciphertext only that phone can open, **clamped to `MAX_PUSH_QUERY_DELIVERY_IDS`** because the route refuses the whole POST past it. The Burrow does **not** ask which devices are subscribed first (rationale).
+- **The settings dialog re-reads the device list when it opens; the transient preview never refreshes.** **Must preview the same bounded target set a send selects**, joined with the Relay's subscriptions and the Burrow's ACL labels. **A disarmed enrolled gate invalidates every in-flight refresh and clears the list**, so nothing already on the wire can repopulate the dialog with phones there is no longer anything to push to.
 
-Source of truth: `push` in `lib/src/host/remote/service.ts`; `pushAlert` in `vscode-ext/src/burrow.ts`; `sendPush` / `toPushText` in `lib/src/remote/burrow/push-delivery.ts`; `commitPushDevices` / `refreshPushDevicesNow` / `clearPushDevices` / `resetPushDevices` in `lib/src/lib/push-devices.ts`.
+Source of truth: `push` in `lib/src/host/remote/service.ts`; `pushAlert` in `vscode-ext/src/burrow.ts`; `sendPush` / `loadPushDevices` / `pushTargets` / `toPushText` in `lib/src/remote/burrow/push-delivery.ts`; `commitPushDevices` / `refreshPushDevicesNow` / `clearPushDevices` / `resetPushDevices` in `lib/src/lib/push-devices.ts`.
 
 ### Settings dialog
 
diff --git a/docs/specs/security-local.md b/docs/specs/security-local.md
index a26759f5a..3d59f6b22 100644
--- a/docs/specs/security-local.md
+++ b/docs/specs/security-local.md
@@ -38,7 +38,7 @@ shell-integration scripts — the parser scans raw bytes and cannot defend it
 
 - **FAIL IF** `TerminalProtocolParser` in `lib/src/lib/terminal-protocol.ts` stops consuming `OSC 52` or `OSC 50`, or a parse site stops running it before `pty:data` leaves it (rationale). Pinned by `lib/src/lib/terminal-protocol.test.ts`.
 - **FAIL IF** an `OSC 52` payload can reach the clipboard except as the copy editor's program format the user chose and copied, is retained unbounded or with control characters other than newline and tab, or is accepted into a pane with no shadowed drag: `parseOsc52` and `CLIPBOARD_OFFER_LIMIT` in `lib/src/lib/terminal-protocol.ts`, `offerProgramCopy` in `lib/src/lib/mouse-selection.ts`, `copySelection` in `lib/src/lib/copy-selection.ts`. Pinned by `lib/src/lib/terminal-protocol.test.ts`, `lib/src/lib/mouse-selection.test.ts`, and `lib/src/lib/copy-editor.test.ts`.
-- **FAIL IF** a value the parser retains stops being bounded and control-stripped before storage, or a new one arrives without a limit — `TITLE_LIMIT`, `BODY_LIMIT`, `COMMAND_LINE_LIMIT` and `sanitizeText` in `lib/src/lib/terminal-protocol.ts`, `MAX_CWD_LENGTH` and `boundedCwdValue` in `lib/src/lib/terminal-state.ts`. `COMMAND_LINE_LIMIT` binds *after* the `\xNN` unescape, a 4x bound before it (rationale).
+- **FAIL IF** a value the parser retains stops being bounded and control-stripped before storage, or a new one arrives without a limit — `TITLE_LIMIT`, `BODY_LIMIT`, `COMMAND_LINE_LIMIT` and `sanitizeText` in `lib/src/lib/terminal-protocol.ts`, `MAX_CWD_LENGTH` and `boundedCwdValue` in `lib/src/lib/terminal-state.ts`. `commandLineEvents` caps decoded command lines at `COMMAND_LINE_LIMIT` after sanitization, with source caps of 4× that limit for OSC 633 or shell quoting and 12× for percent-encoded UTF-8 (rationale).
 - **FAIL IF** an `OSC 8` activation reaches an adapter's `openExternal` without the confirmation dialog, or the dialog renders an open action for a **deceptive** verdict: `linkHandler` in `lib/src/lib/terminal-lifecycle.ts`, `classifyDisplayMatch` in `lib/src/lib/external-links.ts`, the render branches in `lib/src/components/ExternalLinkModal.tsx`. Pinned by `lib/src/lib/external-links.test.ts` and `lib/src/components/ExternalLinkModalHost.test.tsx`; the host also rejects a deceptive confirmation (rationale).
 - **FAIL IF** an `OSC 8` activation reaches the preview path when its display text is not a whole-component suffix of its decoded target, or the host opens a `file:` URL whose host is not empty, `localhost`, or this machine: `localFileLinkPreviewPath` in `lib/src/lib/external-links.ts`, `activateTerminalLink` in `lib/src/lib/terminal-link-activation.ts`, `resolveLocalToolTarget` in `lib/src/host/tool-input.ts`. Pinned by `lib/src/lib/external-links.test.ts`, `lib/src/lib/terminal-link-activation.test.ts`, and `local file URLs` in `lib/src/host/tool-input.test.ts`.
 - **FAIL IF** an OSC 367 `open` reaches `surface.tool` from replay, from a Session that is not a Tool running its designated command, or naming anything but an absolute path free of controls; or if a control-socket request can set its `oscOpen` flag, or its failure reaches the error viewer's argv with a control character. Read `parseToolOpen` in `dor-tools-lib/src/osc.ts`, `dispatchToolOpens` in `lib/src/lib/tool-open-requests.ts` (reached from `applyLiveToolEvents`, never from `parseReplay` in `lib/src/lib/platform/replay-parse.ts`), the `oscOpen` argument of `dispatchDorControlRequest` in `lib/src/lib/platform/dor-control-dispatch.ts`, and the `oscOpen` gate in `lib/src/components/wall/use-dor-control.ts`. Pinned by `an OSC 367 open` in `lib/src/components/wall/preview-slot.test.tsx`.
diff --git a/docs/specs/terminal-context.md b/docs/specs/terminal-context.md
index f00fa3f5b..117cc30d8 100644
--- a/docs/specs/terminal-context.md
+++ b/docs/specs/terminal-context.md
@@ -17,7 +17,7 @@
 - **Must retain exited output**, offer Reset, and avoid automatic restart loops.
 - **Must pause status and process-inspection polling while the context is hidden**, invalidating cached idle results. Reopening publishes current terminal status; source closure inspects work on demand.
 
-**Must carry one status line per helper state**, offering Reset in place of Modify only after user input and after exit.
+**Must carry one status line per helper state**, offering Reset in place of Modify only for user-touched or exited helpers.
 
 **Must make Reset an explicit discard**, confirming loss of scrollback, unfinished input, running programs, and unsaved edits. Cancellation changes nothing; confirmation disposes the old helper and launches a fresh one using the source's current directory and current global setting. Stale timers cannot write to the replacement.
 
diff --git a/docs/specs/terminal-escapes.md b/docs/specs/terminal-escapes.md
index 40bd42c74..3fad11d05 100644
--- a/docs/specs/terminal-escapes.md
+++ b/docs/specs/terminal-escapes.md
@@ -22,7 +22,7 @@ State-driving and security-sensitive OSCs — plus the `CSI > q` query — are p
 
 **Must buffer an unterminated consumed OSC up to `OSC_INCOMPLETE_LIMIT` (16,384 UTF-16 code units), then discard through its terminator or cancellation**, retaining only a split `ESC`, never promoting payload to text or its terminating BEL to an alert (rationale). A complete sequence in a single read is parsed whole. Pinned by `discards an oversized consumed OSC through its %j terminator` in `lib/src/lib/terminal-protocol.test.ts`. **An unterminated OSC the parser will forward streams to xterm.js instead**, preserving a split `ESC \` terminator (rationale). **Route by the OSC id, and decide nothing while more digits could follow** — `133` becomes `1337` — for `1337` by the subcommand ([Inline graphics](#inline-graphics)).
 
-**Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the command line (`OSC 633 ; E`, `OSC 133 ; C`), bounded *before* its decoding and sanitized *after* it (rationale), **line breaks kept as `\n`**; `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Every limit counts code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
+**Every semantic value `TerminalProtocolParser` *retains* is bounded and stripped of control characters before storage**, whatever the emitter: `TITLE_LIMIT` / `BODY_LIMIT` for titles and notification bodies, whose whitespace controls collapse to spaces before the trim; `COMMAND_LINE_LIMIT` for the command line (`OSC 633 ; E`, `OSC 133 ; C`), source bounded at 4× `COMMAND_LINE_LIMIT` code points for OSC 633 or shell-quoted input, or 12× for percent-encoded UTF-8, then decoded, sanitized, and capped at `COMMAND_LINE_LIMIT` code points (rationale), **line breaks kept as `\n`**; `MAX_CWD_LENGTH` for every CWD source, interior whitespace preserved. **Semantic value limits count code points**, so a cut never splits a surrogate pair. **A value that reduces to nothing is dropped, never stored empty.**
 
 **The owner alone acts on the events** its parse produced — writing the responses, feeding its `AlertManager`, forwarding the semantic and Tool events to the owning renderer — and hands every consumer the same chunk ([remote-api.md](remote-api.md#terminal-surfaces)).
 
@@ -30,7 +30,7 @@ State-driving and security-sensitive OSCs — plus the `CSI > q` query — are p
 
 **The owner splits a PTY read above `MAX_PARSER_INPUT_CHARS` (64 Ki UTF-16 code units) before parsing it, and never through a surrogate pair**, so **both** projections — one message, not two — fit the 1 MiB application-message cap after base64url and JSON framing (rationale; [remote-api.md](remote-api.md)).
 
-Source of truth: `oscDispositionAt` in `lib/src/lib/terminal-protocol.ts`, `boundedCwdValue` in `lib/src/lib/terminal-state.ts`, `createProcessedPtyStream` in `lib/src/lib/processed-pty-stream.ts`, `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`.
+Source of truth: `oscDispositionAt` / `commandLineEvents` in `lib/src/lib/terminal-protocol.ts`, `boundedCwdValue` in `lib/src/lib/terminal-state.ts`, `createProcessedPtyStream` in `lib/src/lib/processed-pty-stream.ts`, `createOwnerPtyStream` in `lib/src/host/owner-pty.ts`.
 
 ### `pty:data` strip semantics
 
@@ -129,11 +129,13 @@ Source of truth: `getWebviewHtml` in `vscode-ext/src/webview-html.ts`, `app.secu
 
 `onData` includes xterm.js *replies*. **Both classifiers require every chunk token to match**, so a report glued onto real keystrokes is never mistaken for one.
 
-- **`inputIsReplayTerminalReport`** — dropped outright while `isReplaying` (rationale). Shapes: cursor-position / device-status (`CSI [?]<params> R` / `n`), device attributes (`CSI [?>=]<params> c`), window-manipulation reports (`CSI <params> t` / `x`), DECRQSS and XTSMGRAPHICS reports (`CSI [?]<params> $y` and `CSI ? <params> S`), focus in/out (`CSI I` / `CSI O`), kitty keyboard-query replies (`CSI ? <flags> u`), and OSC, DCS, or APC replies of any shape. Also gates recording, acknowledgement ([alert.md](alert.md)), and untouched state ([layout.md](layout.md)).
-- **`inputIsSyntheticTerminalReport`** — the broader prompt-recording guard (any chunk built only of CSI, SS3 `ESC O <final>`, OSC, or APC tokens). **Never dropped, and must suppress input recording alone** — these sequences can encode real keys.
-- **`stripMouseReportsFromInput`** — removes X10 (`CSI M <3 bytes>`), SGR (`CSI < b;x;y M/m`) and urxvt (`CSI b;x;y M`) mouse reports during mouse-mode override, so reports bypassing DOM interception never reach the PTY ([mouse-and-clipboard.md](mouse-and-clipboard.md)). Acknowledgement gating: `docs/specs/alert.md` → Engagement.
+- **Must drop complete terminal replies during replay through `inputIsReplayTerminalReport`**, excluding them from input recording, acknowledgement, and untouched-state updates (rationale).
+- **Must suppress input recording alone through `inputIsSyntheticTerminalReport`**, whose broader control-only grammar can include real keys; never drop those chunks.
+- **Must remove mouse reports through `stripMouseReportsFromInput` only during mouse-mode override**, so reports bypassing DOM interception cannot reach the PTY. Pointer acknowledgement follows `docs/specs/alert.md` → Engagement.
 
-**No filter may swallow user keyboard escape sequences** — arrows, function keys, bracketed paste, kitty modified-key reports, win32-input-mode key records (`CSI …_`). Source of truth: `lib/src/lib/terminal-report-filter.ts`.
+**Never swallow user keyboard escape sequences**: arrows, function keys, bracketed paste, kitty modified-key reports, and win32-input-mode key records.
+
+Source of truth: the three classifiers and their canonical reply grammars in `lib/src/lib/terminal-report-filter.ts`; pinned by `lib/src/lib/terminal-report-filter.test.ts` and `lib/src/lib/terminal-registry.alert.test.ts`.
 
 ### Replay-time mode-reset tail (Dormouse-emitted)
 
diff --git a/docs/specs/terminal-escapes.rationale.md b/docs/specs/terminal-escapes.rationale.md
index 20a273c8d..42aef09bf 100644
--- a/docs/specs/terminal-escapes.rationale.md
+++ b/docs/specs/terminal-escapes.rationale.md
@@ -12,7 +12,7 @@
 
 **Why the incomplete-OSC buffer is capped.** The parser must hold bytes across PTY reads for a sequence split mid-flight, so an OSC that is never terminated would otherwise accumulate forever. No legitimate emitter sends a 16 KiB title, so dropping the held bytes past `OSC_INCOMPLETE_LIMIT` turns an unbounded-growth primitive into a discarded chunk.
 
-**Why `COMMAND_LINE_LIMIT` is applied on both sides of the unescape.** Bounding first stops a hostile command line from making the unescape allocate; sanitizing after catches the `\xNN` decoding, which is precisely what puts control characters back into a value that looked clean going in.
+**Why command-line source and decoded output have separate bounds.** The source caps allow encoding expansion (4× for OSC 633 or shell quoting, 12× for percent-encoded UTF-8) while bounding decoder allocation. The retained result has its own cap; post-decode sanitization removes controls introduced by decoding.
 
 **Why the sidecar no longer parses a second time.** It used to: standalone stripped in the frontend adapter, which the sidecar's stream to the phone never passed through, so without a second strip-only pass the phone saw OSC sequences the laptop never rendered. That pass needed a fake colour provider — "discarded" and "not parsed" are different things, and a *declined* OSC 10/11/12 survives in `visibleData` for the phone's xterm to answer a second time — and it began at first attach, so it could start mid-sequence. One parse at the process that owns the PTY removes the duplicate, the workaround, and the mid-sequence start together. What it costs is the theme push, since the sidecar has no DOM, and a webview that is told the semantic and Tool events rather than deriving them.
 
diff --git a/docs/specs/terminal-state.md b/docs/specs/terminal-state.md
index 3ca853920..dc2451fd4 100644
--- a/docs/specs/terminal-state.md
+++ b/docs/specs/terminal-state.md
@@ -40,7 +40,7 @@ CWD:
 
 **Every CWD is bounded at `MAX_CWD_LENGTH` and stripped of control characters before storage**, whatever the source ([terminal-escapes.md](terminal-escapes.md), rationale).
 
-**The OSC 7 host is the URL parser's mapped hostname except in case and the literal `localhost` spelling** — the two the raw slice alone preserves; a slice diverging further is unnormalized input, and taking it would let an ignorable code point inside `localhost` read as remote. Pinned by `bounds every CWD source and strips control characters` in `lib/src/lib/terminal-state.test.ts`. Source of truth: `fileUriHost` in `lib/src/lib/terminal-state.ts`.
+**Must use the URL parser's normalized OSC 7 hostname, preserving raw case and the literal `localhost` spelling only.** Pinned by `bounds every CWD source and strips control characters` in `lib/src/lib/terminal-state.test.ts`. Source of truth: `fileUriHost` in `lib/src/lib/terminal-state.ts`.
 
 Non-OSC CWD sources:
 
@@ -95,7 +95,9 @@ Source of truth: `cwdFromManualPath` in `lib/src/lib/terminal-state.ts`; `seedTe
 - `commandFinish` moves `currentCommand` to `lastCommand`, stores `event.finishedAt` (otherwise reducer time) and `exitCode`, snapshots the latest in-run OSC 0/2/9 title into `lastCommand.finalTerminalTitle` (titles older than `startedAt` or younger than `finishedAt` excluded), clears `currentCommand`, and sets `{ kind: "finished", exitCode }`. **With no `currentCommand` it only sets the activity**, never inventing a `lastCommand`.
 - `title` updates the per-source entry in `titleCandidates`. **Later OSC title events never erase earlier candidates from other sources.**
 
-Command-line tokenizing is dialect-free: **`\` escapes exactly the set `shellEscapePosix` writes** (`POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; both halves pinned by `terminal-state.test.ts`). **A leading `&` is PowerShell's call operator, never a POSIX background suffix**, and is dropped rather than read as a boundary. **A redirection keeps its `&` or `|`** — `2>&1`, `<&3`, `>|`, `&>`, `&>>` separate nothing — and **`|&`, like fish's `&|`, is a pipe**. **An unquoted `#` starting a word comments out the rest of its line.** **An unquoted newline separates commands like `;`**; a backslash-newline continues the line. **A here-document's body is skipped**: after an unquoted `<<` or `<<-` (not `<<<`), the lines through its delimiter, quotes removed and leading tabs stripped under `<<-`. **Grouping `(` `)` `{` `}` is dropped; a `$(…)`, `<(…)` or `>(…)` substitution or a `name=(…)` array is one word**, separators included. **An unquoted Windows path containing spaces stays split.** **A launcher suffix is not part of a program's name** — `npm.cmd` and `C:\tools\claude.exe` are `npm` and `claude` for the header, the WATCHING key, and the terminal context alike. Accepted: `foo.bat` and `foo.exe` in one directory cannot be watched separately. (rationale)
+**Must tokenize without selecting a shell dialect, and read back exactly the `POSIX_ESCAPABLE` set that `shellEscapePosix` writes.** **Must derive the same suffix-free program name for headers, WATCHING keys, and terminal context**: `npm.cmd` and `C:\tools\claude.exe` become `npm` and `claude`; launcher variants in one directory cannot be watched separately. (rationale)
+
+Source of truth: `tokenizeCommand` / `commandProgramName` in `lib/src/lib/terminal-state.ts`; `POSIX_ESCAPABLE` in `lib/src/lib/posix-escape.ts`; pinned by `lib/src/lib/terminal-state.test.ts`.
 
 **`displayCommand` is a one-line, per-program summary of those tokens** — the program name plus a bounded argument count, suffixed `| ...` or ` ...` past a pipeline or compound boundary. Source of truth: `summarizeCommandLine` and `commandTitleTokens` in `lib/src/lib/terminal-state.ts`.
 
diff --git a/lib/src/lib/resume-patterns.test.ts b/lib/src/lib/resume-patterns.test.ts
index 9c45e95a6..0b1508108 100644
--- a/lib/src/lib/resume-patterns.test.ts
+++ b/lib/src/lib/resume-patterns.test.ts
@@ -2,6 +2,15 @@ import { describe, it, expect } from 'vitest';
 import { detectResumeCommand } from './resume-patterns';
 
 describe('detectResumeCommand', () => {
+  it.each(['\x1b[', '\x9b'])('preserves recovery ID boundaries for CSI %j', (csi) => {
+    expect(detectResumeCommand('codex resume abc' + csi + '31mdef\n')).toBe('codex resume abcdef');
+    expect(detectResumeCommand('codex resume abc' + csi + '2Kxyz\n')).toBe('codex resume abc');
+    expect(detectResumeCommand('codex resume abc' + csi + '38;5')).toBeNull();
+  });
+  it.each(['\x1bD', '\x84', '\x1bE', '\x85', '\x1bM', '\x8d'])('does not weld recovery IDs across movement %j', (move) => {
+    expect(detectResumeCommand('codex resume abc' + move + 'xyz\n')).toBe('codex resume abc');
+  });
+
   it.each(['\n', '\r', '\t', ' ', '`', "'", ')', '.', '\x1b[K'])(
     'accepts an observed separator %j after the ID', (separator) => {
       expect(detectResumeCommand(`codex resume abc123${separator}`)).toBe('codex resume abc123');
diff --git a/lib/src/lib/terminal-controls.test.ts b/lib/src/lib/terminal-controls.test.ts
index 1f5241c71..ee06721dc 100644
--- a/lib/src/lib/terminal-controls.test.ts
+++ b/lib/src/lib/terminal-controls.test.ts
@@ -57,6 +57,19 @@ describe('TerminalControlStreamFilter', () => {
 });
 
 describe('stripTerminalControls', () => {
+  it.each(['\x1b[', '\x9b'])('treats CSI introducer %j consistently in both readings', (csi) => {
+    expect(stripTerminalControls('a' + csi + '31mb')).toBe('ab');
+    expect(stripTerminalControls('a' + csi + '31mb', { boundaries: true })).toBe('ab');
+    expect(stripTerminalControls('a' + csi + '2Kb', { boundaries: true })).toBe('a\nb');
+    expect(stripTerminalControls('a' + csi + '?1049hb')).toBe('ab');
+    expect(stripTerminalControls('a' + csi + '38;5', { boundaries: true })).toBe('a');
+    expect(stripTerminalControls('a' + csi, { boundaries: true })).toBe('a');
+  });
+  it.each(['\x1bD', '\x84', '\x1bE', '\x85', '\x1bM', '\x8d'])('seams cursor movement %j in either representation', (move) => {
+    expect(stripTerminalControls('a' + move + 'b', { boundaries: true })).toBe('a\nb');
+    expect(stripTerminalControls('a' + move + 'b')).toBe('ab');
+  });
+
   it('removes terminated string controls with their payload', () => {
     expect(stripTerminalControls('\x1b]0;window title\x07user$ ')).toBe('user$ ');
     expect(stripTerminalControls('\x1bP+q544e\x1b\\user$ ')).toBe('user$ ');
@@ -169,4 +182,15 @@ describe('stripTerminalControls', () => {
       }
     });
   });
+  it.each(Array.from({ length: 32 }, (_, index) => index + 0x40)
+    .filter(final => ![0x50, 0x58, 0x5b, 0x5d, 0x5e, 0x5f].includes(final)))
+  ('standalone C1 and ESC Fe counterpart 0x%s preserve the same boundary', final => {
+    const esc = '\x1b' + String.fromCharCode(final);
+    const c1 = String.fromCharCode(final + 0x40);
+    for (const control of [esc, c1]) {
+      expect(stripTerminalControls('left' + control + 'right', { boundaries: true })).toBe('left\nright');
+      expect(stripTerminalControls('left' + control + 'right')).toBe('leftright');
+    }
+  });
+
 });
diff --git a/lib/src/lib/terminal-controls.ts b/lib/src/lib/terminal-controls.ts
index 5bf5a28af..13b6b3d7f 100644
--- a/lib/src/lib/terminal-controls.ts
+++ b/lib/src/lib/terminal-controls.ts
@@ -182,19 +182,21 @@ function stripPresentationControls(stringsRemoved: string, boundaries: boolean):
       // An unfinished CSI or ESC sequence has not moved the cursor yet. Drop
       // its tail without a synthetic boundary: it may become SGR or a charset
       // designator whose following text continues the same word on the next read.
-      .replace(/\x1b(?:\[[0-?]*[ -/]*|[ -/]*)$/, '')
+      .replace(/(?:\x1b\[|\x9b)[0-?]*[ -/]*$|\x1b[ -/]*$/, '')
       // CSI.
-      .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, csi)
+      .replace(/(?:\x1b\[|\x9b)[0-?]*[ -/]*[@-~]/g, csi)
       // Charset designators (G0–G3): no cursor movement, no erase, so like SGR
       // they leave the text either side genuinely contiguous.
       .replace(/\x1b[()*+][A-Za-z0-9]/g, '')
       // Remaining ESC sequences use the full Fp/Fe/Fs/nF final-byte range;
       // matching only the introducer would leak finals such as `7`, `8`, or `c`.
       .replace(/\x1b[ -/]*[0-~]/g, boundary)
-      // Backspace, VT and FF move the cursor, so they seam two regions the same
-      // way a CSI move does — give them the same boundary when asked.
-      .replace(/[\x08\x0b\x0c]/g, boundary)
-      // Preserve LF/CR/TAB as text boundaries; discard other C0/C1 controls.
-      .replace(/[\x00-\x08\x0e-\x1f\x7f-\x9f]/g, '')
+      // BS, VT and FF move the cursor. Remaining standalone C1 controls
+      // take the same conservative boundary as their ESC Fe equivalents;
+      // string controls and CSI were already consumed above.
+      .replace(/[\x08\x0b\x0c\x80-\x9f]/g, boundary)
+      // Preserve LF/CR/TAB as text boundaries. Other C0 controls (e.g. BEL,
+      // ENQ and charset shifts) do not move or erase text and are discarded.
+      .replace(/[\x00-\x08\x0e-\x1f\x7f]/g, '')
   );
 }
diff --git a/lib/src/lib/terminal-lifecycle.ts b/lib/src/lib/terminal-lifecycle.ts
index 6b2ee1cb0..858d3f6e5 100644
--- a/lib/src/lib/terminal-lifecycle.ts
+++ b/lib/src/lib/terminal-lifecycle.ts
@@ -367,11 +367,15 @@ function typeCommandWhenPromptReady(id: string, command: string, requireIntegrat
       : getTerminalPaneState(id).currentCommand === null;
     if (ready) {
       clearInterval(timer);
+      seedLaunchedCommand(id, command);
       getPlatform().writePty(id, `${command}\r`);
     } else if ((elapsed += LAUNCH_PROMPT_POLL_MS) >= timeoutMs) {
       clearInterval(timer);
       // Best effort for split; drop for ensure (the handler kills + errors).
-      if (!requireIntegration) getPlatform().writePty(id, `${command}\r`);
+      if (!requireIntegration) {
+        seedLaunchedCommand(id, command);
+        getPlatform().writePty(id, `${command}\r`);
+      }
     }
   }, LAUNCH_PROMPT_POLL_MS);
 }
diff --git a/lib/src/lib/terminal-protocol.ts b/lib/src/lib/terminal-protocol.ts
index facaa1c04..4e504be70 100644
--- a/lib/src/lib/terminal-protocol.ts
+++ b/lib/src/lib/terminal-protocol.ts
@@ -725,8 +725,10 @@ function parseOsc133CommandLine(params: string): TerminalProtocolEvent[] {
 /**
  * The `commandLine` event for a shell-reported command line, from `OSC 633 ; E`
  * or `OSC 133 ; C` alike (`docs/specs/terminal-escapes.md`): bounded *before*
- * `decode` to `COMMAND_LINE_LIMIT` code points of at most `encodedWidth`
- * characters each, so a megabyte of escapes is never decoded to be thrown away,
+ * `decode` to `COMMAND_LINE_LIMIT * encodedWidth` source code points, with
+ * multipliers 4 for OSC 633 / shell-quoted input and 12 for percent-encoded
+ * UTF-8. The decoded value is capped separately at `COMMAND_LINE_LIMIT`, so
+ * a megabyte of escapes is never decoded to be thrown away,
  * and sanitized *after* it, because decoding is what puts control characters
  * back. One that reduces to nothing is dropped rather than stored empty.
  */
diff --git a/lib/src/lib/terminal-registry.alert.test.ts b/lib/src/lib/terminal-registry.alert.test.ts
index 132e7eda0..cfceca106 100644
--- a/lib/src/lib/terminal-registry.alert.test.ts
+++ b/lib/src/lib/terminal-registry.alert.test.ts
@@ -472,6 +472,31 @@ describe('terminal-registry alert behavior', () => {
     expect(received).toEqual(['pnpm storybook\r']);
   });
 
+  it.each(['restore', 'split'])('seeds the actual %s launch after a non-integrated shell prompt', async (launch) => {
+    const id = 'launch-after-prompt-' + launch;
+    const received: string[] = [];
+    fakePlatform.setInputHandler(id, (data) => {
+      expect(getTerminalPaneState(id).currentCommand?.rawCommandLine).toBe('codex resume abc');
+      received.push(data);
+    });
+    if (launch === 'restore') restoreTerminal(id, { resumeCommand: 'codex resume abc' });
+    else { setPendingShellOpts(id, { command: 'codex resume abc' }); getOrCreateTerminal(id); }
+    fakePlatform.sendOutput(id, 'C:\\repo>');
+    await vi.advanceTimersByTimeAsync(200);
+    expect(received).toEqual(['codex resume abc\r']);
+    expect(getTerminalPaneState(id).currentCommand?.source).toBe('user_input');
+    expect(countRunningSessions()).toBe(1);
+  });
+  it('keeps reported CWD when seeding the actual launch and lets authentic boundaries win', async () => {
+    const id = 'launch-current-cwd';
+    fakePlatform.setInputHandler(id, () => {});
+    restoreTerminal(id, { command: 'pnpm dev', cwd: '/old', requireIntegration: true });
+    fakePlatform.sendOutput(id, '\x1b]633;P;Cwd=/actual\x07\x1b]633;A\x07\x1b]633;B\x07');
+    await vi.advanceTimersByTimeAsync(200);
+    expect(getTerminalPaneState(id).currentCommand).toMatchObject({ source: 'user_input', cwdAtStart: { path: '/actual', source: 'osc633' } });
+    fakePlatform.sendOutput(id, '\x1b]633;E;pnpm dev\x07\x1b]633;C\x07');
+    expect(getTerminalPaneState(id).currentCommand?.source).toBe('osc633_E');
+  });
   it('announces the resume in the pane instead of replaying a transcript', () => {
     const id = 'noticed-resume-command';
     const entry = restoreTerminal(id, { resumeCommand: 'codex resume 01JCX8ZK' });
diff --git a/lib/src/lib/terminal-state.ts b/lib/src/lib/terminal-state.ts
index f163dd6d2..a256132cd 100644
--- a/lib/src/lib/terminal-state.ts
+++ b/lib/src/lib/terminal-state.ts
@@ -379,10 +379,22 @@ export function summarizeCommandLine(raw: string): string {
 }
 
 /**
- * The key WATCHING rules are stored under: the program a command line waits on,
- * as a bare name or `<runner> <script>`, or null when the line holds no
- * runnable word. Every key it returns passes {@link isWatchKey}. The rules that
- * derive it are `docs/specs/alert.md` -> WATCHING Track.
+ * WATCHING's canonical lexical key, using only the shell-reported raw line.
+ * Take the last command of a list and its first pipeline stage, ignoring
+ * grouping, compound-command grammar (POSIX and fish), loop headers, and case
+ * patterns. A closing segment contributes no command, including its
+ * redirections/pipeline. Strip redirections and separate targets before
+ * selecting either program or script.
+ *
+ * Skip leading assignments and known transparent wrappers; an unknown wrapper
+ * flag stops the skip rather than guessing how many words it consumes. Reduce
+ * argv[0] to its basename without a launcher suffix. Script runners key as
+ * `<runner> <script>` after their flags/shared run verb; an invalid script key
+ * falls back to the bare runner. Empty or invalid program names return null.
+ * Every returned key passes isWatchKey. The helper tables/functions below own
+ * accepted wrapper flags, runner flags, and shell grammar; tests pin these in
+ * terminal-state.test.ts -> WATCHING key. Cross-module eligibility and matching
+ * rules remain in docs/specs/alert.md -> WATCHING Track.
  */
 export function commandWatchKey(raw: string): string | null {
   const commands = listCommands(tokenizeCommand(raw.trim()));
diff --git a/lib/src/remote/burrow/push-delivery.test.ts b/lib/src/remote/burrow/push-delivery.test.ts
index b53438e05..ba9fbdf42 100644
--- a/lib/src/remote/burrow/push-delivery.test.ts
+++ b/lib/src/remote/burrow/push-delivery.test.ts
@@ -200,6 +200,30 @@ describe('toPushText', () => {
   });
 });
 
+describe('push target preview', () => {
+  it('names only the newest subscribed records a bounded send can target', async () => {
+    const base = aclRecord(PHONE, 'base');
+    records = Array.from({ length: MAX_PUSH_QUERY_DELIVERY_IDS + 3 }, (_, i) => ({
+      ...base, deliveryId: id32(`preview-${i}-`), label: `phone ${i}`,
+    }));
+    subscribed = records.map((record) => record.deliveryId);
+    expect(new Set(subscribed).size).toBe(records.length);
+    const expected = records.slice(-MAX_PUSH_QUERY_DELIVERY_IDS);
+    expect(await loadPushDevices(deps())).toEqual(expected.map(({ label }) => ({ label })));
+    await sendPush(deps(), 'pty-1', 'terminal');
+    expect(lastRecipients()).toEqual(expected.map(({ deliveryId }) => deliveryId));
+  });
+
+  it('does not list an older subscription excluded before the Relay intersection', async () => {
+    const base = aclRecord(PHONE, 'base');
+    records = Array.from({ length: MAX_PUSH_QUERY_DELIVERY_IDS + 1 }, (_, i) => ({
+      ...base, deliveryId: id32(`preview-${i}-`), label: `phone ${i}`,
+    }));
+    subscribed = [records[0]!.deliveryId];
+    expect(await loadPushDevices(deps())).toEqual([]);
+  });
+});
+
 describe('sendPush', () => {
   it('sends the label sealed, tagged per Session', async () => {
     await sendPush(deps(), 'pty-1', 'terminal');
@@ -342,7 +366,7 @@ describe('sealed push', () => {
     // dead records accumulate.
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
     const ids = Array.from({ length: MAX_PUSH_QUERY_DELIVERY_IDS + 3 }, (_, i) =>
-      id32(`delivery-${i}`),
+      id32(`delivery-${i}-`),
     );
     // Real statics, since `aclRecord` seals against whatever this map holds.
     for (const deliveryId of ids) clientStatics.set(deliveryId, await generateNoiseKeyPair());
diff --git a/lib/src/remote/burrow/push-delivery.ts b/lib/src/remote/burrow/push-delivery.ts
index 11f3c6664..8e022ee1f 100644
--- a/lib/src/remote/burrow/push-delivery.ts
+++ b/lib/src/remote/burrow/push-delivery.ts
@@ -102,6 +102,16 @@ export interface AlertPushDeps {
   readonly fetch?: typeof globalThis.fetch;
 }
 
+/**
+ * The send route refuses the whole POST above its recipient bound. Approval
+ * order places replacements after stale statics, so both sending and its
+ * preview select the newest records before intersecting Relay subscriptions.
+ * Keeping this choice shared prevents Settings naming phones a send omits.
+ */
+function pushTargets(records: readonly BurrowAclRecord[]): readonly BurrowAclRecord[] {
+  return records.slice(-MAX_PUSH_QUERY_DELIVERY_IDS);
+}
+
 /**
  * The devices the settings dialog names: subscribed on the Relay **and** still
  * active in the Burrow's ACL, joined by `deliveryId` to the ACL's human labels.
@@ -119,7 +129,7 @@ export async function loadPushDevices(deps: AlertPushDeps): Promise<PushDevice[]
   const response = await burrowFetch(deps, API_ROUTES.pushDevices);
   const body = (await response.json()) as PushDevicesResponse;
 
-  const labels = new Map(deps.activeRecords().map((r) => [r.deliveryId, r.label]));
+  const labels = new Map(pushTargets(deps.activeRecords()).map((r) => [r.deliveryId, r.label]));
   return body.devices
     .filter((device) => labels.has(device.deliveryId))
     .map((device) => ({ label: labels.get(device.deliveryId) || 'Unnamed device' }));
@@ -144,15 +154,7 @@ export async function sendPush(
   // (`docs/specs/alert.md` -> Push notifications owns the recipient rule).
   const all = deps.activeRecords();
   if (all.length === 0) return { targeted: 0, delivered: 0, failed: 0 };
-  // The send route refuses more than this, and it refuses the *whole* POST — so
-  // an unclamped fan-out past the bound would reach nobody rather than most.
-  //
-  // **The newest end, not the oldest.** `activeRecords()` is in approval order,
-  // and re-pairing a phone that lost its IndexedDB mints a fresh Client static,
-  // which supersedes nothing — so the old record stays active forever, ahead of
-  // its own replacement. Clamping from the front would push to dead records and
-  // drop the phones actually in use.
-  const records = all.slice(-MAX_PUSH_QUERY_DELIVERY_IDS);
+  const records = pushTargets(all);
   if (records.length !== all.length) {
     console.warn(
       `burrow: ${all.length} devices are paired; pushing to the ${MAX_PUSH_QUERY_DELIVERY_IDS} most recent`,
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 6dbf3035d..fb6f52192 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -2,8 +2,8 @@
   "AGENTS.md": 3600,
   "SECURITY.md": 200,
   "SELF_HOST.md": 6100,
-  "docs/compatible-agents.md": 1750,
-  "docs/specs/alert.md": 8900,
+  "docs/compatible-agents.md": 1800,
+  "docs/specs/alert.md": 8650,
   "docs/specs/auto-update.md": 1450,
   "docs/specs/deploy.md": 1950,
   "docs/specs/dor-browser.md": 9350,
@@ -32,8 +32,8 @@
   "docs/specs/shortcuts.md": 1100,
   "docs/specs/standalone.md": 11950,
   "docs/specs/terminal-context.md": 1100,
-  "docs/specs/terminal-escapes.md": 4100,
-  "docs/specs/terminal-state.md": 2550,
+  "docs/specs/terminal-escapes.md": 4050,
+  "docs/specs/terminal-state.md": 2400,
   "docs/specs/theme.md": 2400,
   "docs/specs/tiling-engine.md": 4450,
   "docs/specs/transport.md": 5050,