diff --git a/.github/workflows/installer-verify.yml b/.github/workflows/installer-verify.yml
new file mode 100644
index 000000000..a9910cd52
--- /dev/null
+++ b/.github/workflows/installer-verify.yml
@@ -0,0 +1,45 @@
+name: Verify installers
+
+on:
+  pull_request:
+    paths:
+      - "install*.ps1"
+      - "install*.sh"
+      - "uninstall*.ps1"
+      - "uninstall*.sh"
+      - "scripts/verify-installers.ps1"
+      - "src/Ai.Tlbx.MidTerm.Common/Identity/**"
+      - "src/Ai.Tlbx.MidTerm/Settings/**"
+      - "src/Ai.Tlbx.MidTerm/Startup/**"
+      - "src/Ai.Tlbx.MidTerm/Services/Certificates/**"
+      - "src/Ai.Tlbx.MidTerm/Services/Updates/**"
+  push:
+    branches: [main, dev]
+    paths:
+      - "install*.ps1"
+      - "install*.sh"
+      - "uninstall*.ps1"
+      - "uninstall*.sh"
+      - "scripts/verify-installers.ps1"
+      - "src/Ai.Tlbx.MidTerm.Common/Identity/**"
+      - "src/Ai.Tlbx.MidTerm/Settings/**"
+      - "src/Ai.Tlbx.MidTerm/Startup/**"
+      - "src/Ai.Tlbx.MidTerm/Services/Certificates/**"
+      - "src/Ai.Tlbx.MidTerm/Services/Updates/**"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, windows-2025]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - name: Verify installer contracts
+        shell: pwsh
+        run: ./scripts/verify-installers.ps1
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index e819e5aca..5dd26bd35 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -32,6 +32,9 @@ jobs:
           source: ./docs/site
           destination: ./_site
 
+      - name: Make Pages artifact writable
+        run: sudo chown -R "$(id -u):$(id -g)" ./_site
+
       - name: Publish canonical signed-release installers
         run: |
           cp ./install.sh ./_site/install.sh
@@ -44,9 +47,6 @@ jobs:
           test -f ./_site/uninstall.sh
           test -f ./_site/uninstall.ps1
 
-      - name: Make Pages artifact writable
-        run: sudo chown -R "$(id -u):$(id -g)" ./_site
-
       - name: Normalize and verify duplicate Pages search metadata
         shell: python
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b2b66f818..de612671d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -642,9 +642,14 @@ jobs:
           Copy-Item "src/Ai.Tlbx.MidTerm/bin/Release/net10.0/$rid/publish/mt.exe" "staging/$rid/"
           Copy-Item "src/Ai.Tlbx.MidTerm.TmuxShim/bin/Release/net10.0/$rid/publish/mttmux.exe" "staging/$rid/"
           Copy-Item src/version.json "staging/$rid/"
+          Copy-Item "src/Ai.Tlbx.MidTerm/src/static/THIRD-PARTY-LICENSES.txt" "staging/$rid/"
           $mthostPath = "src/Ai.Tlbx.MidTerm.TtyHost/bin/Release/net10.0/$rid/publish/mthost.exe"
           if (Test-Path $mthostPath) {
             Copy-Item $mthostPath "staging/$rid/"
+            ./scripts/copy-windows-conpty-runtime.ps1 `
+              -SourceDir (Split-Path -Parent $mthostPath) `
+              -DestinationDir "staging/$rid" `
+              -Rid $rid
           } else {
             Write-Host "mthost.exe not found for $rid; continuing with web-only artifact set"
           }
@@ -654,13 +659,12 @@ jobs:
         shell: pwsh
         run: |
           $rid = '${{ matrix.rid }}'
-          $files = @("staging/$rid/mt.exe", "staging/$rid/mtagenthost.exe", "staging/$rid/mttmux.exe")
-          if (Test-Path "staging/$rid/mthost.exe") {
-            $files += "staging/$rid/mthost.exe"
-          }
-          $hashes = Get-ChildItem $files | ForEach-Object {
+          $root = (Resolve-Path "staging/$rid").Path
+          $files = Get-ChildItem $root -Recurse -File | Where-Object Name -NotIn @("version.json", "SHA256SUMS.txt")
+          $hashes = $files | ForEach-Object {
             $hash = (Get-FileHash $_ -Algorithm SHA256).Hash.ToLower()
-            "$hash  $($_.Name)"
+            $relativePath = [IO.Path]::GetRelativePath($root, $_.FullName).Replace('\', '/')
+            "$hash  $relativePath"
           }
           $hashes | Set-Content "staging/$rid/SHA256SUMS.txt"
           Write-Host "=== $rid ==="
@@ -743,9 +747,14 @@ jobs:
           Copy-Item "src/Ai.Tlbx.MidTerm/bin/Release/net10.0/$rid/publish/mt.exe" "staging/$rid/"
           Copy-Item "src/Ai.Tlbx.MidTerm.TmuxShim/bin/Release/net10.0/$rid/publish/mttmux.exe" "staging/$rid/"
           Copy-Item src/version.json "staging/$rid/"
+          Copy-Item "src/Ai.Tlbx.MidTerm/src/static/THIRD-PARTY-LICENSES.txt" "staging/$rid/"
           $mthostPath = "src/Ai.Tlbx.MidTerm.TtyHost/bin/Release/net10.0/$rid/publish/mthost.exe"
           if (Test-Path $mthostPath) {
             Copy-Item $mthostPath "staging/$rid/"
+            ./scripts/copy-windows-conpty-runtime.ps1 `
+              -SourceDir (Split-Path -Parent $mthostPath) `
+              -DestinationDir "staging/$rid" `
+              -Rid $rid
           } else {
             Write-Host "mthost.exe not found for $rid; continuing with web-only artifact set"
           }
@@ -789,13 +798,12 @@ jobs:
         shell: pwsh
         run: |
           $rid = '${{ matrix.rid }}'
-          $files = @("staging/$rid/mt.exe", "staging/$rid/mtagenthost.exe", "staging/$rid/mttmux.exe")
-          if (Test-Path "staging/$rid/mthost.exe") {
-            $files += "staging/$rid/mthost.exe"
-          }
-          $hashes = Get-ChildItem $files | ForEach-Object {
+          $root = (Resolve-Path "staging/$rid").Path
+          $files = Get-ChildItem $root -Recurse -File | Where-Object Name -NotIn @("version.json", "SHA256SUMS.txt")
+          $hashes = $files | ForEach-Object {
             $hash = (Get-FileHash $_ -Algorithm SHA256).Hash.ToLower()
-            "$hash  $($_.Name)"
+            $relativePath = [IO.Path]::GetRelativePath($root, $_.FullName).Replace('\', '/')
+            "$hash  $relativePath"
           }
           $hashes | Set-Content "staging/$rid/SHA256SUMS.txt"
           Write-Host "=== $rid ==="
diff --git a/README.md b/README.md
index 25e523e08..3fb23867b 100644
--- a/README.md
+++ b/README.md
@@ -92,7 +92,7 @@ curl -fsSL https://get.tlbx.ai/install.sh | bash
 irm https://get.tlbx.ai/install.ps1 | iex
 ```
 
-Open `https://localhost:2000`. Choose service mode for a host that should survive logouts and reboots; user mode needs no administrator access.
+The installer starts tlbx, waits until its process and HTTPS health endpoint are ready, and then prints clickable localhost and available Tailscale URLs for the configured port. Choose service mode for a host that should survive logouts and reboots; user mode needs no administrator access.
 
 These commands install the current stable release. Add `--dev` on macOS/Linux or `-Dev` on Windows only when you explicitly want the prerelease channel.
 
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index a844f61bd..52ef87273 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -602,6 +602,8 @@ The root `install.ps1` and `install.sh` scripts handle:
 - certificate reuse plus trust flows for both newly generated and reused certificates
 - platform-specific install paths and service registration
 - channel selection and release download
+- detached user-mode startup, supervised service startup, and fatal process/HTTPS readiness verification
+- ready-to-open localhost plus reachable Tailscale URLs for the configured bind address and port
 - update logging
 
 ### Update Service
diff --git a/docs/AgentControllerSessionDesign.md b/docs/AgentControllerSessionDesign.md
index 76e244f5b..060b73e92 100644
--- a/docs/AgentControllerSessionDesign.md
+++ b/docs/AgentControllerSessionDesign.md
@@ -681,7 +681,7 @@ Status in this branch/work item:
 - implemented: the history pane itself is again the native local pixel scroller for the currently materialized kernel, while browse-mode retained-window growth and trims preserve the reader anchor
 - implemented: ordinary local pane scrolling no longer force-refreshes the already loaded history window when no window shift is needed; forced same-window refetch is reserved for urgent void-recovery cases where the viewport has lost all intersecting concrete rows
 - implemented: direct progress-nav scrubs now jump to a tiny centered preview window first and then hydrate into a normal browse window after drag idle, so large jumps do not try to materialize the traversed span
-- implemented gap: canonical interactive request/question flows now have a dedicated frontend interview widget, but the backend model still represents them as request summaries rather than a first-class canonical `interview` item type
+- implemented: canonical interactive request/question flows are first-class `interview` history items with embedded questions and answers; the frontend prefers that self-renderable payload and retains request-summary lookup only as a compatibility fallback
 
 Still mandatory after this work whenever Agent Controller Session evolves:
 
diff --git a/docs/ai/AGENTS.md b/docs/ai/AGENTS.md
index 986d14fbf..06a1c67b1 100644
--- a/docs/ai/AGENTS.md
+++ b/docs/ai/AGENTS.md
@@ -95,8 +95,9 @@ tlbx is a web-based terminal multiplexer. Native AOT compiled, runs on macOS/Win
 - `mthost` / `mthost.exe` — TTY host (spawned per terminal, all platforms)
 
 **Settings locations:**
-- Service mode: `%ProgramData%\MidTerm\settings.json` (Win) or `/usr/local/etc/midterm/settings.json` (Unix)
-- User mode: `~/.midterm/settings.json`
+- Service mode: `%ProgramData%\tlbx\settings.json` (Win) or `/usr/local/etc/tlbx/settings.json` (Unix)
+- User mode: `~/.tlbx/settings.json`
+- Existing legacy installations continue to use their `MidTerm` / `.midterm` paths in place.
 
 **Platform defaults:**
 - Windows — ConPTY, default shell `Pwsh`
diff --git a/docs/ai/CLAUDE.md b/docs/ai/CLAUDE.md
index ad5865094..0808e9910 100644
--- a/docs/ai/CLAUDE.md
+++ b/docs/ai/CLAUDE.md
@@ -70,8 +70,9 @@ tlbx is a web-based terminal multiplexer. Native AOT compiled, runs on macOS/Win
 - `mthost` / `mthost.exe` — TTY host (spawned per terminal, all platforms)
 
 **Settings locations:**
-- Service mode: `%ProgramData%\MidTerm\settings.json` (Win) or `/usr/local/etc/midterm/settings.json` (Unix)
-- User mode: `~/.midterm/settings.json`
+- Service mode: `%ProgramData%\tlbx\settings.json` (Win) or `/usr/local/etc/tlbx/settings.json` (Unix)
+- User mode: `~/.tlbx/settings.json`
+- Existing legacy installations continue to use their `MidTerm` / `.midterm` paths in place.
 
 **Platform defaults:**
 - Windows — ConPTY, default shell `Pwsh`
diff --git a/docs/multi-instance-install.md b/docs/multi-instance-install.md
index ffcd5f8e6..2e8229a4e 100644
--- a/docs/multi-instance-install.md
+++ b/docs/multi-instance-install.md
@@ -39,9 +39,9 @@ Use the normal installer when:
 - the service should stay at the default identity and port
 - you are upgrading an existing normal installation
 
-Do not mix installer families for the same instance. A normal `MidTerm` service
-should be managed by the normal installer. `MidTerm-<name>`,
-`midterm-<name>`, and `ai.tlbx.midterm.<name>` services should be managed by
+Do not mix installer families for the same instance. A normal `tlbx` service
+should be managed by the normal installer. `tlbx-<name>` and
+`ai.tlbx.instance.<name>` services should be managed by
 the multi-instance installer.
 
 ## Platform and architecture support
@@ -95,9 +95,9 @@ For an instance named `alice`, the generated identities are:
 
 | Platform | Service identity |
 | --- | --- |
-| Windows | `MidTerm-alice` |
-| Linux | `midterm-alice` |
-| macOS | `ai.tlbx.midterm.alice` |
+| Windows | `tlbx-alice` |
+| Linux | `tlbx-alice` |
+| macOS | `ai.tlbx.instance.alice` |
 
 The settings directory contains an `instance.json` manifest with the effective
 name, port, bind address, service identity, install directory, settings
@@ -109,19 +109,19 @@ Windows defaults:
 
 | Purpose | Default |
 | --- | --- |
-| Settings root | `%ProgramData%\MidTerm\instances` |
-| Install root | `%ProgramFiles%\MidTerm\instances` |
-| Instance settings | `%ProgramData%\MidTerm\instances\<name>` |
-| Instance binaries | `%ProgramFiles%\MidTerm\instances\<name>` |
+| Settings root | `%ProgramData%\tlbx\instances` |
+| Install root | `%ProgramFiles%\tlbx\instances` |
+| Instance settings | `%ProgramData%\tlbx\instances\<name>` |
+| Instance binaries | `%ProgramFiles%\tlbx\instances\<name>` |
 
 macOS and Linux defaults:
 
 | Purpose | Default |
 | --- | --- |
-| Settings root | `/usr/local/etc/midterm-instances` |
-| Install root | `/usr/local/lib/midterm/instances` |
-| Instance settings | `/usr/local/etc/midterm-instances/<name>` |
-| Instance binaries | `/usr/local/lib/midterm/instances/<name>` |
+| Settings root | `/usr/local/etc/tlbx-instances` |
+| Install root | `/usr/local/lib/tlbx/instances` |
+| Instance settings | `/usr/local/etc/tlbx-instances/<name>` |
+| Instance binaries | `/usr/local/lib/tlbx/instances/<name>` |
 
 These roots are intentionally separate from the normal installer paths. Do not
 point a multi-instance install at the normal service directory.
@@ -149,8 +149,8 @@ Run from an elevated PowerShell session.
 | `-BasePort` | `int` | `2000` | `install`, `plan` | First candidate port when `-Ports` is not provided. Used ports are skipped. |
 | `-Ports` | `int[]` | empty | `install`, `plan`, `update`, `remove` | Explicit ports. Must contain exactly one port per resolved instance name. |
 | `-BindAddress` | `string` | `0.0.0.0` | `install`, `update`, `update-all`, `plan` | Address passed to `mt --bind`. Use `127.0.0.1` for local-only access. |
-| `-RootDir` | `string` | `%ProgramData%\MidTerm\instances` | all | Root for instance settings and manifests. |
-| `-InstallRoot` | `string` | `%ProgramFiles%\MidTerm\instances` | install/update/remove | Root for instance binaries. |
+| `-RootDir` | `string` | `%ProgramData%\tlbx\instances` | all | Root for instance settings and manifests. |
+| `-InstallRoot` | `string` | `%ProgramFiles%\tlbx\instances` | install/update/remove | Root for instance binaries. |
 | `-VersionTag` | `string` | `latest` | install/update/update-all | GitHub release tag, for example `v9.18.0-dev`. |
 | `-AssetPath` | `string` | empty | install/update/update-all | Local zip asset. Overrides GitHub download. |
 | `-PasswordHash` | `string` | empty | install | Precomputed PBKDF2 password hash. Preferred for automated agents. |
@@ -182,8 +182,8 @@ sudo ./install-multi.sh --mode remove --names alice
 | `--base-port` | `N` | `2000` | `install`, `plan` | First candidate port when `--ports` is not provided. Used ports are skipped when `ss` or `lsof` is available. |
 | `--ports` | `p1,p2,p3` | empty | `install`, `plan`, `update`, `remove` | Explicit ports. Must contain exactly one port per resolved instance name. |
 | `--bind` | address | `0.0.0.0` | `install`, `update`, `update-all`, `plan` | Address passed to `mt --bind`. Use `127.0.0.1` for local-only access. |
-| `--root-dir` | path | `/usr/local/etc/midterm-instances` | all | Root for instance settings and manifests. |
-| `--install-root` | path | `/usr/local/lib/midterm/instances` | install/update/remove | Root for instance binaries. |
+| `--root-dir` | path | `/usr/local/etc/tlbx-instances` | all | Root for instance settings and manifests. |
+| `--install-root` | path | `/usr/local/lib/tlbx/instances` | install/update/remove | Root for instance binaries. |
 | `--version-tag` | tag | `latest` | install/update/update-all | GitHub release tag, for example `v9.18.0-dev`. |
 | `--asset-path` | path | empty | install/update/update-all | Local tar.gz asset. Overrides GitHub download. |
 | `--password-hash` | hash | empty | install | Precomputed PBKDF2 password hash. Preferred for automated agents. |
@@ -200,14 +200,16 @@ valid for manual diagnostics.
 
 | Runtime flag | Environment variable | Meaning |
 | --- | --- | --- |
-| `--port <port>` | `MIDTERM_PORT` | HTTPS listener port. |
-| `--bind <address>` | `MIDTERM_BIND` | Listener bind address. |
-| `--settings-dir <path>` | `MIDTERM_SETTINGS_DIR` | Settings, secrets, certs, logs, sessions, update state. |
-| `--service-mode` | `MIDTERM_SERVICE_MODE=true` | Force service-mode paths and secret storage behavior. |
-| `--user-mode` | `MIDTERM_SERVICE_MODE=false` | Force user-mode behavior. Do not use for installed multi-instance services. |
-| `--service-name <name>` | `MIDTERM_SERVICE_NAME` | Windows service identity used by updates and restarts. |
-| `--launchd-label <label>` | `MIDTERM_LAUNCHD_LABEL` | macOS launchd identity used by updates and restarts. |
-| `--systemd-service <name>` | `MIDTERM_SYSTEMD_SERVICE` | Linux systemd unit used by updates and restarts. |
+| `--port <port>` | `TLBX_PORT` | HTTPS listener port. |
+| `--bind <address>` | `TLBX_BIND` | Listener bind address. |
+| `--settings-dir <path>` | `TLBX_SETTINGS_DIR` | Settings, secrets, certs, logs, sessions, update state. |
+| `--service-mode` | `TLBX_SERVICE_MODE=true` | Force service-mode paths and secret storage behavior. |
+| `--user-mode` | `TLBX_SERVICE_MODE=false` | Force user-mode behavior. Do not use for installed multi-instance services. |
+| `--service-name <name>` | `TLBX_SERVICE_NAME` | Windows service identity used by updates and restarts. |
+| `--launchd-label <label>` | `TLBX_LAUNCHD_LABEL` | macOS launchd identity used by updates and restarts. |
+| `--systemd-service <name>` | `TLBX_SYSTEMD_SERVICE` | Linux systemd unit used by updates and restarts. |
+
+The legacy `MIDTERM_*` environment-variable aliases remain accepted for existing automation; when both forms are set, `TLBX_*` wins.
 
 For multi-instance services, always pass `--settings-dir` and `--service-mode`.
 Do not rely on default settings paths, because defaults resolve to the normal
@@ -428,25 +430,25 @@ File system:
 Windows:
 
 ```powershell
-Get-Service MidTerm-alice
-Restart-Service MidTerm-alice
-Stop-Service MidTerm-alice
-Start-Service MidTerm-alice
+Get-Service tlbx-alice
+Restart-Service tlbx-alice
+Stop-Service tlbx-alice
+Start-Service tlbx-alice
 ```
 
 Linux:
 
 ```bash
-systemctl status midterm-alice
-sudo systemctl restart midterm-alice
-sudo journalctl -u midterm-alice -n 200 --no-pager
+systemctl status tlbx-alice
+sudo systemctl restart tlbx-alice
+sudo journalctl -u tlbx-alice -n 200 --no-pager
 ```
 
 macOS:
 
 ```bash
-sudo launchctl print system/ai.tlbx.midterm.alice
-sudo launchctl kickstart -k system/ai.tlbx.midterm.alice
+sudo launchctl print system/ai.tlbx.instance.alice
+sudo launchctl kickstart -k system/ai.tlbx.instance.alice
 sudo log show --predicate 'process == "mt"' --last 10m
 ```
 
@@ -464,7 +466,7 @@ For each instance:
 8. Updating one instance does not change the binary timestamp or version of
    another instance.
 9. Stopping one service does not stop another service.
-10. The normal `MidTerm` service on port `2000` is unchanged unless it was
+10. The normal `tlbx` service on port `2000` is unchanged unless it was
     intentionally part of the plan.
 
 PowerShell endpoint check:
@@ -529,13 +531,17 @@ The multi-instance installer is intentionally separate from the normal
 installer. Do not change these normal-install invariants while working on
 multi-instance behavior:
 
-- default Windows service name remains `MidTerm`
-- default macOS launchd label remains `ai.tlbx.midterm`
-- default Linux service name remains `MidTerm`
+- default Windows service name remains `tlbx`
+- default macOS launchd label remains `ai.tlbx.service`
+- default Linux service name remains `tlbx`
 - default port remains `2000`
 - default service settings paths remain the normal installer paths
 - `install.ps1` and `install.sh` keep their single-instance behavior
 
+The installers automatically keep the legacy names and roots when updating an
+existing MidTerm multi-instance layout; fresh installations use the tlbx names
+shown above.
+
 When changing multi-instance support, verify at least one plan-mode command and
 review changes for accidental edits to the normal installer path.
 
diff --git a/install-multi.ps1 b/install-multi.ps1
index 8290f142e..13b93e098 100644
--- a/install-multi.ps1
+++ b/install-multi.ps1
@@ -1,11 +1,11 @@
 #!/usr/bin/env pwsh
 <#
 .SYNOPSIS
-    Installs multiple isolated MidTerm Windows service instances on one machine.
+    Installs multiple isolated tlbx Windows service instances on one machine.
 
 .DESCRIPTION
     This installer is intentionally separate from install.ps1. The normal install
-    path keeps the historical MidTerm service, paths, and port. Multi-instance
+    path keeps the standard tlbx service, paths, and port. Multi-instance
     installs use one install directory, settings directory, service name, and
     update scope per instance.
 #>
@@ -20,8 +20,8 @@ param(
     [int]$BasePort = 2000,
     [int[]]$Ports = @(),
     [string]$BindAddress = "0.0.0.0",
-    [string]$RootDir = "$env:ProgramData\MidTerm\instances",
-    [string]$InstallRoot = "$env:ProgramFiles\MidTerm\instances",
+    [string]$RootDir = "$env:ProgramData\tlbx\instances",
+    [string]$InstallRoot = "$env:ProgramFiles\tlbx\instances",
     [string]$VersionTag = "latest",
     [string]$AssetPath = "",
     [string]$PasswordHash = "",
@@ -31,6 +31,19 @@ param(
 
 $ErrorActionPreference = "Stop"
 $repo = "tlbx-ai/tlbx"
+$instanceServicePrefix = "tlbx"
+
+if (-not $PSBoundParameters.ContainsKey("RootDir") -and
+    -not (Test-Path $RootDir) -and
+    (Test-Path "$env:ProgramData\MidTerm\instances")) {
+    $RootDir = "$env:ProgramData\MidTerm\instances"
+    $instanceServicePrefix = "MidTerm"
+}
+if (-not $PSBoundParameters.ContainsKey("InstallRoot") -and
+    -not (Test-Path $InstallRoot) -and
+    (Test-Path "$env:ProgramFiles\MidTerm\instances")) {
+    $InstallRoot = "$env:ProgramFiles\MidTerm\instances"
+}
 
 function Assert-Windows {
     if (-not $IsWindows) {
@@ -103,7 +116,7 @@ function Get-InstanceLayout([string]$name, [int]$port) {
     [pscustomobject]@{
         Name = $safe
         Port = $port
-        ServiceName = "MidTerm-$safe"
+        ServiceName = "$instanceServicePrefix-$safe"
         InstallDir = Join-Path $InstallRoot $safe
         SettingsDir = Join-Path $RootDir $safe
         ManifestPath = Join-Path (Join-Path $RootDir $safe) "instance.json"
@@ -131,7 +144,7 @@ function Download-ReleaseAsset([string]$destinationDir) {
         "https://api.github.com/repos/$repo/releases/tags/$VersionTag"
     }
 
-    $release = Invoke-RestMethod -Headers @{ "User-Agent" = "MidTerm multi-instance installer" } -Uri $releaseUri
+    $release = Invoke-RestMethod -Headers @{ "User-Agent" = "tlbx multi-instance installer" } -Uri $releaseUri
     $asset = @($release.assets | Where-Object { $_.name -eq $assetName } | Select-Object -First 1)
     if (-not $asset) {
         $available = ($release.assets | ForEach-Object { $_.name }) -join ", "
@@ -140,12 +153,12 @@ function Download-ReleaseAsset([string]$destinationDir) {
 
     New-Item -ItemType Directory -Force -Path $destinationDir | Out-Null
     $destination = Join-Path $destinationDir $assetName
-    Invoke-WebRequest -Headers @{ "User-Agent" = "MidTerm multi-instance installer" } -Uri $asset.browser_download_url -OutFile $destination
+    Invoke-WebRequest -Headers @{ "User-Agent" = "tlbx multi-instance installer" } -Uri $asset.browser_download_url -OutFile $destination
     return $destination
 }
 
 function Expand-Asset([string]$assetPath) {
-    $extractDir = Join-Path ([IO.Path]::GetTempPath()) ("midterm-multi-" + [Guid]::NewGuid().ToString("N"))
+    $extractDir = Join-Path ([IO.Path]::GetTempPath()) ("tlbx-multi-" + [Guid]::NewGuid().ToString("N"))
     New-Item -ItemType Directory -Force -Path $extractDir | Out-Null
     Expand-Archive -Path $assetPath -DestinationPath $extractDir -Force
     return $extractDir
@@ -158,7 +171,7 @@ function Resolve-PasswordHash([string]$mtPath) {
 
     $plain = $Password
     if (-not $plain) {
-        $secure = Read-Host "Password for new MidTerm instances" -AsSecureString
+        $secure = Read-Host "Password for new tlbx instances" -AsSecureString
         $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
         try {
             $plain = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)
@@ -232,8 +245,8 @@ function Install-Instance($layout, [string]$payloadDir, [string]$passwordHash) {
         "--service-name", "`"$($layout.ServiceName)`""
     )
     $binPath = "`"$mtPath`" $($args -join ' ')"
-    sc.exe create $layout.ServiceName binPath= $binPath start= auto DisplayName= "MidTerm ($($layout.Name))" | Out-Null
-    sc.exe description $layout.ServiceName "MidTerm isolated instance '$($layout.Name)' on port $($layout.Port)" | Out-Null
+    sc.exe create $layout.ServiceName binPath= $binPath start= auto DisplayName= "tlbx ($($layout.Name))" | Out-Null
+    sc.exe description $layout.ServiceName "tlbx isolated instance '$($layout.Name)' on port $($layout.Port)" | Out-Null
     sc.exe failure $layout.ServiceName reset= 86400 actions= restart/5000/restart/10000/restart/30000 | Out-Null
     Start-Service -Name $layout.ServiceName
 }
@@ -262,8 +275,8 @@ function Remove-Instance($layout) {
 }
 
 Assert-Windows
-$instanceNames = Resolve-InstanceNames
-$resolvedPorts = Resolve-Ports $instanceNames
+$instanceNames = @(Resolve-InstanceNames)
+$resolvedPorts = @(Resolve-Ports $instanceNames)
 $layouts = for ($i = 0; $i -lt $instanceNames.Count; $i++) {
     Get-InstanceLayout $instanceNames[$i] $resolvedPorts[$i]
 }
@@ -289,7 +302,7 @@ if ($Mode -eq "remove") {
     return
 }
 
-$downloadDir = Join-Path ([IO.Path]::GetTempPath()) "midterm-multi-download"
+$downloadDir = Join-Path ([IO.Path]::GetTempPath()) "tlbx-multi-download"
 $asset = Download-ReleaseAsset $downloadDir
 $payloadDir = Expand-Asset $asset
 try {
diff --git a/install-multi.sh b/install-multi.sh
index ff3b9c159..08a829e78 100644
--- a/install-multi.sh
+++ b/install-multi.sh
@@ -7,14 +7,18 @@ NAMES=()
 PORTS=()
 BASE_PORT=2000
 BIND_ADDRESS="0.0.0.0"
-ROOT_DIR="/usr/local/etc/midterm-instances"
-INSTALL_ROOT="/usr/local/lib/midterm/instances"
+ROOT_DIR="/usr/local/etc/tlbx-instances"
+INSTALL_ROOT="/usr/local/lib/tlbx/instances"
+ROOT_DIR_SET=false
+INSTALL_ROOT_SET=false
 VERSION_TAG="latest"
 ASSET_PATH=""
 PASSWORD_HASH=""
 PASSWORD=""
 FORCE=false
 REPO="tlbx-ai/tlbx"
+SERVICE_PREFIX="tlbx"
+LAUNCHD_PREFIX="ai.tlbx.instance"
 
 usage() {
   cat <<'EOF'
@@ -48,8 +52,8 @@ while [[ $# -gt 0 ]]; do
     --ports) IFS=',' read -r -a PORTS <<< "$2"; shift 2 ;;
     --base-port) BASE_PORT="$2"; shift 2 ;;
     --bind) BIND_ADDRESS="$2"; shift 2 ;;
-    --root-dir) ROOT_DIR="$2"; shift 2 ;;
-    --install-root) INSTALL_ROOT="$2"; shift 2 ;;
+    --root-dir) ROOT_DIR="$2"; ROOT_DIR_SET=true; shift 2 ;;
+    --install-root) INSTALL_ROOT="$2"; INSTALL_ROOT_SET=true; shift 2 ;;
     --version-tag) VERSION_TAG="$2"; shift 2 ;;
     --asset-path) ASSET_PATH="$2"; shift 2 ;;
     --password-hash) PASSWORD_HASH="$2"; shift 2 ;;
@@ -60,6 +64,15 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+if [[ "$ROOT_DIR_SET" != true && ! -d "$ROOT_DIR" && -d "/usr/local/etc/midterm-instances" ]]; then
+  ROOT_DIR="/usr/local/etc/midterm-instances"
+  SERVICE_PREFIX="midterm"
+  LAUNCHD_PREFIX="ai.tlbx.midterm"
+fi
+if [[ "$INSTALL_ROOT_SET" != true && ! -d "$INSTALL_ROOT" && -d "/usr/local/lib/midterm/instances" ]]; then
+  INSTALL_ROOT="/usr/local/lib/midterm/instances"
+fi
+
 normalize_name() {
   local value="${1//[^A-Za-z0-9_-]/-}"
   value="${value#[-_]}"
@@ -98,8 +111,8 @@ asset_name() {
     Darwin:x86_64) echo "mt-osx-x64.tar.gz" ;;
     Linux:x86_64|Linux:amd64) echo "mt-linux-x64.tar.gz" ;;
     Linux:aarch64|Linux:arm64) echo "mt-linux-arm64.tar.gz" ;;
-    Darwin:i386|Darwin:i686|Darwin:x86) echo "32-bit macOS is not supported by current MidTerm release assets." >&2; exit 1 ;;
-    Linux:i386|Linux:i686|Linux:x86) echo "32-bit Linux is not supported by current MidTerm release assets." >&2; exit 1 ;;
+    Darwin:i386|Darwin:i686|Darwin:x86) echo "32-bit macOS is not supported by current tlbx release assets." >&2; exit 1 ;;
+    Linux:i386|Linux:i686|Linux:x86) echo "32-bit Linux is not supported by current tlbx release assets." >&2; exit 1 ;;
     *) echo "Unsupported platform/architecture: $os $arch" >&2; exit 1 ;;
   esac
 }
@@ -119,7 +132,7 @@ download_asset() {
     release_url="https://api.github.com/repos/$REPO/releases/tags/$VERSION_TAG"
   fi
 
-  api_json="$(curl -fsSL -H "User-Agent: MidTerm multi-instance installer" "$release_url")"
+  api_json="$(curl -fsSL -H "User-Agent: tlbx multi-instance installer" "$release_url")"
   url="$(printf '%s' "$api_json" | python3 -c 'import json,sys; name=sys.argv[1]; data=json.load(sys.stdin); matches=[a["browser_download_url"] for a in data.get("assets",[]) if a.get("name")==name]; print(matches[0] if matches else "")' "$name")"
   if [[ -z "$url" ]]; then
     printf '%s' "$api_json" | python3 -c 'import json,sys; data=json.load(sys.stdin); print("Available assets: " + ", ".join(a.get("name","") for a in data.get("assets",[])))' >&2
@@ -128,7 +141,7 @@ download_asset() {
   fi
 
   asset="$temp_dir/$name"
-  curl -fsSL -H "User-Agent: MidTerm multi-instance installer" "$url" -o "$asset"
+  curl -fsSL -H "User-Agent: tlbx multi-instance installer" "$url" -o "$asset"
   echo "$asset"
 }
 
@@ -139,7 +152,7 @@ resolve_password_hash() {
     return
   fi
   if [[ -z "$PASSWORD" ]]; then
-    read -rsp "Password for new MidTerm instances: " PASSWORD
+    read -rsp "Password for new tlbx instances: " PASSWORD
     echo
   fi
   [[ -n "$PASSWORD" ]] || { echo "A password or --password-hash is required." >&2; exit 1; }
@@ -147,11 +160,11 @@ resolve_password_hash() {
 }
 
 service_name() {
-  echo "midterm-$(normalize_name "$1" | tr '[:upper:]' '[:lower:]')"
+  echo "$SERVICE_PREFIX-$(normalize_name "$1" | tr '[:upper:]' '[:lower:]')"
 }
 
 launchd_label() {
-  echo "ai.tlbx.midterm.$(normalize_name "$1" | tr '[:upper:]' '[:lower:]')"
+  echo "$LAUNCHD_PREFIX.$(normalize_name "$1" | tr '[:upper:]' '[:lower:]')"
 }
 
 install_instance() {
@@ -174,7 +187,7 @@ install_instance() {
 
   mkdir -p "$install_dir" "$settings_dir"
   cp -R "$payload"/. "$install_dir"/
-  chmod +x "$install_dir"/mt "$install_dir"/mtagenthost 2>/dev/null || true
+  chmod +x "$install_dir"/mt "$install_dir"/mtagenthost "$install_dir"/mttmux 2>/dev/null || true
   [[ -f "$install_dir/mthost" ]] && chmod +x "$install_dir/mthost"
 
   printf '%s' "$hash" | "$mt" --write-secret password_hash --settings-dir "$settings_dir" --service-mode >/dev/null
@@ -228,7 +241,7 @@ EOF
     systemctl stop "$svc" >/dev/null 2>&1 || true
     cat > "/etc/systemd/system/$svc.service" <<EOF
 [Unit]
-Description=MidTerm isolated instance $name
+Description=tlbx isolated instance $name
 After=network.target
 
 [Service]
@@ -279,7 +292,7 @@ update_instance() {
 
   mkdir -p "$install_dir" "$settings_dir"
   cp -R "$payload"/. "$install_dir"/
-  chmod +x "$install_dir"/mt "$install_dir"/mtagenthost 2>/dev/null || true
+  chmod +x "$install_dir"/mt "$install_dir"/mtagenthost "$install_dir"/mttmux 2>/dev/null || true
   [[ -f "$install_dir/mthost" ]] && chmod +x "$install_dir/mthost"
 
   cat > "$settings_dir/instance.json" <<EOF
diff --git a/install.ps1 b/install.ps1
index 89492c418..c2b1644c8 100644
--- a/install.ps1
+++ b/install.ps1
@@ -1,4 +1,4 @@
-# tlbx Windows Installer (formerly MidTerm)
+# tlbx Windows Installer
 # Usage: irm https://get.tlbx.ai/install.ps1 | iex
 # Dev:   & ([scriptblock]::Create((irm https://get.tlbx.ai/install.ps1))) -Dev
 #
@@ -135,11 +135,11 @@ function Initialize-Log
 
     if ($Mode -eq "service")
     {
-        $logDir = "$env:ProgramData\MidTerm"
+        $logDir = $WIN_SERVICE_SETTINGS_DIR
     }
     else
     {
-        $logDir = "$env:USERPROFILE\.MidTerm"
+        $logDir = $WIN_USER_SETTINGS_DIR
     }
 
     if (-not (Test-Path $logDir))
@@ -180,19 +180,27 @@ function Write-Log
     }
 }
 
-$ServiceName = "MidTerm"
-$OldHostServiceName = "MidTermHost"
-$DisplayName = "MidTerm"
+$ServiceName = "tlbx"
+$OldHostServiceName = "tlbxHost"
+$DisplayName = "tlbx"
 $Publisher = "tlbx-ai"
 $RepoOwner = "tlbx-ai"
-$RepoName = "MidTerm"
+$RepoName = "tlbx"
 $WebBinaryName = "mt.exe"
 $TtyHostBinaryName = "mthost.exe"
 $AgentHostBinaryName = "mtagenthost.exe"
+$TmuxShimBinaryName = "mttmux.exe"
 $LegacyHostBinaryName = "mt-host.exe"
-$AssetPattern = "mt-win-x64.zip"
+$Is64BitWindows = [Environment]::Is64BitOperatingSystem
+$AssetArchitecture = if ($Is64BitWindows) { "x64" } else { "x86" }
+$AssetPattern = "mt-win-$AssetArchitecture.zip"
+$ExpectedReleasePlatform = "win-$AssetArchitecture"
 # Certificate subject CN - must match CertificateGenerator.CertificateSubject in C#
-$CertificateSubject = "CN=ai.tlbx.midterm"
+$CertificateSubject = "CN=tlbx"
+$CertificateFileName = "tlbx.pem"
+$CertificateKeyId = "tlbx"
+$UninstallRegistryName = "tlbx"
+$FirewallDisplayName = "tlbx HTTPS"
 
 try
 {
@@ -214,31 +222,145 @@ catch
 #   - UpdateScriptGenerator.cs (SettingsDir variable in generated scripts)
 #   - install.sh (PATH_CONSTANTS section)
 # ============================================================================
-# Windows service mode: %ProgramData%\MidTerm (typically C:\ProgramData\MidTerm)
-$WIN_SERVICE_SETTINGS_DIR = "$env:ProgramData\MidTerm"
-$WIN_SERVICE_INSTALL_DIR = "$env:ProgramFiles\MidTerm"
-# Windows user mode: %LOCALAPPDATA%\MidTerm and %USERPROFILE%\.midterm
-$WIN_USER_INSTALL_DIR = "$env:LOCALAPPDATA\MidTerm"
-$WIN_USER_SETTINGS_DIR = "$env:USERPROFILE\.midterm"
+# New installations use tlbx. Existing MidTerm layouts are selected explicitly
+# later and remain updateable in place.
+$TLBX_SERVICE_SETTINGS_DIR = "$env:ProgramData\tlbx"
+$TLBX_SERVICE_INSTALL_DIR = "$env:ProgramFiles\tlbx"
+$TLBX_USER_INSTALL_DIR = "$env:LOCALAPPDATA\tlbx"
+$TLBX_USER_SETTINGS_DIR = "$env:USERPROFILE\.tlbx"
+$LEGACY_SERVICE_SETTINGS_DIR = "$env:ProgramData\MidTerm"
+$LEGACY_SERVICE_INSTALL_DIR = "$env:ProgramFiles\MidTerm"
+$LEGACY_USER_INSTALL_DIR = "$env:LOCALAPPDATA\MidTerm"
+$LEGACY_USER_SETTINGS_DIR = "$env:USERPROFILE\.midterm"
+$WIN_SERVICE_SETTINGS_DIR = $TLBX_SERVICE_SETTINGS_DIR
+$WIN_SERVICE_INSTALL_DIR = $TLBX_SERVICE_INSTALL_DIR
+$WIN_USER_INSTALL_DIR = $TLBX_USER_INSTALL_DIR
+$WIN_USER_SETTINGS_DIR = $TLBX_USER_SETTINGS_DIR
 # Secrets file (secrets.bin on Windows, secrets.json on Unix)
 $WIN_SECRETS_FILENAME = "secrets.bin"
 # ============================================================================
 
+function Test-ServiceInstallIdentity
+{
+    param(
+        [string]$InstallDir,
+        [string]$SettingsDir,
+        [string]$RegistryName,
+        [string[]]$ServiceNames
+    )
+
+    if ((Test-Path (Join-Path $InstallDir $WebBinaryName)) -or
+        (Test-MeaningfulSettingsDirectory -Path $SettingsDir) -or
+        (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$RegistryName"))
+    {
+        return $true
+    }
+
+    foreach ($name in $ServiceNames)
+    {
+        if (Get-Service -Name $name -ErrorAction SilentlyContinue)
+        {
+            return $true
+        }
+    }
+
+    return $false
+}
+
+function Test-UserInstallIdentity
+{
+    param(
+        [string]$InstallDir,
+        [string]$SettingsDir,
+        [string]$RegistryName
+    )
+
+    return ((Test-Path (Join-Path $InstallDir $WebBinaryName)) -or
+        (Test-MeaningfulSettingsDirectory -Path $SettingsDir) -or
+        (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$RegistryName"))
+}
+
+function Test-MeaningfulSettingsDirectory
+{
+    param([string]$Path)
+
+    if (-not (Test-Path -LiteralPath $Path -PathType Container)) { return $false }
+    $entry = Get-ChildItem -LiteralPath $Path -Force -ErrorAction SilentlyContinue |
+        Where-Object { $_.Name -notin @("Logs", "logs", "update.log", "startup-debug.log", ".write-check") } |
+        Select-Object -First 1
+    return [bool]$entry
+}
+
+function Select-InstallIdentity
+{
+    param([bool]$AsService)
+
+    $currentExists = if ($AsService)
+    {
+        Test-ServiceInstallIdentity -InstallDir $TLBX_SERVICE_INSTALL_DIR -SettingsDir $TLBX_SERVICE_SETTINGS_DIR -RegistryName "tlbx" -ServiceNames @("tlbx", "tlbxHost")
+    }
+    else
+    {
+        Test-UserInstallIdentity -InstallDir $TLBX_USER_INSTALL_DIR -SettingsDir $TLBX_USER_SETTINGS_DIR -RegistryName "tlbx"
+    }
+
+    $legacyExists = if ($AsService)
+    {
+        Test-ServiceInstallIdentity -InstallDir $LEGACY_SERVICE_INSTALL_DIR -SettingsDir $LEGACY_SERVICE_SETTINGS_DIR -RegistryName "MidTerm" -ServiceNames @("MidTerm", "MidTermHost")
+    }
+    else
+    {
+        Test-UserInstallIdentity -InstallDir $LEGACY_USER_INSTALL_DIR -SettingsDir $LEGACY_USER_SETTINGS_DIR -RegistryName "MidTerm"
+    }
+
+    if ($currentExists -and $legacyExists)
+    {
+        throw "Both tlbx and legacy MidTerm $($(if ($AsService) { 'service' } else { 'user' })) installations were found. Uninstall one copy before continuing."
+    }
+
+    if ($legacyExists)
+    {
+        $script:ServiceName = "MidTerm"
+        $script:OldHostServiceName = "MidTermHost"
+        $script:DisplayName = "MidTerm"
+        $script:CertificateSubject = "CN=ai.tlbx.midterm"
+        $script:CertificateFileName = "midterm.pem"
+        $script:CertificateKeyId = "midterm"
+        $script:UninstallRegistryName = "MidTerm"
+        $script:FirewallDisplayName = "MidTerm HTTPS"
+        $script:WIN_SERVICE_SETTINGS_DIR = $LEGACY_SERVICE_SETTINGS_DIR
+        $script:WIN_SERVICE_INSTALL_DIR = $LEGACY_SERVICE_INSTALL_DIR
+        $script:WIN_USER_INSTALL_DIR = $LEGACY_USER_INSTALL_DIR
+        $script:WIN_USER_SETTINGS_DIR = $LEGACY_USER_SETTINGS_DIR
+        Write-Host "  Existing MidTerm installation detected; updating it in place." -ForegroundColor Yellow
+        return
+    }
+
+    $script:ServiceName = "tlbx"
+    $script:OldHostServiceName = "tlbxHost"
+    $script:DisplayName = "tlbx"
+    $script:CertificateSubject = "CN=tlbx"
+    $script:CertificateFileName = "tlbx.pem"
+    $script:CertificateKeyId = "tlbx"
+    $script:UninstallRegistryName = "tlbx"
+    $script:FirewallDisplayName = "tlbx HTTPS"
+    $script:WIN_SERVICE_SETTINGS_DIR = $TLBX_SERVICE_SETTINGS_DIR
+    $script:WIN_SERVICE_INSTALL_DIR = $TLBX_SERVICE_INSTALL_DIR
+    $script:WIN_USER_INSTALL_DIR = $TLBX_USER_INSTALL_DIR
+    $script:WIN_USER_SETTINGS_DIR = $TLBX_USER_SETTINGS_DIR
+}
+
 $script:StatusLabelWidth = 12
 
 function Write-Banner
 {
     Write-Host ""
-    Write-Host "            //   \\" -ForegroundColor White
-    Write-Host "           //     \\         __  __ _     _ _____" -ForegroundColor White
-    Write-Host "          //       \\       |  \/  (_) __| |_   _|__ _ __ _ __ ___" -ForegroundColor White
-    Write-Host "         //  ( " -NoNewline -ForegroundColor White
-    Write-Host "·" -NoNewline -ForegroundColor Cyan
-    Write-Host " )  \\      | |\/| | |/ _` | | |/ _ \\ '__| '_ ` _ \\" -ForegroundColor White
-    Write-Host "        //           \\     | |  | | | (_| | | |  __/ |  | | | | | |" -ForegroundColor White
-    Write-Host "       //             \\    |_|  |_|_|\__,_| |_|\___|_|  |_| |_| |_|" -ForegroundColor White
-    Write-Host "      //               \\   " -NoNewline -ForegroundColor White
-    Write-Host "tlbx.ai - https://github.com/tlbx-ai/tlbx" -ForegroundColor Green
+    Write-Host "       _   _ _            " -ForegroundColor White
+    Write-Host "      | |_| | |__  __  __ " -ForegroundColor White
+    Write-Host "      | __| | '_ \ \ \/ / " -ForegroundColor White
+    Write-Host "      | |_| | |_) | >  <  " -ForegroundColor White
+    Write-Host "       \__|_|_.__/ /_/\_\ " -ForegroundColor White
+    Write-Host "      tlbx.ai - https://github.com/tlbx-ai/tlbx" -ForegroundColor Green
     Write-Host ""
 }
 
@@ -330,7 +452,7 @@ function Get-CurrentInstallerScriptContent
     }
 
     $scriptUrl = "https://get.tlbx.ai/install.ps1"
-    return Invoke-CompatibleRestMethod -Uri $scriptUrl -Headers @{ "User-Agent" = "MidTerm-Installer" }
+    return Invoke-CompatibleRestMethod -Uri $scriptUrl -Headers @{ "User-Agent" = "tlbx-Installer" }
 }
 
 function New-ElevationHandoffDirectory
@@ -340,7 +462,7 @@ function New-ElevationHandoffDirectory
         [string]$UserSid
     )
 
-    $root = Join-Path ([System.IO.Path]::GetTempPath()) ("MidTerm-Install-" + [Guid]::NewGuid().ToString("N"))
+    $root = Join-Path ([System.IO.Path]::GetTempPath()) ("tlbx-install-" + [Guid]::NewGuid().ToString("N"))
     New-Item -ItemType Directory -Path $root -Force | Out-Null
 
     $grants = @()
@@ -455,20 +577,16 @@ function Test-ExistingPassword
 function Test-ExistingServiceInstall
 {
     return (
-        (Test-Path $WIN_SERVICE_INSTALL_DIR) -or
-        (Test-Path $WIN_SERVICE_SETTINGS_DIR) -or
-        (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm") -or
-        (Get-Service -Name $ServiceName -ErrorAction SilentlyContinue) -or
-        (Get-Service -Name $OldHostServiceName -ErrorAction SilentlyContinue)
+        (Test-ServiceInstallIdentity -InstallDir $TLBX_SERVICE_INSTALL_DIR -SettingsDir $TLBX_SERVICE_SETTINGS_DIR -RegistryName "tlbx" -ServiceNames @("tlbx", "tlbxHost")) -or
+        (Test-ServiceInstallIdentity -InstallDir $LEGACY_SERVICE_INSTALL_DIR -SettingsDir $LEGACY_SERVICE_SETTINGS_DIR -RegistryName "MidTerm" -ServiceNames @("MidTerm", "MidTermHost"))
     )
 }
 
 function Test-ExistingUserInstall
 {
     return (
-        (Test-Path $WIN_USER_INSTALL_DIR) -or
-        (Test-Path $WIN_USER_SETTINGS_DIR) -or
-        (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm")
+        (Test-UserInstallIdentity -InstallDir $TLBX_USER_INSTALL_DIR -SettingsDir $TLBX_USER_SETTINGS_DIR -RegistryName "tlbx") -or
+        (Test-UserInstallIdentity -InstallDir $LEGACY_USER_INSTALL_DIR -SettingsDir $LEGACY_USER_SETTINGS_DIR -RegistryName "MidTerm")
     )
 }
 
@@ -481,7 +599,7 @@ function Assert-NoCrossModeConflict
         Write-Host ""
         Write-Host "  Cannot install as a system service while a user install still exists." -ForegroundColor Red
         Write-Host "  Uninstall the user-mode copy first, then rerun the installer." -ForegroundColor Gray
-        Write-Host "  User traces: $WIN_USER_INSTALL_DIR or $WIN_USER_SETTINGS_DIR" -ForegroundColor Gray
+        Write-Host "  User traces: $TLBX_USER_INSTALL_DIR, $TLBX_USER_SETTINGS_DIR, or their legacy MidTerm equivalents" -ForegroundColor Gray
         exit 1
     }
 
@@ -490,7 +608,7 @@ function Assert-NoCrossModeConflict
         Write-Host ""
         Write-Host "  Cannot install in user mode while a system service install still exists." -ForegroundColor Red
         Write-Host "  Uninstall the service-mode copy first, then rerun the installer." -ForegroundColor Gray
-        Write-Host "  Service traces: $WIN_SERVICE_INSTALL_DIR or $WIN_SERVICE_SETTINGS_DIR" -ForegroundColor Gray
+        Write-Host "  Service traces: $TLBX_SERVICE_INSTALL_DIR, $TLBX_SERVICE_SETTINGS_DIR, or their legacy MidTerm equivalents" -ForegroundColor Gray
         exit 1
     }
 }
@@ -600,8 +718,8 @@ function Test-ExistingCertificate
         [string]$SettingsDir
     )
 
-    $certPath = Join-Path $SettingsDir "midterm.pem"
-    $keyPath = Join-Path (Join-Path $SettingsDir "keys") "midterm.dpapi"
+    $certPath = Join-Path $SettingsDir $CertificateFileName
+    $keyPath = Join-Path (Join-Path $SettingsDir "keys") "$CertificateKeyId.dpapi"
 
     # Check if both cert and key exist
     if (-not (Test-Path $certPath))
@@ -651,7 +769,7 @@ function Test-ExistingCertificate
     }
 }
 
-function Remove-OldMidTermCertificates
+function Remove-PreviousTlbxCertificates
 {
     param(
         [string]$ExceptThumbprint = $null
@@ -688,7 +806,7 @@ function Remove-OldMidTermCertificates
 
         if ($removed -gt 0)
         {
-            Write-Host "  Cleaned up $removed old MidTerm certificate(s) from trusted store" -ForegroundColor Green
+            Write-Host "  Cleaned up $removed old $DisplayName certificate(s) from trusted store" -ForegroundColor Green
         }
     }
     catch
@@ -779,7 +897,8 @@ function Generate-Certificate
             # Use mt.exe --generate-cert to generate certificate with DPAPI-protected key
             # Pass --service-mode for service installs so it uses ProgramData instead of user profile
             # Pass --force to regenerate since we already checked validity above
-            $certArgs = if ($IsService) { @("--generate-cert", "--service-mode", "--force") } else { @("--generate-cert", "--force") }
+            $modeArg = if ($IsService) { "--service-mode" } else { "--user-mode" }
+            $certArgs = @("--generate-cert", $modeArg, "--settings-dir", $SettingsDir, "--force")
             $output = & $mtPath @certArgs 2>&1
             $exitCode = $LASTEXITCODE
 
@@ -802,7 +921,7 @@ function Generate-Certificate
             if (-not $certPath)
             {
                 # Default path (matches what mt.exe generates)
-                $certPath = Join-Path $SettingsDir "midterm.pem"
+                $certPath = Join-Path $SettingsDir $CertificateFileName
             }
 
             Write-Host "  Certificate generated with DPAPI-protected private key" -ForegroundColor Green
@@ -825,8 +944,8 @@ function Generate-Certificate
     # Trust the certificate if requested (decision made before elevation)
     if ($TrustCert)
     {
-        # First, remove ALL old MidTerm certs from trusted store to avoid accumulation
-        Remove-OldMidTermCertificates -ExceptThumbprint $null  # Remove all, we'll add the current one
+        # First, remove old certificates for the selected install identity.
+        Remove-PreviousTlbxCertificates -ExceptThumbprint $null  # Remove all, we'll add the current one
 
         Write-Host "  Adding certificate to trusted root store..." -ForegroundColor Gray
         try
@@ -968,7 +1087,7 @@ function Get-LatestRelease
     {
         Write-Host "Fetching latest dev release..." -ForegroundColor Gray
         $apiUrl = "https://api.github.com/repos/$RepoOwner/$RepoName/releases"
-        $releases = Invoke-CompatibleRestMethod -Uri $apiUrl -Headers @{ "User-Agent" = "MidTerm-Installer" }
+        $releases = Invoke-CompatibleRestMethod -Uri $apiUrl -Headers @{ "User-Agent" = "tlbx-Installer" }
 
         # Find the first prerelease
         $release = $releases | Where-Object { $_.prerelease -eq $true } | Select-Object -First 1
@@ -977,7 +1096,7 @@ function Get-LatestRelease
         {
             Write-Host "  No dev releases found, falling back to latest stable..." -ForegroundColor Yellow
             $apiUrl = "https://api.github.com/repos/$RepoOwner/$RepoName/releases/latest"
-            $release = Invoke-CompatibleRestMethod -Uri $apiUrl -Headers @{ "User-Agent" = "MidTerm-Installer" }
+            $release = Invoke-CompatibleRestMethod -Uri $apiUrl -Headers @{ "User-Agent" = "tlbx-Installer" }
         }
 
         return $release
@@ -986,7 +1105,7 @@ function Get-LatestRelease
     {
         Write-Host "Fetching latest release..." -ForegroundColor Gray
         $apiUrl = "https://api.github.com/repos/$RepoOwner/$RepoName/releases/latest"
-        $release = Invoke-CompatibleRestMethod -Uri $apiUrl -Headers @{ "User-Agent" = "MidTerm-Installer" }
+        $release = Invoke-CompatibleRestMethod -Uri $apiUrl -Headers @{ "User-Agent" = "tlbx-Installer" }
         return $release
     }
 }
@@ -1000,6 +1119,109 @@ function Test-NetworkBinding
     return $BindAddress -ne "localhost" -and $BindAddress -ne "127.0.0.1" -and $BindAddress -ne "::1"
 }
 
+function Test-TailscaleIpv4Address
+{
+    param([string]$Address)
+
+    $parsed = $null
+    if (-not [Net.IPAddress]::TryParse($Address, [ref]$parsed))
+    {
+        return $false
+    }
+
+    $bytes = $parsed.GetAddressBytes()
+    return $bytes.Length -eq 4 -and $bytes[0] -eq 100 -and $bytes[1] -ge 64 -and $bytes[1] -le 127
+}
+
+function Get-TailscaleIpv4Addresses
+{
+    $addresses = @()
+    $tailscale = Get-Command tailscale -ErrorAction SilentlyContinue
+    if ($tailscale)
+    {
+        try
+        {
+            $addresses += @(& $tailscale.Source ip -4 2>$null)
+        }
+        catch
+        {
+            Write-Log "Could not query the Tailscale CLI: $_" "WARN"
+        }
+    }
+
+    try
+    {
+        $addresses += @(Get-NetIPAddress -AddressFamily IPv4 -ErrorAction Stop | ForEach-Object { $_.IPAddress })
+    }
+    catch
+    {
+        Write-Log "Could not inspect Windows network addresses for Tailscale: $_" "WARN"
+    }
+
+    return @($addresses |
+        ForEach-Object { if ($null -ne $_) { $_.ToString().Trim() } } |
+        Where-Object { Test-TailscaleIpv4Address $_ } |
+        Sort-Object -Unique)
+}
+
+function Format-TlbxUrl
+{
+    param(
+        [string]$HostName,
+        [int]$Port
+    )
+
+    $urlHost = $HostName
+    if ($urlHost.Contains(":") -and -not $urlHost.StartsWith("["))
+    {
+        $urlHost = "[$urlHost]"
+    }
+    return "https://${urlHost}:$Port"
+}
+
+function Get-TlbxAccessUrls
+{
+    param(
+        [int]$Port,
+        [string]$BindAddress,
+        [AllowNull()]
+        [string[]]$TailscaleAddresses = $null
+    )
+
+    $wildcardBindings = @("*", "0.0.0.0", "::", "[::]")
+    $localBindings = @("", "localhost", "127.0.0.1", "::1", "[::1]")
+    $primaryHost = if ($BindAddress -in $wildcardBindings -or $BindAddress -in $localBindings)
+    {
+        "localhost"
+    }
+    else
+    {
+        $BindAddress
+    }
+
+    $urls = @((Format-TlbxUrl -HostName $primaryHost -Port $Port))
+    if ($BindAddress -in $wildcardBindings)
+    {
+        if ($null -eq $TailscaleAddresses)
+        {
+            $TailscaleAddresses = @(Get-TailscaleIpv4Addresses)
+        }
+        foreach ($address in $TailscaleAddresses)
+        {
+            if (Test-TailscaleIpv4Address $address)
+            {
+                $urls += Format-TlbxUrl -HostName $address -Port $Port
+            }
+        }
+    }
+    elseif (Test-TailscaleIpv4Address $BindAddress)
+    {
+        $urls += Format-TlbxUrl -HostName $BindAddress -Port $Port
+    }
+
+    return @($urls | Select-Object -Unique)
+}
+
 function Prompt-FirewallConfig
 {
     param(
@@ -1015,7 +1237,7 @@ function Prompt-FirewallConfig
     Write-Host ""
     Write-Host "  Windows Firewall:" -ForegroundColor Cyan
     Write-Host "  Allow other PCs to reach tlbx on TCP port $Port?" -ForegroundColor Yellow
-    Write-Host "  (Creates or updates the inbound rule named 'MidTerm HTTPS')" -ForegroundColor Gray
+    Write-Host "  (Creates or updates the inbound rule named '$FirewallDisplayName')" -ForegroundColor Gray
     $choice = Read-Host "  Add firewall rule? [Y/n]"
     return ($choice -ne "n" -and $choice -ne "N")
 }
@@ -1027,7 +1249,7 @@ function Ensure-FirewallRule
         [string]$InstallDir
     )
 
-    $displayName = "MidTerm HTTPS"  # Sync with WindowsFirewallService.ManagedRuleName
+    $displayName = $FirewallDisplayName
     $programPath = Join-Path $InstallDir $WebBinaryName
 
     try
@@ -1037,7 +1259,7 @@ function Ensure-FirewallRule
 
         New-NetFirewallRule `
             -DisplayName $displayName `
-            -Group "MidTerm" `
+            -Group $DisplayName `
             -Direction Inbound `
             -Action Allow `
             -Enabled True `
@@ -1045,7 +1267,7 @@ function Ensure-FirewallRule
             -Protocol TCP `
             -LocalPort $Port `
             -Program $programPath `
-            -Description "Allows inbound HTTPS access to MidTerm." | Out-Null
+            -Description "Allows inbound HTTPS access to $DisplayName." | Out-Null
 
         Write-Log "Windows firewall rule ensured for TCP port $Port"
         Write-Host "  Firewall: added rule '$displayName' for TCP port $Port" -ForegroundColor Gray
@@ -1068,6 +1290,121 @@ function Get-AssetUrl
     return $asset.browser_download_url
 }
 
+function Convert-DerEcdsaSignatureToP1363
+{
+    param(
+        [Parameter(Mandatory=$true)][byte[]]$Signature,
+        [int]$CoordinateSize = 48
+    )
+
+    function Read-DerLength([byte[]]$Data, [ref]$Offset)
+    {
+        $first = $Data[$Offset.Value]
+        $Offset.Value++
+        if (($first -band 0x80) -eq 0) { return [int]$first }
+        $count = $first -band 0x7f
+        if ($count -lt 1 -or $count -gt 4) { throw "Invalid DER length." }
+        $length = 0
+        for ($i = 0; $i -lt $count; $i++)
+        {
+            $length = ($length -shl 8) -bor $Data[$Offset.Value]
+            $Offset.Value++
+        }
+        return $length
+    }
+
+    function Copy-DerInteger([byte[]]$Integer, [byte[]]$Destination, [int]$DestinationOffset, [int]$Size)
+    {
+        $sourceOffset = 0
+        while ($sourceOffset -lt ($Integer.Length - 1) -and $Integer[$sourceOffset] -eq 0)
+        {
+            $sourceOffset++
+        }
+        $length = $Integer.Length - $sourceOffset
+        if ($length -gt $Size) { throw "ECDSA signature coordinate is too large." }
+        [Array]::Copy($Integer, $sourceOffset, $Destination, $DestinationOffset + $Size - $length, $length)
+    }
+
+    $offset = 0
+    if ($Signature[$offset++] -ne 0x30) { throw "Invalid ECDSA DER sequence." }
+    $null = Read-DerLength $Signature ([ref]$offset)
+    if ($Signature[$offset++] -ne 0x02) { throw "Invalid ECDSA DER R value." }
+    $rLength = Read-DerLength $Signature ([ref]$offset)
+    $r = [byte[]]::new($rLength)
+    [Array]::Copy($Signature, $offset, $r, 0, $rLength)
+    $offset += $rLength
+    if ($Signature[$offset++] -ne 0x02) { throw "Invalid ECDSA DER S value." }
+    $sLength = Read-DerLength $Signature ([ref]$offset)
+    $s = [byte[]]::new($sLength)
+    [Array]::Copy($Signature, $offset, $s, 0, $sLength)
+
+    $p1363 = [byte[]]::new($CoordinateSize * 2)
+    Copy-DerInteger $r $p1363 0 $CoordinateSize
+    Copy-DerInteger $s $p1363 $CoordinateSize $CoordinateSize
+    return $p1363
+}
+
+function Test-ReleaseMetadataSignature
+{
+    param(
+        [Parameter(Mandatory=$true)][byte[]]$PayloadBytes,
+        [Parameter(Mandatory=$true)][byte[]]$SignatureBytes,
+        [Parameter(Mandatory=$true)][byte[]]$PublicKeyBytes
+    )
+
+    if ($PSVersionTable.PSVersion.Major -ge 7)
+    {
+        $ecdsa = [System.Security.Cryptography.ECDsa]::Create()
+        try
+        {
+            $bytesRead = 0
+            $ecdsa.ImportSubjectPublicKeyInfo($PublicKeyBytes, [ref]$bytesRead)
+            return $ecdsa.VerifyData(
+                $PayloadBytes,
+                $SignatureBytes,
+                [System.Security.Cryptography.HashAlgorithmName]::SHA256,
+                [System.Security.Cryptography.DSASignatureFormat]::Rfc3279DerSequence)
+        }
+        finally
+        {
+            $ecdsa.Dispose()
+        }
+    }
+
+    # Windows PowerShell 5.1 lacks ImportSubjectPublicKeyInfo. Import the
+    # P-384 public point through CNG and convert the DER signature to P1363.
+    if (-not $IsWindows -and $env:OS -ne "Windows_NT")
+    {
+        throw "Windows PowerShell 5.1 signature verification is only supported on Windows."
+    }
+    if ($PublicKeyBytes.Length -lt 97 -or $PublicKeyBytes[$PublicKeyBytes.Length - 97] -ne 0x04)
+    {
+        throw "Release public key is not an uncompressed P-384 point."
+    }
+
+    $blob = [byte[]]::new(8 + 96)
+    [Array]::Copy([BitConverter]::GetBytes([uint32]0x33534345), 0, $blob, 0, 4)
+    [Array]::Copy([BitConverter]::GetBytes([uint32]48), 0, $blob, 4, 4)
+    [Array]::Copy($PublicKeyBytes, $PublicKeyBytes.Length - 96, $blob, 8, 96)
+    $cngKey = [System.Security.Cryptography.CngKey]::Import(
+        $blob,
+        [System.Security.Cryptography.CngKeyBlobFormat]::EccPublicBlob)
+    $ecdsaCng = New-Object -TypeName System.Security.Cryptography.ECDsaCng -ArgumentList @(,$cngKey)
+    try
+    {
+        $p1363Signature = Convert-DerEcdsaSignatureToP1363 -Signature $SignatureBytes
+        return $ecdsaCng.VerifyData(
+            $PayloadBytes,
+            $p1363Signature,
+            [System.Security.Cryptography.HashAlgorithmName]::SHA256)
+    }
+    finally
+    {
+        $ecdsaCng.Dispose()
+        $cngKey.Dispose()
+    }
+}
+
 function Assert-SignedRelease
 {
     param(
@@ -1097,21 +1434,7 @@ function Assert-SignedRelease
         $payloadBytes = [Convert]::FromBase64String([string]$manifest.signedPayload)
         $signatureBytes = [Convert]::FromBase64String([string]$manifest.metadataSignature)
         $publicKeyBytes = [Convert]::FromBase64String($publicKeyBase64)
-        $ecdsa = [System.Security.Cryptography.ECDsa]::Create()
-        try
-        {
-            $bytesRead = 0
-            $ecdsa.ImportSubjectPublicKeyInfo($publicKeyBytes, [ref]$bytesRead)
-            $signatureValid = $ecdsa.VerifyData(
-                $payloadBytes,
-                $signatureBytes,
-                [System.Security.Cryptography.HashAlgorithmName]::SHA256,
-                [System.Security.Cryptography.DSASignatureFormat]::Rfc3279DerSequence)
-        }
-        finally
-        {
-            $ecdsa.Dispose()
-        }
+        $signatureValid = Test-ReleaseMetadataSignature -PayloadBytes $payloadBytes -SignatureBytes $signatureBytes -PublicKeyBytes $publicKeyBytes
 
         if (-not $signatureValid)
         {
@@ -1150,9 +1473,12 @@ function Assert-SignedRelease
         {
             $fileName = [string]$checksum.Name
             $expectedHash = ([string]$checksum.Value).ToLowerInvariant()
+            $normalizedFileName = $fileName.Replace('\', '/')
+            $segments = @($normalizedFileName.Split('/'))
             if ([string]::IsNullOrWhiteSpace($fileName) -or
                 [System.IO.Path]::IsPathRooted($fileName) -or
-                [System.IO.Path]::GetFileName($fileName) -cne $fileName -or
+                $segments.Count -eq 0 -or
+                @($segments | Where-Object { [string]::IsNullOrWhiteSpace($_) -or $_ -in @('.', '..') }).Count -gt 0 -or
                 $expectedHash -notmatch '^[0-9a-f]{64}$')
             {
                 throw "Downloaded release contains an unsafe checksum entry: $fileName"
@@ -1164,7 +1490,13 @@ function Assert-SignedRelease
                 throw "Downloaded release checksum metadata is inconsistent for $fileName."
             }
 
-            $filePath = Join-Path $ExtractDir $fileName
+            $relativePlatformPath = $normalizedFileName.Replace('/', [System.IO.Path]::DirectorySeparatorChar)
+            $filePath = [System.IO.Path]::GetFullPath((Join-Path $ExtractDir $relativePlatformPath))
+            $extractRoot = [System.IO.Path]::GetFullPath($ExtractDir).TrimEnd([char[]]@('\', '/'))
+            if (-not $filePath.StartsWith($extractRoot + [System.IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase))
+            {
+                throw "Downloaded release contains an unsafe checksum entry: $fileName"
+            }
             if (-not (Test-Path -LiteralPath $filePath -PathType Leaf))
             {
                 throw "Downloaded release is missing signed file $fileName."
@@ -1177,62 +1509,258 @@ function Assert-SignedRelease
             }
         }
     }
-    catch [System.Management.Automation.MethodInvocationException]
+    catch
     {
-        throw "This installer requires PowerShell 7 or newer for release-signature verification: $($_.Exception.Message)"
+        throw
     }
 }
 
-function Write-ServiceSettings
+function Get-WindowsReleaseFileNames
 {
-    param(
-        [string]$InstallDir,
-        [string]$Username,
-        [string]$UserSid,
-        [string]$PasswordHash,
-        [int]$Port = 2000,
-        [string]$BindAddress = "*",
-        [string]$CertPath = $null
-    )
-
-    # Uses PATH_CONSTANTS defined above - keep in sync with SettingsService.cs!
-    $configDir = $WIN_SERVICE_SETTINGS_DIR
-    $settingsPath = Join-Path $configDir "settings.json"
-    $mergePath = Join-Path $configDir "merge-settings.json"
-
-    if (-not (Test-Path $configDir))
+    $files = @($WebBinaryName, $TtyHostBinaryName, $AgentHostBinaryName, $TmuxShimBinaryName, "version.json", "THIRD-PARTY-LICENSES.txt")
+    if ($ExpectedReleasePlatform -in @("win-x64", "win-x86"))
     {
-        New-Item -ItemType Directory -Path $configDir -Force | Out-Null
+        $files += @("conpty.dll", "x64/OpenConsole.exe", "arm64/OpenConsole.exe")
+        if ($ExpectedReleasePlatform -eq "win-x86")
+        {
+            $files += "x86/OpenConsole.exe"
+        }
     }
+    return $files
+}
 
-    # Build install-time settings for merge. These are installer-owned knobs
-    # such as service identity and certificate location, not user preferences.
-    $settings = @{
-        runAsUser = $Username
-        runAsUserSid = $UserSid
-        authenticationEnabled = $true
-        isServiceInstall = $true
-    }
+function Assert-SafeReleaseArchive
+{
+    param([Parameter(Mandatory=$true)][string]$Path)
 
-    if ($CertPath)
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    $archive = [System.IO.Compression.ZipFile]::OpenRead($Path)
+    try
     {
-        $settings.certificatePath = $CertPath
-        $settings.keyProtection = "osProtected"
+        $required = @(Get-WindowsReleaseFileNames)
+        $allowed = @($required + "SHA256SUMS.txt")
+        $allowedDirectories = @("x64/", "arm64/")
+        if ($ExpectedReleasePlatform -eq "win-x86")
+        {
+            $allowedDirectories += "x86/"
+        }
+        $seen = @{}
+        foreach ($entry in $archive.Entries)
+        {
+            $normalizedName = $entry.FullName.Replace('\', '/')
+            if ($normalizedName.EndsWith('/'))
+            {
+                if ($normalizedName -notin $allowedDirectories -or $entry.Length -ne 0)
+                {
+                    throw "Downloaded release archive contains unexpected or unsafe entry '$($entry.FullName)'."
+                }
+                continue
+            }
+            if ($normalizedName -notin $allowed -or [string]::IsNullOrWhiteSpace($entry.Name))
+            {
+                throw "Downloaded release archive contains unexpected or unsafe entry '$($entry.FullName)'."
+            }
+            $unixFileType = (($entry.ExternalAttributes -shr 16) -band 0xF000)
+            if (($unixFileType -ne 0) -and ($unixFileType -ne 0x8000))
+            {
+                throw "Downloaded release archive entry '$($entry.FullName)' is not a regular file."
+            }
+            if ($entry.Length -le 0)
+            {
+                throw "Downloaded release archive entry '$($entry.FullName)' is empty."
+            }
+            if ($seen.ContainsKey($normalizedName))
+            {
+                throw "Downloaded release archive contains duplicate entry '$($entry.FullName)'."
+            }
+            $seen[$normalizedName] = $true
+        }
+        foreach ($name in $required)
+        {
+            if (-not $seen.ContainsKey($name))
+            {
+                throw "Downloaded release archive is missing '$name'."
+            }
+        }
+    }
+    finally
+    {
+        $archive.Dispose()
     }
+}
 
-    $json = $settings | ConvertTo-Json -Depth 10
+function Stop-ExistingInstallProcesses
+{
+    $existingService = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
+    $oldHostService = Get-Service -Name $OldHostServiceName -ErrorAction SilentlyContinue
 
-    if (Test-Path $settingsPath)
+    if ($existingService)
     {
-        # Reinstall: write merge file, let mt handle merging
-        Set-Content -Path $mergePath -Value $json -Encoding UTF8
-        Write-Host "  Settings: merge file written for mt" -ForegroundColor Gray
+        Write-Host "Stopping existing service..." -ForegroundColor Gray
+        Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue
+        Get-Process -Name "mt-host", "mthost", "mtagenthost", "mt" -ErrorAction SilentlyContinue |
+            Stop-Process -Force -ErrorAction SilentlyContinue
+
+        for ($waited = 0; $waited -lt 10; $waited++)
+        {
+            if (-not (Get-Process -Name "mt-host", "mthost", "mtagenthost", "mt" -ErrorAction SilentlyContinue))
+            {
+                break
+            }
+            Start-Sleep -Milliseconds 500
+        }
     }
-    else
+
+    if ($oldHostService)
     {
-        # Fresh install: write settings.json directly
-        Set-Content -Path $settingsPath -Value $json -Encoding UTF8
-        Write-Host "  Settings: $settingsPath" -ForegroundColor Gray
+        Write-Host "Migrating from old two-service architecture..." -ForegroundColor Yellow
+        Stop-Service -Name $OldHostServiceName -Force -ErrorAction SilentlyContinue
+        Get-Process -Name "mt-host" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
+        Start-Sleep -Seconds 1
+        sc.exe delete $OldHostServiceName | Out-Null
+    }
+}
+
+function Install-VerifiedBinarySet
+{
+    param(
+        [Parameter(Mandatory=$true)][string]$ExtractDir,
+        [Parameter(Mandatory=$true)][string]$InstallDir,
+        [Parameter(Mandatory=$true)][string]$BackupRoot
+    )
+
+    $fileNames = @(Get-WindowsReleaseFileNames)
+    $stagingDir = Join-Path $InstallDir (".tlbx-install-" + [Guid]::NewGuid().ToString("N"))
+    $backupDir = Join-Path $BackupRoot "backup"
+    New-Item -ItemType Directory -Path $stagingDir -Force | Out-Null
+    New-Item -ItemType Directory -Path $backupDir -Force | Out-Null
+
+    foreach ($fileName in $fileNames)
+    {
+        $source = Join-Path $ExtractDir $fileName
+        if (-not (Test-Path -LiteralPath $source -PathType Leaf))
+        {
+            throw "Verified release is missing $fileName."
+        }
+        $stagedPath = Join-Path $stagingDir $fileName
+        New-Item -ItemType Directory -Path (Split-Path -Parent $stagedPath) -Force | Out-Null
+        Copy-Item -LiteralPath $source -Destination $stagedPath -Force
+    }
+
+    $backedUp = New-Object System.Collections.Generic.List[string]
+    try
+    {
+        foreach ($fileName in $fileNames)
+        {
+            $destination = Join-Path $InstallDir $fileName
+            if (Test-Path -LiteralPath $destination)
+            {
+                $backupPath = Join-Path $backupDir $fileName
+                New-Item -ItemType Directory -Path (Split-Path -Parent $backupPath) -Force | Out-Null
+                Copy-Item -LiteralPath $destination -Destination $backupPath -Force
+                $backedUp.Add($fileName)
+            }
+        }
+
+        foreach ($fileName in $fileNames)
+        {
+            $destination = Join-Path $InstallDir $fileName
+            New-Item -ItemType Directory -Path (Split-Path -Parent $destination) -Force | Out-Null
+            Move-Item -LiteralPath (Join-Path $stagingDir $fileName) -Destination $destination -Force
+            Write-Host "  Installed: $(Join-Path $InstallDir $fileName)" -ForegroundColor Gray
+        }
+    }
+    catch
+    {
+        foreach ($fileName in $fileNames)
+        {
+            Remove-Item -LiteralPath (Join-Path $InstallDir $fileName) -Force -ErrorAction SilentlyContinue
+        }
+        foreach ($fileName in $backedUp)
+        {
+            $destination = Join-Path $InstallDir $fileName
+            New-Item -ItemType Directory -Path (Split-Path -Parent $destination) -Force | Out-Null
+            Copy-Item -LiteralPath (Join-Path $backupDir $fileName) -Destination $destination -Force -ErrorAction SilentlyContinue
+        }
+        throw "Installing the verified binary set failed; the previous files were restored. $_"
+    }
+    finally
+    {
+        Remove-Item -LiteralPath $stagingDir -Recurse -Force -ErrorAction SilentlyContinue
+    }
+}
+
+function Restore-PreviousBinarySet
+{
+    param(
+        [Parameter(Mandatory=$true)][string]$InstallDir,
+        [Parameter(Mandatory=$true)][string]$BackupRoot
+    )
+
+    $backupDir = Join-Path $BackupRoot "backup"
+    foreach ($fileName in @(Get-WindowsReleaseFileNames))
+    {
+        Remove-Item -LiteralPath (Join-Path $InstallDir $fileName) -Force -ErrorAction SilentlyContinue
+        $backupPath = Join-Path $backupDir $fileName
+        if (Test-Path -LiteralPath $backupPath -PathType Leaf)
+        {
+            $destination = Join-Path $InstallDir $fileName
+            New-Item -ItemType Directory -Path (Split-Path -Parent $destination) -Force | Out-Null
+            Copy-Item -LiteralPath $backupPath -Destination $destination -Force -ErrorAction Stop
+        }
+    }
+}
+
+function Write-ServiceSettings
+{
+    param(
+        [string]$InstallDir,
+        [string]$Username,
+        [string]$UserSid,
+        [string]$PasswordHash,
+        [int]$Port = 2000,
+        [string]$BindAddress = "*",
+        [string]$CertPath = $null
+    )
+
+    # Uses PATH_CONSTANTS defined above - keep in sync with SettingsService.cs!
+    $configDir = $WIN_SERVICE_SETTINGS_DIR
+    $settingsPath = Join-Path $configDir "settings.json"
+    $mergePath = Join-Path $configDir "merge-settings.json"
+
+    if (-not (Test-Path $configDir))
+    {
+        New-Item -ItemType Directory -Path $configDir -Force | Out-Null
+    }
+
+    # Build install-time settings for merge. These are installer-owned knobs
+    # such as service identity and certificate location, not user preferences.
+    $settings = @{
+        runAsUser = $Username
+        runAsUserSid = $UserSid
+        authenticationEnabled = $true
+        isServiceInstall = $true
+    }
+
+    if ($CertPath)
+    {
+        $settings.certificatePath = $CertPath
+        $settings.keyProtection = "osProtected"
+    }
+
+    $json = $settings | ConvertTo-Json -Depth 10
+
+    if (Test-Path $settingsPath)
+    {
+        # Reinstall: write merge file, let mt handle merging
+        Set-Content -Path $mergePath -Value $json -Encoding UTF8
+        Write-Host "  Settings: merge file written for mt" -ForegroundColor Gray
+    }
+    else
+    {
+        # Fresh install: write settings.json directly
+        Set-Content -Path $settingsPath -Value $json -Encoding UTF8
+        Write-Host "  Settings: $settingsPath" -ForegroundColor Gray
     }
 
     # Store password hash in secure storage (DPAPI-protected secrets.bin).
@@ -1244,7 +1772,7 @@ function Write-ServiceSettings
         $secretsPath = "$WIN_SERVICE_SETTINGS_DIR\$WIN_SECRETS_FILENAME"
         try
         {
-            $PasswordHash | & $mtPath --write-secret password_hash --service-mode 2>&1 | Out-Null
+            $PasswordHash | & $mtPath --write-secret password_hash --service-mode --settings-dir $configDir 2>&1 | Out-Null
             Write-Host "  Password: stored in $secretsPath" -ForegroundColor Gray
         }
         catch
@@ -1259,7 +1787,160 @@ function Write-ServiceSettings
     if ($CertPath) { Write-Host "  Certificate: $CertPath" -ForegroundColor Gray }
 }
 
-function Install-MidTerm
+function Invoke-TlbxHealthRequest
+{
+    param([string]$Url)
+
+    if ($PSVersionTable.PSVersion.Major -ge 6)
+    {
+        return Invoke-RestMethod -Uri "$Url/api/health" -TimeoutSec 5 -SkipCertificateCheck -ErrorAction Stop
+    }
+
+    Add-Type @"
+using System.Net;
+using System.Net.Security;
+using System.Security.Cryptography.X509Certificates;
+public class TlbxInstallerTrustAllCerts {
+    public static void Ignore() {
+        ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
+    }
+    public static void Restore() {
+        ServicePointManager.ServerCertificateValidationCallback = null;
+    }
+}
+"@ -ErrorAction SilentlyContinue
+
+    try
+    {
+        [TlbxInstallerTrustAllCerts]::Ignore()
+        return Invoke-RestMethod -Uri "$Url/api/health" -TimeoutSec 5 -ErrorAction Stop
+    }
+    finally
+    {
+        [TlbxInstallerTrustAllCerts]::Restore()
+    }
+}
+
+function Get-TlbxProcess
+{
+    param(
+        [string]$ExecutablePath,
+        [int]$ExpectedProcessId = 0
+    )
+
+    if ($ExpectedProcessId -gt 0)
+    {
+        return Get-Process -Id $ExpectedProcessId -ErrorAction SilentlyContinue
+    }
+
+    $expectedFullPath = [IO.Path]::GetFullPath($ExecutablePath)
+    $processes = @(Get-Process -Name ([IO.Path]::GetFileNameWithoutExtension($ExecutablePath)) -ErrorAction SilentlyContinue)
+    foreach ($process in $processes)
+    {
+        try
+        {
+            if ($process.Path -and [IO.Path]::GetFullPath($process.Path) -eq $expectedFullPath)
+            {
+                return $process
+            }
+        }
+        catch
+        {
+            # Process path access can race with startup/exit; retry on the next poll.
+        }
+    }
+    return $null
+}
+
+function Wait-TlbxReady
+{
+    param(
+        [string]$ExecutablePath,
+        [int]$Port,
+        [string]$BindAddress,
+        [bool]$AsService,
+        [int]$ExpectedProcessId = 0
+    )
+
+    $healthUrl = @(Get-TlbxAccessUrls -Port $Port -BindAddress $BindAddress -TailscaleAddresses @())[0]
+    $lastHealth = $null
+    $process = $null
+    $serviceStatus = if ($AsService) { "Unknown" } else { "Not applicable" }
+
+    for ($attempt = 1; $attempt -le 15; $attempt++)
+    {
+        $process = Get-TlbxProcess -ExecutablePath $ExecutablePath -ExpectedProcessId $ExpectedProcessId
+        if ($AsService)
+        {
+            $service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
+            $serviceStatus = if ($service) { $service.Status.ToString() } else { "Not installed" }
+        }
+
+        try
+        {
+            $lastHealth = Invoke-TlbxHealthRequest -Url $healthUrl
+        }
+        catch
+        {
+            $lastHealth = $null
+        }
+
+        $serviceReady = -not $AsService -or $serviceStatus -eq "Running"
+        if ($process -and $serviceReady -and $lastHealth -and $lastHealth.healthy)
+        {
+            return [pscustomobject]@{
+                Ready = $true
+                Process = $process
+                ServiceStatus = $serviceStatus
+                Health = $lastHealth
+                HealthUrl = $healthUrl
+            }
+        }
+
+        if ($ExpectedProcessId -gt 0 -and -not $process)
+        {
+            break
+        }
+        if ($attempt -lt 15)
+        {
+            Start-Sleep -Seconds 1
+        }
+    }
+
+    return [pscustomobject]@{
+        Ready = $false
+        Process = $process
+        ServiceStatus = $serviceStatus
+        Health = $lastHealth
+        HealthUrl = $healthUrl
+    }
+}
+
+function Start-TlbxUserProcess
+{
+    param(
+        [string]$ExecutablePath,
+        [string]$InstallDir,
+        [string]$SettingsDir,
+        [int]$Port,
+        [string]$BindAddress
+    )
+
+    $bindArg = if ($BindAddress -eq "localhost") { "127.0.0.1" } else { $BindAddress }
+    $stdoutLog = Join-Path $SettingsDir "tlbx-user.stdout.log"
+    $stderrLog = Join-Path $SettingsDir "tlbx-user.stderr.log"
+    $arguments = Join-ProcessArguments -Arguments @(
+        "--user-mode",
+        "--settings-dir", $SettingsDir,
+        "--port", $Port.ToString([Globalization.CultureInfo]::InvariantCulture),
+        "--bind", $bindArg)
+
+    Write-Log "Starting user-mode tlbx with stdout=$stdoutLog and stderr=$stderrLog"
+    return Start-Process -FilePath $ExecutablePath -ArgumentList $arguments -WorkingDirectory $InstallDir `
+        -WindowStyle Hidden -RedirectStandardOutput $stdoutLog -RedirectStandardError $stderrLog -PassThru
+}
+
+function Install-Tlbx
 {
     param(
         [bool]$AsService,
@@ -1273,6 +1954,52 @@ function Install-MidTerm
         [bool]$TrustCert = $false
     )
 
+    $tempRoot = $null
+    $installDir = $null
+    $binarySwapCompleted = $false
+    $installationCompleted = $false
+    $serviceExistedBefore = $false
+    $startedUserProcess = $null
+    trap
+    {
+        $installError = $_
+        if ($startedUserProcess -and -not $startedUserProcess.HasExited)
+        {
+            Stop-Process -Id $startedUserProcess.Id -Force -ErrorAction SilentlyContinue
+        }
+        if ($binarySwapCompleted -and -not $installationCompleted -and $installDir -and $tempRoot)
+        {
+            Write-Host "  Installation failed; restoring the previous tlbx binary set..." -ForegroundColor Yellow
+            try
+            {
+                if ($AsService)
+                {
+                    Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue
+                }
+                Restore-PreviousBinarySet -InstallDir $installDir -BackupRoot $tempRoot
+                if ($AsService -and $serviceExistedBefore)
+                {
+                    Start-Service -Name $ServiceName -ErrorAction SilentlyContinue
+                }
+                elseif ($AsService -and (Get-Service -Name $ServiceName -ErrorAction SilentlyContinue))
+                {
+                    sc.exe delete $ServiceName | Out-Null
+                }
+                Write-Log "Previous binary set restored after installation failure" "WARN"
+            }
+            catch
+            {
+                Write-Log "Rollback failed: $_" "ERROR"
+                Write-Host "  Automatic rollback also failed. See $script:UpdateLogFile." -ForegroundColor Red
+            }
+        }
+        if ($tempRoot -and (Test-Path -LiteralPath $tempRoot))
+        {
+            Remove-Item -LiteralPath $tempRoot -Recurse -Force -ErrorAction SilentlyContinue
+        }
+        throw $installError
+    }
+
     # Initialize logging
     $mode = if ($AsService) { "service" } else { "user" }
     Initialize-Log -Mode $mode
@@ -1283,45 +2010,6 @@ function Install-MidTerm
         # Uses PATH_CONSTANTS defined above - keep in sync with SettingsService.cs!
         $installDir = $WIN_SERVICE_INSTALL_DIR
         Write-Log "Install directory: $installDir"
-
-        # Stop and remove old two-service architecture if present
-        $existingService = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
-        $oldHostService = Get-Service -Name $OldHostServiceName -ErrorAction SilentlyContinue
-
-        if ($existingService)
-        {
-            Write-Host "Stopping existing service..." -ForegroundColor Gray
-            Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue
-
-            # Kill any remaining processes
-            Get-Process -Name "mt-host", "mthost", "mtagenthost", "mt" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
-
-            # Wait for processes to fully exit (file handles released)
-            $maxWait = 10
-            $waited = 0
-            while ($waited -lt $maxWait)
-            {
-                $procs = Get-Process -Name "mt-host", "mthost", "mtagenthost", "mt" -ErrorAction SilentlyContinue
-                if (-not $procs) { break }
-                Start-Sleep -Milliseconds 500
-                $waited++
-            }
-
-            if ($waited -ge $maxWait)
-            {
-                Write-Host "  Warning: Some processes may still be running" -ForegroundColor Yellow
-            }
-        }
-
-        # Migration: remove old MidTermHost service from v2.1.x
-        if ($oldHostService)
-        {
-            Write-Host "Migrating from old two-service architecture..." -ForegroundColor Yellow
-            Stop-Service -Name $OldHostServiceName -Force -ErrorAction SilentlyContinue
-            Get-Process -Name "mt-host" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
-            Start-Sleep -Seconds 1
-            sc.exe delete $OldHostServiceName | Out-Null
-        }
     }
     else
     {
@@ -1329,15 +2017,11 @@ function Install-MidTerm
         $installDir = $WIN_USER_INSTALL_DIR
     }
 
-    # Create install directory
-    if (-not (Test-Path $installDir))
-    {
-        New-Item -ItemType Directory -Path $installDir -Force | Out-Null
-    }
-
     # Download and extract
-    $tempZip = Join-Path $env:TEMP "mt-download.zip"
-    $tempExtract = Join-Path $env:TEMP "mt-extract"
+    $tempRoot = Join-Path $env:TEMP ("tlbx-install-" + [Guid]::NewGuid().ToString("N"))
+    $tempZip = Join-Path $tempRoot "release.zip"
+    $tempExtract = Join-Path $tempRoot "extract"
+    New-Item -ItemType Directory -Path $tempExtract -Force | Out-Null
 
     Write-Log "=== PHASE 1: Downloading binaries ==="
     Write-Host "Downloading..." -ForegroundColor Gray
@@ -1349,137 +2033,43 @@ function Install-MidTerm
 
     Write-Host "Extracting..." -ForegroundColor Gray
     Write-Log "Extracting to: $tempExtract"
-    if (Test-Path $tempExtract) { Remove-Item $tempExtract -Recurse -Force }
+    Assert-SafeReleaseArchive -Path $tempZip
     Expand-Archive -Path $tempZip -DestinationPath $tempExtract
-    Assert-SignedRelease -ExtractDir $tempExtract -ExpectedVersion $version -ExpectedPlatform "win-x64" -ExpectedChannel $channelLabel
+    Assert-SignedRelease -ExtractDir $tempExtract -ExpectedVersion $version -ExpectedPlatform $ExpectedReleasePlatform -ExpectedChannel $channelLabel
     Unblock-DownloadedTree -Path $tempExtract
     Write-Log "Extraction and release-signature verification complete"
 
-    Write-Log "=== PHASE 2: Installing binaries ==="
-    # Copy binaries
-    $sourceWebBinary = Join-Path $tempExtract $WebBinaryName
-    $sourceConHostBinary = Join-Path $tempExtract $TtyHostBinaryName
-    $sourceAgentHostBinary = Join-Path $tempExtract $AgentHostBinaryName
-    $destWebBinary = Join-Path $installDir $WebBinaryName
-    $destConHostBinary = Join-Path $installDir $TtyHostBinaryName
-    $destAgentHostBinary = Join-Path $installDir $AgentHostBinaryName
-
-    Write-Host "Installing binaries to $installDir..." -ForegroundColor Gray
-    Write-Log "Installing binaries to $installDir"
-
-    if (-not (Test-Path $sourceWebBinary) -or -not (Test-Path $sourceConHostBinary) -or -not (Test-Path $sourceAgentHostBinary))
-    {
-        throw "Downloaded release archive is incomplete. Expected $WebBinaryName, $TtyHostBinaryName, and $AgentHostBinaryName."
-    }
-
-    # Retry logic for file copy (handles may take time to release)
-    $maxRetries = 15
-    $retryDelay = 500
-
-    # Copy mt.exe with retry
-    $copied = $false
-    for ($i = 0; $i -lt $maxRetries; $i++)
+    # Do not interrupt a working installation until the complete download has
+    # passed archive, metadata-signature, and checksum verification.
+    if ($AsService)
     {
-        try
-        {
-            Copy-Item $sourceWebBinary $destWebBinary -Force -ErrorAction Stop
-            Write-Host "  Installed: $destWebBinary" -ForegroundColor Gray
-            $copied = $true
-            break
-        }
-        catch
-        {
-            if ($i -eq 0)
-            {
-                Write-Host "  Waiting for $WebBinaryName to be released..." -ForegroundColor Yellow
-            }
-            Start-Sleep -Milliseconds $retryDelay
-        }
+        $serviceExistedBefore = [bool](Get-Service -Name $ServiceName -ErrorAction SilentlyContinue)
+        Stop-ExistingInstallProcesses
     }
-    if (-not $copied)
+    if (-not (Test-Path $installDir))
     {
-        Write-Host "  Failed to copy $WebBinaryName after $maxRetries attempts - file is locked" -ForegroundColor Red
-        Write-Host "  Try manually stopping the MidTerm service or process" -ForegroundColor Red
-        throw "Failed to install $WebBinaryName - file locked"
+        New-Item -ItemType Directory -Path $installDir -Force | Out-Null
     }
 
-    # Copy mthost.exe with retry
-    if (Test-Path $sourceConHostBinary)
+    Write-Log "=== PHASE 2: Installing binaries ==="
+    $destWebBinary = Join-Path $installDir $WebBinaryName
+
+    Write-Host "Installing binaries to $installDir..." -ForegroundColor Gray
+    Write-Log "Installing binaries to $installDir"
+    try
     {
-        $copied = $false
-        for ($i = 0; $i -lt $maxRetries; $i++)
-        {
-            try
-            {
-                Copy-Item $sourceConHostBinary $destConHostBinary -Force -ErrorAction Stop
-                Write-Host "  Installed: $destConHostBinary" -ForegroundColor Gray
-                $copied = $true
-                break
-            }
-            catch
-            {
-                if ($i -eq 0)
-                {
-                    Write-Host "  Waiting for $TtyHostBinaryName to be released..." -ForegroundColor Yellow
-                }
-                Start-Sleep -Milliseconds $retryDelay
-            }
-        }
-        if (-not $copied)
-        {
-            Write-Host "  Failed to copy $TtyHostBinaryName after $maxRetries attempts - file is locked" -ForegroundColor Red
-            throw "Failed to install $TtyHostBinaryName - file locked"
-        }
+        Install-VerifiedBinarySet -ExtractDir $tempExtract -InstallDir $installDir -BackupRoot $tempRoot
+        $binarySwapCompleted = $true
     }
-
-    # Copy mtagenthost.exe with retry
-    if (Test-Path $sourceAgentHostBinary)
+    catch
     {
-        $copied = $false
-        for ($i = 0; $i -lt $maxRetries; $i++)
-        {
-            try
-            {
-                Copy-Item $sourceAgentHostBinary $destAgentHostBinary -Force -ErrorAction Stop
-                Write-Host "  Installed: $destAgentHostBinary" -ForegroundColor Gray
-                $copied = $true
-                break
-            }
-            catch
-            {
-                if ($i -eq 0)
-                {
-                    Write-Host "  Waiting for $AgentHostBinaryName to be released..." -ForegroundColor Yellow
-                }
-                Start-Sleep -Milliseconds $retryDelay
-            }
-        }
-        if (-not $copied)
+        if ($AsService -and (Get-Service -Name $ServiceName -ErrorAction SilentlyContinue))
         {
-            Write-Host "  Failed to copy $AgentHostBinaryName after $maxRetries attempts - file is locked" -ForegroundColor Red
-            throw "Failed to install $AgentHostBinaryName - file locked"
+            Start-Service -Name $ServiceName -ErrorAction SilentlyContinue
         }
+        throw
     }
 
-    # Remove legacy mt-host.exe if present from previous installs
-    $legacyHostPath = Join-Path $installDir $LegacyHostBinaryName
-    if (Test-Path $legacyHostPath)
-    {
-        Remove-Item $legacyHostPath -Force -ErrorAction SilentlyContinue
-        Write-Host "  Removed legacy: $LegacyHostBinaryName" -ForegroundColor Gray
-    }
-
-    # Copy version manifest
-    $sourceVersionJson = Join-Path $tempExtract "version.json"
-    if (Test-Path $sourceVersionJson)
-    {
-        Copy-Item $sourceVersionJson (Join-Path $installDir "version.json") -Force
-    }
-
-    # Cleanup temp files
-    Remove-Item $tempZip -Force -ErrorAction SilentlyContinue
-    Remove-Item $tempExtract -Recurse -Force -ErrorAction SilentlyContinue
-
     Write-Log "=== PHASE 3: Password configuration ==="
     # Hash pending password now that mt.exe is installed
     if ($PasswordHash -and $PasswordHash.StartsWith("__PENDING__:"))
@@ -1550,65 +2140,35 @@ function Install-MidTerm
             Ensure-FirewallRule -Port $Port -InstallDir $installDir
         }
 
-        # Wait for mt.exe to spawn
-        Start-Sleep -Seconds 2
-
-        # Show final status
+        # Monitor both the supervised process and the configured HTTPS endpoint.
         Write-Section "Status"
-        $serviceStatus = (Get-Service -Name $ServiceName -ErrorAction SilentlyContinue).Status
-        $mmProc = Get-Process -Name "mt" -ErrorAction SilentlyContinue
+        Write-StatusLine "Startup" "Waiting for process and https endpoint..." Yellow
+        $readiness = Wait-TlbxReady -ExecutablePath $destWebBinary -Port $Port -BindAddress $BindAddress -AsService $true
 
-        if ($serviceStatus -eq "Running") { Write-StatusLine "Service" "Running" Green }
-        else { Write-StatusLine "Service" "$serviceStatus" Red }
+        if ($readiness.ServiceStatus -eq "Running") { Write-StatusLine "Service" "Running" Green }
+        else { Write-StatusLine "Service" "$($readiness.ServiceStatus)" Red }
 
-        if ($mmProc) { Write-StatusLine "mt (web)" "Running (PID $($mmProc.Id))" Green }
-        else { Write-StatusLine "mt (web)" "Starting..." Yellow }
+        if ($readiness.Process) { Write-StatusLine "tlbx process" "Running (PID $($readiness.Process.Id))" Green }
+        else { Write-StatusLine "tlbx process" "Not running" Red }
 
-        # Check health endpoint (HTTPS with self-signed cert requires SkipCertificateCheck)
-        try
+        if ($readiness.Ready)
         {
-            if ($PSVersionTable.PSVersion.Major -ge 6)
-            {
-                $health = Invoke-RestMethod -Uri "https://localhost:$Port/api/health" -TimeoutSec 5 -SkipCertificateCheck -ErrorAction Stop
-            }
-            else
-            {
-                # PS 5.1 workaround for self-signed certs
-                try
-                {
-                    Add-Type @"
-using System.Net;
-using System.Net.Security;
-using System.Security.Cryptography.X509Certificates;
-public class TrustAllCerts {
-    public static void Ignore() {
-        ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
-    }
-    public static void Restore() {
-        ServicePointManager.ServerCertificateValidationCallback = null;
-    }
-}
-"@ -ErrorAction SilentlyContinue
-                    [TrustAllCerts]::Ignore()
-                    $health = Invoke-RestMethod -Uri "https://localhost:$Port/api/health" -TimeoutSec 5 -ErrorAction Stop
-                    [TrustAllCerts]::Restore()
-                }
-                catch
-                {
-                    $health = $null
-                }
-            }
-
-            if ($health)
-            {
-                if ($health.healthy) { Write-StatusLine "Health" "Healthy" Green }
-                else { Write-StatusLine "Health" "Unhealthy" Red; if ($health.hostError) { Write-StatusLine "Error" "$($health.hostError)" Red } }
-                Write-StatusLine "Version" "$($health.version)" Gray
-            }
+            Write-StatusLine "HTTPS" "Reachable and healthy" Green
+            Write-StatusLine "Version" "$($readiness.Health.version)" Gray
         }
-        catch
+        elseif ($readiness.Health)
+        {
+            Write-StatusLine "Health" "Unhealthy" Red
+            if ($readiness.Health.hostError) { Write-StatusLine "Error" "$($readiness.Health.hostError)" Red }
+        }
+        else
+        {
+            Write-StatusLine "HTTPS" "Could not connect to $($readiness.HealthUrl)" Red
+        }
+
+        if (-not $readiness.Ready)
         {
-            Write-StatusLine "Health" "Could not connect to https://localhost:$Port" Yellow
+            throw "tlbx was installed but did not pass the service and health verification. See $script:UpdateLogFile."
         }
     }
     else
@@ -1620,6 +2180,12 @@ public class TrustAllCerts {
         $userMergePath = Join-Path $userSettingsDir "merge-settings.json"
         if (-not (Test-Path $userSettingsDir)) { New-Item -ItemType Directory -Path $userSettingsDir -Force | Out-Null }
 
+        $runtimeSettings = @{
+            port = $Port
+            bindAddress = if ($BindAddress -eq "localhost") { "127.0.0.1" } else { "0.0.0.0" }
+        }
+        $runtimeSettings | ConvertTo-Json | Set-Content -Path (Join-Path $userSettingsDir "runtime.json") -Encoding UTF8
+
         # Build install-time settings
         $userSettings = @{
             authenticationEnabled = $true
@@ -1650,7 +2216,7 @@ public class TrustAllCerts {
             $mtPath = Join-Path $installDir "mt.exe"
             try
             {
-                $PasswordHash | & $mtPath --write-secret password_hash 2>&1 | Out-Null
+                $PasswordHash | & $mtPath --write-secret password_hash --user-mode --settings-dir $userSettingsDir 2>&1 | Out-Null
                 Write-Host "  Password: stored in secure storage ($userSettingsDir\secrets.bin)" -ForegroundColor Gray
             }
             catch
@@ -1659,21 +2225,61 @@ public class TrustAllCerts {
             }
         }
 
-        Install-AsUserApp -InstallDir $installDir -Version $Version
+        Install-AsUserApp -InstallDir $installDir -Version $Version -Port $Port -BindAddress $BindAddress
+
+        Write-Section "Status"
+        Write-StatusLine "Startup" "Starting tlbx and waiting for https endpoint..." Yellow
+        $startedUserProcess = Start-TlbxUserProcess -ExecutablePath $destWebBinary -InstallDir $installDir `
+            -SettingsDir $userSettingsDir -Port $Port -BindAddress $BindAddress
+        $readiness = Wait-TlbxReady -ExecutablePath $destWebBinary -Port $Port -BindAddress $BindAddress `
+            -AsService $false -ExpectedProcessId $startedUserProcess.Id
+
+        if ($readiness.Process) { Write-StatusLine "tlbx process" "Running (PID $($readiness.Process.Id))" Green }
+        else { Write-StatusLine "tlbx process" "Not running" Red }
+
+        if ($readiness.Ready)
+        {
+            Write-StatusLine "HTTPS" "Reachable and healthy" Green
+            Write-StatusLine "Version" "$($readiness.Health.version)" Gray
+        }
+        else
+        {
+            Write-StatusLine "HTTPS" "Could not connect to $($readiness.HealthUrl)" Red
+            throw "tlbx was installed but the user process did not become reachable. See $userSettingsDir\tlbx-user.stderr.log."
+        }
     }
 
+    # Remove the obsolete split-host binary only after the complete install has
+    # succeeded so rollback never destroys a still-working legacy deployment.
+    $legacyHostPath = Join-Path $installDir $LegacyHostBinaryName
+    if (Test-Path $legacyHostPath)
+    {
+        Remove-Item $legacyHostPath -Force -ErrorAction SilentlyContinue
+        Write-Host "  Removed legacy: $LegacyHostBinaryName" -ForegroundColor Gray
+    }
+
+    $installationCompleted = $true
+    Remove-Item $tempRoot -Recurse -Force -ErrorAction SilentlyContinue
+
     Write-Log "=========================================="
     Write-Log "INSTALLATION COMPLETE"
     Write-Log "  Location: $installDir"
-    Write-Log "  URL: https://localhost:$Port"
+    $accessUrls = @(Get-TlbxAccessUrls -Port $Port -BindAddress $BindAddress)
+    foreach ($accessUrl in $accessUrls)
+    {
+        Write-Log "  URL: $accessUrl"
+    }
     Write-Log "  Settings: $settingsDir"
     Write-Log "=========================================="
 
     Write-Section "Complete"
-    Write-Host "  Installation complete" -ForegroundColor Green
+    Write-Host "  Your tlbx is ready at:" -ForegroundColor Green
     Write-Host ""
     Write-StatusLine "Location" "$installDir" Gray
-    Write-StatusLine "URL" "https://localhost:$Port" Cyan
+    foreach ($accessUrl in $accessUrls)
+    {
+        Write-Host "  $accessUrl" -ForegroundColor Cyan
+    }
     Write-StatusLine "Note" "Browser may show certificate warning until trusted" Yellow
     if ($AsService -and (Test-NetworkBinding -BindAddress $BindAddress) -and -not $ConfigureFirewall)
     {
@@ -1717,7 +2323,7 @@ function Install-AsService
         throw "Service '$Name' is still present after delete request$statusText."
     }
 
-    function Get-MidTermServiceDiagnostics
+    function Get-TlbxServiceDiagnostics
     {
         $details = New-Object System.Collections.Generic.List[string]
 
@@ -1805,8 +2411,8 @@ function Install-AsService
 
     # Create service - mt.exe spawns mthost per terminal session
     Write-Log "Creating Windows service..."
-    Write-Host "Creating MidTerm service..." -ForegroundColor Gray
-    $binPath = "`"$webBinaryPath`" --port $Port --bind $bindArg"
+    Write-Host "Creating $DisplayName service..." -ForegroundColor Gray
+    $binPath = "`"$webBinaryPath`" --service-mode --settings-dir `"$WIN_SERVICE_SETTINGS_DIR`" --service-name `"$ServiceName`" --port $Port --bind $bindArg"
     Write-Log "Service binPath: $binPath"
     $scCreateOutput = sc.exe create $ServiceName binPath= $binPath start= auto DisplayName= "$DisplayName" 2>&1
     Write-Log "sc.exe create output: $scCreateOutput"
@@ -1833,7 +2439,7 @@ function Install-AsService
         Write-Log "Failed to start service: $_" "ERROR"
         Write-Host "  Failed to start service: $_" -ForegroundColor Red
 
-        $diagnostics = Get-MidTermServiceDiagnostics
+        $diagnostics = Get-TlbxServiceDiagnostics
         foreach ($line in $diagnostics)
         {
             Write-Log $line "ERROR"
@@ -1861,7 +2467,9 @@ function Install-AsUserApp
 {
     param(
         [string]$InstallDir,
-        [string]$Version
+        [string]$Version,
+        [int]$Port,
+        [string]$BindAddress
     )
 
     # Add to user PATH
@@ -1872,14 +2480,18 @@ function Install-AsUserApp
         [Environment]::SetEnvironmentVariable("Path", "$userPath;$InstallDir", "User")
     }
 
+    $bindArg = if ($BindAddress -eq "localhost") { "127.0.0.1" } else { "0.0.0.0" }
+    [Environment]::SetEnvironmentVariable("TLBX_PORT", $Port.ToString([Globalization.CultureInfo]::InvariantCulture), "User")
+    [Environment]::SetEnvironmentVariable("TLBX_BIND", $bindArg, "User")
+    $env:TLBX_PORT = $Port.ToString([Globalization.CultureInfo]::InvariantCulture)
+    $env:TLBX_BIND = $bindArg
+
     # Register in Add/Remove Programs (user scope)
     Register-Uninstall -InstallDir $InstallDir -Version $Version -IsService $false
 
     # Create uninstall script
     Create-UninstallScript -InstallDir $InstallDir -IsService $false
 
-    Write-Host ""
-    Write-Host "Run 'mt' to start tlbx" -ForegroundColor Yellow
 }
 
 function Register-Uninstall
@@ -1894,11 +2506,11 @@ function Register-Uninstall
 
     if ($IsService)
     {
-        $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm"
+        $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$UninstallRegistryName"
     }
     else
     {
-        $regPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm"
+        $regPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$UninstallRegistryName"
     }
 
     $regValues = @{
@@ -1935,7 +2547,7 @@ function Create-UninstallScript
     # Keep the local uninstall stub tiny so it always delegates to the latest
     # published uninstaller instead of freezing old removal logic on disk.
     $content = @"
-# MidTerm Uninstaller
+# tlbx Uninstaller
 `$ErrorActionPreference = "Stop"
 [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 
@@ -1966,6 +2578,8 @@ if ($ServiceMode)
         Import-ElevatedReplayFile -Path $ReplayFile
     }
 
+    Select-InstallIdentity -AsService $true
+
     # If log file specified, redirect all output there for streaming to original terminal
     if ($LogFile)
     {
@@ -1982,7 +2596,7 @@ if ($ServiceMode)
             $channelLabel = if ($Dev) { "dev" } else { "stable" }
             Write-Host "  Latest $channelLabel version: $version" -ForegroundColor White
             Write-Host ""
-            Install-MidTerm -AsService $true -Version $version -RunAsUser $RunAsUser -RunAsUserSid $RunAsUserSid -PasswordHash $PasswordHash -Port $Port -BindAddress $BindAddress -ConfigureFirewall:$ConfigureFirewall -TrustCert:$TrustCert
+            Install-Tlbx -AsService $true -Version $version -RunAsUser $RunAsUser -RunAsUserSid $RunAsUserSid -PasswordHash $PasswordHash -Port $Port -BindAddress $BindAddress -ConfigureFirewall:$ConfigureFirewall -TrustCert:$TrustCert
         } *>&1 | ForEach-Object {
             $line = $_.ToString()
             Write-Host $_
@@ -1999,7 +2613,7 @@ if ($ServiceMode)
         $channelLabel = if ($Dev) { "dev" } else { "stable" }
         Write-Host "  Latest $channelLabel version: $version" -ForegroundColor White
         Write-Host ""
-        Install-MidTerm -AsService $true -Version $version -RunAsUser $RunAsUser -RunAsUserSid $RunAsUserSid -PasswordHash $PasswordHash -Port $Port -BindAddress $BindAddress -ConfigureFirewall:$ConfigureFirewall -TrustCert:$TrustCert
+        Install-Tlbx -AsService $true -Version $version -RunAsUser $RunAsUser -RunAsUserSid $RunAsUserSid -PasswordHash $PasswordHash -Port $Port -BindAddress $BindAddress -ConfigureFirewall:$ConfigureFirewall -TrustCert:$TrustCert
     }
     return
 }
@@ -2025,7 +2639,7 @@ Write-Host "  Latest $channelLabel version: $version" -ForegroundColor White
 Write-Host ""
 
 # Prompt for install mode with validation
-Write-Host "  How would you like to install MidTerm?" -ForegroundColor White
+Write-Host "  How would you like to install tlbx?" -ForegroundColor White
 Write-Host ""
 Write-Host "  [1] System service (recommended for always-on access)" -ForegroundColor Cyan
 Write-Host "      - Runs in background, starts on boot" -ForegroundColor Gray
@@ -2075,6 +2689,7 @@ for ($i = 0; $i -lt $maxAttempts; $i++)
 if ($asService)
 {
     Assert-NoCrossModeConflict -AsService $true
+    Select-InstallIdentity -AsService $true
 
     # Uses PATH_CONSTANTS defined above - keep in sync with SettingsService.cs!
     $installDir = $WIN_SERVICE_INSTALL_DIR
@@ -2228,11 +2843,12 @@ if ($asService)
     }
 
     # Already admin, proceed with install
-    Install-MidTerm -AsService $true -Version $version -RunAsUser $currentUser.Name -RunAsUserSid $currentUser.Sid -PasswordHash $passwordHash -Port $port -BindAddress $bindAddress -ConfigureFirewall:$configureFirewall -TrustCert $trustCert
+    Install-Tlbx -AsService $true -Version $version -RunAsUser $currentUser.Name -RunAsUserSid $currentUser.Sid -PasswordHash $passwordHash -Port $port -BindAddress $bindAddress -ConfigureFirewall:$configureFirewall -TrustCert $trustCert
 }
 else
 {
     Assert-NoCrossModeConflict -AsService $false
+    Select-InstallIdentity -AsService $false
 
     # User install - still require password
     # Uses PATH_CONSTANTS defined above - keep in sync with SettingsService.cs!
@@ -2260,7 +2876,7 @@ else
         $passwordAction = Prompt-ExistingPasswordAction
         if ($passwordAction -eq "Replace")
         {
-            $tempDir = Join-Path $env:TEMP "MidTerm-Install"
+            $tempDir = Join-Path $env:TEMP "tlbx-install"
             $passwordHash = Prompt-Password -InstallDir $tempDir
         }
         else
@@ -2273,12 +2889,12 @@ else
     else
     {
         # Prompt for password - need a temp location for mt.exe to hash
-        $tempDir = Join-Path $env:TEMP "MidTerm-Install"
+        $tempDir = Join-Path $env:TEMP "tlbx-install"
         $passwordHash = Prompt-Password -InstallDir $tempDir
     }
 
     # Prompt for network configuration
     $networkConfig = Prompt-NetworkConfig
 
-    Install-MidTerm -AsService $false -Version $version -RunAsUser "" -RunAsUserSid "" -PasswordHash $passwordHash
+    Install-Tlbx -AsService $false -Version $version -RunAsUser "" -RunAsUserSid "" -PasswordHash $passwordHash -Port $networkConfig.Port -BindAddress $networkConfig.BindAddress
 }
diff --git a/install.sh b/install.sh
index 74eecc9d8..6ad65f88e 100644
--- a/install.sh
+++ b/install.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# tlbx macOS/Linux Installer (formerly MidTerm)
+# tlbx macOS/Linux Installer
 # Usage: curl -fsSL https://get.tlbx.ai/install.sh | bash
 # Dev:   curl -fsSL https://get.tlbx.ai/install.sh | bash -s -- --dev
 #
@@ -11,6 +11,28 @@
 
 set -e
 
+ACTIVE_INSTALL_TEMP=""
+INSTALL_TRANSACTION_ACTIVE=false
+INSTALL_TRANSACTION_INSTALL_DIR=""
+INSTALL_TRANSACTION_FILES=""
+INSTALL_TRANSACTION_SERVICE_MODE=false
+INSTALL_TRANSACTION_HAD_SERVICE=false
+STARTED_USER_PID=""
+cleanup_active_install_temp() {
+    local exit_status="${1:-0}"
+    if [ "$exit_status" -ne 0 ] && [ -n "$STARTED_USER_PID" ] && kill -0 "$STARTED_USER_PID" 2>/dev/null; then
+        kill "$STARTED_USER_PID" 2>/dev/null || true
+        wait "$STARTED_USER_PID" 2>/dev/null || true
+    fi
+    if [ "$exit_status" -ne 0 ] && [ "$INSTALL_TRANSACTION_ACTIVE" = true ]; then
+        rollback_install_transaction
+    fi
+    if [ -n "$ACTIVE_INSTALL_TEMP" ] && [ -d "$ACTIVE_INSTALL_TEMP" ]; then
+        rm -rf "$ACTIVE_INSTALL_TEMP"
+    fi
+}
+trap 'installer_exit_status=$?; cleanup_active_install_temp "$installer_exit_status"' EXIT
+
 command_exists() {
     command -v "$1" >/dev/null 2>&1
 }
@@ -22,13 +44,13 @@ bootstrap_download() {
     if command_exists curl; then
         curl --fail --silent --show-error --location \
             --retry 3 --retry-delay 1 --retry-all-errors \
-            -H "User-Agent: MidTerm-Installer" \
+            -H "User-Agent: tlbx-Installer" \
             "$url" -o "$dest"
         return
     fi
 
     if command_exists wget; then
-        wget -qO "$dest" --user-agent="MidTerm-Installer" "$url"
+        wget -qO "$dest" --user-agent="tlbx-Installer" "$url"
         return
     fi
 
@@ -49,7 +71,7 @@ if [[ "$SCRIPT_PATH" == "bash" || "$SCRIPT_PATH" == "/bin/bash" || "$SCRIPT_PATH
 fi
 
 REPO_OWNER="tlbx-ai"
-REPO_NAME="MidTerm"
+REPO_NAME="tlbx"
 if command_exists curl; then
     REPOSITORY_COORDINATE=$(curl --fail --silent --show-error --max-time 3 https://get.tlbx.ai/v1/repository 2>/dev/null || true)
 elif command_exists wget; then
@@ -61,8 +83,14 @@ case "${REPOSITORY_COORDINATE:-}" in
         REPO_NAME="${REPOSITORY_COORDINATE#*/}"
         ;;
 esac
-SERVICE_NAME="MidTerm"
-LAUNCHD_LABEL="ai.tlbx.midterm"
+SERVICE_NAME="tlbx"
+LAUNCHD_LABEL="ai.tlbx.service"
+DISPLAY_NAME="tlbx"
+CERTIFICATE_FILE_NAME="tlbx.pem"
+CERTIFICATE_SUBJECT="tlbx"
+SERVICE_LOG_NAME="tlbx.log"
+SERVICE_LIB_DIR="/usr/local/lib/tlbx"
+USER_LIB_DIR="$HOME/.local/lib/tlbx"
 DEV_CHANNEL=false
 # Legacy service names for migration
 OLD_HOST_SERVICE_NAME="MidTerm-host"
@@ -76,16 +104,84 @@ OLD_LAUNCHD_LABEL="com.aitlbx.MidTerm"
 #   - UpdateScriptGenerator.cs (CONFIG_DIR variable in generated scripts)
 #   - install.ps1 (Path Constants section)
 # ============================================================================
-# Unix service mode paths (lowercase 'midterm' - critical!)
-UNIX_SERVICE_SETTINGS_DIR="/usr/local/etc/midterm"
+# New installations use tlbx paths. Existing MidTerm layouts are selected
+# explicitly and remain updateable in place.
+TLBX_SERVICE_SETTINGS_DIR="/usr/local/etc/tlbx"
+LEGACY_SERVICE_SETTINGS_DIR="/usr/local/etc/midterm"
+TLBX_USER_SETTINGS_DIR="$HOME/.tlbx"
+LEGACY_USER_SETTINGS_DIR="$HOME/.midterm"
+UNIX_SERVICE_SETTINGS_DIR="$TLBX_SERVICE_SETTINGS_DIR"
 UNIX_SERVICE_LOG_DIR="/usr/local/var/log"
 UNIX_SERVICE_BIN_DIR="/usr/local/bin"
 # Unix user mode paths
-UNIX_USER_SETTINGS_DIR="$HOME/.midterm"
+UNIX_USER_SETTINGS_DIR="$TLBX_USER_SETTINGS_DIR"
 # Secrets file (NOT secrets.bin - that's Windows only!)
 UNIX_SECRETS_FILENAME="secrets.json"
 # ============================================================================
 
+select_install_identity() {
+    local current_service=false legacy_service=false
+    local current_user=false legacy_user=false
+
+    if settings_layout_has_state "$TLBX_SERVICE_SETTINGS_DIR" || [ -f "/usr/local/lib/tlbx/uninstall.sh" ] || \
+       [ -f "/etc/systemd/system/tlbx.service" ] || [ -f "/Library/LaunchDaemons/ai.tlbx.service.plist" ]; then
+        current_service=true
+    fi
+    if settings_layout_has_state "$LEGACY_SERVICE_SETTINGS_DIR" || [ -f "/usr/local/lib/MidTerm/uninstall.sh" ] || \
+       [ -f "/etc/systemd/system/MidTerm.service" ] || [ -f "/Library/LaunchDaemons/ai.tlbx.midterm.plist" ]; then
+        legacy_service=true
+    fi
+    if settings_layout_has_state "$TLBX_USER_SETTINGS_DIR" || [ -f "$HOME/.local/lib/tlbx/uninstall.sh" ]; then
+        current_user=true
+    fi
+    if settings_layout_has_state "$LEGACY_USER_SETTINGS_DIR" || [ -f "$HOME/.local/lib/MidTerm/uninstall.sh" ]; then
+        legacy_user=true
+    fi
+
+    if { [ "$current_service" = true ] && [ "$legacy_service" = true ]; } || \
+       { [ "$current_user" = true ] && [ "$legacy_user" = true ]; }; then
+        echo "Error: both tlbx and legacy MidTerm installations were found. Uninstall one copy before continuing." >&2
+        exit 1
+    fi
+
+    if [ "$legacy_service" = true ] || [ "$legacy_user" = true ]; then
+        SERVICE_NAME="MidTerm"
+        LAUNCHD_LABEL="ai.tlbx.midterm"
+        DISPLAY_NAME="MidTerm"
+        CERTIFICATE_FILE_NAME="midterm.pem"
+        CERTIFICATE_SUBJECT="ai.tlbx.midterm"
+        SERVICE_LOG_NAME="MidTerm.log"
+        SERVICE_LIB_DIR="/usr/local/lib/MidTerm"
+        USER_LIB_DIR="$HOME/.local/lib/MidTerm"
+        UNIX_SERVICE_SETTINGS_DIR="$LEGACY_SERVICE_SETTINGS_DIR"
+        UNIX_USER_SETTINGS_DIR="$LEGACY_USER_SETTINGS_DIR"
+        echo -e "  ${YELLOW}Existing MidTerm installation detected; updating it in place.${NC}"
+        return
+    fi
+
+    SERVICE_NAME="tlbx"
+    LAUNCHD_LABEL="ai.tlbx.service"
+    DISPLAY_NAME="tlbx"
+    CERTIFICATE_FILE_NAME="tlbx.pem"
+    CERTIFICATE_SUBJECT="tlbx"
+    SERVICE_LOG_NAME="tlbx.log"
+    SERVICE_LIB_DIR="/usr/local/lib/tlbx"
+    USER_LIB_DIR="$HOME/.local/lib/tlbx"
+    UNIX_SERVICE_SETTINGS_DIR="$TLBX_SERVICE_SETTINGS_DIR"
+    UNIX_USER_SETTINGS_DIR="$TLBX_USER_SETTINGS_DIR"
+}
+
+settings_layout_has_state() {
+    local directory="$1"
+    [ -f "$directory/settings.json" ] ||
+        [ -f "$directory/secrets.json" ] ||
+        [ -f "$directory/tlbx.pem" ] ||
+        [ -f "$directory/midterm.pem" ] ||
+        [ -f "$directory/runtime.json" ] ||
+        [ -d "$directory/keys" ] ||
+        [ -d "$directory/worktrees" ]
+}
+
 # Colors
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -204,7 +300,7 @@ download_to_file() {
         if [ "$DOWNLOADER" = "curl" ]; then
             if curl --fail --silent --show-error --location \
                 --retry 3 --retry-delay 1 --retry-all-errors \
-                -H "User-Agent: MidTerm-Installer" \
+                -H "User-Agent: tlbx-Installer" \
                 "$url" -o "$dest"; then
                 if validate_archive "$dest"; then
                     log "Download and archive validation succeeded for $description"
@@ -212,7 +308,7 @@ download_to_file() {
                 fi
             fi
         else
-            if wget -qO "$dest" --user-agent="MidTerm-Installer" "$url"; then
+            if wget -qO "$dest" --user-agent="tlbx-Installer" "$url"; then
                 if validate_archive "$dest"; then
                     log "Download and archive validation succeeded for $description"
                     return 0
@@ -236,7 +332,7 @@ github_api_get() {
             --retry 3 --retry-delay 1 --retry-all-errors \
             -H "Accept: application/vnd.github+json" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            -H "User-Agent: MidTerm-Installer" \
+            -H "User-Agent: tlbx-Installer" \
             "$url"
         return
     fi
@@ -244,7 +340,7 @@ github_api_get() {
     wget -qO- \
         --header="Accept: application/vnd.github+json" \
         --header="X-GitHub-Api-Version: 2022-11-28" \
-        --user-agent="MidTerm-Installer" \
+        --user-agent="tlbx-Installer" \
         "$url"
 }
 
@@ -254,14 +350,14 @@ resolve_redirect_url() {
     if [ "$DOWNLOADER" = "curl" ]; then
         curl --fail --silent --show-error --location --head \
             --output /dev/null --write-out '%{url_effective}' \
-            -H "User-Agent: MidTerm-Installer" \
+            -H "User-Agent: tlbx-Installer" \
             "$url"
         return
     fi
 
     local headers
     headers=$(wget --server-response --spider --max-redirect=0 \
-        --user-agent="MidTerm-Installer" "$url" 2>&1 || true)
+        --user-agent="tlbx-Installer" "$url" 2>&1 || true)
 
     printf '%s' "$headers" |
         tr -d '\r' |
@@ -278,15 +374,43 @@ ensure_prerequisites() {
     require_command tar tar
     require_command grep grep
     require_command sed sed
+    require_command awk gawk
     require_command stty coreutils
     require_command tee coreutils
     require_command base64 coreutils
     require_command pgrep procps/procps-ng
+    require_command openssl openssl
     require_any_download_tool
 
-    if [ "$DEV_CHANNEL" = true ]; then
-        require_command awk gawk
+    if ! command_exists sha256sum && ! command_exists shasum; then
+        echo -e "${RED}Missing required SHA-256 tool: sha256sum or shasum${NC}" >&2
+        exit 1
+    fi
+}
+
+validate_archive_members() {
+    local archive_path="$1"
+    local member normalized
+
+    while IFS= read -r member; do
+        normalized="${member#./}"
+        case "$normalized" in
+            ""|mt|mthost|mtagenthost|mttmux|version.json|SHA256SUMS.txt) ;;
+            *)
+                log "Release archive contains unexpected member: $member" "ERROR"
+                return 1
+                ;;
+        esac
+    done < <(tar -tzf "$archive_path")
+
+    # Release payloads are regular files only. Reject links and device entries
+    # before extraction so an archive cannot redirect writes outside temp.
+    if tar -tvzf "$archive_path" | awk 'NF && substr($1,1,1) != "-" && $NF != "./" { exit 1 }'; then
+        return 0
     fi
+
+    log "Release archive contains a non-regular member" "ERROR"
+    return 1
 }
 
 init_log() {
@@ -296,7 +420,7 @@ init_log() {
     if [ "$mode" = "service" ]; then
         log_dir="/usr/local/var/log"
     else
-        log_dir="$HOME/.midterm"
+        log_dir="$UNIX_USER_SETTINGS_DIR"
     fi
 
     mkdir -p "$log_dir" 2>/dev/null || true
@@ -355,15 +479,14 @@ repeat_char() {
     printf '%s' "$out"
 }
 
-print_midterm_banner() {
+print_tlbx_banner() {
     echo ""
-    echo -e "            ${WHITE}//   \\\\${NC}"
-    echo -e "           ${WHITE}//     \\\\         __  __ _     _ _____${NC}"
-    echo -e "          ${WHITE}//       \\\\       |  \\/  (_) __| |_   _|__ _ __ _ __ ___${NC}"
-    echo -e "         ${WHITE}//  ( ${CYAN}·${WHITE} )  \\\\      | |\\/| | |/ _\` | | |/ _ \\\\ '__| '_ \` _ \\\\${NC}"
-    echo -e "        ${WHITE}//           \\\\     | |  | | | (_| | | |  __/ |  | | | | | |${NC}"
-    echo -e "       ${WHITE}//             \\\\    |_|  |_|_|\\__,_| |_|\\___|_|  |_| |_| |_|${NC}"
-    echo -e "      ${WHITE}//               \\\\   ${GREEN}tlbx.ai - https://github.com/tlbx-ai/tlbx${NC}"
+    echo -e "       ${WHITE}_   _ _${NC}"
+    echo -e "      ${WHITE}| |_| | |__  __  __${NC}"
+    echo -e "      ${WHITE}| __| | '_ \\\\ \\\\ \\/ /${NC}"
+    echo -e "      ${WHITE}| |_| | |_) | >  <${NC}"
+    echo -e "       ${WHITE}\\\\__|_|_.__/ /_/\\\\_\\\\${NC}"
+    echo -e "      ${GREEN}tlbx.ai - https://github.com/tlbx-ai/tlbx${NC}"
     echo ""
 }
 
@@ -413,6 +536,45 @@ PORT="${PORT:-2000}"
 BIND_ADDRESS="${BIND_ADDRESS:-0.0.0.0}"
 TRUST_CERT="${TRUST_CERT:-}"
 LOGGING_STARTED="${LOGGING_STARTED:-}"
+INSTALLER_HANDOFF_FILE="${INSTALLER_HANDOFF_FILE:-}"
+
+write_handoff_value() {
+    local key="$1"
+    local value="$2"
+    local destination="$3"
+    printf '%s=' "$key" >> "$destination"
+    printf '%s' "$value" | base64 | tr -d '\r\n' >> "$destination"
+    printf '\n' >> "$destination"
+}
+
+load_installer_handoff() {
+    local path="$1"
+    if [ -z "$path" ] || [ ! -f "$path" ] || [ -L "$path" ]; then
+        echo "Error: secure installer handoff file is missing or invalid." >&2
+        exit 1
+    fi
+
+    while IFS='=' read -r key encoded; do
+        local decoded
+        decoded=$(printf '%s' "$encoded" | base64 -d 2>/dev/null || printf '%s' "$encoded" | base64 -D 2>/dev/null) || {
+            echo "Error: secure installer handoff could not be decoded." >&2
+            exit 1
+        }
+        case "$key" in
+            INSTALLING_USER) INSTALLING_USER="$decoded" ;;
+            INSTALLING_UID) INSTALLING_UID="$decoded" ;;
+            INSTALLING_GID) INSTALLING_GID="$decoded" ;;
+            PASSWORD_HASH) PASSWORD_HASH="$decoded" ;;
+            PASSWORD_ACTION) PASSWORD_ACTION="$decoded" ;;
+            PORT) PORT="$decoded" ;;
+            BIND_ADDRESS) BIND_ADDRESS="$decoded" ;;
+            TRUST_CERT) TRUST_CERT="$decoded" ;;
+        esac
+    done < "$path"
+
+    rm -f "$path"
+    INSTALLER_HANDOFF_FILE=""
+}
 
 setup_logging() {
     local mode="$1"
@@ -420,11 +582,11 @@ setup_logging() {
 
     # Log paths - MUST match LogPaths.cs in C# codebase (source of truth)
     # Service mode: /usr/local/var/log/update.log
-    # User mode: ~/.midterm/update.log
+    # User mode: selected tlbx or compatible legacy settings directory.
     if [ "$mode" = "service" ]; then
         log_dir="/usr/local/var/log"
     else
-        log_dir="$HOME/.midterm"
+        log_dir="$UNIX_USER_SETTINGS_DIR"
     fi
 
     log_file="$log_dir/update.log"
@@ -450,7 +612,7 @@ setup_logging() {
 }
 
 print_header() {
-    print_midterm_banner
+    print_tlbx_banner
     echo -e "  ${CYAN}Installer${NC}"
     echo ""
 }
@@ -1206,15 +1368,15 @@ generate_certificate() {
     fi
 
     # Build args - service mode uses different paths
-    local cert_args="--generate-cert --force"
+    local cert_args=(--generate-cert --user-mode --settings-dir "$settings_dir" --force)
     if [ "$is_service" = true ]; then
-        cert_args="--generate-cert --service-mode --force"
+        cert_args=(--generate-cert --service-mode --settings-dir "$settings_dir" --force)
     fi
-    log "Running: $mt_path $cert_args"
+    log "Running certificate generator for selected settings directory"
 
     # Use mt --generate-cert to generate certificate with encrypted private key
     local output
-    output=$("$mt_path" $cert_args 2>&1)
+    output=$("$mt_path" "${cert_args[@]}" 2>&1)
     local exit_code=$?
 
     log "Certificate generation exit code: $exit_code"
@@ -1234,7 +1396,7 @@ generate_certificate() {
     fi
     if [ -z "$CERT_PATH" ]; then
         # Default path (matches what mt generates)
-        CERT_PATH="$settings_dir/midterm.pem"
+        CERT_PATH="$settings_dir/$CERTIFICATE_FILE_NAME"
     fi
 
     log "Certificate path: $CERT_PATH"
@@ -1301,6 +1463,14 @@ write_user_settings() {
 
     mkdir -p "$config_dir"
 
+    cat > "$config_dir/runtime.json" << EOF
+{
+  "port": $PORT,
+  "bindAddress": "$BIND_ADDRESS"
+}
+EOF
+    chmod 600 "$config_dir/runtime.json"
+
     # Build install-time settings for merge
     local json_content="{
   \"authenticationEnabled\": true"
@@ -1444,7 +1614,7 @@ execute_certificate_trust() {
     # user can trust the certificate manually later.
     if [ "$(uname -s)" = "Darwin" ]; then
         local existing_hashes current_hash
-        existing_hashes=$(security find-certificate -a -Z -c ai.tlbx.midterm /Library/Keychains/System.keychain 2>/dev/null | \
+        existing_hashes=$(security find-certificate -a -Z -c "$CERTIFICATE_SUBJECT" /Library/Keychains/System.keychain 2>/dev/null | \
             sed -n 's/^SHA-256 hash: //p')
         if command_exists openssl; then
             current_hash=$(openssl x509 -in "$cert_path" -noout -fingerprint -sha256 2>/dev/null | \
@@ -1480,7 +1650,7 @@ execute_certificate_trust() {
             fi
         fi
     else
-        if cp "$cert_path" /usr/local/share/ca-certificates/midterm.crt 2>/dev/null && \
+        if cp "$cert_path" "/usr/local/share/ca-certificates/${CERTIFICATE_FILE_NAME%.pem}.crt" 2>/dev/null && \
            update-ca-certificates 2>/dev/null; then
             print_step "Trusting certificate..." "done"
         else
@@ -1513,7 +1683,7 @@ prompt_certificate_trust() {
                 log "Could not auto-trust certificate (code: $exit_code): $output"
             fi
         else
-            if sudo cp "$cert_path" /usr/local/share/ca-certificates/midterm.crt 2>/dev/null && \
+            if sudo cp "$cert_path" "/usr/local/share/ca-certificates/${CERTIFICATE_FILE_NAME%.pem}.crt" 2>/dev/null && \
                sudo update-ca-certificates 2>/dev/null; then
                 print_step "Trusting certificate..." "done"
             else
@@ -1523,76 +1693,213 @@ prompt_certificate_trust() {
     fi
 }
 
-show_process_status() {
-    local port="$1"
+is_tailscale_ipv4() {
+    local address="$1" first second third fourth extra
+    IFS=. read -r first second third fourth extra <<< "$address"
+    [[ -z "$extra" && "$first" =~ ^[0-9]+$ && "$second" =~ ^[0-9]+$ && \
+       "$third" =~ ^[0-9]+$ && "$fourth" =~ ^[0-9]+$ ]] || return 1
+    [ "$first" -eq 100 ] && [ "$second" -ge 64 ] && [ "$second" -le 127 ] && \
+        [ "$third" -le 255 ] && [ "$fourth" -le 255 ]
+}
 
-    print_phase "Status"
+get_tailscale_ipv4_addresses() {
+    local candidates="" address
+    if command_exists tailscale; then
+        candidates="$(tailscale ip -4 2>/dev/null || true)"
+    fi
+    if command_exists ip; then
+        candidates="$candidates
+$(ip -4 -o address show 2>/dev/null | awk '{print $4}' | cut -d/ -f1)"
+    elif command_exists ifconfig; then
+        candidates="$candidates
+$(ifconfig 2>/dev/null | awk '/inet / {print $2}')"
+    fi
 
-    # Check service status
-    if [ "$(uname -s)" = "Darwin" ]; then
-        if launchctl list 2>/dev/null | grep -q "$LAUNCHD_LABEL"; then
-            print_status "Service" "running" "$GREEN"
-        else
-            print_status "Service" "starting..." "$YELLOW"
+    while IFS= read -r address; do
+        address="${address//[[:space:]]/}"
+        if is_tailscale_ipv4 "$address"; then
+            printf '%s\n' "$address"
         fi
+    done <<< "$candidates" | awk '!seen[$0]++'
+}
+
+format_tlbx_url() {
+    local host="$1" port="$2"
+    if [[ "$host" == *:* && "$host" != \[*\] ]]; then
+        host="[$host]"
+    fi
+    printf 'https://%s:%s' "$host" "$port"
+}
+
+get_primary_access_url() {
+    local port="$1" bind_address="$2" host
+    case "$bind_address" in
+        ""|localhost|127.0.0.1|::1|\[::1\]|\*|0.0.0.0|::|\[::\]) host="localhost" ;;
+        *) host="$bind_address" ;;
+    esac
+    format_tlbx_url "$host" "$port"
+}
+
+print_ready_urls() {
+    local port="$1" bind_address="$2" primary_url tailscale_address tailscale_url
+    primary_url="$(get_primary_access_url "$port" "$bind_address")"
+
+    echo -e "  ${GREEN}Your tlbx is ready at:${NC}"
+    echo "  $primary_url"
+    log "  URL: $primary_url"
+
+    case "$bind_address" in
+        \*|0.0.0.0|::|\[::\])
+            while IFS= read -r tailscale_address; do
+                [ -n "$tailscale_address" ] || continue
+                tailscale_url="$(format_tlbx_url "$tailscale_address" "$port")"
+                echo "  $tailscale_url"
+                log "  URL: $tailscale_url"
+            done < <(get_tailscale_ipv4_addresses)
+            ;;
+        *) ;;
+    esac
+}
+
+service_is_running() {
+    if [ "$(uname -s)" = "Darwin" ]; then
+        launchctl print "system/$LAUNCHD_LABEL" >/dev/null 2>&1
     else
-        if systemctl is-active --quiet "$SERVICE_NAME" 2>/dev/null; then
-            print_status "Service" "running" "$GREEN"
-        else
-            print_status "Service" "starting..." "$YELLOW"
-        fi
+        systemctl is-active --quiet "$SERVICE_NAME" 2>/dev/null
     fi
+}
 
-    # Check mt process
-    local mt_pid
-    mt_pid=$(pgrep -f "^/usr/local/bin/mt" 2>/dev/null | head -1 || true)
-    if [ -n "$mt_pid" ]; then
-        print_status "mt (web)" "running (PID $mt_pid)" "$GREEN"
+get_service_pid() {
+    if [ "$(uname -s)" = "Darwin" ]; then
+        launchctl print "system/$LAUNCHD_LABEL" 2>/dev/null | awk '/pid = / {print $3; exit}'
     else
-        print_status "mt (web)" "starting..." "$YELLOW"
+        systemctl show "$SERVICE_NAME" --property MainPID --value 2>/dev/null | awk '$1 != 0 {print; exit}'
     fi
+}
 
-    # Health check with version info
-    sleep 2
-    local health_response
-    health_response=$(curl -fsSk "https://localhost:$port/api/health" 2>/dev/null || true)
+request_health() {
+    local url="$1"
+    if command_exists curl; then
+        curl -fsSk --max-time 5 "$url/api/health" 2>/dev/null
+    else
+        wget -qO- --timeout=5 --no-check-certificate "$url/api/health" 2>/dev/null
+    fi
+}
+
+READY_PID=""
+READY_HEALTH_RESPONSE=""
+READY_VERSION=""
+READY_URL=""
+wait_tlbx_ready() {
+    local port="$1" bind_address="$2" service_mode="$3" expected_pid="${4:-}"
+    local attempt service_ready process_ready health_response current_pid
+    READY_PID=""
+    READY_HEALTH_RESPONSE=""
+    READY_VERSION=""
+    READY_URL="$(get_primary_access_url "$port" "$bind_address")"
+
+    for attempt in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+        service_ready=true
+        current_pid="$expected_pid"
+        if [ "$service_mode" = true ]; then
+            service_is_running || service_ready=false
+            current_pid="$(get_service_pid || true)"
+        fi
+
+        process_ready=false
+        if [ -n "$current_pid" ] && kill -0 "$current_pid" 2>/dev/null; then
+            process_ready=true
+            READY_PID="$current_pid"
+        fi
 
-    if [ -n "$health_response" ]; then
-        local healthy version
-        healthy=$(echo "$health_response" | grep -o '"healthy"[[:space:]]*:[[:space:]]*true' || true)
-        version=$(echo "$health_response" | grep -o '"version"[[:space:]]*:[[:space:]]*"[^"]*"' | sed 's/.*"\([^"]*\)"$/\1/')
+        health_response="$(request_health "$READY_URL" || true)"
+        READY_HEALTH_RESPONSE="$health_response"
+        if [ "$service_ready" = true ] && [ "$process_ready" = true ] && \
+           echo "$health_response" | grep -q '"healthy"[[:space:]]*:[[:space:]]*true'; then
+            READY_VERSION="$(echo "$health_response" | grep -o '"version"[[:space:]]*:[[:space:]]*"[^"]*"' | sed 's/.*"\([^"]*\)"$/\1/')"
+            log "Process $READY_PID and health endpoint $READY_URL are ready"
+            return 0
+        fi
 
-        if [ -n "$healthy" ]; then
-            if [ -n "$version" ]; then
-                print_status "Health" "healthy (v$version)" "$GREEN"
+        if [ -n "$expected_pid" ] && ! kill -0 "$expected_pid" 2>/dev/null; then
+            break
+        fi
+        [ "$attempt" -eq 15 ] || sleep 1
+    done
+
+    log "Process/health readiness failed for $READY_URL after 15 attempts" "ERROR"
+    return 1
+}
+
+start_user_tlbx() {
+    local install_dir="$1" settings_dir="$2" port="$3" bind_address="$4"
+    local stdout_log="$settings_dir/tlbx-user.stdout.log"
+    local stderr_log="$settings_dir/tlbx-user.stderr.log"
+
+    log "Starting user-mode tlbx with stdout=$stdout_log and stderr=$stderr_log"
+    nohup "$install_dir/mt" --user-mode --settings-dir "$settings_dir" \
+        --port "$port" --bind "$bind_address" </dev/null >"$stdout_log" 2>"$stderr_log" &
+    STARTED_USER_PID=$!
+}
+
+rollback_install_transaction() {
+    [ "$INSTALL_TRANSACTION_ACTIVE" = true ] || return 0
+
+    log "Installation failed after the binary swap; restoring the previous binary set" "WARN"
+    if [ "$INSTALL_TRANSACTION_SERVICE_MODE" = true ]; then
+        if [ "$PLATFORM" = "osx" ]; then
+            launchctl bootout system/"$LAUNCHD_LABEL" >/dev/null 2>&1 || true
+        else
+            systemctl stop "$SERVICE_NAME" >/dev/null 2>&1 || true
+        fi
+    fi
+
+    local file_name backup_dir="$ACTIVE_INSTALL_TEMP/backup"
+    for file_name in $INSTALL_TRANSACTION_FILES; do
+        rm -f "$INSTALL_TRANSACTION_INSTALL_DIR/$file_name"
+        if [ -f "$backup_dir/$file_name" ]; then
+            cp -p "$backup_dir/$file_name" "$INSTALL_TRANSACTION_INSTALL_DIR/$file_name" || true
+        fi
+    done
+
+    if [ "$INSTALL_TRANSACTION_SERVICE_MODE" = true ]; then
+        if [ "$INSTALL_TRANSACTION_HAD_SERVICE" = true ]; then
+            if [ "$PLATFORM" = "osx" ]; then
+                local plist_path="/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist"
+                [ -f "$plist_path" ] && launchctl bootstrap system "$plist_path" >/dev/null 2>&1 || true
+                launchctl kickstart -k system/"$LAUNCHD_LABEL" >/dev/null 2>&1 || true
             else
-                print_status "Health" "healthy" "$GREEN"
+                systemctl start "$SERVICE_NAME" >/dev/null 2>&1 || true
             fi
+        elif [ "$PLATFORM" = "osx" ]; then
+            rm -f "/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist"
         else
-            print_status "Health" "unhealthy" "$RED"
+            systemctl disable "$SERVICE_NAME" >/dev/null 2>&1 || true
+            rm -f "/etc/systemd/system/${SERVICE_NAME}.service"
+            systemctl daemon-reload >/dev/null 2>&1 || true
         fi
-    else
-        print_status "Health" "could not connect" "$YELLOW"
     fi
-}
 
-check_health() {
-    local port="$1"
-    sleep 2
+    INSTALL_TRANSACTION_ACTIVE=false
+    echo -e "  ${YELLOW}Previous tlbx binaries restored after installation failure.${NC}" >&2
+}
 
-    # Try curl with insecure flag (self-signed cert)
-    if curl -fsSk "https://localhost:$port/api/health" >/dev/null 2>&1; then
-        log "Health check passed"
-        return 0
-    else
-        log "Health check pending"
-        return 1
-    fi
+commit_install_transaction() {
+    [ "$INSTALL_TRANSACTION_ACTIVE" = true ] || return 0
+    rm -f "$INSTALL_TRANSACTION_INSTALL_DIR/mt-host"
+    rm -rf "$ACTIVE_INSTALL_TEMP"
+    ACTIVE_INSTALL_TEMP=""
+    INSTALL_TRANSACTION_ACTIVE=false
+    INSTALL_TRANSACTION_INSTALL_DIR=""
+    INSTALL_TRANSACTION_FILES=""
+    log "Installation transaction committed"
 }
 
 install_binary() {
     local install_dir="$1"
+    local service_mode="${2:-false}"
     local temp_dir=$(mktemp -d)
+    ACTIVE_INSTALL_TEMP="$temp_dir"
     local archive_path="$temp_dir/$ASSET_NAME"
 
     log "Downloading from: $ASSET_URL"
@@ -1611,6 +1918,11 @@ install_binary() {
 
     log "Extracting to: $temp_dir"
     print_step_inline "Extracting binaries..."
+    if ! validate_archive_members "$archive_path"; then
+        finish_step_inline "failed (unsafe archive)" "$RED"
+        rm -rf "$temp_dir"
+        exit 1
+    fi
     if ! tar -xzf "$archive_path" -C "$temp_dir"; then
         log "Extraction failed for $archive_path" "ERROR"
         finish_step_inline "failed" "$RED"
@@ -1634,63 +1946,81 @@ install_binary() {
     fi
     finish_step_inline "verified" "$GREEN"
 
+    local had_service=false
+    if [ "$service_mode" = true ]; then
+        if [ "$PLATFORM" = "osx" ]; then
+            [ -f "/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist" ] && had_service=true
+            launchctl bootout system/"$LAUNCHD_LABEL" 2>/dev/null || true
+        else
+            [ -f "/etc/systemd/system/${SERVICE_NAME}.service" ] && had_service=true
+            systemctl stop "$SERVICE_NAME" 2>/dev/null || true
+        fi
+        stop_conflicting_tlbx_processes "$install_dir"
+    fi
+
     # Create install directory
     mkdir -p "$install_dir"
 
-    # Copy web binary with retry (handles file lock during updates)
-    log "Copying mt to $install_dir/mt"
-    if ! copy_with_retry "$temp_dir/mt" "$install_dir/mt"; then
-        log "Failed to copy mt - file locked" "ERROR"
-        print_step "Copying mt..." "failed (locked)" "$RED"
-        rm -rf "$temp_dir"
-        exit 1
+    local backup_dir="$temp_dir/backup"
+    local file_name install_ok=true
+    local runtime_files="mt mthost mtagenthost version.json"
+    if [ -f "$temp_dir/mttmux" ]; then
+        runtime_files="$runtime_files mttmux"
     fi
-    chmod +x "$install_dir/mt"
-    log "mt copied and made executable"
-
-    # Copy tty host binary (terminal subprocess)
-    if [ -f "$temp_dir/mthost" ]; then
-        log "Copying mthost to $install_dir/mthost"
-        if ! copy_with_retry "$temp_dir/mthost" "$install_dir/mthost"; then
-            log "Failed to copy mthost - file locked" "ERROR"
-            print_step "Copying mthost..." "failed (locked)" "$RED"
-            rm -rf "$temp_dir"
-            exit 1
+    mkdir -p "$backup_dir"
+    for file_name in $runtime_files; do
+        if [ -f "$install_dir/$file_name" ]; then
+            cp -p "$install_dir/$file_name" "$backup_dir/$file_name"
         fi
-        chmod +x "$install_dir/mthost"
-        log "mthost copied and made executable"
-    fi
+    done
 
-    if [ -f "$temp_dir/mtagenthost" ]; then
-        log "Copying mtagenthost to $install_dir/mtagenthost"
-        if ! copy_with_retry "$temp_dir/mtagenthost" "$install_dir/mtagenthost"; then
-            log "Failed to copy mtagenthost - file locked" "ERROR"
-            print_step "Copying mtagenthost..." "failed (locked)" "$RED"
-            rm -rf "$temp_dir"
-            exit 1
+    for file_name in $runtime_files; do
+        if ! copy_with_retry "$temp_dir/$file_name" "$install_dir/$file_name"; then
+            log "Failed to install $file_name; restoring previous binary set" "ERROR"
+            install_ok=false
+            break
         fi
-        chmod +x "$install_dir/mtagenthost"
-        log "mtagenthost copied and made executable"
-    fi
+    done
 
-    # Copy version manifest
-    if [ -f "$temp_dir/version.json" ]; then
-        copy_with_retry "$temp_dir/version.json" "$install_dir/version.json" || true
-        log "version.json copied"
+    if [ "$install_ok" != true ]; then
+        for file_name in $runtime_files; do
+            rm -f "$install_dir/$file_name"
+            if [ -f "$backup_dir/$file_name" ]; then
+                cp -p "$backup_dir/$file_name" "$install_dir/$file_name" || true
+            fi
+        done
+        if [ "$service_mode" = true ]; then
+            if [ "$PLATFORM" = "osx" ]; then
+                local existing_plist="/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist"
+                if [ -f "$existing_plist" ]; then
+                    launchctl bootstrap system "$existing_plist" 2>/dev/null || true
+                    launchctl kickstart -k system/"$LAUNCHD_LABEL" 2>/dev/null || true
+                fi
+            else
+                systemctl start "$SERVICE_NAME" 2>/dev/null || true
+            fi
+        fi
+        rm -rf "$temp_dir"
+        exit 1
     fi
 
-    # Cleanup
-    rm -rf "$temp_dir"
-    log "Temp directory cleaned up"
+    chmod +x "$install_dir/mt" "$install_dir/mthost" "$install_dir/mtagenthost"
+    [ -f "$install_dir/mttmux" ] && chmod +x "$install_dir/mttmux"
+    log "Verified binary set installed transactionally"
 
-    # Remove legacy mt-host if present (from pre-v4)
-    rm -f "$install_dir/mt-host"
+    # Keep the backup until password, certificate, settings, service, and health
+    # setup have all succeeded. The caller commits the transaction at the end.
+    INSTALL_TRANSACTION_ACTIVE=true
+    INSTALL_TRANSACTION_INSTALL_DIR="$install_dir"
+    INSTALL_TRANSACTION_FILES="$runtime_files"
+    INSTALL_TRANSACTION_SERVICE_MODE="$service_mode"
+    INSTALL_TRANSACTION_HAD_SERVICE="$had_service"
 }
 
 install_as_service() {
     # Uses PATH_CONSTANTS defined above - keep in sync with SettingsService.cs!
     local install_dir="$UNIX_SERVICE_BIN_DIR"
-    local lib_dir="/usr/local/lib/MidTerm"
+    local lib_dir="$SERVICE_LIB_DIR"
     local settings_dir="$UNIX_SERVICE_SETTINGS_DIR"
 
     # Check for root first. Service-mode logging lives under /usr/local/var/log,
@@ -1705,20 +2035,29 @@ install_as_service() {
 
         echo ""
         echo -e "${YELLOW}Requesting sudo privileges...${NC}"
-        # Re-exec with sudo, passing all collected info as environment variables
+        # Re-exec with sudo. Sensitive password material is transferred through
+        # a mode-0600 handoff file rather than process arguments or sudo env.
         local dev_flag=""
         if [ "$DEV_CHANNEL" = true ]; then
             dev_flag="--dev"
         fi
-        exec sudo env INSTALLING_USER="$INSTALLING_USER" \
-                     INSTALLING_UID="$INSTALLING_UID" \
-                     INSTALLING_GID="$INSTALLING_GID" \
-                     PASSWORD_HASH="$PASSWORD_HASH" \
-                     PASSWORD_ACTION="$PASSWORD_ACTION" \
-                     PORT="$PORT" \
-                     BIND_ADDRESS="$BIND_ADDRESS" \
-                     TRUST_CERT="$TRUST_CERT" \
-                     "$SCRIPT_PATH" --service $dev_flag
+        local handoff_file
+        handoff_file=$(mktemp "${TMPDIR:-/tmp}/tlbx-install-handoff.XXXXXX")
+        chmod 600 "$handoff_file"
+        write_handoff_value INSTALLING_USER "$INSTALLING_USER" "$handoff_file"
+        write_handoff_value INSTALLING_UID "$INSTALLING_UID" "$handoff_file"
+        write_handoff_value INSTALLING_GID "$INSTALLING_GID" "$handoff_file"
+        write_handoff_value PASSWORD_HASH "$PASSWORD_HASH" "$handoff_file"
+        write_handoff_value PASSWORD_ACTION "$PASSWORD_ACTION" "$handoff_file"
+        write_handoff_value PORT "$PORT" "$handoff_file"
+        write_handoff_value BIND_ADDRESS "$BIND_ADDRESS" "$handoff_file"
+        write_handoff_value TRUST_CERT "$TRUST_CERT" "$handoff_file"
+        set +e
+        sudo env INSTALLER_HANDOFF_FILE="$handoff_file" "$SCRIPT_PATH" --service $dev_flag
+        local elevated_exit=$?
+        set -e
+        rm -f "$handoff_file"
+        exit "$elevated_exit"
     fi
 
     if [ "$PLATFORM" = "linux" ] && ! command_exists systemctl; then
@@ -1733,13 +2072,14 @@ install_as_service() {
     print_phase "Installing"
 
     log "=== PHASE 1: Installing binaries ==="
-    install_binary "$install_dir"
+    install_binary "$install_dir" true
 
     # Make binaries writable by the service user so self-update works without sudo.
     # The update script runs as the service user (non-root) and needs to overwrite
     # these files in-place. Without this, self-update silently fails.
     if [ -n "$INSTALLING_USER" ]; then
         chown "$INSTALLING_USER" "$install_dir/mt" "$install_dir/mthost" "$install_dir/mtagenthost" 2>/dev/null || true
+        [ -f "$install_dir/mttmux" ] && chown "$INSTALLING_USER" "$install_dir/mttmux" 2>/dev/null || true
         [ -f "$install_dir/version.json" ] && chown "$INSTALLING_USER" "$install_dir/version.json" 2>/dev/null || true
     fi
 
@@ -1822,7 +2162,7 @@ install_as_service() {
     # Store password in secure secrets storage. A failed new/replacement write is
     # fatal; we do not want to continue into a misleading partially secured state.
     if [ "$should_write_password" = true ] && [ -n "$PASSWORD_HASH" ] && [[ "$PASSWORD_HASH" == '$PBKDF2$'* ]]; then
-        if echo "$PASSWORD_HASH" | "$install_dir/mt" --write-secret password_hash --service-mode 2>/dev/null; then
+        if echo "$PASSWORD_HASH" | "$install_dir/mt" --write-secret password_hash --service-mode --settings-dir "$settings_dir" 2>/dev/null; then
             log "Password stored in secure secrets storage"
             print_step "Storing password..." "done"
         else
@@ -1835,7 +2175,7 @@ install_as_service() {
 
     log "=== PHASE 3: Certificate configuration ==="
     # Check existing certificate before generating
-    local existing_cert="$settings_dir/midterm.pem"
+    local existing_cert="$settings_dir/$CERTIFICATE_FILE_NAME"
     if check_existing_certificate "$existing_cert"; then
         log "Existing certificate is valid, reusing"
         CERT_PATH="$existing_cert"
@@ -1867,8 +2207,28 @@ install_as_service() {
         install_systemd "$install_dir"
     fi
 
-    # Show detailed process status (like PS does)
-    show_process_status "$PORT"
+    print_phase "Status"
+    print_status "Startup" "waiting for process and https endpoint..." "$YELLOW"
+    if ! wait_tlbx_ready "$PORT" "$BIND_ADDRESS" true; then
+        if service_is_running; then
+            print_status "Service" "running" "$GREEN"
+        else
+            print_status "Service" "not running" "$RED"
+        fi
+        if [ -n "$READY_PID" ]; then
+            print_status "tlbx process" "running (PID $READY_PID)" "$GREEN"
+        else
+            print_status "tlbx process" "not running" "$RED"
+        fi
+        print_status "HTTPS" "could not connect to $READY_URL" "$RED"
+        echo -e "  ${RED}tlbx was installed but did not pass process and health verification.${NC}"
+        echo -e "  ${GRAY}See $LOG_FILE for details.${NC}"
+        exit 1
+    fi
+    print_status "Service" "running" "$GREEN"
+    print_status "tlbx process" "running (PID $READY_PID)" "$GREEN"
+    print_status "HTTPS" "reachable and healthy" "$GREEN"
+    [ -z "$READY_VERSION" ] || print_status "Version" "$READY_VERSION"
 
     # Create uninstall script
     create_uninstall_script "$lib_dir" true
@@ -1878,19 +2238,19 @@ install_as_service() {
         chown "$INSTALLING_USER" "$LOG_FILE" 2>/dev/null || true
     fi
 
+    commit_install_transaction
+
     log "=========================================="
     log "INSTALLATION COMPLETE"
     log "  Location: $install_dir/mt"
-    log "  URL: https://localhost:$PORT"
     log "  Settings: $settings_dir"
     log "=========================================="
 
     echo ""
     echo -e "  ${CYAN}════════════════════════════════════════${NC}"
-    echo -e "  ${GREEN}Installation complete${NC}"
-    echo ""
     print_status "Location" "$install_dir/mt"
-    print_status "URL" "https://localhost:$PORT" "$CYAN"
+    echo ""
+    print_ready_urls "$PORT" "$BIND_ADDRESS"
     if [ "$TRUST_CERT" != "yes" ]; then
         echo -e "  ${GRAY}Note: browser may show cert warning${NC}"
     fi
@@ -1915,8 +2275,8 @@ install_launchd() {
     # Create log directory and ensure log files are owned by the service user.
     # The self-update script runs as the service user and needs write access to these files.
     mkdir -p "$log_dir"
-    touch "$log_dir/MidTerm.log" "$log_dir/update.log"
-    chown "$INSTALLING_USER" "$log_dir/MidTerm.log" "$log_dir/update.log" 2>/dev/null || \
+    touch "$log_dir/$SERVICE_LOG_NAME" "$log_dir/update.log"
+    chown "$INSTALLING_USER" "$log_dir/$SERVICE_LOG_NAME" "$log_dir/update.log" 2>/dev/null || \
         log "Failed to set ownership on log files for user $INSTALLING_USER" "WARN"
 
     # Write launcher script — update-aware wrapper for launchd.
@@ -1925,13 +2285,13 @@ install_launchd() {
     # This eliminates race conditions: mt is never running when its binary is overwritten.
 cat > "$launcher_path" << 'LAUNCHER_EOF'
 #!/bin/bash
-# MidTerm Launcher - update-aware wrapper for launchd
+# tlbx Launcher - update-aware wrapper for launchd
 # launchd calls this instead of mt directly. On each respawn,
 # this script applies any staged update before exec'ing mt.
 
 set -euo pipefail
 
-CONFIG_DIR="/usr/local/etc/midterm"
+CONFIG_DIR="__TLBX_CONFIG_DIR__"
 INSTALL_DIR="/usr/local/bin"
 CONFIG_AGENTHOST="$CONFIG_DIR/mtagenthost"
 STAGING="$CONFIG_DIR/update-staging"
@@ -2066,6 +2426,8 @@ fi
 # Replace this process with mt (launchd tracks the PID)
 exec "$INSTALL_DIR/mt" "$@"
 LAUNCHER_EOF
+    sed "s|__TLBX_CONFIG_DIR__|$config_dir|g" "$launcher_path" > "$launcher_path.tmp"
+    mv "$launcher_path.tmp" "$launcher_path"
     chmod +x "$launcher_path"
     chown "$INSTALLING_USER" "$launcher_path" 2>/dev/null || true
     log "Launcher script written to $launcher_path"
@@ -2105,6 +2467,11 @@ LAUNCHER_EOF
     <key>ProgramArguments</key>
     <array>
         <string>${launcher_path}</string>
+        <string>--service-mode</string>
+        <string>--settings-dir</string>
+        <string>${config_dir}</string>
+        <string>--launchd-label</string>
+        <string>${LAUNCHD_LABEL}</string>
         <string>--port</string>
         <string>${PORT}</string>
         <string>--bind</string>
@@ -2119,9 +2486,9 @@ LAUNCHER_EOF
     <key>UserName</key>
     <string>${INSTALLING_USER}</string>
     <key>StandardOutPath</key>
-    <string>${log_dir}/MidTerm.log</string>
+    <string>${log_dir}/${SERVICE_LOG_NAME}</string>
     <key>StandardErrorPath</key>
-    <string>${log_dir}/MidTerm.log</string>
+    <string>${log_dir}/${SERVICE_LOG_NAME}</string>
     <key>EnvironmentVariables</key>
     <dict>
         <key>PATH</key>
@@ -2160,7 +2527,7 @@ EOF
         bootstrap_ok=false
         log "Service NOT found in launchd after all registration attempts" "ERROR"
         finish_step_inline "failed" "$RED"
-        echo -e "  ${GRAY}Check logs at: /usr/local/var/log/MidTerm.log${NC}"
+        echo -e "  ${GRAY}Check logs at: /usr/local/var/log/$SERVICE_LOG_NAME${NC}"
         return 1
     fi
 
@@ -2218,7 +2585,7 @@ EOF
                 log "Service registered but may still be starting" "WARN"
                 finish_step_inline "starting..." "$YELLOW"
             fi
-            echo -e "  ${GRAY}Check logs: tail -f /usr/local/var/log/MidTerm.log${NC}"
+            echo -e "  ${GRAY}Check logs: tail -f /usr/local/var/log/$SERVICE_LOG_NAME${NC}"
         fi
     fi
 
@@ -2247,20 +2614,21 @@ EOF
         log "  plist exists: NO" "ERROR"
     fi
 
-    log "Checking MidTerm.log for errors..."
-    if [ -f "/usr/local/var/log/MidTerm.log" ]; then
-        log "Last 10 lines of MidTerm.log:"
-        tail -10 "/usr/local/var/log/MidTerm.log" 2>/dev/null | while read -r line; do
+    log "Checking $SERVICE_LOG_NAME for errors..."
+    if [ -f "/usr/local/var/log/$SERVICE_LOG_NAME" ]; then
+        log "Last 10 lines of $SERVICE_LOG_NAME:"
+        tail -10 "/usr/local/var/log/$SERVICE_LOG_NAME" 2>/dev/null | while read -r line; do
             log "  $line"
         done
     else
-        log "  MidTerm.log does not exist yet"
+        log "  $SERVICE_LOG_NAME does not exist yet"
     fi
 
     log "=== PHASE 5 complete ==="
+    return 1
 }
 
-stop_conflicting_midterm_processes() {
+stop_conflicting_tlbx_processes() {
     local install_dir="$1"
     local process_pattern="^${install_dir}/mt( |$)"
     local agenthost_pattern="^${install_dir}/mtagenthost( |$)"
@@ -2273,7 +2641,7 @@ stop_conflicting_midterm_processes() {
         return 0
     fi
 
-    log "Stopping conflicting MidTerm processes: $(echo "$pids" | tr '\n' ' ')"
+    log "Stopping conflicting $DISPLAY_NAME processes: $(echo "$pids" | tr '\n' ' ')"
     kill $pids 2>/dev/null || true
     sleep 1
 
@@ -2281,7 +2649,7 @@ stop_conflicting_midterm_processes() {
         "$(pgrep -f "$process_pattern" 2>/dev/null || true)" \
         "$(pgrep -f "$agenthost_pattern" 2>/dev/null || true)" | awk 'NF' | sort -u)
     if [ -n "$pids" ]; then
-        log "Force killing remaining MidTerm processes: $(echo "$pids" | tr '\n' ' ')" "WARN"
+        log "Force killing remaining $DISPLAY_NAME processes: $(echo "$pids" | tr '\n' ' ')" "WARN"
         kill -9 $pids 2>/dev/null || true
         sleep 1
     fi
@@ -2297,7 +2665,7 @@ install_systemd() {
     # Unload existing service if present
     systemctl stop "$SERVICE_NAME" 2>/dev/null || true
     systemctl disable "$SERVICE_NAME" 2>/dev/null || true
-    stop_conflicting_midterm_processes "$install_dir"
+    stop_conflicting_tlbx_processes "$install_dir"
 
     # Migration: remove old host service from pre-v4
     if [ -f "$old_host_service" ]; then
@@ -2310,14 +2678,14 @@ install_systemd() {
     # Create systemd service
     cat > "$service_path" << EOF
 [Unit]
-Description=MidTerm Terminal Server
+Description=${DISPLAY_NAME} Terminal Server
 After=network.target
 
 [Service]
 Type=simple
 User=${INSTALLING_USER}
 WorkingDirectory=/tmp
-ExecStart=${install_dir}/mt --port ${PORT} --bind ${BIND_ADDRESS}
+ExecStart=${install_dir}/mt --service-mode --settings-dir ${UNIX_SERVICE_SETTINGS_DIR} --systemd-service ${SERVICE_NAME} --port ${PORT} --bind ${BIND_ADDRESS}
 Restart=always
 RestartSec=5
 Environment=PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
@@ -2344,6 +2712,7 @@ EOF
     else
         finish_step_inline "failed" "$RED"
         echo -e "  ${GRAY}Check logs with: journalctl -u $SERVICE_NAME -f${NC}"
+        return 1
     fi
 }
 
@@ -2436,7 +2805,7 @@ install_as_user() {
     # Store password in secure secrets storage. Like service mode, this is fatal
     # for a new/replacement password if the secret cannot be persisted.
     if [ "$should_write_password" = true ] && [ -n "$PASSWORD_HASH" ] && [[ "$PASSWORD_HASH" == '$PBKDF2$'* ]]; then
-        if echo "$PASSWORD_HASH" | "$install_dir/mt" --write-secret password_hash 2>/dev/null; then
+        if echo "$PASSWORD_HASH" | "$install_dir/mt" --write-secret password_hash --user-mode --settings-dir "$settings_dir" 2>/dev/null; then
             log "Password stored in secure secrets storage"
             print_step "Storing password..." "done"
         else
@@ -2449,7 +2818,7 @@ install_as_user() {
 
     log "=== PHASE 3: Certificate configuration ==="
     # Check existing certificate before generating
-    local existing_cert="$settings_dir/midterm.pem"
+    local existing_cert="$settings_dir/$CERTIFICATE_FILE_NAME"
     if check_existing_certificate "$existing_cert"; then
         log "Existing certificate is valid, reusing"
         CERT_PATH="$existing_cert"
@@ -2477,25 +2846,42 @@ install_as_user() {
     fi
 
     # Create uninstall script
-    local lib_dir="$HOME/.local/lib/MidTerm"
+    local lib_dir="$USER_LIB_DIR"
     mkdir -p "$lib_dir"
 
     create_uninstall_script "$lib_dir" false
 
+    print_phase "Status"
+    print_status "Startup" "starting tlbx and waiting for https endpoint..." "$YELLOW"
+    start_user_tlbx "$install_dir" "$settings_dir" "$PORT" "$BIND_ADDRESS"
+    if ! wait_tlbx_ready "$PORT" "$BIND_ADDRESS" false "$STARTED_USER_PID"; then
+        if kill -0 "$STARTED_USER_PID" 2>/dev/null; then
+            print_status "tlbx process" "running (PID $STARTED_USER_PID)" "$GREEN"
+        else
+            print_status "tlbx process" "not running" "$RED"
+        fi
+        print_status "HTTPS" "could not connect to $READY_URL" "$RED"
+        echo -e "  ${RED}tlbx was installed but the user process did not become reachable.${NC}"
+        echo -e "  ${GRAY}See $settings_dir/tlbx-user.stderr.log for details.${NC}"
+        exit 1
+    fi
+    print_status "tlbx process" "running (PID $READY_PID)" "$GREEN"
+    print_status "HTTPS" "reachable and healthy" "$GREEN"
+    [ -z "$READY_VERSION" ] || print_status "Version" "$READY_VERSION"
+
+    commit_install_transaction
+
     log "=========================================="
     log "INSTALLATION COMPLETE"
     log "  Location: $install_dir/mt"
-    log "  URL: https://localhost:$PORT"
     log "  Settings: $settings_dir"
     log "=========================================="
 
     echo ""
     echo -e "  ${CYAN}════════════════════════════════════════${NC}"
-    echo -e "  ${GREEN}Installation complete${NC}"
-    echo ""
     print_status "Location" "$install_dir/mt"
-    print_status "URL" "https://localhost:$PORT" "$CYAN"
-    echo -e "  ${YELLOW}Run 'mt' to start MidTerm${NC}"
+    echo ""
+    print_ready_urls "$PORT" "$BIND_ADDRESS"
     echo -e "  ${CYAN}════════════════════════════════════════${NC}"
     echo ""
 }
@@ -2506,7 +2892,7 @@ create_uninstall_script() {
 
     cat > "$uninstall_script" << 'EOF'
 #!/bin/bash
-# MidTerm Uninstaller
+# tlbx Uninstaller
 
 set -e
 
@@ -2517,7 +2903,7 @@ if command -v curl >/dev/null 2>&1; then
 elif command -v wget >/dev/null 2>&1; then
     wget -qO- "$SCRIPT_URL" | bash
 else
-    echo "Error: MidTerm uninstaller requires 'curl' or 'wget'." >&2
+    echo "Error: tlbx uninstaller requires 'curl' or 'wget'." >&2
     exit 1
 fi
 EOF
@@ -2540,7 +2926,7 @@ detect_existing_install() {
 
     # Service install
     if [ -f "$UNIX_SERVICE_BIN_DIR/mt" ] || [ -f "$UNIX_SERVICE_BIN_DIR/mthost" ] || [ -f "$UNIX_SERVICE_BIN_DIR/mtagenthost" ] || \
-        [ -d "$UNIX_SERVICE_SETTINGS_DIR" ] || [ -d "/usr/local/lib/MidTerm" ] || \
+        [ -d "$UNIX_SERVICE_SETTINGS_DIR" ] || [ -d "$SERVICE_LIB_DIR" ] || \
         [ -f "/etc/systemd/system/${SERVICE_NAME}.service" ] || [ -f "/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist" ]; then
         EXISTING_SERVICE_PRESENT=true
     fi
@@ -2550,7 +2936,7 @@ detect_existing_install() {
     if check_existing_password_file "service" 2>/dev/null; then
         EXISTING_SERVICE_PASSWORD=true
     fi
-    local svc_cert="$UNIX_SERVICE_SETTINGS_DIR/midterm.pem"
+    local svc_cert="$UNIX_SERVICE_SETTINGS_DIR/$CERTIFICATE_FILE_NAME"
     if [ -f "$svc_cert" ]; then
         EXISTING_SERVICE_CERT=true
         if command_exists openssl; then
@@ -2572,7 +2958,7 @@ detect_existing_install() {
 
     # User install
     if [ -f "$HOME/.local/bin/mt" ] || [ -f "$HOME/.local/bin/mthost" ] || [ -f "$HOME/.local/bin/mtagenthost" ] || \
-        [ -d "$HOME/.local/lib/MidTerm" ] || [ -d "$UNIX_USER_SETTINGS_DIR" ]; then
+        [ -d "$USER_LIB_DIR" ] || [ -d "$UNIX_USER_SETTINGS_DIR" ]; then
         EXISTING_USER_PRESENT=true
     fi
     if [ -f "$HOME/.local/bin/mt" ]; then
@@ -2581,7 +2967,7 @@ detect_existing_install() {
     if check_existing_password_file "user" 2>/dev/null; then
         EXISTING_USER_PASSWORD=true
     fi
-    local usr_cert="$UNIX_USER_SETTINGS_DIR/midterm.pem"
+    local usr_cert="$UNIX_USER_SETTINGS_DIR/$CERTIFICATE_FILE_NAME"
     if [ -f "$usr_cert" ]; then
         EXISTING_USER_CERT=true
         if command_exists openssl; then
@@ -2678,7 +3064,7 @@ enforce_cross_mode_policy() {
         echo ""
         echo -e "  ${RED}Cannot install as a system service while a user install still exists.${NC}"
         echo -e "  ${GRAY}Uninstall the user-mode copy first, then rerun the installer.${NC}"
-        echo -e "  ${GRAY}User traces: ~/.local/bin/mt or ~/.midterm${NC}"
+        echo -e "  ${GRAY}User traces: ~/.local/bin/mt, ~/.tlbx, or legacy ~/.midterm${NC}"
         exit 1
     fi
 
@@ -2686,7 +3072,7 @@ enforce_cross_mode_policy() {
         echo ""
         echo -e "  ${RED}Cannot install in user mode while a system service install still exists.${NC}"
         echo -e "  ${GRAY}Uninstall the service-mode copy first, then rerun the installer.${NC}"
-        echo -e "  ${GRAY}Service traces: /usr/local/bin/mt or /usr/local/etc/midterm${NC}"
+        echo -e "  ${GRAY}Service traces: /usr/local/bin/mt, /usr/local/etc/tlbx, or legacy /usr/local/etc/midterm${NC}"
         exit 1
     fi
 }
@@ -2727,6 +3113,8 @@ done
 if [[ " $* " == *" --service "* ]] || [ "$1" = "--service" ]; then
     SERVICE_MODE=true
     ensure_prerequisites
+    load_installer_handoff "$INSTALLER_HANDOFF_FILE"
+    select_install_identity
     # Start logging to update.log (service mode)
     if [ -z "$LOGGING_STARTED" ]; then
         setup_logging "service"
@@ -2766,6 +3154,7 @@ fi
 
 detect_platform
 get_latest_release
+select_install_identity
 detect_existing_install
 prompt_service_mode
 enforce_cross_mode_policy
diff --git a/scripts/copy-windows-conpty-runtime.ps1 b/scripts/copy-windows-conpty-runtime.ps1
new file mode 100644
index 000000000..adca297fa
--- /dev/null
+++ b/scripts/copy-windows-conpty-runtime.ps1
@@ -0,0 +1,24 @@
+param(
+    [Parameter(Mandatory = $true)][string]$SourceDir,
+    [Parameter(Mandatory = $true)][string]$DestinationDir,
+    [Parameter(Mandatory = $true)][ValidateSet("win-x64", "win-x86")][string]$Rid
+)
+
+$ErrorActionPreference = "Stop"
+
+$requiredFiles = @("conpty.dll", "x64\OpenConsole.exe", "arm64\OpenConsole.exe")
+if ($Rid -eq "win-x86") {
+    $requiredFiles += "x86\OpenConsole.exe"
+}
+
+foreach ($relativePath in $requiredFiles) {
+    $source = Join-Path $SourceDir $relativePath
+    if (-not (Test-Path -LiteralPath $source -PathType Leaf)) {
+        throw "ConPTY runtime file missing from $Rid publish output: $source"
+    }
+
+    $destination = Join-Path $DestinationDir $relativePath
+    $destinationDirectory = Split-Path -Parent $destination
+    New-Item -ItemType Directory -Path $destinationDirectory -Force | Out-Null
+    Copy-Item -LiteralPath $source -Destination $destination -Force
+}
diff --git a/scripts/dev.ps1 b/scripts/dev.ps1
index 140f76bf2..3809f3b42 100644
--- a/scripts/dev.ps1
+++ b/scripts/dev.ps1
@@ -198,6 +198,14 @@ function Invoke-FrontendBuild {
     }
 }
 
+function Invoke-StaticAssetSync {
+    Write-Host "  Syncing transformed static assets..." -ForegroundColor Cyan
+    & pwsh -NoProfile -ExecutionPolicy Bypass -File (Join-Path $WebProjectDir "frontend-build.ps1") -StaticOnly
+    if ($LASTEXITCODE -ne 0) {
+        throw "Static asset sync failed"
+    }
+}
+
 function Build-AgentHost {
     Write-Host "  Building local mtagenthost..." -ForegroundColor DarkGray
     & dotnet build $AgentHostProjectFile -c Debug --nologo
@@ -265,6 +273,35 @@ function New-CodeWatcher {
     return $watcher
 }
 
+function New-StaticWatcher {
+    $watcher = [System.IO.FileSystemWatcher]::new()
+    $watcher.Path = Join-Path $WebProjectDir "src/static"
+    $watcher.Filter = "*.*"
+    $watcher.IncludeSubdirectories = $true
+    $watcher.NotifyFilter = [System.IO.NotifyFilters]'FileName, DirectoryName, LastWrite, CreationTime, Size'
+    $watcher.EnableRaisingEvents = $true
+    return $watcher
+}
+
+function Wait-ForStaticChange {
+    param([System.IO.FileSystemWatcher]$Watcher)
+
+    $change = $Watcher.WaitForChanged([System.IO.WatcherChangeTypes]::All, 1)
+    if ($change.TimedOut) {
+        return $null
+    }
+
+    $latestPath = if ([string]::IsNullOrWhiteSpace($change.Name)) { $change.OldName } else { $change.Name }
+    do {
+        $change = $Watcher.WaitForChanged([System.IO.WatcherChangeTypes]::All, 150)
+        if (-not $change.TimedOut) {
+            $latestPath = if ([string]::IsNullOrWhiteSpace($change.Name)) { $change.OldName } else { $change.Name }
+        }
+    } while (-not $change.TimedOut)
+
+    return $latestPath
+}
+
 function Should-RestartForPath([string]$relativePath) {
     if ([string]::IsNullOrWhiteSpace($relativePath)) {
         return $false
@@ -422,6 +459,11 @@ function Invoke-DevLoopCleanup {
         $script:codeWatcher = $null
     }
 
+    if ($script:staticWatcher) {
+        $script:staticWatcher.Dispose()
+        $script:staticWatcher = $null
+    }
+
     if ($script:esbuildProcess -and -not $script:esbuildProcess.HasExited) {
         Write-Host "Stopping esbuild watch..." -ForegroundColor Yellow
         Stop-ProcessTree -ProcessId $script:esbuildProcess.Id -Reason "script shutdown"
@@ -446,6 +488,7 @@ if ($Tailnet) {
 $stableVersion = Test-StableSupervisor
 $resolvedTtyHostPath = Resolve-TtyHostPath
 $codeWatcher = New-CodeWatcher
+$staticWatcher = New-StaticWatcher
 Stop-StaleSourceServerProcesses
 $serverState = $null
 $esbuildProcess = $null
@@ -462,7 +505,7 @@ Write-Host "  Settings dir   : $SettingsDir" -ForegroundColor DarkGray
 Write-Host "  mthost         : $resolvedTtyHostPath" -ForegroundColor DarkGray
 Write-Host "  mtagenthost    : local Debug build" -ForegroundColor DarkGray
 Write-Host "  TS changes     : esbuild watch rebuilds" -ForegroundColor DarkGray
-Write-Host "  CSS changes    : refresh browser" -ForegroundColor DarkGray
+Write-Host "  Static changes : transformed assets sync automatically; refresh browser" -ForegroundColor DarkGray
 Write-Host "  C# changes     : script rebuilds and restarts local source tlbx" -ForegroundColor DarkGray
 Write-Host ""
 
@@ -487,6 +530,12 @@ try {
         }
 
         $changedPath = Wait-ForCodeChange -Watcher $codeWatcher -TimeoutMilliseconds $PollMilliseconds
+        $staticChangedPath = Wait-ForStaticChange -Watcher $staticWatcher
+        if ($staticChangedPath) {
+            Write-Host "  Static change detected: $staticChangedPath" -ForegroundColor Yellow
+            Invoke-StaticAssetSync
+        }
+
         if ($changedPath) {
             Stop-DevProcess -state $serverState -reason "C# change detected: $changedPath"
             Start-Sleep -Milliseconds 300
diff --git a/scripts/kitty-graphics-test.mjs b/scripts/kitty-graphics-test.mjs
new file mode 100644
index 000000000..85426e228
--- /dev/null
+++ b/scripts/kitty-graphics-test.mjs
@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import process from "node:process";
+import { deflateSync } from "node:zlib";
+
+const ESC = "\x1b";
+const ST = `${ESC}\\`;
+// OpenTUI uses this exact id for its Kitty capability probe. Matching its wire
+// contract makes this script a direct compatibility test for OpenCode/OpenTUI.
+const QUERY_IMAGE_ID = 31337;
+const DISPLAY_IMAGE_ID = QUERY_IMAGE_ID + 1;
+const QUERY_TIMEOUT_MS = 2500;
+
+function crc32(bytes) {
+  let crc = 0xffffffff;
+  for (const byte of bytes) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+    }
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function pngChunk(type, data) {
+  const typeBytes = Buffer.from(type, "ascii");
+  const length = Buffer.allocUnsafe(4);
+  length.writeUInt32BE(data.length);
+  const checksum = Buffer.allocUnsafe(4);
+  checksum.writeUInt32BE(crc32(Buffer.concat([typeBytes, data])));
+  return Buffer.concat([length, typeBytes, data, checksum]);
+}
+
+export function createTestPng(width = 192, height = 128) {
+  const signature = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+  const header = Buffer.allocUnsafe(13);
+  header.writeUInt32BE(width, 0);
+  header.writeUInt32BE(height, 4);
+  header[8] = 8;
+  header[9] = 6;
+  header[10] = 0;
+  header[11] = 0;
+  header[12] = 0;
+
+  const scanlines = Buffer.allocUnsafe((width * 4 + 1) * height);
+  for (let y = 0; y < height; y += 1) {
+    const rowStart = y * (width * 4 + 1);
+    scanlines[rowStart] = 0;
+    for (let x = 0; x < width; x += 1) {
+      const offset = rowStart + 1 + x * 4;
+      const border = x < 5 || y < 5 || x >= width - 5 || y >= height - 5;
+      const divider =
+        Math.abs(x - width / 2) < 3 || Math.abs(y - height / 2) < 3;
+      const blueTile = x < width / 2 === y < height / 2;
+      scanlines[offset] = border || divider ? 240 : blueTile ? 47 : 18;
+      scanlines[offset + 1] = border || divider ? 244 : blueTile ? 145 : 24;
+      scanlines[offset + 2] = border || divider ? 248 : blueTile ? 255 : 36;
+      scanlines[offset + 3] = 255;
+    }
+  }
+
+  return Buffer.concat([
+    signature,
+    pngChunk("IHDR", header),
+    pngChunk("IDAT", deflateSync(scanlines, { level: 9 })),
+    pngChunk("IEND", Buffer.alloc(0)),
+  ]);
+}
+
+export function createKittyCapabilityQuery(imageId = QUERY_IMAGE_ID) {
+  // Query a valid 1x1 RGB payload, then request primary device attributes as
+  // the ordering fence prescribed by the Kitty graphics specification.
+  return `${ESC}_Gi=${imageId},s=1,v=1,a=q,t=d,f=24;AAAA${ST}${ESC}[c`;
+}
+
+export function parseKittyCapabilityResponse(input, imageId = QUERY_IMAGE_ID) {
+  const escapedId = String(imageId).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const response = new RegExp(
+    `${ESC}_G[^;]*i=${escapedId}(?:,[^;]*)?;([^${ESC}]*)${ESC}\\\\`,
+  );
+  const match = response.exec(input);
+  if (match) {
+    return { complete: true, supported: match[1] === "OK", message: match[1] };
+  }
+
+  // A DA1 reply is the protocol-defined fence: if it arrives before a Kitty
+  // response, the terminal has ignored the APC query and does not support TGP.
+  if (/\x1b\[\??[0-9;]*c/.test(input)) {
+    return {
+      complete: true,
+      supported: false,
+      message: "no Kitty response before DA1",
+    };
+  }
+  return { complete: false, supported: false, message: "waiting" };
+}
+
+export function createKittyPngTransmission(png, imageId = DISPLAY_IMAGE_ID) {
+  const encoded = png.toString("base64");
+  const chunks = encoded.match(/.{1,4096}/g) ?? [];
+  return chunks
+    .map((chunk, index) => {
+      const more = index < chunks.length - 1 ? 1 : 0;
+      const control =
+        index === 0
+          ? `a=T,f=100,t=d,i=${imageId},q=1,C=1,c=24,r=10,m=${more}`
+          : `q=1,m=${more}`;
+      return `${ESC}_G${control};${chunk}${ST}`;
+    })
+    .join("");
+}
+
+function runSelfTest() {
+  const png = createTestPng(16, 8);
+  assert.deepEqual([...png.subarray(0, 8)], [137, 80, 78, 71, 13, 10, 26, 10]);
+  assert.equal(png.readUInt32BE(16), 16);
+  assert.equal(png.readUInt32BE(20), 8);
+
+  const query = createKittyCapabilityQuery();
+  assert.match(query, /a=q,t=d,f=24;AAAA/);
+  assert.ok(query.endsWith(`${ESC}[c`));
+
+  assert.deepEqual(parseKittyCapabilityResponse("unrelated"), {
+    complete: false,
+    supported: false,
+    message: "waiting",
+  });
+  assert.deepEqual(
+    parseKittyCapabilityResponse(`${ESC}_Gi=${QUERY_IMAGE_ID};OK${ST}`),
+    { complete: true, supported: true, message: "OK" },
+  );
+  assert.deepEqual(parseKittyCapabilityResponse(`${ESC}[?62;4;22c`), {
+    complete: true,
+    supported: false,
+    message: "no Kitty response before DA1",
+  });
+
+  const transmission = createKittyPngTransmission(png);
+  assert.match(transmission, /a=T,f=100,t=d/);
+  assert.ok(transmission.endsWith(ST));
+  process.stdout.write("Kitty graphics protocol self-test passed.\n");
+}
+
+async function queryTerminal() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error("Run this test interactively inside a tlbx terminal.");
+  }
+
+  const canSetRawMode = typeof process.stdin.setRawMode === "function";
+  const previousRawMode = process.stdin.isRaw;
+  if (canSetRawMode) process.stdin.setRawMode(true);
+  process.stdin.setEncoding("utf8");
+  process.stdin.resume();
+
+  // A shell may leave replies to its own startup probes in the shared PTY
+  // input queue. Drain those before issuing our ordered Kitty + DA1 probe so a
+  // stale device-attributes reply cannot produce a false negative on Windows.
+  await new Promise((resolve) => {
+    const discard = () => {};
+    process.stdin.on("data", discard);
+    setTimeout(() => {
+      process.stdin.off("data", discard);
+      resolve();
+    }, 100);
+  });
+
+  return await new Promise((resolve) => {
+    let received = "";
+    const restore = () => {
+      clearTimeout(timeout);
+      process.stdin.off("data", onData);
+      if (canSetRawMode) process.stdin.setRawMode(Boolean(previousRawMode));
+      process.stdin.pause();
+    };
+    const finish = (result) => {
+      restore();
+      resolve({ ...result, received });
+    };
+    const onData = (chunk) => {
+      received = (received + chunk).slice(-8192);
+      const result = parseKittyCapabilityResponse(received);
+      if (result.complete) finish(result);
+    };
+    const timeout = setTimeout(
+      () =>
+        finish({
+          complete: true,
+          supported: false,
+          message: "query timed out",
+        }),
+      QUERY_TIMEOUT_MS,
+    );
+
+    process.stdin.on("data", onData);
+    process.stdout.write(createKittyCapabilityQuery());
+  });
+}
+
+async function runInteractive() {
+  const result = await queryTerminal();
+  if (!result.supported) {
+    process.stderr.write(`Kitty graphics unsupported: ${result.message}\n`);
+    if (process.argv.includes("--debug")) {
+      process.stderr.write(
+        `Response bytes: ${Buffer.from(result.received).toString("hex")}\n`,
+      );
+    }
+    process.exitCode = 2;
+    return;
+  }
+
+  const png = createTestPng();
+  process.stdout.write(`${ESC}[2J${ESC}[H`);
+  process.stdout.write(
+    "tlbx Kitty graphics: capability query returned OK\r\n\r\n",
+  );
+  process.stdout.write(createKittyPngTransmission(png));
+  process.stdout.write(`${ESC}[11B\r\n`);
+  process.stdout.write(
+    "PASS: the blue/black four-tile image above was rendered through Kitty TGP.\r\n",
+  );
+}
+
+if (process.argv.includes("--self-test")) {
+  runSelfTest();
+} else {
+  await runInteractive();
+}
diff --git a/scripts/perf/desktop-command-bay-snapshot.js b/scripts/perf/desktop-command-bay-snapshot.js
new file mode 100644
index 000000000..8840d1d6d
--- /dev/null
+++ b/scripts/perf/desktop-command-bay-snapshot.js
@@ -0,0 +1,63 @@
+const waitFor = async (predicate, timeoutMs = 10000, label = 'desktop Command Bay') => {
+  const deadline = performance.now() + timeoutMs;
+  while (performance.now() < deadline) {
+    const value = predicate();
+    if (value) return value;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  throw new Error(`Timed out waiting for ${label}.`);
+};
+
+const sessionItem = await waitFor(
+  () => document.querySelector('.session-item[data-session-id]'),
+  10000,
+  'a session item',
+);
+sessionItem.click();
+const dock = await waitFor(() => {
+  const candidate = document.querySelector('.adaptive-footer-dock[data-device="desktop"]');
+  return candidate && !candidate.hidden ? candidate : null;
+});
+await new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+const selectors = [
+  '.adaptive-footer-dock',
+  '.adaptive-footer-primary',
+  '.smart-input-row',
+  '.smart-input-textarea',
+  '.smart-input-send-btn',
+  '.smart-input-tools-toggle',
+];
+
+const snapshot = Object.fromEntries(
+  selectors.map((selector) => {
+    const element = document.querySelector(selector);
+    const rect = element.getBoundingClientRect();
+    const style = getComputedStyle(element);
+    return [
+      selector,
+      {
+        width: rect.width,
+        height: rect.height,
+        display: style.display,
+        position: style.position,
+        padding: style.padding,
+        margin: style.margin,
+        gap: style.gap,
+        border: style.border,
+        borderRadius: style.borderRadius,
+        fontFamily: style.fontFamily,
+        fontSize: style.fontSize,
+        lineHeight: style.lineHeight,
+      },
+    ];
+  }),
+);
+
+return {
+  viewport: { width: innerWidth, height: innerHeight },
+  device: dock.dataset.device,
+  controlHeight: getComputedStyle(dock).getPropertyValue('--command-bay-control-height').trim(),
+  gap: getComputedStyle(dock).getPropertyValue('--command-bay-gap').trim(),
+  snapshot,
+};
diff --git a/scripts/perf/midterm-foreground-terminal-recovery.js b/scripts/perf/midterm-foreground-terminal-recovery.js
index 5c300666a..48a46c599 100644
--- a/scripts/perf/midterm-foreground-terminal-recovery.js
+++ b/scripts/perf/midterm-foreground-terminal-recovery.js
@@ -13,6 +13,16 @@ perf.scenario = {
   claimedReferenceBrowser: false,
   isMainBrowserBeforeFreeze: null,
   xtermsAfterOpen: 0,
+  hiddenAtMs: null,
+  visibleAtMs: null,
+  reconnectedAtMs: null,
+  inputReadyAtMs: null,
+  resumeConnectedMs: null,
+  resumeInputReadyMs: null,
+  connectionTransitions: [],
+  terminalElementPreserved: null,
+  terminalContainerPreserved: null,
+  xtermsAfterResume: null,
 };
 
 function sleep(ms) {
@@ -82,6 +92,70 @@ state.terminal.refresh = (...args) => {
   return originalRefresh(...args);
 };
 
+const terminalElementBeforeFreeze = state.container.querySelector(".xterm");
+const inputBeforeFreeze = state.container.querySelector(
+  "textarea.xterm-helper-textarea",
+);
+let sawReconnectTransition = false;
+
+function recordConnectionState() {
+  const badge = document.getElementById("connection-status");
+  const status = badge?.className ?? "missing";
+  perf.scenario.connectionTransitions.push({
+    atMs: performance.now(),
+    status,
+  });
+
+  if (!perf.scenario.visibleAtMs) return;
+  if (!badge?.classList.contains("connected")) {
+    sawReconnectTransition = true;
+    return;
+  }
+  if (!sawReconnectTransition || perf.scenario.reconnectedAtMs) return;
+
+  perf.scenario.reconnectedAtMs = performance.now();
+  perf.scenario.resumeConnectedMs =
+    perf.scenario.reconnectedAtMs - perf.scenario.visibleAtMs;
+
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      const currentState = window.mmDebug?.terminals?.get(created.id);
+      const inputAfterResume = currentState?.container?.querySelector(
+        "textarea.xterm-helper-textarea",
+      );
+      perf.scenario.inputReadyAtMs = performance.now();
+      perf.scenario.resumeInputReadyMs =
+        perf.scenario.inputReadyAtMs - perf.scenario.visibleAtMs;
+      perf.scenario.terminalElementPreserved =
+        currentState?.container?.querySelector(".xterm") ===
+        terminalElementBeforeFreeze;
+      perf.scenario.terminalContainerPreserved =
+        currentState?.container === state.container;
+      perf.scenario.inputElementPreserved =
+        inputAfterResume === inputBeforeFreeze;
+      perf.scenario.xtermsAfterResume =
+        document.querySelectorAll(".xterm").length;
+    });
+  });
+}
+
+const connectionBadge = document.getElementById("connection-status");
+if (connectionBadge) {
+  new MutationObserver(recordConnectionState).observe(connectionBadge, {
+    attributes: true,
+    attributeFilter: ["class"],
+  });
+  recordConnectionState();
+}
+
+document.addEventListener("visibilitychange", () => {
+  if (document.visibilityState === "hidden") {
+    perf.scenario.hiddenAtMs = performance.now();
+    return;
+  }
+  perf.scenario.visibleAtMs = performance.now();
+});
+
 perf.scenario.refreshCallsBeforeFreeze = perf.scenario.refreshCallsAfterResume;
 perf.scenario.isMainBrowserBeforeFreeze =
   document.body.innerText.includes("Make this the reference scale browser") ===
diff --git a/scripts/perf/mobile-command-bay-smoke.js b/scripts/perf/mobile-command-bay-smoke.js
new file mode 100644
index 000000000..60a81da48
--- /dev/null
+++ b/scripts/perf/mobile-command-bay-smoke.js
@@ -0,0 +1,122 @@
+const waitFor = async (predicate, timeoutMs = 10000, label = 'mobile Command Bay') => {
+  const deadline = performance.now() + timeoutMs;
+  while (performance.now() < deadline) {
+    const value = predicate();
+    if (value) return value;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  throw new Error(`Timed out waiting for ${label}.`);
+};
+
+const settle = () =>
+  new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+
+Object.defineProperty(navigator, 'maxTouchPoints', { configurable: true, value: 1 });
+if (!('ontouchstart' in window)) {
+  Object.defineProperty(window, 'ontouchstart', { configurable: true, value: null });
+}
+const nativeMatchMedia = window.matchMedia.bind(window);
+window.matchMedia = (query) => {
+  if (query.includes('pointer: fine') || query.includes('hover: hover')) {
+    return {
+      matches: false,
+      media: query,
+      onchange: null,
+      addEventListener() {},
+      removeEventListener() {},
+      addListener() {},
+      removeListener() {},
+      dispatchEvent() {
+        return true;
+      },
+    };
+  }
+  return nativeMatchMedia(query);
+};
+window.dispatchEvent(new Event('resize'));
+
+const sessionItem = await waitFor(
+  () => document.querySelector('.session-item[data-session-id]'),
+  10000,
+  'a session item',
+);
+sessionItem.click();
+
+const dock = await waitFor(() => {
+  const candidate = document.querySelector('.adaptive-footer-dock[data-device="mobile"]');
+  return candidate && !candidate.hidden ? candidate : null;
+}, 10000, 'the mobile footer');
+const toolsToggle = await waitFor(
+  () => document.querySelector('.smart-input-tools-toggle'),
+  10000,
+  'the tools toggle',
+);
+await settle();
+
+const readRect = (selector) => {
+  const element = document.querySelector(selector);
+  if (!element) return null;
+  const rect = element.getBoundingClientRect();
+  return {
+    top: rect.top,
+    right: rect.right,
+    bottom: rect.bottom,
+    left: rect.left,
+    width: rect.width,
+    height: rect.height,
+  };
+};
+
+const snapshot = () => ({
+  dock: readRect('.adaptive-footer-dock'),
+  primary: readRect('.adaptive-footer-primary'),
+  reserve: readRect('.adaptive-footer-reserve'),
+  xterm: readRect('.session-wrapper.active .xterm, .session-wrapper:not(.hidden) .xterm'),
+  reservedHeight: getComputedStyle(document.documentElement)
+    .getPropertyValue('--adaptive-footer-reserved-height')
+    .trim(),
+  statusHidden: document.querySelector('.adaptive-footer-status')?.hidden ?? null,
+  toolLabels: [...document.querySelectorAll('.smart-input-tools-surface .smart-input-tool-label')]
+    .map((element) => element.textContent?.trim())
+    .filter(Boolean),
+  toolsOpen: toolsToggle.getAttribute('aria-expanded'),
+});
+
+const before = snapshot();
+toolsToggle.click();
+await settle();
+const toolsOpen = snapshot();
+
+const keysToggle = await waitFor(() =>
+  document.querySelector('.smart-input-mobile-touch-toggle'),
+  10000,
+  'the mobile touch keys toggle',
+);
+keysToggle.click();
+await settle();
+const keysOpen = snapshot();
+
+const stableGeometry = (left, right) =>
+  left.reservedHeight === right.reservedHeight &&
+  left.dock?.height === right.dock?.height &&
+  left.primary?.height === right.primary?.height &&
+  left.xterm?.height === right.xterm?.height;
+
+return {
+  viewport: { width: innerWidth, height: innerHeight },
+  before,
+  toolsOpen,
+  keysOpen,
+  stableWhenToolsOpen: stableGeometry(before, toolsOpen),
+  stableWhenKeysOpen: stableGeometry(before, keysOpen),
+  requiredToolsPresent: [
+    'Push to talk',
+    'Attach file',
+    'Take photo',
+    'Show keys',
+    'More automations',
+    'Add automation',
+  ].every((label) => toolsOpen.toolLabels.includes(label)),
+  touchControllerVisible:
+    document.querySelector('.smart-input-mobile-touch-host .touch-controller.visible') !== null,
+};
diff --git a/scripts/perf/tlbx-mobile-terminal-input-stability.js b/scripts/perf/tlbx-mobile-terminal-input-stability.js
new file mode 100644
index 000000000..0aaf3cf0b
--- /dev/null
+++ b/scripts/perf/tlbx-mobile-terminal-input-stability.js
@@ -0,0 +1,128 @@
+const perf = window.__codexChromePerf;
+if (!perf) {
+  throw new Error("Chrome perf observer was not initialized.");
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitFor(predicate, label, timeoutMs = 15000) {
+  const deadline = performance.now() + timeoutMs;
+  do {
+    const value = predicate();
+    if (value) return value;
+    await sleep(100);
+  } while (performance.now() < deadline);
+  throw new Error(`Timed out waiting for ${label}`);
+}
+
+await waitFor(() => document.readyState === "complete", "document ready");
+
+let createdSessionId = null;
+if (document.querySelectorAll(".terminal-container").length === 0) {
+  const response = await fetch("/api/sessions", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ cols: 96, rows: 28, shell: "Pwsh" }),
+  });
+  if (!response.ok) {
+    throw new Error(`Session create failed: ${response.status}`);
+  }
+  const createdSession = await response.json();
+  createdSessionId = createdSession.id;
+}
+
+const terminalContainer = await waitFor(
+  () => document.querySelector(".terminal-container:not(.hidden)"),
+  "visible terminal",
+);
+const terminalTextarea = await waitFor(
+  () => terminalContainer.querySelector("textarea.xterm-helper-textarea"),
+  "xterm input textarea",
+);
+await sleep(1500);
+
+const terminalPage = document.querySelector(".terminal-page");
+const initialContainerRect = terminalContainer.getBoundingClientRect();
+const initialPageRect = terminalPage?.getBoundingClientRect() ?? null;
+const initialViewportHeight = getComputedStyle(document.documentElement)
+  .getPropertyValue("--midterm-visual-viewport-height")
+  .trim();
+let terminalResizeCommands = 0;
+let containerResizeCallbacks = 0;
+let pageResizeCallbacks = 0;
+
+const originalWebSocketSend = WebSocket.prototype.send;
+WebSocket.prototype.send = function captureTerminalResize(data) {
+  if (typeof data === "string" && data.includes('"terminal.resize"')) {
+    terminalResizeCommands += 1;
+  }
+  return originalWebSocketSend.call(this, data);
+};
+
+const containerObserver = new ResizeObserver(() => {
+  containerResizeCallbacks += 1;
+});
+containerObserver.observe(terminalContainer);
+const pageObserver = terminalPage
+  ? new ResizeObserver(() => {
+      pageResizeCallbacks += 1;
+    })
+  : null;
+pageObserver?.observe(terminalPage);
+
+try {
+  terminalTextarea.focus({ preventScroll: true });
+  for (const character of "mobile-input-stability") {
+    terminalTextarea.value = character;
+    terminalTextarea.dispatchEvent(
+      new InputEvent("input", {
+        bubbles: true,
+        data: character,
+        inputType: "insertText",
+      }),
+    );
+    await sleep(25);
+  }
+  await sleep(500);
+} finally {
+  WebSocket.prototype.send = originalWebSocketSend;
+  containerObserver.disconnect();
+  pageObserver?.disconnect();
+}
+
+const finalContainerRect = terminalContainer.getBoundingClientRect();
+const finalPageRect = terminalPage?.getBoundingClientRect() ?? null;
+const finalViewportHeight = getComputedStyle(document.documentElement)
+  .getPropertyValue("--midterm-visual-viewport-height")
+  .trim();
+
+perf.scenario = {
+  name: "tlbx-mobile-terminal-input-stability",
+  characters: "mobile-input-stability".length,
+  terminalResizeCommands,
+  containerResizeCallbacks,
+  pageResizeCallbacks,
+  containerRectChanged:
+    initialContainerRect.width !== finalContainerRect.width ||
+    initialContainerRect.height !== finalContainerRect.height,
+  pageRectChanged:
+    initialPageRect && finalPageRect
+      ? initialPageRect.width !== finalPageRect.width || initialPageRect.height !== finalPageRect.height
+      : null,
+  visualViewportHeightChanged: initialViewportHeight !== finalViewportHeight,
+};
+
+if (
+  perf.scenario.terminalResizeCommands !== 0 ||
+  perf.scenario.containerRectChanged ||
+  perf.scenario.pageRectChanged ||
+  perf.scenario.visualViewportHeightChanged
+) {
+  throw new Error(`Mobile terminal input changed layout: ${JSON.stringify(perf.scenario)}`);
+}
+
+if (createdSessionId) {
+  await fetch(`/api/sessions/${encodeURIComponent(createdSessionId)}`, { method: "DELETE" });
+}
diff --git a/scripts/publish-runtime-set.ps1 b/scripts/publish-runtime-set.ps1
index 80d4dac1b..328dca9c2 100644
--- a/scripts/publish-runtime-set.ps1
+++ b/scripts/publish-runtime-set.ps1
@@ -119,6 +119,20 @@ try {
         $failedNames = ($failed | ForEach-Object { $_.Name }) -join ", "
         throw "Parallel dotnet publish failed for: $failedNames"
     }
+
+    if ($Rid -in @("win-x64", "win-x86")) {
+        $mthostPublishDir = Join-Path $RepoRoot "src/Ai.Tlbx.MidTerm.TtyHost/bin/$Configuration/net10.0/$Rid/publish"
+        $requiredConptyFiles = @("conpty.dll", "x64/OpenConsole.exe", "arm64/OpenConsole.exe")
+        if ($Rid -eq "win-x86") {
+            $requiredConptyFiles += "x86/OpenConsole.exe"
+        }
+        foreach ($relativePath in $requiredConptyFiles) {
+            $path = Join-Path $mthostPublishDir $relativePath
+            if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
+                throw "Published $Rid mthost runtime is missing $relativePath"
+            }
+        }
+    }
 }
 finally {
     Pop-Location
diff --git a/scripts/release-local.ps1 b/scripts/release-local.ps1
index e66a41522..5a95bc36f 100644
--- a/scripts/release-local.ps1
+++ b/scripts/release-local.ps1
@@ -259,9 +259,12 @@ if (-not (Test-Path $mttmuxExe)) { throw "mttmux publish failed - output not fou
 Write-Host "Copying to $OutputDir..." -ForegroundColor Gray
 New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
 Copy-Item "$repoRoot/src/Ai.Tlbx.MidTerm/bin/Release/net10.0/$RID/publish/mt.exe" $OutputDir -Force
-Copy-Item "$repoRoot/src/Ai.Tlbx.MidTerm.TtyHost/bin/Release/net10.0/$RID/publish/mthost.exe" $OutputDir -Force
+$mthostPublishDir = "$repoRoot/src/Ai.Tlbx.MidTerm.TtyHost/bin/Release/net10.0/$RID/publish"
+Copy-Item "$mthostPublishDir/mthost.exe" $OutputDir -Force
+& "$PSScriptRoot/copy-windows-conpty-runtime.ps1" -SourceDir $mthostPublishDir -DestinationDir $OutputDir -Rid $RID
 Copy-Item "$repoRoot/src/Ai.Tlbx.MidTerm.AgentHost/bin/Release/net10.0/$RID/publish/mtagenthost.exe" $OutputDir -Force
 Copy-Item "$repoRoot/src/Ai.Tlbx.MidTerm.TmuxShim/bin/Release/net10.0/$RID/publish/mttmux.exe" $OutputDir -Force
+Copy-Item "$repoRoot/src/Ai.Tlbx.MidTerm/src/static/THIRD-PARTY-LICENSES.txt" $OutputDir -Force
 
 # Write version.json to output (for update detection)
 @{
diff --git a/scripts/verify-installers.ps1 b/scripts/verify-installers.ps1
new file mode 100644
index 000000000..852f321e0
--- /dev/null
+++ b/scripts/verify-installers.ps1
@@ -0,0 +1,362 @@
+[CmdletBinding()]
+param(
+    [switch]$LiveRelease
+)
+
+$ErrorActionPreference = "Stop"
+$repoRoot = Split-Path -Parent $PSScriptRoot
+
+function Assert-Contains {
+    param([string]$Content, [string]$Pattern, [string]$Message)
+    if ($Content -notmatch $Pattern) { throw $Message }
+}
+
+function Assert-NotContains {
+    param([string]$Content, [string]$Pattern, [string]$Message)
+    if ($Content -match $Pattern) { throw $Message }
+}
+
+$powerShellScripts = @("install.ps1", "uninstall.ps1", "install-multi.ps1")
+foreach ($relativePath in $powerShellScripts) {
+    $tokens = $null
+    $errors = $null
+    [System.Management.Automation.Language.Parser]::ParseFile(
+        (Join-Path $repoRoot $relativePath),
+        [ref]$tokens,
+        [ref]$errors) | Out-Null
+    if ($errors.Count -gt 0) {
+        throw "$relativePath has PowerShell parser errors: $($errors.Message -join '; ')"
+    }
+}
+
+$bash = Get-Command bash -ErrorAction SilentlyContinue
+if ($bash) {
+    Push-Location $repoRoot
+    try {
+        foreach ($relativePath in @("install.sh", "uninstall.sh", "install-multi.sh")) {
+            & $bash.Source -n "./$relativePath"
+            if ($LASTEXITCODE -ne 0) { throw "$relativePath failed bash -n." }
+        }
+
+        $rollbackSmoke = @'
+set -e
+eval "$(awk '/^rollback_install_transaction\(\) \{/{emit=1} /^install_binary\(\) \{/{emit=0} emit' ./install.sh)"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+mkdir -p "$tmp/backup" "$tmp/install"
+printf old > "$tmp/backup/mt"
+printf new > "$tmp/install/mt"
+printf new > "$tmp/install/mthost"
+log() { :; }
+YELLOW=''
+NC=''
+ACTIVE_INSTALL_TEMP="$tmp"
+INSTALL_TRANSACTION_ACTIVE=true
+INSTALL_TRANSACTION_INSTALL_DIR="$tmp/install"
+INSTALL_TRANSACTION_FILES='mt mthost'
+INSTALL_TRANSACTION_SERVICE_MODE=false
+INSTALL_TRANSACTION_HAD_SERVICE=false
+rollback_install_transaction
+test "$(cat "$tmp/install/mt")" = old
+test ! -e "$tmp/install/mthost"
+test "$INSTALL_TRANSACTION_ACTIVE" = false
+# end rollback smoke
+'@
+        $rollbackOutput = $rollbackSmoke | & $bash.Source -s 2>&1
+        if ($LASTEXITCODE -ne 0) {
+            throw "install.sh rollback smoke test failed: $($rollbackOutput -join [Environment]::NewLine)"
+        }
+
+        $readinessSmoke = @'
+set -e
+eval "$(awk '/^is_tailscale_ipv4\(\) \{/{emit=1} /^rollback_install_transaction\(\) \{/{emit=0} emit' ./install.sh)"
+test "$(get_primary_access_url 2443 0.0.0.0)" = "https://localhost:2443"
+test "$(get_primary_access_url 2443 127.0.0.1)" = "https://localhost:2443"
+test "$(get_primary_access_url 2443 100.64.12.34)" = "https://100.64.12.34:2443"
+is_tailscale_ipv4 100.64.0.1
+is_tailscale_ipv4 100.127.255.254
+! is_tailscale_ipv4 100.128.0.1
+! is_tailscale_ipv4 192.168.1.1
+# end readiness URL smoke
+'@
+        $readinessOutput = $readinessSmoke | & $bash.Source -s 2>&1
+        if ($LASTEXITCODE -ne 0) {
+            throw "install.sh readiness URL smoke test failed: $($readinessOutput -join [Environment]::NewLine)"
+        }
+    } finally {
+        Pop-Location
+    }
+}
+
+$windowsInstaller = Get-Content (Join-Path $repoRoot "install.ps1") -Raw
+$unixInstaller = Get-Content (Join-Path $repoRoot "install.sh") -Raw
+
+Assert-Contains $windowsInstaller '\$ServiceName\s*=\s*"tlbx"' "Fresh Windows service identity is not tlbx."
+Assert-Contains $windowsInstaller '\$TLBX_SERVICE_INSTALL_DIR\s*=\s*"\$env:ProgramFiles\\tlbx"' "Fresh Windows install directory is not tlbx."
+Assert-Contains $windowsInstaller '\$AssetArchitecture\s*=\s*if \(\$Is64BitWindows\)' "Windows x86/x64 release selection is missing."
+Assert-Contains $windowsInstaller 'Existing MidTerm installation detected' "Windows legacy-update detection is missing."
+Assert-Contains $windowsInstaller 'TLBX_PORT' "Windows user port selection is not persisted."
+Assert-Contains $windowsInstaller 'Test-ReleaseMetadataSignature' "Windows signed-release verification is missing."
+Assert-Contains $windowsInstaller 'Restore-PreviousBinarySet' "Windows post-swap rollback is missing."
+Assert-Contains $windowsInstaller 'Start-TlbxUserProcess' "Windows user-mode install does not start tlbx."
+Assert-Contains $windowsInstaller 'Wait-TlbxReady' "Windows process/health readiness verification is missing."
+Assert-Contains $windowsInstaller 'Your tlbx is ready at:' "Windows installer does not present the verified access URL."
+Assert-Contains $windowsInstaller 'Get-TailscaleIpv4Addresses' "Windows installer does not discover Tailscale access URLs."
+
+Assert-Contains $unixInstaller 'SERVICE_NAME="tlbx"' "Fresh Unix service identity is not tlbx."
+Assert-Contains $unixInstaller 'TLBX_SERVICE_SETTINGS_DIR="/usr/local/etc/tlbx"' "Fresh Unix settings directory is not tlbx."
+Assert-Contains $unixInstaller 'Existing MidTerm installation detected' "Unix legacy-update detection is missing."
+Assert-Contains $unixInstaller 'runtime\.json' "Unix user port selection is not persisted."
+Assert-Contains $unixInstaller 'validate_archive_members' "Unix archive allowlist is missing."
+Assert-Contains $unixInstaller 'rollback_install_transaction' "Unix post-swap rollback is missing."
+Assert-NotContains $unixInstaller 'sudo env[^\n]*PASSWORD_HASH' "Password material must not cross sudo in argv or environment."
+Assert-Contains $unixInstaller 'start_user_tlbx' "Unix user-mode install does not start tlbx."
+Assert-Contains $unixInstaller 'wait_tlbx_ready' "Unix process/health readiness verification is missing."
+Assert-Contains $unixInstaller 'Your tlbx is ready at:' "Unix installer does not present the verified access URL."
+Assert-Contains $unixInstaller 'get_tailscale_ipv4_addresses' "Unix installer does not discover Tailscale access URLs."
+
+$windowsMultiInstaller = Get-Content (Join-Path $repoRoot "install-multi.ps1") -Raw
+$unixMultiInstaller = Get-Content (Join-Path $repoRoot "install-multi.sh") -Raw
+Assert-Contains $windowsMultiInstaller '\$instanceServicePrefix\s*=\s*"tlbx"' "Fresh Windows multi-instance services are not tlbx-branded."
+Assert-Contains $windowsMultiInstaller '\$env:ProgramData\\tlbx\\instances' "Fresh Windows multi-instance settings are not under tlbx."
+Assert-Contains $unixMultiInstaller 'ROOT_DIR="/usr/local/etc/tlbx-instances"' "Fresh Unix multi-instance settings are not under tlbx."
+Assert-Contains $unixMultiInstaller 'SERVICE_PREFIX="tlbx"' "Fresh Unix multi-instance services are not tlbx-branded."
+
+# Exercise the PowerShell archive guard and rollback helper without touching a
+# real installation. This catches unsafe extraction and partial-swap regressions
+# on both Windows and Linux CI runners.
+$tokens = $null
+$errors = $null
+$installerAst = [System.Management.Automation.Language.Parser]::ParseInput($windowsInstaller, [ref]$tokens, [ref]$errors)
+$safetyFunctions = ($installerAst.FindAll({
+    param($node)
+    $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+        $node.Name -in @("Get-WindowsReleaseFileNames", "Assert-SafeReleaseArchive", "Restore-PreviousBinarySet")
+}, $true) | ForEach-Object { $_.Extent.Text }) -join "`r`n"
+Invoke-Expression $safetyFunctions
+$script:ExpectedReleasePlatform = "win-x64"
+$script:WebBinaryName = "mt.exe"
+$script:TtyHostBinaryName = "mthost.exe"
+$script:AgentHostBinaryName = "mtagenthost.exe"
+$script:TmuxShimBinaryName = "mttmux.exe"
+
+$readinessFunctions = ($installerAst.FindAll({
+    param($node)
+    $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+        $node.Name -in @("Test-TailscaleIpv4Address", "Format-TlbxUrl", "Get-TlbxAccessUrls")
+}, $true) | ForEach-Object { $_.Extent.Text }) -join "`r`n"
+Invoke-Expression $readinessFunctions
+
+if (-not (Test-TailscaleIpv4Address "100.64.0.1") -or
+    -not (Test-TailscaleIpv4Address "100.127.255.254") -or
+    (Test-TailscaleIpv4Address "100.128.0.1") -or
+    (Test-TailscaleIpv4Address "192.168.1.1")) {
+    throw "PowerShell Tailscale IPv4 detection does not enforce 100.64.0.0/10."
+}
+$wildcardUrls = @(Get-TlbxAccessUrls -Port 2443 -BindAddress "0.0.0.0" -TailscaleAddresses @("100.64.12.34"))
+if ($wildcardUrls -notcontains "https://localhost:2443" -or
+    $wildcardUrls -notcontains "https://100.64.12.34:2443") {
+    throw "PowerShell access URL generation omitted localhost or Tailscale."
+}
+$loopbackUrls = @(Get-TlbxAccessUrls -Port 2443 -BindAddress "127.0.0.1" -TailscaleAddresses @("100.64.12.34"))
+if ($loopbackUrls.Count -ne 1 -or $loopbackUrls[0] -ne "https://localhost:2443") {
+    throw "PowerShell loopback URL generation exposed a non-listening Tailscale address."
+}
+
+$safetyRoot = Join-Path ([IO.Path]::GetTempPath()) ("tlbx-installer-safety-" + [Guid]::NewGuid().ToString("N"))
+New-Item -ItemType Directory -Path $safetyRoot | Out-Null
+try {
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    $validArchiveRoot = Join-Path $safetyRoot "valid"
+    New-Item -ItemType Directory -Path (Join-Path $validArchiveRoot "x64"), (Join-Path $validArchiveRoot "arm64") -Force | Out-Null
+    foreach ($fileName in @(Get-WindowsReleaseFileNames) + "SHA256SUMS.txt") {
+        $path = Join-Path $validArchiveRoot $fileName
+        New-Item -ItemType Directory -Path (Split-Path -Parent $path) -Force | Out-Null
+        Set-Content -LiteralPath $path -Value "payload" -NoNewline
+    }
+    $validArchivePath = Join-Path $safetyRoot "valid.zip"
+    Compress-Archive -Path (Join-Path $validArchiveRoot "*") -DestinationPath $validArchivePath
+    Assert-SafeReleaseArchive -Path $validArchivePath
+
+    $unsafeArchivePath = Join-Path $safetyRoot "unsafe.zip"
+    $unsafeArchive = [System.IO.Compression.ZipFile]::Open($unsafeArchivePath, [System.IO.Compression.ZipArchiveMode]::Create)
+    try {
+        $entry = $unsafeArchive.CreateEntry("../outside.exe")
+        $stream = $entry.Open()
+        try { $stream.WriteByte(1) } finally { $stream.Dispose() }
+    } finally {
+        $unsafeArchive.Dispose()
+    }
+    $unsafeRejected = $false
+    try { Assert-SafeReleaseArchive -Path $unsafeArchivePath } catch { $unsafeRejected = $true }
+    if (-not $unsafeRejected) { throw "PowerShell archive guard accepted a traversal entry." }
+
+    $installDir = Join-Path $safetyRoot "install"
+    $backupRoot = Join-Path $safetyRoot "transaction"
+    $backupDir = Join-Path $backupRoot "backup"
+    New-Item -ItemType Directory -Path $installDir, $backupDir | Out-Null
+    $script:WebBinaryName = "mt.exe"
+    $script:TtyHostBinaryName = "mthost.exe"
+    $script:AgentHostBinaryName = "mtagenthost.exe"
+    $script:TmuxShimBinaryName = "mttmux.exe"
+    foreach ($fileName in @(Get-WindowsReleaseFileNames)) {
+        $path = Join-Path $installDir $fileName
+        New-Item -ItemType Directory -Path (Split-Path -Parent $path) -Force | Out-Null
+        Set-Content -LiteralPath $path -Value "new" -NoNewline
+    }
+    Set-Content -LiteralPath (Join-Path $backupDir $WebBinaryName) -Value "old" -NoNewline
+    Restore-PreviousBinarySet -InstallDir $installDir -BackupRoot $backupRoot
+    if ((Get-Content -LiteralPath (Join-Path $installDir $WebBinaryName) -Raw) -ne "old") {
+        throw "PowerShell rollback did not restore the previous binary."
+    }
+    if (Test-Path -LiteralPath (Join-Path $installDir $TtyHostBinaryName)) {
+        throw "PowerShell rollback retained a newly introduced binary without a backup."
+    }
+    if (Test-Path -LiteralPath (Join-Path $installDir "conpty.dll")) {
+        throw "PowerShell rollback retained a newly introduced ConPTY runtime without a backup."
+    }
+} finally {
+    Remove-Item -LiteralPath $safetyRoot -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+if ($IsWindows) {
+    $windowsPowerShell = Join-Path $env:SystemRoot "System32\WindowsPowerShell\v1.0\powershell.exe"
+    if (Test-Path $windowsPowerShell) {
+        $tokens = $null
+        $errors = $null
+        $ast = [System.Management.Automation.Language.Parser]::ParseInput($windowsInstaller, [ref]$tokens, [ref]$errors)
+        $verifierFunctions = ($ast.FindAll({
+            param($node)
+            $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+                $node.Name -in @("Convert-DerEcdsaSignatureToP1363", "Test-ReleaseMetadataSignature")
+        }, $true) | ForEach-Object { $_.Extent.Text }) -join "`r`n"
+
+        $key = [System.Security.Cryptography.ECDsa]::Create()
+        $key.GenerateKey([System.Security.Cryptography.ECCurve]::CreateFromFriendlyName("nistP384"))
+        try {
+            $payload = [Text.Encoding]::UTF8.GetBytes("tlbx-installer-powershell-5.1")
+            $signature = $key.SignData(
+                $payload,
+                [System.Security.Cryptography.HashAlgorithmName]::SHA256,
+                [System.Security.Cryptography.DSASignatureFormat]::Rfc3279DerSequence)
+            $publicKey = $key.ExportSubjectPublicKeyInfo()
+        } finally {
+            $key.Dispose()
+        }
+
+        $verificationCall = '$ok=Test-ReleaseMetadataSignature -PayloadBytes ([Convert]::FromBase64String(''' +
+            [Convert]::ToBase64String($payload) + ''')) -SignatureBytes ([Convert]::FromBase64String(''' +
+            [Convert]::ToBase64String($signature) + ''')) -PublicKeyBytes ([Convert]::FromBase64String(''' +
+            [Convert]::ToBase64String($publicKey) + ''')); if(-not $ok){exit 1}'
+        $encodedScript = '$ProgressPreference=''SilentlyContinue'';' + "`r`n" + $verifierFunctions + "`r`n" + $verificationCall
+        $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($encodedScript))
+        & $windowsPowerShell -NoProfile -NonInteractive -EncodedCommand $encoded
+        if ($LASTEXITCODE -ne 0) { throw "Windows PowerShell 5.1 release-signature verification failed." }
+    }
+}
+
+if ($LiveRelease) {
+    $tempRoot = Join-Path ([IO.Path]::GetTempPath()) ("tlbx-installer-live-" + [Guid]::NewGuid().ToString("N"))
+    New-Item -ItemType Directory -Path $tempRoot | Out-Null
+    try {
+        $release = Invoke-RestMethod -Headers @{ "User-Agent" = "tlbx-installer-verifier" } `
+            -Uri "https://api.github.com/repos/tlbx-ai/tlbx/releases/latest"
+        $asset = $release.assets | Where-Object name -eq "mt-win-x64.zip" | Select-Object -First 1
+        if (-not $asset) { throw "Latest release has no mt-win-x64.zip asset." }
+
+        $archivePath = Join-Path $tempRoot "release.zip"
+        Invoke-WebRequest -Headers @{ "User-Agent" = "tlbx-installer-verifier" } `
+            -Uri $asset.browser_download_url -OutFile $archivePath
+
+        $tokens = $null
+        $errors = $null
+        $ast = [System.Management.Automation.Language.Parser]::ParseInput($windowsInstaller, [ref]$tokens, [ref]$errors)
+        $names = @(
+            "Convert-DerEcdsaSignatureToP1363",
+            "Test-ReleaseMetadataSignature",
+            "Assert-SignedRelease",
+            "Get-WindowsReleaseFileNames",
+            "Assert-SafeReleaseArchive"
+        )
+        $verifierFunctions = ($ast.FindAll({
+            param($node)
+            $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -in $names
+        }, $true) | ForEach-Object { $_.Extent.Text }) -join "`r`n"
+        Invoke-Expression $verifierFunctions
+
+        $script:ExpectedReleasePlatform = "win-x64"
+        Assert-SafeReleaseArchive -Path $archivePath
+        $extractDir = Join-Path $tempRoot "extract"
+        Expand-Archive -Path $archivePath -DestinationPath $extractDir
+        $version = $release.tag_name.TrimStart("v")
+        Assert-SignedRelease -ExtractDir $extractDir -ExpectedVersion $version -ExpectedPlatform "win-x64" -ExpectedChannel "stable"
+        Write-Host "PowerShell 7 live release verification passed ($($release.tag_name))." -ForegroundColor Green
+
+        if ($IsWindows) {
+            $windowsPowerShell = Join-Path $env:SystemRoot "System32\WindowsPowerShell\v1.0\powershell.exe"
+            $escapedExtractDir = $extractDir.Replace("'", "''", [StringComparison]::Ordinal)
+            $call = '$ErrorActionPreference=''Stop''; Assert-SignedRelease -ExtractDir ''' + $escapedExtractDir +
+                ''' -ExpectedVersion ''' + $version + ''' -ExpectedPlatform ''win-x64'' -ExpectedChannel ''stable'''
+            $encodedScript = '$ProgressPreference=''SilentlyContinue'';' + "`r`n" + $verifierFunctions + "`r`n" + $call
+            $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($encodedScript))
+            & $windowsPowerShell -NoProfile -NonInteractive -EncodedCommand $encoded
+            if ($LASTEXITCODE -ne 0) { throw "Windows PowerShell 5.1 live release verification failed." }
+            Write-Host "Windows PowerShell 5.1 live release verification passed ($($release.tag_name))." -ForegroundColor Green
+        }
+
+        $x86Asset = $release.assets | Where-Object name -eq "mt-win-x86.zip" | Select-Object -First 1
+        if (-not $x86Asset) { throw "Latest release has no mt-win-x86.zip asset." }
+        $x86ArchivePath = Join-Path $tempRoot "release-win-x86.zip"
+        Invoke-WebRequest -Headers @{ "User-Agent" = "tlbx-installer-verifier" } `
+            -Uri $x86Asset.browser_download_url -OutFile $x86ArchivePath
+        $script:ExpectedReleasePlatform = "win-x86"
+        Assert-SafeReleaseArchive -Path $x86ArchivePath
+        $x86ExtractDir = Join-Path $tempRoot "extract-win-x86"
+        Expand-Archive -Path $x86ArchivePath -DestinationPath $x86ExtractDir
+        Assert-SignedRelease -ExtractDir $x86ExtractDir -ExpectedVersion $version -ExpectedPlatform "win-x86" -ExpectedChannel "stable"
+        Write-Host "Windows x86 live release verification passed ($($release.tag_name))." -ForegroundColor Green
+
+        $tar = Get-Command tar -ErrorAction SilentlyContinue
+        if ($tar) {
+            $unixTargets = @(
+                @{ Asset = "mt-linux-x64.tar.gz"; Platform = "linux-x64" },
+                @{ Asset = "mt-linux-arm64.tar.gz"; Platform = "linux-arm64" },
+                @{ Asset = "mt-osx-x64.tar.gz"; Platform = "osx-x64" },
+                @{ Asset = "mt-osx-arm64.tar.gz"; Platform = "osx-arm64" }
+            )
+            foreach ($target in $unixTargets) {
+                $unixAsset = $release.assets | Where-Object name -eq $target.Asset | Select-Object -First 1
+                if (-not $unixAsset) { throw "Latest release has no $($target.Asset) asset." }
+                $unixArchivePath = Join-Path $tempRoot $target.Asset
+                Invoke-WebRequest -Headers @{ "User-Agent" = "tlbx-installer-verifier" } `
+                    -Uri $unixAsset.browser_download_url -OutFile $unixArchivePath
+
+                $members = @(& $tar.Source -tzf $unixArchivePath)
+                if ($LASTEXITCODE -ne 0) { throw "Could not list $($target.Asset)." }
+                $allowed = @("mt", "mthost", "mtagenthost", "mttmux", "version.json", "SHA256SUMS.txt")
+                $seen = @{}
+                foreach ($member in $members) {
+                    $normalized = $member -replace '^\./', ''
+                    if ([string]::IsNullOrEmpty($normalized)) { continue }
+                    if ($normalized -notin $allowed) { throw "$($target.Asset) contains unexpected member '$member'." }
+                    if ($seen.ContainsKey($normalized)) { throw "$($target.Asset) contains duplicate member '$member'." }
+                    $seen[$normalized] = $true
+                }
+                foreach ($required in @("mt", "mthost", "mtagenthost", "version.json")) {
+                    if (-not $seen.ContainsKey($required)) { throw "$($target.Asset) is missing '$required'." }
+                }
+
+                $unixExtractDir = Join-Path $tempRoot ("extract-" + $target.Platform)
+                New-Item -ItemType Directory -Path $unixExtractDir | Out-Null
+                & $tar.Source -xzf $unixArchivePath -C $unixExtractDir
+                if ($LASTEXITCODE -ne 0) { throw "Could not extract $($target.Asset)." }
+                Assert-SignedRelease -ExtractDir $unixExtractDir -ExpectedVersion $version -ExpectedPlatform $target.Platform -ExpectedChannel "stable"
+                Write-Host "$($target.Platform) live release verification passed ($($release.tag_name))." -ForegroundColor Green
+            }
+        }
+    } finally {
+        Remove-Item -LiteralPath $tempRoot -Recurse -Force -ErrorAction SilentlyContinue
+    }
+}
+
+Write-Host "Installer verification passed." -ForegroundColor Green
diff --git a/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.FileMentions.cs b/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.FileMentions.cs
index 32402948f..51b7afd4c 100644
--- a/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.FileMentions.cs
+++ b/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.FileMentions.cs
@@ -173,6 +173,8 @@ private AppServerControlHistoryItem CloneHistoryEntry(string sessionId, AppServe
             Attachments = CloneAttachments(enriched.Attachments),
             FileMentions = CloneInlineFileReferences(enriched.FileMentions),
             ImagePreviews = CloneInlineImagePreviews(enriched.ImagePreviews),
+            Questions = enriched.Questions.Select(CloneQuestion).ToList(),
+            Answers = enriched.Answers.Select(CloneAnsweredQuestion).ToList(),
             Streaming = enriched.Streaming,
             CreatedAt = enriched.CreatedAt,
             UpdatedAt = enriched.UpdatedAt
@@ -812,4 +814,3 @@ private readonly record struct FileMentionCandidate(
         int? Column,
         int Priority);
 }
-
diff --git a/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.cs b/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.cs
index 54ec41ac4..9a983a013 100644
--- a/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.cs
+++ b/src/Ai.Tlbx.MidTerm.AgentHost/Shared/SessionAppServerControlHistoryService.cs
@@ -1881,6 +1881,8 @@ private static void ApplyRequestUpdate(AppServerControlConversationState state,
         entry.ItemType = request.Kind;
         entry.Title = request.KindLabel;
         entry.Body = BuildRequestBody(request);
+        entry.Questions = request.Questions.Select(CloneQuestion).ToList();
+        entry.Answers = request.Answers.Select(CloneAnsweredQuestion).ToList();
         entry.Streaming = false;
         entry.UpdatedAt = appServerControlEvent.CreatedAt;
     }
@@ -2219,6 +2221,8 @@ private static AppServerControlHistoryItem CloneHistoryEntry(AppServerControlHis
             Attachments = CloneAttachments(source.Attachments),
             FileMentions = CloneInlineFileReferences(source.FileMentions),
             ImagePreviews = CloneInlineImagePreviews(source.ImagePreviews),
+            Questions = source.Questions.Select(CloneQuestion).ToList(),
+            Answers = source.Answers.Select(CloneAnsweredQuestion).ToList(),
             Streaming = source.Streaming,
             CreatedAt = source.CreatedAt,
             UpdatedAt = source.UpdatedAt,
@@ -4066,6 +4070,5 @@ public void Dispose()
 
 
 
-
 
 
diff --git a/src/Ai.Tlbx.MidTerm.Api/Endpoints/SystemEndpointDefinitions.cs b/src/Ai.Tlbx.MidTerm.Api/Endpoints/SystemEndpointDefinitions.cs
index d7e0e10cb..704be5505 100644
--- a/src/Ai.Tlbx.MidTerm.Api/Endpoints/SystemEndpointDefinitions.cs
+++ b/src/Ai.Tlbx.MidTerm.Api/Endpoints/SystemEndpointDefinitions.cs
@@ -1,3 +1,4 @@
+using System.Text.Json;
 using Ai.Tlbx.MidTerm.Api.Handlers;
 using Ai.Tlbx.MidTerm.Models;
 using Ai.Tlbx.MidTerm.Models.Update;
@@ -78,6 +79,11 @@ public static IEndpointRouteBuilder MapSystemApiEndpoints(this IEndpointRouteBui
             handler.UpdateSettings(settings))
             .Produces(StatusCodes.Status200OK);
 
+        app.MapPatch("/api/settings", (JsonElement patch, ISystemHandler handler) =>
+            handler.PatchSettings(patch))
+            .Accepts<JsonElement>("application/json")
+            .Produces(StatusCodes.Status200OK);
+
         app.MapPost("/api/settings/reload", (ISystemHandler handler) =>
             handler.ReloadSettings())
             .Produces(StatusCodes.Status200OK);
diff --git a/src/Ai.Tlbx.MidTerm.Api/Handlers/ISystemHandler.cs b/src/Ai.Tlbx.MidTerm.Api/Handlers/ISystemHandler.cs
index e97703728..e47b3a267 100644
--- a/src/Ai.Tlbx.MidTerm.Api/Handlers/ISystemHandler.cs
+++ b/src/Ai.Tlbx.MidTerm.Api/Handlers/ISystemHandler.cs
@@ -1,3 +1,4 @@
+using System.Text.Json;
 using Ai.Tlbx.MidTerm.Models;
 using Ai.Tlbx.MidTerm.Models.Update;
 using Ai.Tlbx.MidTerm.Settings;
@@ -28,6 +29,7 @@ public interface ISystemHandler
     IResult GetUsers();
     IResult GetSettings();
     IResult UpdateSettings(MidTermSettingsPublic settings);
+    IResult PatchSettings(JsonElement patch);
     IResult ReloadSettings();
     IResult GetPaths();
     Task<IResult> CheckUpdateAsync();
diff --git a/src/Ai.Tlbx.MidTerm.Common/Identity/TlbxProductIdentity.cs b/src/Ai.Tlbx.MidTerm.Common/Identity/TlbxProductIdentity.cs
new file mode 100644
index 000000000..1ecb545ea
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm.Common/Identity/TlbxProductIdentity.cs
@@ -0,0 +1,138 @@
+namespace Ai.Tlbx.MidTerm.Common.Identity;
+
+/// <summary>
+/// Product identity and install-layout compatibility rules.
+/// New installations use tlbx names. Existing MidTerm layouts remain readable
+/// and updateable in place; they are not silently moved during an update.
+/// </summary>
+public static class TlbxProductIdentity
+{
+    public const string ProductName = "tlbx";
+    public const string LegacyProductName = "MidTerm";
+
+    public const string UnixServiceSettingsDirectory = "/usr/local/etc/tlbx";
+    public const string LegacyUnixServiceSettingsDirectory = "/usr/local/etc/midterm";
+    public const string LegacyUnixMultiInstanceSettingsDirectory = "/usr/local/etc/midterm-instances";
+
+    public const string UserSettingsDirectoryName = ".tlbx";
+    public const string LegacyUserSettingsDirectoryName = ".midterm";
+
+    public const string CertificateFileName = "tlbx.pem";
+    public const string LegacyCertificateFileName = "midterm.pem";
+    public const string CertificateKeyId = "tlbx";
+    public const string LegacyCertificateKeyId = "midterm";
+    public const string CertificateSubject = "CN=tlbx";
+    public const string LegacyCertificateSubject = "CN=ai.tlbx.midterm";
+
+    public const string MacOsKeychainPrefix = "ai.tlbx";
+    public const string LegacyMacOsKeychainPrefix = "ai.tlbx.midterm";
+
+    public static string GetWindowsServiceSettingsDirectory()
+    {
+        var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
+        return Path.Combine(programData, ProductName);
+    }
+
+    public static string GetLegacyWindowsServiceSettingsDirectory()
+    {
+        var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
+        return Path.Combine(programData, LegacyProductName);
+    }
+
+    public static string GetUserSettingsDirectory()
+    {
+        var userProfile = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+        return Path.Combine(userProfile, UserSettingsDirectoryName);
+    }
+
+    public static string GetLegacyUserSettingsDirectory()
+    {
+        var userProfile = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+        return Path.Combine(userProfile, LegacyUserSettingsDirectoryName);
+    }
+
+    public static string SelectSettingsDirectory(string currentDirectory, string legacyDirectory)
+    {
+        if (ContainsInstallState(currentDirectory))
+        {
+            return currentDirectory;
+        }
+
+        if (ContainsInstallState(legacyDirectory))
+        {
+            return legacyDirectory;
+        }
+
+        return currentDirectory;
+    }
+
+    public static bool ContainsInstallState(string directory)
+    {
+        try
+        {
+            if (!Directory.Exists(directory))
+            {
+                return false;
+            }
+
+            foreach (var entry in Directory.EnumerateFileSystemEntries(directory))
+            {
+                var name = Path.GetFileName(entry);
+                if (name.Equals("logs", StringComparison.OrdinalIgnoreCase) ||
+                    name.Equals("update.log", StringComparison.OrdinalIgnoreCase) ||
+                    name.Equals("startup-debug.log", StringComparison.OrdinalIgnoreCase) ||
+                    name.Equals(".write-check", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                return true;
+            }
+        }
+        catch
+        {
+            // An unreadable existing layout must not steal a fresh install. The
+            // installer passes an explicit directory for service installations.
+        }
+
+        return false;
+    }
+
+    public static bool IsLegacySettingsDirectory(string settingsDirectory)
+    {
+        var fullPath = Normalize(settingsDirectory);
+        var legacyWindowsService = Normalize(GetLegacyWindowsServiceSettingsDirectory());
+        var legacyWindowsMulti = Normalize(Path.Combine(legacyWindowsService, "instances"));
+        var legacyUnixService = Normalize(LegacyUnixServiceSettingsDirectory);
+        var legacyUnixMulti = Normalize(LegacyUnixMultiInstanceSettingsDirectory);
+        var legacyUser = Normalize(GetLegacyUserSettingsDirectory());
+        return IsSameOrChild(fullPath, legacyWindowsService) ||
+               IsSameOrChild(fullPath, legacyWindowsMulti) ||
+               IsSameOrChild(fullPath, legacyUnixService) ||
+               IsSameOrChild(fullPath, legacyUnixMulti) ||
+               IsSameOrChild(fullPath, legacyUser);
+    }
+
+    public static string GetCertificateFileName(string settingsDirectory) =>
+        IsLegacySettingsDirectory(settingsDirectory) ? LegacyCertificateFileName : CertificateFileName;
+
+    public static string GetCertificateKeyId(string settingsDirectory) =>
+        IsLegacySettingsDirectory(settingsDirectory) ? LegacyCertificateKeyId : CertificateKeyId;
+
+    public static string GetCertificateSubject(string settingsDirectory) =>
+        IsLegacySettingsDirectory(settingsDirectory) ? LegacyCertificateSubject : CertificateSubject;
+
+    public static string GetMacOsKeychainPrefix(string settingsDirectory) =>
+        IsLegacySettingsDirectory(settingsDirectory) ? LegacyMacOsKeychainPrefix : MacOsKeychainPrefix;
+
+    private static StringComparison PathComparison =>
+        OperatingSystem.IsWindows() ? StringComparison.OrdinalIgnoreCase : StringComparison.Ordinal;
+
+    private static string Normalize(string path) =>
+        Path.GetFullPath(path).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+
+    private static bool IsSameOrChild(string path, string root) =>
+        path.Equals(root, PathComparison) ||
+        path.StartsWith(root + Path.DirectorySeparatorChar, PathComparison) ||
+        path.StartsWith(root + Path.AltDirectorySeparatorChar, PathComparison);
+}
diff --git a/src/Ai.Tlbx.MidTerm.Common/Logging/LogPaths.cs b/src/Ai.Tlbx.MidTerm.Common/Logging/LogPaths.cs
index 23ba39cef..6dd50d0fa 100644
--- a/src/Ai.Tlbx.MidTerm.Common/Logging/LogPaths.cs
+++ b/src/Ai.Tlbx.MidTerm.Common/Logging/LogPaths.cs
@@ -1,7 +1,9 @@
+using Ai.Tlbx.MidTerm.Common.Identity;
+
 namespace Ai.Tlbx.MidTerm.Common.Logging;
 
 /// <summary>
-/// Centralized path constants for MidTerm directories.
+/// Centralized path constants for tlbx and compatible legacy MidTerm directories.
 /// SYNC: These paths MUST match the following files:
 ///   - install.sh (PATH_CONSTANTS section)
 ///   - install.ps1 (Path Constants section)
@@ -13,14 +15,11 @@ public static class LogPaths
     // === UNIX SERVICE PATHS ===
     // SYNC: Must match install.sh PATH_CONSTANTS section
     private const string UnixServiceLogDir = "/usr/local/var/log";
-    private const string UnixServiceSettingsDir = "/usr/local/etc/midterm";  // lowercase 'midterm'
-
     public static string GetLogDirectory(bool isWindowsService, bool isUnixService = false)
     {
         if (OperatingSystem.IsWindows() && isWindowsService)
         {
-            var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
-            return Path.Combine(programData, "MidTerm", "Logs");
+            return Path.Combine(GetSettingsDirectory(true), "Logs");
         }
 
         if (!OperatingSystem.IsWindows() && isUnixService)
@@ -28,8 +27,7 @@ public static string GetLogDirectory(bool isWindowsService, bool isUnixService =
             return UnixServiceLogDir;
         }
 
-        var userDir = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
-        return Path.Combine(userDir, ".midterm", "logs");
+        return Path.Combine(GetSettingsDirectory(false), "logs");
     }
 
     public static string GetBackgroundDirectory(string settingsDirectory)
@@ -51,8 +49,7 @@ public static string GetDataDirectory(bool isWindowsService, bool isUnixService
     {
         if (OperatingSystem.IsWindows() && isWindowsService)
         {
-            var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
-            return Path.Combine(programData, "MidTerm", "Data");
+            return Path.Combine(GetSettingsDirectory(true), "Data");
         }
 
         if (!OperatingSystem.IsWindows() && isUnixService)
@@ -60,25 +57,28 @@ public static string GetDataDirectory(bool isWindowsService, bool isUnixService
             return Path.Combine(UnixServiceLogDir, "data");
         }
 
-        var userDir = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
-        return Path.Combine(userDir, ".midterm", "data");
+        return Path.Combine(GetSettingsDirectory(false), "data");
     }
 
     public static string GetSettingsDirectory(bool isWindowsService, bool isUnixService = false)
     {
         if (OperatingSystem.IsWindows() && isWindowsService)
         {
-            var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
-            return Path.Combine(programData, "MidTerm");
+            return TlbxProductIdentity.SelectSettingsDirectory(
+                TlbxProductIdentity.GetWindowsServiceSettingsDirectory(),
+                TlbxProductIdentity.GetLegacyWindowsServiceSettingsDirectory());
         }
 
         if (!OperatingSystem.IsWindows() && isUnixService)
         {
-            return UnixServiceSettingsDir;
+            return TlbxProductIdentity.SelectSettingsDirectory(
+                TlbxProductIdentity.UnixServiceSettingsDirectory,
+                TlbxProductIdentity.LegacyUnixServiceSettingsDirectory);
         }
 
-        var userDir = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
-        return Path.Combine(userDir, ".midterm");
+        return TlbxProductIdentity.SelectSettingsDirectory(
+            TlbxProductIdentity.GetUserSettingsDirectory(),
+            TlbxProductIdentity.GetLegacyUserSettingsDirectory());
     }
 
     public static string GetUpdateLogPath(bool isWindowsService, bool isUnixService, string? settingsDirectory = null)
diff --git a/src/Ai.Tlbx.MidTerm.Common/Protocol/AppServerControlHostProtocol.cs b/src/Ai.Tlbx.MidTerm.Common/Protocol/AppServerControlHostProtocol.cs
index 0230e303c..10d8b721d 100644
--- a/src/Ai.Tlbx.MidTerm.Common/Protocol/AppServerControlHostProtocol.cs
+++ b/src/Ai.Tlbx.MidTerm.Common/Protocol/AppServerControlHostProtocol.cs
@@ -250,6 +250,8 @@ public sealed class AppServerControlHistoryItem
     public List<AppServerControlAttachmentReference> Attachments { get; set; } = [];
     public List<AppServerControlInlineFileReference> FileMentions { get; set; } = [];
     public List<AppServerControlInlineImagePreview> ImagePreviews { get; set; } = [];
+    public List<AppServerControlQuestion> Questions { get; set; } = [];
+    public List<AppServerControlAnsweredQuestion> Answers { get; set; } = [];
     public bool Streaming { get; set; }
     public DateTimeOffset CreatedAt { get; set; }
     public DateTimeOffset UpdatedAt { get; set; }
@@ -613,6 +615,5 @@ public partial class AppServerControlHostJsonContext : JsonSerializerContext
 
 
 
-
 
 
diff --git a/src/Ai.Tlbx.MidTerm.Common/Shells/ShellConfigurations.cs b/src/Ai.Tlbx.MidTerm.Common/Shells/ShellConfigurations.cs
index dc724925b..87f28e3e0 100644
--- a/src/Ai.Tlbx.MidTerm.Common/Shells/ShellConfigurations.cs
+++ b/src/Ai.Tlbx.MidTerm.Common/Shells/ShellConfigurations.cs
@@ -1,3 +1,5 @@
+using Ai.Tlbx.MidTerm.Common.Identity;
+
 namespace Ai.Tlbx.MidTerm.Common.Shells;
 
 /// <summary>
@@ -79,7 +81,7 @@ public virtual Dictionary<string, string> GetEnvironmentVariables()
 
         env["TERM"] = "xterm-256color";
         env["COLORTERM"] = "truecolor";
-        env["TERM_PROGRAM"] = "midterm";
+        env["TERM_PROGRAM"] = "tlbx";
         env["FORCE_COLOR"] = "3";
         env["CLICOLOR"] = "1";
         env["CLICOLOR_FORCE"] = "1";
@@ -310,7 +312,10 @@ public override Dictionary<string, string> GetEnvironmentVariables()
                 ? h
                 : Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
 
-            var initDir = Path.Combine(home, ".midterm", "zsh-init");
+            var settingsDir = TlbxProductIdentity.SelectSettingsDirectory(
+                Path.Combine(home, TlbxProductIdentity.UserSettingsDirectoryName),
+                Path.Combine(home, TlbxProductIdentity.LegacyUserSettingsDirectoryName));
+            var initDir = Path.Combine(settingsDir, "zsh-init");
             Directory.CreateDirectory(initDir);
 
             var zshenvPath = Path.Combine(initDir, ".zshenv");
diff --git a/src/Ai.Tlbx.MidTerm.OpenApi/Stubs/StubSystemHandler.cs b/src/Ai.Tlbx.MidTerm.OpenApi/Stubs/StubSystemHandler.cs
index 1c405a387..235bf66f5 100644
--- a/src/Ai.Tlbx.MidTerm.OpenApi/Stubs/StubSystemHandler.cs
+++ b/src/Ai.Tlbx.MidTerm.OpenApi/Stubs/StubSystemHandler.cs
@@ -1,3 +1,4 @@
+using System.Text.Json;
 using Ai.Tlbx.MidTerm.Api.Handlers;
 using Ai.Tlbx.MidTerm.Models;
 using Ai.Tlbx.MidTerm.Models.Update;
@@ -59,6 +60,9 @@ public IResult GetSettings() =>
     public IResult UpdateSettings(MidTermSettingsPublic settings) =>
         Results.Ok();
 
+    public IResult PatchSettings(JsonElement patch) =>
+        Results.Ok();
+
     public IResult ReloadSettings() =>
         Results.Json(new MidTermSettingsPublic());
 
diff --git a/src/Ai.Tlbx.MidTerm.Tests/MultiInstanceRuntimeTests.cs b/src/Ai.Tlbx.MidTerm.Tests/MultiInstanceRuntimeTests.cs
index 74df6af85..dafb5eac7 100644
--- a/src/Ai.Tlbx.MidTerm.Tests/MultiInstanceRuntimeTests.cs
+++ b/src/Ai.Tlbx.MidTerm.Tests/MultiInstanceRuntimeTests.cs
@@ -8,6 +8,47 @@ namespace Ai.Tlbx.MidTerm.Tests;
 
 public sealed class MultiInstanceRuntimeTests
 {
+    [Fact]
+    public void ArgumentParser_ParseOptions_ReadsUserRuntimeDefaultsWithoutOverridingCli()
+    {
+        var settingsDir = Path.Combine(Path.GetTempPath(), $"tlbx-runtime-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(settingsDir);
+        File.WriteAllText(Path.Combine(settingsDir, "runtime.json"), """
+            { "port": 2345, "bindAddress": "127.0.0.1" }
+            """);
+        var originalTlbxPort = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.TlbxPortEnvironmentVariable);
+        var originalTlbxBind = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.TlbxBindAddressEnvironmentVariable);
+        var originalLegacyPort = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.PortEnvironmentVariable);
+        var originalLegacyBind = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.BindAddressEnvironmentVariable);
+
+        try
+        {
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.TlbxPortEnvironmentVariable, null);
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.TlbxBindAddressEnvironmentVariable, null);
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.PortEnvironmentVariable, null);
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.BindAddressEnvironmentVariable, null);
+
+            var defaults = ArgumentParser.ParseOptions(["--user-mode", "--settings-dir", settingsDir]);
+            var explicitOptions = ArgumentParser.ParseOptions([
+                "--user-mode", "--settings-dir", settingsDir,
+                "--port", "3456", "--bind", "0.0.0.0"
+            ]);
+
+            Assert.Equal(2345, defaults.Port);
+            Assert.Equal("127.0.0.1", defaults.BindAddress);
+            Assert.Equal(3456, explicitOptions.Port);
+            Assert.Equal("0.0.0.0", explicitOptions.BindAddress);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.TlbxPortEnvironmentVariable, originalTlbxPort);
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.TlbxBindAddressEnvironmentVariable, originalTlbxBind);
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.PortEnvironmentVariable, originalLegacyPort);
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.BindAddressEnvironmentVariable, originalLegacyBind);
+            Directory.Delete(settingsDir, recursive: true);
+        }
+    }
+
     [Fact]
     public void ArgumentParser_ParseOptions_ReadsInstanceFlags()
     {
@@ -35,9 +76,27 @@ public void ArgumentParser_ParseOptions_ReadsInstanceFlags()
     [Fact]
     public void RuntimeOptions_ApplyProcessEnvironment_SetsSettingsAndServiceScope()
     {
-        var originalSettingsDir = Environment.GetEnvironmentVariable(SettingsService.SettingsDirectoryEnvironmentVariable);
-        var originalServiceMode = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.ServiceModeEnvironmentVariable);
-        var originalServiceName = Environment.GetEnvironmentVariable(MidTermServiceIdentity.WindowsServiceNameEnvironmentVariable);
+        var variableNames = new[]
+        {
+            MidTermRuntimeOptions.TlbxPortEnvironmentVariable,
+            MidTermRuntimeOptions.PortEnvironmentVariable,
+            MidTermRuntimeOptions.TlbxBindAddressEnvironmentVariable,
+            MidTermRuntimeOptions.BindAddressEnvironmentVariable,
+            SettingsService.TlbxSettingsDirectoryEnvironmentVariable,
+            SettingsService.SettingsDirectoryEnvironmentVariable,
+            MidTermRuntimeOptions.TlbxServiceModeEnvironmentVariable,
+            MidTermRuntimeOptions.ServiceModeEnvironmentVariable,
+            MidTermServiceIdentity.TlbxWindowsServiceNameEnvironmentVariable,
+            MidTermServiceIdentity.WindowsServiceNameEnvironmentVariable,
+            MidTermServiceIdentity.TlbxLaunchdLabelEnvironmentVariable,
+            MidTermServiceIdentity.LaunchdLabelEnvironmentVariable,
+            MidTermServiceIdentity.TlbxSystemdServiceEnvironmentVariable,
+            MidTermServiceIdentity.SystemdServiceEnvironmentVariable
+        };
+        var originalValues = variableNames.ToDictionary(
+            static name => name,
+            static name => Environment.GetEnvironmentVariable(name),
+            StringComparer.Ordinal);
 
         try
         {
@@ -53,13 +112,47 @@ public void RuntimeOptions_ApplyProcessEnvironment_SetsSettingsAndServiceScope()
 
             Assert.Equal(Path.GetFullPath(settingsDir), SettingsService.GetSettingsDirectoryOverride());
             Assert.True(SettingsService.GetServiceModeOverride());
+            Assert.Equal("MidTerm-env", Environment.GetEnvironmentVariable(MidTermServiceIdentity.TlbxWindowsServiceNameEnvironmentVariable));
             Assert.Equal("MidTerm-env", Environment.GetEnvironmentVariable(MidTermServiceIdentity.WindowsServiceNameEnvironmentVariable));
         }
         finally
         {
-            Environment.SetEnvironmentVariable(SettingsService.SettingsDirectoryEnvironmentVariable, originalSettingsDir);
-            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.ServiceModeEnvironmentVariable, originalServiceMode);
-            Environment.SetEnvironmentVariable(MidTermServiceIdentity.WindowsServiceNameEnvironmentVariable, originalServiceName);
+            foreach (var variable in originalValues)
+            {
+                Environment.SetEnvironmentVariable(variable.Key, variable.Value);
+            }
+        }
+    }
+
+    [Fact]
+    public void ArgumentParser_PrefersTlbxEnvironmentAliasesOverLegacyAliases()
+    {
+        var variables = new Dictionary<string, string?>(StringComparer.Ordinal)
+        {
+            [MidTermRuntimeOptions.TlbxPortEnvironmentVariable] = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.TlbxPortEnvironmentVariable),
+            [MidTermRuntimeOptions.PortEnvironmentVariable] = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.PortEnvironmentVariable),
+            [MidTermServiceIdentity.TlbxWindowsServiceNameEnvironmentVariable] = Environment.GetEnvironmentVariable(MidTermServiceIdentity.TlbxWindowsServiceNameEnvironmentVariable),
+            [MidTermServiceIdentity.WindowsServiceNameEnvironmentVariable] = Environment.GetEnvironmentVariable(MidTermServiceIdentity.WindowsServiceNameEnvironmentVariable)
+        };
+
+        try
+        {
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.PortEnvironmentVariable, "2100");
+            Environment.SetEnvironmentVariable(MidTermRuntimeOptions.TlbxPortEnvironmentVariable, "2200");
+            Environment.SetEnvironmentVariable(MidTermServiceIdentity.WindowsServiceNameEnvironmentVariable, "MidTerm-legacy");
+            Environment.SetEnvironmentVariable(MidTermServiceIdentity.TlbxWindowsServiceNameEnvironmentVariable, "tlbx-current");
+
+            var options = ArgumentParser.ParseOptions([]);
+
+            Assert.Equal(2200, options.Port);
+            Assert.Equal("tlbx-current", options.ServiceIdentity.WindowsServiceName);
+        }
+        finally
+        {
+            foreach (var variable in variables)
+            {
+                Environment.SetEnvironmentVariable(variable.Key, variable.Value);
+            }
         }
     }
 
@@ -92,6 +185,8 @@ public void UpdateScriptGenerator_WindowsScript_UsesInstanceServiceName()
             Assert.Contains("Get-Service -Name $ServiceName", script, StringComparison.Ordinal);
             Assert.DoesNotContain("Get-Service -Name 'MidTerm'", script, StringComparison.Ordinal);
             Assert.DoesNotContain("Start-Service -Name 'MidTerm'", script, StringComparison.Ordinal);
+            Assert.Contains("tlbx.pem", script, StringComparison.Ordinal);
+            Assert.DoesNotContain("midterm.pem", script, StringComparison.Ordinal);
         }
         finally
         {
diff --git a/src/Ai.Tlbx.MidTerm.TtyHost/Ai.Tlbx.MidTerm.TtyHost.csproj b/src/Ai.Tlbx.MidTerm.TtyHost/Ai.Tlbx.MidTerm.TtyHost.csproj
index c165b3177..44332efb2 100644
--- a/src/Ai.Tlbx.MidTerm.TtyHost/Ai.Tlbx.MidTerm.TtyHost.csproj
+++ b/src/Ai.Tlbx.MidTerm.TtyHost/Ai.Tlbx.MidTerm.TtyHost.csproj
@@ -12,6 +12,12 @@
     <SelfContained>true</SelfContained>
     <ServerGarbageCollection>false</ServerGarbageCollection>
     <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;osx-x64;osx-arm64</RuntimeIdentifiers>
+    <ConptyNativePlatform Condition="'$(RuntimeIdentifier)' == 'win-x64'">x64</ConptyNativePlatform>
+    <ConptyNativePlatform Condition="'$(RuntimeIdentifier)' == 'win-x86'">x86</ConptyNativePlatform>
+    <ConptyNativePlatform Condition="'$(RuntimeIdentifier)' == 'win-arm64'">ARM64</ConptyNativePlatform>
+    <ConptyRequiresx86Host Condition="'$(RuntimeIdentifier)' == 'win-x86'">true</ConptyRequiresx86Host>
+    <ConptyRequiresx64Host Condition="'$(RuntimeIdentifier)' == 'win-x86' Or '$(RuntimeIdentifier)' == 'win-x64'">true</ConptyRequiresx64Host>
+    <ConptyRequiresARM64Host Condition="'$(RuntimeIdentifier)' == 'win-x86' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'">true</ConptyRequiresARM64Host>
     <!-- Version is set dynamically from version.json via ReadVersionJson target -->
   </PropertyGroup>
 
@@ -71,6 +77,58 @@
 
   <ItemGroup>
     <ProjectReference Include="..\Ai.Tlbx.MidTerm.Common\Ai.Tlbx.MidTerm.Common.csproj" />
+    <PackageReference Include="Microsoft.Windows.Console.ConPTY" Version="1.24.260710001" GeneratePathProperty="true" />
+  </ItemGroup>
+
+  <!--
+    Native AOT does not reliably carry the ConPTY package's native sidecars into
+    publish output. Keep the package's expected layout explicit so release
+    staging cannot silently ship mthost.exe without its Windows PTY runtime.
+  -->
+  <ItemGroup Condition="'$(RuntimeIdentifier)' != '' And $(RuntimeIdentifier.StartsWith('win'))">
+    <None Condition="'$(RuntimeIdentifier)' == 'win-x64'"
+          Include="$(PkgMicrosoft_Windows_Console_ConPTY)\runtimes\win-x64\native\conpty.dll"
+          Link="conpty.dll"
+          CopyToOutputDirectory="PreserveNewest"
+          CopyToPublishDirectory="PreserveNewest" />
+    <None Condition="'$(RuntimeIdentifier)' == 'win-x86'"
+          Include="$(PkgMicrosoft_Windows_Console_ConPTY)\runtimes\win-x86\native\conpty.dll"
+          Link="conpty.dll"
+          CopyToOutputDirectory="PreserveNewest"
+          CopyToPublishDirectory="PreserveNewest" />
+    <None Condition="'$(RuntimeIdentifier)' == 'win-x86'"
+          Include="$(PkgMicrosoft_Windows_Console_ConPTY)\build\native\runtimes\x86\OpenConsole.exe"
+          Link="x86\OpenConsole.exe"
+          CopyToOutputDirectory="PreserveNewest"
+          CopyToPublishDirectory="PreserveNewest" />
+    <None Condition="'$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-x86'"
+          Include="$(PkgMicrosoft_Windows_Console_ConPTY)\build\native\runtimes\x64\OpenConsole.exe"
+          Link="x64\OpenConsole.exe"
+          CopyToOutputDirectory="PreserveNewest"
+          CopyToPublishDirectory="PreserveNewest" />
+    <None Condition="'$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-x86'"
+          Include="$(PkgMicrosoft_Windows_Console_ConPTY)\build\native\runtimes\arm64\OpenConsole.exe"
+          Link="arm64\OpenConsole.exe"
+          CopyToOutputDirectory="PreserveNewest"
+          CopyToPublishDirectory="PreserveNewest" />
+  </ItemGroup>
+
+  <ItemGroup Condition="'$(RuntimeIdentifier)' != '' And $(RuntimeIdentifier.StartsWith('win'))">
+    <EmbeddedResource Condition="'$(RuntimeIdentifier)' == 'win-x64'"
+                      Include="$(PkgMicrosoft_Windows_Console_ConPTY)\runtimes\win-x64\native\conpty.dll"
+                      LogicalName="tlbx.conpty.conpty.dll" />
+    <EmbeddedResource Condition="'$(RuntimeIdentifier)' == 'win-x86'"
+                      Include="$(PkgMicrosoft_Windows_Console_ConPTY)\runtimes\win-x86\native\conpty.dll"
+                      LogicalName="tlbx.conpty.conpty.dll" />
+    <EmbeddedResource Condition="'$(RuntimeIdentifier)' == 'win-x86'"
+                      Include="$(PkgMicrosoft_Windows_Console_ConPTY)\build\native\runtimes\x86\OpenConsole.exe"
+                      LogicalName="tlbx.conpty.x86.OpenConsole.exe" />
+    <EmbeddedResource Condition="'$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-x86'"
+                      Include="$(PkgMicrosoft_Windows_Console_ConPTY)\build\native\runtimes\x64\OpenConsole.exe"
+                      LogicalName="tlbx.conpty.x64.OpenConsole.exe" />
+    <EmbeddedResource Condition="'$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-x86'"
+                      Include="$(PkgMicrosoft_Windows_Console_ConPTY)\build\native\runtimes\arm64\OpenConsole.exe"
+                      LogicalName="tlbx.conpty.arm64.OpenConsole.exe" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Ai.Tlbx.MidTerm.TtyHost/KittyGraphicsCapabilityResponder.cs b/src/Ai.Tlbx.MidTerm.TtyHost/KittyGraphicsCapabilityResponder.cs
new file mode 100644
index 000000000..d95341f34
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm.TtyHost/KittyGraphicsCapabilityResponder.cs
@@ -0,0 +1,245 @@
+using System.Globalization;
+using System.Runtime.InteropServices;
+using System.Text;
+
+namespace Ai.Tlbx.MidTerm.TtyHost;
+
+/// <summary>
+/// Answers Kitty graphics capability probes in the live PTY stream.
+///
+/// tlbx's terminal emulator is split between mthost and the browser. Handling
+/// the query here keeps capability detection independent of browser attach and
+/// replay timing, while image payloads continue to flow unchanged to xterm.js.
+/// </summary>
+internal sealed class KittyGraphicsCapabilityResponder
+{
+    private const int MaximumQueryBytes = 16 * 1024;
+    private const int MaximumRememberedResponses = 64;
+    private const byte Escape = 0x1b;
+    private static readonly byte[] PrimaryDeviceAttributesResponse =
+        Encoding.ASCII.GetBytes("\x1b[?62;4;9;22c");
+
+    private readonly List<byte> _query = new(128);
+    private readonly object _responseLock = new();
+    private readonly List<byte[]> _rememberedResponses = [];
+    private int _prefixLength;
+    private int _primaryDeviceAttributesPrefixLength;
+    private bool _capturing;
+    private bool _escapePending;
+
+    public List<byte[]>? Consume(ReadOnlySpan<byte> data)
+    {
+        List<byte[]>? responses = null;
+
+        foreach (var value in data)
+        {
+            if (ConsumePrimaryDeviceAttributesPrefix(value))
+            {
+                RememberResponse(PrimaryDeviceAttributesResponse);
+                responses ??= [];
+                responses.Add(PrimaryDeviceAttributesResponse);
+            }
+
+            if (!_capturing)
+            {
+                ConsumePrefix(value);
+                continue;
+            }
+
+            if (_escapePending)
+            {
+                if (value == (byte)'\\')
+                {
+                    var response = CreateResponse(_query);
+                    if (response is not null)
+                    {
+                        RememberResponse(response);
+                        responses ??= [];
+                        responses.Add(response);
+                    }
+
+                    ResetCapture();
+                    continue;
+                }
+
+                _query.Add(Escape);
+                _escapePending = false;
+            }
+
+            if (value == Escape)
+            {
+                _escapePending = true;
+                continue;
+            }
+
+            _query.Add(value);
+            if (_query.Count > MaximumQueryBytes)
+            {
+                ResetCapture();
+            }
+        }
+
+        return responses;
+    }
+
+    private bool ConsumePrimaryDeviceAttributesPrefix(byte value)
+    {
+        var expected = _primaryDeviceAttributesPrefixLength switch
+        {
+            0 => Escape,
+            1 => (byte)'[',
+            _ => (byte)'c'
+        };
+
+        if (value == expected)
+        {
+            _primaryDeviceAttributesPrefixLength++;
+            if (_primaryDeviceAttributesPrefixLength == 3)
+            {
+                _primaryDeviceAttributesPrefixLength = 0;
+                return true;
+            }
+            return false;
+        }
+
+        _primaryDeviceAttributesPrefixLength = value == Escape ? 1 : 0;
+        return false;
+    }
+
+    /// <summary>
+    /// Drops the browser renderer's duplicate answer to a capability query that
+    /// mthost already answered. Keeping the answer in mthost makes discovery work
+    /// before a browser attaches; suppressing the duplicate keeps it out of the
+    /// application's stdin when that query is later rendered or replayed.
+    /// </summary>
+    public bool IsDuplicateClientResponse(ReadOnlySpan<byte> data)
+    {
+        lock (_responseLock)
+        {
+            foreach (var response in _rememberedResponses)
+            {
+                if (data.SequenceEqual(response))
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+    }
+
+    private void RememberResponse(byte[] response)
+    {
+        lock (_responseLock)
+        {
+            if (_rememberedResponses.Any(existing => response.AsSpan().SequenceEqual(existing)))
+            {
+                return;
+            }
+
+            if (_rememberedResponses.Count == MaximumRememberedResponses)
+            {
+                _rememberedResponses.RemoveAt(0);
+            }
+
+            _rememberedResponses.Add(response);
+        }
+    }
+
+    private void ConsumePrefix(byte value)
+    {
+        var expected = _prefixLength switch
+        {
+            0 => Escape,
+            1 => (byte)'_',
+            _ => (byte)'G'
+        };
+
+        if (value == expected)
+        {
+            _prefixLength++;
+            if (_prefixLength == 3)
+            {
+                _capturing = true;
+                _prefixLength = 0;
+                _query.Clear();
+            }
+            return;
+        }
+
+        _prefixLength = value == Escape ? 1 : 0;
+    }
+
+    private void ResetCapture()
+    {
+        _capturing = false;
+        _escapePending = false;
+        _prefixLength = 0;
+        _query.Clear();
+    }
+
+    private static byte[]? CreateResponse(List<byte> query)
+    {
+        var separator = query.IndexOf((byte)';');
+        var controlsLength = separator >= 0 ? separator : query.Count;
+        var controls = Encoding.ASCII.GetString(CollectionsMarshal.AsSpan(query)[..controlsLength]);
+
+        string? action = null;
+        string? transmission = null;
+        string? format = null;
+        uint imageId = 0;
+        var quiet = 0;
+
+        foreach (var item in controls.Split(',', StringSplitOptions.RemoveEmptyEntries))
+        {
+            var equals = item.IndexOf('=', StringComparison.Ordinal);
+            if (equals <= 0 || equals == item.Length - 1)
+            {
+                continue;
+            }
+
+            var key = item[..equals];
+            var value = item[(equals + 1)..];
+            switch (key)
+            {
+                case "a":
+                    action = value;
+                    break;
+                case "t":
+                    transmission = value;
+                    break;
+                case "f":
+                    format = value;
+                    break;
+                case "i":
+                    _ = uint.TryParse(value, NumberStyles.None, CultureInfo.InvariantCulture, out imageId);
+                    break;
+                case "q":
+                    _ = int.TryParse(value, NumberStyles.Integer, CultureInfo.InvariantCulture, out quiet);
+                    break;
+            }
+        }
+
+        if (!string.Equals(action, "q", StringComparison.Ordinal))
+        {
+            return null;
+        }
+
+        var directTransfer = transmission is null or "d";
+        var supportedFormat = format is null or "24" or "32" or "100";
+        var ok = directTransfer && supportedFormat;
+        if ((ok && quiet >= 1) || (!ok && quiet >= 2))
+        {
+            return null;
+        }
+
+        var message = !directTransfer
+            ? "EINVAL:unsupported transmission medium"
+            : !supportedFormat
+                ? "EINVAL:unsupported format"
+                : "OK";
+        return Encoding.ASCII.GetBytes(string.Create(
+            CultureInfo.InvariantCulture,
+            $"\x1b_Gi={imageId};{message}\x1b\\"));
+    }
+}
diff --git a/src/Ai.Tlbx.MidTerm.TtyHost/Program.cs b/src/Ai.Tlbx.MidTerm.TtyHost/Program.cs
index 7b0bb8d1d..40e6cc03f 100644
--- a/src/Ai.Tlbx.MidTerm.TtyHost/Program.cs
+++ b/src/Ai.Tlbx.MidTerm.TtyHost/Program.cs
@@ -1364,6 +1364,8 @@ public InputTraceState(uint traceId, long markerReceivedAtMs, long inputReceived
     private readonly object _transportLock = new();
     private readonly object _inputTraceLock = new();
     private readonly object _metadataLock = new();
+    private readonly SemaphoreSlim _ptyWriteLock = new(1, 1);
+    private readonly KittyGraphicsCapabilityResponder _kittyGraphicsResponder = new();
     private readonly int _scrollbackBytes;
     private readonly Action<ForegroundProcessInfo>? _foregroundChangedHandler;
     private TtyHostTransportInfo _transportInfo;
@@ -1483,6 +1485,14 @@ private void RunReadLoop(CancellationToken ct)
                 var ptyOutputReadAtMs = Environment.TickCount64;
                 var data = buffer.AsMemory(0, bytesRead);
                 Log.Verbose(() => string.Create(CultureInfo.InvariantCulture, $"[PTY-READ] {bytesRead} bytes"));
+                var kittyResponses = _kittyGraphicsResponder.Consume(data.Span);
+                if (kittyResponses is not null)
+                {
+                    foreach (var response in kittyResponses)
+                    {
+                        WritePtyInputAsync(response, ct).GetAwaiter().GetResult();
+                    }
+                }
                 ulong sequenceStart;
                 ulong sequenceEndExclusive;
 
@@ -1512,9 +1522,29 @@ private void RunReadLoop(CancellationToken ct)
     }
 
     public async Task SendInputAsync(ReadOnlyMemory<byte> data, CancellationToken ct)
+    {
+        if (_kittyGraphicsResponder.IsDuplicateClientResponse(data.Span))
+        {
+            Log.Verbose(() => "[PTY-WRITE] suppressed duplicate Kitty capability response");
+            return;
+        }
+
+        await WritePtyInputAsync(data, ct).ConfigureAwait(false);
+    }
+
+    private async Task WritePtyInputAsync(ReadOnlyMemory<byte> data, CancellationToken ct)
     {
         Log.Verbose(() => $"[PTY-WRITE] {data.Length} bytes");
-        await _pty.WriterStream.WriteAsync(data, ct).ConfigureAwait(false);
+        await _ptyWriteLock.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            await _pty.WriterStream.WriteAsync(data, ct).ConfigureAwait(false);
+            await _pty.WriterStream.FlushAsync(ct).ConfigureAwait(false);
+        }
+        finally
+        {
+            _ptyWriteLock.Release();
+        }
     }
 
     public void BeginInputTrace(uint traceId, long markerReceivedAtMs, long inputReceivedAtMs)
@@ -1909,6 +1939,7 @@ public void Dispose()
         }
 
         _outputBuffer.Dispose();
+        _ptyWriteLock.Dispose();
     }
 
     public SessionInfo GetInfo()
diff --git a/src/Ai.Tlbx.MidTerm.TtyHost/Pty/ConPtyNative.cs b/src/Ai.Tlbx.MidTerm.TtyHost/Pty/ConPtyNative.cs
index abbcdf95e..ad194b8cb 100644
--- a/src/Ai.Tlbx.MidTerm.TtyHost/Pty/ConPtyNative.cs
+++ b/src/Ai.Tlbx.MidTerm.TtyHost/Pty/ConPtyNative.cs
@@ -6,6 +6,27 @@ namespace Ai.Tlbx.MidTerm.TtyHost.Pty;
 
 internal static class ConPtyNative
 {
+    [DefaultDllImportSearchPaths(DllImportSearchPath.ApplicationDirectory | DllImportSearchPath.SafeDirectories)]
+    [DllImport("conpty.dll", EntryPoint = "ConptyCreatePseudoConsole", SetLastError = true)]
+    public static extern int ConptyCreatePseudoConsole(
+        Coord size,
+        SafeFileHandle hInput,
+        SafeFileHandle hOutput,
+        uint dwFlags,
+        out IntPtr phPC);
+
+    [DefaultDllImportSearchPaths(DllImportSearchPath.ApplicationDirectory | DllImportSearchPath.SafeDirectories)]
+    [DllImport("conpty.dll", EntryPoint = "ConptyResizePseudoConsole", SetLastError = true)]
+    public static extern int ConptyResizePseudoConsole(IntPtr hPC, Coord size);
+
+    [DefaultDllImportSearchPaths(DllImportSearchPath.ApplicationDirectory | DllImportSearchPath.SafeDirectories)]
+    [DllImport("conpty.dll", EntryPoint = "ConptyReleasePseudoConsole", SetLastError = true)]
+    public static extern int ConptyReleasePseudoConsole(IntPtr hPC);
+
+    [DefaultDllImportSearchPaths(DllImportSearchPath.ApplicationDirectory | DllImportSearchPath.SafeDirectories)]
+    [DllImport("conpty.dll", EntryPoint = "ConptyClosePseudoConsole", SetLastError = true)]
+    public static extern void ConptyClosePseudoConsole(IntPtr hPC);
+
     [DllImport("kernel32.dll", SetLastError = true)]
     public static extern int CreatePseudoConsole(
         Coord size,
diff --git a/src/Ai.Tlbx.MidTerm.TtyHost/Pty/PackagedConPtyRuntime.cs b/src/Ai.Tlbx.MidTerm.TtyHost/Pty/PackagedConPtyRuntime.cs
new file mode 100644
index 000000000..21243524f
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm.TtyHost/Pty/PackagedConPtyRuntime.cs
@@ -0,0 +1,169 @@
+#if WINDOWS
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Globalization;
+
+namespace Ai.Tlbx.MidTerm.TtyHost.Pty;
+
+internal static class PackagedConPtyRuntime
+{
+    private const string PackageVersion = "1.24.260710001";
+    private static readonly Lock Sync = new();
+    private static IntPtr _nativeHandle;
+    private static string? _nativePath;
+    private static bool _resolverInstalled;
+
+    public static void EnsureLoaded()
+    {
+        lock (Sync)
+        {
+            if (_nativeHandle != IntPtr.Zero)
+            {
+                return;
+            }
+
+            if (!_resolverInstalled)
+            {
+                NativeLibrary.SetDllImportResolver(typeof(PackagedConPtyRuntime).Assembly, ResolveImport);
+                _resolverInstalled = true;
+            }
+
+            _nativePath = HasMatchingAdjacentRuntime(AppContext.BaseDirectory)
+                ? Path.Combine(AppContext.BaseDirectory, "conpty.dll")
+                : ExtractEmbeddedRuntime();
+            _nativeHandle = NativeLibrary.Load(_nativePath);
+        }
+    }
+
+    private static IntPtr ResolveImport(string libraryName, Assembly assembly, DllImportSearchPath? searchPath)
+    {
+        if (!string.Equals(libraryName, "conpty.dll", StringComparison.OrdinalIgnoreCase))
+        {
+            return IntPtr.Zero;
+        }
+
+        lock (Sync)
+        {
+            if (_nativeHandle != IntPtr.Zero)
+            {
+                return _nativeHandle;
+            }
+
+            if (string.IsNullOrWhiteSpace(_nativePath))
+            {
+                throw new DllNotFoundException("The packaged tlbx ConPTY runtime was not prepared.");
+            }
+
+            _nativeHandle = NativeLibrary.Load(_nativePath);
+            return _nativeHandle;
+        }
+    }
+
+    private static string ExtractEmbeddedRuntime()
+    {
+        var architecture = RuntimeInformation.ProcessArchitecture.ToString().ToLowerInvariant();
+        var root = Path.Combine(Path.GetTempPath(), "tlbx-conpty", PackageVersion, architecture);
+        Directory.CreateDirectory(root);
+
+        ExtractResource("tlbx.conpty.conpty.dll", Path.Combine(root, "conpty.dll"));
+        ExtractResource("tlbx.conpty.x64.OpenConsole.exe", Path.Combine(root, "x64", "OpenConsole.exe"));
+        ExtractResource("tlbx.conpty.arm64.OpenConsole.exe", Path.Combine(root, "arm64", "OpenConsole.exe"));
+        if (RuntimeInformation.ProcessArchitecture == Architecture.X86)
+        {
+            ExtractResource("tlbx.conpty.x86.OpenConsole.exe", Path.Combine(root, "x86", "OpenConsole.exe"));
+        }
+
+        return Path.Combine(root, "conpty.dll");
+    }
+
+    private static bool HasMatchingAdjacentRuntime(string root)
+    {
+        if (!ResourceMatchesFile("tlbx.conpty.conpty.dll", Path.Combine(root, "conpty.dll")) ||
+            !ResourceMatchesFile("tlbx.conpty.x64.OpenConsole.exe", Path.Combine(root, "x64", "OpenConsole.exe")) ||
+            !ResourceMatchesFile("tlbx.conpty.arm64.OpenConsole.exe", Path.Combine(root, "arm64", "OpenConsole.exe")))
+        {
+            return false;
+        }
+
+        return RuntimeInformation.ProcessArchitecture != Architecture.X86 ||
+            ResourceMatchesFile("tlbx.conpty.x86.OpenConsole.exe", Path.Combine(root, "x86", "OpenConsole.exe"));
+    }
+
+    private static bool ResourceMatchesFile(string resourceName, string path)
+    {
+        try
+        {
+            if (!File.Exists(path))
+            {
+                return false;
+            }
+
+            using var resource = typeof(PackagedConPtyRuntime).Assembly.GetManifestResourceStream(resourceName);
+            if (resource is null)
+            {
+                return false;
+            }
+
+            using var file = File.OpenRead(path);
+            return CryptographicOperations.FixedTimeEquals(SHA256.HashData(resource), SHA256.HashData(file));
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    private static void ExtractResource(string resourceName, string destinationPath)
+    {
+        using var resource = typeof(PackagedConPtyRuntime).Assembly.GetManifestResourceStream(resourceName)
+            ?? throw new InvalidOperationException($"Embedded ConPTY resource is missing: {resourceName}");
+        using var buffer = new MemoryStream();
+        resource.CopyTo(buffer);
+        var bytes = buffer.ToArray();
+
+        if (File.Exists(destinationPath) && HasExpectedHash(destinationPath, bytes))
+        {
+            return;
+        }
+
+        Directory.CreateDirectory(Path.GetDirectoryName(destinationPath)!);
+        var temporaryPath = string.Concat(
+            destinationPath,
+            ".",
+            Environment.ProcessId.ToString(CultureInfo.InvariantCulture),
+            ".",
+            Guid.NewGuid().ToString("N"),
+            ".tmp");
+        try
+        {
+            File.WriteAllBytes(temporaryPath, bytes);
+            File.Move(temporaryPath, destinationPath, overwrite: true);
+        }
+        finally
+        {
+            try { File.Delete(temporaryPath); } catch { }
+        }
+
+        if (!HasExpectedHash(destinationPath, bytes))
+        {
+            throw new IOException($"Extracted ConPTY runtime failed verification: {destinationPath}");
+        }
+    }
+
+    private static bool HasExpectedHash(string path, byte[] expectedBytes)
+    {
+        try
+        {
+            using var file = File.OpenRead(path);
+            return CryptographicOperations.FixedTimeEquals(
+                SHA256.HashData(file),
+                SHA256.HashData(expectedBytes));
+        }
+        catch
+        {
+            return false;
+        }
+    }
+}
+#endif
diff --git a/src/Ai.Tlbx.MidTerm.TtyHost/Pty/WindowsPty.cs b/src/Ai.Tlbx.MidTerm.TtyHost/Pty/WindowsPty.cs
index f556ae970..71020bc5e 100644
--- a/src/Ai.Tlbx.MidTerm.TtyHost/Pty/WindowsPty.cs
+++ b/src/Ai.Tlbx.MidTerm.TtyHost/Pty/WindowsPty.cs
@@ -22,6 +22,7 @@ public sealed class WindowsPty : IPtyConnection
     private SafeFileHandle? _outputReadHandle;
     private FileStream? _writerStream;
     private FileStream? _readerStream;
+    private bool _usesPackagedConPty;
     private bool _disposed;
 
     public Stream WriterStream
@@ -134,7 +135,12 @@ private void StartInternal(
             _outputReadHandle = outputReadHandle;
 
             var size = new Coord((short)cols, (short)rows);
-            var hr = CreatePseudoConsole(size, inputReadHandle, outputWriteHandle, 0, out _pseudoConsoleHandle);
+            var hr = TryCreatePackagedPseudoConsole(size, inputReadHandle, outputWriteHandle);
+            if (hr != 0)
+            {
+                _pseudoConsoleHandle = IntPtr.Zero;
+                hr = CreatePseudoConsole(size, inputReadHandle, outputWriteHandle, 0, out _pseudoConsoleHandle);
+            }
             if (hr != 0)
             {
                 throw new Win32Exception(hr, "Failed to create pseudo console");
@@ -203,6 +209,15 @@ private void StartInternal(
                 _processHandle = processInfo.hProcess;
                 _threadHandle = processInfo.hThread;
                 Pid = processInfo.dwProcessId;
+
+                if (_usesPackagedConPty)
+                {
+                    var releaseHr = ConptyReleasePseudoConsole(_pseudoConsoleHandle);
+                    if (releaseHr != 0)
+                    {
+                        Log.Warn(() => string.Create(CultureInfo.InvariantCulture, $"Failed to release packaged pseudo console server handles for PID {Pid}: HRESULT=0x{releaseHr:X8}"));
+                    }
+                }
             }
             finally
             {
@@ -227,6 +242,31 @@ private void StartInternal(
         }
     }
 
+    private int TryCreatePackagedPseudoConsole(
+        Coord size,
+        SafeFileHandle inputReadHandle,
+        SafeFileHandle outputWriteHandle)
+    {
+        try
+        {
+            PackagedConPtyRuntime.EnsureLoaded();
+            var hr = ConptyCreatePseudoConsole(size, inputReadHandle, outputWriteHandle, 0, out _pseudoConsoleHandle);
+            _usesPackagedConPty = hr == 0;
+            if (hr != 0)
+            {
+                Log.Warn(() => string.Create(CultureInfo.InvariantCulture, $"Packaged ConPTY returned HRESULT=0x{hr:X8}; using the Windows system ConPTY"));
+            }
+            return hr;
+        }
+        catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException or BadImageFormatException or IOException or UnauthorizedAccessException or InvalidOperationException)
+        {
+            _usesPackagedConPty = false;
+            _pseudoConsoleHandle = IntPtr.Zero;
+            Log.Warn(() => $"Packaged ConPTY unavailable; using the Windows system ConPTY: {ex.Message}");
+            return -1;
+        }
+    }
+
     private static string BuildCommandLine(string app, string[] args)
     {
         var sb = new StringBuilder();
@@ -291,7 +331,9 @@ public void Resize(int cols, int rows)
                 try
                 {
                     var size = new Coord((short)cols, (short)rows);
-                    var hr = ResizePseudoConsole(_pseudoConsoleHandle, size);
+                    var hr = _usesPackagedConPty
+                        ? ConptyResizePseudoConsole(_pseudoConsoleHandle, size)
+                        : ResizePseudoConsole(_pseudoConsoleHandle, size);
                     if (hr != 0)
                     {
                         Log.Warn(() => string.Create(CultureInfo.InvariantCulture, $"Failed to resize pseudo console for PID {Pid}: HRESULT=0x{hr:X8}"));
@@ -365,7 +407,18 @@ public void Dispose()
 
         if (_pseudoConsoleHandle != IntPtr.Zero)
         {
-            try { ClosePseudoConsole(_pseudoConsoleHandle); } catch { }
+            try
+            {
+                if (_usesPackagedConPty)
+                {
+                    ConptyClosePseudoConsole(_pseudoConsoleHandle);
+                }
+                else
+                {
+                    ClosePseudoConsole(_pseudoConsoleHandle);
+                }
+            }
+            catch { }
             _pseudoConsoleHandle = IntPtr.Zero;
         }
 
@@ -426,7 +479,18 @@ private void DisposeNativeResources()
 
             if (_pseudoConsoleHandle != IntPtr.Zero)
             {
-                try { ClosePseudoConsole(_pseudoConsoleHandle); } catch { }
+                try
+                {
+                    if (_usesPackagedConPty)
+                    {
+                        ConptyClosePseudoConsole(_pseudoConsoleHandle);
+                    }
+                    else
+                    {
+                        ClosePseudoConsole(_pseudoConsoleHandle);
+                    }
+                }
+                catch { }
                 _pseudoConsoleHandle = IntPtr.Zero;
             }
 
diff --git a/src/Ai.Tlbx.MidTerm.TtyHost/packages.lock.json b/src/Ai.Tlbx.MidTerm.TtyHost/packages.lock.json
index c1d3df5e4..73fb5a194 100644
--- a/src/Ai.Tlbx.MidTerm.TtyHost/packages.lock.json
+++ b/src/Ai.Tlbx.MidTerm.TtyHost/packages.lock.json
@@ -26,6 +26,12 @@
         "resolved": "10.0.10",
         "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Direct",
+        "requested": "[1.24.260710001, )",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "ai.tlbx.midterm.common": {
         "type": "Project"
       }
@@ -40,6 +46,12 @@
           "runtime.linux-arm64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Direct",
+        "requested": "[1.24.260710001, )",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "runtime.linux-arm64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
         "resolved": "10.0.10",
@@ -56,6 +68,12 @@
           "runtime.linux-x64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Direct",
+        "requested": "[1.24.260710001, )",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "runtime.linux-x64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
         "resolved": "10.0.10",
@@ -72,6 +90,12 @@
           "runtime.osx-arm64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Direct",
+        "requested": "[1.24.260710001, )",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "runtime.osx-arm64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
         "resolved": "10.0.10",
@@ -88,6 +112,12 @@
           "runtime.osx-x64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Direct",
+        "requested": "[1.24.260710001, )",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "runtime.osx-x64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
         "resolved": "10.0.10",
@@ -104,6 +134,12 @@
           "runtime.win-x64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Direct",
+        "requested": "[1.24.260710001, )",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "runtime.win-x64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
         "resolved": "10.0.10",
@@ -120,6 +156,12 @@
           "runtime.win-x86.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Direct",
+        "requested": "[1.24.260710001, )",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "runtime.win-x86.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
         "resolved": "10.0.10",
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/BrowserUiBridgeTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/BrowserUiBridgeTests.cs
index 6dc3e94e5..a8396febf 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/BrowserUiBridgeTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/BrowserUiBridgeTests.cs
@@ -6,6 +6,37 @@ namespace Ai.Tlbx.MidTerm.UnitTests;
 
 public sealed class BrowserUiBridgeTests
 {
+    [Fact]
+    public async Task RequestOpenWhenAvailableAsync_WaitsForReconnectAndDispatchesExactlyOnce()
+    {
+        var mainBrowser = new MainBrowserService();
+        var bridge = new BrowserUiBridge(mainBrowser);
+        var openCount = 0;
+
+        var pending = bridge.RequestOpenWhenAvailableAsync(
+            "session-a",
+            "default",
+            "https://example.com",
+            activateSession: true,
+            timeout: TimeSpan.FromSeconds(2),
+            pollInterval: TimeSpan.FromMilliseconds(10));
+
+        await Task.Delay(50);
+        bridge.RegisterListener(
+            "connection-a",
+            "browser-a",
+            (_, _) => { },
+            (_, _) => { },
+            (_, _, _, _) => { },
+            (_, _, _, _) => openCount += 1);
+
+        var result = await pending;
+
+        Assert.True(result.Success);
+        Assert.Equal("", result.Error);
+        Assert.Equal(1, openCount);
+    }
+
     [Fact]
     public void RequestMobileDevice_ForwardsToSelectedBrowserUi()
     {
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/KittyGraphicsCapabilityResponderTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/KittyGraphicsCapabilityResponderTests.cs
new file mode 100644
index 000000000..6374aa07c
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/KittyGraphicsCapabilityResponderTests.cs
@@ -0,0 +1,84 @@
+using System.Text;
+using Ai.Tlbx.MidTerm.TtyHost;
+using Xunit;
+
+namespace Ai.Tlbx.MidTerm.UnitTests;
+
+public sealed class KittyGraphicsCapabilityResponderTests
+{
+    private const string Query = "\x1b_Gi=31337,s=1,v=1,a=q,t=d,f=24;AAAA\x1b\\";
+
+    [Fact]
+    public void Consume_AnswersOpenTuiCapabilityQuery()
+    {
+        var responder = new KittyGraphicsCapabilityResponder();
+
+        var responses = responder.Consume(Encoding.ASCII.GetBytes(Query));
+
+        var response = Assert.Single(Assert.IsType<List<byte[]>>(responses));
+        Assert.Equal("\x1b_Gi=31337;OK\x1b\\", Encoding.ASCII.GetString(response));
+    }
+
+    [Fact]
+    public void Consume_HandlesQuerySplitAcrossPtyReads()
+    {
+        var responder = new KittyGraphicsCapabilityResponder();
+        var bytes = Encoding.ASCII.GetBytes(Query);
+
+        Assert.Null(responder.Consume(bytes.AsSpan(0, 7)));
+        Assert.Null(responder.Consume(bytes.AsSpan(7, 19)));
+        var responses = responder.Consume(bytes.AsSpan(26));
+
+        Assert.Single(Assert.IsType<List<byte[]>>(responses));
+    }
+
+    [Fact]
+    public void Consume_DoesNotAnswerImageTransmission()
+    {
+        var responder = new KittyGraphicsCapabilityResponder();
+        var image = Encoding.ASCII.GetBytes("\x1b_Ga=T,f=100,t=d,i=31338;AAAA\x1b\\");
+
+        Assert.Null(responder.Consume(image));
+    }
+
+    [Fact]
+    public void Consume_AnswersPrimaryDeviceAttributesAcrossPtyReads()
+    {
+        var responder = new KittyGraphicsCapabilityResponder();
+
+        Assert.Null(responder.Consume(Encoding.ASCII.GetBytes("before\x1b[")));
+        var responses = responder.Consume(Encoding.ASCII.GetBytes("cafter"));
+
+        var response = Assert.Single(Assert.IsType<List<byte[]>>(responses));
+        Assert.Equal("\x1b[?62;4;9;22c", Encoding.ASCII.GetString(response));
+        Assert.True(responder.IsDuplicateClientResponse(response));
+    }
+
+    [Fact]
+    public void Consume_RejectsFileTransferWithoutClaimingBrowserFilesystemAccess()
+    {
+        var responder = new KittyGraphicsCapabilityResponder();
+        var query = Encoding.ASCII.GetBytes("\x1b_Gi=7,a=q,t=f,f=100;AAAA\x1b\\");
+
+        var responses = responder.Consume(query);
+
+        var response = Assert.Single(Assert.IsType<List<byte[]>>(responses));
+        Assert.Equal(
+            "\x1b_Gi=7;EINVAL:unsupported transmission medium\x1b\\",
+            Encoding.ASCII.GetString(response));
+    }
+
+    [Fact]
+    public void IsDuplicateClientResponse_SuppressesOnlyResponsesAlreadySentByHost()
+    {
+        var responder = new KittyGraphicsCapabilityResponder();
+        var response = Assert.Single(Assert.IsType<List<byte[]>>(
+            responder.Consume(Encoding.ASCII.GetBytes(Query))));
+
+        Assert.True(responder.IsDuplicateClientResponse(response));
+        Assert.True(responder.IsDuplicateClientResponse(response));
+        Assert.False(responder.IsDuplicateClientResponse(
+            Encoding.ASCII.GetBytes("\x1b_Gi=99;OK\x1b\\")));
+        Assert.False(responder.IsDuplicateClientResponse(Encoding.ASCII.GetBytes("echo OK")));
+    }
+}
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/ManagerBarQueueServiceTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/ManagerBarQueueServiceTests.cs
index 093ddbdd7..460acc27e 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/ManagerBarQueueServiceTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/ManagerBarQueueServiceTests.cs
@@ -125,6 +125,32 @@ public async Task EnqueuePromptAt_PersistsScheduledRunTimeAcrossRestart()
         Assert.Equal(runAt, snapshot.NextRunAt);
     }
 
+    [Fact]
+    public async Task EnqueuePromptAt_PersistsRecurringPromptProgressAcrossRestart()
+    {
+        var runtime = new FakeRuntime(["session-1"]);
+        var runAt = _timeProvider.GetUtcNow().AddMinutes(5);
+        await using (var initial = new ManagerBarQueueService(_stateDir, runtime, _timeProvider))
+        {
+            var entry = initial.EnqueuePromptAt(
+                "session-1",
+                new AppServerControlTurnRequest { Text = "check again" },
+                runAt,
+                repeatEveryMs: 60_000,
+                repeatCount: 3);
+
+            Assert.NotNull(entry);
+            Assert.Equal(60_000, entry!.RepeatEveryMs);
+            Assert.Equal(3, entry.RepeatCount);
+        }
+
+        await using var restarted = new ManagerBarQueueService(_stateDir, runtime, _timeProvider);
+        var snapshot = Assert.Single(restarted.GetSnapshot(["session-1"]));
+        Assert.Equal(60_000, snapshot.RepeatEveryMs);
+        Assert.Equal(3, snapshot.RepeatCount);
+        Assert.Equal(runAt, snapshot.NextRunAt);
+    }
+
     [Fact]
     public async Task SubmitPromptAsync_FastTracksTerminalPromptWhenQueueEmptyAndHeatIsLow()
     {
@@ -171,6 +197,23 @@ public async Task SubmitPromptAsync_QueuesTerminalPromptWhenHeatIsHigh()
         Assert.Single(service.GetSnapshot(["session-1"]));
     }
 
+    [Fact]
+    public async Task SubmitPromptAsync_QueueInAnotherSessionDoesNotBlockImmediateDispatch()
+    {
+        var runtime = new FakeRuntime(["session-1", "session-2"]) { CurrentHeat = 0.1 };
+        await using var service = new ManagerBarQueueService(_stateDir, runtime, _timeProvider);
+        service.EnqueuePrompt("session-1", new AppServerControlTurnRequest { Text = "later" });
+
+        var (accepted, entry) = await service.SubmitPromptAsync(
+            "session-2",
+            new AppServerControlTurnRequest { Text = "now" });
+
+        Assert.True(accepted);
+        Assert.Null(entry);
+        Assert.Equal(["now"], runtime.SentPrompts);
+        Assert.Single(service.GetSnapshot(["session-1", "session-2"]));
+    }
+
     [Fact]
     public async Task DispatchPromptDirectAsync_IgnoresHeatAndNeverCreatesAHeuristicQueueEntry()
     {
@@ -456,6 +499,100 @@ public async Task ProcessLoop_WaitsUntilScheduledPromptRunTime()
         Assert.Empty(service.GetSnapshot(["session-1"]));
     }
 
+    [Fact]
+    public async Task ProcessLoop_RearmsRecurringPromptUntilConfiguredRunCount()
+    {
+        var runtime = new FakeRuntime(["session-1"]);
+        await using var service = new ManagerBarQueueService(_stateDir, runtime, _timeProvider);
+        service.Start();
+
+        service.EnqueuePromptAt(
+            "session-1",
+            new AppServerControlTurnRequest { Text = "recurring status" },
+            _timeProvider.GetUtcNow().AddSeconds(1),
+            repeatEveryMs: 2_000,
+            repeatCount: 2);
+
+        _timeProvider.Advance(TimeSpan.FromSeconds(2));
+        await Task.Delay(700);
+
+        Assert.Equal(["recurring status"], runtime.SentPrompts);
+        var rearmed = Assert.Single(service.GetSnapshot(["session-1"]));
+        Assert.Equal(1, rearmed.CompletedCycles);
+        Assert.NotNull(rearmed.NextRunAt);
+
+        _timeProvider.Advance(TimeSpan.FromSeconds(3));
+        await Task.Delay(700);
+
+        Assert.Equal(["recurring status", "recurring status"], runtime.SentPrompts);
+        Assert.Empty(service.GetSnapshot(["session-1"]));
+    }
+
+    [Fact]
+    public async Task ProcessLoop_RetainsFailedOccurrenceAndRetriesWithoutAdvancing()
+    {
+        var runtime = new FakeRuntime(["session-1"]) { SendFailuresRemaining = 1 };
+        await using var service = new ManagerBarQueueService(_stateDir, runtime, _timeProvider);
+        service.Start();
+
+        service.EnqueuePromptAt(
+            "session-1",
+            new AppServerControlTurnRequest { Text = "retry me" },
+            _timeProvider.GetUtcNow().AddSeconds(1));
+
+        _timeProvider.Advance(TimeSpan.FromSeconds(2));
+        await Task.Delay(700);
+
+        Assert.Empty(runtime.SentPrompts);
+        var retained = Assert.Single(service.GetSnapshot(["session-1"]));
+        Assert.Equal(0, retained.CompletedCycles);
+        Assert.Equal("pendingInterval", retained.Phase);
+
+        _timeProvider.Advance(TimeSpan.FromSeconds(6));
+        await Task.Delay(700);
+
+        Assert.Equal(["retry me"], runtime.SentPrompts);
+        Assert.Empty(service.GetSnapshot(["session-1"]));
+    }
+
+    [Fact]
+    public void ComputeNextScheduleTime_UsesConfiguredWallClockZoneAndSkipsMissingDstTime()
+    {
+        var berlin = FindBerlinTimeZone();
+        var schedule = new[]
+        {
+            new ManagerBarScheduleEntry { TimeOfDay = "02:30", Repeat = "daily" }
+        };
+
+        var next = ManagerBarQueueService.ComputeNextScheduleTime(
+            schedule,
+            DateTimeOffset.Parse("2026-03-29T00:00:00Z", CultureInfo.InvariantCulture),
+            berlin);
+
+        Assert.Equal(
+            DateTimeOffset.Parse("2026-03-30T00:30:00Z", CultureInfo.InvariantCulture),
+            next?.ToUniversalTime());
+    }
+
+    [Fact]
+    public void ComputeNextScheduleTime_SelectsRemainingAmbiguousDstOccurrence()
+    {
+        var berlin = FindBerlinTimeZone();
+        var schedule = new[]
+        {
+            new ManagerBarScheduleEntry { TimeOfDay = "02:30", Repeat = "daily" }
+        };
+
+        var next = ManagerBarQueueService.ComputeNextScheduleTime(
+            schedule,
+            DateTimeOffset.Parse("2026-10-25T00:45:00Z", CultureInfo.InvariantCulture),
+            berlin);
+
+        Assert.Equal(
+            DateTimeOffset.Parse("2026-10-25T01:30:00Z", CultureInfo.InvariantCulture),
+            next?.ToUniversalTime());
+    }
+
     [Fact]
     public async Task ProcessLoop_WaitsForAppServerControlTurnToReturnBeforeSendingQueuedTurn()
     {
@@ -512,6 +649,12 @@ private static ManagerBarButton CreateRepeatCountAction()
         };
     }
 
+    private static TimeZoneInfo FindBerlinTimeZone()
+    {
+        return TimeZoneInfo.FindSystemTimeZoneById(
+            OperatingSystem.IsWindows() ? "W. Europe Standard Time" : "Europe/Berlin");
+    }
+
     private sealed class FakeRuntime : IManagerBarQueueRuntime
     {
         private readonly HashSet<string> _sessionIds;
@@ -519,6 +662,7 @@ private sealed class FakeRuntime : IManagerBarQueueRuntime
         public DateTimeOffset? LastOutputAt { get; set; }
         public bool UsesTurnQueueValue { get; set; }
         public bool TurnQueueReady { get; set; } = true;
+        public int SendFailuresRemaining { get; set; }
         public List<string> SentPrompts { get; } = [];
         public List<AppServerControlTurnRequest> SentTurns { get; } = [];
 
@@ -558,12 +702,24 @@ public bool IsTurnQueueReady(string sessionId)
 
         public Task SendPromptAsync(string sessionId, string prompt, CancellationToken cancellationToken)
         {
+            if (SendFailuresRemaining > 0)
+            {
+                SendFailuresRemaining -= 1;
+                throw new InvalidOperationException("synthetic send failure");
+            }
+
             SentPrompts.Add(prompt);
             return Task.CompletedTask;
         }
 
         public Task SendTurnAsync(string sessionId, AppServerControlTurnRequest request, CancellationToken cancellationToken)
         {
+            if (SendFailuresRemaining > 0)
+            {
+                SendFailuresRemaining -= 1;
+                throw new InvalidOperationException("synthetic send failure");
+            }
+
             if (!UsesTurnQueueValue)
             {
                 if (!string.IsNullOrWhiteSpace(request.Text))
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/MidTermSettingsPublicTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/MidTermSettingsPublicTests.cs
index bb66e8e92..12f520e71 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/MidTermSettingsPublicTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/MidTermSettingsPublicTests.cs
@@ -1,3 +1,4 @@
+using System.Text.Json;
 using Ai.Tlbx.MidTerm.Models.Hub;
 using Ai.Tlbx.MidTerm.Settings;
 using Xunit;
@@ -6,6 +7,81 @@ namespace Ai.Tlbx.MidTerm.UnitTests;
 
 public sealed class MidTermSettingsPublicTests
 {
+    [Fact]
+    public void SettingsReplacement_RejectsPartialDocument()
+    {
+        var current = MidTermSettingsPublic.FromSettings(new MidTermSettings { UpdateChannel = "stable" });
+        using var document = JsonDocument.Parse("""{"updateChannel":"dev"}""");
+
+        var exception = Assert.Throws<ArgumentException>(
+            () => MidTermSettingsPatch.Replace(current, document.RootElement));
+
+        Assert.Contains("requires a complete settings document", exception.Message, StringComparison.Ordinal);
+        Assert.Contains("Use PATCH /api/settings", exception.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SettingsReplacement_AcceptsFullRoundTripDocument()
+    {
+        var current = MidTermSettingsPublic.FromSettings(new MidTermSettings
+        {
+            Language = LanguageSetting.English,
+            BackgroundImageEnabled = true,
+            UpdateChannel = "dev"
+        });
+        var json = JsonSerializer.Serialize(current, Ai.Tlbx.MidTerm.Services.AppJsonContext.Default.MidTermSettingsPublic);
+        using var document = JsonDocument.Parse(json);
+
+        var replacement = MidTermSettingsPatch.Replace(current, document.RootElement);
+
+        Assert.Equal(LanguageSetting.English, replacement.Language);
+        Assert.True(replacement.BackgroundImageEnabled);
+        Assert.Equal("dev", replacement.UpdateChannel);
+    }
+
+    [Fact]
+    public void SettingsPatch_RejectsUnknownProperty()
+    {
+        var current = MidTermSettingsPublic.FromSettings(new MidTermSettings());
+        using var document = JsonDocument.Parse("""{"updateChanel":"dev"}""");
+
+        var exception = Assert.Throws<ArgumentException>(
+            () => MidTermSettingsPatch.Merge(current, document.RootElement));
+
+        Assert.Contains("unknown settings: updateChanel", exception.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SettingsPatch_ChangesOnlyExplicitProperties()
+    {
+        var settings = new MidTermSettings
+        {
+            Language = LanguageSetting.English,
+            BackgroundImageEnabled = true,
+            BackgroundImageFileName = "app-background.png",
+            UiTransparency = 50,
+            TerminalColorSchemes =
+            [
+                new TerminalColorSchemeDefinition { Name = "Personal", Background = "#101010" }
+            ],
+            UpdateChannel = "stable"
+        };
+        var current = MidTermSettingsPublic.FromSettings(settings);
+        using var document = JsonDocument.Parse("""{"updateChannel":"dev"}""");
+
+        var merged = MidTermSettingsPatch.Merge(current, document.RootElement);
+        merged.ApplyTo(settings);
+
+        Assert.Equal("dev", settings.UpdateChannel);
+        Assert.Equal(LanguageSetting.English, settings.Language);
+        Assert.True(settings.BackgroundImageEnabled);
+        Assert.Equal("app-background.png", settings.BackgroundImageFileName);
+        Assert.Equal(50, settings.UiTransparency);
+        Assert.Collection(
+            settings.TerminalColorSchemes,
+            scheme => Assert.Equal("Personal", scheme.Name));
+    }
+
     [Fact]
     public void FromSettings_AndApplyTo_RoundTripTerminalTransparency()
     {
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/PutRequestContractTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/PutRequestContractTests.cs
new file mode 100644
index 000000000..df42ee2de
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/PutRequestContractTests.cs
@@ -0,0 +1,38 @@
+using System.Text.Json;
+using Ai.Tlbx.MidTerm.Services;
+using Xunit;
+
+namespace Ai.Tlbx.MidTerm.UnitTests;
+
+public sealed class PutRequestContractTests
+{
+    [Fact]
+    public void FileSaveRequest_RejectsMissingContent()
+    {
+        Assert.Throws<JsonException>(() =>
+            JsonSerializer.Deserialize("""{"path":"file.txt"}""", AppJsonContext.Default.FileSaveRequest));
+    }
+
+    [Fact]
+    public void HubMachineRequest_RejectsMissingEnabledState()
+    {
+        Assert.Throws<JsonException>(() =>
+            JsonSerializer.Deserialize(
+                """{"name":"server","baseUrl":"https://server"}""",
+                AppJsonContext.Default.HubMachineUpsertRequest));
+    }
+
+    [Fact]
+    public void SessionControlRequest_RejectsMissingState()
+    {
+        Assert.Throws<JsonException>(() =>
+            JsonSerializer.Deserialize("{}", AppJsonContext.Default.SetSessionControlRequest));
+    }
+
+    [Fact]
+    public void SessionLayoutRequest_RejectsMissingNullableStateFields()
+    {
+        Assert.Throws<JsonException>(() =>
+            JsonSerializer.Deserialize("""{"revision":1}""", AppJsonContext.Default.SessionLayoutState));
+    }
+}
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/ServerSetupTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/ServerSetupTests.cs
index 36d1b6464..0ab66103e 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/ServerSetupTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/ServerSetupTests.cs
@@ -28,6 +28,7 @@ public void BuildContentSecurityPolicy_WithoutPreviewOrigin_UsesDefaultFrameSour
     {
         var csp = ServerSetup.BuildContentSecurityPolicy();
 
+        Assert.Contains("script-src 'self' 'wasm-unsafe-eval';", csp, StringComparison.Ordinal);
         Assert.Contains("frame-src 'self' blob: data:;", csp, StringComparison.Ordinal);
     }
 
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/SessionAppServerControlHistoryServiceTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/SessionAppServerControlHistoryServiceTests.cs
index 0b970fff0..599e27348 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/SessionAppServerControlHistoryServiceTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/SessionAppServerControlHistoryServiceTests.cs
@@ -111,6 +111,27 @@ public void GetSnapshot_ReducesCanonicalAppServerControlEventsIntoRenderState()
             }
         });
         service.Append(new AppServerControlProviderEvent
+        {
+            EventId = "e5-resolved",
+            SessionId = "s1",
+            Provider = "codex",
+            ThreadId = "thread-1",
+            RequestId = "req-1",
+            CreatedAt = ParseUtc("2026-03-20T14:00:03.5000000Z"),
+            Type = "user-input.resolved",
+            UserInputResolved = new AppServerControlProviderUserInputResolvedPayload
+            {
+                Answers =
+                [
+                    new AppServerControlAnsweredQuestion
+                    {
+                        QuestionId = "q1",
+                        Answers = ["A"]
+                    }
+                ]
+            }
+        });
+        service.Append(new AppServerControlProviderEvent
         {
             EventId = "e6",
             SessionId = "s1",
@@ -202,8 +223,19 @@ public void GetSnapshot_ReducesCanonicalAppServerControlEventsIntoRenderState()
                     item.Attachments.Count == 1 &&
                     item.Attachments[0].DisplayName == "screenshot.png");
         Assert.Equal(2, snapshot.Requests.Count);
-        Assert.Contains(snapshot.Requests, request => request.Kind == "interview" && request.Questions.Count == 1);
+        Assert.Contains(
+            snapshot.Requests,
+            request => request.Kind == "interview" &&
+                       request.Questions.Count == 1 &&
+                       request.Answers.Count == 1);
         Assert.Contains(snapshot.Requests, request => request.Kind == "command_execution_approval" && request.Decision == "accept");
+        Assert.Contains(
+            snapshot.History,
+            entry => entry.ItemType == "interview" &&
+                     entry.RequestId == "req-1" &&
+                     entry.Questions.Count == 1 &&
+                     entry.Answers.Count == 1 &&
+                     entry.Answers[0].Answers.SequenceEqual(["A"], StringComparer.Ordinal));
     }
 
     [Fact]
@@ -2220,5 +2252,3 @@ private static bool WaitForCondition(Func<bool> predicate, int attempts = 80, in
 
 
 
-
-
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/ShellConfigurationsTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/ShellConfigurationsTests.cs
index c2d5598da..cdc2a231e 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/ShellConfigurationsTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/ShellConfigurationsTests.cs
@@ -34,7 +34,7 @@ public void GetEnvironmentVariables_AdvertisesAndForcesRichColorSupport()
 
         Assert.Equal("xterm-256color", env["TERM"]);
         Assert.Equal("truecolor", env["COLORTERM"]);
-        Assert.Equal("midterm", env["TERM_PROGRAM"]);
+        Assert.Equal("tlbx", env["TERM_PROGRAM"]);
         Assert.Equal("3", env["FORCE_COLOR"]);
         Assert.Equal("1", env["CLICOLOR"]);
         Assert.Equal("1", env["CLICOLOR_FORCE"]);
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/TlbxCliScriptWriterTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/TlbxCliScriptWriterTests.cs
index 6f9a3734b..407143813 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/TlbxCliScriptWriterTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/TlbxCliScriptWriterTests.cs
@@ -173,6 +173,8 @@ public void WriteScripts_WritesRemoteSessionControlHelpers()
         Assert.Contains("mt_prompt_now()", shell, StringComparison.Ordinal);
         Assert.Contains("mt_slash()", shell, StringComparison.Ordinal);
         Assert.Contains("mt_wake()", shell, StringComparison.Ordinal);
+        Assert.Contains("mt_recur()", shell, StringComparison.Ordinal);
+        Assert.Contains("mt_queue()", shell, StringComparison.Ordinal);
         Assert.Contains("mt_wake_cancel()", shell, StringComparison.Ordinal);
         Assert.Contains("mt_sendkeys()", shell, StringComparison.Ordinal);
         Assert.Contains("mt_inject()", shell, StringComparison.Ordinal);
@@ -202,6 +204,8 @@ public void WriteScripts_WritesRemoteSessionControlHelpers()
         Assert.Contains("function Mt-PromptNow", powershell, StringComparison.Ordinal);
         Assert.Contains("function Mt-Slash", powershell, StringComparison.Ordinal);
         Assert.Contains("function Mt-Wake", powershell, StringComparison.Ordinal);
+        Assert.Contains("function Mt-Recur", powershell, StringComparison.Ordinal);
+        Assert.Contains("function Mt-Queue", powershell, StringComparison.Ordinal);
         Assert.Contains("function Mt-WakeCancel", powershell, StringComparison.Ordinal);
         Assert.Contains("function Mt-SendKeys", powershell, StringComparison.Ordinal);
         Assert.Contains("function Mt-Inject", powershell, StringComparison.Ordinal);
@@ -228,6 +232,8 @@ public void WriteScripts_WritesRemoteSessionControlHelpers()
         Assert.Contains("Set-Alias -Name mt_paste -Value Mt-Paste", powershell, StringComparison.Ordinal);
         Assert.Contains("Set-Alias -Name mt_prompt -Value Mt-Prompt", powershell, StringComparison.Ordinal);
         Assert.Contains("Set-Alias -Name mt_wake -Value Mt-Wake", powershell, StringComparison.Ordinal);
+        Assert.Contains("Set-Alias -Name mt_recur -Value Mt-Recur", powershell, StringComparison.Ordinal);
+        Assert.Contains("Set-Alias -Name mt_queue -Value Mt-Queue", powershell, StringComparison.Ordinal);
         Assert.Contains("Set-Alias -Name mt_control_plane -Value Mt-ControlPlane", powershell, StringComparison.Ordinal);
         Assert.Contains("Set-Alias -Name mt_agent_capabilities -Value Mt-AgentCapabilities", powershell, StringComparison.Ordinal);
         Assert.Contains("Set-Alias -Name mt_dispatch -Value Mt-Dispatch", powershell, StringComparison.Ordinal);
@@ -513,6 +519,8 @@ public void Ensure_WritesAgentsGuidanceWithSessionScopedPreviewWorkflow()
         Assert.Contains("mt_prompt_now", agents, StringComparison.Ordinal);
         Assert.Contains("mt_slash", agents, StringComparison.Ordinal);
         Assert.Contains("mt_wake", agents, StringComparison.Ordinal);
+        Assert.Contains("mt_recur", agents, StringComparison.Ordinal);
+        Assert.Contains("mt_queue", agents, StringComparison.Ordinal);
         Assert.Contains("mt_sendkeys", agents, StringComparison.Ordinal);
         Assert.Contains("mt_activity", agents, StringComparison.Ordinal);
         Assert.Contains("mt_attention", agents, StringComparison.Ordinal);
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/TlbxProductIdentityTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/TlbxProductIdentityTests.cs
new file mode 100644
index 000000000..ef4249ae0
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/TlbxProductIdentityTests.cs
@@ -0,0 +1,79 @@
+using Ai.Tlbx.MidTerm.Common.Identity;
+using Xunit;
+
+namespace Ai.Tlbx.MidTerm.UnitTests;
+
+public sealed class TlbxProductIdentityTests : IDisposable
+{
+    private readonly string _root = Path.Combine(Path.GetTempPath(), $"tlbx_identity_{Guid.NewGuid():N}");
+
+    public void Dispose()
+    {
+        try
+        {
+            if (Directory.Exists(_root))
+            {
+                Directory.Delete(_root, recursive: true);
+            }
+        }
+        catch
+        {
+        }
+    }
+
+    [Fact]
+    public void SelectSettingsDirectory_DefaultsToCurrentTlbxLayout()
+    {
+        var current = Path.Combine(_root, ".tlbx");
+        var legacy = Path.Combine(_root, ".midterm");
+
+        Assert.Equal(current, TlbxProductIdentity.SelectSettingsDirectory(current, legacy));
+    }
+
+    [Fact]
+    public void SelectSettingsDirectory_PreservesMeaningfulLegacyLayout()
+    {
+        var current = Path.Combine(_root, ".tlbx");
+        var legacy = Path.Combine(_root, ".midterm");
+        Directory.CreateDirectory(legacy);
+        File.WriteAllText(Path.Combine(legacy, "settings.json"), "{}");
+
+        Assert.Equal(legacy, TlbxProductIdentity.SelectSettingsDirectory(current, legacy));
+    }
+
+    [Fact]
+    public void SelectSettingsDirectory_PrefersCurrentLayoutWhenBothExist()
+    {
+        var current = Path.Combine(_root, ".tlbx");
+        var legacy = Path.Combine(_root, ".midterm");
+        Directory.CreateDirectory(current);
+        Directory.CreateDirectory(legacy);
+        File.WriteAllText(Path.Combine(current, "settings.json"), "{}");
+        File.WriteAllText(Path.Combine(legacy, "settings.json"), "{}");
+
+        Assert.Equal(current, TlbxProductIdentity.SelectSettingsDirectory(current, legacy));
+    }
+
+    [Fact]
+    public void SelectSettingsDirectory_IgnoresLogOnlyCurrentDirectory()
+    {
+        var current = Path.Combine(_root, ".tlbx");
+        var legacy = Path.Combine(_root, ".midterm");
+        Directory.CreateDirectory(Path.Combine(current, "logs"));
+        Directory.CreateDirectory(legacy);
+        File.WriteAllText(Path.Combine(legacy, "settings.json"), "{}");
+
+        Assert.Equal(legacy, TlbxProductIdentity.SelectSettingsDirectory(current, legacy));
+    }
+
+    [Fact]
+    public void IsLegacySettingsDirectory_RecognizesLegacyMultiInstanceLayout()
+    {
+        var settingsDirectory = OperatingSystem.IsWindows()
+            ? Path.Combine(TlbxProductIdentity.GetLegacyWindowsServiceSettingsDirectory(), "instances", "alice")
+            : Path.Combine(TlbxProductIdentity.LegacyUnixMultiInstanceSettingsDirectory, "alice");
+
+        Assert.True(TlbxProductIdentity.IsLegacySettingsDirectory(settingsDirectory));
+        Assert.Equal(TlbxProductIdentity.LegacyCertificateFileName, TlbxProductIdentity.GetCertificateFileName(settingsDirectory));
+    }
+}
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/UpdateScriptGeneratorTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/UpdateScriptGeneratorTests.cs
index b0447a1b6..7f2f306d2 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/UpdateScriptGeneratorTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/UpdateScriptGeneratorTests.cs
@@ -151,6 +151,35 @@ public void GenerateUpdateScript_DeleteSourceFlag_IsConfigurable()
         }
     }
 
+    [Fact]
+    public void GenerateUpdateScript_RetainsPreviousResultUntilAtomicCompletionAndRecordsRollback()
+    {
+        var scriptText = ReadScript(
+            UpdateScriptGenerator.GenerateUpdateScript(
+                _extractedDir,
+                _currentBinaryPath,
+                _settingsDir,
+                UpdateType.Full,
+                deleteSourceAfter: true));
+
+        Assert.Contains("rollbackAttempted", scriptText, StringComparison.Ordinal);
+
+        if (OperatingSystem.IsWindows())
+        {
+            Assert.DoesNotContain("Remove-Item $ResultFile", scriptText, StringComparison.Ordinal);
+            Assert.Contains("$tempResultFile = \"$ResultFile.new\"", scriptText, StringComparison.Ordinal);
+            Assert.Contains("Move-Item -Path $tempResultFile -Destination $ResultFile -Force", scriptText, StringComparison.Ordinal);
+            Assert.Contains("WriteResult $false $errorMessage '' $rollbackAttempted", scriptText, StringComparison.Ordinal);
+        }
+        else
+        {
+            Assert.DoesNotContain("rm -f \"$RESULT_FILE\"", scriptText, StringComparison.Ordinal);
+            Assert.Contains("temp_result_file=\"$RESULT_FILE.new\"", scriptText, StringComparison.Ordinal);
+            Assert.Contains("mv -f \"$temp_result_file\" \"$RESULT_FILE\"", scriptText, StringComparison.Ordinal);
+            Assert.Contains("ROLLBACK_ATTEMPTED=true", scriptText, StringComparison.Ordinal);
+        }
+    }
+
     [Fact]
     public void GenerateUpdateScript_PathsWithSingleQuotes_AreEscaped()
     {
@@ -247,6 +276,30 @@ public void GenerateUpdateScript_FullUpdate_StopsMtAgentHostProcesses()
         }
     }
 
+    [Fact]
+    public void GenerateUpdateScript_WindowsFullUpdate_InstallsAndRollsBackConptyRuntime()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        var scriptText = ReadScript(
+            UpdateScriptGenerator.GenerateUpdateScript(
+                _extractedDir,
+                _currentBinaryPath,
+                _settingsDir,
+                UpdateType.Full,
+                deleteSourceAfter: true));
+
+        Assert.Contains("$ConptyRuntimeFiles", scriptText, StringComparison.Ordinal);
+        Assert.Contains("conpty.dll", scriptText, StringComparison.Ordinal);
+        Assert.Contains("x64\\OpenConsole.exe", scriptText, StringComparison.Ordinal);
+        Assert.Contains("THIRD-PARTY-LICENSES.txt", scriptText, StringComparison.Ordinal);
+        Assert.Contains("SafeCopy $newRuntimePath $currentRuntimePath $relativePath", scriptText, StringComparison.Ordinal);
+        Assert.Contains("$backupRuntimePath", scriptText, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void GenerateUpdateScript_Linux_StoresBackupsOutsideInstallDirectory()
     {
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/UpdateServiceTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/UpdateServiceTests.cs
index 8aa384020..bd511a814 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/UpdateServiceTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/UpdateServiceTests.cs
@@ -354,7 +354,8 @@ public void ReadUpdateResult_ValidFile_ReturnsParsedWithFoundTrue()
             Message = "done",
             Details = "ok",
             Timestamp = "2026-02-28T00:00:00Z",
-            LogFile = "update.log"
+            LogFile = "update.log",
+            RollbackAttempted = true
         };
         File.WriteAllText(path, JsonSerializer.Serialize(payload, AppJsonContext.Default.UpdateResult));
 
@@ -365,6 +366,7 @@ public void ReadUpdateResult_ValidFile_ReturnsParsedWithFoundTrue()
         Assert.True(result.Success);
         Assert.Equal("done", result.Message);
         Assert.Equal("ok", result.Details);
+        Assert.True(result.RollbackAttempted);
     }
 
     [Fact]
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/UpdateVerificationTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/UpdateVerificationTests.cs
index 9bcd0d22f..ae793def0 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/UpdateVerificationTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/UpdateVerificationTests.cs
@@ -79,6 +79,18 @@ public void VerifyUpdate_ValidMetadataSignatureAndChecksums_ReturnsTrue()
         Assert.True(Verify(manifest, "win-x64", "1.2.3-dev", "dev"));
     }
 
+    [Fact]
+    public void VerifyUpdate_SignedNestedRuntimePath_ReturnsTrue()
+    {
+        var filePath = WriteFile("x64/OpenConsole.exe", "signed ConPTY host");
+        var manifest = CreateManifest(new Dictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["x64/OpenConsole.exe"] = ComputeHash(filePath)
+        });
+
+        Assert.True(Verify(manifest));
+    }
+
     [Theory]
     [InlineData("linux-x64", "1.2.3-dev", "dev")]
     [InlineData("win-x64", "1.2.4-dev", "dev")]
@@ -216,6 +228,7 @@ private bool Verify(
     private string WriteFile(string name, string content)
     {
         var path = Path.Combine(_tempDir, name);
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
         File.WriteAllText(path, content);
         return path;
     }
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/WindowsFirewallServiceTests.cs b/src/Ai.Tlbx.MidTerm.UnitTests/WindowsFirewallServiceTests.cs
index c6265f123..0a93bd28e 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/WindowsFirewallServiceTests.cs
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/WindowsFirewallServiceTests.cs
@@ -35,7 +35,7 @@ public void GetStatus_ReturnsActiveRule_WhenManagedRuleMatchesCurrentProcess()
         Assert.True(status.RuleEnabled);
         Assert.True(status.MatchesCurrentPort);
         Assert.True(status.MatchesCurrentProgram);
-        Assert.Equal("MidTerm HTTPS", status.RuleName);
+        Assert.Equal("tlbx HTTPS", status.RuleName);
     }
 
     [Fact]
diff --git a/src/Ai.Tlbx.MidTerm.UnitTests/packages.lock.json b/src/Ai.Tlbx.MidTerm.UnitTests/packages.lock.json
index 22204e784..3c41d0032 100644
--- a/src/Ai.Tlbx.MidTerm.UnitTests/packages.lock.json
+++ b/src/Ai.Tlbx.MidTerm.UnitTests/packages.lock.json
@@ -91,6 +91,11 @@
           "Microsoft.TestPlatform.ObjectModel": "18.8.1"
         }
       },
+      "Microsoft.Windows.Console.ConPTY": {
+        "type": "Transitive",
+        "resolved": "1.24.260710001",
+        "contentHash": "JR1xAkZbNnAALBjzFpqSwEx7YZfD1LI228jF9j9cgKknBPCiFy9mpphlgH+TpTN8vajTUpcgg9Miy5Y8eUAH9g=="
+      },
       "SQLitePCLRaw.bundle_e_sqlite3": {
         "type": "Transitive",
         "resolved": "2.1.12",
@@ -184,7 +189,8 @@
       "mthost": {
         "type": "Project",
         "dependencies": {
-          "Ai.Tlbx.MidTerm.Common": "[4.0.1, )"
+          "Ai.Tlbx.MidTerm.Common": "[4.0.1, )",
+          "Microsoft.Windows.Console.ConPTY": "[1.24.260710001, )"
         }
       }
     }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Files/CommandModels.cs b/src/Ai.Tlbx.MidTerm/Models/Files/CommandModels.cs
index f90a1aeb4..7f3a996f1 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Files/CommandModels.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Files/CommandModels.cs
@@ -1,3 +1,5 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.Files;
 
 public sealed class ScriptDefinition
@@ -25,7 +27,10 @@ public sealed class CreateScriptRequest
 
 public sealed class UpdateScriptRequest
 {
+    [JsonRequired]
     public string SessionId { get; set; } = "";
+
+    [JsonRequired]
     public string Content { get; set; } = "";
 }
 
diff --git a/src/Ai.Tlbx.MidTerm/Models/Files/FileModels.cs b/src/Ai.Tlbx.MidTerm/Models/Files/FileModels.cs
index 1accd9ccd..b574e3351 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Files/FileModels.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Files/FileModels.cs
@@ -1,3 +1,5 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.Files;
 
 /// <summary>
@@ -94,7 +96,10 @@ public sealed class FileTreeEntry
 
 public sealed class FileSaveRequest
 {
+    [JsonRequired]
     public string Path { get; set; } = string.Empty;
+
+    [JsonRequired]
     public string Content { get; set; } = string.Empty;
 }
 
diff --git a/src/Ai.Tlbx.MidTerm/Models/Hub/HubMachineUpsertRequest.cs b/src/Ai.Tlbx.MidTerm/Models/Hub/HubMachineUpsertRequest.cs
index f202ae37d..53653b553 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Hub/HubMachineUpsertRequest.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Hub/HubMachineUpsertRequest.cs
@@ -1,9 +1,16 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.Hub;
 
 public sealed class HubMachineUpsertRequest
 {
+    [JsonRequired]
     public string Name { get; set; } = string.Empty;
+
+    [JsonRequired]
     public string BaseUrl { get; set; } = string.Empty;
+
+    [JsonRequired]
     public bool Enabled { get; set; } = true;
     public string? ApiKey { get; set; }
     public string? Password { get; set; }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEnqueueRequest.cs b/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEnqueueRequest.cs
index b69df95a5..6dd662549 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEnqueueRequest.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEnqueueRequest.cs
@@ -10,4 +10,6 @@ public sealed class ManagerBarQueueEnqueueRequest
     public AppServerControlTurnRequest? Turn { get; set; }
     public int? DelayMs { get; set; }
     public DateTimeOffset? RunAt { get; set; }
+    public int? RepeatEveryMs { get; set; }
+    public int? RepeatCount { get; set; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEntryDto.cs b/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEntryDto.cs
index fd7927e24..bdc7e3e59 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEntryDto.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Sessions/ManagerBarQueueEntryDto.cs
@@ -14,6 +14,8 @@ public sealed class ManagerBarQueueEntryDto
     public int NextPromptIndex { get; set; }
     public int CompletedCycles { get; set; }
     public DateTimeOffset? NextRunAt { get; set; }
+    public int? RepeatEveryMs { get; set; }
+    public int? RepeatCount { get; set; }
     public DateTimeOffset? IgnoreHeatUntil { get; set; }
     public bool AwaitingHeatRise { get; set; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Sessions/RenameSessionRequest.cs b/src/Ai.Tlbx.MidTerm/Models/Sessions/RenameSessionRequest.cs
index d4b6a6409..a1fbafc1e 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Sessions/RenameSessionRequest.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Sessions/RenameSessionRequest.cs
@@ -1,3 +1,5 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.Sessions;
 
 /// <summary>
@@ -5,5 +7,6 @@ namespace Ai.Tlbx.MidTerm.Models.Sessions;
 /// </summary>
 public sealed class RenameSessionRequest
 {
+    [JsonRequired]
     public string? Name { get; set; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Sessions/SessionLayoutState.cs b/src/Ai.Tlbx.MidTerm/Models/Sessions/SessionLayoutState.cs
index 4389ce6a8..64a310510 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Sessions/SessionLayoutState.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Sessions/SessionLayoutState.cs
@@ -19,8 +19,13 @@ public sealed class LayoutNode
 
 public sealed class SessionLayoutState
 {
+    [JsonRequired]
     public long Revision { get; set; }
+
+    [JsonRequired]
     public LayoutNode? Root { get; set; }
+
+    [JsonRequired]
     public string? FocusedSessionId { get; set; }
 }
 
diff --git a/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionControlRequest.cs b/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionControlRequest.cs
index c9db19b8b..2220e0633 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionControlRequest.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionControlRequest.cs
@@ -1,3 +1,5 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.Sessions;
 
 /// <summary>
@@ -5,5 +7,6 @@ namespace Ai.Tlbx.MidTerm.Models.Sessions;
 /// </summary>
 public sealed class SetSessionControlRequest
 {
+    [JsonRequired]
     public bool AgentControlled { get; init; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionNotesRequest.cs b/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionNotesRequest.cs
index e881ea12c..297122c02 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionNotesRequest.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionNotesRequest.cs
@@ -1,6 +1,9 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.Sessions;
 
 public sealed class SetSessionNotesRequest
 {
+    [JsonRequired]
     public string? Notes { get; init; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionTopicRequest.cs b/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionTopicRequest.cs
index 3e7b42943..4cde563cd 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionTopicRequest.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Sessions/SetSessionTopicRequest.cs
@@ -1,6 +1,9 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.Sessions;
 
 public sealed class SetSessionTopicRequest
 {
+    [JsonRequired]
     public string? Topic { get; init; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Models/System/BootstrapResponse.cs b/src/Ai.Tlbx.MidTerm/Models/System/BootstrapResponse.cs
index 129c937ba..545b593ea 100644
--- a/src/Ai.Tlbx.MidTerm/Models/System/BootstrapResponse.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/System/BootstrapResponse.cs
@@ -69,7 +69,7 @@ public sealed class BootstrapResponse
     public List<ShellInfoDto> Shells { get; init; } = [];
 
     /// <summary>
-    /// Update result from previous update (auto-cleared after read).
+    /// Update result from the previous update until the user dismisses it.
     /// Null if no update result exists.
     /// </summary>
     public UpdateResult? UpdateResult { get; init; }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Update/UpdateInfo.cs b/src/Ai.Tlbx.MidTerm/Models/Update/UpdateInfo.cs
index 1148d6b90..9a1cd0643 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Update/UpdateInfo.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Update/UpdateInfo.cs
@@ -14,6 +14,8 @@ public sealed class UpdateInfo
     public string? ReleaseNotes { get; init; }
     public UpdateType Type { get; init; } = UpdateType.Full;
     public bool SessionsPreserved => Type == UpdateType.WebOnly;
+    /// <summary>The last completed update attempt, retained until explicitly dismissed.</summary>
+    public UpdateResult? LastResult { get; set; }
 
     /// <summary>Local development environment name (MIDTERM_ENVIRONMENT).</summary>
     public string? Environment { get; init; }
diff --git a/src/Ai.Tlbx.MidTerm/Models/Update/UpdateResult.cs b/src/Ai.Tlbx.MidTerm/Models/Update/UpdateResult.cs
index ab1c9120c..bfb652f35 100644
--- a/src/Ai.Tlbx.MidTerm/Models/Update/UpdateResult.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/Update/UpdateResult.cs
@@ -11,4 +11,5 @@ public sealed class UpdateResult
     public string Details { get; set; } = "";
     public string Timestamp { get; set; } = "";
     public string LogFile { get; set; } = "";
+    public bool RollbackAttempted { get; set; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Models/WebPreview/WebPreviewTargetRequest.cs b/src/Ai.Tlbx.MidTerm/Models/WebPreview/WebPreviewTargetRequest.cs
index b0c2c4a35..3f99ee09d 100644
--- a/src/Ai.Tlbx.MidTerm/Models/WebPreview/WebPreviewTargetRequest.cs
+++ b/src/Ai.Tlbx.MidTerm/Models/WebPreview/WebPreviewTargetRequest.cs
@@ -1,9 +1,13 @@
+using System.Text.Json.Serialization;
+
 namespace Ai.Tlbx.MidTerm.Models.WebPreview;
 
 public sealed class WebPreviewTargetRequest
 {
     public string? SessionId { get; init; }
     public string? PreviewName { get; init; }
+
+    [JsonRequired]
     public string Url { get; init; } = "";
     public bool? ActivateSession { get; init; }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Program.cs b/src/Ai.Tlbx.MidTerm/Program.cs
index f2ae10590..61687f8cd 100644
--- a/src/Ai.Tlbx.MidTerm/Program.cs
+++ b/src/Ai.Tlbx.MidTerm/Program.cs
@@ -510,11 +510,11 @@ static void SyncTlbxDirectoryForCwd(string? cwd)
         }
         await sessionUpdateStateService.RestoreAsync(sessionManager, gitWatcher, shutdownService.Token);
         await spaceService.ReconcileSessionBindingsAsync(sessionManager, shutdownService.Token);
+        await appServerControlRuntime.DiscoverExistingSessionsAsync(sessionManager, shutdownService.Token);
         managerBarQueueService.PruneToValidSessions(sessionManager.GetAllSessions().Select(s => s.Id));
         managerBarQueueService.Start();
         var layoutSnapshot = layoutStateService.PruneToValidSessions(sessionManager.GetAllSessions().Select(s => s.Id));
         tmuxLayoutBridge?.UpdateLayout(layoutSnapshot.Root);
-        await appServerControlRuntime.DiscoverExistingSessionsAsync(sessionManager, shutdownService.Token);
         sleepInhibitorService.UpdateSessionCount(sessionManager.GetAllSessions().Count);
 
         async Task CleanupAsync()
diff --git a/src/Ai.Tlbx.MidTerm/Services/AppJsonContext.cs b/src/Ai.Tlbx.MidTerm/Services/AppJsonContext.cs
index a317b746b..7478007b1 100644
--- a/src/Ai.Tlbx.MidTerm/Services/AppJsonContext.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/AppJsonContext.cs
@@ -1,3 +1,4 @@
+using System.Text.Json;
 using System.Text.Json.Serialization;
 using Ai.Tlbx.MidTerm.Common.Protocol;
 using Ai.Tlbx.MidTerm.Models;
@@ -268,6 +269,7 @@ namespace Ai.Tlbx.MidTerm.Services;
 [JsonSerializable(typeof(ShareAccessMode))]
 
 // --- Settings ---
+[JsonSerializable(typeof(JsonElement))]
 [JsonSerializable(typeof(MidTermSettings))]
 [JsonSerializable(typeof(MidTermSettingsPublic))]
 [JsonSerializable(typeof(TerminalColorSchemeDefinition))]
@@ -386,4 +388,3 @@ public partial class AppJsonContext : JsonSerializerContext
 
 
 
-
diff --git a/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserEndpoints.cs b/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserEndpoints.cs
index 6c403d976..98e4104fd 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserEndpoints.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserEndpoints.cs
@@ -176,14 +176,15 @@ private static void MapUiEndpoints(
                 return Results.BadRequest("Invalid URL. Must be http://, https://, or a local file:/// URL, and cannot point to this server.");
             }
 
-            if (!uiBridge.RequestOpen(
+            var openResult = await uiBridge.RequestOpenWhenAvailableAsync(
                 sessionId,
                 previewName,
                 url,
                 activateSession,
-                out var error))
+                cancellationToken: cancellationToken);
+            if (!openResult.Success)
             {
-                return Results.Text(error + "\n", statusCode: 409);
+                return Results.Text(openResult.Error + "\n", statusCode: 409);
             }
 
             var status = await commandService.WaitForControllableAsync(
diff --git a/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserUiBridge.cs b/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserUiBridge.cs
index 88a16368f..ce8a50842 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserUiBridge.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Browser/BrowserUiBridge.cs
@@ -112,6 +112,35 @@ public bool RequestOpen(
         return true;
     }
 
+    public async Task<(bool Success, string Error)> RequestOpenWhenAvailableAsync(
+        string? sessionId,
+        string? previewName,
+        string url,
+        bool activateSession,
+        TimeSpan? timeout = null,
+        TimeSpan? pollInterval = null,
+        CancellationToken cancellationToken = default)
+    {
+        var deadline = DateTimeOffset.UtcNow + (timeout ?? TimeSpan.FromSeconds(4));
+        var retryDelay = pollInterval ?? TimeSpan.FromMilliseconds(100);
+        var lastError = "";
+
+        while (true)
+        {
+            if (RequestOpen(sessionId, previewName, url, activateSession, out lastError))
+            {
+                return (true, "");
+            }
+
+            if (DateTimeOffset.UtcNow >= deadline)
+            {
+                return (false, lastError);
+            }
+
+            await Task.Delay(retryDelay, cancellationToken).ConfigureAwait(false);
+        }
+    }
+
     public bool RequestMobileDevice(
         string? sessionId,
         string? previewName,
diff --git a/src/Ai.Tlbx.MidTerm/Services/Browser/TlbxCliScriptWriter.cs b/src/Ai.Tlbx.MidTerm/Services/Browser/TlbxCliScriptWriter.cs
index 45b9d435d..e5ac42cde 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Browser/TlbxCliScriptWriter.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Browser/TlbxCliScriptWriter.cs
@@ -582,6 +582,48 @@ local sid delay_arg amount unit delay_ms text
           local body="{\"sessionId\":\"$(_MJE "$sid")\",\"delayMs\":$delay_ms,\"turn\":{\"text\":\"$(_MJE "$text")\"} }"
           _MJ -d "$body" "$_MT/api/command-bay/queue"
         }
+        # mt_recur [SESSION_ID] INTERVAL TEXT  — repeat a prompt until its queue item is cancelled
+        mt_recur() {
+          local sid interval_arg amount unit interval_ms text
+          if [ $# -gt 0 ] && _MISID "$1"; then
+            sid="$1"
+            shift
+          else
+            sid="$(_MSID)"
+          fi
+          [ -n "$sid" ] || { echo "Session id required." >&2; return 1; }
+          [ $# -ge 2 ] || { echo "Usage: mt_recur [SESSION_ID] INTERVAL TEXT" >&2; return 1; }
+          interval_arg="$1"
+          shift
+          if [[ ! "$interval_arg" =~ ^([0-9]+)(ms|s|m|h|d)?$ ]]; then
+            echo "Interval must look like 30s, 5m, 2h, or 1d." >&2
+            return 1
+          fi
+          amount="${BASH_REMATCH[1]}"
+          unit="${BASH_REMATCH[2]:-m}"
+          case "$unit" in
+            ms) interval_ms="$amount" ;;
+            s) interval_ms=$((amount * 1000)) ;;
+            m) interval_ms=$((amount * 60000)) ;;
+            h) interval_ms=$((amount * 3600000)) ;;
+            d) interval_ms=$((amount * 86400000)) ;;
+            *) echo "Unsupported interval unit." >&2; return 1 ;;
+          esac
+          if [ "$interval_ms" -lt 1000 ] || [ "$interval_ms" -gt 2147483647 ]; then
+            echo "Interval must be between 1 second and 2147483647 ms." >&2
+            return 1
+          fi
+          text="$*"
+          local body="{\"sessionId\":\"$(_MJE "$sid")\",\"delayMs\":$interval_ms,\"repeatEveryMs\":$interval_ms,\"turn\":{\"text\":\"$(_MJE "$text")\"} }"
+          _MJ -d "$body" "$_MT/api/command-bay/queue"
+        }
+        # mt_queue [SESSION_ID]  — list queued one-shot and recurring prompts/actions
+        mt_queue() {
+          local sid
+          if [ $# -gt 0 ] && _MISID "$1"; then sid="$1"; else sid="$(_MSID)"; fi
+          [ -n "$sid" ] || { echo "Session id required." >&2; return 1; }
+          _MC "$_MT/api/command-bay/queue?sessionId=$(_MURLENC "$sid")"
+        }
         # mt_wake_cancel QUEUE_ID  — cancel a queued wake/prompt/action item
         mt_wake_cancel() {
           local queue_id="${1:-}"
@@ -1526,6 +1568,32 @@ function Mt-Wake {
                 turn = @{ text = $text }
             }) "$script:_MT/api/command-bay/queue"
         }
+        # Mt-Recur [SESSION_ID] INTERVAL TEXT  — repeat a prompt until its queue item is cancelled
+        function Mt-Recur {
+            param([Parameter(ValueFromRemainingArguments)][string[]]$InputArgs)
+            $resolved = _MResolveSessionArgs $InputArgs
+            $sessionId = $resolved.SessionId
+
+            if (-not $sessionId) { Write-Error "Session id required."; return }
+            if ($resolved.Remaining.Count -lt 2) { Write-Error "Usage: Mt-Recur [SESSION_ID] INTERVAL TEXT"; return }
+
+            $intervalMs = _MParseDelayMs $resolved.Remaining[0]
+            if ($intervalMs -lt 1000) { Write-Error "Interval must be at least 1 second."; return }
+            $text = [string]::Join(' ', @($resolved.Remaining[1..($resolved.Remaining.Count - 1)]))
+            _MJ -d (_MH @{
+                sessionId = $sessionId
+                delayMs = $intervalMs
+                repeatEveryMs = $intervalMs
+                turn = @{ text = $text }
+            }) "$script:_MT/api/command-bay/queue"
+        }
+        # Mt-Queue [SESSION_ID]  — list queued one-shot and recurring prompts/actions
+        function Mt-Queue {
+            param([Parameter(ValueFromRemainingArguments)][string[]]$InputArgs)
+            $resolved = _MResolveSessionArgs $InputArgs
+            if (-not $resolved.SessionId) { Write-Error "Session id required."; return }
+            _MC "$script:_MT/api/command-bay/queue?sessionId=$([Uri]::EscapeDataString($resolved.SessionId))"
+        }
         # Mt-WakeCancel QUEUE_ID  — cancel a queued wake/prompt/action item
         function Mt-WakeCancel {
             param([string]$QueueId)
@@ -1890,6 +1958,8 @@ function Mt-Mobile {
         Set-Alias -Name mt_prompt_now -Value Mt-PromptNow
         Set-Alias -Name mt_slash -Value Mt-Slash
         Set-Alias -Name mt_wake -Value Mt-Wake
+        Set-Alias -Name mt_recur -Value Mt-Recur
+        Set-Alias -Name mt_queue -Value Mt-Queue
         Set-Alias -Name mt_wake_cancel -Value Mt-WakeCancel
         Set-Alias -Name mt_sendkeys -Value Mt-SendKeys
         Set-Alias -Name mt_enter -Value Mt-Enter
diff --git a/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateGenerator.cs b/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateGenerator.cs
index 6c26d9f04..61bd587e8 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateGenerator.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateGenerator.cs
@@ -4,6 +4,7 @@
 using System.Net.Sockets;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
+using Ai.Tlbx.MidTerm.Common.Identity;
 
 namespace Ai.Tlbx.MidTerm.Services.Certificates;
 
@@ -12,18 +13,23 @@ public static class CertificateGenerator
     private const int ValidityYears = 2;
 
     /// <summary>
-    /// The CN used for certificates. Uses reverse-DNS style to avoid collisions with other apps.
+    /// The CN used for certificates created for fresh tlbx installations.
     /// This is the single source of truth - all code should reference this constant.
     /// </summary>
-    public const string CertificateSubject = "CN=ai.tlbx.midterm";
+    public const string CertificateSubject = TlbxProductIdentity.CertificateSubject;
 
-    public static X509Certificate2 GenerateSelfSigned(string[] dnsNames, string[] ipAddresses, bool useEcdsa = true)
+    public static X509Certificate2 GenerateSelfSigned(
+        string[] dnsNames,
+        string[] ipAddresses,
+        bool useEcdsa = true,
+        string? certificateSubject = null)
     {
+        certificateSubject ??= CertificateSubject;
         if (useEcdsa)
         {
             using var ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384);
             var request = new CertificateRequest(
-                CertificateSubject,
+                certificateSubject,
                 ecdsa,
                 HashAlgorithmName.SHA384);
             return CreateExportableSelfSignedCertificate(request, dnsNames, ipAddresses);
@@ -31,7 +37,7 @@ public static X509Certificate2 GenerateSelfSigned(string[] dnsNames, string[] ip
 
         using var rsa = RSA.Create(4096);
         var rsaRequest = new CertificateRequest(
-                CertificateSubject,
+                certificateSubject,
                 rsa,
                 HashAlgorithmName.SHA256,
                 RSASignaturePadding.Pkcs1);
@@ -206,7 +212,8 @@ public static void PrintTrustInstructions(string certPath, string[] dnsNames, st
             Console.WriteLine("  To trust on Linux:");
             Console.ForegroundColor = ConsoleColor.Cyan;
             Console.WriteLine($"    openssl pkcs12 -in \"{certPath}\" -out \"{pemPath}\" -nodes -password pass:");
-            Console.WriteLine($"    sudo cp \"{pemPath}\" /usr/local/share/ca-certificates/midterm.crt");
+            var certificateName = Path.GetFileNameWithoutExtension(certPath);
+            Console.WriteLine($"    sudo cp \"{pemPath}\" /usr/local/share/ca-certificates/{certificateName}.crt");
             Console.WriteLine("    sudo update-ca-certificates");
             Console.ResetColor();
         }
diff --git a/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateInfoService.cs b/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateInfoService.cs
index 3928d7a8f..5244dc8a4 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateInfoService.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateInfoService.cs
@@ -121,7 +121,7 @@ public CertificateDownloadInfo GetDownloadInfo()
             <key>PayloadDisplayName</key>
             <string>tlbx Certificate</string>
             <key>PayloadIdentifier</key>
-            <string>ai.tlbx.midterm.cert.{payloadUuid}</string>
+            <string>ai.tlbx.cert.{payloadUuid}</string>
             <key>PayloadType</key>
             <string>com.apple.security.root</string>
             <key>PayloadUUID</key>
@@ -135,7 +135,7 @@ public CertificateDownloadInfo GetDownloadInfo()
     <key>PayloadDisplayName</key>
     <string>tlbx Certificate</string>
     <key>PayloadIdentifier</key>
-    <string>ai.tlbx.midterm.profile.{profileUuid}</string>
+    <string>ai.tlbx.profile.{profileUuid}</string>
     <key>PayloadOrganization</key>
     <string>tlbx.ai</string>
     <key>PayloadRemovalDisallowed</key>
diff --git a/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateService.cs b/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateService.cs
index 075452bc6..63a4dd757 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateService.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Certificates/CertificateService.cs
@@ -1,4 +1,5 @@
 using System.Security.Cryptography.X509Certificates;
+using Ai.Tlbx.MidTerm.Common.Identity;
 using Ai.Tlbx.MidTerm.Common.Logging;
 using Ai.Tlbx.MidTerm.Services.Security;
 using Ai.Tlbx.MidTerm.Settings;
@@ -10,8 +11,8 @@ public static class CertificateService
     public static void RegenerateCertificate(SettingsService settingsService)
     {
         var settingsDir = Path.GetDirectoryName(settingsService.SettingsPath) ?? ".";
-        var certPath = Path.Combine(settingsDir, "midterm.pem");
-        const string keyId = "midterm";
+        var certPath = Path.Combine(settingsDir, TlbxProductIdentity.GetCertificateFileName(settingsDir));
+        var keyId = TlbxProductIdentity.GetCertificateKeyId(settingsDir);
 
         var isServiceInstall = settingsService.Load().IsServiceInstall || settingsService.IsRunningAsService;
         var protector = CertificateProtectorFactory.Create(settingsDir, isServiceInstall);
@@ -21,7 +22,11 @@ public static void RegenerateCertificate(SettingsService settingsService)
 
         var dnsNames = CertificateGenerator.GetDnsNames();
         var ipAddresses = CertificateGenerator.GetLocalIPAddresses();
-        using var cert = CertificateGenerator.GenerateSelfSigned(dnsNames, ipAddresses, useEcdsa: true);
+        using var cert = CertificateGenerator.GenerateSelfSigned(
+            dnsNames,
+            ipAddresses,
+            useEcdsa: true,
+            TlbxProductIdentity.GetCertificateSubject(settingsDir));
         CertificateGenerator.ExportPublicCertToPem(cert, certPath);
 
         var privateKeyBytes = CertificateGenerator.ExportPrivateKeyPkcs8(cert);
diff --git a/src/Ai.Tlbx.MidTerm/Services/Git/GitEndpoints.cs b/src/Ai.Tlbx.MidTerm/Services/Git/GitEndpoints.cs
index bc73db218..2b1ec92b1 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Git/GitEndpoints.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Git/GitEndpoints.cs
@@ -164,17 +164,23 @@ public static void MapGitEndpoints(WebApplication app, GitWatcherService gitWatc
                 return Results.BadRequest("sessionId required");
             }
 
-            var repoRoot = gitWatcher.ResolveRepoRoot(request.SessionId, request.RepoRoot);
-            if (repoRoot is not null)
+            if (!string.IsNullOrWhiteSpace(request.RepoRoot))
             {
+                var repoRoot = gitWatcher.ResolveRepoRoot(request.SessionId, request.RepoRoot);
+                if (repoRoot is null)
+                {
+                    return Results.BadRequest("Repository is not bound to this session");
+                }
+
                 await gitWatcher.RefreshStatusAsync(repoRoot);
             }
             else
             {
-                foreach (var repo in gitWatcher.GetRepoBindings(request.SessionId))
-                {
-                    await gitWatcher.RefreshStatusAsync(repo.RepoRoot);
-                }
+                var repoRoots = gitWatcher.GetRepoBindings(request.SessionId)
+                    .Select(static repo => repo.RepoRoot)
+                    .Distinct(StringComparer.OrdinalIgnoreCase)
+                    .ToArray();
+                await Task.WhenAll(repoRoots.Select(gitWatcher.RefreshStatusAsync));
             }
 
             return Results.Json(
diff --git a/src/Ai.Tlbx.MidTerm/Services/Git/GitWatcherService.cs b/src/Ai.Tlbx.MidTerm/Services/Git/GitWatcherService.cs
index ee3fce96b..f3ddc3d2d 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Git/GitWatcherService.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Git/GitWatcherService.cs
@@ -78,11 +78,29 @@ public void StartIndexWatcher(IEnumerable<string> gitDirs, FileSystemEventHandle
                 watcher.Filters.Add("index");
                 watcher.Filters.Add("HEAD");
                 watcher.Filters.Add("FETCH_HEAD");
+                watcher.Filters.Add("packed-refs");
                 watcher.Changed += onIndexChange;
                 watcher.Created += onIndexChange;
                 watcher.Renamed += (s, e) => onIndexChange(s, e);
                 watcher.EnableRaisingEvents = true;
                 _indexWatchers.Add(watcher);
+
+                var remoteRefsDir = Path.Combine(gitDir, "refs", "remotes");
+                if (Directory.Exists(remoteRefsDir))
+                {
+                    var remoteRefsWatcher = new FileSystemWatcher(remoteRefsDir)
+                    {
+                        Filter = "*",
+                        IncludeSubdirectories = true,
+                        NotifyFilter = NotifyFilters.LastWrite | NotifyFilters.FileName | NotifyFilters.DirectoryName
+                    };
+                    remoteRefsWatcher.Changed += onIndexChange;
+                    remoteRefsWatcher.Created += onIndexChange;
+                    remoteRefsWatcher.Deleted += onIndexChange;
+                    remoteRefsWatcher.Renamed += (s, e) => onIndexChange(s, e);
+                    remoteRefsWatcher.EnableRaisingEvents = true;
+                    _indexWatchers.Add(remoteRefsWatcher);
+                }
             }
         }
 
@@ -437,6 +455,37 @@ private GitRepoBinding CreateBinding(string repoRoot, string role, string source
     }
 
     public async Task RefreshStatusAsync(string repoRoot)
+    {
+        if (!_watchers.TryGetValue(repoRoot, out var watcher))
+        {
+            await RefreshStatusCoreAsync(repoRoot).ConfigureAwait(false);
+            return;
+        }
+
+        await watcher.RefreshGate.WaitAsync(CancellationToken.None).ConfigureAwait(false);
+        try
+        {
+            await _globalRefreshThrottle.WaitAsync(CancellationToken.None).ConfigureAwait(false);
+            try
+            {
+                do
+                {
+                    watcher.RefreshPending = false;
+                    await RefreshStatusCoreAsync(repoRoot).ConfigureAwait(false);
+                } while (watcher.RefreshPending && !watcher.IsDisposed);
+            }
+            finally
+            {
+                _globalRefreshThrottle.Release();
+            }
+        }
+        finally
+        {
+            watcher.RefreshGate.Release();
+        }
+    }
+
+    private async Task RefreshStatusCoreAsync(string repoRoot)
     {
         try
         {
@@ -445,18 +494,21 @@ public async Task RefreshStatusAsync(string repoRoot)
             var stashCountTask = GitCommandRunner.GetStashCountAsync(repoRoot);
             var numStatTask = GitCommandRunner.GetNumStatAsync(repoRoot);
 
-            await Task.WhenAll(statusTask, recentCommitsTask, stashCountTask, numStatTask);
+            await Task.WhenAll(statusTask, recentCommitsTask, stashCountTask, numStatTask).ConfigureAwait(false);
 
-            var status = await statusTask;
-            status.RecentCommits = await recentCommitsTask;
-            status.StashCount = await stashCountTask;
-            var numStat = await numStatTask;
-            MergeNumStat(status, numStat);
+            var status = await statusTask.ConfigureAwait(false);
+            status.RecentCommits = await recentCommitsTask.ConfigureAwait(false);
+            status.StashCount = await stashCountTask.ConfigureAwait(false);
+            MergeNumStat(status, await numStatTask.ConfigureAwait(false));
 
             if (_watchers.TryGetValue(repoRoot, out var watcher))
             {
                 var fingerprint = StatusFingerprint(status);
-                if (watcher.LastFingerprint == fingerprint) return;
+                if (watcher.LastFingerprint == fingerprint)
+                {
+                    return;
+                }
+
                 watcher.CachedStatus = status;
                 watcher.LastFingerprint = fingerprint;
             }
@@ -575,7 +627,7 @@ private async Task CoalescedRefreshAsync(string repoRoot, RepoWatcher watcher)
                 do
                 {
                     watcher.RefreshPending = false;
-                    await RefreshStatusAsync(repoRoot);
+                    await RefreshStatusCoreAsync(repoRoot).ConfigureAwait(false);
                 } while (watcher.RefreshPending && !watcher.IsDisposed);
             }
             finally
diff --git a/src/Ai.Tlbx.MidTerm/Services/Secrets/MacOsSecretStorage.cs b/src/Ai.Tlbx.MidTerm/Services/Secrets/MacOsSecretStorage.cs
index d352965c2..9d5d046b0 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Secrets/MacOsSecretStorage.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Secrets/MacOsSecretStorage.cs
@@ -3,6 +3,7 @@
 using System.Runtime.Versioning;
 using System.Text;
 using System.Security.Cryptography;
+using Ai.Tlbx.MidTerm.Common.Identity;
 using Ai.Tlbx.MidTerm.Common.Logging;
 
 namespace Ai.Tlbx.MidTerm.Services.Secrets;
@@ -15,7 +16,6 @@ namespace Ai.Tlbx.MidTerm.Services.Secrets;
 [SupportedOSPlatform("macos")]
 public sealed class MacOsSecretStorage : ISecretStorage
 {
-    private const string ServiceNamePrefix = "ai.tlbx.midterm";
     private const int ErrSecSuccess = 0;
     private const int ErrSecItemNotFound = -25300;
     private const int ErrSecDuplicateItem = -25299;
@@ -33,7 +33,7 @@ public MacOsSecretStorage(string settingsDirectory)
         var normalized = Path.GetFullPath(settingsDirectory);
         var hash = SHA256.HashData(Encoding.UTF8.GetBytes(normalized));
         var suffix = Convert.ToHexString(hash.AsSpan(0, 8)).ToLowerInvariant();
-        _serviceName = $"{ServiceNamePrefix}.{suffix}";
+        _serviceName = $"{TlbxProductIdentity.GetMacOsKeychainPrefix(normalized)}.{suffix}";
     }
 
     public string? GetSecret(string key)
diff --git a/src/Ai.Tlbx.MidTerm/Services/Security/WindowsFirewallService.cs b/src/Ai.Tlbx.MidTerm/Services/Security/WindowsFirewallService.cs
index af4ae2a30..60a65cb31 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Security/WindowsFirewallService.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Security/WindowsFirewallService.cs
@@ -9,15 +9,21 @@ namespace Ai.Tlbx.MidTerm.Services.Security;
 
 public sealed class WindowsFirewallService
 {
-    public const string ManagedRuleName = "MidTerm HTTPS";
+    public const string ManagedRuleName = "tlbx HTTPS";
+    public const string LegacyManagedRuleName = "MidTerm HTTPS";
 
     private readonly ServerBindingInfo _bindingInfo;
     private readonly IPowerShellCommandRunner _commandRunner;
+    private readonly string _managedRuleName;
 
-    public WindowsFirewallService(ServerBindingInfo bindingInfo, IPowerShellCommandRunner commandRunner)
+    public WindowsFirewallService(
+        ServerBindingInfo bindingInfo,
+        IPowerShellCommandRunner commandRunner,
+        string managedRuleName = ManagedRuleName)
     {
         _bindingInfo = bindingInfo;
         _commandRunner = commandRunner;
+        _managedRuleName = managedRuleName;
     }
 
     public FirewallRuleStatusResponse GetStatus()
@@ -55,7 +61,7 @@ public FirewallRuleStatusResponse GetStatus()
             Port = status.Port,
             BindAddress = status.BindAddress,
             LoopbackOnly = status.LoopbackOnly,
-            RuleName = ManagedRuleName,
+            RuleName = _managedRuleName,
             RulePresent = true,
             RuleEnabled = string.Equals(snapshot.Enabled, "True", StringComparison.OrdinalIgnoreCase),
             MatchesCurrentPort = string.Equals(snapshot.LocalPort, expectedPort, StringComparison.OrdinalIgnoreCase),
@@ -104,7 +110,7 @@ private FirewallRuleStatusResponse CreateBaseStatus()
             Port = _bindingInfo.Port,
             BindAddress = _bindingInfo.BindAddress,
             LoopbackOnly = IsLoopbackBinding(_bindingInfo.BindAddress),
-            RuleName = ManagedRuleName
+            RuleName = _managedRuleName
         };
     }
 
@@ -159,7 +165,7 @@ private static bool IsLoopbackBinding(string bindAddress)
 
     private string BuildStatusScript()
     {
-        var ruleName = EscapeForPowerShell(ManagedRuleName);
+        var ruleName = EscapeForPowerShell(_managedRuleName);
         return $$"""
 $ErrorActionPreference = 'Stop'
 Import-Module NetSecurity -ErrorAction Stop
@@ -183,7 +189,7 @@ exit 0
 
     private string BuildAddScript()
     {
-        var ruleName = EscapeForPowerShell(ManagedRuleName);
+        var ruleName = EscapeForPowerShell(_managedRuleName);
         var programPath = EscapeForPowerShell(GetCurrentProgramPath());
         var localPort = _bindingInfo.Port.ToString(CultureInfo.InvariantCulture);
         return $$"""
@@ -199,13 +205,13 @@ private string BuildAddScript()
   -Protocol TCP `
   -LocalPort {{localPort}} `
   -Program '{{programPath}}' `
-  -Description 'Allows inbound HTTPS access to MidTerm.' | Out-Null
+  -Description 'Allows inbound HTTPS access to tlbx.' | Out-Null
 """;
     }
 
     private string BuildRemoveScript()
     {
-        var ruleName = EscapeForPowerShell(ManagedRuleName);
+        var ruleName = EscapeForPowerShell(_managedRuleName);
         return $$"""
 $ErrorActionPreference = 'Stop'
 Import-Module NetSecurity -ErrorAction Stop
diff --git a/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueRuntime.cs b/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueRuntime.cs
index 676f233c0..8af0af2f2 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueRuntime.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueRuntime.cs
@@ -73,7 +73,7 @@ public bool IsTurnQueueReady(string sessionId)
 
         if (!_appServerControlRuntime.TryGetCachedHistoryWindow(sessionId, out var historyWindow))
         {
-            return true;
+            return false;
         }
 
         if (historyWindow.Requests.Any(static request =>
@@ -119,6 +119,9 @@ public async Task SendPromptAsync(string sessionId, string prompt, CancellationT
             {
                 return;
             }
+
+            throw new InvalidOperationException(
+                $"Agent Controller session {sessionId} is not attached; refusing PTY fallback.");
         }
 
         var promptBytes = Encoding.UTF8.GetBytes(prompt);
diff --git a/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueService.cs b/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueService.cs
index 4af0378ad..4a5a8a962 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueService.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Sessions/ManagerBarQueueService.cs
@@ -26,6 +26,7 @@ public sealed class ManagerBarQueueService : IAsyncDisposable
     private List<ManagerBarQueueEntryDto> _entries = [];
     private readonly Dictionary<string, RecentEnqueue> _recentEnqueues = new(StringComparer.Ordinal);
     private readonly HashSet<string> _activeImmediateDispatchSessions = new(StringComparer.Ordinal);
+    private readonly HashSet<string> _activeQueuedDispatchSessions = new(StringComparer.Ordinal);
     private string _serializedState = string.Empty;
     private Task? _processingTask;
 
@@ -124,17 +125,30 @@ public IReadOnlyList<ManagerBarQueueEntryDto> GetSnapshot(IEnumerable<string>? v
     public ManagerBarQueueEntryDto? EnqueuePromptAt(
         string sessionId,
         AppServerControlTurnRequest turn,
-        DateTimeOffset runAt)
+        DateTimeOffset runAt,
+        int? repeatEveryMs = null,
+        int? repeatCount = null)
     {
         if (!TryNormalizePromptSubmission(sessionId, turn, out var trimmedSessionId, out var normalizedTurn))
         {
             return null;
         }
 
+        if (repeatEveryMs is < 1000 || repeatCount is <= 1 || (repeatCount is not null && repeatEveryMs is null))
+        {
+            return null;
+        }
+
         ManagerBarQueueEntryDto entry;
         lock (_lock)
         {
-            entry = EnqueuePromptLocked(trimmedSessionId, normalizedTurn, QueuePhase.PendingInterval, runAt);
+            entry = EnqueuePromptLocked(
+                trimmedSessionId,
+                normalizedTurn,
+                QueuePhase.PendingInterval,
+                runAt,
+                repeatEveryMs,
+                repeatCount);
         }
 
         OnChanged?.Invoke();
@@ -423,7 +437,7 @@ private async Task ProcessEntriesAsync(CancellationToken cancellationToken)
 
         lock (_lock)
         {
-            var dispatchedSessions = new HashSet<string>(StringComparer.Ordinal);
+            var dispatchedSessions = new HashSet<string>(_activeQueuedDispatchSessions, StringComparer.Ordinal);
             for (var index = 0; index < _entries.Count;)
             {
                 var entry = _entries[index];
@@ -455,22 +469,9 @@ private async Task ProcessEntriesAsync(CancellationToken cancellationToken)
                 }
 
                 pendingSends.Add(dispatch);
-                var queueId = entry.QueueId;
-                var sessionId = entry.SessionId;
-                var usesTurnQueue = _runtime.UsesTurnQueue(sessionId);
-                var removed = AdvanceQueueEntry(entry, index, now);
-                if (!usesTurnQueue)
-                {
-                    ApplyTerminalRearmFenceLocked(sessionId, now, queueId);
-                }
-
-                dispatchedSessions.Add(sessionId);
-                changed = true;
-
-                if (!removed)
-                {
-                    index += 1;
-                }
+                _activeQueuedDispatchSessions.Add(entry.SessionId);
+                dispatchedSessions.Add(entry.SessionId);
+                index += 1;
             }
 
             if (changed)
@@ -486,6 +487,7 @@ private async Task ProcessEntriesAsync(CancellationToken cancellationToken)
 
         foreach (var send in pendingSends)
         {
+            var succeeded = false;
             try
             {
                 if (send.Kind == PromptQueueKind && send.Turn is not null)
@@ -496,6 +498,7 @@ private async Task ProcessEntriesAsync(CancellationToken cancellationToken)
                 {
                     await _runtime.SendPromptAsync(send.SessionId, send.Prompt, cancellationToken).ConfigureAwait(false);
                 }
+                succeeded = true;
             }
             catch (OperationCanceledException)
             {
@@ -505,6 +508,57 @@ private async Task ProcessEntriesAsync(CancellationToken cancellationToken)
             {
                 Log.Warn(() => $"Manager bar queue send failed for session {send.SessionId}: {ex.Message}");
             }
+            finally
+            {
+                CompleteQueueDispatch(send, succeeded);
+            }
+        }
+    }
+
+    private void CompleteQueueDispatch(PendingQueueDispatch send, bool succeeded)
+    {
+        var changed = false;
+        lock (_lock)
+        {
+            _activeQueuedDispatchSessions.Remove(send.SessionId);
+
+            var index = _entries.FindIndex(entry =>
+                string.Equals(entry.QueueId, send.QueueId, StringComparison.Ordinal));
+            if (index < 0)
+            {
+                return;
+            }
+
+            var entry = _entries[index];
+            var now = _timeProvider.GetUtcNow();
+            if (succeeded)
+            {
+                var removed = AdvanceQueueEntry(entry, index, now);
+                if (!_runtime.UsesTurnQueue(send.SessionId))
+                {
+                    ApplyTerminalRearmFenceLocked(send.SessionId, now, send.QueueId);
+                }
+
+                changed = removed || index < _entries.Count;
+            }
+            else
+            {
+                entry.Phase = QueuePhase.PendingInterval;
+                entry.NextRunAt = now.AddSeconds(5);
+                entry.IgnoreHeatUntil = null;
+                entry.AwaitingHeatRise = false;
+                changed = true;
+            }
+
+            if (changed)
+            {
+                PersistLocked();
+            }
+        }
+
+        if (changed)
+        {
+            OnChanged?.Invoke();
         }
     }
 
@@ -609,6 +663,17 @@ private bool AdvanceQueueEntry(ManagerBarQueueEntryDto entry, int index, DateTim
     {
         if (string.Equals(entry.Kind, PromptQueueKind, StringComparison.Ordinal))
         {
+            entry.CompletedCycles += 1;
+            if (entry.RepeatEveryMs is >= 1000 &&
+                (entry.RepeatCount is null || entry.CompletedCycles < entry.RepeatCount.Value))
+            {
+                entry.Phase = QueuePhase.PendingInterval;
+                entry.NextRunAt = now.AddMilliseconds(entry.RepeatEveryMs.Value);
+                entry.IgnoreHeatUntil = null;
+                entry.AwaitingHeatRise = false;
+                return false;
+            }
+
             _entries.RemoveAt(index);
             return true;
         }
@@ -749,7 +814,9 @@ private void PersistLocked()
                 return;
             }
 
-            File.WriteAllText(_statePath, _serializedState);
+            var tempPath = _statePath + ".new";
+            File.WriteAllText(tempPath, _serializedState);
+            File.Move(tempPath, _statePath, overwrite: true);
         }
         catch (Exception ex)
         {
@@ -848,8 +915,12 @@ private static string BuildEnqueueSignature(string sessionId, ManagerBarButton a
                 Turn = normalizedTurn,
                 Phase = ParsePhase(entry.Phase),
                 NextPromptIndex = 0,
-                CompletedCycles = 0,
+                CompletedCycles = Math.Max(0, entry.CompletedCycles),
                 NextRunAt = entry.NextRunAt,
+                RepeatEveryMs = entry.RepeatEveryMs is >= 1000 ? entry.RepeatEveryMs : null,
+                RepeatCount = entry.RepeatEveryMs is >= 1000 && entry.RepeatCount is > 1
+                    ? entry.RepeatCount
+                    : null,
                 IgnoreHeatUntil = entry.IgnoreHeatUntil,
                 AwaitingHeatRise = entry.AwaitingHeatRise
             };
@@ -921,6 +992,8 @@ private static ManagerBarQueueEntryDto CloneEntry(ManagerBarQueueEntryDto entry)
             NextPromptIndex = entry.NextPromptIndex,
             CompletedCycles = entry.CompletedCycles,
             NextRunAt = entry.NextRunAt,
+            RepeatEveryMs = entry.RepeatEveryMs,
+            RepeatCount = entry.RepeatCount,
             IgnoreHeatUntil = entry.IgnoreHeatUntil,
             AwaitingHeatRise = entry.AwaitingHeatRise
         };
@@ -991,12 +1064,14 @@ private static TimeSpan IntervalToTimeSpan(ManagerBarTrigger trigger)
         };
     }
 
-    private static DateTimeOffset? ComputeNextScheduleTime(
+    internal static DateTimeOffset? ComputeNextScheduleTime(
         IEnumerable<ManagerBarScheduleEntry> schedule,
-        DateTimeOffset from)
+        DateTimeOffset from,
+        TimeZoneInfo? timeZone = null)
     {
         DateTimeOffset? best = null;
-        var baseLocal = from.LocalDateTime;
+        timeZone ??= TimeZoneInfo.Local;
+        var baseLocal = TimeZoneInfo.ConvertTime(from, timeZone).DateTime;
 
         for (var dayOffset = 0; dayOffset < 8; dayOffset += 1)
         {
@@ -1017,16 +1092,29 @@ private static TimeSpan IntervalToTimeSpan(ManagerBarTrigger trigger)
                     continue;
                 }
 
-                var candidateLocal = day.AddHours(hours).AddMinutes(minutes);
-                var candidate = new DateTimeOffset(candidateLocal, from.Offset);
-                if (candidate <= from)
+                var candidateLocal = DateTime.SpecifyKind(
+                    day.AddHours(hours).AddMinutes(minutes),
+                    DateTimeKind.Unspecified);
+                if (timeZone.IsInvalidTime(candidateLocal))
                 {
                     continue;
                 }
 
-                if (best is null || candidate < best.Value)
+                var offsets = timeZone.IsAmbiguousTime(candidateLocal)
+                    ? timeZone.GetAmbiguousTimeOffsets(candidateLocal)
+                    : [timeZone.GetUtcOffset(candidateLocal)];
+                foreach (var offset in offsets)
                 {
-                    best = candidate;
+                    var candidate = new DateTimeOffset(candidateLocal, offset);
+                    if (candidate <= from)
+                    {
+                        continue;
+                    }
+
+                    if (best is null || candidate < best.Value)
+                    {
+                        best = candidate;
+                    }
                 }
             }
         }
@@ -1056,14 +1144,14 @@ private static string SerializeEntries(IReadOnlyList<ManagerBarQueueEntryDto> en
             var turn = NormalizeTurn(entry.Turn);
             return turn is null
                 ? null
-                : new PendingQueueDispatch(entry.SessionId, PromptQueueKind, turn.Text, turn);
+                : new PendingQueueDispatch(entry.QueueId, entry.SessionId, PromptQueueKind, turn.Text, turn);
         }
 
         var action = entry.Action?.Normalize();
         var prompt = action?.Prompts.ElementAtOrDefault(entry.NextPromptIndex);
         return string.IsNullOrWhiteSpace(prompt)
             ? null
-            : new PendingQueueDispatch(entry.SessionId, AutomationQueueKind, prompt, null);
+            : new PendingQueueDispatch(entry.QueueId, entry.SessionId, AutomationQueueKind, prompt, null);
     }
 
     private static AppServerControlTurnRequest? NormalizeTurn(AppServerControlTurnRequest? turn)
@@ -1164,6 +1252,7 @@ private static string SerializeEntries(IReadOnlyList<ManagerBarQueueEntryDto> en
     }
 
     private sealed record PendingQueueDispatch(
+        string QueueId,
         string SessionId,
         string Kind,
         string? Prompt,
@@ -1225,7 +1314,9 @@ private ManagerBarQueueEntryDto EnqueuePromptLocked(
         string sessionId,
         AppServerControlTurnRequest normalizedTurn,
         string phase = QueuePhase.PendingCooldown,
-        DateTimeOffset? nextRunAt = null)
+        DateTimeOffset? nextRunAt = null,
+        int? repeatEveryMs = null,
+        int? repeatCount = null)
     {
         var entry = new ManagerBarQueueEntryDto
         {
@@ -1238,6 +1329,8 @@ private ManagerBarQueueEntryDto EnqueuePromptLocked(
             NextPromptIndex = 0,
             CompletedCycles = 0,
             NextRunAt = nextRunAt,
+            RepeatEveryMs = repeatEveryMs,
+            RepeatCount = repeatCount,
             IgnoreHeatUntil = null,
             AwaitingHeatRise = false
         };
@@ -1249,7 +1342,8 @@ private ManagerBarQueueEntryDto EnqueuePromptLocked(
 
     private bool CanDispatchImmediatelyLocked(string sessionId)
     {
-        if (_entries.Count > 0 || _activeImmediateDispatchSessions.Count > 0)
+        if (_entries.Any(entry => string.Equals(entry.SessionId, sessionId, StringComparison.Ordinal)) ||
+            _activeImmediateDispatchSessions.Contains(sessionId))
         {
             return false;
         }
diff --git a/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionApiEndpoints.cs b/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionApiEndpoints.cs
index ca7d43876..8cb4613da 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionApiEndpoints.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionApiEndpoints.cs
@@ -151,7 +151,12 @@ async Task<IResult> EnqueueCommandBayQueueItem(ManagerBarQueueEnqueueRequest req
             {
                 if (runAt is not null)
                 {
-                    entry = managerBarQueueService.EnqueuePromptAt(request.SessionId, request.Turn, runAt.Value);
+                    entry = managerBarQueueService.EnqueuePromptAt(
+                        request.SessionId,
+                        request.Turn,
+                        runAt.Value,
+                        request.RepeatEveryMs,
+                        request.RepeatCount);
                     if (entry is null)
                     {
                         return Results.BadRequest("Only queued command-bay items can be enqueued.");
@@ -194,6 +199,21 @@ async Task<IResult> EnqueueCommandBayQueueItem(ManagerBarQueueEnqueueRequest req
 
         app.MapPost("/api/manager-bar/queue", EnqueueCommandBayQueueItem);
         app.MapPost("/api/command-bay/queue", EnqueueCommandBayQueueItem);
+        app.MapGet("/api/command-bay/queue", (string? sessionId) =>
+        {
+            if (string.IsNullOrWhiteSpace(sessionId))
+            {
+                return Results.BadRequest("sessionId required");
+            }
+
+            if (sessionManager.GetSession(sessionId) is null)
+            {
+                return Results.NotFound();
+            }
+
+            var entries = managerBarQueueService.GetSnapshot([sessionId]).ToList();
+            return Results.Json(entries, AppJsonContext.Default.ListManagerBarQueueEntryDto);
+        });
 
         IResult RemoveCommandBayQueueItem(string queueId)
         {
@@ -1228,8 +1248,43 @@ private static bool TryResolveQueueRunAt(
 
         var hasDelay = request.DelayMs is not null;
         var hasRunAt = request.RunAt is not null;
+        var hasRepeatInterval = request.RepeatEveryMs is not null;
+        if (request.RepeatCount is not null && !hasRepeatInterval)
+        {
+            error = "repeatCount requires repeatEveryMs.";
+            return false;
+        }
+
+        if (hasRepeatInterval)
+        {
+            var repeatEveryMs = request.RepeatEveryMs.GetValueOrDefault();
+            if (repeatEveryMs < 1000)
+            {
+                error = "repeatEveryMs must be at least 1000.";
+                return false;
+            }
+
+            if (request.RepeatCount is <= 1)
+            {
+                error = "repeatCount must be at least 2 when provided.";
+                return false;
+            }
+        }
+
         if (!hasDelay && !hasRunAt)
         {
+            if (hasRepeatInterval)
+            {
+                try
+                {
+                    runAt = now.AddMilliseconds(request.RepeatEveryMs!.Value);
+                }
+                catch (ArgumentOutOfRangeException)
+                {
+                    error = "repeatEveryMs is too large.";
+                    return false;
+                }
+            }
             return true;
         }
 
diff --git a/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionAppServerControlHostRuntimeService.cs b/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionAppServerControlHostRuntimeService.cs
index 2a22cb0f6..93c707949 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionAppServerControlHostRuntimeService.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Sessions/SessionAppServerControlHostRuntimeService.cs
@@ -1297,6 +1297,8 @@ private static AppServerControlHistoryItem CloneHistoryEntry(AppServerControlHis
             Attachments = source.Attachments.Select(CloneAttachment).ToList(),
             FileMentions = source.FileMentions.Select(CloneInlineFileReference).ToList(),
             ImagePreviews = source.ImagePreviews.Select(CloneInlineImagePreview).ToList(),
+            Questions = source.Questions.Select(CloneQuestion).ToList(),
+            Answers = source.Answers.Select(CloneAnsweredQuestion).ToList(),
             Streaming = source.Streaming,
             CreatedAt = source.CreatedAt,
             UpdatedAt = source.UpdatedAt
@@ -2166,4 +2168,3 @@ public void Close()
     }
 }
 
-
diff --git a/src/Ai.Tlbx.MidTerm/Services/TlbxDirectory.cs b/src/Ai.Tlbx.MidTerm/Services/TlbxDirectory.cs
index 4feab3b3a..42e945a9f 100644
--- a/src/Ai.Tlbx.MidTerm/Services/TlbxDirectory.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/TlbxDirectory.cs
@@ -330,6 +330,8 @@ Requires the web preview panel to be open in tlbx.
         | `mt_prompt_now [id] <text...>` | Force interrupt-first prompt delivery |
         | `mt_slash [id] <command...>` | Send slash commands through the prompt path |
         | `mt_wake [id] <delay> <text...>` | Queue a prompt to run later (`30s`, `5m`, `2h`, `1d`; visible and cancelable in the Command Bay queue) |
+        | `mt_recur [id] <interval> <text...>` | Repeat a prompt at an interval until its queue item is canceled |
+        | `mt_queue [id]` | List queued one-shot and recurring prompts/actions |
         | `mt_wake_cancel <queueId>` | Cancel a queued wake/prompt/action item by queue id |
         | `mt_sendkeys [id] <keys...>` | Send named keys like `Enter`, `C-c`, `Escape`, `Up` |
         | `mt_enter` / `mt_ctrlc` / `mt_escape` | Convenience key sends for the current or target session |
@@ -539,6 +541,7 @@ mt_repo list → mt_repo add "~/repos/lib" target → mt_repo refresh → check
         - mt_prompt_now is the explicit takeover helper for busy AI terminals when immediate interrupt-first execution is intended
         - mt_slash routes slash commands like `/status` or `/compact` through the same prompt path instead of pasting them manually
         - mt_wake queues a future prompt through the Command Bay queue, so delayed work survives helper reloads and can be canceled from the queue
+        - mt_recur uses the same persistent queue for recurring prompts; inspect it with mt_queue and stop it with mt_wake_cancel
         - mt_input_history and its show/replay/delete helpers expose the same session-scoped deterministic Terminal history available in each session's top bar; use them instead of scraping terminal output to recover prior prompts or pasted paths
         - mt_control_plane is the machine-readable operator outlet; use mt_work_add/update, mt_publish_status, and mt_checkpoint to make work and next actions visible without asking tlbx to infer them
         - mt_agent_capabilities reports product-authored feature flags and exact session runtime flags; mt_dispatch acts only on the session IDs you pass and returns a separate accepted/queued/error result for each
diff --git a/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateScriptGenerator.cs b/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateScriptGenerator.cs
index b2eb84c00..442708930 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateScriptGenerator.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateScriptGenerator.cs
@@ -1,5 +1,7 @@
 using System.Reflection;
 using System.Globalization;
+using System.Runtime.InteropServices;
+using Ai.Tlbx.MidTerm.Common.Identity;
 using Ai.Tlbx.MidTerm.Common.Logging;
 using Ai.Tlbx.MidTerm.Models.Update;
 using Ai.Tlbx.MidTerm.Startup;
@@ -84,6 +86,11 @@ private static string GenerateWindowsScript(string extractedDir, string currentB
         var logFilePath = Path.Combine(settingsDir, "update.log");
         var scriptPath = Path.Combine(Path.GetTempPath(), $"mt-update-{Guid.NewGuid():N}.ps1");
         var serviceName = EscapeForPowerShell(serviceIdentity.WindowsServiceName);
+        var certificateFileName = TlbxProductIdentity.GetCertificateFileName(settingsDir);
+        var conptyRuntimeFiles = RuntimeInformation.ProcessArchitecture == Architecture.X86
+            ? new[] { "conpty.dll", "x86\\OpenConsole.exe", "x64\\OpenConsole.exe", "arm64\\OpenConsole.exe", "THIRD-PARTY-LICENSES.txt" }
+            : new[] { "conpty.dll", "x64\\OpenConsole.exe", "arm64\\OpenConsole.exe", "THIRD-PARTY-LICENSES.txt" };
+        var conptyRuntimeFilesLiteral = string.Join(", ", conptyRuntimeFiles.Select(path => $"'{EscapeForPowerShell(path)}'"));
 
         var isWebOnly = updateType != UpdateType.Full;
 
@@ -119,6 +126,7 @@ private static string GenerateWindowsScript(string extractedDir, string currentB
 $IsWebOnly = ${(isWebOnly ? "true" : "false")}
 $DeleteSource = ${(deleteSourceAfter ? "true" : "false")}
 $ServiceName = '{serviceName}'
+$ConptyRuntimeFiles = @({conptyRuntimeFilesLiteral})
 
 # === Helper Functions ===
 
@@ -131,16 +139,19 @@ function Log {{
 }}
 
 function WriteResult {{
-    param([bool]$Success, [string]$Message, [string]$Details = '')
+    param([bool]$Success, [string]$Message, [string]$Details = '', [bool]$RollbackAttempted = $false)
     $result = @{{
         success = $Success
         message = $Message
         details = $Details
         timestamp = (Get-Date -Format 'o')
         logFile = $LogFile
+        rollbackAttempted = $RollbackAttempted
     }}
     try {{
-        $result | ConvertTo-Json -Depth 3 | Set-Content -Path $ResultFile -Encoding UTF8
+        $tempResultFile = ""$ResultFile.new""
+        $result | ConvertTo-Json -Depth 3 | Set-Content -Path $tempResultFile -Encoding UTF8
+        Move-Item -Path $tempResultFile -Destination $ResultFile -Force
     }} catch {{
         Log ""Failed to write result file: $_"" 'ERROR'
     }}
@@ -244,7 +255,6 @@ function SafeCopy {{
 
 # Clear previous logs
 Remove-Item $LogFile -Force -ErrorAction SilentlyContinue
-Remove-Item $ResultFile -Force -ErrorAction SilentlyContinue
 
 Log '=========================================='
 Log 'tlbx update starting'
@@ -264,6 +274,7 @@ function SafeCopy {{
 }}
 
 $rollbackNeeded = $false
+$rollbackAttempted = $false
 $startedOk = $false
 
 try {{
@@ -296,6 +307,12 @@ function SafeCopy {{
         Log 'Killing mthost.exe processes...'
         KillProcessByPath $CurrentMthost
 
+        foreach ($relativePath in $ConptyRuntimeFiles) {{
+            if ([IO.Path]::GetFileName($relativePath) -eq 'OpenConsole.exe') {{
+                KillProcessByPath (Join-Path $InstallDir $relativePath)
+            }}
+        }}
+
         if (Test-Path $CurrentAgentHost) {{
             Log 'Killing {AgentHostBinaryName}.exe processes...'
             KillProcessByPath $CurrentAgentHost
@@ -320,6 +337,15 @@ function SafeCopy {{
         }}
     }}
 
+    if (-not $IsWebOnly) {{
+        foreach ($relativePath in $ConptyRuntimeFiles) {{
+            $currentRuntimePath = Join-Path $InstallDir $relativePath
+            if ((Test-Path $currentRuntimePath) -and (-not (WaitForFileWritable $currentRuntimePath))) {{
+                throw ""ConPTY runtime file is still locked after $MaxRetries retries: $currentRuntimePath""
+            }}
+        }}
+    }}
+
     if ((-not $IsWebOnly) -and (Test-Path $CurrentAgentHost)) {{
         if (-not (WaitForFileWritable $CurrentAgentHost)) {{
             throw ""{AgentHostBinaryName}.exe is still locked after $MaxRetries retries. Another process may be using it.""
@@ -352,6 +378,16 @@ function SafeCopy {{
         Log 'mthost.exe backed up'
     }}
 
+    if (-not $IsWebOnly) {{
+        foreach ($relativePath in $ConptyRuntimeFiles) {{
+            $currentRuntimePath = Join-Path $InstallDir $relativePath
+            if (Test-Path $currentRuntimePath) {{
+                Log ""Backing up $relativePath...""
+                Copy-Item $currentRuntimePath ""$currentRuntimePath.bak"" -Force -ErrorAction Stop
+            }}
+        }}
+    }}
+
     if ((-not $IsWebOnly) -and (Test-Path $CurrentAgentHost)) {{
         Log 'Backing up {AgentHostBinaryName}.exe...'
         Copy-Item $CurrentAgentHost ""$CurrentAgentHost.bak"" -Force -ErrorAction Stop
@@ -475,6 +511,13 @@ function SafeCopy {{
 
     if ((-not $IsWebOnly) -and (Test-Path $NewMthost)) {{
         SafeCopy $NewMthost $CurrentMthost 'mthost.exe'
+
+        foreach ($relativePath in $ConptyRuntimeFiles) {{
+            $newRuntimePath = Join-Path $ExtractedDir $relativePath
+            $currentRuntimePath = Join-Path $InstallDir $relativePath
+            New-Item -ItemType Directory -Path (Split-Path -Parent $currentRuntimePath) -Force | Out-Null
+            SafeCopy $newRuntimePath $currentRuntimePath $relativePath
+        }}
     }}
 
     if ((-not $IsWebOnly) -and (Test-Path $NewAgentHost)) {{
@@ -609,6 +652,7 @@ function SafeCopy {{
     Log '==========================================' 'ERROR'
 
     if ($rollbackNeeded -and -not $startedOk) {{
+        $rollbackAttempted = $true
         Log ''
         Log '=== ROLLBACK ===' 'WARN'
 
@@ -646,6 +690,24 @@ function SafeCopy {{
             }}
         }}
 
+        if (-not $IsWebOnly) {{
+            foreach ($relativePath in $ConptyRuntimeFiles) {{
+                $currentRuntimePath = Join-Path $InstallDir $relativePath
+                $backupRuntimePath = ""$currentRuntimePath.bak""
+                try {{
+                    if (Test-Path $backupRuntimePath) {{
+                        New-Item -ItemType Directory -Path (Split-Path -Parent $currentRuntimePath) -Force | Out-Null
+                        Copy-Item $backupRuntimePath $currentRuntimePath -Force -ErrorAction Stop
+                        Log ""$relativePath restored""
+                    }} else {{
+                        Remove-Item $currentRuntimePath -Force -ErrorAction SilentlyContinue
+                    }}
+                }} catch {{
+                    Log ""Failed to restore $relativePath`: $_"" 'ERROR'
+                }}
+            }}
+        }}
+
         if (Test-Path ""$CurrentAgentHost.bak"") {{
             Log 'Restoring {AgentHostBinaryName}.exe from backup...'
             try {{
@@ -732,7 +794,7 @@ function SafeCopy {{
         Log 'Rollback complete'
     }}
 
-    WriteResult $false $errorMessage
+    WriteResult $false $errorMessage '' $rollbackAttempted
 }}
 
 # Self-cleanup
@@ -740,6 +802,7 @@ function SafeCopy {{
 Remove-Item $MyInvocation.MyCommand.Path -Force -ErrorAction SilentlyContinue
 ";
 
+        script = script.Replace("midterm.pem", certificateFileName, StringComparison.Ordinal);
         File.WriteAllText(scriptPath, script);
         return scriptPath;
     }
@@ -827,7 +890,11 @@ private static string GenerateUnixScript(string extractedDir, string currentBina
 DELETE_SOURCE={( deleteSourceAfter ? "true" : "false")}
 
 ROLLBACK_NEEDED=false
+ROLLBACK_ATTEMPTED=false
 STARTED_OK=false
+LAST_RESULT_SUCCESS=false
+LAST_RESULT_MESSAGE=""""
+LAST_RESULT_DETAILS=""""
 
 # Detect service user from existing config file ownership
 # On macOS, launchd service runs as user (via UserName in plist), not root
@@ -849,15 +916,22 @@ private static string GenerateUnixScript(string extractedDir, string currentBina
     local success=""$1""
     local message=""$2""
     local details=""${{3:-}}""
-    cat > ""$RESULT_FILE"" << RESULT_EOF
+    local rollback_attempted=""${{4:-false}}""
+    LAST_RESULT_SUCCESS=""$success""
+    LAST_RESULT_MESSAGE=""$message""
+    LAST_RESULT_DETAILS=""$details""
+    local temp_result_file=""$RESULT_FILE.new""
+    cat > ""$temp_result_file"" << RESULT_EOF
 {{
     ""success"": $success,
     ""message"": ""$message"",
     ""details"": ""$details"",
     ""timestamp"": ""$(date -u '+%Y-%m-%dT%H:%M:%SZ')"",
-    ""logFile"": ""$LOG_FILE""
+    ""logFile"": ""$LOG_FILE"",
+    ""rollbackAttempted"": $rollback_attempted
 }}
 RESULT_EOF
+    mv -f ""$temp_result_file"" ""$RESULT_FILE""
 }}
 
 describe_source_file() {{
@@ -985,6 +1059,7 @@ sleep 1
 cleanup() {{
     log """"
     if [[ ""$ROLLBACK_NEEDED"" == ""true"" ]] && [[ ""$STARTED_OK"" != ""true"" ]]; then
+        ROLLBACK_ATTEMPTED=true
         log ""=== ROLLBACK ==="" ""WARN""
 
         # Stop any partially started process
@@ -1046,6 +1121,7 @@ sleep 1
         fi
 
         log ""Rollback complete""
+        write_result ""$LAST_RESULT_SUCCESS"" ""$LAST_RESULT_MESSAGE"" ""$LAST_RESULT_DETAILS"" ""$ROLLBACK_ATTEMPTED""
     fi
 
     # Self-cleanup
@@ -1061,8 +1137,8 @@ trap cleanup EXIT
 mkdir -p ""$LOG_DIR"" 2>/dev/null || true
 mkdir -p ""$BACKUP_DIR"" 2>/dev/null || true
 
-# Log file is already truncated by exec > redirect at script start
-rm -f ""$RESULT_FILE"" 2>/dev/null || true
+# Log file is already truncated by exec > redirect at script start.
+# Keep the previous completed result visible until this attempt writes its own result.
 
 log '=========================================='
 log 'tlbx update script v{generatingVersion}'
@@ -1447,6 +1523,8 @@ exit 1
 write_result true ""Update completed successfully""
 ";
 
+        var certificateFileName = TlbxProductIdentity.GetCertificateFileName(settingsDirectory);
+        script = script.Replace("midterm.pem", certificateFileName, StringComparison.Ordinal);
         File.WriteAllText(scriptPath, script);
 
         // Set executable permission (Unix only)
diff --git a/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateService.cs b/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateService.cs
index f38779578..824c69b68 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateService.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateService.cs
@@ -1239,7 +1239,12 @@ private static (bool Success, string Message) TryApplyLinuxServiceWebOnlyUpdate(
                 currentVersionJsonPath,
                 backupVersionJsonPath,
                 writeLog);
-            WriteUpdateResult(artifacts, success: false, "Failed to install update", ex.Message);
+            WriteUpdateResult(
+                artifacts,
+                success: false,
+                "Failed to install update",
+                ex.Message,
+                rollbackAttempted: true);
             Log.Error(() => $"Failed to apply Linux web-only service update in-process: {ex.Message}");
             return (false, $"Failed to install update: {ex.Message}");
         }
@@ -1331,7 +1336,12 @@ private static (bool Success, string Message) TryApplyUnixUserUpdateInProcess(
         {
             writeLog($"Failed to apply Unix user update in-process: {ex.Message}", "ERROR");
             TryRestoreUnixFiles(replacedFiles, writeLog);
-            WriteUpdateResult(artifacts, success: false, "Failed to install update", ex.Message);
+            WriteUpdateResult(
+                artifacts,
+                success: false,
+                "Failed to install update",
+                ex.Message,
+                rollbackAttempted: true);
             return (false, $"Failed to install update: {ex.Message}");
         }
         finally
@@ -1485,7 +1495,6 @@ private static void ResetUpdateArtifacts(UpdateArtifacts artifacts)
         }
 
         try { File.WriteAllText(artifacts.LogPath, string.Empty); } catch { }
-        try { File.Delete(artifacts.ResultPath); } catch { }
     }
 
     private static void AppendUpdateLog(string logPath, string message, string level = "INFO")
@@ -1506,7 +1515,12 @@ private static void AppendUpdateLog(string logPath, string message, string level
         }
     }
 
-    private static void WriteUpdateResult(UpdateArtifacts artifacts, bool success, string message, string details = "")
+    private static void WriteUpdateResult(
+        UpdateArtifacts artifacts,
+        bool success,
+        string message,
+        string details = "",
+        bool rollbackAttempted = false)
     {
         try
         {
@@ -1516,12 +1530,13 @@ private static void WriteUpdateResult(UpdateArtifacts artifacts, bool success, s
                 Message = message,
                 Details = details,
                 Timestamp = DateTime.UtcNow.ToString("O", CultureInfo.InvariantCulture),
-                LogFile = artifacts.LogPath
+                LogFile = artifacts.LogPath,
+                RollbackAttempted = rollbackAttempted
             };
 
-            File.WriteAllText(
-                artifacts.ResultPath,
-                JsonSerializer.Serialize(result, AppJsonContext.Default.UpdateResult));
+            var tempPath = artifacts.ResultPath + ".new";
+            File.WriteAllText(tempPath, JsonSerializer.Serialize(result, AppJsonContext.Default.UpdateResult));
+            File.Move(tempPath, artifacts.ResultPath, overwrite: true);
         }
         catch (Exception ex)
         {
diff --git a/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateVerification.cs b/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateVerification.cs
index b800159b4..4876d370b 100644
--- a/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateVerification.cs
+++ b/src/Ai.Tlbx.MidTerm/Services/Updates/UpdateVerification.cs
@@ -84,15 +84,12 @@ private static bool VerifyUpdateCore(
         // Verify each file's checksum
         foreach (var (filename, expectedHash) in checksums)
         {
-            if (string.IsNullOrWhiteSpace(filename) ||
-                Path.IsPathRooted(filename) ||
-                !string.Equals(filename, Path.GetFileName(filename), StringComparison.Ordinal))
+            if (!TryResolveChecksumPath(extractDir, filename, out var filePath))
             {
                 Log.Warn(() => $"UpdateVerification: Unsafe checksum entry rejected: {filename}");
                 return false;
             }
 
-            var filePath = Path.Combine(extractDir, filename);
             if (!File.Exists(filePath))
             {
                 Log.Warn(() => $"UpdateVerification: Expected file not found: {filename}");
@@ -112,6 +109,31 @@ private static bool VerifyUpdateCore(
         return true;
     }
 
+    private static bool TryResolveChecksumPath(string extractDir, string filename, out string filePath)
+    {
+        filePath = "";
+        if (string.IsNullOrWhiteSpace(filename) || Path.IsPathRooted(filename))
+        {
+            return false;
+        }
+
+        var segments = filename.Replace('\\', '/').Split('/');
+        if (segments.Any(segment => string.IsNullOrWhiteSpace(segment) || segment is "." or ".."))
+        {
+            return false;
+        }
+
+        var extractRoot = Path.GetFullPath(extractDir);
+        var candidate = Path.GetFullPath(Path.Combine([extractRoot, .. segments]));
+        if (!candidate.StartsWith(extractRoot + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        filePath = candidate;
+        return true;
+    }
+
     /// <summary>
     /// Verifies the ECDSA signature and the exact metadata/checksum binding.
     /// </summary>
diff --git a/src/Ai.Tlbx.MidTerm/Settings/MidTermSettingsPatch.cs b/src/Ai.Tlbx.MidTerm/Settings/MidTermSettingsPatch.cs
new file mode 100644
index 000000000..a68822619
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm/Settings/MidTermSettingsPatch.cs
@@ -0,0 +1,109 @@
+using System.Globalization;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using Ai.Tlbx.MidTerm.Services;
+
+namespace Ai.Tlbx.MidTerm.Settings;
+
+public static class MidTermSettingsPatch
+{
+    public static MidTermSettingsPublic Replace(
+        MidTermSettingsPublic current,
+        JsonElement replacement)
+    {
+        ArgumentNullException.ThrowIfNull(current);
+        var contract = GetContract(current);
+        var suppliedProperties = ValidatePropertyNames(replacement, contract, "PUT /api/settings");
+        var missingProperties = contract
+            .Select(entry => entry.Key)
+            .Where(name => !suppliedProperties.Contains(name))
+            .Order(StringComparer.Ordinal)
+            .ToList();
+
+        if (missingProperties.Count > 0)
+        {
+            var shownProperties = string.Join(", ", missingProperties.Take(8));
+            var remainder = missingProperties.Count > 8
+                ? $" (and {(missingProperties.Count - 8).ToString(CultureInfo.InvariantCulture)} more)"
+                : string.Empty;
+            throw new ArgumentException(
+                $"PUT /api/settings requires a complete settings document. Missing: {shownProperties}{remainder}. " +
+                "Use PATCH /api/settings for partial updates.",
+                nameof(replacement));
+        }
+
+        return Merge(current, replacement);
+    }
+
+    public static MidTermSettingsPublic Merge(
+        MidTermSettingsPublic current,
+        JsonElement patch)
+    {
+        ArgumentNullException.ThrowIfNull(current);
+        var merged = GetContract(current);
+        ValidatePropertyNames(patch, merged, "PATCH /api/settings");
+
+        using var properties = patch.EnumerateObject();
+        while (properties.MoveNext())
+        {
+            var property = properties.Current;
+            var existingName = merged
+                .Select(entry => entry.Key)
+                .FirstOrDefault(name => string.Equals(name, property.Name, StringComparison.OrdinalIgnoreCase));
+            var propertyName = existingName ?? property.Name;
+            merged[propertyName] = JsonNode.Parse(property.Value.GetRawText());
+        }
+
+        return merged.Deserialize(AppJsonContext.Default.MidTermSettingsPublic)
+            ?? throw new ArgumentException("Settings payload could not be deserialized.", nameof(patch));
+    }
+
+    private static JsonObject GetContract(MidTermSettingsPublic current)
+    {
+        return JsonSerializer.SerializeToNode(
+            current,
+            AppJsonContext.Default.MidTermSettingsPublic) as JsonObject
+            ?? throw new InvalidOperationException("Failed to serialize current public settings.");
+    }
+
+    private static HashSet<string> ValidatePropertyNames(
+        JsonElement payload,
+        JsonObject contract,
+        string operation)
+    {
+        if (payload.ValueKind != JsonValueKind.Object)
+        {
+            throw new ArgumentException("Settings payload must be a JSON object.", nameof(payload));
+        }
+
+        var contractNames = contract.Select(entry => entry.Key).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var suppliedNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var unknownNames = new List<string>();
+
+        using var properties = payload.EnumerateObject();
+        while (properties.MoveNext())
+        {
+            var property = properties.Current;
+            if (!suppliedNames.Add(property.Name))
+            {
+                throw new ArgumentException(
+                    $"{operation} contains the duplicate property '{property.Name}'.",
+                    nameof(payload));
+            }
+
+            if (!contractNames.Contains(property.Name))
+            {
+                unknownNames.Add(property.Name);
+            }
+        }
+
+        if (unknownNames.Count > 0)
+        {
+            throw new ArgumentException(
+                $"{operation} contains unknown settings: {string.Join(", ", unknownNames.Order(StringComparer.Ordinal))}.",
+                nameof(payload));
+        }
+
+        return suppliedNames;
+    }
+}
diff --git a/src/Ai.Tlbx.MidTerm/Settings/SettingsService.cs b/src/Ai.Tlbx.MidTerm/Settings/SettingsService.cs
index 561f6f6e4..ad56f716b 100644
--- a/src/Ai.Tlbx.MidTerm/Settings/SettingsService.cs
+++ b/src/Ai.Tlbx.MidTerm/Settings/SettingsService.cs
@@ -1,5 +1,6 @@
 using System.Collections.Concurrent;
 using System.Text.Json;
+using Ai.Tlbx.MidTerm.Common.Identity;
 using Ai.Tlbx.MidTerm.Common.Logging;
 using Ai.Tlbx.MidTerm.Services;
 
@@ -9,6 +10,7 @@ namespace Ai.Tlbx.MidTerm.Settings;
 
 public sealed class SettingsService
 {
+    public const string TlbxSettingsDirectoryEnvironmentVariable = "TLBX_SETTINGS_DIR";
     public const string SettingsDirectoryEnvironmentVariable = "MIDTERM_SETTINGS_DIR";
     private readonly string _settingsPath;
     private readonly ISecretStorage _secretStorage;
@@ -65,26 +67,28 @@ private static string GetSettingsPath(bool isService)
         {
             if (OperatingSystem.IsWindows())
             {
-                // Windows service: %ProgramData%\MidTerm (typically C:\ProgramData\MidTerm)
-                var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
-                return Path.Combine(programData, "MidTerm", "settings.json");
-            }
-            else
-            {
-                // Unix service: lowercase 'midterm' - MUST match install.sh
-                return "/usr/local/etc/midterm/settings.json";
+                var directory = TlbxProductIdentity.SelectSettingsDirectory(
+                    TlbxProductIdentity.GetWindowsServiceSettingsDirectory(),
+                    TlbxProductIdentity.GetLegacyWindowsServiceSettingsDirectory());
+                return Path.Combine(directory, "settings.json");
             }
+
+            var unixDirectory = TlbxProductIdentity.SelectSettingsDirectory(
+                TlbxProductIdentity.UnixServiceSettingsDirectory,
+                TlbxProductIdentity.LegacyUnixServiceSettingsDirectory);
+            return Path.Combine(unixDirectory, "settings.json");
         }
 
-        // User mode: ~/.midterm
-        var userDir = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
-        var configDir = Path.Combine(userDir, ".midterm");
-        return Path.Combine(configDir, "settings.json");
+        var userDirectory = TlbxProductIdentity.SelectSettingsDirectory(
+            TlbxProductIdentity.GetUserSettingsDirectory(),
+            TlbxProductIdentity.GetLegacyUserSettingsDirectory());
+        return Path.Combine(userDirectory, "settings.json");
     }
 
     internal static string? GetSettingsDirectoryOverride()
     {
-        var overrideDirectory = Environment.GetEnvironmentVariable(SettingsDirectoryEnvironmentVariable);
+        var overrideDirectory = Environment.GetEnvironmentVariable(TlbxSettingsDirectoryEnvironmentVariable)
+            ?? Environment.GetEnvironmentVariable(SettingsDirectoryEnvironmentVariable);
         if (string.IsNullOrWhiteSpace(overrideDirectory))
         {
             return null;
@@ -95,7 +99,8 @@ private static string GetSettingsPath(bool isService)
 
     internal static bool? GetServiceModeOverride()
     {
-        var value = Environment.GetEnvironmentVariable(Ai.Tlbx.MidTerm.Startup.MidTermRuntimeOptions.ServiceModeEnvironmentVariable);
+        var value = Environment.GetEnvironmentVariable(Ai.Tlbx.MidTerm.Startup.MidTermRuntimeOptions.TlbxServiceModeEnvironmentVariable)
+            ?? Environment.GetEnvironmentVariable(Ai.Tlbx.MidTerm.Startup.MidTermRuntimeOptions.ServiceModeEnvironmentVariable);
         if (string.IsNullOrWhiteSpace(value))
         {
             return null;
@@ -134,29 +139,34 @@ private static bool DetectServiceMode()
             return IsWindowsService();
         }
 
-        var serviceSettingsPath = "/usr/local/etc/midterm/settings.json";
-        if (!File.Exists(serviceSettingsPath))
-        {
-            return false;
-        }
-
-        // Service settings file exists, but verify we can actually write to it.
-        // On macOS/Linux, a root-owned service install creates this file, but if mt
-        // is run manually by a non-root user, writes would silently fail (settings
-        // appear saved in-memory but never persist to disk). Fall back to user mode
-        // (~/.midterm/settings.json) when we don't have write access.
-        try
+        foreach (var serviceDirectory in new[]
         {
-            var dir = Path.GetDirectoryName(serviceSettingsPath)!;
-            var testPath = Path.Combine(dir, ".write-check");
-            File.WriteAllBytes(testPath, []);
-            File.Delete(testPath);
-            return true;
-        }
-        catch
+            TlbxProductIdentity.UnixServiceSettingsDirectory,
+            TlbxProductIdentity.LegacyUnixServiceSettingsDirectory
+        })
         {
-            return false;
+            var serviceSettingsPath = Path.Combine(serviceDirectory, "settings.json");
+            if (!File.Exists(serviceSettingsPath))
+            {
+                continue;
+            }
+
+            // A non-root interactive invocation must not select a root-owned
+            // service profile that it cannot persist.
+            try
+            {
+                var testPath = Path.Combine(serviceDirectory, ".write-check");
+                File.WriteAllBytes(testPath, []);
+                File.Delete(testPath);
+                return true;
+            }
+            catch
+            {
+                return false;
+            }
         }
+
+        return false;
     }
 
     private static bool IsWindowsService()
@@ -191,20 +201,22 @@ private static string ResolveDefaultWorktreeRootDirectory(MidTermSettings settin
         {
             if (OperatingSystem.IsWindows())
             {
-                var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
-                return Path.Combine(programData, "MidTerm", "Worktrees");
+                var directory = TlbxProductIdentity.SelectSettingsDirectory(
+                    TlbxProductIdentity.GetWindowsServiceSettingsDirectory(),
+                    TlbxProductIdentity.GetLegacyWindowsServiceSettingsDirectory());
+                return Path.Combine(directory, "Worktrees");
             }
 
-            return "/usr/local/etc/midterm/worktrees";
-        }
-
-        var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
-        if (OperatingSystem.IsWindows())
-        {
-            return Path.Combine(home, ".midTerm", "Worktrees");
+            var unixDirectory = TlbxProductIdentity.SelectSettingsDirectory(
+                TlbxProductIdentity.UnixServiceSettingsDirectory,
+                TlbxProductIdentity.LegacyUnixServiceSettingsDirectory);
+            return Path.Combine(unixDirectory, "worktrees");
         }
 
-        return Path.Combine(home, ".midterm", "worktrees");
+        var userDirectory = TlbxProductIdentity.SelectSettingsDirectory(
+            TlbxProductIdentity.GetUserSettingsDirectory(),
+            TlbxProductIdentity.GetLegacyUserSettingsDirectory());
+        return Path.Combine(userDirectory, OperatingSystem.IsWindows() ? "Worktrees" : "worktrees");
     }
 
     private static string NormalizeDirectoryPath(string path)
diff --git a/src/Ai.Tlbx.MidTerm/Startup/ArgumentParser.cs b/src/Ai.Tlbx.MidTerm/Startup/ArgumentParser.cs
index fa66a3c46..2af842e3c 100644
--- a/src/Ai.Tlbx.MidTerm/Startup/ArgumentParser.cs
+++ b/src/Ai.Tlbx.MidTerm/Startup/ArgumentParser.cs
@@ -1,4 +1,6 @@
 using System.Globalization;
+using System.Text.Json;
+using Ai.Tlbx.MidTerm.Common.Identity;
 using Ai.Tlbx.MidTerm.Settings;
 
 namespace Ai.Tlbx.MidTerm.Startup;
@@ -21,23 +23,30 @@ public static MidTermRuntimeOptions ParseOptions(string[] args)
         string? settingsDirectory = null;
         bool? serviceMode = null;
         var serviceIdentity = MidTermServiceIdentity.FromEnvironment();
+        var portWasSpecified = false;
+        var bindWasSpecified = false;
 
-        var envPort = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.PortEnvironmentVariable);
+        var envPort = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.TlbxPortEnvironmentVariable)
+            ?? Environment.GetEnvironmentVariable(MidTermRuntimeOptions.PortEnvironmentVariable);
         if (!string.IsNullOrWhiteSpace(envPort) &&
             int.TryParse(envPort, CultureInfo.InvariantCulture, out var parsedEnvPort))
         {
             port = parsedEnvPort;
+            portWasSpecified = true;
         }
 
-        var envBind = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.BindAddressEnvironmentVariable);
+        var envBind = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.TlbxBindAddressEnvironmentVariable)
+            ?? Environment.GetEnvironmentVariable(MidTermRuntimeOptions.BindAddressEnvironmentVariable);
         if (!string.IsNullOrWhiteSpace(envBind))
         {
             bindAddress = envBind.Trim();
+            bindWasSpecified = true;
         }
 
         settingsDirectory = SettingsService.GetSettingsDirectoryOverride();
 
-        var envServiceMode = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.ServiceModeEnvironmentVariable);
+        var envServiceMode = Environment.GetEnvironmentVariable(MidTermRuntimeOptions.TlbxServiceModeEnvironmentVariable)
+            ?? Environment.GetEnvironmentVariable(MidTermRuntimeOptions.ServiceModeEnvironmentVariable);
         if (!string.IsNullOrWhiteSpace(envServiceMode) &&
             bool.TryParse(envServiceMode, out var parsedServiceMode))
         {
@@ -49,11 +58,13 @@ public static MidTermRuntimeOptions ParseOptions(string[] args)
             if (args[i] == "--port" && i + 1 < args.Length && int.TryParse(args[i + 1], CultureInfo.InvariantCulture, out var p))
             {
                 port = p;
+                portWasSpecified = true;
                 i++;
             }
             else if (args[i] == "--bind" && i + 1 < args.Length)
             {
                 bindAddress = args[i + 1];
+                bindWasSpecified = true;
                 i++;
             }
             else if (args[i] == "--settings-dir" && i + 1 < args.Length)
@@ -86,6 +97,19 @@ public static MidTermRuntimeOptions ParseOptions(string[] args)
             }
         }
 
+        if (serviceMode != true && (!portWasSpecified || !bindWasSpecified))
+        {
+            var userSettingsDirectory = settingsDirectory ?? TlbxProductIdentity.SelectSettingsDirectory(
+                TlbxProductIdentity.GetUserSettingsDirectory(),
+                TlbxProductIdentity.GetLegacyUserSettingsDirectory());
+            ApplyUserRuntimeDefaults(
+                userSettingsDirectory,
+                ref port,
+                ref bindAddress,
+                portWasSpecified,
+                bindWasSpecified);
+        }
+
         return new MidTermRuntimeOptions(
             port,
             bindAddress,
@@ -93,4 +117,44 @@ public static MidTermRuntimeOptions ParseOptions(string[] args)
             serviceMode,
             serviceIdentity);
     }
+
+    private static void ApplyUserRuntimeDefaults(
+        string settingsDirectory,
+        ref int port,
+        ref string bindAddress,
+        bool portWasSpecified,
+        bool bindWasSpecified)
+    {
+        try
+        {
+            var path = Path.Combine(settingsDirectory, "runtime.json");
+            if (!File.Exists(path))
+            {
+                return;
+            }
+
+            using var document = JsonDocument.Parse(File.ReadAllText(path));
+            var root = document.RootElement;
+            if (!portWasSpecified &&
+                root.TryGetProperty("port", out var configuredPort) &&
+                configuredPort.TryGetInt32(out var parsedPort) &&
+                parsedPort is >= 1 and <= 65535)
+            {
+                port = parsedPort;
+            }
+
+            if (!bindWasSpecified &&
+                root.TryGetProperty("bindAddress", out var configuredBind) &&
+                configuredBind.ValueKind == JsonValueKind.String &&
+                !string.IsNullOrWhiteSpace(configuredBind.GetString()))
+            {
+                bindAddress = configuredBind.GetString()!.Trim();
+            }
+        }
+        catch
+        {
+            // A malformed optional launcher profile must not prevent explicit
+            // command-line and environment configuration from working.
+        }
+    }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Startup/CertificateSetup.cs b/src/Ai.Tlbx.MidTerm/Startup/CertificateSetup.cs
index 957615824..e7b3dc234 100644
--- a/src/Ai.Tlbx.MidTerm/Startup/CertificateSetup.cs
+++ b/src/Ai.Tlbx.MidTerm/Startup/CertificateSetup.cs
@@ -1,6 +1,7 @@
 using System.Globalization;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
+using Ai.Tlbx.MidTerm.Common.Identity;
 using Ai.Tlbx.MidTerm.Services;
 using Ai.Tlbx.MidTerm.Settings;
 
@@ -21,27 +22,11 @@ public static void GenerateCertificateCommand(bool force, bool serviceMode)
         var settingsService = new SettingsService();
         var settings = settingsService.Load();
 
-        string settingsDir;
-        if (serviceMode)
-        {
-            if (OperatingSystem.IsWindows())
-            {
-                var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
-                settingsDir = Path.Combine(programData, "MidTerm");
-            }
-            else
-            {
-                settingsDir = "/usr/local/etc/midterm";
-            }
-            Directory.CreateDirectory(settingsDir);
-        }
-        else
-        {
-            settingsDir = Path.GetDirectoryName(settingsService.SettingsPath) ?? ".";
-        }
+        var settingsDir = settingsService.SettingsDirectory;
+        Directory.CreateDirectory(settingsDir);
 
-        var certPath = Path.Combine(settingsDir, "midterm.pem");
-        var keyId = "midterm";
+        var certPath = Path.Combine(settingsDir, TlbxProductIdentity.GetCertificateFileName(settingsDir));
+        var keyId = TlbxProductIdentity.GetCertificateKeyId(settingsDir);
 
         if (File.Exists(certPath) && !force)
         {
@@ -60,7 +45,11 @@ public static void GenerateCertificateCommand(bool force, bool serviceMode)
         Console.WriteLine($"  DNS names: {string.Join(", ", dnsNames)}");
         Console.WriteLine($"  IP addresses: {string.Join(", ", ipAddresses)}");
 
-        using var cert = CertificateGenerator.GenerateSelfSigned(dnsNames, ipAddresses, useEcdsa: true);
+        using var cert = CertificateGenerator.GenerateSelfSigned(
+            dnsNames,
+            ipAddresses,
+            useEcdsa: true,
+            TlbxProductIdentity.GetCertificateSubject(settingsDir));
         CertificateGenerator.ExportPublicCertToPem(cert, certPath);
 
         var isService = serviceMode || settingsService.IsRunningAsService;
@@ -97,7 +86,7 @@ public static void GenerateCertificateCommand(bool force, bool serviceMode)
     {
         LastCertificateError = null;
         var settingsDir = Path.GetDirectoryName(settingsService.SettingsPath) ?? ".";
-        const string keyId = "midterm";
+        var keyId = ResolveCertificateKeyId(settingsDir, settings.CertificatePath);
 
         writeEventLog?.Invoke($"LoadOrGenerateCertificate: SettingsDir={settingsDir}, CertPath={settings.CertificatePath}, KeyProtection={settings.KeyProtection}", false);
 
@@ -107,8 +96,8 @@ public static void GenerateCertificateCommand(bool force, bool serviceMode)
 
             // Pre-flight validation: check key file exists
             var keyPath = OperatingSystem.IsWindows()
-                ? Path.Combine(settingsDir, "keys", "midterm.dpapi")
-                : Path.Combine(settingsDir, "midterm.key.enc");
+                ? Path.Combine(settingsDir, "keys", $"{keyId}.dpapi")
+                : Path.Combine(settingsDir, $"{keyId}.key.enc");
 
             if (!File.Exists(keyPath))
             {
@@ -208,11 +197,15 @@ public static void GenerateCertificateCommand(bool force, bool serviceMode)
 
         try
         {
-            var certPath = Path.Combine(settingsDir, "midterm.pem");
+            var certPath = Path.Combine(settingsDir, TlbxProductIdentity.GetCertificateFileName(settingsDir));
             var dnsNames = CertificateGenerator.GetDnsNames();
             var ipAddresses = CertificateGenerator.GetLocalIPAddresses();
 
-            using var cert = CertificateGenerator.GenerateSelfSigned(dnsNames, ipAddresses, useEcdsa: true);
+            using var cert = CertificateGenerator.GenerateSelfSigned(
+                dnsNames,
+                ipAddresses,
+                useEcdsa: true,
+                TlbxProductIdentity.GetCertificateSubject(settingsDir));
             CertificateGenerator.ExportPublicCertToPem(cert, certPath);
 
             // Use persisted flag with runtime detection as fallback
@@ -250,4 +243,17 @@ public static void GenerateCertificateCommand(bool force, bool serviceMode)
             return null;
         }
     }
+
+    private static string ResolveCertificateKeyId(string settingsDirectory, string? certificatePath)
+    {
+        if (!string.IsNullOrWhiteSpace(certificatePath) &&
+            Path.GetFileName(certificatePath).Equals(
+                TlbxProductIdentity.LegacyCertificateFileName,
+                StringComparison.OrdinalIgnoreCase))
+        {
+            return TlbxProductIdentity.LegacyCertificateKeyId;
+        }
+
+        return TlbxProductIdentity.GetCertificateKeyId(settingsDirectory);
+    }
 }
diff --git a/src/Ai.Tlbx.MidTerm/Startup/EndpointSetup.cs b/src/Ai.Tlbx.MidTerm/Startup/EndpointSetup.cs
index 087cd6866..ac4b09a76 100644
--- a/src/Ai.Tlbx.MidTerm/Startup/EndpointSetup.cs
+++ b/src/Ai.Tlbx.MidTerm/Startup/EndpointSetup.cs
@@ -2,6 +2,7 @@
 using System.Globalization;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
+using System.Text.Json;
 using Ai.Tlbx.MidTerm.Common.Logging;
 using Ai.Tlbx.MidTerm.Common.Shells;
 using Ai.Tlbx.MidTerm.Models;
@@ -267,7 +268,7 @@ public static void MapBootstrapEndpoints(
                 SupportsOsc7 = s.SupportsOsc7
             }).ToList();
 
-            var updateResult = UpdateService.ReadUpdateResult(settingsService.SettingsDirectory, clear: true);
+            var updateResult = UpdateService.ReadUpdateResult(settingsService.SettingsDirectory);
             var isDevMode = UpdateService.IsDevEnvironment || settings.DevMode;
             var displayVersion = GetDisplayVersion(version);
 
@@ -416,7 +417,7 @@ public static void MapSystemEndpoints(
             {
                 return Results.NotFound("Certificate not available");
             }
-            return Results.File(pemBytes, "application/x-pem-file", "midterm.pem");
+            return Results.File(pemBytes, "application/x-pem-file", "tlbx.pem");
         });
 
         app.MapGet("/api/certificate/download/crt", () =>
@@ -427,7 +428,7 @@ public static void MapSystemEndpoints(
             {
                 return Results.NotFound("Certificate not available");
             }
-            return Results.File(derBytes, "application/x-x509-ca-cert", "midterm.crt");
+            return Results.File(derBytes, "application/x-x509-ca-cert", "tlbx.crt");
         });
 
         app.MapGet("/api/certificate/download/mobileconfig", (HttpContext context) =>
@@ -439,7 +440,7 @@ public static void MapSystemEndpoints(
             {
                 return Results.NotFound("Certificate not available");
             }
-            return Results.File(configBytes, "application/x-apple-aspen-config", "midterm.mobileconfig");
+            return Results.File(configBytes, "application/x-apple-aspen-config", "tlbx.mobileconfig");
         });
 
         app.MapGet("/api/certificate/share-packet", (HttpContext context) =>
@@ -515,13 +516,14 @@ public static void MapSystemEndpoints(
 
         app.MapGet("/api/update/check", async () =>
         {
-            var update = await updateService.CheckForUpdateAsync();
-            return Results.Json(update ?? new UpdateInfo
+            var update = await updateService.CheckForUpdateAsync() ?? new UpdateInfo
             {
                 Available = false,
                 CurrentVersion = updateService.CurrentVersion,
                 LatestVersion = updateService.CurrentVersion
-            }, AppJsonContext.Default.UpdateInfo);
+            };
+            update.LastResult = UpdateService.ReadUpdateResult(settingsService.SettingsDirectory);
+            return Results.Json(update, AppJsonContext.Default.UpdateInfo);
         });
 
         app.MapPost("/api/update/apply", async (string? source) =>
@@ -651,17 +653,21 @@ public static void MapSystemEndpoints(
             return Results.Json(publicSettings, AppJsonContext.Default.MidTermSettingsPublic);
         });
 
-        app.MapPut("/api/settings", (Settings.MidTermSettingsPublic publicSettings) =>
+        IResult SaveSettings(JsonElement payload, bool partial, string method)
         {
             try
             {
                 var currentSettings = settingsService.Load();
                 var previousUpdateChannel = currentSettings.UpdateChannel;
+                var currentPublicSettings = MidTermSettingsPublic.FromSettings(currentSettings);
+                var publicSettings = partial
+                    ? MidTermSettingsPatch.Merge(currentPublicSettings, payload)
+                    : MidTermSettingsPatch.Replace(currentPublicSettings, payload);
                 publicSettings.ApplyTo(currentSettings);
                 if (!string.Equals(previousUpdateChannel, currentSettings.UpdateChannel, StringComparison.Ordinal))
                 {
                     Log.Warn(() =>
-                        $"UpdateChannel changing via PUT /api/settings: {previousUpdateChannel} -> {currentSettings.UpdateChannel}");
+                        $"UpdateChannel changing via {method} /api/settings: {previousUpdateChannel} -> {currentSettings.UpdateChannel}");
                 }
                 settingsService.Save(currentSettings);
                 return Results.Ok();
@@ -672,10 +678,18 @@ public static void MapSystemEndpoints(
             }
             catch (Exception ex)
             {
-                Common.Logging.Log.Exception(ex, "PUT /api/settings");
+                Common.Logging.Log.Exception(ex, $"{method} /api/settings");
                 return Results.Problem($"Failed to save settings: {ex.Message}");
             }
-        });
+        }
+
+        app.MapPut("/api/settings", (JsonElement replacement) =>
+            SaveSettings(replacement, partial: false, "PUT"))
+            .Accepts<MidTermSettingsPublic>("application/json");
+
+        app.MapPatch("/api/settings", (JsonElement patch) =>
+            SaveSettings(patch, partial: true, "PATCH"))
+            .Accepts<JsonElement>("application/json");
 
         app.MapPost("/api/settings/reload", () =>
         {
diff --git a/src/Ai.Tlbx.MidTerm/Startup/MidTermRuntimeOptions.cs b/src/Ai.Tlbx.MidTerm/Startup/MidTermRuntimeOptions.cs
index eb01d3382..dc8d4277f 100644
--- a/src/Ai.Tlbx.MidTerm/Startup/MidTermRuntimeOptions.cs
+++ b/src/Ai.Tlbx.MidTerm/Startup/MidTermRuntimeOptions.cs
@@ -10,6 +10,9 @@ public sealed record MidTermRuntimeOptions(
     bool? ServiceMode,
     MidTermServiceIdentity ServiceIdentity)
 {
+    public const string TlbxPortEnvironmentVariable = "TLBX_PORT";
+    public const string TlbxBindAddressEnvironmentVariable = "TLBX_BIND";
+    public const string TlbxServiceModeEnvironmentVariable = "TLBX_SERVICE_MODE";
     public const string PortEnvironmentVariable = "MIDTERM_PORT";
     public const string BindAddressEnvironmentVariable = "MIDTERM_BIND";
     public const string ServiceModeEnvironmentVariable = "MIDTERM_SERVICE_MODE";
@@ -18,17 +21,21 @@ public void ApplyProcessEnvironment()
     {
         Environment.SetEnvironmentVariable(PortEnvironmentVariable, Port.ToString(CultureInfo.InvariantCulture));
         Environment.SetEnvironmentVariable(BindAddressEnvironmentVariable, BindAddress);
+        Environment.SetEnvironmentVariable(TlbxPortEnvironmentVariable, Port.ToString(CultureInfo.InvariantCulture));
+        Environment.SetEnvironmentVariable(TlbxBindAddressEnvironmentVariable, BindAddress);
 
         if (!string.IsNullOrWhiteSpace(SettingsDirectory))
         {
-            Environment.SetEnvironmentVariable(
-                SettingsService.SettingsDirectoryEnvironmentVariable,
-                Path.GetFullPath(Environment.ExpandEnvironmentVariables(SettingsDirectory)));
+            var fullSettingsDirectory = Path.GetFullPath(Environment.ExpandEnvironmentVariables(SettingsDirectory));
+            Environment.SetEnvironmentVariable(SettingsService.TlbxSettingsDirectoryEnvironmentVariable, fullSettingsDirectory);
+            Environment.SetEnvironmentVariable(SettingsService.SettingsDirectoryEnvironmentVariable, fullSettingsDirectory);
         }
 
         if (ServiceMode is not null)
         {
-            Environment.SetEnvironmentVariable(ServiceModeEnvironmentVariable, ServiceMode.Value ? "true" : "false");
+            var value = ServiceMode.Value ? "true" : "false";
+            Environment.SetEnvironmentVariable(TlbxServiceModeEnvironmentVariable, value);
+            Environment.SetEnvironmentVariable(ServiceModeEnvironmentVariable, value);
         }
 
         ServiceIdentity.ApplyProcessEnvironment();
diff --git a/src/Ai.Tlbx.MidTerm/Startup/MidTermServiceIdentity.cs b/src/Ai.Tlbx.MidTerm/Startup/MidTermServiceIdentity.cs
index 4d4fa218e..b322b334f 100644
--- a/src/Ai.Tlbx.MidTerm/Startup/MidTermServiceIdentity.cs
+++ b/src/Ai.Tlbx.MidTerm/Startup/MidTermServiceIdentity.cs
@@ -7,6 +7,9 @@ public sealed record MidTermServiceIdentity(
     string LaunchdLabel,
     string SystemdServiceName)
 {
+    public const string TlbxWindowsServiceNameEnvironmentVariable = "TLBX_SERVICE_NAME";
+    public const string TlbxLaunchdLabelEnvironmentVariable = "TLBX_LAUNCHD_LABEL";
+    public const string TlbxSystemdServiceEnvironmentVariable = "TLBX_SYSTEMD_SERVICE";
     public const string WindowsServiceNameEnvironmentVariable = "MIDTERM_SERVICE_NAME";
     public const string LaunchdLabelEnvironmentVariable = "MIDTERM_LAUNCHD_LABEL";
     public const string SystemdServiceEnvironmentVariable = "MIDTERM_SYSTEMD_SERVICE";
@@ -21,12 +24,15 @@ public sealed record MidTermServiceIdentity(
         DefaultSystemdServiceName);
 
     public static MidTermServiceIdentity FromEnvironment() => new(
-        ResolveEnvironmentValue(WindowsServiceNameEnvironmentVariable, DefaultWindowsServiceName),
-        ResolveEnvironmentValue(LaunchdLabelEnvironmentVariable, DefaultLaunchdLabel),
-        ResolveEnvironmentValue(SystemdServiceEnvironmentVariable, DefaultSystemdServiceName));
+        ResolveEnvironmentValue(TlbxWindowsServiceNameEnvironmentVariable, WindowsServiceNameEnvironmentVariable, DefaultWindowsServiceName),
+        ResolveEnvironmentValue(TlbxLaunchdLabelEnvironmentVariable, LaunchdLabelEnvironmentVariable, DefaultLaunchdLabel),
+        ResolveEnvironmentValue(TlbxSystemdServiceEnvironmentVariable, SystemdServiceEnvironmentVariable, DefaultSystemdServiceName));
 
     public void ApplyProcessEnvironment()
     {
+        Environment.SetEnvironmentVariable(TlbxWindowsServiceNameEnvironmentVariable, WindowsServiceName);
+        Environment.SetEnvironmentVariable(TlbxLaunchdLabelEnvironmentVariable, LaunchdLabel);
+        Environment.SetEnvironmentVariable(TlbxSystemdServiceEnvironmentVariable, SystemdServiceName);
         Environment.SetEnvironmentVariable(WindowsServiceNameEnvironmentVariable, WindowsServiceName);
         Environment.SetEnvironmentVariable(LaunchdLabelEnvironmentVariable, LaunchdLabel);
         Environment.SetEnvironmentVariable(SystemdServiceEnvironmentVariable, SystemdServiceName);
@@ -41,9 +47,10 @@ public static string BuildInstanceLaunchdLabel(string instanceName) =>
     public static string BuildInstanceSystemdServiceName(string instanceName) =>
         string.Create(CultureInfo.InvariantCulture, $"midterm-{NormalizeInstanceName(instanceName).ToLowerInvariant()}");
 
-    private static string ResolveEnvironmentValue(string variableName, string fallback)
+    private static string ResolveEnvironmentValue(string preferredVariableName, string legacyVariableName, string fallback)
     {
-        var value = Environment.GetEnvironmentVariable(variableName);
+        var value = Environment.GetEnvironmentVariable(preferredVariableName)
+            ?? Environment.GetEnvironmentVariable(legacyVariableName);
         return string.IsNullOrWhiteSpace(value) ? fallback : value.Trim();
     }
 
diff --git a/src/Ai.Tlbx.MidTerm/Startup/ServerSetup.cs b/src/Ai.Tlbx.MidTerm/Startup/ServerSetup.cs
index 8a20e5c09..62938d37e 100644
--- a/src/Ai.Tlbx.MidTerm/Startup/ServerSetup.cs
+++ b/src/Ai.Tlbx.MidTerm/Startup/ServerSetup.cs
@@ -2,6 +2,7 @@
 using System.Reflection;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
+using Ai.Tlbx.MidTerm.Common.Identity;
 using Ai.Tlbx.MidTerm.Common.Shells;
 using Ai.Tlbx.MidTerm.Services;
 using Ai.Tlbx.MidTerm.Settings;
@@ -136,7 +137,12 @@ public static WebApplicationBuilder CreateBuilder(string[] args, Action<string,
         builder.Services.AddSingleton<SecurityStatusService>();
         builder.Services.AddSingleton<ApiKeyService>();
         builder.Services.AddSingleton<IPowerShellCommandRunner, WindowsPowerShellCommandRunner>();
-        builder.Services.AddSingleton<WindowsFirewallService>();
+        builder.Services.AddSingleton(sp => new WindowsFirewallService(
+            sp.GetRequiredService<ServerBindingInfo>(),
+            sp.GetRequiredService<IPowerShellCommandRunner>(),
+            TlbxProductIdentity.IsLegacySettingsDirectory(settingsService.SettingsDirectory)
+                ? WindowsFirewallService.LegacyManagedRuleName
+                : WindowsFirewallService.ManagedRuleName));
         builder.Services.AddSingleton<MainBrowserService>();
         builder.Services.AddSingleton<BackgroundImageService>();
         builder.Services.AddSingleton<ClipboardService>();
@@ -427,7 +433,7 @@ internal static string BuildContentSecurityPolicy(string? previewOrigin = null)
         }
 
         return "default-src 'self'; " +
-               "script-src 'self'; " +
+               "script-src 'self' 'wasm-unsafe-eval'; " +
                "worker-src 'self' blob:; " +
                "style-src 'self' 'unsafe-inline'; " +
                "img-src 'self' data:; " +
diff --git a/src/Ai.Tlbx.MidTerm/frontend-build.ps1 b/src/Ai.Tlbx.MidTerm/frontend-build.ps1
index 57406eb71..e3b41519f 100644
--- a/src/Ai.Tlbx.MidTerm/frontend-build.ps1
+++ b/src/Ai.Tlbx.MidTerm/frontend-build.ps1
@@ -21,6 +21,7 @@ param(
     [switch]$Publish,        # Enable Brotli compression for publish builds
     [switch]$DevRelease,     # Include source maps in publish (for dev/prerelease builds)
     [switch]$SkipVerify,     # Skip npm verify/lint/typecheck gates when another job already owns them
+    [switch]$StaticOnly,     # Rebuild transformed static assets without regenerating or bundling TypeScript
     [string]$Version = "dev" # Version to inject into BUILD_VERSION
 )
 
@@ -34,6 +35,10 @@ $RepoRoot = Resolve-Path (Join-Path $PSScriptRoot "../..")
 $NodeModulesRoot = Join-Path $PSScriptRoot "node_modules"
 $AssetVersionPlaceholder = "__MIDTERM_ASSET_VERSION__"
 
+if ($StaticOnly -and $Publish) {
+    throw "-StaticOnly is a source-dev operation and cannot be combined with -Publish."
+}
+
 if (Test-Path $WwwRoot) {
     Get-ChildItem -Path $WwwRoot -Filter "*.br" -File -Recurse | Remove-Item -Force
 }
@@ -181,6 +186,7 @@ $GeneratedTypes = Join-Path $TsSource "api.generated.ts"
 $SwaggerSource = Join-Path $StaticSource "swagger"
 $SwaggerUiRoot = Join-Path $NodeModulesRoot "swagger-ui-dist"
 
+if (-not $StaticOnly) {
 Write-Host "Generating API types from OpenAPI spec..." -ForegroundColor Cyan
 
 # Build OpenAPI project to regenerate spec
@@ -209,6 +215,7 @@ if ($LASTEXITCODE -ne 0) { Write-Error "openapi-typescript failed"; exit $LASTEX
 if ($LASTEXITCODE -ne 0) { Write-Error "prettier formatting failed"; exit $LASTEXITCODE }
 
 Write-Host "  api.generated.ts updated" -ForegroundColor DarkGray
+}
 
 $AssetVersion = Get-AssetFingerprint -Paths @(
     $TsSource,
@@ -224,7 +231,10 @@ Write-Host "Asset fingerprint: $AssetVersion" -ForegroundColor DarkGray
 # ===========================================
 # PHASE 1+2: Static verification
 # ===========================================
-if ($Publish) {
+if ($StaticOnly) {
+    Write-Host "Skipping TypeScript verification for static-only sync..." -ForegroundColor DarkGray
+}
+elseif ($Publish) {
     if ($SkipVerify) {
         Write-Host "Skipping publish TypeScript/lint/test gate..." -ForegroundColor Yellow
     }
@@ -240,6 +250,7 @@ else {
 # ===========================================
 # PHASE 3: Bundle with esbuild
 # ===========================================
+if (-not $StaticOnly) {
 Write-Host "Bundling with esbuild (version: $Version, assets: $AssetVersion)..." -ForegroundColor Cyan
 
 $mainTs = Join-Path $TsSource "main.ts"
@@ -260,10 +271,31 @@ if ($LASTEXITCODE -ne 0) {
 
 $jsSize = (Get-Item $OutFile).Length
 Write-Host "  terminal.min.js ($([math]::Round($jsSize/1KB, 1)) KB)" -ForegroundColor DarkGray
+}
 
 # ===========================================
 # PHASE 4: Copy binary assets
 # ===========================================
+if ($StaticOnly) {
+    # Source-dev sync is an exact mirror for static-owned destinations so deletes
+    # do not survive in wwwroot. Generated bundles and vendor assets stay intact.
+    Get-ChildItem -Path $WwwRoot -File -ErrorAction SilentlyContinue |
+        Where-Object { $_.Extension -in @('.html', '.txt', '.json', '.webmanifest', '.svg', '.png', '.ico', '.css', '.js') } |
+        Remove-Item -Force
+    foreach ($ownedDir in @('css', 'fonts', 'img', 'locales')) {
+        $ownedPath = Join-Path $WwwRoot $ownedDir
+        if (Test-Path $ownedPath) {
+            Get-ChildItem -Path $ownedPath -File -Recurse | Remove-Item -Force
+        }
+    }
+    $jsDir = Join-Path $WwwRoot 'js'
+    if (Test-Path $jsDir) {
+        Get-ChildItem -Path $jsDir -Filter '*.js' -File |
+            Where-Object { $_.Name -notin @('terminal.min.js', 'html2canvas.min.js') } |
+            Remove-Item -Force
+    }
+}
+
 # Binary asset compression notes (tested 2025-01):
 #   - woff2 files are already Brotli-compressed internally, so most don't benefit
 #   - EXCEPT Terminus.woff2 which has 62% reduction (unoptimized metadata?)
@@ -643,4 +675,4 @@ if ($Publish) {
     Write-Host "  Total saved: $([math]::Round($totalSaved/1KB, 1)) KB" -ForegroundColor Green
 }
 
-Write-Host "Frontend build complete" -ForegroundColor Green
+Write-Host $(if ($StaticOnly) { "Static asset sync complete" } else { "Frontend build complete" }) -ForegroundColor Green
diff --git a/src/Ai.Tlbx.MidTerm/openapi/openapi.json b/src/Ai.Tlbx.MidTerm/openapi/openapi.json
index 78dd915f1..6d0aaf260 100644
--- a/src/Ai.Tlbx.MidTerm/openapi/openapi.json
+++ b/src/Ai.Tlbx.MidTerm/openapi/openapi.json
@@ -2841,6 +2841,26 @@
             "description": "OK"
           }
         }
+      },
+      "patch": {
+        "tags": [
+          "Ai.Tlbx.MidTerm.OpenApi"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonElement"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
       }
     },
     "/api/settings/reload": {
@@ -4752,6 +4772,7 @@
           }
         }
       },
+      "JsonElement": { },
       "LanguageSetting": {
         "enum": [
           "auto",
@@ -5099,6 +5120,8 @@
           "nextPromptIndex",
           "completedCycles",
           "nextRunAt",
+          "repeatEveryMs",
+          "repeatCount",
           "ignoreHeatUntil",
           "awaitingHeatRise"
         ],
@@ -5151,6 +5174,20 @@
             ],
             "format": "date-time"
           },
+          "repeatEveryMs": {
+            "type": [
+              "null",
+              "integer"
+            ],
+            "format": "int32"
+          },
+          "repeatCount": {
+            "type": [
+              "null",
+              "integer"
+            ],
+            "format": "int32"
+          },
           "ignoreHeatUntil": {
             "type": [
               "null",
@@ -5666,6 +5703,9 @@
         }
       },
       "RenameSessionRequest": {
+        "required": [
+          "name"
+        ],
         "type": "object",
         "properties": {
           "name": {
@@ -6489,6 +6529,9 @@
         }
       },
       "SetSessionNotesRequest": {
+        "required": [
+          "notes"
+        ],
         "type": "object",
         "properties": {
           "notes": {
@@ -6500,6 +6543,9 @@
         }
       },
       "SetSessionTopicRequest": {
+        "required": [
+          "topic"
+        ],
         "type": "object",
         "properties": {
           "topic": {
@@ -7105,6 +7151,7 @@
           "releaseNotes",
           "type",
           "sessionsPreserved",
+          "lastResult",
           "environment",
           "localUpdate",
           "isDowngrade"
@@ -7147,6 +7194,16 @@
           "sessionsPreserved": {
             "type": "boolean"
           },
+          "lastResult": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "$ref": "#/components/schemas/UpdateResult"
+              }
+            ]
+          },
           "environment": {
             "type": [
               "null",
@@ -7175,7 +7232,8 @@
           "message",
           "details",
           "timestamp",
-          "logFile"
+          "logFile",
+          "rollbackAttempted"
         ],
         "type": "object",
         "properties": {
@@ -7196,6 +7254,9 @@
           },
           "logFile": {
             "type": "string"
+          },
+          "rollbackAttempted": {
+            "type": "boolean"
           }
         }
       },
diff --git a/src/Ai.Tlbx.MidTerm/package-lock.json b/src/Ai.Tlbx.MidTerm/package-lock.json
index db3d5a126..3508937fe 100644
--- a/src/Ai.Tlbx.MidTerm/package-lock.json
+++ b/src/Ai.Tlbx.MidTerm/package-lock.json
@@ -8,6 +8,7 @@
       "hasInstallScript": true,
       "dependencies": {
         "@xterm/addon-fit": "0.12.0-beta.292",
+        "@xterm/addon-image": "0.10.0-beta.292",
         "@xterm/addon-search": "0.17.0-beta.292",
         "@xterm/addon-unicode11": "0.10.0-beta.292",
         "@xterm/addon-web-links": "0.13.0-beta.292",
@@ -1751,6 +1752,15 @@
         "@xterm/xterm": "^6.1.0-beta.292"
       }
     },
+    "node_modules/@xterm/addon-image": {
+      "version": "0.10.0-beta.292",
+      "resolved": "https://registry.npmjs.org/@xterm/addon-image/-/addon-image-0.10.0-beta.292.tgz",
+      "integrity": "sha512-kFhxNiZ5eU1acMYvp/aS0wYs2wJ3j/ueq54FSNnWwnchirOuAVQxxdlFdxlZFHVLSas7rijqaRN1dniN+30HGQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@xterm/xterm": "^6.1.0-beta.292"
+      }
+    },
     "node_modules/@xterm/addon-search": {
       "version": "0.17.0-beta.292",
       "resolved": "https://registry.npmjs.org/@xterm/addon-search/-/addon-search-0.17.0-beta.292.tgz",
diff --git a/src/Ai.Tlbx.MidTerm/package.json b/src/Ai.Tlbx.MidTerm/package.json
index 517bcaa40..34dc7e6f7 100644
--- a/src/Ai.Tlbx.MidTerm/package.json
+++ b/src/Ai.Tlbx.MidTerm/package.json
@@ -26,7 +26,8 @@
     "watch:typecheck": "tsc --noEmit -p tsconfig.json --watch",
     "generate:types": "npx openapi-typescript openapi/openapi.json -o src/ts/api.generated.ts && npx prettier --write src/ts/api.generated.ts",
     "generate:openapi": "dotnet build ../Ai.Tlbx.MidTerm.OpenApi/Ai.Tlbx.MidTerm.OpenApi.csproj && npm run generate:types",
-    "test": "vitest run",
+    "test": "vitest run && npm run test:kitty-graphics",
+    "test:kitty-graphics": "node ../../scripts/kitty-graphics-test.mjs --self-test",
     "test:watch": "vitest",
     "verify": "npm run typecheck && npm run lint && npm run test"
   },
@@ -56,6 +57,7 @@
   },
   "dependencies": {
     "@xterm/addon-fit": "0.12.0-beta.292",
+    "@xterm/addon-image": "0.10.0-beta.292",
     "@xterm/addon-search": "0.17.0-beta.292",
     "@xterm/addon-unicode11": "0.10.0-beta.292",
     "@xterm/addon-web-links": "0.13.0-beta.292",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/THIRD-PARTY-LICENSES.txt b/src/Ai.Tlbx.MidTerm/src/static/THIRD-PARTY-LICENSES.txt
index 230db95d9..a2fe250d4 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/THIRD-PARTY-LICENSES.txt
+++ b/src/Ai.Tlbx.MidTerm/src/static/THIRD-PARTY-LICENSES.txt
@@ -35,6 +35,35 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 
+================================================================================
+Microsoft Windows Console ConPTY 1.24.260710001 (conpty.dll, OpenConsole.exe)
+https://www.nuget.org/packages/Microsoft.Windows.Console.ConPTY/1.24.260710001
+https://github.com/microsoft/terminal
+================================================================================
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ================================================================================
 CsWin32
 https://github.com/microsoft/CsWin32
diff --git a/src/Ai.Tlbx.MidTerm/src/static/css/app.css b/src/Ai.Tlbx.MidTerm/src/static/css/app.css
index 244ee8f78..165fcff11 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/css/app.css
+++ b/src/Ai.Tlbx.MidTerm/src/static/css/app.css
@@ -18662,12 +18662,12 @@ body.keyboard-visible .adaptive-footer-dock {
   max-height: 100%;
 }
 
-body.keyboard-visible .adaptive-footer-dock[data-device='mobile'] {
-  overflow-y: auto;
-  overscroll-behavior: contain;
-  scrollbar-gutter: stable both-edges;
+body.keyboard-visible
+  .adaptive-footer-dock[data-device='mobile']:not([data-composer-expanded='true']) {
+  overflow: visible;
   scroll-padding-top: 6px;
-  scroll-padding-bottom: calc(56px + env(safe-area-inset-bottom, 0px));
+  scroll-padding-bottom: 0;
+  padding-bottom: 2px;
 }
 
 .adaptive-footer-dock[data-device='mobile'] .smart-input-row {
@@ -18731,7 +18731,7 @@ body.keyboard-visible .adaptive-footer-dock[data-device='mobile'] .manager-bar {
 }
 
 body.keyboard-visible .adaptive-footer-dock[data-device='mobile'] .smart-input-tools-surface {
-  max-height: min(24vh, 168px);
+  max-height: min(46dvh, 320px);
   overflow-y: auto;
   overscroll-behavior: contain;
 }
@@ -18862,11 +18862,13 @@ body.keyboard-visible .adaptive-footer-dock:not([data-device='mobile']) .manager
 
 @media (max-width: 768px), (hover: none) and (pointer: coarse) and (max-width: 1024px) {
   .adaptive-footer-dock {
+    --command-bay-control-height-mobile: 40px;
     --command-bay-control-height: var(--command-bay-control-height-mobile);
-    padding: 4px;
-    padding-left: calc(4px + env(safe-area-inset-left, 0px));
-    padding-right: calc(4px + env(safe-area-inset-right, 0px));
-    padding-bottom: calc(4px + env(safe-area-inset-bottom, 0px));
+    --command-bay-gap: 4px;
+    padding: 2px;
+    padding-left: calc(2px + env(safe-area-inset-left, 0px));
+    padding-right: calc(2px + env(safe-area-inset-right, 0px));
+    padding-bottom: calc(2px + env(safe-area-inset-bottom, 0px));
     background: transparent;
     -webkit-backdrop-filter: none;
     backdrop-filter: none;
@@ -18877,21 +18879,76 @@ body.keyboard-visible .adaptive-footer-dock:not([data-device='mobile']) .manager
   }
 
   .smart-input-row.smart-input-row-tools-open {
-    flex-wrap: wrap;
+    flex-wrap: nowrap;
   }
 
   .smart-input-row.smart-input-row-tools-open .smart-input-tools-surface:not([hidden]) {
-    position: static;
-    order: -1;
-    flex: 1 0 100%;
+    position: absolute;
+    right: 0;
+    bottom: calc(100% + var(--command-bay-gap));
+    z-index: 4;
     width: 100%;
     min-width: 0;
     max-width: none;
-    max-height: min(28vh, 180px);
+    max-height: min(46dvh, 320px);
     overflow-y: auto;
     overscroll-behavior: contain;
   }
 
+  .smart-input-tools-surface .smart-input-tools-strip {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .smart-input-tools-surface .smart-input-tool-button {
+    min-height: var(--command-bay-control-height);
+    padding: 0 9px;
+  }
+
+  .smart-input-mobile-touch-host {
+    width: 100%;
+    margin-top: var(--command-bay-gap);
+  }
+
+  .smart-input-mobile-touch-host[hidden] {
+    display: none !important;
+  }
+
+  .smart-input-mobile-touch-host .touch-controller.embedded {
+    position: static;
+    display: flex !important;
+    width: 100%;
+    max-height: none;
+    margin: 0;
+    padding: 0;
+    border: 0;
+    background: none;
+  }
+
+  .smart-input-mobile-touch-host .touch-controller.embedded .touch-dismiss {
+    display: none;
+  }
+
+  .smart-input-mobile-touch-host .touch-controller.embedded .touch-bar-main {
+    display: grid;
+    width: 100%;
+    grid-template-columns: repeat(auto-fit, minmax(38px, 1fr));
+    gap: var(--command-bay-gap);
+  }
+
+  .smart-input-mobile-touch-host .touch-controller.embedded .touch-group {
+    display: contents;
+  }
+
+  .smart-input-mobile-touch-host .touch-controller.embedded .touch-key {
+    width: auto;
+    min-width: 38px;
+    min-height: 38px;
+    margin-left: 0;
+    padding: 6px 8px;
+    border-radius: 8px;
+  }
+
   .smart-input-editor {
     gap: var(--command-bay-gap);
   }
diff --git a/src/Ai.Tlbx.MidTerm/src/static/index.html b/src/Ai.Tlbx.MidTerm/src/static/index.html
index 6bd5d377f..356186712 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/index.html
+++ b/src/Ai.Tlbx.MidTerm/src/static/index.html
@@ -75,7 +75,7 @@
       }
     </style>
 
-    <!-- Preload terminal fonts for instant availability -->
+    <!-- Preload the default terminal font; alternate choices load on demand. -->
     <link
       rel="preload"
       href="/fonts/CascadiaCode-Regular.woff2?v=__MIDTERM_ASSET_VERSION__"
@@ -83,28 +83,6 @@
       type="font/woff2"
       crossorigin
     />
-    <link
-      rel="preload"
-      href="/fonts/CascadiaCode-SemiBold.woff2?v=__MIDTERM_ASSET_VERSION__"
-      as="font"
-      type="font/woff2"
-      crossorigin
-    />
-    <link
-      rel="preload"
-      href="/fonts/JetBrainsMono-Regular.woff2?v=__MIDTERM_ASSET_VERSION__"
-      as="font"
-      type="font/woff2"
-      crossorigin
-    />
-    <link
-      rel="preload"
-      href="/fonts/Terminus.woff2?v=__MIDTERM_ASSET_VERSION__"
-      as="font"
-      type="font/woff2"
-      crossorigin
-    />
-
     <link rel="stylesheet" href="/css/app.css?v=__MIDTERM_ASSET_VERSION__" />
     <link rel="stylesheet" href="/css/xterm.css?v=__MIDTERM_ASSET_VERSION__" />
   </head>
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/bn.json b/src/Ai.Tlbx.MidTerm/src/static/locales/bn.json
index 8146915a1..4896406ef 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/bn.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/bn.json
@@ -367,6 +367,7 @@
   "update.applying": "প্রয়োগ হচ্ছে...",
   "update.lastUpdate": "শেষ আপডেট:",
   "update.success": "সফল",
+  "update.rollbackAttempted": "রোলব্যাকের চেষ্টা করা হয়েছে। বিস্তারিত জানতে আপডেট লগ দেখুন।",
   "update.viewUpdateLog": "আপডেট লগ দেখুন",
   "update.noLogFound": "কোনো আপডেট লগ পাওয়া যায়নি",
   "update.copyLog": "লগ কপি করুন",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/de.json b/src/Ai.Tlbx.MidTerm/src/static/locales/de.json
index f7c38d6b8..b06fcac0f 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/de.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/de.json
@@ -392,6 +392,7 @@
   "update.applying": "Anwenden...",
   "update.lastUpdate": "Letztes Update:",
   "update.success": "Erfolgreich",
+  "update.rollbackAttempted": "Ein Rollback wurde versucht. Details stehen im Update-Protokoll.",
   "update.viewUpdateLog": "Update-Protokoll anzeigen",
   "update.noLogFound": "Kein Update-Protokoll gefunden",
   "update.copyLog": "Protokoll kopieren",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/en.json b/src/Ai.Tlbx.MidTerm/src/static/locales/en.json
index ed02a6404..8cb5b743d 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/en.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/en.json
@@ -973,6 +973,7 @@
   "update.refreshingUi": "Refreshing UI...",
   "update.lastUpdate": "Last update:",
   "update.success": "Success",
+  "update.rollbackAttempted": "Rollback was attempted. Check the update log for details.",
   "update.viewUpdateLog": "View Update Log",
   "update.noLogFound": "No update log found",
   "update.copyLog": "Copy Log",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/es.json b/src/Ai.Tlbx.MidTerm/src/static/locales/es.json
index 71e441cce..516765ea0 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/es.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/es.json
@@ -367,6 +367,7 @@
   "update.applying": "Aplicando...",
   "update.lastUpdate": "Última actualización:",
   "update.success": "Éxito",
+  "update.rollbackAttempted": "Se intentó revertir la actualización. Consulta el registro de actualización para más detalles.",
   "update.viewUpdateLog": "Ver Registro de Actualizaciones",
   "update.noLogFound": "No se encontró registro de actualizaciones",
   "update.copyLog": "Copiar Registro",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/fr.json b/src/Ai.Tlbx.MidTerm/src/static/locales/fr.json
index 4df8aabd8..caf9acd9e 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/fr.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/fr.json
@@ -367,6 +367,7 @@
   "update.applying": "Application...",
   "update.lastUpdate": "Dernière mise à jour :",
   "update.success": "Succès",
+  "update.rollbackAttempted": "Une restauration a été tentée. Consultez le journal de mise à jour pour plus de détails.",
   "update.viewUpdateLog": "Voir le Journal des Mises à Jour",
   "update.noLogFound": "Aucun journal de mise à jour trouvé",
   "update.copyLog": "Copier le Journal",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/hi.json b/src/Ai.Tlbx.MidTerm/src/static/locales/hi.json
index 62326c1d2..80b831950 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/hi.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/hi.json
@@ -367,6 +367,7 @@
   "update.applying": "लागू हो रहा है...",
   "update.lastUpdate": "अंतिम अपडेट:",
   "update.success": "सफल",
+  "update.rollbackAttempted": "रोलबैक का प्रयास किया गया। विवरण के लिए अपडेट लॉग देखें।",
   "update.viewUpdateLog": "अपडेट लॉग देखें",
   "update.noLogFound": "कोई अपडेट लॉग नहीं मिला",
   "update.copyLog": "लॉग कॉपी करें",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/ja.json b/src/Ai.Tlbx.MidTerm/src/static/locales/ja.json
index a6ea1f39a..1425a8d13 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/ja.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/ja.json
@@ -367,6 +367,7 @@
   "update.applying": "適用中...",
   "update.lastUpdate": "最終アップデート：",
   "update.success": "成功",
+  "update.rollbackAttempted": "ロールバックを試行しました。詳細は更新ログを確認してください。",
   "update.viewUpdateLog": "アップデートログを表示",
   "update.noLogFound": "アップデートログが見つかりません",
   "update.copyLog": "ログをコピー",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/pt.json b/src/Ai.Tlbx.MidTerm/src/static/locales/pt.json
index 4124c6fd3..193436544 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/pt.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/pt.json
@@ -367,6 +367,7 @@
   "update.applying": "Aplicando...",
   "update.lastUpdate": "Última atualização:",
   "update.success": "Sucesso",
+  "update.rollbackAttempted": "Foi tentada uma reversão. Consulte o registro de atualização para obter detalhes.",
   "update.viewUpdateLog": "Ver Log de Atualização",
   "update.noLogFound": "Nenhum log de atualização encontrado",
   "update.copyLog": "Copiar Log",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/ru.json b/src/Ai.Tlbx.MidTerm/src/static/locales/ru.json
index 1697b77b8..3b0b24f37 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/ru.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/ru.json
@@ -367,6 +367,7 @@
   "update.applying": "Применение...",
   "update.lastUpdate": "Последнее обновление:",
   "update.success": "Успешно",
+  "update.rollbackAttempted": "Была предпринята попытка отката. Подробности см. в журнале обновления.",
   "update.viewUpdateLog": "Просмотреть журнал обновлений",
   "update.noLogFound": "Журнал обновлений не найден",
   "update.copyLog": "Копировать журнал",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/locales/zh.json b/src/Ai.Tlbx.MidTerm/src/static/locales/zh.json
index c4aede358..f8df82ca4 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/locales/zh.json
+++ b/src/Ai.Tlbx.MidTerm/src/static/locales/zh.json
@@ -370,6 +370,7 @@
   "update.applying": "应用中...",
   "update.lastUpdate": "上次更新：",
   "update.success": "成功",
+  "update.rollbackAttempted": "已尝试回滚。详情请查看更新日志。",
   "update.viewUpdateLog": "查看更新日志",
   "update.noLogFound": "未找到更新日志",
   "update.copyLog": "复制日志",
diff --git a/src/Ai.Tlbx.MidTerm/src/static/trust.html b/src/Ai.Tlbx.MidTerm/src/static/trust.html
index 0e9fa9c86..873d1317a 100644
--- a/src/Ai.Tlbx.MidTerm/src/static/trust.html
+++ b/src/Ai.Tlbx.MidTerm/src/static/trust.html
@@ -76,7 +76,7 @@ <h4>Android <span id="android-detected" class="detected-badge hidden">(Detected)
                         <li>Tap "Download Certificate" above</li>
                         <li>Open <strong>Settings &rarr; Security &rarr; Encryption & credentials</strong></li>
                         <li>Tap <strong>Install a certificate &rarr; CA certificate</strong></li>
-                        <li>Select the downloaded <code>midterm.crt</code> file</li>
+                        <li>Select the downloaded <code>tlbx.crt</code> file</li>
                         <li>Verify the fingerprint shown matches the one above</li>
                     </ol>
                     <p class="install-note">Note: Menu names vary by Android version and manufacturer.</p>
@@ -98,7 +98,7 @@ <h3 class="platform-group-title"><span data-i18n="trust.desktop">Desktop</span>
                             Download Certificate
                         </button>
                         <p>Then run as Administrator in the download folder:</p>
-                        <code class="command-block">certutil -addstore Root midterm.pem</code>
+                        <code class="command-block">certutil -addstore Root tlbx.pem</code>
                     </div>
 
                     <div class="os-instructions hidden" id="macos-instructions">
@@ -107,7 +107,7 @@ <h3 class="platform-group-title"><span data-i18n="trust.desktop">Desktop</span>
                         </button>
                         <p>Then run in Terminal from the download folder:</p>
                         <code class="command-block">sudo security add-trusted-cert -d -r trustRoot \
-    -k /Library/Keychains/System.keychain midterm.pem</code>
+    -k /Library/Keychains/System.keychain tlbx.pem</code>
                     </div>
 
                     <div class="os-instructions hidden" id="linux-instructions">
@@ -115,7 +115,7 @@ <h3 class="platform-group-title"><span data-i18n="trust.desktop">Desktop</span>
                             Download Certificate
                         </button>
                         <p>Then run in Terminal from the download folder:</p>
-                        <code class="command-block">sudo cp midterm.pem /usr/local/share/ca-certificates/midterm.crt
+                        <code class="command-block">sudo cp tlbx.pem /usr/local/share/ca-certificates/tlbx.crt
 sudo update-ca-certificates</code>
                     </div>
                 </div>
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/api.generated.ts b/src/Ai.Tlbx.MidTerm/src/ts/api.generated.ts
index 2a677b9be..20b7d6c4b 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/api.generated.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/api.generated.ts
@@ -3531,7 +3531,28 @@ export interface paths {
     delete?: never;
     options?: never;
     head?: never;
-    patch?: never;
+    patch: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          'application/json': components['schemas']['JsonElement'];
+        };
+      };
+      responses: {
+        /** @description OK */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
     trace?: never;
   };
   '/api/settings/reload': {
@@ -4179,6 +4200,7 @@ export interface components {
       claudeMdUpdated: boolean;
       agentsMdUpdated: boolean;
     };
+    JsonElement: unknown;
     /** @enum {unknown} */
     LanguageSetting: 'auto' | 'en' | 'zh' | 'es' | 'hi' | 'fr' | 'bn' | 'pt' | 'ru' | 'ja' | 'de';
     LaunchEntry: {
@@ -4266,6 +4288,10 @@ export interface components {
       completedCycles: number;
       /** Format: date-time */
       nextRunAt: null | string;
+      /** Format: int32 */
+      repeatEveryMs: null | number;
+      /** Format: int32 */
+      repeatCount: null | number;
       /** Format: date-time */
       ignoreHeatUntil: null | string;
       awaitingHeatRise: boolean;
@@ -4403,7 +4429,7 @@ export interface components {
       logDirectory: string;
     };
     RenameSessionRequest: {
-      name?: null | string;
+      name: null | string;
     };
     ResizeRequest: {
       /** Format: int32 */
@@ -4605,10 +4631,10 @@ export interface components {
       agentControlled: boolean;
     };
     SetSessionNotesRequest: {
-      notes?: null | string;
+      notes: null | string;
     };
     SetSessionTopicRequest: {
-      topic?: null | string;
+      topic: null | string;
     };
     /** @enum {unknown} */
     ShareAccessMode: 'ViewOnly' | 'FullControl';
@@ -4774,6 +4800,7 @@ export interface components {
       releaseNotes: null | string;
       type: components['schemas']['UpdateType'];
       sessionsPreserved: boolean;
+      lastResult: null | components['schemas']['UpdateResult'];
       environment: null | string;
       localUpdate: null | components['schemas']['LocalUpdateInfo'];
       isDowngrade: boolean;
@@ -4785,6 +4812,7 @@ export interface components {
       details: string;
       timestamp: string;
       logFile: string;
+      rollbackAttempted: boolean;
     };
     /** @enum {unknown} */
     UpdateType: 'none' | 'webOnly' | 'full';
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/api/client.ts b/src/Ai.Tlbx.MidTerm/src/ts/api/client.ts
index 2be154890..01ef82a05 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/api/client.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/api/client.ts
@@ -715,8 +715,8 @@ export async function getSettings(): ClientGetResult<'/api/settings'> {
 
 export async function updateSettings(
   settings: MidTermSettingsUpdate,
-): ClientPutResult<'/api/settings'> {
-  return client.PUT('/api/settings', {
+): ClientPatchResult<'/api/settings'> {
+  return client.PATCH('/api/settings', {
     body: settings as unknown as MidTermSettingsPublic,
   });
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/api/types.ts b/src/Ai.Tlbx.MidTerm/src/ts/api/types.ts
index 7a303d10c..71b68a4a0 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/api/types.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/api/types.ts
@@ -230,6 +230,8 @@ export interface AppServerControlHistoryItem {
   attachments: AppServerControlAttachmentReference[];
   fileMentions?: AppServerControlInlineFileReference[];
   imagePreviews?: AppServerControlInlineImagePreview[];
+  questions?: AppServerControlQuestion[];
+  answers?: AppServerControlAnsweredQuestion[];
   streaming: boolean;
   createdAt: string;
   updatedAt: string;
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/main.ts b/src/Ai.Tlbx.MidTerm/src/ts/main.ts
index b3fbe15e6..520b77478 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/main.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/main.ts
@@ -461,7 +461,7 @@ async function init(): Promise<void> {
   initDiagnosticsPanel();
   bindHubSettings();
 
-  setupVisibilityChangeHandler();
+  setupVisibilityChangeHandler(true);
   initPwaInstall();
 
   let serviceWorker: ServiceWorkerContainer | undefined;
@@ -509,7 +509,7 @@ async function initShared(): Promise<void> {
   syncAppModeClasses();
   setupResizeObserver();
   setupVisualViewport();
-  setupVisibilityChangeHandler();
+  setupVisibilityChangeHandler(false);
 
   try {
     await claimSharedSessionAccess();
@@ -664,13 +664,16 @@ function applyScrollbackProtection(): void {
   }, 50);
 }
 
-function setupVisibilityChangeHandler(): void {
+function setupVisibilityChangeHandler(includeSettingsChannel: boolean): void {
   setupBrowserLifecycleRecovery({
     getVisibleTerminalSessionIds,
     syncMuxTerminalVisibility,
     focusActiveTerminal,
     applyScrollbackProtection,
     keepTerminalOutputActiveWhileHidden: isMobilePiPEnabled,
+    ...(includeSettingsChannel
+      ? { reconnectSettingsAfterLongResume: connectSettingsWebSocket }
+      : {}),
   });
 }
 
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyDom.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyDom.ts
index 2833bd82b..bcd4aa09e 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyDom.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyDom.ts
@@ -98,6 +98,27 @@ type AgentHistoryDomDeps = {
   logWarn: (message: () => string) => void;
 };
 
+function buildEmbeddedInterviewRequest(
+  entry: AppServerControlHistoryEntry,
+): AppServerControlHistoryRequestSummary | null {
+  if (entry.sourceItemType !== 'interview' || !entry.requestId || !entry.questions?.length) {
+    return null;
+  }
+
+  return {
+    requestId: entry.requestId,
+    turnId: entry.sourceTurnId ?? null,
+    kind: 'interview',
+    kindLabel: entry.title || t('appServerControl.request.pendingInterview'),
+    state: entry.sourceStatus || 'open',
+    detail: entry.body || null,
+    decision: null,
+    questions: entry.questions,
+    answers: entry.answers ?? [],
+    updatedAt: entry.sourceUpdatedAt || new Date(0).toISOString(),
+  };
+}
+
 function appendInlineRequestWidgetToArticle(args: {
   article: HTMLElement;
   createRequestActionBlock: (
@@ -117,9 +138,10 @@ function appendInlineRequestWidgetToArticle(args: {
   }
 
   const state = deps.getState(sessionId);
-  const request = state?.snapshot?.requests.find(
-    (candidate) => candidate.requestId === entry.requestId,
-  );
+  const embeddedRequest = buildEmbeddedInterviewRequest(entry);
+  const request =
+    embeddedRequest ??
+    state?.snapshot?.requests.find((candidate) => candidate.requestId === entry.requestId);
   if (!state || !request) {
     return false;
   }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyProcessing.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyProcessing.ts
index 584013d27..7cbcdce8c 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyProcessing.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/historyProcessing.ts
@@ -7,8 +7,10 @@ import type {
 } from '../../api/client';
 import type {
   AppServerControlAttachmentReference,
+  AppServerControlAnsweredQuestion,
   AppServerControlInlineFileReference,
   AppServerControlInlineImagePreview,
+  AppServerControlQuestion,
 } from '../../api/types';
 import { $currentSettings } from '../../stores';
 import {
@@ -100,6 +102,23 @@ function cloneImagePreviews(
   return imagePreviews?.map((preview) => ({ ...preview })) ?? [];
 }
 
+function cloneQuestions(
+  questions: readonly AppServerControlQuestion[] | undefined,
+): AppServerControlQuestion[] {
+  return (
+    questions?.map((question) => ({
+      ...question,
+      options: question.options.map((option) => ({ ...option })),
+    })) ?? []
+  );
+}
+
+function cloneAnswers(
+  answers: readonly AppServerControlAnsweredQuestion[] | undefined,
+): AppServerControlAnsweredQuestion[] {
+  return answers?.map((answer) => ({ ...answer, answers: [...answer.answers] })) ?? [];
+}
+
 export function buildAppServerControlHistoryEntries(
   snapshot: AppServerControlHistorySnapshot,
 ): AppServerControlHistoryEntry[] {
@@ -134,6 +153,10 @@ export function buildAppServerControlHistoryEntries(
         sourceItemId: entry.itemId ?? null,
         sourceTurnId: entry.turnId ?? null,
         sourceItemType: entry.itemType ?? null,
+        sourceStatus: entry.status,
+        sourceUpdatedAt: entry.updatedAt,
+        questions: cloneQuestions(entry.questions),
+        answers: cloneAnswers(entry.answers),
       };
       if (typeof entry.estimatedHeightPx === 'number' && entry.estimatedHeightPx > 0) {
         mapped.estimatedHeightPx = entry.estimatedHeightPx;
@@ -429,6 +452,8 @@ function cloneAppServerControlHistoryEntry(
     commandOutputTail: [...(entry.commandOutputTail ?? [])],
     fileMentions: cloneFileMentions(entry.fileMentions),
     imagePreviews: cloneImagePreviews(entry.imagePreviews),
+    questions: cloneQuestions(entry.questions),
+    answers: cloneAnswers(entry.answers),
   };
   if (entry.actions) {
     cloned.actions = entry.actions.map((action) => ({ ...action }));
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/types.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/types.ts
index a2b6acf64..7ef768624 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/types.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/agentView/types.ts
@@ -4,6 +4,8 @@ import type {
   AppServerControlInlineFileReference,
   AppServerControlInlineImagePreview,
   AppServerControlHistoryRuntimeNotice,
+  AppServerControlQuestion,
+  AppServerControlAnsweredQuestion,
 } from '../../api/types';
 
 export interface SessionAppServerControlViewState {
@@ -176,6 +178,10 @@ export interface AppServerControlHistoryEntry {
   sourceItemId?: string | null;
   sourceTurnId?: string | null;
   sourceItemType?: string | null;
+  sourceStatus?: string;
+  sourceUpdatedAt?: string;
+  questions?: AppServerControlQuestion[];
+  answers?: AppServerControlAnsweredQuestion[];
   busyIndicator?: boolean;
   busyElapsedText?: string | null;
   turnDurationNote?: boolean;
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.test.ts
index 70629cbdf..f9fafd2cd 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.test.ts
@@ -5,11 +5,12 @@ const mocks = vi.hoisted(() => ({
   reportBrowserActivity: vi.fn(),
   recoverVisibleTerminalsAfterBrowserResume: vi.fn(),
   suspendMuxForBrowserBackground: vi.fn(),
+  stateWsConnected: true,
 }));
 
 vi.mock('../../stores', () => ({
   $activeSessionId: { get: () => 'sess1234' },
-  $stateWsConnected: { get: () => true },
+  $stateWsConnected: { get: () => mocks.stateWsConnected },
 }));
 
 vi.mock('./stateChannel', () => ({
@@ -26,17 +27,23 @@ import { setupBrowserLifecycleRecovery } from './browserLifecycleRecovery';
 
 describe('browserLifecycleRecovery', () => {
   let fakeDocument: EventTarget & { visibilityState: DocumentVisibilityState };
+  let fakeWindow: EventTarget;
 
   beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date('2026-08-10T00:00:00Z'));
     vi.clearAllMocks();
+    mocks.stateWsConnected = true;
     fakeDocument = Object.assign(new EventTarget(), {
       visibilityState: 'visible' as DocumentVisibilityState,
     });
+    fakeWindow = new EventTarget();
     vi.stubGlobal('document', fakeDocument);
-    vi.stubGlobal('window', new EventTarget());
+    vi.stubGlobal('window', fakeWindow);
   });
 
   afterEach(() => {
+    vi.useRealTimers();
     vi.unstubAllGlobals();
   });
 
@@ -54,6 +61,7 @@ describe('browserLifecycleRecovery', () => {
       focusActiveTerminal: vi.fn(),
       applyScrollbackProtection: vi.fn(),
       keepTerminalOutputActiveWhileHidden: vi.fn(() => keepTerminalOutputActiveWhileHidden),
+      reconnectSettingsAfterLongResume: vi.fn(),
     };
     setupBrowserLifecycleRecovery(options);
     return options;
@@ -63,6 +71,10 @@ describe('browserLifecycleRecovery', () => {
     fakeDocument.dispatchEvent(new Event(type));
   }
 
+  function emitWindow(type: string): void {
+    fakeWindow.dispatchEvent(new Event(type));
+  }
+
   it('suspends terminal transport while a desktop document is hidden', () => {
     const options = setup();
     setVisibility('hidden');
@@ -75,20 +87,63 @@ describe('browserLifecycleRecovery', () => {
     expect(options.syncMuxTerminalVisibility).not.toHaveBeenCalled();
   });
 
-  it('reconnects and restores visible terminal state on foreground', () => {
+  it('restores visible terminal state without replacing healthy transports on ordinary focus', () => {
     const options = setup();
     setVisibility('visible');
 
     emitDocument('visibilitychange');
+    vi.runAllTimers();
+
+    expect(mocks.connectStateWebSocket).not.toHaveBeenCalled();
+    expect(options.reconnectSettingsAfterLongResume).not.toHaveBeenCalled();
+    expect(mocks.recoverVisibleTerminalsAfterBrowserResume).toHaveBeenCalledWith(
+      'sess1234',
+      ['sess1234'],
+      { forceReconnect: false },
+    );
+    expect(options.syncMuxTerminalVisibility).toHaveBeenCalledTimes(1);
+    expect(options.focusActiveTerminal).toHaveBeenCalledTimes(1);
+    expect(options.applyScrollbackProtection).toHaveBeenCalledTimes(1);
+  });
+
+  it('replaces stale-open core transports once after a long background interval', () => {
+    const options = setup();
+    setVisibility('hidden');
+    emitDocument('visibilitychange');
+    vi.advanceTimersByTime(6000);
 
-    expect(mocks.recoverVisibleTerminalsAfterBrowserResume).toHaveBeenCalledWith('sess1234', [
+    setVisibility('visible');
+    emitDocument('visibilitychange');
+    emitWindow('focus');
+    emitWindow('pageshow');
+    emitDocument('resume');
+    vi.runAllTimers();
+
+    expect(mocks.connectStateWebSocket).toHaveBeenCalledTimes(1);
+    expect(options.reconnectSettingsAfterLongResume).toHaveBeenCalledTimes(1);
+    expect(mocks.recoverVisibleTerminalsAfterBrowserResume).toHaveBeenCalledTimes(1);
+    expect(mocks.recoverVisibleTerminalsAfterBrowserResume).toHaveBeenCalledWith(
       'sess1234',
-    ]);
+      ['sess1234'],
+      { forceReconnect: true },
+    );
     expect(options.syncMuxTerminalVisibility).toHaveBeenCalledTimes(1);
     expect(options.focusActiveTerminal).toHaveBeenCalledTimes(1);
     expect(options.applyScrollbackProtection).toHaveBeenCalledTimes(1);
   });
 
+  it('coalesces duplicate foreground events without hiding the document first', () => {
+    const options = setup();
+
+    emitWindow('focus');
+    emitWindow('pageshow');
+    emitDocument('resume');
+    vi.runAllTimers();
+
+    expect(mocks.recoverVisibleTerminalsAfterBrowserResume).toHaveBeenCalledTimes(1);
+    expect(options.focusActiveTerminal).toHaveBeenCalledTimes(1);
+  });
+
   it('keeps hidden terminal output active for mobile PiP', () => {
     setup(true);
     setVisibility('hidden');
@@ -97,4 +152,14 @@ describe('browserLifecycleRecovery', () => {
 
     expect(mocks.suspendMuxForBrowserBackground).not.toHaveBeenCalled();
   });
+
+  it('reconnects state immediately when its store already reports a disconnect', () => {
+    mocks.stateWsConnected = false;
+    setup();
+
+    emitWindow('focus');
+    vi.runAllTimers();
+
+    expect(mocks.connectStateWebSocket).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.ts
index abc69a9ca..55e1a3f9b 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/browserLifecycleRecovery.ts
@@ -11,19 +11,33 @@ interface BrowserLifecycleRecoveryOptions {
   focusActiveTerminal: () => void;
   applyScrollbackProtection: () => void;
   keepTerminalOutputActiveWhileHidden: () => boolean;
+  reconnectSettingsAfterLongResume?: () => void;
 }
 
+const LONG_BACKGROUND_TRANSPORT_RESET_MS = 5000;
+const FOREGROUND_RECOVERY_COALESCE_MS = 250;
+
 export function setupBrowserLifecycleRecovery(options: BrowserLifecycleRecoveryOptions): void {
-  const recoverRealtimeAfterBrowserResume = (): void => {
-    reportBrowserActivity(true);
+  let hiddenAtMs: number | null = isDocumentHidden() ? Date.now() : null;
+  let forceTransportReconnect = false;
+  let recoveryTimer: ReturnType<typeof globalThis.setTimeout> | null = null;
+  let lastRecoveryAtMs = Number.NEGATIVE_INFINITY;
 
-    if (!$stateWsConnected.get()) {
+  const recoverRealtimeAfterBrowserResume = (forceReconnect: boolean): void => {
+    if (forceReconnect || !$stateWsConnected.get()) {
       connectStateWebSocket();
+    } else {
+      reportBrowserActivity(true);
+    }
+
+    if (forceReconnect) {
+      options.reconnectSettingsAfterLongResume?.();
     }
 
     recoverVisibleTerminalsAfterBrowserResume(
       $activeSessionId.get(),
       options.getVisibleTerminalSessionIds(),
+      { forceReconnect },
     );
 
     options.syncMuxTerminalVisibility();
@@ -31,21 +45,63 @@ export function setupBrowserLifecycleRecovery(options: BrowserLifecycleRecoveryO
     options.applyScrollbackProtection();
   };
 
+  const cancelScheduledRecovery = (): void => {
+    if (recoveryTimer === null) return;
+    globalThis.clearTimeout(recoveryTimer);
+    recoveryTimer = null;
+  };
+
+  const rememberBackgroundStart = (): void => {
+    hiddenAtMs ??= Date.now();
+    cancelScheduledRecovery();
+  };
+
+  const scheduleForegroundRecovery = (): void => {
+    const now = Date.now();
+    if (hiddenAtMs !== null) {
+      forceTransportReconnect ||= now - hiddenAtMs >= LONG_BACKGROUND_TRANSPORT_RESET_MS;
+      hiddenAtMs = null;
+    }
+
+    if (
+      recoveryTimer === null &&
+      !forceTransportReconnect &&
+      now - lastRecoveryAtMs < FOREGROUND_RECOVERY_COALESCE_MS
+    ) {
+      return;
+    }
+
+    if (recoveryTimer !== null) return;
+    recoveryTimer = globalThis.setTimeout(() => {
+      recoveryTimer = null;
+      if (isDocumentHidden()) {
+        rememberBackgroundStart();
+        return;
+      }
+
+      const shouldForceReconnect = forceTransportReconnect;
+      forceTransportReconnect = false;
+      lastRecoveryAtMs = Date.now();
+      recoverRealtimeAfterBrowserResume(shouldForceReconnect);
+    }, 0);
+  };
+
   document.addEventListener('visibilitychange', () => {
     reportBrowserActivity();
 
     if (isDocumentHidden()) {
+      rememberBackgroundStart();
       if (!options.keepTerminalOutputActiveWhileHidden()) {
         suspendMuxForBrowserBackground();
       }
       return;
     }
 
-    recoverRealtimeAfterBrowserResume();
+    scheduleForegroundRecovery();
   });
 
   window.addEventListener('focus', () => {
-    recoverRealtimeAfterBrowserResume();
+    scheduleForegroundRecovery();
   });
 
   window.addEventListener('blur', () => {
@@ -53,15 +109,24 @@ export function setupBrowserLifecycleRecovery(options: BrowserLifecycleRecoveryO
   });
 
   window.addEventListener('pagehide', () => {
+    rememberBackgroundStart();
     reportBrowserActivity(false);
   });
 
   window.addEventListener('pageshow', () => {
-    recoverRealtimeAfterBrowserResume();
+    scheduleForegroundRecovery();
   });
 
   document.addEventListener('resume', () => {
-    recoverRealtimeAfterBrowserResume();
+    scheduleForegroundRecovery();
+  });
+
+  document.addEventListener('freeze', () => {
+    rememberBackgroundStart();
+    reportBrowserActivity(false);
+    if (!options.keepTerminalOutputActiveWhileHidden()) {
+      suspendMuxForBrowserBackground();
+    }
   });
 }
 
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.test.ts
index 0a8b0f1d0..176148e54 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.test.ts
@@ -1371,6 +1371,20 @@ describe('muxChannel', () => {
     expect(url.searchParams.get('visibleSessionIds')).toBe('sess5678');
   });
 
+  it('replaces a stale-open mux generation after a long browser resume', async () => {
+    const harness = await loadHarness([5000, 5000, 5000, 5000]);
+    expect(harness.ws.readyState).toBe(MockWebSocket.OPEN);
+
+    harness.recoverVisibleTerminalsAfterBrowserResume('sess1234', ['sess5678'], {
+      forceReconnect: true,
+    });
+
+    expect(MockWebSocket.instances).toHaveLength(2);
+    const reconnectUrl = new URL(MockWebSocket.instances[1]!.url);
+    expect(reconnectUrl.searchParams.get('activeSessionId')).toBe('sess1234');
+    expect(reconnectUrl.searchParams.get('visibleSessionIds')).toBe('sess5678');
+  });
+
   it('sends sampled input trace markers before normal input when tracing is enabled', async () => {
     const harness = await loadHarness([10, 10, 10, 10]);
 
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.ts
index 9a89b217b..c810db2bb 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/muxChannel.ts
@@ -1426,7 +1426,9 @@ export function connectMuxWebSocket(): void {
     return;
   }
 
+  muxReconnect.cancel();
   closeWebSocket(muxWs, setMuxWs);
+  $muxWsConnected.set(false);
 
   const activeId = $activeSessionId.get();
   const query = new URLSearchParams();
@@ -1457,6 +1459,7 @@ export function connectMuxWebSocket(): void {
   setMuxWs(ws);
 
   ws.onopen = () => {
+    if (muxWs !== ws) return;
     muxReconnect.reset();
     syncCompletePending = false;
 
@@ -1515,6 +1518,7 @@ export function connectMuxWebSocket(): void {
   };
 
   ws.onmessage = (event) => {
+    if (muxWs !== ws) return;
     if (!(event.data instanceof ArrayBuffer)) return;
     addWsRxBytes(event.data.byteLength);
 
@@ -1553,6 +1557,7 @@ export function connectMuxWebSocket(): void {
   };
 
   ws.onclose = (event) => {
+    if (muxWs !== ws) return;
     $muxWsConnected.set(false);
     lastHintedSessionId = null;
     syncCompletePending = false;
@@ -1578,6 +1583,7 @@ export function connectMuxWebSocket(): void {
   };
 
   ws.onerror = (e) => {
+    if (muxWs !== ws) return;
     log.error(() => `WebSocket error: ${e.type}`);
   };
 }
@@ -1866,11 +1872,12 @@ export function suspendMuxForBrowserBackground(): void {
 export function recoverVisibleTerminalsAfterBrowserResume(
   activeSessionId: string | null,
   visibleSessionIds: readonly string[],
+  options?: { forceReconnect?: boolean },
 ): void {
   const normalizedVisibleSessionIds = muxSessionRouting.normalizeSessionIds(visibleSessionIds);
   currentVisibleSessionIds = normalizedVisibleSessionIds;
 
-  if (muxSuspendedForBrowserBackground) {
+  if (muxSuspendedForBrowserBackground || options?.forceReconnect) {
     muxSuspendedForBrowserBackground = false;
     connectMuxWebSocket();
     return;
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/settingsChannel.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/settingsChannel.test.ts
new file mode 100644
index 000000000..8d44b4801
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/settingsChannel.test.ts
@@ -0,0 +1,145 @@
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  currentSettings: { language: 'en', theme: 'dark', fontSize: 14 },
+  updateInfo: { version: '10.6.9-dev' },
+  currentSettingsSet: vi.fn(),
+  updateInfoSet: vi.fn(),
+  settingsConnectedSet: vi.fn(),
+  applyReceivedSettings: vi.fn(),
+  handleUpdateInfo: vi.fn(),
+}));
+
+class FakeWebSocket {
+  static readonly CONNECTING = 0;
+  static readonly OPEN = 1;
+  static readonly CLOSED = 3;
+  static instances: FakeWebSocket[] = [];
+
+  readyState = FakeWebSocket.CONNECTING;
+  onopen: (() => void) | null = null;
+  onmessage: ((event: MessageEvent<string>) => void) | null = null;
+  onclose: ((event: CloseEvent) => void) | null = null;
+  onerror: ((event: Event) => void) | null = null;
+
+  constructor(readonly url: string) {
+    FakeWebSocket.instances.push(this);
+  }
+
+  close(): void {
+    this.readyState = FakeWebSocket.CLOSED;
+  }
+}
+
+vi.mock('../../utils', () => ({
+  ReconnectController: class {
+    cancel = vi.fn();
+    reset = vi.fn();
+    schedule = vi.fn();
+  },
+  createWsUrl: (path: string) => `wss://tlbx.test${path}`,
+  closeWebSocket: (ws: FakeWebSocket | null, setter?: (value: null) => void) => {
+    if (!ws) return;
+    ws.onopen = null;
+    ws.onmessage = null;
+    ws.onerror = null;
+    ws.onclose = null;
+    ws.close();
+    setter?.(null);
+  },
+}));
+
+vi.mock('../../stores', () => ({
+  $currentSettings: {
+    get: () => mocks.currentSettings,
+    set: (value: unknown) => mocks.currentSettingsSet(value),
+  },
+  $updateInfo: {
+    get: () => mocks.updateInfo,
+    set: (value: unknown) => mocks.updateInfoSet(value),
+  },
+  $settingsWsConnected: {
+    set: (value: unknown) => mocks.settingsConnectedSet(value),
+    get: () => false,
+  },
+  areJsonLikeEqual: (left: unknown, right: unknown) =>
+    JSON.stringify(left) === JSON.stringify(right),
+}));
+
+vi.mock('../auth/sessionLifetime', () => ({
+  handleAuthenticatedWebSocketClose: () => false,
+}));
+
+vi.mock('../logging', () => ({
+  createLogger: () => ({ info: vi.fn(), error: vi.fn() }),
+}));
+
+vi.mock('../settings/persistence', () => ({
+  applyReceivedSettings: (settings: unknown) => mocks.applyReceivedSettings(settings),
+}));
+
+vi.mock('../updating/checker', () => ({
+  handleUpdateInfo: (update: unknown) => mocks.handleUpdateInfo(update),
+}));
+
+let connectSettingsWebSocket: typeof import('./settingsChannel').connectSettingsWebSocket;
+
+describe('settingsChannel', () => {
+  beforeAll(async () => {
+    ({ connectSettingsWebSocket } = await import('./settingsChannel'));
+  });
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    FakeWebSocket.instances = [];
+    vi.stubGlobal('WebSocket', FakeWebSocket as unknown as typeof WebSocket);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  function connect(): FakeWebSocket {
+    connectSettingsWebSocket();
+    const socket = FakeWebSocket.instances[0];
+    if (!socket) throw new Error('Settings WebSocket was not created.');
+    socket.readyState = FakeWebSocket.OPEN;
+    socket.onopen?.();
+    return socket;
+  }
+
+  it('ignores the unchanged initial settings snapshot after a resume reconnect', () => {
+    const socket = connect();
+
+    socket.onmessage?.({
+      data: JSON.stringify({ type: 'settings', settings: mocks.currentSettings }),
+    } as MessageEvent<string>);
+
+    expect(mocks.applyReceivedSettings).not.toHaveBeenCalled();
+    expect(mocks.currentSettingsSet).not.toHaveBeenCalled();
+  });
+
+  it('applies a changed settings snapshot exactly once', () => {
+    const socket = connect();
+    const changed = { ...mocks.currentSettings, fontSize: 16 };
+
+    socket.onmessage?.({
+      data: JSON.stringify({ type: 'settings', settings: changed }),
+    } as MessageEvent<string>);
+
+    expect(mocks.applyReceivedSettings).toHaveBeenCalledOnce();
+    expect(mocks.applyReceivedSettings).toHaveBeenCalledWith(changed);
+    expect(mocks.currentSettingsSet).not.toHaveBeenCalled();
+  });
+
+  it('ignores an unchanged update snapshot', () => {
+    const socket = connect();
+
+    socket.onmessage?.({
+      data: JSON.stringify({ type: 'update', update: mocks.updateInfo }),
+    } as MessageEvent<string>);
+
+    expect(mocks.handleUpdateInfo).not.toHaveBeenCalled();
+    expect(mocks.updateInfoSet).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/settingsChannel.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/settingsChannel.ts
index e6d84115b..36debf6a0 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/settingsChannel.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/settingsChannel.ts
@@ -9,7 +9,12 @@ import type { MidTermSettingsPublic, UpdateInfo } from '../../types';
 import { ReconnectController, createWsUrl, closeWebSocket } from '../../utils';
 import { handleAuthenticatedWebSocketClose } from '../auth/sessionLifetime';
 import { createLogger } from '../logging';
-import { $currentSettings, $updateInfo, $settingsWsConnected } from '../../stores';
+import {
+  $currentSettings,
+  $updateInfo,
+  $settingsWsConnected,
+  areJsonLikeEqual,
+} from '../../stores';
 import { applyReceivedSettings } from '../settings/persistence';
 import { handleUpdateInfo } from '../updating/checker';
 
@@ -30,20 +35,24 @@ let settingsWs: WebSocket | null = null;
  * Automatically reconnects with exponential backoff on disconnect.
  */
 export function connectSettingsWebSocket(): void {
+  settingsReconnect.cancel();
   closeWebSocket(settingsWs, (ws) => {
     settingsWs = ws;
   });
+  $settingsWsConnected.set(false);
 
   const ws = new WebSocket(createWsUrl('/ws/settings'));
   settingsWs = ws;
 
   ws.onopen = () => {
+    if (settingsWs !== ws) return;
     settingsReconnect.reset();
     $settingsWsConnected.set(true);
     log.info(() => 'Settings WebSocket connected');
   };
 
   ws.onmessage = (event) => {
+    if (settingsWs !== ws) return;
     try {
       const message = JSON.parse(event.data as string) as SettingsWsMessage;
       handleMessage(message);
@@ -54,6 +63,7 @@ export function connectSettingsWebSocket(): void {
   };
 
   ws.onclose = (event) => {
+    if (settingsWs !== ws) return;
     $settingsWsConnected.set(false);
     log.info(() => 'Settings WebSocket disconnected');
     if (handleAuthenticatedWebSocketClose(event)) {
@@ -77,10 +87,14 @@ export function connectSettingsWebSocket(): void {
 
 function handleMessage(message: SettingsWsMessage): void {
   if (message.type === 'settings' && message.settings) {
-    $currentSettings.set(message.settings);
+    if (areJsonLikeEqual(message.settings, $currentSettings.get())) {
+      return;
+    }
     applyReceivedSettings(message.settings);
   } else if (message.type === 'update' && message.update) {
-    $updateInfo.set(message.update);
+    if (areJsonLikeEqual(message.update, $updateInfo.get())) {
+      return;
+    }
     handleUpdateInfo(message.update);
   }
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.test.ts
index d6d45cb8a..21e830bb5 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.test.ts
@@ -39,6 +39,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock('../../utils', () => ({
   ReconnectController: class {
+    cancel(): void {}
     reset(): void {}
     schedule(callback?: () => void): void {
       callback?.();
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.ts
index ff0b48f7a..9518c4771 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/comms/stateChannel.ts
@@ -143,6 +143,14 @@ const pendingCommands = new Map<
     timeout: number;
   }
 >();
+
+function rejectPendingCommands(reason: string): void {
+  pendingCommands.forEach((command, id) => {
+    clearTimeout(command.timeout);
+    command.reject(new Error(reason));
+    pendingCommands.delete(id);
+  });
+}
 import {
   $settingsOpen,
   $stateWsConnected,
@@ -301,13 +309,17 @@ function handleStateSocketMessage(data: StateWsMessage): void {
  * Automatically reconnects with exponential backoff on disconnect.
  */
 export function connectStateWebSocket(): void {
+  stateReconnect.cancel();
+  rejectPendingCommands('Connection replaced');
   closeWebSocket(stateWs, setStateWs);
+  $stateWsConnected.set(false);
 
   const wsPath = isSharedSessionRoute() ? '/ws/share/state' : '/ws/state';
   const ws = new WebSocket(createWsUrl(wsPath));
   setStateWs(ws);
 
   ws.onopen = () => {
+    if (stateWs !== ws) return;
     stateReconnect.reset();
     const isReconnect = stateWsHasConnected;
     stateWsHasConnected = true;
@@ -319,6 +331,7 @@ export function connectStateWebSocket(): void {
   };
 
   ws.onmessage = (event) => {
+    if (stateWs !== ws) return;
     try {
       const data = JSON.parse(event.data as string) as StateWsMessage;
       handleStateSocketMessage(data);
@@ -329,14 +342,11 @@ export function connectStateWebSocket(): void {
   };
 
   ws.onclose = (event) => {
+    if (stateWs !== ws) return;
     $stateWsConnected.set(false);
 
     // Reject all pending commands immediately (don't wait for timeout)
-    pendingCommands.forEach((cmd, id) => {
-      clearTimeout(cmd.timeout);
-      cmd.reject(new Error('Connection lost'));
-      pendingCommands.delete(id);
-    });
+    rejectPendingCommands('Connection lost');
 
     if (handleAuthenticatedWebSocketClose(event)) {
       return;
@@ -346,6 +356,7 @@ export function connectStateWebSocket(): void {
   };
 
   ws.onerror = (e) => {
+    if (stateWs !== ws) return;
     log.error(() => `WebSocket error: ${e.type}`);
   };
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/managerBar.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/managerBar.ts
index 346506ea9..014983503 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/managerBar.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/managerBar.ts
@@ -139,9 +139,11 @@ export function initManagerBar(): void {
 
   const syncManagerBarVisibility = (): void => {
     const settings = $currentSettings.get();
+    const activeSessionId = $activeSessionId.get();
+    const hasQueuedItems = queueEntries.some((entry) => entry.sessionId === activeSessionId);
     const visible =
       !$settingsOpen.get() &&
-      shouldShowManagerBar(settings?.managerBarEnabled, $activeSessionId.get());
+      shouldShowManagerBar(settings?.managerBarEnabled, activeSessionId, hasQueuedItems);
     barEl?.classList.toggle('hidden', !visible);
     if (!visible) {
       overflowBtn?.setAttribute('hidden', '');
@@ -1024,7 +1026,7 @@ function describeQueueTitle(entry: ManagerBarQueueEntry): string {
 function describeQueueCondition(entry: ManagerBarQueueEntry): string {
   const usesTurnQueue = usesTurnQueueForSession(entry.sessionId);
   if (entry.kind === 'prompt' && entry.nextRunAt) {
-    return formatQueuedPromptRunAt(entry.nextRunAt);
+    return describeQueuedPromptCondition(entry);
   }
 
   if (entry.phase === 'chainCooldown') {
@@ -1061,6 +1063,29 @@ function describeQueueCondition(entry: ManagerBarQueueEntry): string {
   return t(usesTurnQueue ? 'managerBar.queue.turn' : 'managerBar.queue.cooldown');
 }
 
+function describeQueuedPromptCondition(entry: ManagerBarQueueEntry): string {
+  const nextRun = formatQueuedPromptRunAt(entry.nextRunAt ?? '');
+  return entry.repeatEveryMs && entry.repeatEveryMs >= 1000
+    ? `${t('managerBar.queue.every')} ${formatRepeatInterval(entry.repeatEveryMs)} · ${nextRun}`
+    : nextRun;
+}
+
+function formatRepeatInterval(intervalMs: number): string {
+  const units: Array<{ divisor: number; key: 'days' | 'hours' | 'minutes' | 'seconds' }> = [
+    { divisor: 86_400_000, key: 'days' },
+    { divisor: 3_600_000, key: 'hours' },
+    { divisor: 60_000, key: 'minutes' },
+    { divisor: 1000, key: 'seconds' },
+  ];
+  const unit = units.find(({ divisor }) => intervalMs % divisor === 0) ?? {
+    divisor: 1000,
+    key: 'seconds' as const,
+  };
+  return `${Math.max(1, Math.trunc(intervalMs / unit.divisor))} ${t(
+    `managerBar.intervalUnit.${unit.key}`,
+  )}`;
+}
+
 function describeQueuedPromptTitle(entry: ManagerBarQueueEntry): string {
   const text = entry.turn?.text?.trim() ?? '';
   if (text.length > 0) {
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.test.ts
index 90627ec74..7523da371 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.test.ts
@@ -11,4 +11,9 @@ describe('manager bar visibility', () => {
     expect(shouldShowManagerBar(true, 'session-1')).toBe(true);
     expect(shouldShowManagerBar(false, 'session-1')).toBe(false);
   });
+
+  it('keeps queued work visible when automation buttons are disabled', () => {
+    expect(shouldShowManagerBar(false, 'session-1', true)).toBe(true);
+    expect(shouldShowManagerBar(false, null, true)).toBe(false);
+  });
 });
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.ts
index 99a56551e..c4e97d30c 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/managerBar/visibility.ts
@@ -1,6 +1,11 @@
 export function shouldShowManagerBar(
   enabled: boolean | null | undefined,
   activeSessionId: string | null | undefined,
+  hasQueuedItems = false,
 ): boolean {
-  return enabled === true && typeof activeSessionId === 'string' && activeSessionId.length > 0;
+  return (
+    (enabled === true || hasQueuedItems) &&
+    typeof activeSessionId === 'string' &&
+    activeSessionId.length > 0
+  );
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.test.ts
index 556ddb5f3..662d8e994 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.test.ts
@@ -120,6 +120,62 @@ describe('appServerControlAttachments', () => {
     expect(files[0]?.name).toMatch(/\.avif$/);
   });
 
+  it('probes the async clipboard for data-poor Android image paste events only on mobile', async () => {
+    const { shouldProbeMobileClipboardForComposerImage } =
+      await import('./appServerControlAttachments');
+    const emptyClipboardData = {
+      files: [],
+      items: [],
+      getData: () => '',
+    };
+    const placeholderClipboardData = {
+      files: [],
+      items: [],
+      getData: (type: string) => (type === 'text/plain' ? '\ufffc' : ''),
+    };
+
+    expect(
+      shouldProbeMobileClipboardForComposerImage(
+        emptyClipboardData as unknown as DataTransfer,
+        true,
+      ),
+    ).toBe(true);
+    expect(
+      shouldProbeMobileClipboardForComposerImage(
+        placeholderClipboardData as unknown as DataTransfer,
+        true,
+      ),
+    ).toBe(true);
+    expect(
+      shouldProbeMobileClipboardForComposerImage(
+        emptyClipboardData as unknown as DataTransfer,
+        false,
+      ),
+    ).toBe(false);
+  });
+
+  it('turns a data-poor mobile paste into an image part through the async clipboard fallback', async () => {
+    const { extractAppServerControlComposerPasteParts } =
+      await import('./appServerControlAttachments');
+    const clipboardData = {
+      files: [],
+      items: [],
+      getData: (type: string) => (type === 'text/plain' ? '\ufffc' : ''),
+    };
+
+    await expect(
+      extractAppServerControlComposerPasteParts(
+        clipboardData as unknown as DataTransfer,
+        async () => [
+          {
+            types: ['image/png'],
+            getType: async () => new Blob(['png'], { type: 'image/png' }),
+          },
+        ],
+      ),
+    ).resolves.toMatchObject([{ kind: 'image', file: { type: 'image/png' } }]);
+  });
+
   it('interleaves plain text object placeholders with clipboard images in paste order', async () => {
     const { extractAppServerControlComposerPasteParts } =
       await import('./appServerControlAttachments');
@@ -132,10 +188,7 @@ describe('appServerControlAttachments', () => {
     };
 
     await expect(
-      extractAppServerControlComposerPasteParts(
-        clipboardData as unknown as DataTransfer,
-        null,
-      ),
+      extractAppServerControlComposerPasteParts(clipboardData as unknown as DataTransfer, null),
     ).resolves.toEqual([
       { kind: 'text', text: 'alpha' },
       { kind: 'image', file: firstImage },
@@ -160,10 +213,7 @@ describe('appServerControlAttachments', () => {
     };
 
     await expect(
-      extractAppServerControlComposerPasteParts(
-        clipboardData as unknown as DataTransfer,
-        null,
-      ),
+      extractAppServerControlComposerPasteParts(clipboardData as unknown as DataTransfer, null),
     ).resolves.toEqual([
       { kind: 'text', text: 'before\n' },
       { kind: 'image', file: firstImage },
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.ts
index 9efa78dea..b167d5dd6 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/appServerControlAttachments.ts
@@ -351,6 +351,23 @@ export function clipboardDataMayContainAppServerControlComposerImage(
   return getClipboardImageSourceUrls(clipboardData).some((url) => looksLikeClipboardImageUrl(url));
 }
 
+/**
+ * Android keyboards can expose an image paste as an empty/data-poor paste event (or only an
+ * object-replacement character). The paste gesture is the permission-bearing user action, so on
+ * mobile these events should still reach the async Clipboard API image fallback.
+ */
+export function shouldProbeMobileClipboardForComposerImage(
+  clipboardData: ClipboardTransferData | null | undefined,
+  isMobile: boolean,
+): boolean {
+  if (!isMobile) {
+    return false;
+  }
+
+  const plainText = clipboardData?.getData('text/plain') ?? '';
+  return plainText.length === 0 || plainText.includes(CLIPBOARD_OBJECT_REPLACEMENT);
+}
+
 export async function extractAppServerControlComposerPasteImageFiles(
   clipboardData: ClipboardTransferData | null | undefined,
   readClipboardItems: ClipboardReadImageProvider | null = getDefaultClipboardReadImageProvider(),
@@ -411,8 +428,9 @@ export async function extractAppServerControlComposerPasteParts(
     clipboardData,
     readClipboardItems,
   );
+  const fallbackText = plainText.split(CLIPBOARD_OBJECT_REPLACEMENT).join('');
   return [
-    ...(plainText ? [{ kind: 'text' as const, text: plainText }] : []),
+    ...(fallbackText ? [{ kind: 'text' as const, text: fallbackText }] : []),
     ...imageFiles.map((file) => ({ kind: 'image' as const, file })),
   ];
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/smartInput.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/smartInput.ts
index 44104925c..9befac307 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/smartInput.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/smartInput/smartInput.ts
@@ -48,6 +48,7 @@ import { getAdaptiveFooterRailSequence } from './layout';
 import {
   clipboardDataMayContainAppServerControlComposerImage,
   extractAppServerControlComposerPasteParts,
+  shouldProbeMobileClipboardForComposerImage,
   type AppServerControlComposerPastePart,
   type AppServerControlComposerDraftAttachment,
   MAX_APP_SERVER_CONTROL_IMAGE_BYTES,
@@ -64,7 +65,6 @@ import { captureImageFromWebcam } from './cameraCapture';
 import { openAppServerControlDraftAttachment } from './attachmentDraftOpen';
 import { renderAppServerControlAttachmentDraftView } from './attachmentDraftView';
 import {
-  createTerminalTouchToggleButton,
   createSmartInputDom,
   createToolButton,
   createToolButtonsStrip,
@@ -152,6 +152,7 @@ let appServerControlAttachmentHost: HTMLDivElement | null = null;
 let sharedPhotoInput: HTMLInputElement | null = null;
 let sharedAttachInput: HTMLInputElement | null = null;
 let toolsPanelOpen = false;
+let mobileTouchControllerHost: HTMLDivElement | null = null;
 let appServerControlQuickSettingsRow: HTMLDivElement | null = null;
 let appServerControlQuickSettingsActions: HTMLDivElement | null = null;
 let appServerControlModelSelect: HTMLSelectElement | null = null;
@@ -1436,6 +1437,7 @@ function createDockedDOM(): void {
       const hasLargeTextReference = text && shouldConvertPastedTextToSmartInputReference(text);
       if (
         clipboardDataMayContainAppServerControlComposerImage(event.clipboardData) ||
+        shouldProbeMobileClipboardForComposerImage(event.clipboardData, isMobileViewport()) ||
         hasLargeTextReference
       ) {
         event.preventDefault();
@@ -1520,6 +1522,11 @@ function createDockedDOM(): void {
   toolButtonsStrip = dom.toolsStrip;
   toolsPanel.appendChild(toolButtonsStrip);
 
+  mobileTouchControllerHost = document.createElement('div');
+  mobileTouchControllerHost.className = 'smart-input-mobile-touch-host';
+  mobileTouchControllerHost.hidden = true;
+  toolsPanel.appendChild(mobileTouchControllerHost);
+
   touchControllerEl ??= document.getElementById('touch-controller');
   if (touchControllerEl && touchControllerEl.parentElement !== footerContextHost) {
     footerContextHost.appendChild(touchControllerEl);
@@ -1574,12 +1581,18 @@ function getToolButtonRenderArgs(): Parameters<typeof createToolButtonsStrip>[0]
   };
 }
 
-function createAutomationOverflowProxy(): HTMLButtonElement {
+function createAutomationOverflowProxy(asTool = false): HTMLButtonElement {
   const btn = document.createElement('button');
   btn.type = 'button';
-  btn.className = 'manager-bar-overflow adaptive-footer-status-automation-proxy';
+  btn.className = asTool
+    ? 'smart-input-tool-button smart-input-mobile-aux-tool smart-input-mobile-automations'
+    : 'manager-bar-overflow adaptive-footer-status-automation-proxy';
   btn.title = t('managerBar.more');
-  btn.innerHTML = '<span class="icon">&#xe910;</span>';
+  btn.setAttribute('aria-label', t('managerBar.more'));
+  btn.innerHTML = asTool
+    ? '<span class="smart-input-tool-icon icon" aria-hidden="true">&#xe910;</span>' +
+      `<span class="smart-input-tool-label">${t('managerBar.more')}</span>`
+    : '<span class="icon">&#xe910;</span>';
   btn.addEventListener('click', (event) => {
     event.preventDefault();
     event.stopPropagation();
@@ -1588,20 +1601,75 @@ function createAutomationOverflowProxy(): HTMLButtonElement {
   return btn;
 }
 
-function createAutomationAddProxy(): HTMLButtonElement {
+function createAutomationAddProxy(asTool = false): HTMLButtonElement {
   const btn = document.createElement('button');
   btn.type = 'button';
-  btn.className = 'manager-bar-add adaptive-footer-status-automation-proxy';
+  btn.className = asTool
+    ? 'smart-input-tool-button smart-input-mobile-aux-tool smart-input-mobile-automation-add'
+    : 'manager-bar-add adaptive-footer-status-automation-proxy';
   btn.title = t('managerBar.addButton');
-  btn.textContent = '+';
+  btn.setAttribute('aria-label', t('managerBar.addButton'));
+  btn.innerHTML = asTool
+    ? '<span class="smart-input-tool-icon" aria-hidden="true">+</span>' +
+      `<span class="smart-input-tool-label">${t('managerBar.addButton')}</span>`
+    : '+';
   btn.addEventListener('click', (event) => {
     event.preventDefault();
     event.stopPropagation();
+    if (asTool) {
+      setToolsPanelOpen(false);
+    }
     triggerAddAutomation();
   });
   return btn;
 }
 
+function createMobileTouchKeysToolButton(
+  layoutState: AdaptiveFooterLayoutState,
+): HTMLButtonElement {
+  const button = document.createElement('button');
+  const expanded = layoutState.touchControlsExpanded;
+  button.type = 'button';
+  button.className =
+    'smart-input-tool-button smart-input-mobile-aux-tool smart-input-mobile-touch-toggle';
+  button.setAttribute('aria-pressed', expanded ? 'true' : 'false');
+  button.setAttribute('aria-label', expanded ? t('smartInput.keysHide') : t('smartInput.keysShow'));
+  button.innerHTML =
+    '<span class="smart-input-tool-icon" aria-hidden="true"><svg viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="5" width="18" height="14" rx="2"/><path d="M7 9h.01M11 9h.01M15 9h.01M17 13H7"/></svg></span>' +
+    `<span class="smart-input-tool-label">${expanded ? t('smartInput.keysHide') : t('smartInput.keysShow')}</span>`;
+  button.addEventListener('click', (event) => {
+    event.preventDefault();
+    event.stopPropagation();
+    setTouchKeysExpanded(!expanded);
+  });
+  return button;
+}
+
+function syncMobileAuxiliaryTools(layoutState: AdaptiveFooterLayoutState): void {
+  if (!toolButtonsStrip) {
+    return;
+  }
+
+  for (const node of toolButtonsStrip.querySelectorAll('.smart-input-mobile-aux-tool')) {
+    node.remove();
+  }
+  setAutomationOverflowProxyAnchor(null);
+
+  if (!layoutState.isMobile || layoutState.appServerControlActive) {
+    return;
+  }
+
+  if (layoutState.touchControlsAvailable) {
+    toolButtonsStrip.appendChild(createMobileTouchKeysToolButton(layoutState));
+  }
+  if (layoutState.showAutomation) {
+    const overflowProxy = createAutomationOverflowProxy(true);
+    toolButtonsStrip.appendChild(overflowProxy);
+    setAutomationOverflowProxyAnchor(overflowProxy);
+    toolButtonsStrip.appendChild(createAutomationAddProxy(true));
+  }
+}
+
 function syncInputRow(layoutState: AdaptiveFooterLayoutState): void {
   if (!footerPrimaryHost || !dockedBar) {
     return;
@@ -1631,6 +1699,7 @@ function syncInputRow(layoutState: AdaptiveFooterLayoutState): void {
     inlineToolHost.hidden = true;
   }
   toolsToggleBtn?.removeAttribute('hidden');
+  syncMobileAuxiliaryTools(layoutState);
   setToolsPanelOpen(toolsPanelOpen);
 }
 
@@ -1639,18 +1708,25 @@ function syncContextRow(layoutState: AdaptiveFooterLayoutState): void {
     return;
   }
 
+  if (layoutState.isMobile) {
+    footerContextHost.hidden = true;
+    if (touchControllerEl && mobileTouchControllerHost) {
+      if (touchControllerEl.parentElement !== mobileTouchControllerHost) {
+        mobileTouchControllerHost.appendChild(touchControllerEl);
+      }
+      touchControllerEl.classList.add('embedded');
+      touchControllerEl.classList.toggle('visible', layoutState.touchControlsExpanded);
+      mobileTouchControllerHost.hidden = !layoutState.touchControlsExpanded;
+    }
+    return;
+  }
+
   footerContextHost.replaceChildren();
 
   if (toolButtonsStrip && toolsPanel && toolButtonsStrip.parentElement !== toolsPanel) {
     toolsPanel.appendChild(toolButtonsStrip);
   }
 
-  if (layoutState.isMobile && !layoutState.touchControlsExpanded) {
-    touchControllerEl?.classList.remove('visible');
-    footerContextHost.hidden = true;
-    return;
-  }
-
   if (layoutState.showContext && layoutState.touchControlsAvailable) {
     if (keysExpanded && touchControllerEl) {
       touchControllerEl.classList.add('embedded', 'visible');
@@ -1718,7 +1794,11 @@ function syncStatusRow(layoutState: AdaptiveFooterLayoutState): void {
   }
 
   if (layoutState.isMobile) {
-    renderMobileTerminalStatusRow(layoutState);
+    setAutomationOverflowProxyAnchor(
+      (toolButtonsStrip?.querySelector('.smart-input-mobile-automations') as HTMLElement | null) ??
+        null,
+    );
+    footerStatusHost.toggleAttribute('hidden', true);
     return;
   }
 
@@ -1730,54 +1810,6 @@ function syncStatusRow(layoutState: AdaptiveFooterLayoutState): void {
   footerStatusHost.toggleAttribute('hidden', !renderedTerminalStatus);
 }
 
-function renderMobileTerminalStatusRow(layoutState: AdaptiveFooterLayoutState): void {
-  if (!footerStatusHost) {
-    return;
-  }
-
-  setAutomationOverflowProxyAnchor(null);
-
-  const leftCluster = document.createElement('div');
-  leftCluster.className = 'adaptive-footer-status-left';
-
-  if (canUseSmartInputVoiceSupport() && autoSendEnabled) {
-    const autoSendPill = document.createElement('div');
-    autoSendPill.className = 'adaptive-footer-status-pill';
-    autoSendPill.textContent = t('smartInput.autoSend');
-    leftCluster.appendChild(autoSendPill);
-  }
-
-  if (layoutState.touchControlsAvailable) {
-    const keysToggle = createTerminalTouchToggleButton({
-      expanded: layoutState.touchControlsExpanded,
-      onToggle: () => {
-        setTouchKeysExpanded(!layoutState.touchControlsExpanded);
-      },
-    });
-    leftCluster.appendChild(keysToggle);
-  }
-
-  if (leftCluster.childElementCount > 0) {
-    footerStatusHost.appendChild(leftCluster);
-  }
-
-  if (layoutState.showAutomation) {
-    const rightCluster = document.createElement('div');
-    rightCluster.className = 'adaptive-footer-status-right';
-
-    const overflowProxy = createAutomationOverflowProxy();
-    rightCluster.appendChild(overflowProxy);
-    setAutomationOverflowProxyAnchor(overflowProxy);
-
-    const addProxy = createAutomationAddProxy();
-    rightCluster.appendChild(addProxy);
-
-    footerStatusHost.appendChild(rightCluster);
-  }
-
-  footerStatusHost.toggleAttribute('hidden', false);
-}
-
 function renderAppServerControlStatusRow(layoutState: AdaptiveFooterLayoutState): void {
   if (
     !footerStatusHost ||
@@ -1978,7 +2010,7 @@ function setToolsPanelOpen(open: boolean): void {
   toolsPanel.parentElement?.classList.toggle('smart-input-row-tools-open', shouldOpen);
   toolsToggleBtn.setAttribute('aria-expanded', shouldOpen ? 'true' : 'false');
   toolsToggleBtn.classList.toggle('open', shouldOpen);
-  if (!footerResizeObserver) {
+  if (!isMobileViewport() && !footerResizeObserver) {
     queueFooterReserveSync();
   }
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/manager.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/manager.ts
index c15e70a3b..9c700d081 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/manager.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/manager.ts
@@ -41,6 +41,7 @@ import { showPasteIndicator, hidePasteIndicator } from '../badges';
 
 import { Terminal } from '@xterm/xterm';
 import { FitAddon } from '@xterm/addon-fit';
+import { ImageAddon } from '@xterm/addon-image';
 import { WebglAddon } from '@xterm/addon-webgl';
 import { WebLinksAddon } from '@xterm/addon-web-links';
 import { Unicode11Addon } from '@xterm/addon-unicode11';
@@ -76,7 +77,6 @@ import {
   DEFAULT_TERMINAL_LETTER_SPACING,
   DEFAULT_TERMINAL_LINE_HEIGHT,
   ensureTerminalFontLoaded,
-  getBundledTerminalFontFamilies,
   getConfiguredTerminalFontFamily,
 } from './fontConfig';
 import { getTerminalOptions } from './terminalOptions';
@@ -1189,6 +1189,32 @@ export function createTerminalForSession(
     syncTerminalLigatureState(state, settings?.terminalLigaturesEnabled ?? true);
     syncTerminalRgbBackgroundTransparency(state, settings);
 
+    // ImageAddon needs the opened terminal and its active renderer. Loading it
+    // after the WebGL/canvas selection keeps the image renderer bound to the
+    // renderer that will actually paint the session, including replayed output.
+    // Capability discovery itself is answered by mthost so it also works before
+    // a browser attaches. Keep decoded memory and individual payloads bounded.
+    try {
+      terminal.loadAddon(
+        new ImageAddon({
+          enableSizeReports: true,
+          pixelLimit: 4_194_304,
+          storageLimit: 32,
+          showPlaceholder: true,
+          kittySupport: true,
+          kittySizeLimit: 16_777_216,
+          sixelSupport: true,
+          sixelSizeLimit: 16_777_216,
+          iipSupport: true,
+          iipSizeLimit: 16_777_216,
+        }),
+      );
+    } catch (error) {
+      // Graphics are progressive enhancement. A future xterm/addon mismatch
+      // must degrade to text instead of making the session unusable.
+      log.warn(() => `Terminal ${sessionId} graphics initialization failed: ${String(error)}`);
+    }
+
     // Load Web-Links addon for clickable URLs
     try {
       const webLinksAddon = new WebLinksAddon(openTerminalWebLinkInNewTab);
@@ -1654,41 +1680,48 @@ export function refreshActiveTerminalBuffer(): void {
 }
 
 /**
- * Preload the terminal font for consistent rendering.
- * Has a 3-second timeout to prevent indefinite hangs if fonts fail to load.
+ * Give the configured terminal font a short startup budget. Alternate font
+ * choices must never delay xterm creation, and a late font only triggers one
+ * renderer remeasure instead of reopening or resizing the terminal.
  */
 export function preloadTerminalFont(): Promise<void> {
-  const FONT_TIMEOUT_MS = 3000;
+  const FONT_STARTUP_BUDGET_MS = 250;
   const baseFontSize = $currentSettings.get()?.fontSize ?? 14;
   const fontSize = getEffectiveTerminalFontSize(baseFontSize);
+  const fontFamily = getConfiguredTerminalFontFamily();
+  let startupBudgetExpired = false;
+  let timeoutId: ReturnType<typeof globalThis.setTimeout> | null = null;
 
-  const fontLoadPromise = Promise.allSettled(
-    getBundledTerminalFontFamilies().map((fontFamily) =>
-      ensureTerminalFontLoaded(fontFamily, fontSize),
-    ),
-  )
-    .then(() => document.fonts.ready)
-    .then(() => {
-      const testSpan = document.createElement('span');
-      testSpan.style.fontFamily = buildTerminalFontStack(getConfiguredTerminalFontFamily());
-      testSpan.style.position = 'absolute';
-      testSpan.style.left = '-9999px';
-      testSpan.textContent = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-      document.body.appendChild(testSpan);
-
-      return new Promise<void>((resolve) => {
-        requestAnimationFrame(() => {
-          testSpan.remove();
-          resolve();
-        });
+  const fontLoadPromise = ensureTerminalFontLoaded(fontFamily, fontSize).then(() => {
+    return new Promise<void>((resolve) => {
+      requestAnimationFrame(() => {
+        resolve();
       });
     });
+  });
 
   const timeoutPromise = new Promise<void>((resolve) => {
-    setTimeout(resolve, FONT_TIMEOUT_MS);
+    timeoutId = globalThis.setTimeout(() => {
+      startupBudgetExpired = true;
+      timeoutId = null;
+      resolve();
+    }, FONT_STARTUP_BUDGET_MS);
   });
 
   const promise = Promise.race([fontLoadPromise, timeoutPromise]);
+  void fontLoadPromise.then(() => {
+    if (timeoutId !== null) {
+      globalThis.clearTimeout(timeoutId);
+      timeoutId = null;
+    }
+    if (!startupBudgetExpired) return;
+
+    sessionTerminals.forEach((state) => {
+      if (!state.opened) return;
+      refreshTerminalRenderer(state);
+      applyTerminalScalingSync(state);
+    });
+  });
   setFontsReadyPromise(promise);
   return promise;
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.test.ts
index 9a9016e1a..b98a58fc5 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.test.ts
@@ -1,6 +1,8 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { sessionTerminals } from '../../state';
 import {
+  observeMobileVerticalViewportChange,
+  rememberCurrentMobileViewportSnapshot,
   revealMobileStableTerminalCursor,
   resumeMobileStableTerminalCursorFollowing,
   setMobileVerticalStability,
@@ -101,4 +103,12 @@ describe('mobile terminal vertical stability', () => {
     expect(state.container.dataset.mobileCursorFollowing).toBe('true');
     expect(state.container.scrollTop).toBe(0);
   });
+
+  it('classifies a one-pixel keyboard height change as vertical-only', () => {
+    rememberCurrentMobileViewportSnapshot();
+    const viewport = window.visualViewport as VisualViewport;
+    Object.defineProperty(viewport, 'height', { configurable: true, value: 429 });
+
+    expect(observeMobileVerticalViewportChange()).toBe(true);
+  });
 });
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.ts
index d1a9879b2..28cd28d2b 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/mobileVerticalStability.ts
@@ -3,7 +3,7 @@ import { sessionTerminals } from '../../state';
 
 const MOBILE_VIEWPORT_WIDTH_MAX = 768;
 const MOBILE_VERTICAL_WIDTH_TOLERANCE_PX = 2;
-const MOBILE_VERTICAL_HEIGHT_TOLERANCE_PX = 1;
+const MOBILE_VERTICAL_HEIGHT_TOLERANCE_PX = 0;
 const MOBILE_VERTICAL_BOTTOM_STICKY_PX = 32;
 const MOBILE_CURSOR_GUARD_PX = 8;
 
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/scaling.visual-viewport.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/scaling.visual-viewport.test.ts
index 648dc5ef7..ad355ddca 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/scaling.visual-viewport.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/scaling.visual-viewport.test.ts
@@ -340,6 +340,59 @@ describe('setupVisualViewport', () => {
     expect(state.container.scrollTop).toBe(0);
   });
 
+  it('ignores focused soft-keyboard height jitter instead of rebuilding terminal layout', () => {
+    const resizeCallbacks: Array<() => void> = [];
+    const appEl = { style: createStyleObject() };
+    const documentElement = { style: createStyleObject() };
+    const bodyClasses = new Set<string>();
+    const visualViewport = {
+      width: 390,
+      height: 600,
+      offsetTop: 0,
+      addEventListener: vi.fn((type: string, callback: () => void) => {
+        if (type === 'resize') {
+          resizeCallbacks.push(callback);
+        }
+      }),
+    };
+
+    globalThis.document = {
+      querySelector: (selector: string) =>
+        selector === '.terminal-page' ? (appEl as unknown as Element) : null,
+      documentElement: documentElement as unknown as Document['documentElement'],
+      body: {
+        style: createStyleObject(),
+        classList: {
+          contains: (name: string) => bodyClasses.has(name),
+          toggle: vi.fn((name: string, force?: boolean) => {
+            const next = force ?? !bodyClasses.has(name);
+            if (next) bodyClasses.add(name);
+            else bodyClasses.delete(name);
+            return next;
+          }),
+        },
+      } as unknown as Document['body'],
+      activeElement: { tagName: 'TEXTAREA', isContentEditable: false },
+      getElementById: () => null,
+    } as unknown as Document;
+    Object.defineProperty(host, 'visualViewport', {
+      configurable: true,
+      value: visualViewport,
+    });
+
+    setupVisualViewport();
+    visualViewport.height = 430;
+    resizeCallbacks.forEach((callback) => callback());
+    const keyboardHeight = appEl.style.height;
+    vi.mocked(sendResize).mockClear();
+
+    visualViewport.height = 429;
+    resizeCallbacks.forEach((callback) => callback());
+
+    expect(appEl.style.height).toBe(keyboardHeight);
+    expect(sendResize).not.toHaveBeenCalled();
+  });
+
   it('pins the app shell to the visual viewport and marks the keyboard-visible state', () => {
     const bodyClasses = new Set<string>();
     const appEl = { style: createStyleObject() };
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/visualViewport.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/visualViewport.ts
index 0395f66cf..dfd86f70f 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/visualViewport.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/terminal/visualViewport.ts
@@ -12,6 +12,7 @@ const KEYBOARD_BOTTOM_GUARD_MIN_PX = 10;
 const KEYBOARD_BOTTOM_GUARD_MAX_PX = 24;
 const KEYBOARD_BOTTOM_GUARD_RATIO = 0.035;
 const LAYOUT_VISUAL_VIEWPORT_HEIGHT_TOLERANCE_PX = 2;
+const KEYBOARD_VIEWPORT_JITTER_TOLERANCE_PX = 4;
 
 function getVisualViewportShellTop(visualViewport: VisualViewport): number {
   // Chromium with interactive-widget=resizes-content already moves the layout
@@ -165,12 +166,14 @@ export function setupVisualViewport(): void {
     const viewportTop = getVisualViewportShellTop(vv);
     const viewportWidth = Math.max(1, vv.width || window.innerWidth);
     const keyboardVisible = isSoftKeyboardVisible(rawViewportHeight, baselineHeight);
-    const heightAndWidthStable =
-      Math.abs(vh - lastHeight) < 1 && Math.abs(viewportWidth - lastWidth) < 1;
-    if (keyboardVisible && hasEditableElementFocus() && heightAndWidthStable) {
+    const keyboardGeometryStable =
+      Math.abs(vh - lastHeight) <= KEYBOARD_VIEWPORT_JITTER_TOLERANCE_PX &&
+      Math.abs(viewportWidth - lastWidth) < 1;
+    if (keyboardVisible && hasEditableElementFocus() && keyboardGeometryStable) {
       // Mobile browsers can pan the focused xterm/prompt textarea on every
-      // character. The visible boundary did not change, so following that
-      // offset would move the whole shell and repeat terminal synchronization.
+      // character and jitter the reported height by a few subpixels. Neither
+      // changes the usable terminal boundary, so following them would move the
+      // whole shell and repeat terminal synchronization on every keystroke.
       return;
     }
     if (
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/modules/updating/checker.ts b/src/Ai.Tlbx.MidTerm/src/ts/modules/updating/checker.ts
index b2361bff3..911cd406e 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/modules/updating/checker.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/modules/updating/checker.ts
@@ -324,6 +324,10 @@ export function checkForUpdates(e?: MouseEvent): void {
       }
 
       if (data) {
+        if (data.lastResult?.found) {
+          lastUpdateResult = data.lastResult;
+          renderUpdateResult();
+        }
         $updateInfo.set(data);
         renderUpdatePanel();
         renderUpdateCards(data);
@@ -544,11 +548,6 @@ export function checkUpdateResult(): void {
       // Store for settings panel display
       lastUpdateResult = data;
       renderUpdateResult();
-
-      // Clear the result file after storing
-      deleteUpdateResult().catch((e: unknown) => {
-        log.verbose(() => `Failed to clear update result: ${String(e)}`);
-      });
     })
     .catch((e: unknown) => {
       log.warn(() => `Failed to check update result: ${String(e)}`);
@@ -579,12 +578,25 @@ export function renderUpdateResult(): void {
       <span class="update-result-time">${timestamp}</span>
     </div>
     ${!lastUpdateResult.success ? `<div class="update-result-message">${escapeHtml(lastUpdateResult.message)}</div>` : ''}
+    ${lastUpdateResult.details ? `<div class="update-result-message">${escapeHtml(lastUpdateResult.details)}</div>` : ''}
+    ${lastUpdateResult.rollbackAttempted ? `<div class="update-result-message">${t('update.rollbackAttempted')}</div>` : ''}
     <button class="btn-secondary btn-view-log">${t('update.viewUpdateLog')}</button>
+    <button class="btn-secondary btn-dismiss-result">${t('sidebar.updateDismiss')}</button>
   `;
 
   container.querySelector('.btn-view-log')?.addEventListener('click', () => {
     void showUpdateLog();
   });
+  container.querySelector('.btn-dismiss-result')?.addEventListener('click', () => {
+    deleteUpdateResult()
+      .then(() => {
+        lastUpdateResult = null;
+        renderUpdateResult();
+      })
+      .catch((e: unknown) => {
+        log.warn(() => `Failed to dismiss update result: ${String(e)}`);
+      });
+  });
 }
 
 /**
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/stores/index.ts b/src/Ai.Tlbx.MidTerm/src/ts/stores/index.ts
index 26a74ba0e..6a7176533 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/stores/index.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/stores/index.ts
@@ -363,7 +363,7 @@ function areJsonLikeRecordsEqual(
   return true;
 }
 
-function areJsonLikeEqual(left: unknown, right: unknown): boolean {
+export function areJsonLikeEqual(left: unknown, right: unknown): boolean {
   if (Object.is(left, right)) {
     return true;
   }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/types.ts b/src/Ai.Tlbx.MidTerm/src/ts/types.ts
index b9e909fb3..f00b63e48 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/types.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/types.ts
@@ -1060,6 +1060,8 @@ export interface ManagerBarQueueEntry {
   nextPromptIndex: number;
   completedCycles: number;
   nextRunAt: string | null;
+  repeatEveryMs: number | null;
+  repeatCount: number | null;
   ignoreHeatUntil: string | null;
   awaitingHeatRise: boolean;
 }
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/utils/reconnect.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/utils/reconnect.test.ts
new file mode 100644
index 000000000..f5ca2cc02
--- /dev/null
+++ b/src/Ai.Tlbx.MidTerm/src/ts/utils/reconnect.test.ts
@@ -0,0 +1,39 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ReconnectController } from './reconnect';
+
+describe('ReconnectController', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.spyOn(Math, 'random').mockReturnValue(0.5);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+  });
+
+  it('cancels a scheduled reconnect when a connection opens explicitly', () => {
+    const reconnect = new ReconnectController();
+    const connect = vi.fn();
+
+    reconnect.schedule(connect);
+    reconnect.reset();
+    vi.runAllTimers();
+
+    expect(connect).not.toHaveBeenCalled();
+  });
+
+  it('runs only the latest scheduled reconnect', () => {
+    const reconnect = new ReconnectController();
+    const first = vi.fn();
+    const second = vi.fn();
+
+    reconnect.schedule(first);
+    reconnect.schedule(second);
+    vi.runAllTimers();
+
+    expect(first).not.toHaveBeenCalled();
+    expect(second).toHaveBeenCalledOnce();
+  });
+});
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/utils/reconnect.ts b/src/Ai.Tlbx.MidTerm/src/ts/utils/reconnect.ts
index 06afe6c1f..1872cf57d 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/utils/reconnect.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/utils/reconnect.ts
@@ -16,7 +16,7 @@ import {
  * Each WebSocket channel should create its own instance.
  */
 export class ReconnectController {
-  private _timer: number | undefined;
+  private _timer: ReturnType<typeof globalThis.setTimeout> | undefined;
   private _attempt = 0;
 
   schedule(connect: () => void): void {
@@ -27,11 +27,15 @@ export class ReconnectController {
     );
     const jitter = baseDelay * RECONNECT_JITTER * (2 * Math.random() - 1);
     const delay = Math.round(baseDelay + jitter);
-    this._timer = window.setTimeout(connect, delay);
+    this._timer = globalThis.setTimeout(() => {
+      this._timer = undefined;
+      connect();
+    }, delay);
     this._attempt++;
   }
 
   reset(): void {
+    this.cancel();
     this._attempt = 0;
   }
 
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.test.ts b/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.test.ts
index 43fbde858..202e574c5 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.test.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { createWsUrl } from './websocket';
+import { closeWebSocket, createWsUrl } from './websocket';
 
 describe('createWsUrl', () => {
   const originalLocation = globalThis.location;
@@ -66,4 +66,24 @@ describe('createWsUrl', () => {
     expect(parsed.pathname).toBe('/webpreview/route-123/ws/state');
     expect(parsed.searchParams.get('tabId')).toBe('tab-123');
   });
+
+  it('detaches every callback before retiring a websocket generation', () => {
+    const socket = {
+      onopen: vi.fn(),
+      onmessage: vi.fn(),
+      onerror: vi.fn(),
+      onclose: vi.fn(),
+      close: vi.fn(),
+    } as unknown as WebSocket;
+    const setter = vi.fn();
+
+    closeWebSocket(socket, setter);
+
+    expect(socket.onopen).toBeNull();
+    expect(socket.onmessage).toBeNull();
+    expect(socket.onerror).toBeNull();
+    expect(socket.onclose).toBeNull();
+    expect(socket.close).toHaveBeenCalledOnce();
+    expect(setter).toHaveBeenCalledWith(null);
+  });
 });
diff --git a/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.ts b/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.ts
index 8cc8b4e87..17d671212 100644
--- a/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.ts
+++ b/src/Ai.Tlbx.MidTerm/src/ts/utils/websocket.ts
@@ -31,6 +31,9 @@ export function createWsUrl(path: string): string {
  */
 export function closeWebSocket(ws: WebSocket | null, setter?: (ws: null) => void): void {
   if (ws) {
+    ws.onopen = null;
+    ws.onmessage = null;
+    ws.onerror = null;
     ws.onclose = null;
     ws.close();
     if (setter) setter(null);
diff --git a/src/npx-launcher/package.json b/src/npx-launcher/package.json
index f8b99c9ec..c9b30bc04 100644
--- a/src/npx-launcher/package.json
+++ b/src/npx-launcher/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@tlbx-ai/midterm",
-  "version": "10.6.4",
+  "version": "10.6.15-dev",
   "description": "Quick-trial launcher for tlbx, the self-hosted browser control station for remote AI coding agents",
   "license": "AGPL-3.0-only",
   "repository": {
diff --git a/src/version.json b/src/version.json
index c94ccf0e1..716fd875b 100644
--- a/src/version.json
+++ b/src/version.json
@@ -1,7 +1,6 @@
 {
-  "web": "10.6.4",
-  "pty": "10.3.1",
+  "web": "10.6.15-dev",
+  "pty": "10.6.15-dev",
   "protocol": 1,
-  "minCompatiblePty": "2.0.0",
-  "webOnly": true
+  "minCompatiblePty": "2.0.0"
 }
diff --git a/uninstall.ps1 b/uninstall.ps1
index 42dfe1a7d..10d930995 100644
--- a/uninstall.ps1
+++ b/uninstall.ps1
@@ -1,4 +1,4 @@
-# MidTerm Windows Uninstaller
+# tlbx Windows Uninstaller
 # Usage: irm https://get.tlbx.ai/uninstall.ps1 | iex
 
 param(
@@ -35,27 +35,22 @@ function Invoke-CompatibleWebRequest
     return Invoke-WebRequest @params
 }
 
-$ServiceName = "MidTerm"
-$OldHostServiceName = "MidTermHost"
-$FirewallRuleName = "MidTerm HTTPS"
-$CertificateSubject = "CN=ai.tlbx.midterm"
-
-$WIN_SERVICE_SETTINGS_DIR = "$env:ProgramData\MidTerm"
-$WIN_SERVICE_INSTALL_DIR = "$env:ProgramFiles\MidTerm"
+$ServiceNames = @("tlbx", "MidTerm")
+$OldHostServiceNames = @("tlbxHost", "MidTermHost")
+$FirewallRuleNames = @("tlbx HTTPS", "MidTerm HTTPS")
+$CertificateSubjects = @("CN=tlbx", "CN=ai.tlbx.midterm")
+$ServiceSettingsDirs = @("$env:ProgramData\tlbx", "$env:ProgramData\MidTerm")
+$ServiceInstallDirs = @("$env:ProgramFiles\tlbx", "$env:ProgramFiles\MidTerm")
 
 function Write-Banner
 {
     Write-Host ""
-    Write-Host "            //   \\" -ForegroundColor White
-    Write-Host "           //     \\         __  __ _     _ _____" -ForegroundColor White
-    Write-Host "          //       \\       |  \/  (_) __| |_   _|__ _ __ _ __ ___" -ForegroundColor White
-    Write-Host "         //  ( " -NoNewline -ForegroundColor White
-    Write-Host "·" -NoNewline -ForegroundColor Cyan
-    Write-Host " )  \\      | |\/| | |/ _` | | |/ _ \\ '__| '_ ` _ \\" -ForegroundColor White
-    Write-Host "        //           \\     | |  | | | (_| | | |  __/ |  | | | | | |" -ForegroundColor White
-    Write-Host "       //             \\    |_|  |_|_|\__,_| |_|\___|_|  |_| |_| |_|" -ForegroundColor White
-    Write-Host "      //               \\   " -NoNewline -ForegroundColor White
-    Write-Host "tlbx.ai - https://github.com/tlbx-ai/tlbx" -ForegroundColor Green
+    Write-Host "       _   _ _            " -ForegroundColor White
+    Write-Host "      | |_| | |__  __  __ " -ForegroundColor White
+    Write-Host "      | __| | '_ \ \ \/ / " -ForegroundColor White
+    Write-Host "      | |_| | |_) | >  <  " -ForegroundColor White
+    Write-Host "       \__|_|_.__/ /_/\_\ " -ForegroundColor White
+    Write-Host "      tlbx.ai - https://github.com/tlbx-ai/tlbx" -ForegroundColor Green
     Write-Host ""
 }
 
@@ -197,7 +192,7 @@ function Test-GlobExists
     return [bool](Get-ChildItem -Path $BasePath -Filter $Filter -Force -ErrorAction SilentlyContinue | Select-Object -First 1)
 }
 
-function Stop-MidTermProcesses
+function Stop-TlbxProcesses
 {
     param([string[]]$KnownPaths)
 
@@ -209,7 +204,7 @@ function Stop-MidTermProcesses
 
     try
     {
-        $processes = Get-CimInstance Win32_Process -Filter "Name='mt.exe' OR Name='mthost.exe' OR Name='mt-host.exe'" -ErrorAction SilentlyContinue
+        $processes = Get-CimInstance Win32_Process -Filter "Name='mt.exe' OR Name='mthost.exe' OR Name='mtagenthost.exe' OR Name='mttmux.exe' OR Name='mt-host.exe'" -ErrorAction SilentlyContinue
         foreach ($proc in $processes)
         {
             $exePath = $proc.ExecutablePath
@@ -226,18 +221,18 @@ function Stop-MidTermProcesses
     }
     catch
     {
-        Write-WarnLine "Could not stop one or more running MidTerm processes."
+        Write-WarnLine "Could not stop one or more running tlbx processes."
     }
 }
 
-function Remove-MidTermCertificates
+function Remove-TlbxCertificates
 {
     try
     {
         $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
         $rootStore.Open("ReadWrite")
-        $midTermCerts = @($rootStore.Certificates | Where-Object { $_.Subject -eq $CertificateSubject })
-        foreach ($cert in $midTermCerts)
+        $tlbxCerts = @($rootStore.Certificates | Where-Object { $_.Subject -in $CertificateSubjects })
+        foreach ($cert in $tlbxCerts)
         {
             try
             {
@@ -250,14 +245,14 @@ function Remove-MidTermCertificates
         }
         $rootStore.Close()
 
-        if ($midTermCerts.Count -gt 0)
+        if ($tlbxCerts.Count -gt 0)
         {
-            Write-Step "Removed $($midTermCerts.Count) trusted MidTerm certificate(s)."
+            Write-Step "Removed $($tlbxCerts.Count) trusted tlbx certificate(s)."
         }
     }
     catch
     {
-        Write-WarnLine "Could not clean up trusted MidTerm certificates."
+        Write-WarnLine "Could not clean up trusted tlbx certificates."
     }
 }
 
@@ -280,7 +275,7 @@ function Remove-UserPathEntry
     }
 }
 
-function Remove-MidTermTempArtifacts
+function Remove-TlbxTempArtifacts
 {
     param([string[]]$Roots)
 
@@ -312,6 +307,7 @@ function Test-UserTraces
     return (
         (Test-Path $UserInstallDir) -or
         (Test-Path $UserSettingsDir) -or
+        (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tlbx") -or
         (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm") -or
         (Test-Path (Join-Path $TempRoot "midterm-bin")) -or
         (Test-Path (Join-Path $TempRoot "mt-drops")) -or
@@ -333,7 +329,7 @@ function Test-ServiceTraces
     {
         $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
         $rootStore.Open("ReadOnly")
-        $hasCerts = [bool]($rootStore.Certificates | Where-Object { $_.Subject -eq $CertificateSubject } | Select-Object -First 1)
+        $hasCerts = [bool]($rootStore.Certificates | Where-Object { $_.Subject -in $CertificateSubjects } | Select-Object -First 1)
         $rootStore.Close()
     }
     catch
@@ -343,15 +339,16 @@ function Test-ServiceTraces
 
     if (Get-Command Get-NetFirewallRule -ErrorAction SilentlyContinue)
     {
-        $hasFirewallRule = [bool](Get-NetFirewallRule -DisplayName $FirewallRuleName -ErrorAction SilentlyContinue)
+        $hasFirewallRule = [bool](Get-NetFirewallRule -DisplayName $FirewallRuleNames -ErrorAction SilentlyContinue)
     }
 
     return (
-        (Test-Path $WIN_SERVICE_INSTALL_DIR) -or
-        (Test-Path $WIN_SERVICE_SETTINGS_DIR) -or
+        [bool]($ServiceInstallDirs | Where-Object { Test-Path $_ } | Select-Object -First 1) -or
+        [bool]($ServiceSettingsDirs | Where-Object { Test-Path $_ } | Select-Object -First 1) -or
+        (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tlbx") -or
         (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm") -or
-        (Get-Service -Name $ServiceName -ErrorAction SilentlyContinue) -or
-        (Get-Service -Name $OldHostServiceName -ErrorAction SilentlyContinue) -or
+        (Get-Service -Name $ServiceNames -ErrorAction SilentlyContinue) -or
+        (Get-Service -Name $OldHostServiceNames -ErrorAction SilentlyContinue) -or
         $hasFirewallRule -or
         $hasCerts
     )
@@ -367,72 +364,92 @@ function Invoke-UserCleanup
 
     Write-Step "Cleaning user install..."
 
-    Stop-MidTermProcesses -KnownPaths @(
+    Stop-TlbxProcesses -KnownPaths @(
         (Join-Path $UserInstallDir "mt.exe"),
         (Join-Path $UserInstallDir "mthost.exe"),
+        (Join-Path $UserInstallDir "mtagenthost.exe"),
+        (Join-Path $UserInstallDir "mttmux.exe"),
         (Join-Path $UserInstallDir "mt-host.exe")
     )
 
     Remove-UserPathEntry -PathToRemove $UserInstallDir
+    Remove-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tlbx" -Force -Recurse -ErrorAction SilentlyContinue
     Remove-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm" -Force -Recurse -ErrorAction SilentlyContinue
     Remove-PathIfExists -Path $UserInstallDir
     Remove-PathIfExists -Path $UserSettingsDir
-    Remove-MidTermTempArtifacts -Roots @($TempRoot, [System.IO.Path]::GetTempPath())
+    Remove-TlbxTempArtifacts -Roots @($TempRoot, [System.IO.Path]::GetTempPath())
 }
 
 function Invoke-ServiceCleanup
 {
     Write-Step "Cleaning system install..."
 
-    Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue
-    sc.exe delete $ServiceName | Out-Null 2>$null
-    Stop-Service -Name $OldHostServiceName -Force -ErrorAction SilentlyContinue
-    sc.exe delete $OldHostServiceName | Out-Null 2>$null
+    foreach ($serviceName in @($ServiceNames + $OldHostServiceNames))
+    {
+        Stop-Service -Name $serviceName -Force -ErrorAction SilentlyContinue
+        sc.exe delete $serviceName | Out-Null 2>$null
+    }
 
-    Stop-MidTermProcesses -KnownPaths @(
-        (Join-Path $WIN_SERVICE_INSTALL_DIR "mt.exe"),
-        (Join-Path $WIN_SERVICE_INSTALL_DIR "mthost.exe"),
-        (Join-Path $WIN_SERVICE_INSTALL_DIR "mt-host.exe")
+    Stop-TlbxProcesses -KnownPaths @(
+        ($ServiceInstallDirs | ForEach-Object { Join-Path $_ "mt.exe" }),
+        ($ServiceInstallDirs | ForEach-Object { Join-Path $_ "mthost.exe" }),
+        ($ServiceInstallDirs | ForEach-Object { Join-Path $_ "mtagenthost.exe" }),
+        ($ServiceInstallDirs | ForEach-Object { Join-Path $_ "mttmux.exe" }),
+        ($ServiceInstallDirs | ForEach-Object { Join-Path $_ "mt-host.exe" })
     )
 
     if ((Get-Command Get-NetFirewallRule -ErrorAction SilentlyContinue) -and
         (Get-Command Remove-NetFirewallRule -ErrorAction SilentlyContinue))
     {
-        Get-NetFirewallRule -DisplayName $FirewallRuleName -ErrorAction SilentlyContinue |
+        Get-NetFirewallRule -DisplayName $FirewallRuleNames -ErrorAction SilentlyContinue |
             Remove-NetFirewallRule -ErrorAction SilentlyContinue | Out-Null
     }
 
+    Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tlbx" -Force -Recurse -ErrorAction SilentlyContinue
     Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MidTerm" -Force -Recurse -ErrorAction SilentlyContinue
-    Remove-MidTermCertificates
-    Remove-PathIfExists -Path $WIN_SERVICE_SETTINGS_DIR
-    Remove-PathIfExists -Path $WIN_SERVICE_INSTALL_DIR
+    Remove-TlbxCertificates
+    $ServiceSettingsDirs | ForEach-Object { Remove-PathIfExists -Path $_ }
+    $ServiceInstallDirs | ForEach-Object { Remove-PathIfExists -Path $_ }
 }
 
 Resolve-OriginalContext
 
-$userInstallDir = Join-Path $OriginalLocalAppData "MidTerm"
-$userSettingsDir = Join-Path $OriginalUserProfile ".midterm"
+$userInstallDirs = @((Join-Path $OriginalLocalAppData "tlbx"), (Join-Path $OriginalLocalAppData "MidTerm"))
+$userSettingsDirs = @((Join-Path $OriginalUserProfile ".tlbx"), (Join-Path $OriginalUserProfile ".midterm"))
 
 Write-Header
 Write-Step "User profile: $OriginalUserProfile"
-Write-Step "User install traces: $(Test-UserTraces -UserInstallDir $userInstallDir -UserSettingsDir $userSettingsDir -TempRoot $OriginalTempRoot)"
+Write-Step "User install traces: $([bool]($userInstallDirs | ForEach-Object { $installDir = $_; $settingsDir = $userSettingsDirs[[Array]::IndexOf($userInstallDirs, $_)]; Test-UserTraces -UserInstallDir $installDir -UserSettingsDir $settingsDir -TempRoot $OriginalTempRoot } | Where-Object { $_ } | Select-Object -First 1))"
 $serviceTraces = [bool](Test-ServiceTraces)
 Write-Step "System install traces: $serviceTraces"
 
-if (-not (Test-UserTraces -UserInstallDir $userInstallDir -UserSettingsDir $userSettingsDir -TempRoot $OriginalTempRoot) -and -not $serviceTraces)
+$userTraces = $false
+for ($i = 0; $i -lt $userInstallDirs.Count; $i++)
 {
-    Write-Host "  No known MidTerm installation traces were found." -ForegroundColor Green
+    if (Test-UserTraces -UserInstallDir $userInstallDirs[$i] -UserSettingsDir $userSettingsDirs[$i] -TempRoot $OriginalTempRoot)
+    {
+        $userTraces = $true
+    }
+}
+if (-not $userTraces -and -not $serviceTraces)
+{
+    Write-Host "  No known tlbx installation traces were found." -ForegroundColor Green
     return
 }
 
-Invoke-UserCleanup -UserInstallDir $userInstallDir -UserSettingsDir $userSettingsDir -TempRoot $OriginalTempRoot
+for ($i = 0; $i -lt $userInstallDirs.Count; $i++)
+{
+    Invoke-UserCleanup -UserInstallDir $userInstallDirs[$i] -UserSettingsDir $userSettingsDirs[$i] -TempRoot $OriginalTempRoot
+}
+[Environment]::SetEnvironmentVariable("TLBX_PORT", $null, "User")
+[Environment]::SetEnvironmentVariable("TLBX_BIND", $null, "User")
 
 if ($serviceTraces)
 {
     if (-not (Test-Administrator))
     {
         Write-Host ""
-        Write-Host "  Requesting administrator privileges to remove the MidTerm service, trusted certs, firewall rule, and system files..." -ForegroundColor Yellow
+        Write-Host "  Requesting administrator privileges to remove the tlbx service, trusted certs, firewall rule, and system files..." -ForegroundColor Yellow
 
         $scriptUrl = "https://get.tlbx.ai/uninstall.ps1"
         $tempScript = Join-Path $env:TEMP "mt-uninstall-elevated.ps1"
@@ -462,4 +479,4 @@ if ($serviceTraces)
 }
 
 Write-Host ""
-Write-Host "  MidTerm uninstall complete." -ForegroundColor Green
+Write-Host "  tlbx uninstall complete." -ForegroundColor Green
diff --git a/uninstall.sh b/uninstall.sh
index b4aa9882a..bc4a5d1e8 100644
--- a/uninstall.sh
+++ b/uninstall.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# MidTerm macOS/Linux Uninstaller
+# tlbx macOS/Linux Uninstaller
 # Usage: curl -fsSL https://get.tlbx.ai/uninstall.sh | bash
 
 set -u
@@ -15,17 +15,17 @@ bootstrap_download() {
     if command_exists curl; then
         curl --fail --silent --show-error --location \
             --retry 3 --retry-delay 1 --retry-all-errors \
-            -H "User-Agent: MidTerm-Uninstaller" \
+            -H "User-Agent: tlbx-Uninstaller" \
             "$url" -o "$dest"
         return
     fi
 
     if command_exists wget; then
-        wget -qO "$dest" --user-agent="MidTerm-Uninstaller" "$url"
+        wget -qO "$dest" --user-agent="tlbx-Uninstaller" "$url"
         return
     fi
 
-    echo "Error: MidTerm uninstaller requires 'curl' or 'wget' to download files." >&2
+    echo "Error: tlbx uninstaller requires 'curl' or 'wget' to download files." >&2
     echo "Install one of them and run the uninstaller again." >&2
     exit 1
 }
@@ -43,17 +43,22 @@ fi
 SCRIPT_DIR=$(cd "$(dirname "$SCRIPT_PATH")" && pwd)
 SCRIPT_PATH="$SCRIPT_DIR/$(basename "$SCRIPT_PATH")"
 
-SERVICE_NAME="MidTerm"
+SERVICE_NAME="tlbx"
+LEGACY_SERVICE_NAME="MidTerm"
 OLD_HOST_SERVICE_NAME="MidTerm-host"
-LAUNCHD_LABEL="ai.tlbx.midterm"
+LAUNCHD_LABEL="ai.tlbx.service"
+LEGACY_LAUNCHD_LABEL="ai.tlbx.midterm"
 OLD_LAUNCHD_LABEL="com.aitlbx.MidTerm"
 OLD_LAUNCHD_HOST_LABEL="com.aitlbx.MidTerm-host"
 
-UNIX_SERVICE_SETTINGS_DIR="/usr/local/etc/midterm"
+UNIX_SERVICE_SETTINGS_DIR="/usr/local/etc/tlbx"
+LEGACY_SERVICE_SETTINGS_DIR="/usr/local/etc/midterm"
 UNIX_SERVICE_LOG_DIR="/usr/local/var/log"
 UNIX_SERVICE_BIN_DIR="/usr/local/bin"
-UNIX_SERVICE_LIB_DIR="/usr/local/lib/MidTerm"
-LINUX_CERT_PATH="/usr/local/share/ca-certificates/midterm.crt"
+UNIX_SERVICE_LIB_DIR="/usr/local/lib/tlbx"
+LEGACY_SERVICE_LIB_DIR="/usr/local/lib/MidTerm"
+LINUX_CERT_PATH="/usr/local/share/ca-certificates/tlbx.crt"
+LEGACY_LINUX_CERT_PATH="/usr/local/share/ca-certificates/midterm.crt"
 
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -67,20 +72,19 @@ INSTALLING_USER="${INSTALLING_USER:-}"
 INSTALLING_HOME="${INSTALLING_HOME:-}"
 ELEVATED=false
 
-print_midterm_banner() {
+print_tlbx_banner() {
     echo ""
-    echo -e "            ${WHITE}//   \\\\${NC}"
-    echo -e "           ${WHITE}//     \\\\         __  __ _     _ _____${NC}"
-    echo -e "          ${WHITE}//       \\\\       |  \\/  (_) __| |_   _|__ _ __ _ __ ___${NC}"
-    echo -e "         ${WHITE}//  ( ${CYAN}·${WHITE} )  \\\\      | |\\/| | |/ _\` | | |/ _ \\\\ '__| '_ \` _ \\\\${NC}"
-    echo -e "        ${WHITE}//           \\\\     | |  | | | (_| | | |  __/ |  | | | | | |${NC}"
-    echo -e "       ${WHITE}//             \\\\    |_|  |_|_|\\__,_| |_|\\___|_|  |_| |_| |_|${NC}"
-    echo -e "      ${WHITE}//               \\\\   ${GREEN}tlbx.ai - https://github.com/tlbx-ai/tlbx${NC}"
+    echo -e "       ${WHITE}_   _ _${NC}"
+    echo -e "      ${WHITE}| |_| | |__  __  __${NC}"
+    echo -e "      ${WHITE}| __| | '_ \\\\ \\\\ \\/ /${NC}"
+    echo -e "      ${WHITE}| |_| | |_) | >  <${NC}"
+    echo -e "       ${WHITE}\\\\__|_|_.__/ /_/\\\\_\\\\${NC}"
+    echo -e "      ${GREEN}tlbx.ai - https://github.com/tlbx-ai/tlbx${NC}"
     echo ""
 }
 
 print_header() {
-    print_midterm_banner
+    print_tlbx_banner
     echo -e "  ${CYAN}Uninstaller${NC}"
     echo ""
 }
@@ -229,9 +233,12 @@ detect_user_traces() {
     path_exists "$UNIX_USER_BIN_DIR/mt" ||
         path_exists "$UNIX_USER_BIN_DIR/mthost" ||
         path_exists "$UNIX_USER_BIN_DIR/mtagenthost" ||
+        path_exists "$UNIX_USER_BIN_DIR/mttmux" ||
         path_exists "$UNIX_USER_BIN_DIR/mt-host" ||
         path_exists "$UNIX_USER_LIB_DIR" ||
-        path_exists "$UNIX_USER_SETTINGS_DIR"
+        path_exists "$LEGACY_USER_LIB_DIR" ||
+        path_exists "$UNIX_USER_SETTINGS_DIR" ||
+        path_exists "$LEGACY_USER_SETTINGS_DIR"
 }
 
 detect_temp_traces() {
@@ -256,31 +263,37 @@ detect_service_traces() {
     path_exists "$UNIX_SERVICE_BIN_DIR/mt" ||
         path_exists "$UNIX_SERVICE_BIN_DIR/mthost" ||
         path_exists "$UNIX_SERVICE_BIN_DIR/mtagenthost" ||
+        path_exists "$UNIX_SERVICE_BIN_DIR/mttmux" ||
         path_exists "$UNIX_SERVICE_BIN_DIR/mt-host" ||
         path_exists "$UNIX_SERVICE_BIN_DIR/version.json" ||
         path_exists "$UNIX_SERVICE_LIB_DIR" ||
+        path_exists "$LEGACY_SERVICE_LIB_DIR" ||
         path_exists "$UNIX_SERVICE_SETTINGS_DIR" ||
+        path_exists "$LEGACY_SERVICE_SETTINGS_DIR" ||
+        path_exists "$UNIX_SERVICE_LOG_DIR/tlbx.log" ||
         path_exists "$UNIX_SERVICE_LOG_DIR/MidTerm.log" ||
         path_exists "$UNIX_SERVICE_LOG_DIR/update.log" ||
         path_exists "$UNIX_SERVICE_LOG_DIR/data" ||
         path_exists "$UNIX_SERVICE_LOG_DIR/midterm-backgrounds" ||
         path_exists "/etc/systemd/system/${SERVICE_NAME}.service" ||
+        path_exists "/etc/systemd/system/${LEGACY_SERVICE_NAME}.service" ||
         path_exists "/etc/systemd/system/${OLD_HOST_SERVICE_NAME}.service" ||
         path_exists "/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist" ||
+        path_exists "/Library/LaunchDaemons/${LEGACY_LAUNCHD_LABEL}.plist" ||
         path_exists "/Library/LaunchDaemons/${OLD_LAUNCHD_LABEL}.plist" ||
         path_exists "/Library/LaunchDaemons/${OLD_LAUNCHD_HOST_LABEL}.plist"
 }
 
 detect_system_trust_traces() {
     if [ "$(uname -s)" = "Darwin" ]; then
-        command_exists security && security find-certificate -a -c ai.tlbx.midterm /Library/Keychains/System.keychain >/dev/null 2>&1
+        command_exists security && { security find-certificate -a -c tlbx /Library/Keychains/System.keychain >/dev/null 2>&1 || security find-certificate -a -c ai.tlbx.midterm /Library/Keychains/System.keychain >/dev/null 2>&1; }
         return
     fi
 
-    path_exists "$LINUX_CERT_PATH"
+    path_exists "$LINUX_CERT_PATH" || path_exists "$LEGACY_LINUX_CERT_PATH"
 }
 
-stop_midterm_binary_processes() {
+stop_tlbx_binary_processes() {
     local pattern
     local path
     local pids=""
@@ -316,6 +329,8 @@ stop_service_processes() {
         if command_exists launchctl; then
             launchctl bootout system/"$LAUNCHD_LABEL" >/dev/null 2>&1 || \
                 launchctl unload "/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist" >/dev/null 2>&1 || true
+            launchctl bootout system/"$LEGACY_LAUNCHD_LABEL" >/dev/null 2>&1 || \
+                launchctl unload "/Library/LaunchDaemons/${LEGACY_LAUNCHD_LABEL}.plist" >/dev/null 2>&1 || true
             launchctl bootout system/"$OLD_LAUNCHD_LABEL" >/dev/null 2>&1 || \
                 launchctl unload "/Library/LaunchDaemons/${OLD_LAUNCHD_LABEL}.plist" >/dev/null 2>&1 || true
             launchctl bootout system/"$OLD_LAUNCHD_HOST_LABEL" >/dev/null 2>&1 || \
@@ -398,6 +413,7 @@ stop_service_processes() {
             }
 
             stop_linux_unit "$SERVICE_NAME"
+            stop_linux_unit "$LEGACY_SERVICE_NAME"
             stop_linux_unit "$OLD_HOST_SERVICE_NAME"
         fi
     fi
@@ -414,11 +430,16 @@ remove_system_trust() {
             [ -z "$cert_hash" ] && continue
             security delete-certificate -Z "$cert_hash" -t /Library/Keychains/System.keychain >/dev/null 2>&1 || true
         done < <(security find-certificate -a -Z -c ai.tlbx.midterm /Library/Keychains/System.keychain 2>/dev/null | sed -n 's/^SHA-256 hash: //p')
+        while IFS= read -r cert_hash; do
+            [ -z "$cert_hash" ] && continue
+            security delete-certificate -Z "$cert_hash" -t /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+        done < <(security find-certificate -a -Z -c tlbx /Library/Keychains/System.keychain 2>/dev/null | sed -n 's/^SHA-256 hash: //p')
 
         return 0
     fi
 
     remove_path "$LINUX_CERT_PATH" || true
+    remove_path "$LEGACY_LINUX_CERT_PATH" || true
     if command_exists update-ca-certificates; then
         update-ca-certificates >/dev/null 2>&1 || true
     fi
@@ -427,17 +448,21 @@ remove_system_trust() {
 cleanup_user_scope() {
     print_info "Cleaning user install for $INSTALLING_USER..."
 
-    stop_midterm_binary_processes \
+    stop_tlbx_binary_processes \
         "$UNIX_USER_BIN_DIR/mt" \
         "$UNIX_USER_BIN_DIR/mthost" \
-        "$UNIX_USER_BIN_DIR/mtagenthost" || true
+        "$UNIX_USER_BIN_DIR/mtagenthost" \
+        "$UNIX_USER_BIN_DIR/mttmux" || true
 
     remove_path "$UNIX_USER_BIN_DIR/mt" || true
     remove_path "$UNIX_USER_BIN_DIR/mthost" || true
     remove_path "$UNIX_USER_BIN_DIR/mtagenthost" || true
+    remove_path "$UNIX_USER_BIN_DIR/mttmux" || true
     remove_path "$UNIX_USER_BIN_DIR/mt-host" || true
     remove_path "$UNIX_USER_LIB_DIR" || true
+    remove_path "$LEGACY_USER_LIB_DIR" || true
     remove_path "$UNIX_USER_SETTINGS_DIR" || true
+    remove_path "$LEGACY_USER_SETTINGS_DIR" || true
 
     while IFS= read -r root; do
         cleanup_temp_root "$root"
@@ -448,25 +473,32 @@ cleanup_service_scope() {
     print_info "Cleaning system install..."
 
     stop_service_processes
-    stop_midterm_binary_processes \
+    stop_tlbx_binary_processes \
         "$UNIX_SERVICE_BIN_DIR/mt" \
         "$UNIX_SERVICE_BIN_DIR/mthost" \
         "$UNIX_SERVICE_BIN_DIR/mtagenthost" \
+        "$UNIX_SERVICE_BIN_DIR/mttmux" \
         "$UNIX_SERVICE_SETTINGS_DIR/mtagenthost" || true
 
     remove_path "/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist" || true
+    remove_path "/Library/LaunchDaemons/${LEGACY_LAUNCHD_LABEL}.plist" || true
     remove_path "/Library/LaunchDaemons/${OLD_LAUNCHD_LABEL}.plist" || true
     remove_path "/Library/LaunchDaemons/${OLD_LAUNCHD_HOST_LABEL}.plist" || true
     remove_path "/etc/systemd/system/${SERVICE_NAME}.service" || true
+    remove_path "/etc/systemd/system/${LEGACY_SERVICE_NAME}.service" || true
     remove_path "/etc/systemd/system/${OLD_HOST_SERVICE_NAME}.service" || true
 
     remove_path "$UNIX_SERVICE_BIN_DIR/mt" || true
     remove_path "$UNIX_SERVICE_BIN_DIR/mthost" || true
     remove_path "$UNIX_SERVICE_BIN_DIR/mtagenthost" || true
+    remove_path "$UNIX_SERVICE_BIN_DIR/mttmux" || true
     remove_path "$UNIX_SERVICE_BIN_DIR/mt-host" || true
     remove_path "$UNIX_SERVICE_BIN_DIR/version.json" || true
     remove_path "$UNIX_SERVICE_LIB_DIR" || true
+    remove_path "$LEGACY_SERVICE_LIB_DIR" || true
     remove_path "$UNIX_SERVICE_SETTINGS_DIR" || true
+    remove_path "$LEGACY_SERVICE_SETTINGS_DIR" || true
+    remove_path "$UNIX_SERVICE_LOG_DIR/tlbx.log" || true
     remove_path "$UNIX_SERVICE_LOG_DIR/MidTerm.log" || true
     remove_path "$UNIX_SERVICE_LOG_DIR/update.log" || true
     remove_path "$UNIX_SERVICE_LOG_DIR/data" || true
@@ -476,6 +508,7 @@ cleanup_service_scope() {
 
     if [ "$(uname -s)" != "Darwin" ] && command_exists systemctl; then
         systemctl reset-failed "$SERVICE_NAME" >/dev/null 2>&1 || true
+        systemctl reset-failed "$LEGACY_SERVICE_NAME" >/dev/null 2>&1 || true
         systemctl reset-failed "$OLD_HOST_SERVICE_NAME" >/dev/null 2>&1 || true
         systemctl daemon-reload >/dev/null 2>&1 || true
     fi
@@ -519,8 +552,10 @@ done
 resolve_user_context
 
 UNIX_USER_BIN_DIR="$INSTALLING_HOME/.local/bin"
-UNIX_USER_LIB_DIR="$INSTALLING_HOME/.local/lib/MidTerm"
-UNIX_USER_SETTINGS_DIR="$INSTALLING_HOME/.midterm"
+UNIX_USER_LIB_DIR="$INSTALLING_HOME/.local/lib/tlbx"
+LEGACY_USER_LIB_DIR="$INSTALLING_HOME/.local/lib/MidTerm"
+UNIX_USER_SETTINGS_DIR="$INSTALLING_HOME/.tlbx"
+LEGACY_USER_SETTINGS_DIR="$INSTALLING_HOME/.midterm"
 
 print_header
 print_info "User context: $INSTALLING_USER ($INSTALLING_HOME)"
@@ -550,7 +585,7 @@ print_info "Detected trusted certificate traces: $SYSTEM_TRUST_TRACES"
 
 if [ "$USER_TRACES" = false ] && [ "$TEMP_TRACES" = false ] && [ "$SERVICE_TRACES" = false ] && [ "$SYSTEM_TRUST_TRACES" = false ]; then
     echo ""
-    print_success "No known MidTerm installation traces were found."
+    print_success "No known tlbx installation traces were found."
     exit 0
 fi
 
@@ -561,4 +596,4 @@ if [ "$SERVICE_TRACES" = true ] || [ "$SYSTEM_TRUST_TRACES" = true ]; then
 fi
 
 echo ""
-print_success "MidTerm uninstall complete."
+print_success "tlbx uninstall complete."