diff --git a/apps/desktop/electron/main/ipc/agent-ipc.ts b/apps/desktop/electron/main/ipc/agent-ipc.ts
index 39dfb7106b..42460d679f 100644
--- a/apps/desktop/electron/main/ipc/agent-ipc.ts
+++ b/apps/desktop/electron/main/ipc/agent-ipc.ts
@@ -649,7 +649,9 @@ export function registerAgentIpc({
     const abortedTurnId = activeTurns.get(req.sessionId);
     if (req.turnId && abortedTurnId !== req.turnId) return { ok: false, aborted: false };
     logger.app("session", "info", "prompt aborted", { sessionId: req.sessionId });
-    agentHostBridge?.markAborting(req.sessionId);
+    // A duplicate Stop after settlement has no turn whose finalizer can clear
+    // this marker. Do not carry that cancellation into the next prompt.
+    if (abortedTurnId) agentHostBridge?.markAborting(req.sessionId);
     // Lock the abort reason before the first await: the cancel RPC can take a
     // while, and a terminal event arriving in that window must not settle the
     // turn as completed.
diff --git a/apps/desktop/src/components/SessionPane.tsx b/apps/desktop/src/components/SessionPane.tsx
index c40194fbb0..c9b72e0d3a 100644
--- a/apps/desktop/src/components/SessionPane.tsx
+++ b/apps/desktop/src/components/SessionPane.tsx
@@ -71,7 +71,7 @@ export const SessionPane = memo(function SessionPane({
       aria-hidden={visible ? undefined : true}
       inert={visible ? undefined : true}
     >
-      <TranscriptDisclosureProvider sessionId={sessionId}>
+      <TranscriptDisclosureProvider sessionId={sessionId} visible={visible}>
         <ChatTranscript
           sessionId={sessionId}
           messages={transcript.messages}
diff --git a/apps/desktop/src/features/chat/transcript/ActivityGroup.tsx b/apps/desktop/src/features/chat/transcript/ActivityGroup.tsx
index b3a6486732..c5c1fcf1b2 100644
--- a/apps/desktop/src/features/chat/transcript/ActivityGroup.tsx
+++ b/apps/desktop/src/features/chat/transcript/ActivityGroup.tsx
@@ -2,7 +2,7 @@ import { SubagentStopButton } from "./SubagentStopButton";
 import { activityTimingInputs, cachedVisibleActivityItems } from "../../../lib/transcript-activity-summary";
 import { reuseReferences } from "../../../lib/transcript-summary";
 import { ActivityItems } from "./ActivityItems";
-import { DisclosureScope, disclosureKey } from "./disclosure";
+import { DisclosureScope, disclosureKey, useTranscriptVisibility } from "./disclosure";
 import { ProcessActivityGroup } from "./ProcessActivityGroup";
 import {
   memo,
@@ -203,6 +203,7 @@ export const ActivityGroup = memo(function ActivityGroup({
   turnDelegationStatuses,
   turnDelegationTimings,
 }: ActivityGroupProps) {
+  const visible = useTranscriptVisibility();
   const showThinking = useAppStore((state) => resolveShowThinking(state.settings));
   const hideThinking = !showThinking;
   const displayMode = useAppStore((state) => resolveTranscriptDisplayMode(state.settings));
@@ -311,11 +312,11 @@ export const ActivityGroup = memo(function ActivityGroup({
   useEffect(() => {
     if (wasActiveRef.current && !live) setFinishedAt(Date.now());
     wasActiveRef.current = live;
-    if (!live) return;
+    if (!live || !visible) return;
     setNow(Date.now());
     const id = window.setInterval(() => setNow(Date.now()), 1000);
     return () => window.clearInterval(id);
-  }, [live]);
+  }, [live, visible]);
 
   const renderedItems = <ActivityItems
     items={items}
@@ -412,19 +413,21 @@ export const ActivityGroup = memo(function ActivityGroup({
 
 /** Keep the running turn visible when no more specific runtime phase is known. */
 export function WorkingIndicator({ startedAt }: { startedAt?: number } = {}) {
+  const visible = useTranscriptVisibility();
   const { t } = useTranslation();
   const [elapsed, setElapsed] = useState(0);
   const startedAtRef = useRef(startedAt ?? Date.now());
 
   useEffect(() => {
-    startedAtRef.current = startedAt ?? Date.now();
+    if (!visible) return;
+    if (startedAt !== undefined) startedAtRef.current = startedAt;
     const updateElapsed = () => {
       setElapsed(Math.floor((Date.now() - startedAtRef.current) / 1000));
     };
     updateElapsed();
     const timer = window.setInterval(updateElapsed, 1000);
     return () => window.clearInterval(timer);
-  }, [startedAt]);
+  }, [startedAt, visible]);
 
   return (
     <div
@@ -449,6 +452,7 @@ export function WorkingIndicator({ startedAt }: { startedAt?: number } = {}) {
 }
 
 export function RunActivityIndicator({ activity }: { activity: AgentActivity }) {
+  const visible = useTranscriptVisibility();
   const { t } = useTranslation();
   const [now, setNow] = useState(Date.now);
   const retryErrorDetailsId = useId();
@@ -456,10 +460,11 @@ export function RunActivityIndicator({ activity }: { activity: AgentActivity })
   const retryPlateRef = useRef<HTMLSpanElement | null>(null);
 
   useEffect(() => {
+    if (!visible) return;
     setNow(Date.now());
     const timer = window.setInterval(() => setNow(Date.now()), 1000);
     return () => window.clearInterval(timer);
-  }, [activity.since]);
+  }, [activity.since, visible]);
 
   const elapsed = formatToolDuration(
     Math.max(0, Math.floor((now - activity.since) / 1000)),
@@ -476,7 +481,7 @@ export function RunActivityIndicator({ activity }: { activity: AgentActivity })
   // anchored 8px above the trigger, so its own bottom edge starts that room -
   // and let the remainder scroll.
   useEffect(() => {
-    if (!retryError) return;
+    if (!retryError || !visible) return;
     const reason = retryReasonRef.current;
     const plate = retryPlateRef.current;
     if (!reason || !plate) return;
@@ -525,7 +530,7 @@ export function RunActivityIndicator({ activity }: { activity: AgentActivity })
       scroller?.removeEventListener("scroll", measure);
       observer?.disconnect();
     };
-  }, [retryError]);
+  }, [retryError, visible]);
   const retryErrorSummary = retryError
     ? (() => {
         const key = `errors.${retryError.code}`;
diff --git a/apps/desktop/src/features/chat/transcript/AssistantTurnParts.tsx b/apps/desktop/src/features/chat/transcript/AssistantTurnParts.tsx
index 89f607f9c0..9760fcb310 100644
--- a/apps/desktop/src/features/chat/transcript/AssistantTurnParts.tsx
+++ b/apps/desktop/src/features/chat/transcript/AssistantTurnParts.tsx
@@ -1,4 +1,4 @@
-import { memo } from "react";
+import { memo, useRef } from "react";
 import type { AgentActivity, UiMessage } from "@pi-desktop/shared";
 import type { AssistantTurnPart } from "../../../lib/assistant-turns";
 import type { SubagentOutcome, SubagentTiming } from "../../../lib/subagent-topology";
@@ -8,18 +8,28 @@ import { useSmoothText } from "../../../hooks/useSmoothText";
 import { ActivityGroup } from "./ActivityGroup";
 import { AssistantErrorMessage } from "./shared";
 import { useRenderBlocks, type RenderBlock } from "./render-blocks";
+import { useTranscriptVisibility } from "./disclosure";
 
 /** Message bubble that optionally applies smooth text release. */
 const SmoothMessageBubble = memo(function SmoothMessageBubble({ message, streaming }: {
   message: UiMessage;
   streaming: boolean;
 }) {
+  const visible = useTranscriptVisibility();
   const smoothStreaming = useAppStore((s) => s.settings?.smoothStreaming !== false);
   const prefersReducedMotion = typeof window !== "undefined" &&
     window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   const enabled = smoothStreaming && !prefersReducedMotion;
-  const displayContent = useSmoothText(message.content || "", streaming, enabled);
-  const showCursor = streaming && enabled && Boolean(displayContent);
+  const source = useRef(message.content || "");
+  const lastDisplay = useRef(source.current);
+  const wasVisible = useRef(visible);
+  const revealed = visible && !wasVisible.current;
+  if (visible) source.current = message.content || "";
+  const smoothContent = useSmoothText(source.current, streaming, enabled && visible && !revealed);
+  if (visible) lastDisplay.current = smoothContent;
+  wasVisible.current = visible;
+  const displayContent = lastDisplay.current;
+  const showCursor = streaming && enabled && visible && Boolean(displayContent);
   return (
     <div
       className={`message-bubble assistant-turn-fragment${streaming ? " streaming" : ""}${showCursor ? " smooth-cursor" : ""}`}
diff --git a/apps/desktop/src/features/chat/transcript/ToolRow.tsx b/apps/desktop/src/features/chat/transcript/ToolRow.tsx
index 963106e8a8..dc35d09dff 100644
--- a/apps/desktop/src/features/chat/transcript/ToolRow.tsx
+++ b/apps/desktop/src/features/chat/transcript/ToolRow.tsx
@@ -21,7 +21,7 @@ import { useChatFileMenu } from "../../../hooks/use-chat-file-menu";
 import { ContextMenu } from "../../../components/ContextMenu";
 import { useFollowScroll } from "../../../hooks/use-follow-scroll";
 import { getToolPreviewTarget } from "../../../lib/chat-links";
-import { disclosureKey } from "./disclosure";
+import { disclosureKey, useTranscriptVisibility } from "./disclosure";
 import {
   formatToolDuration,
   getToolAction,
@@ -256,7 +256,7 @@ function HostToolRow({
     nestedReport: boolean | undefined;
     blocks: ReturnType<typeof buildToolPresentation>;
   } | null>(null);
-  if (variant !== "topology" && open && hasDetails && disclosure.parentVisible &&
+  if (variant !== "topology" && open && hasDetails && disclosure.workVisible &&
     (presentation.current?.message !== message || presentation.current?.nestedReport !== nestedReport)) {
     presentation.current = {
       message,
@@ -350,11 +350,11 @@ function HostToolRow({
       : "";
 
   useEffect(() => {
-    if (outcome !== "running") return;
+    if (outcome !== "running" || !disclosure.workVisible) return;
     setNow(Date.now());
     const id = window.setInterval(() => setNow(Date.now()), 1000);
     return () => window.clearInterval(id);
-  }, [outcome]);
+  }, [outcome, disclosure.workVisible]);
 
   // Auto-scroll the nested `.tool-row-content` containers to their bottom
   // while the tool is still running. These elements have `max-height: 260px`
@@ -363,7 +363,7 @@ function HostToolRow({
   // when the container is already near the bottom so a manual scroll-up by
   // the user is not overridden.
   useLayoutEffect(() => {
-    if (status !== "running" || !open) return;
+    if (status !== "running" || !open || !disclosure.workVisible) return;
     const body = disclosure.bodyRef.current;
     if (!body) return;
     const containers = body.querySelectorAll<HTMLElement>(".tool-row-content");
@@ -374,7 +374,7 @@ function HostToolRow({
         el.scrollTop = el.scrollHeight;
       }
     }
-  }, [status, open, message, disclosure.bodyRef]);
+  }, [status, open, message, disclosure.bodyRef, disclosure.workVisible]);
 
 
   const statusTone =
@@ -678,6 +678,9 @@ function SubagentRunFollow({
   scrollable?: boolean;
 }) {
   const { t } = useTranslation();
+  const visible = useTranscriptVisibility();
+  const displayedItems = useRef(items);
+  if (visible) displayedItems.current = items;
   const {
     scrollRef,
     contentRef,
@@ -686,12 +689,12 @@ function SubagentRunFollow({
     jumpToLatest,
     scheduleFollowScroll,
     disclosureAnchorNotifier,
-  } = useFollowScroll();
+  } = useFollowScroll(visible && scrollable);
 
   useLayoutEffect(() => {
-    if (!scrollable) return;
+    if (!scrollable || !visible) return;
     scheduleFollowScroll();
-  }, [items, scheduleFollowScroll, scrollable]);
+  }, [items, scheduleFollowScroll, scrollable, visible]);
 
   return (
     <DisclosureAnchorContext.Provider value={disclosureAnchorNotifier}>
@@ -710,7 +713,7 @@ function SubagentRunFollow({
           onScroll={scrollable ? handleScroll : undefined}
         >
           <div ref={contentRef}>
-            {items.map((item) =>
+            {displayedItems.current.map((item) =>
               item.kind === "tool" ? (
                 reviewChangeFromMessage(item.message) ? (
                   <ReviewChangeCard
diff --git a/apps/desktop/src/features/chat/transcript/TurnProcess.tsx b/apps/desktop/src/features/chat/transcript/TurnProcess.tsx
index 7b0d83bd91..27040533a8 100644
--- a/apps/desktop/src/features/chat/transcript/TurnProcess.tsx
+++ b/apps/desktop/src/features/chat/transcript/TurnProcess.tsx
@@ -98,11 +98,11 @@ export function TurnProcess({
   const [now, setNow] = useState(Date.now);
   const { startedAt, endedAt } = useMemo(() => turnProcessTiming(turnParts), [turnParts]);
   useEffect(() => {
-    if (!isActive) return;
+    if (!isActive || !disclosure.workVisible) return;
     setNow(Date.now());
     const timer = window.setInterval(() => setNow(Date.now()), 1000);
     return () => window.clearInterval(timer);
-  }, [isActive]);
+  }, [isActive, disclosure.workVisible]);
   const scope = useMemo<DisclosureScopeValue>(
     () => ({ claim: disclosure.claim, visible: disclosure.open }),
     [disclosure.claim, disclosure.open],
diff --git a/apps/desktop/src/features/chat/transcript/disclosure.tsx b/apps/desktop/src/features/chat/transcript/disclosure.tsx
index 8f30f50c00..00b1e940ee 100644
--- a/apps/desktop/src/features/chat/transcript/disclosure.tsx
+++ b/apps/desktop/src/features/chat/transcript/disclosure.tsx
@@ -46,6 +46,7 @@ class DisclosureChoices {
 }
 
 const ChoicesContext = createContext<DisclosureChoices | null>(null);
+const PaneVisibilityContext = createContext(true);
 
 /*
  * A level's own visibility is a second gate beside the stored choice, so a
@@ -56,11 +57,24 @@ const ChoicesContext = createContext<DisclosureChoices | null>(null);
 export type { DisclosureScopeValue } from "./disclosure-scope";
 
 /** Explicit choices survive pane eviction, but never persist to the host. */
-export function TranscriptDisclosureProvider({ children, sessionId }: { children: ReactNode; sessionId?: string }) {
+export function TranscriptDisclosureProvider({ children, sessionId, visible = true }: {
+  children: ReactNode;
+  sessionId?: string;
+  visible?: boolean;
+}) {
+  const parentVisible = useContext(PaneVisibilityContext);
   const [choices] = useState(() => new DisclosureChoices(
     sessionId ? sessionReadingState(sessionId).disclosures : undefined,
   ));
-  return <ChoicesContext.Provider value={choices}>{children}</ChoicesContext.Provider>;
+  return <ChoicesContext.Provider value={choices}>
+    <PaneVisibilityContext.Provider value={parentVisible && visible}>{children}</PaneVisibilityContext.Provider>
+  </ChoicesContext.Provider>;
+}
+
+/** Mounted transcript descendants suspend work while their pane or scope is hidden. */
+export function useTranscriptVisibility() {
+  const paneVisible = useContext(PaneVisibilityContext);
+  return useContext(ScopeContext).visible && paneVisible;
 }
 
 export function disclosureKey(kind: string, ...ids: string[]) {
@@ -97,6 +111,7 @@ export function useAutomaticDisclosure(
       : automaticOpen
   );
   const scope = useContext(ScopeContext);
+  const paneVisible = useContext(PaneVisibilityContext);
   // A level below a collapsed parent renders nothing, whatever its own choice
   // says. The choice is left untouched so reopening the parent restores it.
   const open = requestedOpen && scope.visible;
@@ -151,6 +166,8 @@ export function useAutomaticDisclosure(
     // Kept for callers that read the parent's visibility directly; the scope
     // itself already folded it into `open`.
     parentVisible: scope.visible,
+    // Pane suspension is independent from the stored disclosure/open state.
+    workVisible: scope.visible && paneVisible,
     // Pointer selection and keyboard interaction establish ownership before
     // a streaming update can apply an automatic close.
     bodyEvents: { onPointerDownCapture: claim, onFocusCapture: claim },
diff --git a/apps/desktop/src/features/chat/transcript/hooks/useTranscriptScroll.ts b/apps/desktop/src/features/chat/transcript/hooks/useTranscriptScroll.ts
index 4d9d838ca1..21d4f4c0ae 100644
--- a/apps/desktop/src/features/chat/transcript/hooks/useTranscriptScroll.ts
+++ b/apps/desktop/src/features/chat/transcript/hooks/useTranscriptScroll.ts
@@ -500,12 +500,12 @@ export function useTranscriptScroll({
   useEffect(() => {
     const content = contentRef.current;
     const scroller = scrollRef.current;
-    if (!content || !scroller || typeof ResizeObserver === "undefined") return;
+    if (!paneVisible || !content || !scroller || typeof ResizeObserver === "undefined") return;
     const ro = new ResizeObserver(followScrollNow);
     ro.observe(content, { box: "border-box" });
     ro.observe(scroller, { box: "border-box" });
     return () => ro.disconnect();
-  }, [followScrollNow]);
+  }, [followScrollNow, paneVisible]);
 
   // Defer one immutable projection, never messages and compaction boundaries
   // independently. First paint, reading, and pane reveal use the current source.
@@ -517,8 +517,16 @@ export function useTranscriptScroll({
     [messages, compactions],
   );
   const deferredProjection = useDeferredValue(projection);
+  const revealedProjection = useRef<typeof projection | null>(null);
+  if (paneRevealed) revealedProjection.current = projection;
+  if (deferredProjection === revealedProjection.current || deferredProjection === projection) {
+    revealedProjection.current = null;
+  }
+  // A reveal uses the latest source immediately. Layout commits must not
+  // rewind to the pre-reveal deferred snapshot before it catches up.
   const renderedProjection =
-    readingWindow || firstCommit || paneRevealed ? projection : deferredProjection;
+    readingWindow || firstCommit || paneRevealed || revealedProjection.current
+      ? projection : deferredProjection;
   const { entries, visible, history: allHistoryEntries } = renderedProjection;
   const tailEntry = entries.at(-1);
   // Published for `reachTop`, which is declared above this projection but only
diff --git a/apps/desktop/src/features/chat/transcript/shared.tsx b/apps/desktop/src/features/chat/transcript/shared.tsx
index 5942fc7292..56dd2e3087 100644
--- a/apps/desktop/src/features/chat/transcript/shared.tsx
+++ b/apps/desktop/src/features/chat/transcript/shared.tsx
@@ -714,6 +714,10 @@ export const ThinkingRow = memo(function ThinkingRow({
   // reasoning rows and excerpts. The stored text is never removed, so turning
   // the preference back on restores the row.
   const showThinking = useAppStore((state) => resolveShowThinking(state.settings));
+  const presentation = useRef<{ message: UiMessage; text: string } | null>(null);
+  if (!presentation.current || (disclosure.workVisible && presentation.current.message !== message)) {
+    presentation.current = { message, text: thinkingText(message) };
+  }
   if (!showThinking) {
     return isThinkingActive(message, streaming) ? (
       <div className="tool-row thinking thinking-compact" role="status">
@@ -726,7 +730,7 @@ export const ThinkingRow = memo(function ThinkingRow({
       </div>
     ) : null;
   }
-  const text = thinkingText(message);
+  const { text } = presentation.current;
   return (
     <div className={`tool-row thinking ${open ? "open" : ""}`}>
       <button
diff --git a/apps/desktop/src/hooks/use-follow-scroll.ts b/apps/desktop/src/hooks/use-follow-scroll.ts
index ac2e1b95c4..78523903e7 100644
--- a/apps/desktop/src/hooks/use-follow-scroll.ts
+++ b/apps/desktop/src/hooks/use-follow-scroll.ts
@@ -40,7 +40,10 @@ export type FollowScroll = {
  * hold also reaches the scroller this one is nested in, because growing these
  * rows grows that one's content as well.
  */
-export function useFollowScroll(): FollowScroll {
+export function useFollowScroll(enabled = true): FollowScroll {
+  const enabledRef = useRef(enabled);
+  enabledRef.current = enabled;
+  const initializedRef = useRef(false);
   const scrollRef = useRef<HTMLDivElement>(null);
   const contentRef = useRef<HTMLDivElement>(null);
   const pinnedRef = useRef(true);
@@ -51,7 +54,7 @@ export function useFollowScroll(): FollowScroll {
 
   const scrollToBottom = useCallback((behavior: ScrollBehavior = "auto") => {
     const el = scrollRef.current;
-    if (!el) return;
+    if (!el || !enabledRef.current) return;
     const targetTop = Math.max(0, el.scrollHeight - el.clientHeight);
     el.scrollTo({ top: targetTop, behavior });
     // Record the position the scroller actually reached, not the one that was
@@ -100,7 +103,7 @@ export function useFollowScroll(): FollowScroll {
 
   useEffect(() => {
     const el = scrollRef.current;
-    if (!el) return;
+    if (!el || !enabled) return;
     el.addEventListener("wheel", markScrollGesture, { passive: true });
     el.addEventListener("touchstart", markScrollGesture, { passive: true });
     el.addEventListener("touchmove", markScrollGesture, { passive: true });
@@ -113,24 +116,28 @@ export function useFollowScroll(): FollowScroll {
       el.removeEventListener("pointerdown", markScrollGesture);
       el.removeEventListener("keydown", markScrollGesture);
     };
-  }, [markScrollGesture]);
+  }, [enabled, markScrollGesture]);
 
   useLayoutEffect(() => {
-    releaseDisclosureAnchor();
     cancelFollowScroll();
-    pinnedRef.current = true;
-    setShowJump(false);
-    scrollToBottom();
-  }, [cancelFollowScroll, releaseDisclosureAnchor, scrollToBottom]);
+    if (!enabled) return;
+    if (!initializedRef.current) {
+      initializedRef.current = true;
+      releaseDisclosureAnchor();
+      pinnedRef.current = true;
+      setShowJump(false);
+    }
+    if (!restoreDisclosureAnchor() && pinnedRef.current) scrollToBottom();
+  }, [cancelFollowScroll, enabled, releaseDisclosureAnchor, restoreDisclosureAnchor, scrollToBottom]);
 
   const scheduleFollowScroll = useCallback(() => {
     // A queued follow frame must not move the title the reader just toggled:
     // the observer below already refuses to, and this path would undo it.
-    if (!pinnedRef.current || followFrameRef.current !== 0) return;
+    if (!enabledRef.current || !pinnedRef.current || followFrameRef.current !== 0) return;
     if (isDisclosureAnchorHeld()) return;
     followFrameRef.current = requestAnimationFrame(() => {
       followFrameRef.current = 0;
-      if (pinnedRef.current) scrollToBottom();
+      if (enabledRef.current && pinnedRef.current) scrollToBottom();
     });
   }, [isDisclosureAnchorHeld, scrollToBottom]);
 
@@ -140,6 +147,7 @@ export function useFollowScroll(): FollowScroll {
   // still while the dock's rows animate. (`useDisclosureAnchor` already passes
   // this hold outward to the scroller this one is nested in.)
   const followScrollNow = useCallback(() => {
+    if (!enabledRef.current) return;
     if (restoreDisclosureAnchor()) return;
     if (!pinnedRef.current) return;
     cancelFollowScroll();
@@ -151,7 +159,7 @@ export function useFollowScroll(): FollowScroll {
 
   const handleScroll = useCallback<UIEventHandler<HTMLDivElement>>(() => {
     const el = scrollRef.current;
-    if (!el) return;
+    if (!el || !enabledRef.current) return;
     const wasPinned = pinnedRef.current;
     // Real input is compared exactly; without it, sub-pixel slack keeps a
     // fractional device pixel ratio from reading as the user scrolling up.
@@ -185,12 +193,12 @@ export function useFollowScroll(): FollowScroll {
   useEffect(() => {
     const content = contentRef.current;
     const scroller = scrollRef.current;
-    if (!content || !scroller || typeof ResizeObserver === "undefined") return;
+    if (!enabled || !content || !scroller || typeof ResizeObserver === "undefined") return;
     const ro = new ResizeObserver(followScrollNow);
     ro.observe(content, { box: "border-box" });
     ro.observe(scroller, { box: "border-box" });
     return () => ro.disconnect();
-  }, [followScrollNow]);
+  }, [enabled, followScrollNow]);
 
   const jumpToLatest = useCallback(() => {
     releaseDisclosureAnchor();
diff --git a/apps/desktop/src/lib/turn-process.ts b/apps/desktop/src/lib/turn-process.ts
index aef11dc7f9..ce7251a2bb 100644
--- a/apps/desktop/src/lib/turn-process.ts
+++ b/apps/desktop/src/lib/turn-process.ts
@@ -263,31 +263,40 @@ export function projectTurnProcess(entry: AssistantTurnEntry) {
   return { process, responses };
 }
 
+type TurnProcessTiming = Readonly<{
+  startedAt: number | undefined;
+  endedAt: number | undefined;
+}>;
+
+// Process chunks share the same immutable turn snapshot. Weak keys release
+// timing with that snapshot instead of retaining every historical/live revision.
+const timingByParts = new WeakMap<readonly AssistantTurnPart[], TurnProcessTiming>();
+
 /** Use recorded message/tool timing for history; elapsed live time is UI-only. */
-export function turnProcessTiming(parts: readonly AssistantTurnPart[]) {
-  const messages = parts.flatMap((part) =>
-    part.kind === "message" ? [part.message] : part.items.map((item) => item.message),
-  );
-  const starts = messages
-    .map((message) => Date.parse(message.createdAt))
-    .filter(Number.isFinite);
-  if (starts.length === 0) return { startedAt: undefined, endedAt: undefined };
-  const startedAt = Math.min(...starts);
-  const endedAt = Math.max(
+export function turnProcessTiming(parts: readonly AssistantTurnPart[]): TurnProcessTiming {
+  const cached = timingByParts.get(parts);
+  if (cached) return cached;
+  let startedAt: number | undefined;
+  let endedAt: number | undefined;
+  const include = (message: UiMessage) => {
+    const createdAt = Date.parse(message.createdAt);
+    if (!Number.isFinite(createdAt)) return;
+    startedAt = startedAt === undefined ? createdAt : Math.min(startedAt, createdAt);
+    const duration = message.role === "tool" ? message.toolDurationMs : message.responseDurationMs;
+    const recordedEnd = Date.parse(message.toolCompletedAt ?? "");
+    const end = Number.isFinite(recordedEnd)
+      ? recordedEnd
+      : createdAt + (typeof duration === "number" && Number.isFinite(duration) ? Math.max(0, duration) : 0);
+    endedAt = endedAt === undefined ? end : Math.max(endedAt, end);
+  };
+  for (const part of parts) {
+    if (part.kind === "message") include(part.message);
+    else for (const item of part.items) include(item.message);
+  }
+  const timing = Object.freeze({
     startedAt,
-    ...messages.map((message) => {
-      const createdAt = Date.parse(message.createdAt);
-      if (!Number.isFinite(createdAt)) return startedAt;
-      const duration =
-        message.role === "tool" ? message.toolDurationMs : message.responseDurationMs;
-      const recordedEnd = Date.parse(message.toolCompletedAt ?? "");
-      return Number.isFinite(recordedEnd)
-        ? recordedEnd
-        : createdAt +
-            (typeof duration === "number" && Number.isFinite(duration)
-              ? Math.max(0, duration)
-              : 0);
-    }),
-  );
-  return { startedAt, endedAt };
+    endedAt: startedAt === undefined ? undefined : Math.max(startedAt, endedAt ?? startedAt),
+  });
+  timingByParts.set(parts, timing);
+  return timing;
 }
diff --git a/apps/desktop/src/stores/runtime/stop-session.ts b/apps/desktop/src/stores/runtime/stop-session.ts
new file mode 100644
index 0000000000..a009ea288d
--- /dev/null
+++ b/apps/desktop/src/stores/runtime/stop-session.ts
@@ -0,0 +1,174 @@
+import type { UiMessage } from "@pi-desktop/shared";
+import { api } from "../../lib/api";
+import { resolveComposerSmartStop } from "../../lib/composer-smart-stop";
+import { settleStoppedAssistantMetrics } from "../../lib/context-usage";
+import { clearSessionAsks } from "../../lib/pending-asks";
+import { clearSessionPermissions, sessionPermissions } from "../../lib/pending-permissions";
+import { isRemoteSession, sessionAllows } from "../../lib/remote-session-safety";
+import { mergeLiveSessionMessages } from "../../lib/session-transcript";
+import type { AppState } from "../app-state";
+import type { StoreAccess } from "../slices/types";
+import type { SessionRuntime } from "./session-runtime";
+
+type StopDependencies = StoreAccess & {
+  runtime: SessionRuntime;
+  flushPendingSessionConfiguration: (sessionId: string) => Promise<void>;
+};
+
+function withoutKey<T>(record: Record<string, T>, key: string): Record<string, T> {
+  const next = { ...record };
+  delete next[key];
+  return next;
+}
+
+function stoppedRows(rows: UiMessage[], stoppedAtMs: number): UiMessage[] {
+  let changed = false;
+  const completedAt = new Date(stoppedAtMs).toISOString();
+  const next = rows.map((message) => {
+    if (message.role === "assistant" && message.status === "streaming") {
+      changed = true;
+      return { ...settleStoppedAssistantMetrics(message, stoppedAtMs), status: "aborted" as const };
+    }
+    if (message.role === "tool" && message.toolStatus === "running") {
+      changed = true;
+      return {
+        ...message, toolStatus: "error" as const, status: "aborted" as const,
+        toolCompletedAt: message.toolCompletedAt ?? completedAt,
+      };
+    }
+    return message;
+  });
+  return changed ? next : rows;
+}
+
+/** Stop owns backend settlement first, then optional draft/history recovery. */
+export function createSessionStop({ get, set, runtime, flushPendingSessionConfiguration }: StopDependencies) {
+  const pending = new Map<string, { owns: (state: AppState) => boolean; promise: Promise<void> }>();
+  return (): Promise<void> => {
+    const before = get();
+    const sessionId = before.activeSessionId;
+    if (!sessionId) return Promise.resolve();
+    const target = before.sessions.find((session) => session.id === sessionId);
+    if (!sessionAllows(target, "canStop")) return Promise.resolve();
+    const active = pending.get(sessionId);
+    if (active?.owns(before)) return active.promise;
+    const submittedDraft = runtime.submittedComposerDrafts.get(sessionId);
+    const rowsForSession = (state: AppState) => state.activeSessionId === sessionId ? state.messages
+      : runtime.sessionTranscriptCache.get(sessionId) ?? state.retainedTranscripts[sessionId] ?? before.messages;
+    let turnId = before.agentStatuses?.[sessionId]?.currentTurnId;
+    let admittedUserId = before.messages.findLast((message) => message.role === "user")?.id;
+    let initialAdmissionOpen = Boolean(submittedDraft) && !turnId;
+    const owns = (state: AppState) => {
+      const nextDraft = runtime.submittedComposerDrafts.get(sessionId);
+      if (nextDraft && nextDraft !== submittedDraft) return false;
+      if (rowsForSession(state).findLast((message) => message.role === "user")?.id !== admittedUserId) return false;
+      const nextTurn = state.agentStatuses?.[sessionId]?.currentTurnId;
+      // Stop can precede this submission's first status, but must never adopt
+      // a later turn while optional history recovery is still pending.
+      if (!turnId && nextTurn && initialAdmissionOpen) turnId = nextTurn;
+      return !nextTurn || nextTurn === turnId;
+    };
+    const stoppedAtMs = Date.now();
+    const external = target?.source === "pi-native" || isRemoteSession(target);
+    const preserveSteering = before.messages
+      .slice(submittedDraft?.messageCountBeforeSend ?? 0)
+      .findLast((message) => message.role === "user")?.steering;
+    if (submittedDraft && !submittedDraft.abortResolution) {
+      submittedDraft.abortResolution = new Promise<boolean>((resolve) => { submittedDraft.resolveAbort = resolve; });
+    }
+    const finishDraft = (restored: boolean) => {
+      submittedDraft?.resolveAbort?.(restored);
+      // A newer send owns its own snapshot and must survive this Stop's await.
+      if (runtime.submittedComposerDrafts.get(sessionId) === submittedDraft) {
+        runtime.submittedComposerDrafts.delete(sessionId);
+      }
+    };
+    const publishRows = (rows: UiMessage[], full = false) => {
+      if (!owns(get())) return;
+      const window = full ? { messageStart: 0, hasMoreBefore: false } : undefined;
+      // The ownership check and publication are synchronous. Update the
+      // boundary for rows this Stop itself removes during draft recovery.
+      set((current) => ({
+        retainedTranscripts: { ...current.retainedTranscripts, [sessionId]: rows },
+        ...(window ? { sessionHistory: { ...current.sessionHistory, [sessionId]: window } } : {}),
+        ...(current.activeSessionId === sessionId ? { messages: rows } : {}),
+      }));
+      admittedUserId = rows.findLast((message) => message.role === "user")?.id;
+      runtime.cacheSessionTranscript(sessionId, rows, window);
+    };
+    const settle = () => {
+      const current = get();
+      if (!owns(current)) return;
+      const rows = stoppedRows(rowsForSession(current), stoppedAtMs);
+      publishRows(rows);
+      set((state) => owns(state) ? {
+        runningSessions: { ...state.runningSessions, [sessionId]: false },
+        agentStatuses: withoutKey(state.agentStatuses, sessionId),
+        pendingPermissions: clearSessionPermissions(state.pendingPermissions, sessionId),
+        pendingAsks: clearSessionAsks(state.pendingAsks, sessionId),
+        ...(state.activeSessionId === sessionId ? { isRunning: false } : {}),
+      } : {});
+    };
+    const run = async () => {
+      // Permission responses may race the terminal event; their failures must
+      // not mask the abort RPC or delay publishing an already-settled turn.
+      const permissionReplies = external ? Promise.resolve([]) : Promise.allSettled(
+        sessionPermissions(before.pendingPermissions, sessionId).map((permission) =>
+          api.resolvePermission({ requestId: permission.requestId, decision: "deny" })),
+      );
+      try {
+        await api.abort(sessionId);
+        settle();
+        initialAdmissionOpen = false;
+        if (!owns(get())) return;
+        if (external) {
+          finishDraft(false);
+          const detail = await api.getSession(sessionId);
+          if (detail.session?.messages && owns(get())) {
+            publishRows(stoppedRows(detail.session.messages, stoppedAtMs));
+          }
+          return;
+        }
+        const state = get();
+        if (state.activeSessionId !== sessionId) return;
+        const smartStop = preserveSteering ? { kind: "settle" as const }
+          : resolveComposerSmartStop(state.messages, submittedDraft);
+        if (smartStop.kind === "restore") {
+          // Never let an old detail request publish into a newer turn's cache.
+          const fullMessages = await runtime.loadFullSessionMessages(sessionId, false);
+          if (!fullMessages || get().activeSessionId !== sessionId || !owns(get())) return;
+          const merged = stoppedRows(mergeLiveSessionMessages(fullMessages, get().messages), stoppedAtMs);
+          const fullStop = resolveComposerSmartStop(merged, submittedDraft);
+          if (fullStop.kind === "restore") {
+            publishRows(fullStop.kept, true);
+            set((current) => current.activeSessionId === sessionId && owns(current)
+              ? { composerPrefill: { ...fullStop.draft, sessionId } } : {});
+            finishDraft(true);
+            if (fullStop.kept.length < merged.length) await api.replaceSessionMessages(sessionId, fullStop.kept);
+            return;
+          }
+          publishRows(merged, true);
+        }
+      } catch (error) {
+        set((current) => current.activeSessionId === sessionId && owns(current) ? {
+          error: error instanceof Error ? error.message : String(error),
+          errorCode: (error as { code?: string })?.code ?? null,
+        } : {});
+        throw error;
+      } finally {
+        finishDraft(false);
+        // These responses have rejection handlers from the moment they start.
+        void permissionReplies;
+        if (!external && owns(get()) && !get().runningSessions[sessionId]) {
+          void flushPendingSessionConfiguration(sessionId);
+        }
+      }
+    };
+    const promise = run();
+    const operation = { owns, promise };
+    pending.set(sessionId, operation);
+    const clear = () => { if (pending.get(sessionId) === operation) pending.delete(sessionId); };
+    void promise.then(clear, clear);
+    return promise;
+  };
+}
diff --git a/apps/desktop/src/stores/slices/transcript-slice.ts b/apps/desktop/src/stores/slices/transcript-slice.ts
index 9b6b283182..c5784e93d7 100644
--- a/apps/desktop/src/stores/slices/transcript-slice.ts
+++ b/apps/desktop/src/stores/slices/transcript-slice.ts
@@ -1,23 +1,18 @@
 import i18n from "i18next";
-import { isRemoteSession, sessionAllows } from "../../lib/remote-session-safety";
+import { sessionAllows } from "../../lib/remote-session-safety";
 import type {
   UiMessage,
 } from "@pi-desktop/shared";
 import { isRenderableAttachment } from "@pi-desktop/shared";
 import { api } from "../../lib/api";
-import { resolveComposerSmartStop } from "../../lib/composer-smart-stop";
-import {
-  clearSessionPermissions,
-  sessionPermissions,
-} from "../../lib/pending-permissions";
 import {
   mergeLiveSessionMessages,
 } from "../../lib/session-transcript";
 import { optimisticUserMessage } from "../../lib/session-transcript";
 import { withReviewChangeState } from "../../lib/workspace-review";
-import { settleStoppedAssistantMetrics } from "../../lib/context-usage";
 import type { AppState } from "../app-state";
 import type { SessionRuntime } from "../runtime/session-runtime";
+import { createSessionStop } from "../runtime/stop-session";
 import { prepareTranscriptAction } from "../runtime/transcript-action";
 import type { StoreAccess } from "./types";
 
@@ -464,141 +459,7 @@ export function createTranscriptSlice({
       }
     },
 
-    abort: async () => {
-      const stateBeforeAbort = get();
-      const sessionId = stateBeforeAbort.activeSessionId;
-      if (!sessionId) return;
-      const target = stateBeforeAbort.sessions.find((session) => session.id === sessionId);
-      if (!sessionAllows(target, "canStop")) return;
-      if (target?.source === "pi-native" || isRemoteSession(target)) {
-        await api.abort(sessionId);
-        runtime.submittedComposerDrafts.delete(sessionId);
-        // Bypass in-flight pre-abort detail reads; request settled source state.
-        const detail = await api.getSession(sessionId);
-        const messages = detail.session?.messages;
-        if (messages) runtime.cacheSessionTranscript(sessionId, messages);
-        set((current) => ({
-          runningSessions: { ...current.runningSessions, [sessionId]: false },
-          ...(messages ? { retainedTranscripts: { ...current.retainedTranscripts, [sessionId]: messages } } : {}),
-          ...(current.activeSessionId === sessionId ? { isRunning: false, ...(messages ? { messages } : {}) } : {}),
-        }));
-        return;
-      }
-      const submittedDraft = runtime.submittedComposerDrafts.get(sessionId);
-      const preserveSteering = stateBeforeAbort.messages
-        .slice(submittedDraft?.messageCountBeforeSend ?? 0)
-        .findLast((message) => message.role === "user")?.steering;
-      const stoppedAtMs = Date.now();
-      if (submittedDraft && !submittedDraft.abortResolution) {
-        submittedDraft.abortResolution = new Promise<boolean>((resolve) => {
-          submittedDraft.resolveAbort = resolve;
-        });
-      }
-      const pendingForSession = sessionPermissions(
-        stateBeforeAbort.pendingPermissions,
-        sessionId,
-      );
-      await Promise.allSettled([
-        api.abort(sessionId),
-        ...pendingForSession.map((permission) =>
-          api.resolvePermission({
-            requestId: permission.requestId,
-            decision: "deny",
-          }),
-        ),
-      ]);
-      set((current) => ({
-        pendingPermissions: clearSessionPermissions(
-          current.pendingPermissions,
-          sessionId,
-        ),
-      }));
-      const state = get();
-      if (state.activeSessionId !== sessionId) {
-        submittedDraft?.resolveAbort?.(false);
-        runtime.submittedComposerDrafts.delete(sessionId);
-        set((current) => ({
-          runningSessions: { ...current.runningSessions, [sessionId]: false },
-        }));
-        return;
-      }
-      const smartStop = preserveSteering
-        ? { kind: "settle" as const }
-        : resolveComposerSmartStop(state.messages, submittedDraft);
-      if (smartStop.kind === "restore") {
-        const fullMessages = await runtime.loadFullSessionMessages(sessionId);
-        if (!fullMessages || get().activeSessionId !== sessionId) {
-          submittedDraft?.resolveAbort?.(false);
-          runtime.submittedComposerDrafts.delete(sessionId);
-          return;
-        }
-        const merged = mergeLiveSessionMessages(fullMessages, get().messages);
-        const fullStop = resolveComposerSmartStop(merged, submittedDraft);
-        if (fullStop.kind === "restore") {
-          runtime.submittedComposerDrafts.delete(sessionId);
-          submittedDraft?.resolveAbort?.(true);
-          const fullWindow = { messageStart: 0, hasMoreBefore: false };
-          runtime.cacheSessionTranscript(sessionId, fullStop.kept, fullWindow);
-          set((current) => ({
-            messages: fullStop.kept,
-            sessionHistory: { ...current.sessionHistory, [sessionId]: fullWindow },
-            composerPrefill: { ...fullStop.draft, sessionId },
-            isRunning: false,
-            runningSessions: { ...current.runningSessions, [sessionId]: false },
-          }));
-          if (fullStop.kept.length < merged.length) {
-            try {
-              await api.replaceSessionMessages(sessionId, fullStop.kept);
-            } catch {
-              // Best effort — the local transcript already reflects the undo.
-            }
-          }
-          void flushPendingSessionConfiguration(sessionId);
-          return;
-        }
-        set((current) =>
-          current.activeSessionId === sessionId
-            ? {
-                messages: merged,
-                sessionHistory: {
-                  ...current.sessionHistory,
-                  [sessionId]: { messageStart: 0, hasMoreBefore: false },
-                },
-              }
-            : {},
-        );
-      }
-      submittedDraft?.resolveAbort?.(false);
-      runtime.submittedComposerDrafts.delete(sessionId);
-      const stoppedRows = (rows: UiMessage[]) =>
-        rows.map((message) => {
-          if (message.role === "assistant" && message.status === "streaming") {
-            return {
-              ...settleStoppedAssistantMetrics(message, stoppedAtMs),
-              status: "aborted" as const,
-            };
-          }
-          if (message.role === "tool" && message.toolStatus === "running") {
-            return {
-              ...message,
-              toolStatus: "error" as const,
-              status: "aborted" as const,
-              toolCompletedAt:
-                message.toolCompletedAt ?? new Date().toISOString(),
-            };
-          }
-          return message;
-        });
-      set((current) => ({
-        messages:
-          current.activeSessionId === sessionId
-            ? stoppedRows(current.messages)
-            : current.messages,
-        isRunning: false,
-        runningSessions: { ...current.runningSessions, [sessionId]: false },
-      }));
-      void flushPendingSessionConfiguration(sessionId);
-    },
+    abort: createSessionStop({ get, set, runtime, flushPendingSessionConfiguration }),
   };
 }
 
diff --git a/apps/desktop/test/chat-streaming-layout.test.mjs b/apps/desktop/test/chat-streaming-layout.test.mjs
index f941199f9c..f2ba63afd8 100644
--- a/apps/desktop/test/chat-streaming-layout.test.mjs
+++ b/apps/desktop/test/chat-streaming-layout.test.mjs
@@ -13,9 +13,10 @@ const messagesCss = await readFile(
 
 test("streaming cursor remains steady throughout active streaming without flapping", () => {
   // Must not flap on/off between network chunks when buffer catches up with current source length
+  assert.match(assistantTurnPartsSource, /const visible = useTranscriptVisibility\(\);/);
   assert.match(
     assistantTurnPartsSource,
-    /const showCursor = streaming && enabled && Boolean\(displayContent\);/,
+    /const showCursor = streaming && enabled && visible && Boolean\(displayContent\);/,
   );
   assert.doesNotMatch(
     assistantTurnPartsSource,
diff --git a/apps/desktop/test/interaction-performance.test.mjs b/apps/desktop/test/interaction-performance.test.mjs
index 37bbce3a89..b0695197dd 100644
--- a/apps/desktop/test/interaction-performance.test.mjs
+++ b/apps/desktop/test/interaction-performance.test.mjs
@@ -71,7 +71,7 @@ test("stream rendering avoids duplicate frame state and coalesces following", ()
   // commit that reveals it, or the reveal shows one empty frame (ADR 0137).
   assert.match(
     transcript,
-    /const renderedProjection =\s*readingWindow \|\| firstCommit \|\| paneRevealed \? projection : deferredProjection/,
+    /const renderedProjection =\s*readingWindow \|\| firstCommit \|\| paneRevealed \|\| revealedProjection\.current\s*\? projection : deferredProjection/,
   );
   assert.match(transcript, /getTranscriptProjection\(messages, compactions\)/);
   assert.match(transcript, /useDeferredValue\(projection\)/);
@@ -98,7 +98,8 @@ test("expanded live tool output stays local to the changed row", () => {
   assert.match(transcript, /function toolRowPropsEqual\(/);
   assert.match(transcript, /if \(previous.variant !== "topology"\) return true;/);
   assert.doesNotMatch(transcript, /autoOpenLatest/);
-  assert.match(transcript, /if \(variant !== "topology" && open && hasDetails && disclosure\.parentVisible/);
+  assert.match(transcript, /if \(variant !== "topology" && open && hasDetails && disclosure\.workVisible/);
+  assert.match(transcript, /workVisible: scope\.visible && paneVisible/);
   assert.match(transcript, /const blocks = variant !== "topology" && open && hasDetails \? presentation\.current\?\.blocks : null/);
 });
 
diff --git a/apps/desktop/test/native-pi-sessions.test.mjs b/apps/desktop/test/native-pi-sessions.test.mjs
index a6af9c6d44..70c64e4c7a 100644
--- a/apps/desktop/test/native-pi-sessions.test.mjs
+++ b/apps/desktop/test/native-pi-sessions.test.mjs
@@ -6,6 +6,7 @@ const agent = await read("../electron/main/ipc/agent-ipc.ts");
 
 const composer = await read("../src/components/Composer.tsx");
 const transcript = await read("../src/stores/slices/transcript-slice.ts");
+const stopSession = await read("../src/stores/runtime/stop-session.ts");
 const events = await read("../src/stores/slices/events-slice.ts");
 const sidecarDispatch = await read("../../../packages/agent-runtime/src/sidecar.ts");
 
@@ -14,9 +15,10 @@ test("native model readiness uses capability instead of Desktop secrets", () =>
 });
 
 test("native abort bypasses smart-stop rewrite and refreshes source detail", () => {
-  const abort = transcript.slice(transcript.indexOf("abort: async"));
-  const native = abort.slice(abort.indexOf('source === "pi-native"'), abort.indexOf("const submittedDraft"));
-  assert.match(native, /api\.abort\(sessionId\)/);
+  assert.match(transcript, /abort: createSessionStop\(/);
+  assert.match(stopSession, /const external = target\?\.source === "pi-native" \|\| isRemoteSession\(target\)/);
+  assert.match(stopSession, /await api\.abort\(sessionId\)/);
+  const native = stopSession.slice(stopSession.indexOf("if (external) {"), stopSession.indexOf("const state = get();", stopSession.indexOf("if (external) {")));
   assert.match(native, /api\.getSession/);
   assert.match(native, /return;/);
   assert.doesNotMatch(native, /replaceSessionMessages|resolveComposerSmartStop/);
@@ -99,7 +101,7 @@ test("durable user acknowledgement reconciles active, cached and background rows
 
 test("native smart-stop abort keeps one durable user row and never rewrites the source", async () => {
   const id = "native-pi:fixture";
-  const state = { activeSessionId: id, sessions: [{ id, source: "pi-native" }], messages: [user("optimistic-1")], retainedTranscripts: {}, runningSessions: { [id]: true }, isRunning: true };
+  const state = { activeSessionId: id, sessions: [{ id, source: "pi-native" }], messages: [user("optimistic-1")], retainedTranscripts: {}, runningSessions: { [id]: true }, isRunning: true, agentStatuses: {}, pendingPermissions: {}, pendingAsks: {} };
   const calls = [];
   const originalAbort = api.abort;
   const originalReplace = api.replaceSessionMessages;
diff --git a/apps/desktop/test/permission-inline.test.mjs b/apps/desktop/test/permission-inline.test.mjs
index 478a4c321a..761dfd8699 100644
--- a/apps/desktop/test/permission-inline.test.mjs
+++ b/apps/desktop/test/permission-inline.test.mjs
@@ -47,6 +47,7 @@ const eventsSource = readStoreModuleSync("slices/events-slice.ts");
 const interactionSource = readStoreModuleSync("slices/interaction-slice.ts");
 const transcriptSliceSource = readStoreModuleSync("slices/transcript-slice.ts");
 const sessionRuntimeSource = readStoreModuleSync("runtime/session-runtime.ts");
+const stopSessionSource = readStoreModuleSync("runtime/stop-session.ts");
 
 function permission(sessionId, requestId, extra = {}) {
   return {
@@ -308,14 +309,17 @@ test("background permission events update only session-scoped state", () => {
     /removePermission\([\s\S]*state\.pendingPermissions,[\s\S]*sessionId,[\s\S]*requestId/,
   );
   assert.match(storeSource, /removePermissionForToolCall\(/);
-  const abortStart = transcriptSliceSource.indexOf("abort: async");
-  const abortBlock = transcriptSliceSource.slice(abortStart);
-  assert.match(abortBlock, /Promise\.allSettled/);
-  assert.match(abortBlock, /decision: "deny"/);
+  assert.match(transcriptSliceSource, /import \{ createSessionStop \} from "\.\.\/runtime\/stop-session"/);
+  assert.match(
+    transcriptSliceSource,
+    /abort: createSessionStop\(\{ get, set, runtime, flushPendingSessionConfiguration \}\)/,
+  );
+  assert.match(stopSessionSource, /Promise\.allSettled/);
+  assert.match(stopSessionSource, /decision: "deny"/);
   // Every open request is denied: a queued delegate would otherwise keep its
   // tool call alive past the stop the user asked for.
-  assert.match(abortBlock, /sessionPermissions\(/);
-  assert.match(abortBlock, /clearSessionPermissions\(/);
+  assert.match(stopSessionSource, /sessionPermissions\(before\.pendingPermissions, sessionId\)\.map/);
+  assert.match(stopSessionSource, /clearSessionPermissions\(state\.pendingPermissions, sessionId\)/);
 });
 
 test("new navigation intents invalidate older asynchronous commits", async () => {
diff --git a/apps/desktop/test/session-message-input.test.mjs b/apps/desktop/test/session-message-input.test.mjs
index 7b88a2ff42..1b74693661 100644
--- a/apps/desktop/test/session-message-input.test.mjs
+++ b/apps/desktop/test/session-message-input.test.mjs
@@ -193,3 +193,36 @@ test("abort waits for prompt admission before dispatching to the sidecar", async
   assert.deepEqual(finishedTurns, [["target", "aborted", "TURN_ABORTED", { turnId: "turn-1" }]]);
   assert.deepEqual(calls.slice(0, 2), ["settings.get", "session.get"]);
 });
+
+test("duplicate Stop cannot leave an abort marker on the following turn", async () => {
+  const handlers = new Map();
+  const activeTurns = new Map([["target", "turn-1"]]);
+  const aborting = new Set();
+  const finalized = [];
+  let queue = Promise.resolve();
+  registerAgentIpc({
+    registrar: { handle: (channel, handler) => handlers.set(channel, handler) },
+    getHost: () => null,
+    getSidecar: () => ({ call: async () => ({ ok: true, aborted: true }) }),
+    getAgentHostBridge: () => ({ markAborting: (id) => aborting.add(id) }),
+    logger: { app() {} }, agentExtensions: { cancelPrompts() {} }, cancelSessionTools() {},
+    activeTurns, approvedExecutionIdsBySession: new Map(), claimedExecutionSessions: new Map(),
+    acquireSessionOperation: async () => {
+      const previous = queue;
+      let release;
+      queue = new Promise((resolve) => { release = resolve; });
+      await previous;
+      return release;
+    },
+    lockAbortReason() {},
+    finishTurn: async (_id, reason, _code, options) => {
+      finalized.push([options.turnId, reason]);
+      activeTurns.delete("target");
+      aborting.delete("target");
+    },
+  });
+  const stop = handlers.get(IPC.invoke.agentAbort);
+  await Promise.all([stop({ sessionId: "target" }), stop({ sessionId: "target" })]);
+  assert.deepEqual(finalized, [["turn-1", "aborted"]]);
+  assert.equal(aborting.has("target"), false, "a Stop without an owning turn must not poison the next completion");
+});
diff --git a/apps/desktop/test/session-stop-settlement.test.mjs b/apps/desktop/test/session-stop-settlement.test.mjs
new file mode 100644
index 0000000000..5c67152da8
--- /dev/null
+++ b/apps/desktop/test/session-stop-settlement.test.mjs
@@ -0,0 +1,251 @@
+import assert from "node:assert/strict";
+import { register } from "node:module";
+import test from "node:test";
+
+register(new URL("./helpers/ts-import-hooks.mjs", import.meta.url));
+const { api } = await import("../src/lib/api.ts");
+const { createSessionRuntime } = await import("../src/stores/runtime/session-runtime.ts");
+const { createTranscriptSlice } = await import("../src/stores/slices/transcript-slice.ts");
+
+const sessionId = "stop-fixture";
+const message = (id, role, extra = {}) => ({
+  id, role, content: role === "assistant" ? "partial answer" : "inspect", createdAt: "2026-09-30T00:00:00Z", ...extra,
+});
+const deferred = () => {
+  let resolve;
+  let reject;
+  const promise = new Promise((yes, no) => { resolve = yes; reject = no; });
+  return { promise, resolve, reject };
+};
+
+function harness(source = "desktop", rows = [
+  message("user-1", "user"),
+  message("assistant-1", "assistant", { status: "streaming" }),
+  message("grep-1", "tool", { toolName: "Grep", toolStatus: "running" }),
+]) {
+  let runtime;
+  let state = {
+    activeSessionId: sessionId, sessions: [{ id: sessionId, source, capabilities: { canStop: true } }],
+    messages: rows, retainedSessionIds: [sessionId], retainedTranscripts: { [sessionId]: rows },
+    sessionHistory: {}, runningSessions: { [sessionId]: true }, isRunning: true,
+    agentStatuses: { [sessionId]: { isRunning: true, currentTurnId: "turn-1", activity: { phase: "waiting-model", since: 1 } } },
+    pendingPermissions: {}, pendingAsks: {}, latestTurnResults: {}, sessionOutcomes: {},
+  };
+  const access = {
+    get: () => state,
+    set: (patch) => {
+      const previous = state;
+      const next = typeof patch === "function" ? patch(state) : patch;
+      state = { ...state, ...next };
+      runtime?.syncTranscriptProjection(state, previous);
+    },
+  };
+  runtime = createSessionRuntime(access);
+  runtime.cacheSessionTranscript(sessionId, rows);
+  const slice = createTranscriptSlice({
+    ...access, runtime, promptAttachmentsFromMessage: () => [], viewingSessionIdForPrompt: () => null,
+    flushPendingSessionConfiguration: async () => {},
+  });
+  return { ...access, runtime, slice };
+}
+
+for (const source of ["pi-native", "remote"]) {
+  test(`${source} Stop publishes settled state before a slow secondary history read`, async (t) => {
+    const h = harness(source);
+    const abort = deferred();
+    const detail = deferred();
+    const reading = deferred();
+    t.mock.method(api, "abort", () => abort.promise);
+    t.mock.method(api, "getSession", () => { reading.resolve(); return detail.promise; });
+    const stopping = h.slice.abort();
+    assert.equal(h.get().isRunning, true, "never fake idle before backend settlement");
+    abort.resolve({ ok: true });
+    await reading.promise;
+    const settled = {
+      isRunning: h.get().isRunning, running: h.get().runningSessions[sessionId],
+      statusRunning: h.get().agentStatuses[sessionId]?.isRunning ?? false,
+      assistant: h.get().messages[1].status, tool: h.get().messages[2].toolStatus,
+    };
+    detail.resolve({ session: { messages: h.get().messages } });
+    await stopping;
+    assert.deepEqual(settled, { isRunning: false, running: false, statusRunning: false, assistant: "aborted", tool: "error" });
+  });
+}
+
+test("smart Stop history failure cannot retain the running badge or unresolved draft", async (t) => {
+  const h = harness("desktop", [message("user-1", "user")]);
+  const draft = { messageCountBeforeSend: 0, draft: { text: "inspect", fileReferences: [{ path: "src/a.ts", name: "a.ts" }] } };
+  h.runtime.submittedComposerDrafts.set(sessionId, draft);
+  t.mock.method(api, "abort", async () => ({ ok: true }));
+  const historyFailure = new Error("history unavailable");
+  t.mock.method(api, "getSession", async () => { throw historyFailure; });
+  await assert.rejects(h.slice.abort(), historyFailure);
+  assert.equal(h.get().isRunning, false);
+  assert.equal(h.get().runningSessions[sessionId], false);
+  assert.equal(h.get().agentStatuses[sessionId]?.isRunning ?? false, false);
+  assert.equal(await draft.abortResolution, false);
+  assert.equal(h.runtime.submittedComposerDrafts.has(sessionId), false);
+});
+
+test("failed backend abort remains observable and never pretends tool settlement", async (t) => {
+  const h = harness();
+  const failure = Object.assign(new Error("abort transport failed"), { code: "RPC_TIMEOUT" });
+  t.mock.method(api, "abort", async () => { throw failure; });
+  await assert.rejects(h.slice.abort(), failure);
+  assert.equal(h.get().isRunning, true);
+  assert.equal(h.get().runningSessions[sessionId], true);
+  assert.equal(h.get().messages[2].toolStatus, "running");
+});
+
+test("Stop settles its retained session after switching without clearing the visible session", async (t) => {
+  const h = harness();
+  const abort = deferred();
+  t.mock.method(api, "abort", () => abort.promise);
+  const stopping = h.slice.abort();
+  const other = [message("other-live", "assistant", { status: "streaming" })];
+  h.set({ activeSessionId: "other", messages: other, isRunning: true, runningSessions: { [sessionId]: true, other: true } });
+  abort.resolve({ ok: true });
+  await stopping;
+  assert.equal(h.get().isRunning, true);
+  assert.equal(h.get().messages, other);
+  assert.equal(h.get().runningSessions.other, true);
+  assert.equal(h.get().runningSessions[sessionId], false);
+  assert.equal(h.get().retainedTranscripts[sessionId][1].status, "aborted");
+  assert.equal(h.runtime.sessionTranscriptCache.get(sessionId)[2].toolStatus, "error");
+});
+
+test("a late smart Stop history read cannot clobber a switched session", async (t) => {
+  const h = harness("desktop", [message("user-1", "user")]);
+  const detail = deferred();
+  const reading = deferred();
+  h.runtime.submittedComposerDrafts.set(sessionId, { messageCountBeforeSend: 0, draft: { text: "inspect", fileReferences: [] } });
+  t.mock.method(api, "abort", async () => ({ ok: true }));
+  t.mock.method(api, "getSession", () => { reading.resolve(); return detail.promise; });
+  const stopping = h.slice.abort();
+  await reading.promise;
+  const other = [message("other", "assistant", { status: "streaming" })];
+  h.set({ activeSessionId: "other", messages: other, isRunning: true, runningSessions: { [sessionId]: false, other: true } });
+  detail.resolve({ session: { messages: [message("user-1", "user"), message("assistant-1", "assistant", { status: "complete" })] } });
+  await stopping;
+  assert.equal(h.get().isRunning, true);
+  assert.equal(h.get().messages, other);
+  assert.equal(h.get().composerPrefill, undefined);
+});
+
+test("a new turn in the same session survives an older Stop acknowledgement", async (t) => {
+  const h = harness();
+  const abort = deferred();
+  t.mock.method(api, "abort", () => abort.promise);
+  const stopping = h.slice.abort();
+  const nextDraft = { messageCountBeforeSend: 3, draft: { text: "follow up", fileReferences: [] } };
+  h.runtime.submittedComposerDrafts.set(sessionId, nextDraft);
+  const nextRows = [...h.get().messages, message("user-2", "user"), message("assistant-2", "assistant", { status: "streaming" })];
+  h.set({ messages: nextRows, agentStatuses: { [sessionId]: { isRunning: true, currentTurnId: "turn-2" } } });
+  abort.resolve({ ok: true });
+  await stopping;
+  assert.equal(h.get().isRunning, true);
+  assert.equal(h.get().runningSessions[sessionId], true);
+  assert.equal(h.get().messages.at(-1).status, "streaming");
+  assert.equal(h.runtime.submittedComposerDrafts.get(sessionId), nextDraft);
+});
+
+test("unanswered smart Stop restores structured references only after backend settlement", async (t) => {
+  const previous = message("previous", "assistant", { status: "complete" });
+  const h = harness("desktop", [previous, message("user-1", "user")]);
+  const draft = { text: "inspect", fileReferences: [{ path: "src/a.ts", name: "a.ts" }] };
+  h.runtime.submittedComposerDrafts.set(sessionId, { messageCountBeforeSend: 1, draft });
+  const abort = deferred();
+  t.mock.method(api, "abort", () => abort.promise);
+  t.mock.method(api, "getSession", async () => ({ session: { messages: h.get().messages } }));
+  t.mock.method(api, "replaceSessionMessages", async () => ({}));
+  const stopping = h.slice.abort();
+  assert.equal(h.get().isRunning, true);
+  assert.equal(h.get().composerPrefill, undefined);
+  abort.resolve({ ok: true });
+  await stopping;
+  assert.deepEqual(h.get().messages, [previous]);
+  assert.deepEqual(h.get().composerPrefill, { ...draft, sessionId });
+  assert.equal(h.get().isRunning, false);
+});
+
+test("repeated Stop shares one pending backend settlement", async (t) => {
+  const h = harness();
+  const abort = deferred();
+  const calls = [];
+  t.mock.method(api, "abort", (id) => { calls.push(id); return abort.promise; });
+  const first = h.slice.abort();
+  const second = h.slice.abort();
+  assert.equal(h.get().isRunning, true);
+  abort.resolve({ ok: true });
+  await Promise.all([first, second]);
+  assert.deepEqual(calls, [sessionId]);
+  assert.equal(h.get().isRunning, false);
+});
+
+test("Stop admission can acquire its initial turn status while the abort is pending", async (t) => {
+  const h = harness("desktop", [message("user-1", "user")]);
+  h.set({ agentStatuses: {} });
+  h.runtime.submittedComposerDrafts.set(sessionId, { messageCountBeforeSend: 0, draft: { text: "inspect", fileReferences: [] } });
+  const abort = deferred();
+  t.mock.method(api, "abort", () => abort.promise);
+  t.mock.method(api, "getSession", async () => ({ session: { messages: h.get().messages } }));
+  t.mock.method(api, "replaceSessionMessages", async () => ({}));
+  const stopping = h.slice.abort();
+  h.set({ agentStatuses: { [sessionId]: { isRunning: true, currentTurnId: "turn-1" } } });
+  abort.resolve({ ok: true });
+  await stopping;
+  assert.equal(h.get().isRunning, false);
+  assert.equal(h.get().runningSessions[sessionId], false);
+});
+
+test("late native history cannot replace a newer same-session transcript", async (t) => {
+  const h = harness("pi-native");
+  const detail = deferred();
+  const reading = deferred();
+  t.mock.method(api, "abort", async () => ({ ok: true }));
+  t.mock.method(api, "getSession", () => { reading.resolve(); return detail.promise; });
+  const stopping = h.slice.abort();
+  await reading.promise;
+  const next = [message("user-2", "user"), message("assistant-2", "assistant", { status: "streaming" })];
+  h.set({ messages: next, isRunning: true, runningSessions: { [sessionId]: true }, agentStatuses: { [sessionId]: { isRunning: true, currentTurnId: "turn-2" } } });
+  detail.resolve({ session: { messages: [message("old", "assistant", { status: "complete" })] } });
+  await stopping;
+  assert.equal(h.get().messages, next);
+  assert.equal(h.runtime.sessionTranscriptCache.get(sessionId), next);
+  assert.equal(h.get().isRunning, true);
+});
+
+test("Stop admission ignores prior history when acquiring the submitted turn", async (t) => {
+  const h = harness("desktop", [
+    message("old-answer", "assistant", { status: "complete" }),
+    message("user-1", "user"),
+  ]);
+  h.set({ agentStatuses: {} });
+  h.runtime.submittedComposerDrafts.set(sessionId, { messageCountBeforeSend: 1, draft: { text: "inspect", fileReferences: [] } });
+  const abort = deferred();
+  t.mock.method(api, "abort", () => abort.promise);
+  t.mock.method(api, "getSession", async () => ({ session: { messages: h.get().messages } }));
+  t.mock.method(api, "replaceSessionMessages", async () => ({}));
+  const stopping = h.slice.abort();
+  h.set({ agentStatuses: { [sessionId]: { isRunning: true, currentTurnId: "turn-1" } } });
+  abort.resolve({ ok: true });
+  await stopping;
+  assert.equal(h.get().isRunning, false);
+  assert.equal(h.get().runningSessions[sessionId], false);
+});
+
+test("late native history cannot replace a newer turn that already completed", async (t) => {
+  const h = harness("pi-native");
+  const detail = deferred();
+  const reading = deferred();
+  t.mock.method(api, "abort", async () => ({ ok: true }));
+  t.mock.method(api, "getSession", () => { reading.resolve(); return detail.promise; });
+  const stopping = h.slice.abort();
+  await reading.promise;
+  const next = [message("user-2", "user"), message("answer-2", "assistant", { status: "complete" })];
+  h.set({ messages: next, isRunning: false, runningSessions: { [sessionId]: false }, agentStatuses: {} });
+  detail.resolve({ session: { messages: [message("old", "assistant", { status: "complete" })] } });
+  await stopping;
+  assert.equal(h.get().messages, next);
+  assert.equal(h.runtime.sessionTranscriptCache.get(sessionId), next);
+});
diff --git a/apps/desktop/test/session-switch-performance.test.mjs b/apps/desktop/test/session-switch-performance.test.mjs
index 0e309bde3a..bded79fb78 100644
--- a/apps/desktop/test/session-switch-performance.test.mjs
+++ b/apps/desktop/test/session-switch-performance.test.mjs
@@ -178,7 +178,15 @@ test("reopening a running session never lets durable detail erase its live tail"
   // A warm pane must not reveal one deferred frame from before the stream was
   // captured; its first visible render uses the selected live snapshot.
   assert.match(transcript, /const paneRevealed = paneVisible && !wasPaneVisibleRef\.current/);
-  assert.match(transcript, /firstCommit \|\| paneRevealed \? projection : deferredProjection/);
+  assert.match(transcript, /if \(paneRevealed\) revealedProjection\.current = projection/);
+  assert.match(
+    transcript,
+    /if \(deferredProjection === revealedProjection\.current \|\| deferredProjection === projection\) \{\s*revealedProjection\.current = null;/,
+  );
+  assert.match(
+    transcript,
+    /readingWindow \|\| firstCommit \|\| paneRevealed \|\| revealedProjection\.current\s*\? projection : deferredProjection/,
+  );
 });
 
 test("reopening an idle session keeps a completed live tail until the durable page has it (D324)", () => {
diff --git a/apps/desktop/test/subagent-transcript.test.mjs b/apps/desktop/test/subagent-transcript.test.mjs
index 4f7784482e..f21684a21c 100644
--- a/apps/desktop/test/subagent-transcript.test.mjs
+++ b/apps/desktop/test/subagent-transcript.test.mjs
@@ -365,10 +365,10 @@ test("a delegate's rows scroll in place instead of growing the page (D271)", ()
 });
 
 test("an expanded delegate run follows the latest output while pinned (D302)", () => {
-  // Nested follow is a dedicated hook so the main transcript's history,
-  // veil, and pane-visibility machinery stay out of the run scroller.
+  // Nested follow keeps the main transcript's history and veil machinery out
+  // of the run scroller, while suspending work with the ambient visibility.
   assert.match(transcriptSource, /function SubagentRunFollow\(/);
-  assert.match(transcriptSource, /const \{[^}]*scrollRef,[^}]*\} = useFollowScroll\(\)/);
+  assert.match(transcriptSource, /const \{[^}]*scrollRef,[^}]*\} = useFollowScroll\(visible && scrollable\)/);
   assert.match(
     transcriptSource,
     /<SubagentRunFollow[\s\S]*?headingId=\{headingId\}[\s\S]*?items=\{run\.items\}/,
diff --git a/apps/desktop/test/transcript-disclosure-reading.test.mjs b/apps/desktop/test/transcript-disclosure-reading.test.mjs
index cc62a7d8b6..5a4a399735 100644
--- a/apps/desktop/test/transcript-disclosure-reading.test.mjs
+++ b/apps/desktop/test/transcript-disclosure-reading.test.mjs
@@ -175,7 +175,7 @@ test("scroll input is attributed to the scroller that can consume it", () => {
 test("a nested owner holds its own position and passes the hold outward", () => {
   assert.match(
     followScroll,
-    /const followScrollNow = useCallback\(\(\) => \{\s*if \(restoreDisclosureAnchor\(\)\) return;\s*if \(!pinnedRef\.current\) return;\s*cancelFollowScroll\(\);\s*scrollToBottom\(\);/,
+    /const followScrollNow = useCallback\(\(\) => \{\s*if \(!enabledRef\.current\) return;\s*if \(restoreDisclosureAnchor\(\)\) return;\s*if \(!pinnedRef\.current\) return;\s*cancelFollowScroll\(\);\s*scrollToBottom\(\);/,
   );
   assert.match(followScroll, /disclosureAnchorNotifier,/);
   assert.match(
diff --git a/apps/desktop/test/transcript-style.test.mjs b/apps/desktop/test/transcript-style.test.mjs
index 3ddc58c302..39cbd59e7c 100644
--- a/apps/desktop/test/transcript-style.test.mjs
+++ b/apps/desktop/test/transcript-style.test.mjs
@@ -56,8 +56,11 @@ test("tool rows render structured blocks instead of dumping JSON", async () => {
   assert.doesNotMatch(transcriptSource, /getToolSections|hasToolSections/);
   assert.doesNotMatch(permissionSource, /JSON\.stringify|formatToolValue/);
   assert.match(transcriptSource, /buildToolPresentation\(message, \{\n\s+hideSummaryArg: true,/);
-  // Formatting remains lazy and the cached blocks are read only while visible.
-  assert.match(transcriptSource, /if \(variant !== "topology" && open && hasDetails && disclosure\.parentVisible/);
+  // Formatting runs only for visible work; cached blocks stay mounted off screen.
+  assert.match(
+    transcriptSource,
+    /if \(variant !== "topology" && open && hasDetails && disclosure\.workVisible &&\s*\(presentation\.current\?\.message !== message \|\| presentation\.current\?\.nestedReport !== nestedReport\)\)/,
+  );
   assert.match(transcriptSource, /const blocks = variant !== "topology" && open && hasDetails \? presentation\.current\?\.blocks : null/);
   assert.match(transcriptSource, /<ToolChips chips=\{chips\} \/>/);
   assert.match(
@@ -432,31 +435,41 @@ test("user-message file chips reuse the composer chip node", () => {
 });
 
 test("stopping a turn undoes an unanswered prompt or settles the partial reply", async () => {
-  const storeSource = await readStoreSource();
-  assert.match(storeSource, /const submittedDraft = runtime\.submittedComposerDrafts\.get\(sessionId\)/);
-  assert.match(storeSource, /resolveComposerSmartStop\(state\.messages, submittedDraft\)/);
-  assert.match(storeSource, /composerPrefill:\s*\{ \.\.\.fullStop\.draft, sessionId \}/);
-  assert.match(storeSource, /submittedDraft\?\.resolveAbort\?\.\(true\)/);
-  assert.match(storeSource, /submittedDraft\?\.resolveAbort\?\.\(false\)/);
-  assert.match(storeSource, /submittedComposerDrafts\.delete\(sessionId\)/);
-  assert.match(storeSource, /smartStop\.kind === "restore"/);
-  assert.match(storeSource, /status:\s*"aborted" as const/);
+  const [stopSource, transcriptSliceSource] = await Promise.all([
+    readFile(new URL("../src/stores/runtime/stop-session.ts", import.meta.url), "utf8"),
+    readFile(new URL("../src/stores/slices/transcript-slice.ts", import.meta.url), "utf8"),
+  ]);
+  assert.match(transcriptSliceSource, /import \{ createSessionStop \} from "\.\.\/runtime\/stop-session"/);
+  assert.match(
+    transcriptSliceSource,
+    /abort: createSessionStop\(\{ get, set, runtime, flushPendingSessionConfiguration \}\)/,
+  );
+  assert.match(stopSource, /const submittedDraft = runtime\.submittedComposerDrafts\.get\(sessionId\)/);
+  assert.match(stopSource, /await api\.abort\(sessionId\);\s*settle\(\);/);
+  assert.match(stopSource, /resolveComposerSmartStop\(state\.messages, submittedDraft\)/);
+  assert.match(stopSource, /composerPrefill:\s*\{ \.\.\.fullStop\.draft, sessionId \}/);
+  assert.match(stopSource, /submittedDraft\?\.resolveAbort\?\.\(restored\)/);
+  assert.match(stopSource, /finishDraft\(true\)/);
+  assert.match(stopSource, /finishDraft\(false\)/);
+  assert.match(stopSource, /submittedComposerDrafts\.delete\(sessionId\)/);
+  assert.match(stopSource, /smartStop\.kind === "restore"/);
+  assert.match(stopSource, /status:\s*"aborted" as const/);
   // The undo rewrite starts from the full durable transcript merged with the
   // live rows, never from the renderer's paged, display-capped window (D299).
   assert.match(
-    storeSource,
-    /const merged = mergeLiveSessionMessages\(fullMessages, get\(\)\.messages\)/,
+    stopSource,
+    /const merged = stoppedRows\(mergeLiveSessionMessages\(fullMessages, get\(\)\.messages\), stoppedAtMs\)/,
   );
-  assert.match(storeSource, /resolveComposerSmartStop\(merged, submittedDraft\)/);
+  assert.match(stopSource, /resolveComposerSmartStop\(merged, submittedDraft\)/);
   assert.match(
-    storeSource,
+    stopSource,
     /replaceSessionMessages\(sessionId,\s*fullStop\.kept\)/,
   );
   // Settling a partial reply is renderer-only: the runtime's aborted final row
   // (or its checkpoint) is the durable copy, and a rewrite from this snapshot
   // could delete it.
-  assert.doesNotMatch(storeSource, /replaceSessionMessages\(sessionId,\s*settled\)/);
-  assert.doesNotMatch(storeSource, /replaceSessionMessages\(sessionId,\s*smartStop\.kept\)/);
+  assert.doesNotMatch(stopSource, /replaceSessionMessages\(sessionId,\s*settled\)/);
+  assert.doesNotMatch(stopSource, /replaceSessionMessages\(sessionId,\s*smartStop\.kept\)/);
 });
 
 test("delete remains on user turns and is removed from assistant toolbar", async () => {
diff --git a/apps/desktop/test/turn-process.test.mjs b/apps/desktop/test/turn-process.test.mjs
index b07bf4dad9..44be0a35f0 100644
--- a/apps/desktop/test/turn-process.test.mjs
+++ b/apps/desktop/test/turn-process.test.mjs
@@ -611,3 +611,44 @@ test("settings writes validate the thinking preference without changing other pr
     /thinkingDisplayMode is invalid/,
   );
 });
+
+test("all process chunks share a linear timing pass over one immutable turn snapshot", () => {
+  let timestampReads = 0;
+  const count = 2_000;
+  const parts = Object.freeze(Array.from({ length: count }, (_, index) => ({
+    kind: "activity",
+    items: [Object.freeze({
+      kind: "tool",
+      message: Object.freeze({
+        ...tool(`timed-${index}`, index % 2 ? "Bash" : "Read", { toolDurationMs: 10 }),
+        get createdAt() {
+          timestampReads += 1;
+          return "2026-09-17T00:00:00.000Z";
+        },
+      }),
+    })],
+  })));
+  const segments = segmentTurnProcess(parts).filter((segment) => segment.kind === "process");
+  for (const _segment of segments) {
+    assert.deepEqual(turnProcessTiming(parts), {
+      startedAt: Date.parse("2026-09-17T00:00:00.000Z"),
+      endedAt: Date.parse("2026-09-17T00:00:00.000Z") + 10,
+    });
+  }
+  assert.ok(timestampReads <= count * 2, `one snapshot must be linear, read ${timestampReads} timestamps`);
+  const updated = [...parts, { kind: "message", message: message("later", "assistant", "done", {
+    createdAt: "2026-09-17T00:00:02.000Z", responseDurationMs: 50,
+  }) }];
+  assert.equal(turnProcessTiming(updated).endedAt, Date.parse("2026-09-17T00:00:02.050Z"));
+  assert.equal(turnProcessTiming(parts).endedAt, Date.parse("2026-09-17T00:00:00.010Z"));
+});
+
+test("timing accepts a giant activity without an argument-spread limit", () => {
+  const parts = [{
+    kind: "activity",
+    items: Array.from({ length: 150_000 }, (_, index) => ({
+      kind: "tool", message: tool(`large-${index}`, "Grep", { toolDurationMs: index }),
+    })),
+  }];
+  assert.equal(turnProcessTiming(parts).endedAt - turnProcessTiming(parts).startedAt, 149_999);
+});
diff --git a/crates/host-core/src/rpc/mod.rs b/crates/host-core/src/rpc/mod.rs
index edc345eb33..d1b5de7d0d 100644
--- a/crates/host-core/src/rpc/mod.rs
+++ b/crates/host-core/src/rpc/mod.rs
@@ -10,6 +10,9 @@ mod worktree_rpc;
 #[cfg(test)]
 mod plugin_reviews_rpc_tests;
 
+#[cfg(test)]
+mod search_cancellation_tests;
+
 use std::io::{self, BufRead, BufReader as StdBufReader, Read, Write};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -4489,9 +4492,10 @@ async fn handle_request(
                             bash_options,
                             allow_external_paths: external_path_permission,
                             hashline: Some(hashline_ctx),
+                            cancellation: cancellation_receiver.clone(),
                         },
                     );
-                    if matches!(p.tool_name.as_str(), "Read" | "Glob" | "Grep") {
+                    if p.tool_name == "Read" {
                         let mut read_cancellation = cancellation_receiver.clone();
                         tokio::select! {
                             result = execute => result,
@@ -7481,6 +7485,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: false,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
@@ -7501,6 +7506,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: false,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
diff --git a/crates/host-core/src/rpc/remote_tools.rs b/crates/host-core/src/rpc/remote_tools.rs
index b9314bfcb8..a73efb63c9 100644
--- a/crates/host-core/src/rpc/remote_tools.rs
+++ b/crates/host-core/src/rpc/remote_tools.rs
@@ -145,11 +145,33 @@ pub(super) async fn execute_remote_tool(
     )
     .await;
     let timeout_ms = tools::effective_timeout_ms(&p.tool_name, p.timeout_ms).unwrap_or(120_000);
+    let response = async {
+        match tokio::time::timeout(
+            Duration::from_millis(timeout_ms.saturating_add(15_000)),
+            receiver,
+        )
+        .await
+        {
+            Ok(Ok(value)) => Ok(value),
+            _ => Err("TOOL_TIMEOUT"),
+        }
+    };
+    tokio::pin!(response);
     let outcome = tokio::select! {
-        outcome = tokio::time::timeout(Duration::from_millis(timeout_ms.saturating_add(15_000)), receiver) => match outcome {
-            Ok(Ok(value)) => Ok(value), _ => Err("TOOL_TIMEOUT"),
+        outcome = &mut response => outcome,
+        _ = wait_for_tool_cancellation(&mut cancellation) => {
+            if matches!(p.tool_name.as_str(), "Grep" | "Glob") {
+                // Retain relay/admission ownership until the cancellation-aware
+                // remote worker settles. The existing transport deadline still
+                // reports a timeout/disconnection rather than a false stop.
+                send_notification(tx, "tools.remoteAbort", json!({
+                    "sessionId": p.session_id, "toolCallId": p.tool_call_id,
+                }));
+                response.await
+            } else {
+                Err("TOOL_ABORTED")
+            }
         },
-        _ = wait_for_tool_cancellation(&mut cancellation) => Err("TOOL_ABORTED"),
     };
     state.lock().await.remote_execs.remove(&request_id);
     match outcome {
@@ -353,10 +375,19 @@ pub(super) async fn handle(
             session_id: &p.session_id,
             store: &hashline,
         }),
+        cancellation: cancellation.clone(),
     };
-    let mut result = tokio::select! {
-        result = tools::execute_tool_with_path_access(Some(&root),None,&p.tool_name,&p.args,options) => result,
-        _ = wait_for_tool_cancellation(&mut cancellation) => failure(&p,"TOOL_ABORTED","tool aborted",started),
+    let execute =
+        tools::execute_tool_with_path_access(Some(&root), None, &p.tool_name, &p.args, options);
+    let mut result = if matches!(p.tool_name.as_str(), "Grep" | "Glob") {
+        // Search owns cancellation and must settle its blocking body/child
+        // before the registry is cleared or another turn is admitted.
+        execute.await
+    } else {
+        tokio::select! {
+            result = execute => result,
+            _ = wait_for_tool_cancellation(&mut cancellation) => failure(&p,"TOOL_ABORTED","tool aborted",started),
+        }
     };
     result.tool_call_id = p.tool_call_id.clone();
     state
diff --git a/crates/host-core/src/rpc/remote_tools_tests.rs b/crates/host-core/src/rpc/remote_tools_tests.rs
index 6af8d2b48c..e086218d29 100644
--- a/crates/host-core/src/rpc/remote_tools_tests.rs
+++ b/crates/host-core/src/rpc/remote_tools_tests.rs
@@ -386,3 +386,84 @@ async fn remote_projects_cannot_create_isolated_sessions() {
         .len();
     assert_eq!(before, after);
 }
+
+async fn assert_remote_search_waits_for_completion(tool_name: &str, args: Value) {
+    let (_dir, state, tx, mut rx) = fixture();
+    let (_path, id) = create(&state, &tx).await;
+    sessions::configure_session_with_thinking(
+        &state.lock().await.db,
+        &id,
+        "agent",
+        None,
+        None,
+        None,
+        Some("auto"),
+    )
+    .unwrap();
+    let pending_state = state.clone();
+    let pending_tx = tx.clone();
+    let pending_id = id.clone();
+    let name = tool_name.to_string();
+    let pending = tokio::spawn(async move {
+        handle_request(
+            pending_state,
+            "tools.execute",
+            json!({
+                "sessionId": pending_id, "toolCallId": "search-stop", "toolName": name,
+                "args": args, "mode": "agent",
+            }),
+            pending_tx,
+        )
+        .await
+    });
+    let dispatch: Value = serde_json::from_str(
+        &tokio::time::timeout(Duration::from_secs(10), rx.recv())
+            .await
+            .unwrap()
+            .unwrap(),
+    )
+    .unwrap();
+    assert_eq!(dispatch["method"], "tools.remoteExecute");
+    // Drive the public host cancellation API directly, as shutdown does, so
+    // the abort notification below proves the relay observed cancellation.
+    assert_eq!(
+        state
+            .lock()
+            .await
+            .abort_or_queue_tool(&id, "search-stop", tool_name),
+        (true, false)
+    );
+    let abort: Value = serde_json::from_str(
+        &tokio::time::timeout(Duration::from_secs(10), rx.recv())
+            .await
+            .unwrap()
+            .unwrap(),
+    )
+    .unwrap();
+    assert_eq!(abort["method"], "tools.remoteAbort");
+    // A completion remains routable after Stop. Returning before this result
+    // would release the local admission permit while the remote worker runs.
+    let complete = handle_request(state.clone(), "tools.remoteComplete", json!({
+        "requestId": dispatch["params"]["requestId"],
+        "result": { "ok": false, "errorCode": "TOOL_ABORTED", "content": { "code": "TOOL_ABORTED" } },
+    }), tx).await;
+    let result = pending.await.unwrap().unwrap();
+    assert!(
+        complete.is_ok(),
+        "Stop must retain ownership until remote settlement: {complete:?}"
+    );
+    assert_eq!(result["errorCode"], "TOOL_ABORTED");
+    let app = state.lock().await;
+    assert!(app.remote_execs.is_empty());
+    assert!(app.active_tool_cancellations.is_empty());
+}
+
+#[tokio::test]
+async fn remote_grep_stop_waits_for_remote_settlement() {
+    assert_remote_search_waits_for_completion("Grep", json!({ "pattern": "needle" })).await;
+}
+
+#[tokio::test]
+async fn remote_glob_stop_waits_for_remote_settlement() {
+    assert_remote_search_waits_for_completion("Glob", json!({ "pattern": "**/*.txt" })).await;
+}
diff --git a/crates/host-core/src/rpc/search_cancellation_tests.rs b/crates/host-core/src/rpc/search_cancellation_tests.rs
new file mode 100644
index 0000000000..8fccd39f0b
--- /dev/null
+++ b/crates/host-core/src/rpc/search_cancellation_tests.rs
@@ -0,0 +1,177 @@
+use super::*;
+
+struct SearchFixture {
+    _data: tempfile::TempDir,
+    state: Arc<Mutex<AppState>>,
+    session_id: String,
+}
+
+fn search_fixture() -> SearchFixture {
+    let data = tempfile::tempdir().unwrap();
+    let project = data.path().join("project");
+    std::fs::create_dir_all(&project).unwrap();
+    std::fs::write(project.join("source.txt"), "search fixture\n").unwrap();
+    let mut app = AppState::open(data.path()).unwrap();
+    app.handshook = true;
+    let session = sessions::create_session(
+        &app.db,
+        Some("Search cancellation fixture".into()),
+        Some("agent".into()),
+        None,
+        None,
+        Some(project.to_string_lossy().into_owned()),
+    )
+    .unwrap();
+    sessions::configure_session_with_thinking(
+        &app.db,
+        &session.id,
+        "agent",
+        None,
+        None,
+        None,
+        Some("ask"),
+    )
+    .unwrap();
+    SearchFixture {
+        _data: data,
+        state: Arc::new(Mutex::new(app)),
+        session_id: session.id,
+    }
+}
+
+async fn assert_clean(fixture: &SearchFixture, tool_call_id: &str, tool_name: &str) {
+    let mut state = fixture.state.lock().await;
+    assert!(state.active_bash_cancellations.is_empty());
+    assert!(state.active_tool_cancellations.is_empty());
+    assert!(state
+        .permissions
+        .pending_requests(Some(&fixture.session_id))
+        .is_empty());
+    let receiver = state
+        .register_tool_cancellation(&fixture.session_id, tool_call_id, tool_name)
+        .unwrap();
+    assert!(
+        !*receiver.borrow(),
+        "an abort must be consumed, not retained"
+    );
+    state.clear_tool_cancellation(&fixture.session_id, tool_call_id, tool_name);
+}
+
+async fn execute_search(fixture: &SearchFixture, tool_name: &str, args: Value) -> Value {
+    handle_request(
+        fixture.state.clone(),
+        "tools.execute",
+        json!({
+            "sessionId": fixture.session_id, "toolCallId": "next-search",
+            "toolName": tool_name, "args": args, "mode": "agent",
+        }),
+        mpsc::unbounded_channel().0,
+    )
+    .await
+    .unwrap()
+}
+
+async fn assert_search_consumes_early_abort(tool_name: &str, args: Value) {
+    let fixture = search_fixture();
+    let abort = handle_request(
+        fixture.state.clone(),
+        "tools.abort",
+        json!({
+            "sessionId": fixture.session_id, "toolCallId": "early-search", "toolName": tool_name,
+        }),
+        mpsc::unbounded_channel().0,
+    )
+    .await
+    .unwrap();
+    assert_eq!(abort["queued"], true);
+    let result = handle_request(
+        fixture.state.clone(),
+        "tools.execute",
+        json!({
+            "sessionId": fixture.session_id, "toolCallId": "early-search",
+            "toolName": tool_name, "args": args, "mode": "agent",
+        }),
+        mpsc::unbounded_channel().0,
+    )
+    .await
+    .unwrap();
+    assert_eq!(result["errorCode"], "TOOL_ABORTED");
+    assert_eq!(result["content"]["code"], "TOOL_ABORTED");
+    assert_clean(&fixture, "early-search", tool_name).await;
+    let next = execute_search(&fixture, tool_name, args).await;
+    assert_eq!(
+        next["ok"], true,
+        "a stopped call must not poison a later search"
+    );
+}
+
+async fn assert_search_cancels_permission_wait(tool_name: &str, mut args: Value) {
+    let fixture = search_fixture();
+    let outside = tempfile::tempdir().unwrap();
+    std::fs::write(outside.path().join("outside.txt"), "search fixture\n").unwrap();
+    args["path"] = json!(outside.path().to_string_lossy());
+    let (tx, mut notifications) = mpsc::unbounded_channel();
+    let state = fixture.state.clone();
+    let params = json!({ "sessionId": fixture.session_id, "toolCallId": "approval-search",
+        "toolName": tool_name, "args": args, "mode": "agent" });
+    let search = tokio::spawn(async move {
+        handle_request(state, "tools.execute", params, tx)
+            .await
+            .unwrap()
+    });
+    let permission = tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            let notification = notifications
+                .recv()
+                .await
+                .expect("search notification channel closed");
+            let notification: Value = serde_json::from_str(&notification).unwrap();
+            if notification["method"] == "permissions.request" {
+                break notification;
+            }
+        }
+    })
+    .await
+    .expect("external-path search must still require approval");
+    assert_eq!(permission["params"]["toolCallId"], "approval-search");
+    handle_request(
+        fixture.state.clone(),
+        "tools.abort",
+        json!({
+            "sessionId": fixture.session_id, "toolCallId": "approval-search", "toolName": tool_name,
+        }),
+        mpsc::unbounded_channel().0,
+    )
+    .await
+    .unwrap();
+    let result = tokio::time::timeout(Duration::from_secs(10), search)
+        .await
+        .expect("approval cancellation did not settle")
+        .unwrap();
+    assert_eq!(result["errorCode"], "TOOL_ABORTED");
+    assert_clean(&fixture, "approval-search", tool_name).await;
+    args.as_object_mut().unwrap().remove("path");
+    let next = execute_search(&fixture, tool_name, args).await;
+    assert_eq!(next["ok"], true);
+    assert_eq!(next["content"]["count"], 1);
+}
+
+#[tokio::test]
+async fn grep_consumes_abort_before_registration_and_settles() {
+    assert_search_consumes_early_abort("Grep", json!({ "pattern": "search" })).await;
+}
+
+#[tokio::test]
+async fn glob_consumes_abort_before_registration_and_settles() {
+    assert_search_consumes_early_abort("Glob", json!({ "pattern": "**/*.txt" })).await;
+}
+
+#[tokio::test]
+async fn grep_stop_cancels_external_approval_and_cleans_registry() {
+    assert_search_cancels_permission_wait("Grep", json!({ "pattern": "search" })).await;
+}
+
+#[tokio::test]
+async fn glob_stop_cancels_external_approval_and_cleans_registry() {
+    assert_search_cancels_permission_wait("Glob", json!({ "pattern": "**/*.txt" })).await;
+}
diff --git a/crates/host-core/src/rpc/worktree_rpc/tests.rs b/crates/host-core/src/rpc/worktree_rpc/tests.rs
index ef7c349bbe..bc033eb887 100644
--- a/crates/host-core/src/rpc/worktree_rpc/tests.rs
+++ b/crates/host-core/src/rpc/worktree_rpc/tests.rs
@@ -34,6 +34,7 @@ fn tool_options(
         bash_options: bash,
         allow_external_paths: false,
         hashline: None,
+        cancellation: None,
     }
 }
 
diff --git a/crates/host-core/src/session_worktrees/lifecycle.rs b/crates/host-core/src/session_worktrees/lifecycle.rs
index 7f28157ab8..f948a018f0 100644
--- a/crates/host-core/src/session_worktrees/lifecycle.rs
+++ b/crates/host-core/src/session_worktrees/lifecycle.rs
@@ -442,6 +442,7 @@ pub(super) async fn run_setup(
             }),
             allow_external_paths: false,
             hashline: None,
+            cancellation: None,
         },
     )
     .await;
diff --git a/crates/host-core/src/tools/cancel.rs b/crates/host-core/src/tools/cancel.rs
new file mode 100644
index 0000000000..1ddcf4aa80
--- /dev/null
+++ b/crates/host-core/src/tools/cancel.rs
@@ -0,0 +1,129 @@
+//! One per-call cancellation signal for synchronous search checkpoints and
+//! asynchronous subprocess I/O. No watcher threads or parallel registry.
+
+use std::fmt;
+use tokio::sync::watch;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Cancelled;
+
+impl fmt::Display for Cancelled {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("tool aborted")
+    }
+}
+
+impl std::error::Error for Cancelled {}
+
+impl From<Cancelled> for (String, String) {
+    fn from(error: Cancelled) -> Self {
+        ("TOOL_ABORTED".into(), error.to_string())
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct ToolCancellation {
+    receiver: Option<watch::Receiver<bool>>,
+    #[cfg(test)]
+    checks_left: Option<std::sync::Arc<std::sync::atomic::AtomicUsize>>,
+}
+
+impl ToolCancellation {
+    pub fn from_receiver(receiver: Option<watch::Receiver<bool>>) -> Self {
+        Self {
+            receiver,
+            #[cfg(test)]
+            checks_left: None,
+        }
+    }
+
+    pub fn check(&self) -> Result<(), Cancelled> {
+        if self
+            .receiver
+            .as_ref()
+            .is_some_and(|receiver| *receiver.borrow())
+        {
+            return Err(Cancelled);
+        }
+        #[cfg(test)]
+        if let Some(checks) = &self.checks_left {
+            use std::sync::atomic::Ordering;
+            let mut left = checks.load(Ordering::SeqCst);
+            loop {
+                if left == 0 {
+                    return Err(Cancelled);
+                }
+                match checks.compare_exchange_weak(
+                    left,
+                    left - 1,
+                    Ordering::SeqCst,
+                    Ordering::SeqCst,
+                ) {
+                    Ok(_) => break,
+                    Err(current) => left = current,
+                }
+            }
+        }
+        Ok(())
+    }
+
+    pub async fn cancelled(&self) {
+        if let Some(mut receiver) = self.receiver.clone() {
+            if receiver.wait_for(|cancelled| *cancelled).await.is_ok() {
+                return;
+            }
+        }
+        // Normal registry disposal is not a cancellation request. A stopped
+        // call or host shutdown sends true before dropping its sender.
+        std::future::pending::<()>().await;
+    }
+
+    #[cfg(test)]
+    pub fn cancel_after(checks: usize) -> Self {
+        Self {
+            receiver: None,
+            checks_left: Some(std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(
+                checks,
+            ))),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn live_signal_wakes_and_stays_cancelled() {
+        let (sender, receiver) = watch::channel(false);
+        let cancellation = ToolCancellation::from_receiver(Some(receiver));
+        assert_eq!(cancellation.check(), Ok(()));
+        sender.send(true).unwrap();
+        cancellation.cancelled().await;
+        assert_eq!(cancellation.check(), Err(Cancelled));
+        assert_eq!(cancellation.check(), Err(Cancelled));
+    }
+
+    #[tokio::test]
+    async fn normal_registry_disposal_does_not_cancel() {
+        let (sender, receiver) = watch::channel(false);
+        let cancellation = ToolCancellation::from_receiver(Some(receiver));
+        drop(sender);
+        assert_eq!(cancellation.check(), Ok(()));
+        assert!(
+            tokio::time::timeout(std::time::Duration::ZERO, cancellation.cancelled())
+                .await
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn deterministic_checkpoint_budget_is_shared_and_latched() {
+        let cancellation = ToolCancellation::cancel_after(2);
+        let cloned = cancellation.clone();
+        assert_eq!(cancellation.check(), Ok(()));
+        assert_eq!(cloned.check(), Ok(()));
+        assert_eq!(cancellation.check(), Err(Cancelled));
+        assert_eq!(cloned.check(), Err(Cancelled));
+    }
+}
diff --git a/crates/host-core/src/tools/grep_rg.rs b/crates/host-core/src/tools/grep_rg.rs
index cd72e63f4b..cd696464a6 100644
--- a/crates/host-core/src/tools/grep_rg.rs
+++ b/crates/host-core/src/tools/grep_rg.rs
@@ -6,14 +6,18 @@
 //! Spawn failures and `rg` exit 2 fall back to the in-process searcher so a
 //! missing or broken install never changes the tool's public shape.
 
-use super::{clip_chars, display_tool_path, grep_output, BUDGET_SEARCH, MAX_LINE_CHARS};
+use super::{
+    cancel::ToolCancellation, clip_chars, display_tool_path, grep_output, ProcessOwnership,
+    BUDGET_SEARCH, MAX_LINE_CHARS,
+};
 use crate::workspace::ToolRoot;
 use serde_json::{json, Value};
 use std::collections::BTreeMap;
-use std::io::{BufRead, BufReader};
 use std::path::{Path, PathBuf};
-use std::process::{Command, Stdio};
+use std::process::Stdio;
 use std::time::{SystemTime, UNIX_EPOCH};
+use tokio::io::AsyncReadExt;
+use tokio::process::{Child, Command};
 
 /// Cap on `rg --json` stdout so a pathological tree cannot fill host memory
 /// before we apply the Grep result budget.
@@ -32,6 +36,7 @@ pub struct SystemGrep<'a> {
     pub mode: &'a str,
     pub case_insensitive: bool,
     pub head_limit: usize,
+    pub cancellation: &'a ToolCancellation,
 }
 
 #[cfg(test)]
@@ -60,9 +65,14 @@ impl Drop for TestRgGuard {
     }
 }
 
-pub fn try_system_rg(req: SystemGrep<'_>) -> Option<Value> {
-    let rg = resolve_rg()?;
-    grep_with_rg(&rg, req)
+pub fn try_system_rg(req: SystemGrep<'_>) -> Result<Option<Value>, (String, String)> {
+    req.cancellation.check()?;
+    let Some(rg) = resolve_rg() else {
+        return Ok(None);
+    };
+    // The caller remains on the blocking pool for filesystem work. Async
+    // pipe reads let cancellation wake a quiet child without a watcher thread.
+    tokio::runtime::Handle::current().block_on(grep_with_rg(&rg, req))
 }
 
 fn resolve_rg() -> Option<PathBuf> {
@@ -83,7 +93,7 @@ fn resolve_rg() -> Option<PathBuf> {
     }
 }
 
-fn grep_with_rg(rg: &Path, req: SystemGrep<'_>) -> Option<Value> {
+async fn grep_with_rg(rg: &Path, req: SystemGrep<'_>) -> Result<Option<Value>, (String, String)> {
     let mut args: Vec<String> = vec!["--json".into(), "--no-config".into(), "--hidden".into()];
     // Per-file cap: content never needs more than headLimit hits from one file.
     // count mode needs the real per-file total, so it is left unbounded.
@@ -112,48 +122,133 @@ fn grep_with_rg(rg: &Path, req: SystemGrep<'_>) -> Option<Value> {
     args.push("--".into());
     args.push(req.search_dir.to_string_lossy().into_owned());
 
-    let mut child = Command::new(rg)
+    req.cancellation.check()?;
+    let mut command = Command::new(rg);
+    command
         .args(&args)
-        // `--ignore-file` patterns are matched relative to the working
-        // directory, so anchor it at the ignore root.
+        // Anchor ignore patterns at the same root as the in-process walker.
         .current_dir(req.ignore_root)
         .stdin(Stdio::null())
         .stdout(Stdio::piped())
         .stderr(Stdio::null())
-        .spawn()
-        .ok()?;
-    let stdout = child.stdout.take()?;
-    let mut reader = BufReader::with_capacity(64 * 1024, stdout);
-    let mut raw = String::new();
+        .kill_on_drop(true);
+    #[cfg(windows)]
+    command.creation_flags(super::windows_tool_runner_creation_flags(
+        super::windows_breakaway_allowed(),
+    ));
+    #[cfg(unix)]
+    command.process_group(0);
+    let mut child = match command.spawn() {
+        Ok(child) => child,
+        Err(_) => return Ok(None),
+    };
+    let mut ownership = match ProcessOwnership::assign(&child) {
+        Ok(ownership) => ownership,
+        Err(error) => {
+            tracing::warn!(%error, "rg process ownership failed");
+            child.kill().await.map_err(rg_lifecycle_error)?;
+            return Ok(None);
+        }
+    };
+    let Some(mut stdout) = child.stdout.take() else {
+        stop_and_reap(&mut child, &mut ownership).await?;
+        return Ok(None);
+    };
+    let mut chunk = [0_u8; 64 * 1024];
+    let mut raw = Vec::new();
     let mut total = 0_usize;
     let mut capped = false;
     let mut parsed: BTreeMap<PathBuf, FileHits> = BTreeMap::new();
     loop {
-        raw.clear();
-        match reader.read_line(&mut raw) {
+        let read = tokio::select! {
+            biased;
+            _ = req.cancellation.cancelled() => {
+                stop_and_reap(&mut child, &mut ownership).await?;
+                return Err(super::cancel::Cancelled.into());
+            },
+            read = stdout.read(&mut chunk) => read,
+        };
+        let size = match read {
             Ok(0) => break,
-            Ok(n) => {
-                total = total.saturating_add(n);
-                if total > RG_STDOUT_CAP {
-                    capped = true;
-                    let _ = child.kill();
-                    break;
-                }
-                consume_rg_line(&raw, req.search_dir, &mut parsed);
-            }
+            Ok(size) => size,
             Err(_) => {
-                let _ = child.kill();
-                return None;
+                stop_and_reap(&mut child, &mut ownership).await?;
+                return Ok(None);
             }
+        };
+        total = total.saturating_add(size);
+        if total > RG_STDOUT_CAP {
+            capped = true;
+            stop_and_reap(&mut child, &mut ownership).await?;
+            break;
         }
+        let mut scan_from = raw.len();
+        raw.extend_from_slice(&chunk[..size]);
+        let mut consumed = 0;
+        while let Some(newline) = raw[scan_from..].iter().position(|byte| *byte == b'\n') {
+            let end = scan_from + newline;
+            consume_rg_line(
+                &String::from_utf8_lossy(&raw[consumed..end]),
+                req.search_dir,
+                &mut parsed,
+            );
+            consumed = end + 1;
+            scan_from = consumed;
+        }
+        raw.drain(..consumed);
     }
-    let status = child.wait().ok()?;
-    // 0 = matches, 1 = no matches. Anything else is an rg failure: fall back.
-    if !status.success() && status.code() != Some(1) {
-        return None;
+    if !raw.is_empty() && !capped {
+        consume_rg_line(&String::from_utf8_lossy(&raw), req.search_dir, &mut parsed);
     }
+    if !capped {
+        let status = tokio::select! {
+            biased;
+            _ = req.cancellation.cancelled() => {
+                stop_and_reap(&mut child, &mut ownership).await?;
+                return Err(super::cancel::Cancelled.into());
+            },
+            status = child.wait() => match status {
+                Ok(status) => status,
+                Err(error) => {
+                    stop_and_reap(&mut child, &mut ownership).await?;
+                    return Err(rg_lifecycle_error(error));
+                }
+            },
+        };
+        // 0 = matches, 1 = no matches. A broken rg still falls back; Stop does not.
+        if !status.success() && status.code() != Some(1) {
+            return Ok(None);
+        }
+    }
+    req.cancellation.check()?;
+    Ok(Some(build_result(req, parsed, capped)?))
+}
 
-    Some(build_result(req, parsed, capped))
+fn rg_lifecycle_error(error: std::io::Error) -> (String, String) {
+    (
+        "INTERNAL".into(),
+        format!("rg process lifecycle failed: {error}"),
+    )
+}
+
+async fn stop_and_reap(
+    child: &mut Child,
+    ownership: &mut ProcessOwnership,
+) -> Result<(), (String, String)> {
+    let termination_error = child
+        .id()
+        .and_then(|pid| ownership.terminate_fail_closed(pid).err());
+    if termination_error.is_some() {
+        // Best-effort root kill after the ownership fallback, but do not hide
+        // a failure to terminate the complete process tree.
+        let _ = child.start_kill();
+    }
+    // Even after a termination error, reap before releasing tool admission.
+    child.wait().await.map_err(rg_lifecycle_error)?;
+    match termination_error {
+        Some(error) => Err(("INTERNAL".into(), format!("rg termination failed: {error}"))),
+        None => Ok(()),
+    }
 }
 
 struct FileHits {
@@ -218,9 +313,11 @@ fn build_result(
     req: SystemGrep<'_>,
     parsed: BTreeMap<PathBuf, FileHits>,
     stdout_capped: bool,
-) -> Value {
+) -> Result<Value, (String, String)> {
+    req.cancellation.check()?;
     let mut files: Vec<(PathBuf, FileHits)> = parsed.into_iter().collect();
     files.sort_by(|a, b| b.1.mtime.cmp(&a.1.mtime).then_with(|| a.0.cmp(&b.0)));
+    req.cancellation.check()?;
 
     let mut hits: Vec<Value> = Vec::new();
     let mut counts: Vec<Value> = Vec::new();
@@ -231,6 +328,7 @@ fn build_result(
     let mut truncated = stdout_capped;
 
     'files: for (path, file) in files {
+        req.cancellation.check()?;
         let shown = display_tool_path(req.root_kind, req.workspace_root, &path);
         let file_matches = file.lines.len();
         if file_matches == 0 {
@@ -239,6 +337,7 @@ fn build_result(
         match req.mode {
             "content" => {
                 for (line_no, text, clipped) in file.lines {
+                    req.cancellation.check()?;
                     if clipped {
                         clipped_lines += 1;
                     }
@@ -276,7 +375,8 @@ fn build_result(
         }
     }
 
-    grep_output(
+    req.cancellation.check()?;
+    Ok(grep_output(
         req.mode,
         hits,
         counts,
@@ -284,7 +384,7 @@ fn build_result(
         total_matches,
         clipped_lines,
         truncated,
-    )
+    ))
 }
 
 #[cfg(test)]
diff --git a/crates/host-core/src/tools/hashline/mod.rs b/crates/host-core/src/tools/hashline/mod.rs
index 3fecc82f2e..2b19b4b039 100644
--- a/crates/host-core/src/tools/hashline/mod.rs
+++ b/crates/host-core/src/tools/hashline/mod.rs
@@ -19,6 +19,7 @@ pub use tag::{
 
 use serde_json::{json, Map, Value};
 use std::collections::BTreeSet;
+use std::io::Read;
 use std::path::Path;
 
 pub struct HashlineContext<'a> {
@@ -131,13 +132,29 @@ pub fn record_grep_file(
     canonical_path: &Path,
     display_path: &str,
     matched_lines: Option<&[u64]>,
-) -> Option<(String, String)> {
-    let bytes = std::fs::read(canonical_path).ok()?;
-    if looks_binary_bytes(&bytes) {
-        return None;
+    cancellation: &super::cancel::ToolCancellation,
+) -> Result<Option<(String, String)>, super::cancel::Cancelled> {
+    cancellation.check()?;
+    let Ok(mut reader) = std::fs::File::open(canonical_path) else {
+        return Ok(None);
+    };
+    let mut bytes = Vec::new();
+    let mut chunk = [0_u8; 64 * 1024];
+    loop {
+        cancellation.check()?;
+        match reader.read(&mut chunk) {
+            Ok(0) => break,
+            Ok(size) => bytes.extend_from_slice(&chunk[..size]),
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => continue,
+            Err(_) => return Ok(None),
+        }
+    }
+    if tag::looks_binary_bytes_cancellable(&bytes, cancellation)? {
+        return Ok(None);
     }
-    let file = normalize_file(&bytes);
-    let tag = tag_of_lf_text(&file.text);
+    let file = tag::normalize_file_cancellable(&bytes, cancellation)?;
+    let tag = tag::tag_of_lf_text_cancellable(&file.text, cancellation)?;
+    cancellation.check()?;
     if let Some(ctx) = ctx {
         let seen = match matched_lines {
             Some(lines) => Some(lines.iter().map(|n| *n as u32).collect()),
@@ -151,7 +168,7 @@ pub fn record_grep_file(
             seen,
         );
     }
-    Some((display_path.to_string(), tag))
+    Ok(Some((display_path.to_string(), tag)))
 }
 
 pub fn attach_tags(mut out: Value, tags: Map<String, Value>) -> Value {
diff --git a/crates/host-core/src/tools/hashline/tag.rs b/crates/host-core/src/tools/hashline/tag.rs
index afeb763a2f..fdd5a145ad 100644
--- a/crates/host-core/src/tools/hashline/tag.rs
+++ b/crates/host-core/src/tools/hashline/tag.rs
@@ -2,7 +2,36 @@
 //!
 //! `tag(text) = uppercase_hex_4(low_16_bits(SHA-256(normalize_for_hash(text))))`.
 
+use crate::tools::cancel::{Cancelled, ToolCancellation};
 use sha2::{Digest, Sha256};
+use std::convert::Infallible;
+
+const CHECK_CHUNK: usize = 64 * 1024;
+
+fn unchecked<T>(result: Result<T, Infallible>) -> T {
+    match result {
+        Ok(value) => value,
+        Err(never) => match never {},
+    }
+}
+
+fn text_chunks<E>(
+    text: &str,
+    check: &mut impl FnMut() -> Result<(), E>,
+    mut consume: impl FnMut(&str),
+) -> Result<(), E> {
+    let mut start = 0;
+    while start < text.len() {
+        check()?;
+        let mut end = (start + CHECK_CHUNK).min(text.len());
+        while !text.is_char_boundary(end) {
+            end -= 1;
+        }
+        consume(&text[start..end]);
+        start = end;
+    }
+    check()
+}
 
 const UTF8_BOM: &[u8] = &[0xEF, 0xBB, 0xBF];
 const UTF16LE_BOM: &[u8] = &[0xFF, 0xFE];
@@ -35,40 +64,108 @@ pub struct NormalizedFile {
     pub utf16: Option<bool>,
 }
 
-pub fn decode_bytes(bytes: &[u8]) -> (bool, String) {
+fn decode_bytes_checked<E>(
+    bytes: &[u8],
+    check: &mut impl FnMut() -> Result<(), E>,
+) -> Result<(bool, String), E> {
+    check()?;
     if bytes.starts_with(UTF16LE_BOM) || bytes.starts_with(UTF16BE_BOM) {
         let little_endian = bytes.starts_with(UTF16LE_BOM);
         let body = &bytes[2..];
-        let units = body.chunks_exact(2).map(|pair| {
+        let units = body.as_chunks::<2>().0.iter().map(|pair| {
             if little_endian {
                 u16::from_le_bytes([pair[0], pair[1]])
             } else {
                 u16::from_be_bytes([pair[0], pair[1]])
             }
         });
-        return (false, String::from_utf16_lossy(&units.collect::<Vec<_>>()));
+        let mut decoded = String::new();
+        for (index, character) in std::char::decode_utf16(units).enumerate() {
+            if index % (CHECK_CHUNK / 4) == 0 {
+                check()?;
+            }
+            decoded.push(character.unwrap_or(char::REPLACEMENT_CHARACTER));
+        }
+        check()?;
+        return Ok((false, decoded));
     }
     let bom = bytes.starts_with(UTF8_BOM);
     let rest = if bom { &bytes[3..] } else { bytes };
-    (bom, String::from_utf8_lossy(rest).into_owned())
+    let mut decoded = String::new();
+    let mut start = 0;
+    while start < rest.len() {
+        check()?;
+        let mut end = (start + CHECK_CHUNK).min(rest.len());
+        if end < rest.len() {
+            // Keep an incomplete UTF-8 suffix for the next chunk, including
+            // when an earlier invalid sequence requires lossy decoding.
+            for tail in end.saturating_sub(3).max(start)..end {
+                if std::str::from_utf8(&rest[tail..end])
+                    .is_err_and(|error| error.valid_up_to() == 0 && error.error_len().is_none())
+                {
+                    end = tail;
+                    break;
+                }
+            }
+        }
+        decoded.push_str(&String::from_utf8_lossy(&rest[start..end]));
+        start = end;
+    }
+    check()?;
+    Ok((bom, decoded))
 }
 
-pub fn detect_ending(text: &str) -> LineEnding {
-    let crlf = text.matches("\r\n").count();
-    let lf_only = text.matches('\n').count().saturating_sub(crlf);
-    if crlf > lf_only {
+fn detect_ending_checked<E>(
+    text: &str,
+    check: &mut impl FnMut() -> Result<(), E>,
+) -> Result<LineEnding, E> {
+    let (mut crlf, mut lf, mut previous_cr) = (0_usize, 0_usize, false);
+    text_chunks(text, check, |chunk| {
+        for byte in chunk.bytes() {
+            if byte == b'\n' {
+                lf += 1;
+                crlf += usize::from(previous_cr);
+            }
+            previous_cr = byte == b'\r';
+        }
+    })?;
+    Ok(if crlf > lf.saturating_sub(crlf) {
         LineEnding::Crlf
     } else {
         LineEnding::Lf
-    }
+    })
 }
 
-pub fn to_lf(text: &str) -> String {
-    text.replace("\r\n", "\n").replace('\r', "\n")
+fn to_lf_checked<E>(text: &str, check: &mut impl FnMut() -> Result<(), E>) -> Result<String, E> {
+    let mut out = String::new();
+    let mut previous_cr = false;
+    text_chunks(text, check, |chunk| {
+        for character in chunk.chars() {
+            if !(previous_cr && character == '\n') {
+                out.push(if character == '\r' { '\n' } else { character });
+            }
+            previous_cr = character == '\r';
+        }
+    })?;
+    Ok(out)
 }
 
 pub fn normalize_file(bytes: &[u8]) -> NormalizedFile {
-    let (bom, decoded) = decode_bytes(bytes);
+    unchecked(normalize_file_checked(bytes, &mut || Ok(())))
+}
+
+pub(super) fn normalize_file_cancellable(
+    bytes: &[u8],
+    cancellation: &ToolCancellation,
+) -> Result<NormalizedFile, Cancelled> {
+    normalize_file_checked(bytes, &mut || cancellation.check())
+}
+
+fn normalize_file_checked<E>(
+    bytes: &[u8],
+    check: &mut impl FnMut() -> Result<(), E>,
+) -> Result<NormalizedFile, E> {
+    let (bom, decoded) = decode_bytes_checked(bytes, check)?;
     let utf16 = if bytes.starts_with(UTF16LE_BOM) {
         Some(true)
     } else if bytes.starts_with(UTF16BE_BOM) {
@@ -76,13 +173,13 @@ pub fn normalize_file(bytes: &[u8]) -> NormalizedFile {
     } else {
         None
     };
-    let ending = detect_ending(&decoded);
-    NormalizedFile {
-        text: to_lf(&decoded),
+    let ending = detect_ending_checked(&decoded, check)?;
+    Ok(NormalizedFile {
+        text: to_lf_checked(&decoded, check)?,
         ending,
         bom,
         utf16,
-    }
+    })
 }
 
 pub fn split_lines(text: &str) -> Vec<String> {
@@ -111,42 +208,66 @@ pub fn join_lines(lines: &[String], trailing_newline: bool) -> String {
     out
 }
 
-fn rtrim_hash_line(line: &str) -> &str {
-    line.trim_end_matches([' ', '\t', '\r'])
-}
-
 /// Hash input: each line with trailing `[ \t\r]` stripped, joined by LF.
 pub fn hash_input(lf_text: &str) -> String {
-    if lf_text.is_empty() {
-        return String::new();
-    }
-    let ends_with_nl = lf_text.ends_with('\n');
-    let mut out = String::with_capacity(lf_text.len());
-    for (i, line) in lf_text.split('\n').enumerate() {
-        if i > 0 {
-            out.push('\n');
+    unchecked(hash_input_checked(lf_text, &mut || Ok(())))
+}
+
+fn hash_input_checked<E>(
+    lf_text: &str,
+    check: &mut impl FnMut() -> Result<(), E>,
+) -> Result<String, E> {
+    let mut out = String::new();
+    let mut kept = 0;
+    text_chunks(lf_text, check, |chunk| {
+        for character in chunk.chars() {
+            if character == '\n' {
+                out.truncate(kept);
+                out.push('\n');
+                kept = out.len();
+            } else {
+                out.push(character);
+                if !matches!(character, ' ' | '\t' | '\r') {
+                    kept = out.len();
+                }
+            }
         }
-        out.push_str(rtrim_hash_line(line));
-    }
-    if !ends_with_nl && out.ends_with('\n') {
-        // split on a non-terminated string never yields a trailing empty
-        // piece, so this only fires for the empty-last-line case which
-        // already ended with `\n`. Keep the terminator from split.
-    }
-    let _ = ends_with_nl;
-    out
+    })?;
+    out.truncate(kept);
+    Ok(out)
 }
 
 pub fn tag_of_hash_input(hash_input: &str) -> String {
-    let digest = Sha256::digest(hash_input.as_bytes());
+    unchecked(tag_of_hash_input_checked(hash_input, &mut || Ok(())))
+}
+
+fn tag_of_hash_input_checked<E>(
+    hash_input: &str,
+    check: &mut impl FnMut() -> Result<(), E>,
+) -> Result<String, E> {
+    let mut hasher = Sha256::new();
+    for chunk in hash_input.as_bytes().chunks(CHECK_CHUNK) {
+        check()?;
+        hasher.update(chunk);
+    }
+    check()?;
+    let digest = hasher.finalize();
     let low = u16::from_be_bytes([digest[30], digest[31]]);
-    format!("{low:04X}")
+    Ok(format!("{low:04X}"))
 }
 
 pub fn tag_of_lf_text(lf_text: &str) -> String {
     tag_of_hash_input(&hash_input(lf_text))
 }
 
+pub(super) fn tag_of_lf_text_cancellable(
+    lf_text: &str,
+    cancellation: &ToolCancellation,
+) -> Result<String, Cancelled> {
+    let mut check = || cancellation.check();
+    tag_of_hash_input_checked(&hash_input_checked(lf_text, &mut check)?, &mut check)
+}
+
 pub fn encode_bytes(lf_text: &str, ending: LineEnding, bom: bool, utf16: Option<bool>) -> Vec<u8> {
     let body = match ending {
         LineEnding::Lf => lf_text.to_string(),
@@ -177,28 +298,56 @@ pub fn encode_bytes(lf_text: &str, ending: LineEnding, bom: bool, utf16: Option<
 }
 
 pub fn looks_binary_bytes(bytes: &[u8]) -> bool {
+    unchecked(looks_binary_bytes_checked(bytes, &mut || Ok(())))
+}
+
+pub(super) fn looks_binary_bytes_cancellable(
+    bytes: &[u8],
+    cancellation: &ToolCancellation,
+) -> Result<bool, Cancelled> {
+    looks_binary_bytes_checked(bytes, &mut || cancellation.check())
+}
+
+fn looks_binary_bytes_checked<E>(
+    bytes: &[u8],
+    check: &mut impl FnMut() -> Result<(), E>,
+) -> Result<bool, E> {
+    check()?;
     if bytes.starts_with(UTF16LE_BOM) || bytes.starts_with(UTF16BE_BOM) {
         let little_endian = bytes.starts_with(UTF16LE_BOM);
         let body = &bytes[2..];
-        return !body.len().is_multiple_of(2)
-            || std::char::decode_utf16(body.chunks_exact(2).map(|pair| {
+        if !body.len().is_multiple_of(2) {
+            return Ok(true);
+        }
+        for (index, character) in
+            std::char::decode_utf16(body.as_chunks::<2>().0.iter().map(|pair| {
                 if little_endian {
                     u16::from_le_bytes([pair[0], pair[1]])
                 } else {
                     u16::from_be_bytes([pair[0], pair[1]])
                 }
             }))
-            .any(|character| character.is_err() || character.is_ok_and(|c| c == '\0'));
+            .enumerate()
+        {
+            if index % (CHECK_CHUNK / 4) == 0 {
+                check()?;
+            }
+            if character.is_err() || character.is_ok_and(|c| c == '\0') {
+                return Ok(true);
+            }
+        }
+        check()?;
+        return Ok(false);
     }
     let sample = &bytes[..bytes.len().min(4096)];
     if sample.contains(&0) {
-        return true;
+        return Ok(true);
     }
     let non_printable = sample
         .iter()
         .filter(|byte| **byte < 9 || (**byte > 13 && **byte < 32))
         .count();
-    non_printable * 10 > sample.len() * 3
+    Ok(non_printable * 10 > sample.len() * 3)
 }
 
 pub fn section_header(path: &str, tag: &str) -> String {
@@ -308,3 +457,126 @@ mod tests {
         assert_eq!(strip_write_markup("plain\ntext\n"), "plain\ntext\n");
     }
 }
+
+#[cfg(test)]
+mod cancellation_tests {
+    use super::*;
+
+    #[test]
+    fn every_large_tag_transformation_observes_cancellation() {
+        let text = "x \t\r\n".repeat(CHECK_CHUNK);
+        assert_eq!(
+            decode_bytes_checked(text.as_bytes(), &mut || ToolCancellation::cancel_after(0)
+                .check()),
+            Err(Cancelled)
+        );
+        let cancel = ToolCancellation::cancel_after(2);
+        assert_eq!(
+            normalize_file_cancellable(text.as_bytes(), &cancel),
+            Err(Cancelled)
+        );
+        let cancel = ToolCancellation::cancel_after(2);
+        assert_eq!(
+            detect_ending_checked(&text, &mut || cancel.check()),
+            Err(Cancelled)
+        );
+        let cancel = ToolCancellation::cancel_after(2);
+        assert_eq!(to_lf_checked(&text, &mut || cancel.check()), Err(Cancelled));
+        let cancel = ToolCancellation::cancel_after(2);
+        assert_eq!(
+            hash_input_checked(&text, &mut || cancel.check()),
+            Err(Cancelled)
+        );
+        let cancel = ToolCancellation::cancel_after(2);
+        assert_eq!(
+            tag_of_hash_input_checked(&text, &mut || cancel.check()),
+            Err(Cancelled)
+        );
+        let utf16 = encode_bytes(&text, LineEnding::Lf, false, Some(true));
+        let cancel = ToolCancellation::cancel_after(2);
+        assert_eq!(
+            looks_binary_bytes_cancellable(&utf16, &cancel),
+            Err(Cancelled)
+        );
+    }
+
+    #[test]
+    fn chunked_tags_match_the_original_algorithm_at_encoding_boundaries() {
+        for padding in CHECK_CHUNK - 4..CHECK_CHUNK + 4 {
+            let text = format!("{}é😀\r\nnext \t\rline\n  ", "x".repeat(padding));
+            let mut samples = vec![
+                text.as_bytes().to_vec(),
+                [UTF8_BOM, text.as_bytes()].concat(),
+            ];
+            let mut lossy = text.as_bytes().to_vec();
+            lossy.insert(4, 0xFF);
+            lossy.extend_from_slice(&[0xE2, 0x82]);
+            samples.push(lossy);
+            for little_endian in [true, false] {
+                samples.push(encode_bytes(
+                    &text,
+                    LineEnding::Lf,
+                    false,
+                    Some(little_endian),
+                ));
+            }
+            for bytes in samples {
+                let (bom, utf16, decoded) =
+                    if bytes.starts_with(UTF16LE_BOM) || bytes.starts_with(UTF16BE_BOM) {
+                        let little = bytes.starts_with(UTF16LE_BOM);
+                        let units: Vec<_> = bytes[2..]
+                            .as_chunks::<2>()
+                            .0
+                            .iter()
+                            .map(|p| {
+                                if little {
+                                    u16::from_le_bytes([p[0], p[1]])
+                                } else {
+                                    u16::from_be_bytes([p[0], p[1]])
+                                }
+                            })
+                            .collect();
+                        (false, Some(little), String::from_utf16_lossy(&units))
+                    } else {
+                        let bom = bytes.starts_with(UTF8_BOM);
+                        (
+                            bom,
+                            None,
+                            String::from_utf8_lossy(if bom { &bytes[3..] } else { &bytes })
+                                .into_owned(),
+                        )
+                    };
+                let crlf = decoded.matches("\r\n").count();
+                let ending = if crlf > decoded.matches('\n').count() - crlf {
+                    LineEnding::Crlf
+                } else {
+                    LineEnding::Lf
+                };
+                let normalized = decoded.replace("\r\n", "\n").replace('\r', "\n");
+                let file = normalize_file(&bytes);
+                assert!(
+                    file == NormalizedFile {
+                        text: normalized.clone(),
+                        ending,
+                        bom,
+                        utf16
+                    },
+                    "normalization changed at {padding}"
+                );
+                let hash_input = normalized
+                    .split('\n')
+                    .map(|line| line.trim_end_matches([' ', '\t', '\r']))
+                    .collect::<Vec<_>>()
+                    .join("\n");
+                let digest = Sha256::digest(hash_input.as_bytes());
+                let expected = format!("{:04X}", u16::from_be_bytes([digest[30], digest[31]]));
+                assert_eq!(tag_of_lf_text(&file.text), expected);
+                assert_eq!(
+                    tag_of_lf_text_cancellable(&file.text, &ToolCancellation::from_receiver(None))
+                        .unwrap(),
+                    expected
+                );
+            }
+        }
+    }
+}
diff --git a/crates/host-core/src/tools/mod.rs b/crates/host-core/src/tools/mod.rs
index f01a6381dd..091dc2a85e 100644
--- a/crates/host-core/src/tools/mod.rs
+++ b/crates/host-core/src/tools/mod.rs
@@ -21,11 +21,16 @@ use tokio::sync::{mpsc, watch};
 
 use crate::workspace::{resolve_tool_path_with_external, simple_canonicalize, ToolRoot};
 
+pub mod cancel;
 mod grep_rg;
 pub mod hashline;
 pub mod ignore_rules;
 pub mod shell;
 
+#[cfg(test)]
+mod search_cancellation_tests;
+
+use cancel::ToolCancellation;
 pub use hashline::{HashlineContext, HashlineStore};
 
 /// Ceiling on what the streaming capture retains per stream.
@@ -862,6 +867,7 @@ pub struct ToolExecutionOptions<'a> {
     pub bash_options: Option<BashExecutionOptions>,
     pub allow_external_paths: bool,
     pub hashline: Option<HashlineContext<'a>>,
+    pub cancellation: Option<watch::Receiver<bool>>,
 }
 
 pub fn validate_timeout_ms(timeout_ms: Option<u64>) -> Result<(), (String, String)> {
@@ -908,17 +914,24 @@ struct ScannedLine {
 /// that is precisely the file shape the agent hits most often.
 struct LineReader<R: BufRead> {
     reader: R,
+    cancellation: Option<ToolCancellation>,
 }
 
 impl LineReader<BufReader<File>> {
     fn open(path: &Path) -> std::io::Result<Self> {
         Ok(Self {
             reader: BufReader::with_capacity(64 * 1024, File::open(path)?),
+            cancellation: None,
         })
     }
 }
 
 impl<R: BufRead> LineReader<R> {
+    fn with_cancellation(mut self, cancellation: &ToolCancellation) -> Self {
+        self.cancellation = Some(cancellation.clone());
+        self
+    }
+
     /// Peek the buffered head of the stream and decide whether it is binary,
     /// without consuming anything. Cheaper than a second open, and it keeps
     /// Grep from matching lossy garbage inside object files.
@@ -952,6 +965,11 @@ impl<R: BufRead> LineReader<R> {
         let mut clipped = false;
         let mut saw_input = false;
         loop {
+            if let Some(cancellation) = &self.cancellation {
+                cancellation
+                    .check()
+                    .map_err(|error| io::Error::new(ErrorKind::Interrupted, error))?;
+            }
             let chunk = match self.reader.fill_buf() {
                 Ok(chunk) => chunk,
                 Err(error) if error.kind() == ErrorKind::Interrupted => continue,
@@ -1110,6 +1128,7 @@ pub async fn execute_tool_with_options(
             bash_options,
             allow_external_paths: false,
             hashline: None,
+            cancellation: None,
         },
     )
     .await
@@ -1124,6 +1143,7 @@ async fn run_file_tool(
     args: &Value,
     allow_external_paths: bool,
     hashline: Option<&HashlineContext<'_>>,
+    cancellation: ToolCancellation,
 ) -> Result<Value, hashline::ToolError> {
     let workspace = workspace.map(Path::to_path_buf);
     let scratch = scratch.map(Path::to_path_buf);
@@ -1144,12 +1164,31 @@ async fn run_file_tool(
         let (workspace, scratch, hashline) =
             (workspace.as_deref(), scratch.as_deref(), hashline.as_ref());
         let args = &args;
+        if matches!(tool_name.as_str(), "Grep" | "Glob") {
+            cancellation
+                .check()
+                .map_err(|error| hashline::ToolError::from(<(String, String)>::from(error)))?;
+        }
         match tool_name.as_str() {
             "Read" => tool_read(workspace, scratch, args, allow_external_paths, hashline)
                 .map_err(Into::into),
-            "Glob" => tool_glob(workspace, scratch, args, allow_external_paths).map_err(Into::into),
-            "Grep" => tool_grep(workspace, scratch, args, allow_external_paths, hashline)
-                .map_err(Into::into),
+            "Glob" => tool_glob(
+                workspace,
+                scratch,
+                args,
+                allow_external_paths,
+                &cancellation,
+            )
+            .map_err(Into::into),
+            "Grep" => tool_grep(
+                workspace,
+                scratch,
+                args,
+                allow_external_paths,
+                hashline,
+                &cancellation,
+            )
+            .map_err(Into::into),
             "Write" => tool_write(workspace, scratch, args, allow_external_paths, hashline)
                 .map_err(Into::into),
             // "Edit": the caller routes only these five file tools here.
@@ -1174,6 +1213,7 @@ pub async fn execute_tool_with_path_access(
         bash_options,
         allow_external_paths,
         hashline,
+        cancellation,
     } = options;
     let started = Instant::now();
     let timeout_ms = effective_timeout_ms(tool_name, requested_timeout_ms);
@@ -1204,6 +1244,7 @@ pub async fn execute_tool_with_path_access(
                 args,
                 allow_external_paths,
                 hashline.as_ref(),
+                ToolCancellation::from_receiver(cancellation),
             )
             .await
         }
@@ -1874,19 +1915,21 @@ fn candidate_files(
     scoped: bool,
     include: Option<&globset::GlobSet>,
     max_files: usize,
-) -> (Vec<PathBuf>, bool) {
+    cancellation: &ToolCancellation,
+) -> Result<(Vec<PathBuf>, bool), (String, String)> {
+    cancellation.check()?;
     if search_root.is_file() {
         if ignore_rules::is_sensitive_path(search_root) {
-            return (Vec::new(), false);
+            return Ok((Vec::new(), false));
         }
         let relative = search_root
             .file_name()
             .map(Path::new)
             .unwrap_or(search_root);
         if include.is_some_and(|set| !glob_matches(set, relative)) {
-            return (Vec::new(), false);
+            return Ok((Vec::new(), false));
         }
-        return (vec![search_root.to_path_buf()], false);
+        return Ok((vec![search_root.to_path_buf()], false));
     }
 
     let mut walker = WalkBuilder::new(search_root);
@@ -1897,7 +1940,11 @@ fn candidate_files(
     ignore_rules::configure_walker(&mut walker, ignore_root, scoped);
     let mut candidates: Vec<(PathBuf, SystemTime)> = Vec::new();
     let mut capped = false;
-    for entry in walker.build().flatten() {
+    let mut entries = walker.build();
+    loop {
+        cancellation.check()?;
+        let Some(entry) = entries.next() else { break };
+        let Ok(entry) = entry else { continue };
         let path = entry.path();
         if !path.is_file() {
             continue;
@@ -1922,11 +1969,13 @@ fn candidate_files(
     // Most recently touched first: the file someone just edited is far more
     // likely to be the one the question is about than an alphabetically early
     // one, so a capped result keeps the useful half.
+    cancellation.check()?;
     candidates.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
-    (
+    cancellation.check()?;
+    Ok((
         candidates.into_iter().map(|(path, _)| path).collect(),
         capped,
-    )
+    ))
 }
 
 fn tool_glob(
@@ -1934,6 +1983,7 @@ fn tool_glob(
     scratch: Option<&Path>,
     args: &Value,
     allow_external_paths: bool,
+    cancellation: &ToolCancellation,
 ) -> Result<Value, (String, String)> {
     let root = require_workspace(workspace)?;
     let pattern = args
@@ -1966,10 +2016,12 @@ fn tool_glob(
         scoped,
         Some(&set),
         GLOB_MAX_LIMIT * 8,
-    );
+        cancellation,
+    )?;
     let mut matches: Vec<String> = Vec::new();
     let mut bytes = 0_usize;
     for path in &files {
+        cancellation.check()?;
         if matches.len() >= limit {
             truncated = true;
             break;
@@ -1993,6 +2045,7 @@ fn tool_glob(
             "more files match; raise limit (max {GLOB_MAX_LIMIT}) or narrow pattern/path. Results are ordered by modification time, newest first"
         ));
     }
+    cancellation.check()?;
     Ok(out)
 }
 
@@ -2002,6 +2055,7 @@ fn tool_grep(
     args: &Value,
     allow_external_paths: bool,
     hashline: Option<&HashlineContext<'_>>,
+    cancellation: &ToolCancellation,
 ) -> Result<Value, (String, String)> {
     let root = require_workspace(workspace)?;
     let pattern = args
@@ -2077,15 +2131,17 @@ fn tool_grep(
         mode,
         case_insensitive,
         head_limit,
-    }) {
-        return Ok(mint_grep_tags(
+        cancellation,
+    })? {
+        return mint_grep_tags(
             root,
             scratch,
             allow_external_paths,
             mode,
             value,
             hashline,
-        ));
+            cancellation,
+        );
     }
 
     let (files, mut truncated) = candidate_files(
@@ -2094,7 +2150,8 @@ fn tool_grep(
         scoped,
         include.as_ref(),
         GREP_MAX_CANDIDATE_FILES,
-    );
+        cancellation,
+    )?;
 
     let mut hits: Vec<Value> = Vec::new();
     let mut counts: Vec<Value> = Vec::new();
@@ -2103,9 +2160,11 @@ fn tool_grep(
     let mut clipped_lines = 0_usize;
     let mut bytes = 0_usize;
     'files: for path in &files {
-        let Ok(mut reader) = LineReader::open(path) else {
+        cancellation.check()?;
+        let Ok(reader) = LineReader::open(path) else {
             continue;
         };
+        let mut reader = reader.with_cancellation(cancellation);
         // Skipped rather than lossily decoded: a regex over mangled bytes
         // produces hits nobody can act on.
         if reader.looks_binary() {
@@ -2114,9 +2173,19 @@ fn tool_grep(
         let shown = display_tool_path(root_kind, root, path);
         let mut line_no = 0_usize;
         let mut file_matches = 0_usize;
-        // A read error mid-file is treated as end of file: partial matches from
-        // what was readable beat dropping the file entirely.
-        while let Ok(Some(line)) = reader.next_line(MAX_LINE_CHARS) {
+        // Ordinary read errors retain readable matches; cancellation is terminal.
+        loop {
+            let line = match reader.next_line(MAX_LINE_CHARS) {
+                Ok(Some(line)) => line,
+                Err(error)
+                    if error
+                        .get_ref()
+                        .is_some_and(|cause| cause.is::<cancel::Cancelled>()) =>
+                {
+                    return Err(cancel::Cancelled.into());
+                }
+                _ => break,
+            };
             line_no += 1;
             if !re.is_match(&line.text) {
                 continue;
@@ -2158,7 +2227,7 @@ fn tool_grep(
         }
     }
 
-    Ok(mint_grep_tags(
+    mint_grep_tags(
         root,
         scratch,
         allow_external_paths,
@@ -2173,7 +2242,8 @@ fn tool_grep(
             truncated,
         ),
         hashline,
-    ))
+        cancellation,
+    )
 }
 
 pub(super) fn grep_output(
@@ -2228,8 +2298,10 @@ fn mint_grep_tags(
     mode: &str,
     out: Value,
     hashline: Option<&HashlineContext<'_>>,
-) -> Value {
+    cancellation: &ToolCancellation,
+) -> Result<Value, (String, String)> {
     use std::collections::BTreeMap;
+    cancellation.check()?;
     let mut per_file: BTreeMap<String, Option<Vec<u64>>> = BTreeMap::new();
     match mode {
         "content" => {
@@ -2270,6 +2342,7 @@ fn mint_grep_tags(
     }
     let mut tags = serde_json::Map::new();
     for (display, lines) in per_file {
+        cancellation.check()?;
         let Ok((resolved, _)) =
             resolve_tool_path_with_external(root, scratch, &display, allow_external_paths)
         else {
@@ -2277,12 +2350,13 @@ fn mint_grep_tags(
         };
         let matched = lines.as_deref();
         if let Some((path, tag)) =
-            hashline::record_grep_file(hashline, &resolved, &display, matched)
+            hashline::record_grep_file(hashline, &resolved, &display, matched, cancellation)?
         {
             tags.insert(path, json!(tag));
         }
     }
-    hashline::attach_tags(out, tags)
+    cancellation.check()?;
+    Ok(hashline::attach_tags(out, tags))
 }
 
 #[derive(Debug, Clone, Copy)]
@@ -3963,6 +4037,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: true,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
@@ -4122,6 +4197,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: true,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
@@ -4145,6 +4221,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: true,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
@@ -4168,6 +4245,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: true,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
@@ -4195,6 +4273,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: true,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
@@ -4222,6 +4301,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: true,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
@@ -4243,6 +4323,7 @@ mod tests {
                 bash_options: None,
                 allow_external_paths: true,
                 hashline: None,
+                cancellation: None,
             },
         )
         .await;
diff --git a/crates/host-core/src/tools/search_cancellation_tests.rs b/crates/host-core/src/tools/search_cancellation_tests.rs
new file mode 100644
index 0000000000..19a83b735f
--- /dev/null
+++ b/crates/host-core/src/tools/search_cancellation_tests.rs
@@ -0,0 +1,310 @@
+use super::*;
+
+fn assert_aborted<T: std::fmt::Debug>(result: Result<T, (String, String)>) {
+    let (code, _) = result.expect_err("an interrupted search must not return partial success");
+    assert_eq!(code, "TOOL_ABORTED");
+}
+
+#[test]
+fn traversal_cancels_even_when_no_entry_matches_the_include() {
+    let dir = tempfile::tempdir().unwrap();
+    for index in 0..64 {
+        let nested = dir.path().join(format!("folder-{index}"));
+        std::fs::create_dir(&nested).unwrap();
+        std::fs::write(nested.join("source.txt"), "needle\n").unwrap();
+    }
+    let include = build_glob_set("*.rs").unwrap();
+    assert_aborted(candidate_files(
+        dir.path(),
+        dir.path(),
+        false,
+        Some(&include),
+        100,
+        &ToolCancellation::cancel_after(8),
+    ));
+}
+
+#[test]
+fn glob_cancels_during_traversal_instead_of_returning_empty_success() {
+    let dir = tempfile::tempdir().unwrap();
+    for index in 0..64 {
+        std::fs::create_dir(dir.path().join(format!("empty-{index}"))).unwrap();
+    }
+    assert_aborted(tool_glob(
+        Some(dir.path()),
+        None,
+        &json!({ "pattern": "*.rs" }),
+        false,
+        &ToolCancellation::cancel_after(8),
+    ));
+}
+
+#[test]
+fn giant_line_checks_cancellation_between_read_chunks() {
+    let content = vec![b'x'; 1024 * 1024];
+    let cancellation = ToolCancellation::cancel_after(4);
+    let mut reader = LineReader {
+        reader: BufReader::with_capacity(64, std::io::Cursor::new(content)),
+        cancellation: None,
+    }
+    .with_cancellation(&cancellation);
+    let error = match reader.next_line(MAX_LINE_CHARS) {
+        Err(error) => error,
+        Ok(_) => panic!("a giant line must stop before reaching its newline"),
+    };
+    assert!(error
+        .get_ref()
+        .is_some_and(|cause| cause.is::<cancel::Cancelled>()));
+}
+
+#[tokio::test]
+async fn grep_does_not_swallow_cancellation_as_an_unreadable_file() {
+    let dir = tempfile::tempdir().unwrap();
+    std::fs::write(dir.path().join("large.txt"), vec![b'x'; 4 * 1024 * 1024]).unwrap();
+    assert_aborted(tool_grep(
+        Some(dir.path()),
+        None,
+        &json!({ "path": "large.txt", "pattern": "x", "outputMode": "count" }),
+        false,
+        None,
+        &ToolCancellation::cancel_after(8),
+    ));
+}
+
+#[test]
+fn grep_tag_read_is_cancellable_before_publishing_a_snapshot() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("large.txt");
+    std::fs::write(&path, vec![b'x'; 4 * 1024 * 1024]).unwrap();
+    let store = HashlineStore::new();
+    let ctx = HashlineContext {
+        session_id: "cancelled-search",
+        store: &store,
+    };
+    let result = hashline::record_grep_file(
+        Some(&ctx),
+        &path,
+        "large.txt",
+        Some(&[1]),
+        &ToolCancellation::cancel_after(2),
+    );
+    assert_eq!(result, Err(cancel::Cancelled));
+    let tag = hashline::tag_of_lf_text(&"x".repeat(4 * 1024 * 1024));
+    assert!(store
+        .lookup_tag(ctx.session_id, &hashline::canonical_key(&path), &tag)
+        .is_none());
+}
+
+#[test]
+fn grep_tags_keep_encoding_newline_and_provenance_contracts() {
+    let dir = tempfile::tempdir().unwrap();
+    let text = "α😀\r\nb  \rc\t\n";
+    let mut samples = vec![
+        Vec::new(),
+        text.as_bytes().to_vec(),
+        [b"\xEF\xBB\xBF".as_slice(), text.as_bytes()].concat(),
+        b"lossy \xE2\x82\n".to_vec(),
+        format!("{}\r\nend\t", "x".repeat(64 * 1024 - 1)).into_bytes(),
+    ];
+    for little_endian in [true, false] {
+        let mut bytes = if little_endian {
+            vec![0xFF, 0xFE]
+        } else {
+            vec![0xFE, 0xFF]
+        };
+        for unit in text.encode_utf16() {
+            bytes.extend(if little_endian {
+                unit.to_le_bytes()
+            } else {
+                unit.to_be_bytes()
+            });
+        }
+        samples.push(bytes);
+    }
+    for (index, bytes) in samples.iter().enumerate() {
+        let path = dir.path().join(format!("encoding-{index}.txt"));
+        std::fs::write(&path, bytes).unwrap();
+        let expected = hashline::normalize_file(bytes);
+        let expected_tag = hashline::tag_of_lf_text(&expected.text);
+        let store = HashlineStore::new();
+        let ctx = HashlineContext {
+            session_id: "encoding-contract",
+            store: &store,
+        };
+        let result = hashline::record_grep_file(
+            Some(&ctx),
+            &path,
+            "fixture.txt",
+            Some(&[1]),
+            &ToolCancellation::from_receiver(None),
+        )
+        .unwrap()
+        .unwrap();
+        assert_eq!(result, ("fixture.txt".into(), expected_tag.clone()));
+        let snapshot = store
+            .lookup_tag(
+                ctx.session_id,
+                &hashline::canonical_key(&path),
+                &expected_tag,
+            )
+            .unwrap();
+        assert_eq!(snapshot.text, expected.text);
+        assert_eq!(snapshot.seen_lines, Some([1].into_iter().collect()));
+    }
+}
+
+/// Invoked only by the fake rg wrapper in a separate test process. A socket
+/// handshake, not a sleep, holds the child open until Stop or the stdout cap.
+#[test]
+fn rg_process_fixture() {
+    use std::io::{Read, Write};
+    let Ok(address) = std::env::var("PI_DESKTOP_SEARCH_TEST_SOCKET") else {
+        return;
+    };
+    let mut socket = std::net::TcpStream::connect(address).unwrap();
+    writeln!(socket, "{}", std::process::id()).unwrap();
+    let mut mode = [0];
+    socket.read_exact(&mut mode).unwrap();
+    socket.write_all(b"R").unwrap();
+    match mode[0] {
+        b'c' => {
+            let mut stdout = std::io::stdout().lock();
+            for _ in 0..140 {
+                if stdout.write_all(&[b'x'; 64 * 1024]).is_err() {
+                    break;
+                }
+            }
+            let _ = stdout.flush();
+        }
+        b'n' => std::process::exit(1),
+        b'f' => std::process::exit(2),
+        _ => {}
+    }
+    // Cancellation/capping must terminate the process while this read and its
+    // stdout remain open. Dropping the test socket also cleans up on failure.
+    let _ = socket.read_exact(&mut mode);
+}
+
+async fn assert_rg_fixture_settles(mode: u8, abort: bool) {
+    use tokio::io::{AsyncBufReadExt, AsyncWriteExt};
+    let workspace = tempfile::tempdir().unwrap();
+    std::fs::write(workspace.path().join("source.txt"), "needle\n").unwrap();
+    let fake = tempfile::tempdir().unwrap();
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let address = listener.local_addr().unwrap();
+    let executable = std::env::current_exe().unwrap();
+    #[cfg(windows)]
+    let rg = {
+        let path = fake.path().join("rg.cmd");
+        std::fs::write(&path, format!("@echo off\r\nset \"PI_DESKTOP_SEARCH_TEST_SOCKET={address}\"\r\n\"{}\" --exact tools::search_cancellation_tests::rg_process_fixture --nocapture\r\nexit /b %errorlevel%\r\n", executable.display())).unwrap();
+        path
+    };
+    #[cfg(not(windows))]
+    let rg = {
+        use std::os::unix::fs::PermissionsExt;
+        let path = fake.path().join("rg");
+        let escaped = executable.to_string_lossy().replace('\'', "'\\''");
+        std::fs::write(&path, format!("#!/bin/sh\nexport PI_DESKTOP_SEARCH_TEST_SOCKET='{address}'\nexec '{escaped}' --exact tools::search_cancellation_tests::rg_process_fixture --nocapture\n")).unwrap();
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o755)).unwrap();
+        path
+    };
+    let guard = grep_rg::install_test_rg(rg);
+    let (sender, receiver) = watch::channel(false);
+    let root = workspace.path().to_path_buf();
+    let search = tokio::spawn(async move {
+        execute_tool_with_path_access(
+            Some(&root),
+            None,
+            "Grep",
+            &json!({ "pattern": "needle" }),
+            ToolExecutionOptions {
+                timeout_ms: None,
+                bash_options: None,
+                allow_external_paths: false,
+                hashline: None,
+                cancellation: Some(receiver),
+            },
+        )
+        .await
+    });
+    let (socket, _) = tokio::time::timeout(Duration::from_secs(10), listener.accept())
+        .await
+        .expect("rg did not start")
+        .unwrap();
+    let mut socket = tokio::io::BufReader::new(socket);
+    let mut pid = String::new();
+    socket.read_line(&mut pid).await.unwrap();
+    assert!(pid.trim().parse::<u32>().unwrap() > 0);
+    socket.get_mut().write_all(&[mode]).await.unwrap();
+    let mut ready = [0];
+    socket.read_exact(&mut ready).await.unwrap();
+    assert_eq!(ready, *b"R");
+    if abort {
+        assert!(
+            !search.is_finished(),
+            "quiet rg must still own the tool call"
+        );
+        sender.send(true).unwrap();
+        sender.send(true).unwrap();
+    }
+    let result = tokio::time::timeout(Duration::from_secs(10), search)
+        .await
+        .expect("search did not settle")
+        .unwrap();
+    let disconnected = tokio::time::timeout(Duration::from_secs(2), socket.read(&mut ready))
+        .await
+        .expect("child socket is still alive after tool settlement");
+    assert!(
+        matches!(disconnected, Ok(0))
+            || disconnected.is_err_and(|error| error.kind() == io::ErrorKind::ConnectionReset),
+        "child must have exited before tool settlement"
+    );
+    if abort {
+        assert_eq!(result.error_code.as_deref(), Some("TOOL_ABORTED"));
+        assert!(!result.ok, "Stop must not fall back to a successful scan");
+    } else {
+        assert!(result.ok, "{:?}", result.content);
+        match mode {
+            b'c' => {
+                assert_eq!(result.content["truncated"], true);
+                assert_eq!(result.content["count"], 0);
+            }
+            b'n' => assert_eq!(result.content["count"], 0, "rg exit 1 is not a fallback"),
+            b'f' => assert_eq!(
+                result.content["count"], 1,
+                "broken rg retains the normal fallback"
+            ),
+            _ => panic!("unsupported fixture mode"),
+        }
+    }
+    drop(guard);
+    let next = execute_tool(
+        Some(workspace.path()),
+        None,
+        "Grep",
+        &json!({ "pattern": "needle" }),
+        5_000,
+    )
+    .await;
+    assert!(
+        next.ok,
+        "a stopped/capped child must not poison the next call"
+    );
+    assert_eq!(next.content["count"], 1);
+}
+
+#[tokio::test]
+async fn quiet_rg_is_terminated_and_reaped_before_stop_settles() {
+    assert_rg_fixture_settles(b'q', true).await;
+}
+
+#[tokio::test]
+async fn rg_stdout_cap_terminates_and_reaps_a_child_without_newlines() {
+    assert_rg_fixture_settles(b'c', false).await;
+}
+
+#[tokio::test]
+async fn rg_exit_one_and_broken_install_keep_distinct_fallback_semantics() {
+    assert_rg_fixture_settles(b'n', false).await;
+    assert_rg_fixture_settles(b'f', false).await;
+}
diff --git a/docs/adr/tool-abort-abandons-host-call.md b/docs/adr/tool-abort-abandons-host-call.md
index b31d0c0904..67f26a3592 100644
--- a/docs/adr/tool-abort-abandons-host-call.md
+++ b/docs/adr/tool-abort-abandons-host-call.md
@@ -35,10 +35,10 @@ Three facts constrain the fix:
 
 The runtime sends typed `tools.abort` requests for in-flight tools. Host-core
 registers cancellation before permission evaluation, so stopping a pending
-approval or queued tool prevents it from starting. Local `Read`, `Glob`, and
-`Grep` calls may end the runtime's wait immediately because they are read-only;
-the host also observes cancellation and discards their result. The blocking
-filesystem worker may continue until it returns, but it cannot mutate files.
+approval or queued tool prevents it from starting. Local `Read` calls retain
+their existing immediate local-abandon policy. `Glob` and `Grep` instead use
+cooperative host cancellation and await their blocking worker and any owned
+search process termination/reaping before the runtime settles.
 
 For `Bash` and `GenerateImages`, the runtime waits a bounded 10s grace window
 for the host to return output collected before process termination. For
@@ -46,10 +46,12 @@ mutating, MCP, and plugin calls, the runtime waits for the host result after
 requesting cancellation. A pending permission is cancelled; an operation that
 already started is not reported as stopped until its result arrives.
 
-Read-only and process-backed tools race their execution against cancellation.
-For a read-only local filesystem call, the Rust blocking worker may outlive the
-RPC, but its result is discarded. Mutating and desktop-dispatched tools are not
-locally abandoned while active.
+`Read` and process-backed tools race their execution against cancellation.
+For a local `Read`, the blocking worker may outlive the RPC and its result is
+discarded. Searches, mutations, and desktop-dispatched tools are not locally
+abandoned while active. A remote search sends cancellation but keeps its relay
+ownership until remote completion or the existing transport failure deadline;
+a timeout/disconnection is observable failure, not confirmed Stop settlement.
 
 The runtime also drives the tools from `abort()` itself, not only from the
 signal each tool was handed. `abort()` walks the in-flight tool calls and runs
@@ -63,11 +65,12 @@ alive minutes later.
 
 ## Consequences
 
-- A long-running read-only tool no longer holds the turn open after Stop, while
-  pending permission prompts and admission waits are cancelled at the host.
-- Local filesystem workers and already-started extension operations may still
-  consume resources until they return. Mutating and extension results remain
-  observable before the runtime reports the turn settled.
+- Search Stop interrupts traversal, chunked reads, tag processing, and quiet
+  `rg` processes instead of leaving background search work behind. The local
+  admission permit remains owned until worker/process cleanup completes.
+- `Read` workers and already-started extension operations may still consume
+  resources until they return. Mutating and extension results remain observable
+  before the runtime reports the turn settled.
 - A new turn uses distinct tool call ids. Typed abort records also prevent an
   early abort for one tool name from being inherited by another tool.
 - Progress output for an abandoned call stops at the moment of the stop.
@@ -80,6 +83,6 @@ alive minutes later.
 - **Only arm a grace timer on abort (no race for cancellable tools).** Simpler,
   but leaves every non-cancellable tool waiting the full window and still keeps
   the turn blocked for that window.
-- **Wait for host-core to grow cancellation for every tool.** Correct durable
-  fix, tracked separately; it cannot ship as a bug fix for a turn that is stuck
-  today.
+- **Wait for host-core to grow cancellation for every tool.** The search
+  implementation now cooperatively cancels its owned work. Broader interruption
+  of mutating and extension operations remains outside this change.
diff --git a/docs/project/unreleased.md b/docs/project/unreleased.md
index da447d18c9..05d8e8eb86 100644
--- a/docs/project/unreleased.md
+++ b/docs/project/unreleased.md
@@ -4,3 +4,8 @@
   1.1.0 to 1.3.0. Preserve Desktop compatibility patches, omit foreign-model
   thinking from replay, reject malformed final tool JSON before execution, and
   expose the user-run discriminator to trusted extension startup handlers.
+- Reduce repeated timing scans in long tool-heavy turns and suspend invisible
+  transcript work without losing retained reading positions or disclosures.
+- Make Stop settle Grep/Glob traversal and owned search processes before a
+  follow-up starts, and prevent delayed history recovery from leaving sessions
+  running or overwriting newer turns and structured drafts.
diff --git a/docs/spec/03-runtime/03-tools-and-permissions.md b/docs/spec/03-runtime/03-tools-and-permissions.md
index 5cc4eddff2..7da09a242f 100644
--- a/docs/spec/03-runtime/03-tools-and-permissions.md
+++ b/docs/spec/03-runtime/03-tools-and-permissions.md
@@ -123,10 +123,10 @@ tool-abort-abandons-host-call). Host-core registers cancellation before
 permission evaluation, so a pending approval or queued admission is cancelled
 instead of starting after Stop. `Bash` and `GenerateImages` use the existing
 process cancellation path; the runtime waits up to 10s for the host to return
-output collected before termination. Local `Read`, `Glob`, and `Grep` calls may
-end the runtime's wait immediately and return `TOOL_ABORTED`; their results are
-discarded. A blocking filesystem worker may continue until it returns, but
-these tools do not mutate the workspace. For a mutating, MCP, or plugin call
+output collected before termination. Local `Read` calls may end the runtime's
+wait immediately and discard their late result. `Grep` and `Glob` instead await
+cooperative host cancellation and owned worker/process cleanup (§3.1). For a
+mutating, MCP, or plugin call
 that has already started, the runtime waits for the host result before it
 settles the turn, so Stop cannot hide a write or extension action that is still
 running. Typed cancellation records include the tool name and cannot be
@@ -137,6 +137,35 @@ execution tool. It validates its structured request, observes cancellation,
 uses a bounded provider timeout, and returns typed classifier results; it has
 no filesystem path or host-core workspace permission surface.
 
+### 3.1 Search cancellation and settlement
+
+`Grep` and `Glob` forward the turn's abort signal to the existing per-call host
+cancellation registry. Registration precedes permission evaluation, including
+external-path approval. An abort queued before registration is consumed by that
+call; repeated abort requests share the same terminal outcome and cannot poison
+a later call.
+
+Traversal checks cancellation for every entry, even skipped directories,
+unmatched files, and walk errors. In-process Grep also checks between read chunks
+of a giant line and while reading, decoding, normalizing, and hashing tag input.
+Cancellation returns `TOOL_ABORTED`, never partial success or an unreadable-file
+fallback. Existing ignore/security rules, path permissions, output budgets,
+encoding, tags, and provenance remain unchanged.
+
+The system `rg` backend observes abort while reading stdout or waiting for a
+quiet child. Stop and the stdout cap terminate the owned process tree and await
+child reaping before the tool settles. Cancellation is terminal; a missing or
+broken `rg` may still use the normal in-process fallback, and exit 1 still means
+no matches. Process cleanup failures remain observable.
+
+Local and remote workspace runners await the cancellation-aware search body,
+including its blocking-pool join. They must not drop that future and release
+admission while filesystem or child-process work is still running. The remote
+relay keeps its response ownership after sending cancellation; an existing
+transport timeout or disconnect remains an explicit failure, not confirmation
+that remote work stopped. Follow-up turns after a successful Stop require
+actual backend settlement, not a renderer-only idle state or enlarged timeout.
+
 ## 4. Path Rules
 
 Native file and search tools enforce distinct path shapes (D208, ADR 0069):
diff --git a/docs/spec/04-ux/09-interaction-patterns.md b/docs/spec/04-ux/09-interaction-patterns.md
index 47687e7783..5a739b1057 100644
--- a/docs/spec/04-ux/09-interaction-patterns.md
+++ b/docs/spec/04-ux/09-interaction-patterns.md
@@ -339,6 +339,13 @@ may be retained while exactly one workspace supplies the visible shell context.
   appended after the page, which would move the newest turn out of the mounted
   trailing window (D317 / D261 / D324). Live provenance is cleared only once
   that page already contains every live row.
+- Hidden retained panes pause elapsed-time clocks, streamed-text animation,
+  tool-output formatting, delegation projections, follow-scroll frames, and
+  transcript resize observation. Visibility is independent of folding: mounted
+  rows, nested scroll positions, reading bookmarks, and explicit disclosures
+  remain intact. Background events still update the session store. Revealing a
+  pane catches up to its latest stored text/output without a deferred-snapshot
+  rewind, then resumes visible work.
 - Switching to a session with no retained pane (cold) leaves the visible pane on
   its own session until the destination commits. Only a thin progress track and
   `aria-busy` mark the wait, the composer stays non-interactive so a prompt cannot
@@ -791,7 +798,8 @@ may be retained while exactly one workspace supplies the visible shell context.
 
 ### 3.2 Abort behavior
 
-1. Cancel the current agent turn immediately
+1. Request cancellation of the current agent turn immediately; await actual
+   backend settlement before clearing its running state or admitting a follow-up
 2. Cancel any pending permission request (per [03-permission-ux.md](03-permission-ux.md) §7)
 3. If no assistant text, thinking, or tool row has begun, remove the just-sent
    user row and restore its pre-serialization composer draft
@@ -801,13 +809,18 @@ may be retained while exactly one workspace supplies the visible shell context.
    with aborted status and restore no draft. Preserve the measured stream
    duration and use provider output usage when available; otherwise store a
    visibly estimated output count so the conversation still shows throughput
-6. Composer re-activates (unblocked)
-7. Abort is idempotent — pressing abort when already aborting does nothing
+6. Composer re-activates after confirmed backend settlement, before optional
+   history/draft recovery. Recovery failures remain visible but cannot leave a
+   settled turn marked running; an abort failure must not fabricate idle state
+7. Abort is idempotent — concurrent Stop actions share the pending operation.
+   Late history reads or cleanup cannot overwrite a newer turn, another
+   session's visible transcript, or a newly submitted structured draft
 
 ### 3.3 Abort UX
 
-- Abort button changes to "Aborting..." briefly (100ms), then disappears
-- No confirmation dialog for abort — it is always immediate
+- The abort action remains pending until backend settlement; there is no fixed
+  100ms completion guarantee and no optimistic idle transition
+- No confirmation dialog for abort — the cancellation request is immediate
 - A partial aborted message gets a muted "(aborted)" suffix. Only the
   unanswered smart-stop branch deletes its just-sent user row.
 
diff --git a/docs/spec/06-delivery/04-e2e-test-plan.md b/docs/spec/06-delivery/04-e2e-test-plan.md
index e7ebdf2cf8..3965183606 100644
--- a/docs/spec/06-delivery/04-e2e-test-plan.md
+++ b/docs/spec/06-delivery/04-e2e-test-plan.md
@@ -1935,19 +1935,19 @@ identify the platform validation still needed.
 
 - **Preconditions**: A session can produce both a deliberately delayed first
   token and a streaming response. A deterministic Host fixture can hold a
-  read-only `Grep` call and expose a pending `Write` approval.
+  `Read` call and expose a pending `Write` approval.
 - **Steps**: 1) Send ordinary text and click Stop immediately, including while
   the prompt is still being admitted. 2) Confirm the user row is undone and
   the text returns to the composer after that first Stop. 3) Send again, wait
   for partial output, then stop during the stream. 4) Immediately send a new
   prompt after Stop returns, without waiting for an idle delay. 5) Start a
-  read-only Grep that does not return, press Stop, then start another prompt.
+  Read that does not return, press Stop, then start another prompt.
   6) Start a Write that is waiting for permission, press Stop, then try to
   approve the stale request. 7) Observe the transcript, composer, and workspace.
 - **Expected**: The first Stop is honored even if prompt admission is still in
   progress; the unanswered send is undone and its draft restored. The
   streaming send stops with its partial response preserved and no draft
-  restoration or duplicate user turn. The read-only tool returns
+  restoration or duplicate user turn. Read returns
   `TOOL_ABORTED`, its late result is discarded, and the follow-up starts
   without `AGENT_BUSY`. Stopping the pending Write cancels its permission;
   approving the stale request fails and creates no file. A mutating operation
@@ -1962,6 +1962,33 @@ identify the platform validation still needed.
   in `crates/host-core/src/rpc/mod.rs`; rendered Electron interaction remains
   a manual validation run.
 
+#### E2E-STOP-search-settlement: Search Stop releases real work before follow-up
+
+- **Preconditions**: Isolated synthetic workspace, permission state, and child
+  process fixtures; no real provider, user profile, or running Desktop.
+- **Steps**: Abort Grep/Glob before registration, during external-path approval,
+  traversal with no matching entries, giant-line reads, and tag processing.
+  Abort a quiet fake `rg` twice, then run another search. Exercise newline-free
+  stdout capping, normal exit 1, and broken-install fallback separately. Delay
+  optional Stop history recovery, switch sessions or complete a newer turn,
+  and inject abort/recovery failures. Cancel a remote search while its completion
+  is held by a deterministic relay fixture, then deliver the final result.
+- **Expected**: Cancelled searches return `TOOL_ABORTED`; permission requests and
+  registry entries are cleaned. Tool settlement waits for the blocking search
+  body and owned child exit/reap. Stop never becomes a successful fallback or a
+  fake idle state. Later searches/turns remain usable, while late history cannot
+  overwrite newer rows or structured drafts. Security, ignore, output, encoding,
+  and tag/provenance contracts remain intact. Remote completion stays routable
+  after cancellation; the relay cannot release admission before it arrives.
+- **Automated coverage**: `session-stop-settlement.test.mjs`,
+  `native-pi-sessions.test.mjs`, `session-message-input.test.mjs`,
+  `packages/agent-runtime/src/runtime.test.ts`, host-core
+  `search_cancellation_tests`, `tools::cancel::tests`, remote search settlement,
+  and hashline tag cancellation/encoding-boundary tests. These are local unit/integration
+  fixtures, not a live-provider E2E or CPU/temperature measurement.
+- **Specs linked**: `03-runtime/03-tools-and-permissions.md` §3.1,
+  `04-ux/09-interaction-patterns.md` §3
+
 #### E2E-171: Streaming reply survives quit, crash, and stop
 
 - **Preconditions**: A session whose transcript is longer than one renderer
@@ -6137,6 +6164,23 @@ must keep splitting are covered by `markdown-blocks.test.mjs`.
   `node scripts/e2e-transcript-reading-position.mjs` (isolated React/Electron,
   fixture IPC); live UI scenario Draft.
 
+#### E2E-TRANSCRIPT-hidden-pane-work: Retained panes suspend invisible work
+
+- **Preconditions**: Isolated React/Electron transcript fixture with active
+  thinking/tools, assistant text, expanded disclosures, and nested scrolling.
+- **Steps**: Record visible clocks; hide the mounted pane, update stored text
+  and tool output, then reveal it. Repeat the transition and finally unmount.
+- **Expected**: Hidden panes schedule no recurring transcript clocks or
+  follow-scroll frames. They keep the same mounted output, nested scroll
+  positions, and manual disclosure choices. Reveal immediately catches up to
+  current stored content without later reverting to a deferred projection;
+  visible clocks resume and unmount clears timers/frames/observers.
+- **Status**: Automated by `node scripts/e2e-transcript-render.mjs` through
+  `scripts/e2e/transcript-hidden-pane.tsx`; no product main, provider, or user
+  profile is started. Synthetic timer/work counts are not thermal measurements.
+- **Specs linked**: `04-ux/09-interaction-patterns.md` §session navigation,
+  ADR 0137
+
 #### E2E-071h: Reopening a session while its response is streaming
 
 - **Preconditions**: Session A has a completed transcript and is producing a
diff --git a/packages/agent-runtime/src/runtime.test.ts b/packages/agent-runtime/src/runtime.test.ts
index cdc4c7cb05..df83fc58be 100644
--- a/packages/agent-runtime/src/runtime.test.ts
+++ b/packages/agent-runtime/src/runtime.test.ts
@@ -1851,8 +1851,8 @@ describe("DesktopAgentRuntime configuration matching", () => {
     await runtime.dispose();
   });
 
-  // #1767: a blocking read-only host call must not keep the user turn open.
-  it("ends the turn when a stop lands while a read-only core tool is still running", async () => {
+  // #1767: preserve the upstream bounded runtime wait for Read.
+  it("ends the turn when a stop lands while a Read call is still running", async () => {
     let finishExecution!: (value: { ok: boolean; content: unknown }) => void;
     const execution = new Promise<{ ok: boolean; content: unknown }>((resolve) => {
       finishExecution = resolve;
@@ -1863,24 +1863,24 @@ describe("DesktopAgentRuntime configuration matching", () => {
           ? execution
           : method === "tools.abort"
             ? Promise.resolve({ ok: true, found: true })
-            : Promise.resolve({ ok: true, content: "done" }),
+            : Promise.resolve(undefined),
       ),
       onNotification: vi.fn(() => () => undefined),
     };
     const runtime = createRuntime({ host });
-    const grep = runtimeTool(runtime, "Grep");
+    const read = runtimeTool(runtime, "Read");
     const controller = new AbortController();
-    const pending = grep.execute("grep-stop", { query: "needle" }, controller.signal);
+    const pending = read.execute("read-stop", { path: "file.txt" }, controller.signal);
     await new Promise<void>((resolve) => setImmediate(resolve));
 
     controller.abort();
 
-    // The Grep is still running in host-core; only this turn stops waiting.
+    // Read retains its upstream local-abandon policy; searches must settle.
     await expect(pending).rejects.toMatchObject({ errorCode: "TOOL_ABORTED" });
     expect(host.call).toHaveBeenCalledWith("tools.abort", {
       sessionId: "session-1",
-      toolCallId: "grep-stop",
-      toolName: "Grep",
+      toolCallId: "read-stop",
+      toolName: "Read",
     });
     // The orphaned call settling later must not resurface as an unhandled
     // rejection or a second tool result.
@@ -1927,22 +1927,22 @@ describe("DesktopAgentRuntime configuration matching", () => {
     }
   });
 
-  it("releases an in-flight tool when the stop lands without the tool signal firing", async () => {
+  it("releases an in-flight Read when the stop lands without the tool signal firing", async () => {
     const host = {
       call: vi.fn((method: string) =>
         method === "tools.execute"
           ? new Promise<never>(() => undefined)
-          : Promise.resolve({ ok: true, content: "abort requested" }),
+          : Promise.resolve(undefined),
       ),
       onNotification: vi.fn(() => () => undefined),
     };
     const runtime = createRuntime({ host });
-    const grep = runtimeTool(runtime, "Grep");
+    const read = runtimeTool(runtime, "Read");
     // A signal that never fires stands in for the field case: the stop reached
     // the runtime but not the tool, so the executor kept awaiting a host call
     // that would not return and the abort RPC never came back.
     const silent = new AbortController();
-    const pending = grep.execute("grep-silent", { query: "needle" }, silent.signal);
+    const pending = read.execute("read-silent", { path: "file.txt" }, silent.signal);
     await new Promise<void>((resolve) => setImmediate(resolve));
 
     await runtime.abort();
@@ -1998,6 +1998,56 @@ describe("DesktopAgentRuntime configuration matching", () => {
     expect(settled).toBe(true);
     await runtime.dispose();
   });
+  for (const name of ["Grep", "Glob"]) {
+    it.each(["signal", "runtime"])(`forwards ${name} cancellation from %s and waits for actual host settlement`, async (stopSource) => {
+      let executionStarted!: () => void;
+      const started = new Promise<void>((resolve) => { executionStarted = resolve; });
+      let finishExecution!: (value: { ok: boolean; content: unknown; isError?: boolean }) => void;
+      const execution = new Promise<{ ok: boolean; content: unknown; isError?: boolean }>((resolve) => { finishExecution = resolve; });
+      const calls: Array<{ method: string; params: unknown }> = [];
+      const host = {
+        call: vi.fn((method: string, params: unknown) => {
+          calls.push({ method, params });
+          if (method === "tools.execute") { executionStarted(); return execution; }
+          if (method === "tools.abort") return Promise.resolve({ ok: true });
+          throw new Error(`Unexpected host call: ${method}`);
+        }),
+      };
+      const runtime = createRuntime({ host });
+      const controller = new AbortController();
+      const pending = runtimeTool(runtime, name).execute(
+        `${name.toLowerCase()}-stop`, name === "Grep" ? { pattern: "needle", path: "src" } : { pattern: "**/*.ts", path: "src" }, controller.signal,
+      );
+      let settled = false;
+      void pending.then(() => { settled = true; }, () => { settled = true; });
+      try {
+        await started;
+        if (stopSource === "signal") controller.abort();
+        else await runtime.abort();
+        const abortCall = calls.find((call) => call.method === "tools.abort");
+        await new Promise<void>((resolve) => setImmediate(resolve));
+        const settledBeforeHost = settled;
+        finishExecution({ ok: false, isError: true, content: { code: "TOOL_ABORTED" } });
+        await expect(pending).resolves.toMatchObject({ isError: true, details: { code: "TOOL_ABORTED" } });
+        expect(abortCall).toEqual({ method: "tools.abort", params: { sessionId: "session-1", toolCallId: `${name.toLowerCase()}-stop`, toolName: name } });
+        expect(settledBeforeHost).toBe(false);
+      } finally {
+        finishExecution({ ok: false, content: { code: "TOOL_ABORTED" } });
+        await runtime.dispose();
+      }
+    });
+
+    it(`rejects a pre-aborted ${name} without starting a host search`, async () => {
+      const host = { call: vi.fn() };
+      const runtime = createRuntime({ host });
+      try {
+        await expect(runtimeTool(runtime, name).execute(
+          "never-start", { pattern: "needle" }, AbortSignal.abort(),
+        )).rejects.toMatchObject({ errorCode: "TOOL_ABORTED" });
+        expect(host.call).not.toHaveBeenCalled();
+      } finally { await runtime.dispose(); }
+    });
+  }
 });
 
 describe("DesktopAgentRuntime live activity", () => {
diff --git a/packages/agent-runtime/src/runtime.ts b/packages/agent-runtime/src/runtime.ts
index f1d920cc82..f3379f64d1 100644
--- a/packages/agent-runtime/src/runtime.ts
+++ b/packages/agent-runtime/src/runtime.ts
@@ -1264,12 +1264,12 @@ const TOOL_PARAM_ALIASES: Record<string, Record<string, string>> = {
   Grep: { query: "pattern" },
 };
 const TOOL_OUTPUT_UPDATE_THROTTLE_MS = 100;
-const READ_ONLY_CORE_TOOLS = new Set(["Read", "Glob", "Grep"]);
+const LOCALLY_ABANDONABLE_CORE_TOOLS = new Set(["Read"]);
 /**
  * How long a stop request waits for a tool that host-core can actually
  * interrupt (`Bash`, `GenerateImages`) to hand back the output it collected
- * before the kill (#1767). Tools without host-side cancellation do not wait at
- * all: the runtime stops waiting the moment the signal fires.
+ * before the kill (#1767). Searches wait for cooperative host cancellation;
+ * mutating and extension calls also retain host settlement ownership.
  */
 const TOOL_ABORT_GRACE_MS = 10_000;
 const MAX_TOOL_PROGRESS_CHARS = 64 * 1024;
@@ -3490,12 +3490,12 @@ Do not invent objections or turn speculative risks into blockers. Stop when the
               scheduleProgress();
             })
           : undefined;
-        // Read-only core tools may be abandoned locally if host-core is still
-        // waiting on a blocking read/search. Mutating, MCP, and plugin calls
-        // must settle before the turn is reported stopped. Bash and image
-        // generation retain their host process-abort path and grace window.
+        // Read retains its existing local-abandon policy. Searches wait for
+        // cooperative cancellation and owned worker/process cleanup. Mutating,
+        // MCP, and plugin calls also settle before the turn is reported stopped.
+        // Bash and image generation retain their existing process-abort grace.
         const hostAbortsProcess = isBash || toolName === "GenerateImages";
-        const canAbandonWait = READ_ONLY_CORE_TOOLS.has(toolName);
+        const canAbandonWait = LOCALLY_ABANDONABLE_CORE_TOOLS.has(toolName);
         const abortedMarker = Symbol("tool-aborted");
         let resolveAborted: (marker: typeof abortedMarker) => void = () => undefined;
         const aborted = new Promise<typeof abortedMarker>((resolve) => {
@@ -3619,10 +3619,9 @@ Do not invent objections or turn speculative risks into blockers. Stop when the
                 ? { delegationId: this.delegateWorktrees.get(toolCallId) }
                 : {}),
             });
-          // #1767: read-only host work must not keep the user-facing turn open
-          // indefinitely. Other tool classes deliberately wait for the Host
-          // result so a write or extension action cannot outlive a reported
-          // stop.
+          // Only Read and process-backed tools may release their local wait.
+          // Search, mutating, and extension calls retain actual host settlement
+          // ownership rather than reporting a stopped turn with work outstanding.
           const raced = await Promise.race([execution, aborted]);
           if (raced === abortedMarker) {
             stopped = true;
diff --git a/scripts/e2e-transcript-render.mjs b/scripts/e2e-transcript-render.mjs
index 29ece40990..84acbb1884 100644
--- a/scripts/e2e-transcript-render.mjs
+++ b/scripts/e2e-transcript-render.mjs
@@ -15,7 +15,8 @@ const require = createRequire(
 );
 const { build } = require("esbuild");
 const { electronBinary } = resolveElectronBinary(root);
-const temp = await mkdtemp(join(tmpdir(), "pi-transcript-render-"));
+const hiddenPaneOnly = process.argv.includes("--hidden-pane-only");
+const temp = await mkdtemp(join(process.env.PI_SCRATCH_DIR || tmpdir(), "pi-transcript-render-"));
 try {
   await build({
     entryPoints: [join(root, "scripts/e2e/transcript-render.tsx")],
@@ -182,12 +183,14 @@ app.whenReady().then(async () => {
   });
 
   const phases = [
+    ["hiddenPane", "globalThis.transcriptHiddenPaneProbe()"],
     ["render", "globalThis.transcriptRenderProbe()"],
     ["runtimeSlot", "globalThis.transcriptRuntimeSlotProbe()"],
     ["smoothText", "globalThis.smoothTextThrottleProbe()"],
     ["longHistory", "globalThis.transcriptLongHistoryProbe()"],
   ];
-  const outcomes = { render: null, runtimeSlot: null, smoothText: null, longHistory: null };
+  if (${hiddenPaneOnly}) phases.splice(1);
+  const outcomes = Object.fromEntries(phases.map(([name]) => [name, null]));
   const phaseStatus = () => Object.fromEntries(Object.entries(outcomes).map(([name, value]) => [name, value ? value.ok === true : null]));
   const phaseErrors = () => Object.fromEntries(Object.entries(outcomes).filter(([, value]) => value && value.ok !== true).map(([name, value]) => [name, value.error]));
 
@@ -207,6 +210,11 @@ app.whenReady().then(async () => {
       outcomes[name] = await runPhase(name, expression);
       if (!outcomes[name] || outcomes[name].ok !== true) break;
     }
+    const hiddenPane = outcomes.hiddenPane && outcomes.hiddenPane.ok === true ? outcomes.hiddenPane.value : undefined;
+    if (${hiddenPaneOnly}) {
+      finish({ hiddenPane, phases: phaseStatus(), phaseErrors: phaseErrors(), ok: hiddenPane?.ok === true });
+      return;
+    }
     const render = outcomes.render && outcomes.render.ok === true ? outcomes.render.value : {};
     const runtimeSlot = outcomes.runtimeSlot && outcomes.runtimeSlot.ok === true ? outcomes.runtimeSlot.value : undefined;
     const smoothText = outcomes.smoothText && outcomes.smoothText.ok === true ? outcomes.smoothText.value : undefined;
@@ -216,9 +224,9 @@ app.whenReady().then(async () => {
       contextOverflowRecovery = await require(${JSON.stringify(join(root, "scripts/e2e/context-overflow-recovery.cjs"))})(window);
     }
     finish({
-      ...render, runtimeSlot, smoothText, longHistory, contextOverflowRecovery,
+      ...render, hiddenPane, runtimeSlot, smoothText, longHistory, contextOverflowRecovery,
       phases: phaseStatus(), phaseErrors: phaseErrors(),
-      ok: Boolean(render.ok && runtimeSlot?.ok && smoothText?.ok && longHistory?.ok && contextOverflowRecovery?.ok),
+      ok: Boolean(hiddenPane?.ok && render.ok && runtimeSlot?.ok && smoothText?.ok && longHistory?.ok && contextOverflowRecovery?.ok),
     });
   } catch (error) {
     finish({ ok: false, error: describe(error), phases: phaseStatus(), phaseErrors: phaseErrors() });
@@ -267,6 +275,8 @@ app.whenReady().then(async () => {
     true,
     `transcript scenario failed; phases=${JSON.stringify(result.phases)} phaseErrors=${JSON.stringify(result.phaseErrors)}`,
   );
+  assert.equal(result.hiddenPane?.ok, true, `hidden pane scenario failed: ${JSON.stringify(result.hiddenPane)}`);
+  if (!hiddenPaneOnly) {
   // The merged result above already carries the geometry snapshots; this turns
   // a failed scenario into a message that names the checks that failed.
   // check can be read from the scenario output alone.
@@ -290,6 +300,7 @@ app.whenReady().then(async () => {
     true,
     `context overflow recovery scenario failed: ${JSON.stringify(result.contextOverflowRecovery)}`,
   );
+  }
 } finally {
   await rm(temp, { recursive: true, force: true });
 }
diff --git a/scripts/e2e/transcript-hidden-pane.tsx b/scripts/e2e/transcript-hidden-pane.tsx
new file mode 100644
index 0000000000..3699d784ae
--- /dev/null
+++ b/scripts/e2e/transcript-hidden-pane.tsx
@@ -0,0 +1,191 @@
+import { createRoot } from "react-dom/client";
+import { flushSync } from "react-dom";
+import { createInstance } from "i18next";
+import { I18nextProvider } from "react-i18next";
+import { en } from "@pi-desktop/i18n";
+import type { UiMessage } from "@pi-desktop/shared";
+import { SessionPane } from "../../apps/desktop/src/components/SessionPane";
+import { SubagentRunRows, ToolRow } from "../../apps/desktop/src/features/chat/transcript/ToolRow";
+import { ActivityGroup, RunActivityIndicator, WorkingIndicator } from "../../apps/desktop/src/features/chat/transcript/ActivityGroup";
+import { TranscriptDisclosureProvider } from "../../apps/desktop/src/features/chat/transcript/disclosure";
+import { useAppStore } from "../../apps/desktop/src/stores/app-store";
+import type { SubagentRunItem } from "../../apps/desktop/src/lib/assistant-turns";
+
+function assert(value: unknown, message: string): asserts value {
+  if (!value) throw new Error(message);
+}
+
+/** Real retained pane and leaf components; fake only the clock and external RPC. */
+export async function transcriptHiddenPaneProbe() {
+  const i18n = createInstance();
+  await i18n.init({ lng: "en", fallbackLng: "en", resources: { en: { translation: en } } });
+  const initialState = useAppStore.getState();
+  const sessionId = "hidden-pane-fixture";
+  const createdAt = new Date(Date.now() - 10_000).toISOString();
+  const output = Array.from({ length: 400 }, (_, index) => `line ${index}: preserved output`).join("\n");
+  const tool: UiMessage = { id: "hidden-grep", role: "tool", toolName: "Grep", toolArgs: { pattern: "fixture" }, toolStatus: "running", toolResult: output, content: "", createdAt, turnId: "hidden-turn" };
+  let rows: UiMessage[] = [
+    { id: "hidden-user", role: "user", content: "inspect", createdAt, turnId: "hidden-turn" },
+    tool,
+    { id: "hidden-answer", role: "assistant", content: "partial answer", status: "streaming", createdAt, turnId: "hidden-turn" },
+  ];
+  const task: UiMessage = { id: "hidden-task", role: "tool", toolName: "Task", toolArgs: { agent: "explorer", task: "fixture" }, toolStatus: "running", toolResult: { details: { delegationId: "hidden-delegate", status: "running", startedAt: Date.now() - 10_000 } }, content: "", createdAt };
+  const taskItems = [{ kind: "tool" as const, message: task }];
+  let delegateItems: SubagentRunItem[] = Array.from({ length: 40 }, (_, index) => ({
+    kind: "answer", message: { id: `hidden-delegate-${index}`, role: "assistant", content: `delegate row ${index}`, createdAt },
+  }));
+  const host = document.createElement("div");
+  host.style.cssText = "position:fixed;inset:0;display:flex;flex-direction:column";
+  document.body.append(host);
+  const errors: unknown[] = [];
+  const root = createRoot(host, { onUncaughtError: (error) => errors.push(error) });
+  const native = { interval: window.setInterval, clearInterval: window.clearInterval, raf: window.requestAnimationFrame, cancelRaf: window.cancelAnimationFrame, now: Date.now };
+  let now = Date.now();
+  const startedAt = now - 10_000;
+  let nextId = 1;
+  const intervals = new Map<number, () => void>();
+  const frames = new Map<number, FrameRequestCallback>();
+  window.setInterval = ((callback: TimerHandler) => {
+    assert(typeof callback === "function", "interval must use a callback");
+    const id = nextId++;
+    intervals.set(id, () => callback());
+    return id;
+  }) as typeof window.setInterval;
+  window.clearInterval = (id) => { intervals.delete(id); };
+  window.requestAnimationFrame = (callback) => { const id = nextId++; frames.set(id, callback); return id; };
+  window.cancelAnimationFrame = (id) => { frames.delete(id); };
+  Date.now = () => now;
+  const advance = () => {
+    now += 1000;
+    flushSync(() => {
+      for (const callback of [...intervals.values()]) callback();
+      const callbacks = [...frames.values()];
+      frames.clear();
+      for (const callback of callbacks) callback(performance.now() + 1000);
+    });
+  };
+  const yieldToEffects = () => new Promise<void>((resolve) => window.setTimeout(resolve, 0));
+  const until = async (ready: () => boolean, label: string) => {
+    for (let frame = 0; frame < 120 && !ready(); frame++) {
+      await new Promise<void>((resolve) => native.raf.call(window, () => resolve()));
+    }
+    assert(ready(), label);
+  };
+  const render = (visible: boolean) => flushSync(() => root.render(
+    <I18nextProvider i18n={i18n}>
+      <SessionPane sessionId={sessionId} visible={visible} />
+      <TranscriptDisclosureProvider sessionId={`${sessionId}-leaves`} visible={visible}>
+        <div data-hidden-leaves>
+          <ActivityGroup items={taskItems} isActive />
+          <ToolRow message={task} variant="topology" />
+          <WorkingIndicator startedAt={startedAt} />
+          <RunActivityIndicator activity={{ phase: "waiting-model", since: startedAt }} />
+          <SubagentRunRows run={{ items: delegateItems }} agentName="explorer" />
+        </div>
+      </TranscriptDisclosureProvider>
+    </I18nextProvider>,
+  ));
+  try {
+    useAppStore.setState({
+      activeSessionId: sessionId, page: "chat", messages: rows,
+      sessions: [{ id: sessionId, title: "Fixture", createdAt, updatedAt: createdAt, source: "desktop", mode: "agent" }],
+      retainedSessionIds: [sessionId], retainedTranscripts: { [sessionId]: rows },
+      sessionHistory: {}, transcriptViews: {}, planningStates: {},
+      pendingPermissions: {}, pendingAsks: {}, runningSessions: { [sessionId]: true }, isRunning: true,
+      agentStatuses: { [sessionId]: { isRunning: true, currentTurnId: "hidden-turn", activity: { phase: "waiting-model", since: now - 10_000 } } },
+      settings: { ...initialState.settings, smoothStreaming: true },
+    });
+    render(true);
+    await yieldToEffects();
+    const processHeader = host.querySelector<HTMLButtonElement>(".turn-process > .tool-activity-header");
+    if (processHeader?.getAttribute("aria-expanded") === "false") flushSync(() => processHeader.click());
+    const pane = host.querySelector<HTMLElement>(`[data-session-pane="${sessionId}"]`);
+    const nested = host.querySelector<HTMLElement>("[data-hidden-leaves] .subagent-run-rows");
+    assert(nested, "real nested delegate scroller must be mounted");
+    nested.style.maxHeight = "120px";
+    advance();
+    flushSync(() => {
+      nested.dispatchEvent(new WheelEvent("wheel", { deltaY: -50, bubbles: true }));
+      nested.scrollTop = 73;
+      nested.dispatchEvent(new Event("scroll", { bubbles: true }));
+    });
+    const nestedScrollTop = nested.scrollTop;
+    assert(nestedScrollTop > 0, "nested output must overflow and leave follow mode");
+    rows = rows.map((message) => message.id === "hidden-answer"
+      ? { ...message, content: `${message.content}${" visible pending answer".repeat(8)}` } : message);
+    flushSync(() => useAppStore.setState({ messages: rows, retainedTranscripts: { [sessionId]: rows } }));
+    await yieldToEffects();
+    await until(() => frames.size > 0, "visible smooth output must have pending release work");
+    const header = pane?.querySelector<HTMLButtonElement>('[data-message-id="hidden-grep"] .tool-row-header');
+    assert(pane && header, `real pane failed to mount: ${errors.map(String).join("; ")}`);
+    flushSync(() => header.click());
+    const body = pane.querySelector<HTMLElement>('[data-message-id="hidden-grep"] .tool-row-content');
+    const thread = pane.querySelector<HTMLElement>(".thread-scroll");
+    assert(body && thread, `open tool output and retained thread must be mounted: ${JSON.stringify({ expanded: header.getAttribute("aria-expanded"), disabled: header.disabled, thread: Boolean(thread), tool: header.closest(".tool-row")?.outerHTML.slice(-2500), errors: errors.map(String) })}`);
+    body.scrollTop = 73;
+    const scrollTop = body.scrollTop;
+    const content = body.textContent;
+    const answer = pane.querySelector<HTMLElement>('[data-message-id="hidden-answer"] .prose-chat');
+    assert(answer, "streaming assistant output must be mounted");
+    const answerContent = answer.textContent;
+    assert(scrollTop > 0, "fixture output must overflow to prove reading position retention");
+    const visibleTimers = intervals.size;
+    assert(visibleTimers > 0, "visible live clocks must be active");
+    render(false);
+    flushSync(() => useAppStore.setState({ activeSessionId: "other-fixture", messages: [], isRunning: false }));
+    rows = rows.map((message) => message.id === "hidden-grep" ? { ...message, toolResult: `${output}\nhidden output arrives` }
+      : message.id === "hidden-answer" ? { ...message, content: `${message.content} hidden answer arrives` } : message);
+    flushSync(() => useAppStore.setState({ retainedTranscripts: { [sessionId]: rows } }));
+    delegateItems = [...delegateItems, { kind: "answer", message: {
+      id: "hidden-delegate-new", role: "assistant", content: "hidden delegate answer arrives", createdAt,
+    } }];
+    render(false);
+    await yieldToEffects();
+    // Drain one-shot work from mounting; recurring hidden work must be absent.
+    advance();
+    advance();
+    const hiddenTimers = intervals.size;
+    const hiddenFrames = frames.size;
+    const sameOutput = body.textContent === content;
+    const sameAnswer = answer.textContent === answerContent;
+    const retained = pane.querySelector('.tool-row-content') === body && body.scrollTop === scrollTop
+      && header.getAttribute("aria-expanded") === "true" && pane.querySelector(".thread-scroll") === thread;
+    const sameDelegate = !nested.textContent?.includes("hidden delegate answer arrives");
+    const nestedRetained = nested.scrollTop === nestedScrollTop
+      && host.querySelector("[data-hidden-leaves] .subagent-run-rows") === nested;
+    render(true);
+    flushSync(() => useAppStore.setState({ activeSessionId: sessionId, messages: rows, isRunning: true }));
+    await yieldToEffects();
+    const catchUpState = { tool: Boolean(body.textContent?.includes("hidden output arrives")), answer: Boolean(pane.textContent?.includes("hidden answer arrives")), text: answer.textContent?.slice(-120), pendingFrames: frames.size };
+    const caughtUp = catchUpState.tool && catchUpState.answer;
+    const delegateCaughtUp = nested.textContent?.includes("hidden delegate answer arrives")
+      && nested.scrollTop === nestedScrollTop;
+    const resumed = intervals.size > 0;
+    flushSync(() => header.click());
+    render(false);
+    render(true);
+    const manualChoice = header.getAttribute("aria-expanded") === "false";
+    assert(hiddenTimers === 0, `hidden pane retained ${hiddenTimers} recurring clocks`);
+    assert(hiddenFrames === 0, `hidden pane retained ${hiddenFrames} animation frames`);
+    assert(sameOutput, "hidden output formatting should remain deferred");
+    assert(sameAnswer, "hidden assistant text must retain its last visible rendering");
+    assert(sameDelegate && nestedRetained, "hidden delegate work must retain rendering and nested reading position");
+    assert(delegateCaughtUp, "delegate output must catch up without re-pinning the reader");
+    assert(retained, "visibility swap must retain DOM, disclosure and nested scroll position");
+    assert(caughtUp, `reopening must show latest stored tool output and assistant text: ${JSON.stringify(catchUpState)}`);
+    assert(resumed && manualChoice, "visible clocks resume without resetting an explicit disclosure choice");
+    assert(errors.length === 0, errors.map(String).join("; "));
+    flushSync(() => root.unmount());
+    assert(intervals.size === 0 && frames.size === 0, "unmount must release timers and animation frames");
+    return { ok: true, visibleTimers, hiddenTimers, hiddenFrames, sameOutput, sameAnswer, sameDelegate, retained, nestedRetained, caughtUp, delegateCaughtUp, resumed, manualChoice };
+  } finally {
+    flushSync(() => root.unmount());
+    host.remove();
+    window.setInterval = native.interval;
+    window.clearInterval = native.clearInterval;
+    window.requestAnimationFrame = native.raf;
+    window.cancelAnimationFrame = native.cancelRaf;
+    Date.now = native.now;
+    useAppStore.setState(initialState);
+  }
+}
diff --git a/scripts/e2e/transcript-render.tsx b/scripts/e2e/transcript-render.tsx
index 8f535942f0..3f64a4297a 100644
--- a/scripts/e2e/transcript-render.tsx
+++ b/scripts/e2e/transcript-render.tsx
@@ -1,3 +1,4 @@
+import { transcriptHiddenPaneProbe as runHiddenPaneProbe } from "./transcript-hidden-pane";
 import { transcriptLongHistoryProbe as runLongHistoryProbe } from "./transcript-long-history";
 import { transcriptEditProbe } from "./transcript-edit";
 import { turnProcessProbe } from "./turn-process";
@@ -36,11 +37,13 @@ declare global {
   var transcriptRuntimeSlotProbe: () => Promise<unknown>;
   var smoothTextThrottleProbe: () => Promise<unknown>;
   var transcriptLongHistoryProbe: typeof runLongHistoryProbe;
+  var transcriptHiddenPaneProbe: typeof runHiddenPaneProbe;
   var resetContextOverflowRecoveryProbe: () => Promise<void>;
   var contextOverflowRecoveryProbe: (events: AgentEventEnvelope[]) => Promise<unknown>;
 }
 
 globalThis.transcriptLongHistoryProbe = runLongHistoryProbe;
+globalThis.transcriptHiddenPaneProbe = runHiddenPaneProbe;
 
 function assert(value: unknown, message: string): asserts value {
   if (!value) throw new Error(message);