diff --git a/.specify/feature.json b/.specify/feature.json
index 35781f75..1ce695e1 100644
--- a/.specify/feature.json
+++ b/.specify/feature.json
@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/014-a2a-protocol-upgrade"
+  "feature_directory": "specs/015-chat-message-reliability"
 }
diff --git a/CLAUDE.md b/CLAUDE.md
index 383525b8..9d490a4f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,4 +27,9 @@ string. `en.json` per slice is the source, `bun run i18n:sync` generates `ru`,
 templates use the injected `$t`, and copy decided in script travels as a key.
 Never hand-write `ru.json` as the first step. `admin/` stays English-only.
 
+**Client state (`admin` + `app`):** read `docs/state.md` before adding a store,
+a fetch or a live feed. An entity lives once in its Pinia store: fetches upsert,
+pushes patch, components render by id, `useAsyncData` is for loading state only,
+optimistic changes go through the store's `patch()` with a rollback.
+
 Project overview: `README.md`.
diff --git a/admin/package.json b/admin/package.json
index e1bc9b7a..d116a387 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -12,7 +12,7 @@
     "pretypecheck": "openapi-ts",
     "typecheck": "nuxt typecheck",
     "lint": "echo 'admin lint: not configured (see eslint.config.mjs TODO)'",
-    "test": "echo 'admin test: no tests yet'"
+    "test": "bun test slices"
   },
   "dependencies": {
     "@hey-api/client-axios": "^0.6",
diff --git a/admin/slices/agent/agent/components/agent/chat/Tab.vue b/admin/slices/agent/agent/components/agent/chat/Tab.vue
index f6621498..ba6dc70e 100644
--- a/admin/slices/agent/agent/components/agent/chat/Tab.vue
+++ b/admin/slices/agent/agent/components/agent/chat/Tab.vue
@@ -45,12 +45,9 @@ const restartUnderway = computed(
 // reads as "Agent reconnecting…" for 30s on a freshly opened page, because
 // bridle only sees its own WS.
 const agentStatusStore = useAgentStatusStore();
-const liveAgent = computed(() => agentStatusStore.agents[props.agent.id]);
-// The SSE record is fresher than the row this page fetched — the drift sweep
-// flips 'running' → 'unreachable' between refetches.
-const displayStatus = computed(
-  () => liveAgent.value?.status ?? props.agent.status,
-);
+// `props.agent` is the store record, which the status stream writes into —
+// the drift sweep's 'running' → 'unreachable' arrives here by itself.
+const displayStatus = computed(() => props.agent.status);
 
 const bridleAgentState = computed(() => {
   if (restartUnderway.value) return 'restarting';
@@ -81,7 +78,7 @@ const hubUnreachable = computed(
 const offlineHint = computed(() =>
   hubUnreachable.value
     ? {
-        reason: liveAgent.value?.statusReason ?? props.agent.statusReason,
+        reason: props.agent.statusReason,
         envHref: `/agents/${props.agent.id}?tab=env`,
         settingsHref: '/settings/bridle',
       }
diff --git a/admin/slices/agent/agent/components/agent/edit/Provider.vue b/admin/slices/agent/agent/components/agent/edit/Provider.vue
index c950b328..49ebbfc1 100644
--- a/admin/slices/agent/agent/components/agent/edit/Provider.vue
+++ b/admin/slices/agent/agent/components/agent/edit/Provider.vue
@@ -33,8 +33,13 @@ const apiUrl =
   (typeof process !== 'undefined' ? process.env.API_URL : undefined) ??
   'http://localhost:3333';
 
+// The agent request is here for `pending` / `refresh`; the page renders the
+// store's record (docs/state.md), which `fetchById` and every mutation below
+// upsert into.
+const agent = computed(() => agentStore.byId(props.id));
+
 const [
-  { data: agent, pending: pendingAgent, refresh: refreshAgent },
+  { pending: pendingAgent, refresh: refreshAgent },
   { data: templates, pending: pendingTemplates },
   { pending: pendingLlms },
   { data: knowledges, pending: pendingKnowledges },
@@ -180,10 +185,11 @@ async function onPromote() {
   promoting.value = true;
   promoteError.value = null;
   try {
-    const updated = agent.value.isAdmin
-      ? await agentStore.demoteAdmin(agent.value.id)
-      : await agentStore.promoteAdmin(agent.value.id);
-    agent.value = { ...updated, status: 'deploying' };
+    if (agent.value.isAdmin) await agentStore.demoteAdmin(agent.value.id);
+    else await agentStore.promoteAdmin(agent.value.id);
+    // Both redeploy the agent; show it until the refetch confirms. No
+    // rollback — the change itself has already succeeded.
+    agentStore.patch(props.id, { status: 'deploying' });
     await refreshAgent();
   } catch (err) {
     promoteError.value = (err as Error).message || 'Promote failed';
@@ -357,7 +363,7 @@ async function onRemove() {
               :api-url="apiUrl"
               :is-public="agent.isPublic"
               :allowed-origins="agent.allowedOrigins"
-              @saved="(updated) => (agent = updated)"
+              @saved="(updated) => agentStore.upsert(updated)"
             />
           </section>
 
@@ -556,8 +562,10 @@ async function onRemove() {
       </AlertDialogRoot>
     </template>
 
+    <!-- `!removing`: a delete drops the store record before the navigation
+         away lands — that gap is not a "not found". -->
     <div
-      v-else
+      v-else-if="!removing"
       class="rounded-md border border-dashed p-10 text-center text-sm text-muted-foreground"
     >
       Agent not found.
diff --git a/admin/slices/agent/agent/components/agent/overview/RuntimeCard.vue b/admin/slices/agent/agent/components/agent/overview/RuntimeCard.vue
index 54353da6..c44d0e43 100644
--- a/admin/slices/agent/agent/components/agent/overview/RuntimeCard.vue
+++ b/admin/slices/agent/agent/components/agent/overview/RuntimeCard.vue
@@ -10,15 +10,10 @@ const agentStatusStore = useAgentStatusStore();
 const podStatus = computed(() => agentStatusStore.statuses[props.agent.id] ?? null);
 const podLabel = computed(() => podPhaseLabel(podStatus.value));
 
-// The SSE record is fresher than the fetched row (the drift sweep writes
-// 'unreachable' between refetches) — prefer it when present.
-const liveAgent = computed(() => agentStatusStore.agents[props.agent.id]);
-const displayStatus = computed(
-  () => (liveAgent.value?.status as IAgentData['status']) || props.agent.status,
-);
-const statusReason = computed(
-  () => liveAgent.value?.statusReason ?? props.agent.statusReason,
-);
+// `props.agent` is the store record — fetches and status-stream frames both
+// land in it, so this card, the header and the rail row read one value.
+const displayStatus = computed(() => props.agent.status);
+const statusReason = computed(() => props.agent.statusReason);
 // Explicit `=== false`: undefined just means the stream hasn't reported yet.
 const runtimeOffline = computed(
   () =>
diff --git a/admin/slices/agent/agent/components/agent/status/Indicator.vue b/admin/slices/agent/agent/components/agent/status/Indicator.vue
index ae865d1f..9da92802 100644
--- a/admin/slices/agent/agent/components/agent/status/Indicator.vue
+++ b/admin/slices/agent/agent/components/agent/status/Indicator.vue
@@ -22,7 +22,10 @@ const pulseClass = computed(() =>
     : '',
 );
 
-const totalAgents = computed(() => Object.keys(store.agents).length);
+// Agents live in the agent store (docs/state.md); the stream's snapshot loads
+// that collection, so the count is still "what the stream knows about".
+const agentStore = useAgentStore();
+const totalAgents = computed(() => agentStore.agents.length);
 const runningCount = computed(
   () =>
     Object.values(store.statuses).filter(
diff --git a/admin/slices/agent/agent/components/agent/workspace/Main.vue b/admin/slices/agent/agent/components/agent/workspace/Main.vue
index 6f7ffb3a..345e17b7 100644
--- a/admin/slices/agent/agent/components/agent/workspace/Main.vue
+++ b/admin/slices/agent/agent/components/agent/workspace/Main.vue
@@ -17,7 +17,6 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '#theme/components/ui/dropdown-menu';
-import type { IAgentData } from '#agent/domain';
 import { agentInitials } from '#agent/composables/useAgentRailEntries';
 import { useAgentSectionCounts } from '#agent/composables/useAgentSectionCounts';
 import { useAgentTab } from '#agent/composables/useAgentTab';
@@ -38,11 +37,16 @@ const apiUrl =
 // until the data arrives. Without lazy, top-level awaits in <script setup>
 // block the Vue Router transition until every promise resolves — the user
 // perceives this as a multi-second delay before the page opens.
-const { data: agent, pending, refresh } = useAsyncData(
+//
+// The request is here for `pending` and `refresh` only. What renders is the
+// store's record (docs/state.md) — the same object the rail row shows, so the
+// two cannot disagree; `fetchById` upserts into it.
+const { pending, refresh } = useAsyncData(
   `admin-agent-${props.id}`,
   () => agentStore.fetchById(props.id),
   { lazy: true },
 );
+const agent = computed(() => agentStore.byId(props.id));
 
 const {
   isRestarting,
@@ -74,20 +78,11 @@ const initials = computed(() =>
   agent.value ? agentInitials(agent.value.name, agent.value.id) : '?',
 );
 
-// The SSE record is fresher than the fetched row — the drift sweep flips
-// 'running' → 'unreachable' between refetches, and the header badge is the
-// first place an operator looks.
+// Fetches and status-stream frames both land in the one store record, so
+// there is no "live vs fetched" to pick between any more.
 const agentStatusStore = useAgentStatusStore();
-const liveAgent = computed(() => agentStatusStore.agents[props.id]);
-const displayStatus = computed(
-  () =>
-    (liveAgent.value?.status as IAgentData['status']) ??
-    agent.value?.status ??
-    'pending',
-);
-const statusReason = computed(
-  () => liveAgent.value?.statusReason ?? agent.value?.statusReason ?? null,
-);
+const displayStatus = computed(() => agent.value?.status ?? 'pending');
+const statusReason = computed(() => agent.value?.statusReason ?? null);
 // `=== false` on purpose: undefined means the stream hasn't reported yet.
 const runtimeOffline = computed(
   () =>
@@ -102,21 +97,14 @@ const lifecycleError = computed(() => restartError.value || toggleError.value);
 // deploy ran", stays 'restart' forever after the first restart) and the
 // deploying phase lasts seconds, so a snapshot look always lands on
 // status=running. The moment of the last deploy is the missing piece.
-// Live-first like displayStatus: the SSE frame carries the full agent row,
-// so a restart triggered anywhere (Files-tab banner, rancher, another tab)
-// updates the hint without a page reload — the fetched row alone goes stale.
+// A restart triggered anywhere (Files-tab banner, rancher, another tab)
+// reaches the store record through the status stream, so the hint updates
+// without a page reload.
 const lastDeployStartedAt = computed(
-  () =>
-    liveAgent.value?.lastDeployStartedAt ??
-    agent.value?.lastDeployStartedAt ??
-    null,
-);
-const launchContext = computed(
-  () => liveAgent.value?.launchContext ?? agent.value?.launchContext ?? null,
-);
-const lastPullAt = computed(
-  () => liveAgent.value?.lastPullAt ?? agent.value?.lastPullAt ?? null,
+  () => agent.value?.lastDeployStartedAt ?? null,
 );
+const launchContext = computed(() => agent.value?.launchContext ?? null);
+const lastPullAt = computed(() => agent.value?.lastPullAt ?? null);
 const { locale } = useI18n();
 const deployAgo = useTimeAgoIntl(
   () => new Date(lastDeployStartedAt.value ?? Date.now()),
@@ -323,7 +311,7 @@ async function onRemove() {
           :toggling="toggling"
           @restart="restart"
           @toggle-running="toggleRunning"
-          @agent-updated="(updated) => (agent = updated)"
+          @agent-updated="(updated) => agentStore.upsert(updated)"
         />
       </div>
 
diff --git a/admin/slices/agent/agent/components/agent/workspace/Provider.vue b/admin/slices/agent/agent/components/agent/workspace/Provider.vue
index ebc40df5..20412259 100644
--- a/admin/slices/agent/agent/components/agent/workspace/Provider.vue
+++ b/admin/slices/agent/agent/components/agent/workspace/Provider.vue
@@ -9,11 +9,17 @@ const route = useRoute();
 
 // One list request for the whole workspace. It lives here — above the keyed
 // `Main` — so switching agents does not refetch it or flash the rail.
-const { data: agents, pending, refresh: refreshAgents } = useAsyncData(
+//
+// The request gives `pending` and `refresh`; the rail renders the store's
+// collection (docs/state.md). Rendering the array this request returned is
+// what froze a row on "Deploying" while the open agent — a separately fetched
+// copy — had already moved on to "Failed".
+const { pending, refresh: refreshAgents } = useAsyncData(
   'admin-agents',
   () => agentStore.fetchAll(),
   { lazy: true },
 );
+const { agents } = storeToRefs(agentStore);
 
 // Cluster headroom, rendered in the rail's footer next to the create action.
 // Store actions refetch on their own; the interval catches pods actually
@@ -104,9 +110,12 @@ onUnmounted(() => {
  * rail falls through to the resolver, which renders the empty state.
  */
 async function onDeleted() {
-  await refreshAgents();
-  const next = (agents.value ?? []).find((a) => a.id !== props.id);
+  // `remove` already dropped the record from the store, so the next agent is
+  // known right now — navigate first (the pane has nothing left to render),
+  // then let the refetch confirm the list.
+  const next = agents.value.find((a) => a.id !== props.id);
   await router.replace(next ? `/agents/${next.id}` : '/agents');
+  void refreshAgents();
 }
 </script>
 
diff --git a/admin/slices/agent/agent/components/agent/workspace/RailItem.vue b/admin/slices/agent/agent/components/agent/workspace/RailItem.vue
index e54cdde7..88bd495a 100644
--- a/admin/slices/agent/agent/components/agent/workspace/RailItem.vue
+++ b/admin/slices/agent/agent/components/agent/workspace/RailItem.vue
@@ -60,6 +60,20 @@ defineProps<{ entry: IRailEntry }>();
           {{ formatDate(entry.createdAt) }}
         </span>
       </span>
+
+      <!-- Why it is not running, where the operator scans for trouble — the
+           same condition and text as the Overview card, so the row never says
+           less than the open agent does. -->
+      <span
+        v-if="
+          (entry.status === 'failed' || entry.status === 'unreachable') &&
+          entry.statusReason
+        "
+        class="mt-0.5 block truncate text-xs text-muted-foreground"
+        :title="entry.statusReason"
+      >
+        {{ entry.statusReason }}
+      </span>
     </span>
   </button>
 </template>
diff --git a/admin/slices/agent/agent/composables/useAgentLifecycle.ts b/admin/slices/agent/agent/composables/useAgentLifecycle.ts
index b03006a1..076ab410 100644
--- a/admin/slices/agent/agent/composables/useAgentLifecycle.ts
+++ b/admin/slices/agent/agent/composables/useAgentLifecycle.ts
@@ -55,7 +55,7 @@ export function useAgentLifecycle(
   // DOWN and come back (or the reconciled status confirms running/failed).
   const agentWentDown = ref(false);
   watch(
-    () => bridleStore.isAgentConnected,
+    () => bridleStore.isAgentConnectedFor(agentId),
     (up) => {
       if (!up && (restarting.value || agentStore.isRestartInFlight(agentId))) {
         agentWentDown.value = true;
@@ -79,17 +79,15 @@ export function useAgentLifecycle(
     // status='deploying') still shows the overlay.
     agentStore.markRestartInFlight(agentId);
     // Restarting a dead pod skips the "goes down" phase — it's already down.
-    agentWentDown.value = !bridleStore.isAgentConnected;
-    // Optimistic — flip to "deploying" right away so the badge reacts before
-    // the API call resolves (cancel + submit takes a few seconds).
-    const previousStatus = agent.value.status;
-    agent.value = { ...agent.value, status: 'deploying' };
+    agentWentDown.value = !bridleStore.isAgentConnectedFor(agentId);
+    // The optimistic "deploying" flip (and its rollback on error) happens
+    // inside `agentStore.restart`, on the one store record `agent` is read
+    // from — so the rail row flips together with this header.
     try {
       await agentStore.restart(agentId);
       agentStore.clearPendingRestart(agentId);
       await refresh();
     } catch (err) {
-      if (agent.value) agent.value = { ...agent.value, status: previousStatus };
       agentStore.clearRestartInFlight(agentId);
       restartError.value = (err as Error).message || 'Restart failed';
     } finally {
@@ -111,13 +109,8 @@ export function useAgentLifecycle(
     if (!agent.value || toggling.value) return;
     toggling.value = true;
     toggleError.value = null;
-    const previousStatus = agent.value.status;
+    // Read before the call: the store's optimistic flip changes `canStop`.
     const stopping = canStop.value;
-    // Optimistic flip so the badge reacts before the API resolves.
-    agent.value = {
-      ...agent.value,
-      status: stopping ? 'stopped' : 'deploying',
-    };
     try {
       if (stopping) {
         await agentStore.stop(agentId);
@@ -129,7 +122,6 @@ export function useAgentLifecycle(
       }
       await refresh();
     } catch (err) {
-      if (agent.value) agent.value = { ...agent.value, status: previousStatus };
       if (!stopping) agentStore.clearRestartInFlight(agentId);
       toggleError.value =
         (err as Error).message || (stopping ? 'Stop failed' : 'Start failed');
@@ -149,7 +141,7 @@ export function useAgentLifecycle(
   // 'running' while the pod is still being recreated (or is gone) — without
   // polling nothing reactive ever changes, the overlay computed freezes and
   // the flag's TTL never gets re-evaluated, pinning "restarting" forever.
-  // Each refresh replaces the agent ref, which re-runs the computeds (fresh
+  // Each refresh replaces the store record, which re-runs the computeds (fresh
   // Date.now() → TTL honored) and gives the server a chance to reconcile.
   let statusTimer: ReturnType<typeof setInterval> | null = null;
   // While a lifecycle mutation (restart/stop/start) is awaiting its HTTP
@@ -228,7 +220,9 @@ export function useAgentLifecycle(
     // Strongest "agent is up" signal: chat WS is connected AND the runtime is
     // registered with the hub. This bypasses DB/pod entirely — if the agent
     // is actually talking to us, nothing else matters.
-    const chatLive = bridleStore.isConnected && bridleStore.isAgentConnected;
+    const chatLive =
+      bridleStore.isConnectedFor(agentId) &&
+      bridleStore.isAgentConnectedFor(agentId);
 
     if (chatLive) return null;
 
@@ -270,8 +264,8 @@ export function useAgentLifecycle(
       [
         agent.value?.status,
         podStatus.value?.ready,
-        bridleStore.isConnected,
-        bridleStore.isAgentConnected,
+        bridleStore.isConnectedFor(agentId),
+        bridleStore.isAgentConnectedFor(agentId),
       ] as const,
     ([status, ready, chatConnected, agentConnected]) => {
       const chatLive = chatConnected && agentConnected;
diff --git a/admin/slices/agent/agent/composables/useAgentRailEntries.ts b/admin/slices/agent/agent/composables/useAgentRailEntries.ts
index abf0eb36..995a98fc 100644
--- a/admin/slices/agent/agent/composables/useAgentRailEntries.ts
+++ b/admin/slices/agent/agent/composables/useAgentRailEntries.ts
@@ -68,34 +68,16 @@ export function agentInitials(name: string, id: string): string {
 }
 
 /**
- * Live pod state wins over the DB row where we have it — the same precedence
- * `rancher/Provider.vue` uses. The DB row is reconciled asynchronously, so
- * right after a stop/restart it can lag the pod by seconds; the rail is the
- * one place where that lag is visible across every agent at once.
+ * The rail's view model: the agent store's records, filtered by the search
+ * term. The Ranch admin agent (Rancher) is pinned first — it is the agent an
+ * operator reaches for most — and the rest keep the list's own order.
  *
- * No pod at all means either "never deployed" or "stopped" — both are states
- * the DB row describes correctly, so we defer to it rather than inventing one.
- */
-function reconcileStatus(
-  agent: IAgentData,
-  pod: { phase: string; ready: boolean } | undefined,
-): AgentStatusTypes {
-  // 'unreachable' is precisely "pod healthy, runtime absent" — a Running+Ready
-  // pod is part of the diagnosis, not evidence against it. Letting the pod
-  // override to green here would re-create the incident this status exposes.
-  if (agent.status === 'unreachable') return 'unreachable';
-  if (!pod) return agent.status;
-  if (pod.phase === 'Running') return pod.ready ? 'running' : 'deploying';
-  if (pod.phase === 'Pending') return 'pending';
-  if (pod.phase === 'Failed') return 'failed';
-  return agent.status;
-}
-
-/**
- * The rail's view model: the agent list, reconciled against the live status
- * stream, filtered by the search term. The Ranch admin agent (Rancher) is
- * pinned first — it is the agent an operator reaches for most — and the rest
- * keep the list's own order.
+ * A row shows the record's own `status` / `statusReason` — exactly what the
+ * open agent's header shows (docs/state.md). It used to derive a status of its
+ * own from the pod phase, which is a second opinion the header never shared:
+ * two derivations of one fact is how a row and a header end up disagreeing.
+ * The server reconciles pod state into the row and the status stream delivers
+ * it here.
  *
  * Deliberately carries no action handlers — a rail entry identifies an agent
  * and nothing more (FR-002). Restart/stop/delete live in the settings panel.
@@ -105,8 +87,6 @@ export function useAgentRailEntries(
   activeId: Ref<string>,
   search: Ref<string>,
 ) {
-  const agentStatusStore = useAgentStatusStore();
-
   return computed<IRailEntry[]>(() => {
     const term = search.value.trim().toLowerCase();
     return (agents.value ?? [])
@@ -114,26 +94,16 @@ export function useAgentRailEntries(
       // Stable sort: admin agents float to the top, everything else keeps
       // its relative order.
       .sort((a, b) => Number(b.isAdmin) - Number(a.isAdmin))
-      .map((a) => {
-        const live = agentStatusStore.agents[a.id];
-        // The SSE record is fresher than the fetched list (the sweep writes
-        // 'unreachable' between refetches) — prefer it when present.
-        const dbStatus = (live?.status as AgentStatusTypes) || a.status;
-        const status = reconcileStatus(
-          { ...a, status: dbStatus },
-          agentStatusStore.statuses[a.id],
-        );
-        return {
-          id: a.id,
-          name: a.name,
-          initials: agentInitials(a.name, a.id),
-          status,
-          statusReason: live?.statusReason ?? a.statusReason,
-          tone: TONE[status],
-          createdAt: a.createdAt,
-          isAdmin: a.isAdmin,
-          isActive: a.id === activeId.value,
-        };
-      });
+      .map((a) => ({
+        id: a.id,
+        name: a.name,
+        initials: agentInitials(a.name, a.id),
+        status: a.status,
+        statusReason: a.statusReason,
+        tone: TONE[a.status],
+        createdAt: a.createdAt,
+        isAdmin: a.isAdmin,
+        isActive: a.id === activeId.value,
+      }));
   });
 }
diff --git a/admin/slices/agent/agent/data/agent.mapper.ts b/admin/slices/agent/agent/data/agent.mapper.ts
index ac281402..dd0a0cc1 100644
--- a/admin/slices/agent/agent/data/agent.mapper.ts
+++ b/admin/slices/agent/agent/data/agent.mapper.ts
@@ -20,6 +20,9 @@ const KNOWN_STATUSES = new Set<AgentStatusTypes>([
   'running',
   'failed',
   'stopped',
+  // Was missing: a fetched 'unreachable' row decoded as 'pending', which the
+  // screens papered over by preferring a second, stream-fed copy of the agent.
+  'unreachable',
 ]);
 
 const KNOWN_LAUNCH_CONTEXTS = new Set<LaunchContextTypes>([
diff --git a/admin/slices/agent/agent/data/agentStatus.mapper.ts b/admin/slices/agent/agent/data/agentStatus.mapper.ts
index be7c3f14..8e36010f 100644
--- a/admin/slices/agent/agent/data/agentStatus.mapper.ts
+++ b/admin/slices/agent/agent/data/agentStatus.mapper.ts
@@ -5,6 +5,7 @@ import type {
   IAgentRecord,
   IAgentStatus,
 } from '../domain/agentStatus.types';
+import { AgentMapper } from './agent.mapper';
 
 const EVENT_TYPES = new Set<AgentStatusEventType>([
   'added',
@@ -18,9 +19,20 @@ const EVENT_TYPES = new Set<AgentStatusEventType>([
  * so the store's reducer can't crash on a malformed payload.
  */
 export class AgentStatusMapper {
+  // One decoder for an agent row, whichever transport carried it — REST and
+  // the stream must not drift into two shapes of the same entity.
+  private agentMapper = new AgentMapper();
+
   toStreamMessage(raw: unknown): AgentStatusStreamMessage | null {
     if (!raw || typeof raw !== 'object') return null;
-    const o = raw as Record<string, unknown>;
+    let o = raw as Record<string, unknown>;
+    // The API's response interceptor wraps each SSE emission too, so a frame
+    // arrives as `{ data: { type, payload } }`. Reading `type` off the wrapper
+    // dropped every frame silently — the stream looked connected and fed
+    // nothing. Accept both shapes so a bare frame keeps working.
+    if (o.type === undefined && o.data && typeof o.data === 'object') {
+      o = o.data as Record<string, unknown>;
+    }
 
     if (o.type === 'snapshot') {
       const items = Array.isArray(o.payload) ? o.payload : [];
@@ -56,7 +68,7 @@ export class AgentStatusMapper {
   private toStatus(raw: unknown): IAgentStatus | null {
     if (!raw || typeof raw !== 'object') return null;
     const o = raw as Record<string, unknown>;
-    const agent = this.toAgent(o.agent);
+    const agent: IAgentRecord | null = this.agentMapper.toEntity(o.agent);
     if (!agent) return null;
     return {
       agent,
@@ -65,28 +77,6 @@ export class AgentStatusMapper {
     };
   }
 
-  private toAgent(raw: unknown): IAgentRecord | null {
-    if (!raw || typeof raw !== 'object') return null;
-    const o = raw as Record<string, unknown>;
-    if (typeof o.id !== 'string') return null;
-    return {
-      id: o.id,
-      name: typeof o.name === 'string' ? o.name : '',
-      status: typeof o.status === 'string' ? o.status : '',
-      statusReason: typeof o.statusReason === 'string' ? o.statusReason : null,
-      lastDeployStartedAt:
-        typeof o.lastDeployStartedAt === 'string'
-          ? o.lastDeployStartedAt
-          : null,
-      launchContext:
-        o.launchContext === 'initial' || o.launchContext === 'restart'
-          ? o.launchContext
-          : null,
-      lastPullAt: typeof o.lastPullAt === 'string' ? o.lastPullAt : null,
-      lastSyncAt: typeof o.lastSyncAt === 'string' ? o.lastSyncAt : null,
-    };
-  }
-
   // Pod fields come from our own API; validate presence and trust the shape.
   private toPod(raw: unknown): IAgentPodStatus | null {
     if (!raw || typeof raw !== 'object') return null;
diff --git a/admin/slices/agent/agent/domain/agentStatus.types.ts b/admin/slices/agent/agent/domain/agentStatus.types.ts
index 01d88bcd..77c7eccc 100644
--- a/admin/slices/agent/agent/domain/agentStatus.types.ts
+++ b/admin/slices/agent/agent/domain/agentStatus.types.ts
@@ -2,6 +2,8 @@
 // the EventSource transport and parses raw frames into these; the store applies
 // them to reactive state.
 
+import type { IAgentData } from './agent.types';
+
 export type ConnectionStateTypes =
   | 'idle'
   | 'connecting'
@@ -21,20 +23,11 @@ export interface IAgentPodStatus {
   observedAt: string;
 }
 
-export interface IAgentRecord {
-  id: string;
-  name: string;
-  status: string;
-  statusReason: string | null;
-  // Deploy/pull markers ride the stream because the API sends the full agent
-  // row in every frame; without them the header's "restarted N ago" (and the
-  // Files-tab copy banner) would freeze on the one-shot fetched row when a
-  // restart is triggered from anywhere else (CLEAN-59).
-  lastDeployStartedAt: string | null;
-  launchContext: 'initial' | 'restart' | null;
-  lastPullAt: string | null;
-  lastSyncAt: string | null;
-}
+// The API sends the full agent row (`AgentDto`) in every frame — the same
+// shape GET /agents returns. It is decoded as the same `IAgentData` so the
+// store can write it straight into the one agent record (docs/state.md); a
+// thinner projection here is what used to make the stream a second copy.
+export type IAgentRecord = IAgentData;
 
 export interface IAgentStatus {
   agent: IAgentRecord;
diff --git a/admin/slices/agent/agent/pages/agents/index.vue b/admin/slices/agent/agent/pages/agents/index.vue
index 55e82f37..c9d485fd 100644
--- a/admin/slices/agent/agent/pages/agents/index.vue
+++ b/admin/slices/agent/agent/pages/agents/index.vue
@@ -8,12 +8,15 @@
 // agent should leave the agents area, not bounce through the resolver.
 const agentStore = useAgentStore();
 
-const { data: agents, pending } = await useAsyncData('admin-agents', () =>
+// The request is awaited for its loading state; the list itself is read from
+// the store like everywhere else (docs/state.md).
+const { pending } = await useAsyncData('admin-agents', () =>
   agentStore.fetchAll(),
 );
+const { agents } = storeToRefs(agentStore);
 
 const landing = computed(() => {
-  const list = agents.value ?? [];
+  const list = agents.value;
   if (!list.length) return null;
   // The Ranch admin agent is the one an operator almost always wants: it is
   // the agent that can act on the rest of the install.
@@ -30,7 +33,7 @@ watchEffect(() => {
 </script>
 
 <template>
-  <div v-if="pending && !agents?.length" class="flex flex-col gap-3">
+  <div v-if="pending && !agents.length" class="flex flex-col gap-3">
     <Skeleton class="h-8 w-48" />
     <Skeleton class="h-64 w-full rounded-lg" />
   </div>
diff --git a/admin/slices/agent/agent/stores/agent.ts b/admin/slices/agent/agent/stores/agent.ts
index 642f1035..e6c94b65 100644
--- a/admin/slices/agent/agent/stores/agent.ts
+++ b/admin/slices/agent/agent/stores/agent.ts
@@ -87,7 +87,54 @@ function saveRestartInFlightToStorage(state: Record<string, number>): void {
 }
 
 export const useAgentStore = defineStore('agent', () => {
+  // Single source of truth (docs/state.md): an agent lives here once. Every
+  // fetch upserts into this collection, the status stream writes into it, and
+  // components render `byId(id)` — never the value a fetch handed back. A
+  // list row and a detail header are then the same object and cannot disagree.
   const agents = ref<IAgentData[]>([]);
+
+  // Plain lookup — reactive when read inside a computed.
+  function byId(id: string): IAgentData | undefined {
+    return agents.value.find((a) => a.id === id);
+  }
+
+  // Full records only (anything the API returned for one agent): replaces the
+  // row in place so the list keeps its order, appends when the id is new.
+  function upsert(agent: IAgentData): IAgentData {
+    agents.value = agents.value.some((a) => a.id === agent.id)
+      ? agents.value.map((a) => (a.id === agent.id ? agent : a))
+      : [...agents.value, agent];
+    return agent;
+  }
+
+  // Partial change to a known record — the one road for optimistic flips.
+  // Returns a rollback that restores only the fields still holding the patched
+  // value: if a fetch or a stream frame wrote something fresher in between,
+  // undoing the guess must not undo the truth.
+  function patch(id: string, partial: Partial<IAgentData>): () => void {
+    const previous = byId(id);
+    if (!previous) return () => {};
+    agents.value = agents.value.map((a) =>
+      a.id === id ? { ...a, ...partial } : a,
+    );
+    return () => {
+      const current = byId(id);
+      if (!current) return;
+      const restored: Record<string, unknown> = {};
+      for (const key of Object.keys(partial) as (keyof IAgentData)[]) {
+        if (current[key] === partial[key]) restored[key] = previous[key];
+      }
+      agents.value = agents.value.map((a) =>
+        a.id === id ? { ...a, ...(restored as Partial<IAgentData>) } : a,
+      );
+    };
+  }
+
+  // The whole collection at once — `fetchAll` and the stream's snapshot.
+  function setAll(list: IAgentData[]): void {
+    agents.value = list;
+  }
+
   const pendingRestart = ref<Record<string, true>>(
     loadPendingRestartFromStorage(),
   );
@@ -138,7 +185,7 @@ export const useAgentStore = defineStore('agent', () => {
   }
 
   async function fetchAll() {
-    agents.value = await getService().findAll();
+    setAll(await getService().findAll());
     return agents.value;
   }
 
@@ -155,12 +202,14 @@ export const useAgentStore = defineStore('agent', () => {
     return capacity.value;
   }
 
-  function fetchById(id: string) {
-    return getService().findById(id);
+  async function fetchById(id: string) {
+    const agent = await getService().findById(id);
+    return agent ? upsert(agent) : agent;
   }
 
-  function fetchAdmin() {
-    return getService().findAdmin();
+  async function fetchAdmin() {
+    const agent = await getService().findAdmin();
+    return agent ? upsert(agent) : agent;
   }
 
   async function create(data: ICreateAgentData) {
@@ -173,32 +222,22 @@ export const useAgentStore = defineStore('agent', () => {
   }
 
   async function update(id: string, data: IUpdateAgentData) {
-    const updated = await getService().update(id, data);
-    agents.value = agents.value.map((a) => (a.id === id ? updated : a));
-    return updated;
+    return upsert(await getService().update(id, data));
   }
 
   // Optimistic: flip the status so the UI reacts immediately (the lifecycle
-  // endpoints take several seconds). Revert on error.
+  // endpoints take several seconds). Revert on error. Because every screen
+  // renders this record, callers need no optimistic copy of their own.
   async function withOptimisticStatus(
     id: string,
     optimistic: IAgentData['status'],
     run: () => Promise<IAgentData>,
   ) {
-    const previous = agents.value.find((a) => a.id === id);
-    if (previous && previous.status !== optimistic) {
-      agents.value = agents.value.map((a) =>
-        a.id === id ? { ...a, status: optimistic } : a,
-      );
-    }
+    const rollback = patch(id, { status: optimistic });
     try {
-      const updated = await run();
-      agents.value = agents.value.map((a) => (a.id === id ? updated : a));
-      return updated;
+      return upsert(await run());
     } catch (err) {
-      if (previous) {
-        agents.value = agents.value.map((a) => (a.id === id ? previous : a));
-      }
+      rollback();
       throw err;
     }
   }
@@ -244,9 +283,7 @@ export const useAgentStore = defineStore('agent', () => {
   }
 
   async function demoteAdmin(id: string) {
-    const updated = await getService().demoteAdmin(id);
-    agents.value = agents.value.map((a) => (a.id === id ? updated : a));
-    return updated;
+    return upsert(await getService().demoteAdmin(id));
   }
 
   function fetchLogs(id: string): Promise<string> {
@@ -263,6 +300,10 @@ export const useAgentStore = defineStore('agent', () => {
 
   return {
     agents,
+    byId,
+    upsert,
+    patch,
+    setAll,
     capacity,
     fetchAll,
     fetchCapacity,
diff --git a/admin/slices/agent/agent/stores/agentStatus.ts b/admin/slices/agent/agent/stores/agentStatus.ts
index a0a2d56d..57f2694f 100644
--- a/admin/slices/agent/agent/stores/agentStatus.ts
+++ b/admin/slices/agent/agent/stores/agentStatus.ts
@@ -4,7 +4,6 @@ import type {
   AgentStatusStreamMessage,
   ConnectionStateTypes,
   IAgentPodStatus,
-  IAgentRecord,
 } from '#agent/domain';
 
 // Re-export the domain types so any consumer importing them from
@@ -22,7 +21,11 @@ export const useAgentStatusStore = defineStore('agentStatus', () => {
   const connectionState = ref<ConnectionStateTypes>('idle');
   const lastEventAt = ref<number | null>(null);
   const statuses = ref<Record<string, IAgentPodStatus>>({});
-  const agents = ref<Record<string, IAgentRecord>>({});
+  // No `agents` map here on purpose (docs/state.md): the agent row a frame
+  // carries is written into the agent store, the one place an agent lives.
+  // This store keeps only what exists nowhere else — pod state and hub
+  // connectivity.
+  const agentStore = useAgentStore();
   // Live hub connectivity per agent — pushed with every snapshot/event.
   const bridleConnected = ref<Record<string, boolean>>({});
 
@@ -48,29 +51,31 @@ export const useAgentStatusStore = defineStore('agentStatus', () => {
   // bridle hub — as alarming as a failing pod, surfaced the same way.
   const unreachableCount = computed(
     () =>
-      Object.values(agents.value).filter((a) => a.status === 'unreachable')
-        .length,
+      agentStore.agents.filter((a) => a.status === 'unreachable').length,
   );
 
   function applyMessage(msg: AgentStatusStreamMessage) {
     lastEventAt.value = Date.now();
     if (msg.type === 'snapshot') {
-      const nextAgents: Record<string, IAgentRecord> = {};
       const nextStatuses: Record<string, IAgentPodStatus> = {};
       const nextBridle: Record<string, boolean> = {};
       for (const item of msg.payload) {
-        nextAgents[item.agent.id] = item.agent;
         if (item.pod) nextStatuses[item.agent.id] = item.pod;
         nextBridle[item.agent.id] = item.bridleConnected;
       }
-      agents.value = nextAgents;
+      // Same rows and order as GET /agents, so it loads the collection the
+      // same way — and prunes agents deleted while the stream was down.
+      agentStore.setAll(msg.payload.map((item) => item.agent));
       statuses.value = nextStatuses;
       bridleConnected.value = nextBridle;
       return;
     }
 
     const { eventType, status } = msg.payload;
-    agents.value = { ...agents.value, [status.agent.id]: status.agent };
+    // The frame carries the full row, read from the DB when the event fired.
+    // `deleted` is about the POD (restart, stop, TTL) — the agent is still
+    // there, so the record stays.
+    agentStore.upsert(status.agent);
     bridleConnected.value = {
       ...bridleConnected.value,
       [status.agent.id]: status.bridleConnected,
@@ -110,7 +115,6 @@ export const useAgentStatusStore = defineStore('agentStatus', () => {
     connected,
     lastEventAt,
     statuses,
-    agents,
     bridleConnected,
     failingCount,
     unreachableCount,
diff --git a/admin/slices/agent/file/components/agentFile/Provider.vue b/admin/slices/agent/file/components/agentFile/Provider.vue
index ca9c1aae..eecbddff 100644
--- a/admin/slices/agent/file/components/agentFile/Provider.vue
+++ b/admin/slices/agent/file/components/agentFile/Provider.vue
@@ -16,7 +16,6 @@ import {
   IconX,
 } from '@tabler/icons-vue';
 import { until } from '@vueuse/core';
-import type { IAgentData } from '#agent/domain';
 import AgentFileTree from './Tree.vue';
 import AgentFileViewer from './Viewer.vue';
 
@@ -29,15 +28,11 @@ const confirmStore = useConfirmStore();
 // The two-copy model hint (CLEAN-50): while the agent is Running, this tab
 // shows the S3 copy but the pod works on its own — surface that instead of
 // letting the operator wonder why a chat-driven change is not visible.
-// Live-first (CLEAN-59): the SSE frame carries the fresh status and markers;
-// the one-shot fetched row would freeze the banner after a restart/stop done
-// from anywhere until the page is reloaded.
-const agent = ref<IAgentData | null>(null);
-const agentStatusStore = useAgentStatusStore();
-const liveAgent = computed(() => agentStatusStore.agents[props.id]);
-const showCopyHint = computed(
-  () => (liveAgent.value?.status ?? agent.value?.status) === 'running',
-);
+// Read from the agent store's record (docs/state.md): the status stream and
+// every fetch write into it, so a restart/stop done from anywhere — and the
+// refetch after Sync below — reach this banner without a copy of its own.
+const agent = computed(() => agentStore.byId(props.id));
+const showCopyHint = computed(() => agent.value?.status === 'running');
 
 function formatMoment(iso: string | null): string | null {
   if (!iso) return null;
@@ -45,25 +40,9 @@ function formatMoment(iso: string | null): string | null {
   return Number.isNaN(d.getTime()) ? null : d.toLocaleString();
 }
 
-// Freshest-wins for marker timestamps (CLEAN-61): the SSE stream only emits
-// on pod events, so after a Sync (no pod event) the live row keeps a STALE
-// lastSyncAt — a plain live-first `??` would let it shadow the refetched row
-// forever. Statuses stay live-first (no timestamp to compare).
-function newestIso(a: string | null | undefined, b: string | null | undefined): string | null {
-  const ta = a ? Date.parse(a) : NaN;
-  const tb = b ? Date.parse(b) : NaN;
-  if (Number.isNaN(ta)) return Number.isNaN(tb) ? null : (b as string);
-  if (Number.isNaN(tb)) return a as string;
-  return ta >= tb ? (a as string) : (b as string);
-}
-
 const copyHintDetail = computed(() => {
-  const pulled = formatMoment(
-    newestIso(liveAgent.value?.lastPullAt, agent.value?.lastPullAt),
-  );
-  const synced = formatMoment(
-    newestIso(liveAgent.value?.lastSyncAt, agent.value?.lastSyncAt),
-  );
+  const pulled = formatMoment(agent.value?.lastPullAt ?? null);
+  const synced = formatMoment(agent.value?.lastSyncAt ?? null);
   const parts: string[] = [];
   if (pulled) parts.push(`agent took its copy ${pulled}`);
   if (synced) parts.push(`last sync ${synced}`);
@@ -158,11 +137,11 @@ async function onSync() {
     // Refetch the agent row alongside the files: lastSyncAt just changed and
     // no SSE frame will carry it (the stream is pod-event driven) — without
     // this the banner shows the old "last sync" until a page reload.
-    const [freshAgent] = await Promise.all([
+    // `fetchById` upserts into the store, which is what the banner reads.
+    await Promise.all([
       agentStore.fetchById(props.id).catch(() => null),
       store.fetchList(props.id),
     ]);
-    if (freshAgent) agent.value = freshAgent;
   } catch (err) {
     syncError.value = (err as Error).message || 'Failed to load files';
   } finally {
@@ -327,12 +306,11 @@ async function onDownload() {
 useAsyncData(
   `admin-agent-files-${props.id}`,
   async () => {
-    const [agentData] = await Promise.all([
+    await Promise.all([
       // Hint-only: a failed agent fetch must not break the file browser.
       agentStore.fetchById(props.id).catch(() => null),
       store.fetchList(props.id),
     ]);
-    agent.value = agentData;
     return true;
   },
   { lazy: true },
diff --git a/admin/slices/bridle/components/bridle/Input.vue b/admin/slices/bridle/components/bridle/Input.vue
index 41e26da9..fc3d4f19 100644
--- a/admin/slices/bridle/components/bridle/Input.vue
+++ b/admin/slices/bridle/components/bridle/Input.vue
@@ -3,7 +3,7 @@ import { computed, ref } from 'vue'
 import { Textarea } from '#theme/components/ui/textarea'
 import { Button } from '#theme/components/ui/button'
 import { AlertCircle, Paperclip, Send } from 'lucide-vue-next'
-import { useBridleStore } from '../../stores/bridle'
+import { bridleKey, useBridleStore } from '../../stores/bridle'
 import AttachmentChip from './AttachmentChip.vue'
 import {
   FILE_PICKER_ACCEPT,
@@ -13,6 +13,7 @@ import {
 const props = defineProps<{
   apiUrl: string
   agentId: string
+  channel?: string
   placeholder?: string
   disabled?: boolean
 }>()
@@ -23,11 +24,19 @@ const emit = defineEmits<{
 
 const store = useBridleStore()
 
+// The composer stages files into ITS conversation — staged files were global
+// once, and showed up in every chat that was open.
+const conversationKey = computed(() => bridleKey(props.agentId, props.channel))
+const staged = computed(() => store.conversations[conversationKey.value]?.staged ?? [])
+const attachmentError = computed(
+  () => store.conversations[conversationKey.value]?.attachmentError ?? null,
+)
+
 const input = ref('')
 const textareaRef = ref<InstanceType<typeof Textarea> | null>(null)
 const fileInputRef = ref<HTMLInputElement | null>(null)
 
-const atLimit = computed(() => store.staged.length >= MAX_ATTACHMENTS_PER_MESSAGE)
+const atLimit = computed(() => staged.value.length >= MAX_ATTACHMENTS_PER_MESSAGE)
 const canAttach = computed(() => !props.disabled && !atLimit.value)
 
 /**
@@ -37,8 +46,8 @@ const canAttach = computed(() => !props.disabled && !atLimit.value)
  */
 const canSend = computed(() => {
   if (props.disabled) return false
-  if (store.isUploadingAttachment || store.hasFailedAttachment) return false
-  return input.value.trim().length > 0 || store.readyAttachments.length > 0
+  if (store.isUploadingAttachment(conversationKey.value) || store.hasFailedAttachment(conversationKey.value)) return false
+  return input.value.trim().length > 0 || store.readyAttachments(conversationKey.value).length > 0
 })
 
 const attachTitle = computed(() =>
@@ -69,7 +78,7 @@ const openPicker = () => {
 const onFilesPicked = (event: Event) => {
   const el = event.target as HTMLInputElement
   if (el.files?.length) {
-    store.stageFiles(props.apiUrl, props.agentId, el.files)
+    store.stageFiles(conversationKey.value, props.apiUrl, el.files)
   }
   // Reset so picking the same file twice in a row still fires `change`.
   el.value = ''
@@ -84,20 +93,20 @@ const onPaste = (event: ClipboardEvent) => {
   const files = Array.from(event.clipboardData?.files ?? [])
   if (!files.length) return
   event.preventDefault()
-  store.stageFiles(props.apiUrl, props.agentId, files)
+  store.stageFiles(conversationKey.value, props.apiUrl, files)
 }
 </script>
 
 <template>
   <div class="flex w-full flex-col gap-1.5">
     <!-- Staged files above the composer so it still reads as one block -->
-    <div v-if="store.staged.length" class="flex flex-wrap gap-1.5">
+    <div v-if="staged.length" class="flex flex-wrap gap-1.5">
       <AttachmentChip
-        v-for="attachment in store.staged"
+        v-for="attachment in staged"
         :key="attachment.localId"
         :attachment="attachment"
-        @remove="store.removeStaged($event)"
-        @retry="store.retryStaged(apiUrl, agentId, $event)"
+        @remove="store.removeStaged(conversationKey, $event)"
+        @retry="store.retryStaged(conversationKey, apiUrl, $event)"
       />
     </div>
 
@@ -146,17 +155,17 @@ const onPaste = (event: ClipboardEvent) => {
     <!-- Rejections are announced, not just coloured: a screen reader user gets
          no signal from a red line. -->
     <p
-      v-if="store.attachmentError"
+      v-if="attachmentError"
       class="flex items-start gap-1.5 text-[11px] text-destructive"
       role="status"
       aria-live="polite"
     >
       <AlertCircle class="mt-px h-3 w-3 shrink-0" />
-      <span>{{ store.attachmentError }}</span>
+      <span>{{ attachmentError }}</span>
       <button
         type="button"
         class="ml-1 cursor-pointer underline underline-offset-2 hover:no-underline"
-        @click="store.dismissAttachmentError()"
+        @click="store.dismissAttachmentError(conversationKey)"
       >
         Dismiss
       </button>
diff --git a/admin/slices/bridle/components/bridle/Message.vue b/admin/slices/bridle/components/bridle/Message.vue
index 6ffb77b9..f20f3177 100644
--- a/admin/slices/bridle/components/bridle/Message.vue
+++ b/admin/slices/bridle/components/bridle/Message.vue
@@ -2,7 +2,7 @@
 import { computed, ref, onBeforeUnmount, watch } from 'vue'
 import { BridlePartTypes, type IBridleMessageData } from '../../stores/bridle'
 import { renderMarkdown } from '../../utils/markdown'
-import { Bot, User, FileText, Info, X } from 'lucide-vue-next'
+import { AlertCircle, Bot, User, FileText, Info, Loader2, X } from 'lucide-vue-next'
 import { Button } from '#theme/components/ui/button'
 import { cn } from '#theme/utils/cn'
 
@@ -24,10 +24,45 @@ const showAgentText = computed(
 
 defineEmits<{
   inspect: [id: string]
+  resend: [id: string]
+  discard: [id: string]
 }>()
 
 const isUser = computed(() => props.message.role === 'user')
 
+// ── Time and delivery line ───────────────────────────────────
+// The admin panel is English-only, hence the fixed locale. Built once per
+// bubble, not per render — constructing a formatter is the expensive part.
+const timeFormat = new Intl.DateTimeFormat('en', { hour: '2-digit', minute: '2-digit' })
+const dateTimeFormat = new Intl.DateTimeFormat('en', { dateStyle: 'medium', timeStyle: 'medium' })
+
+// `format` throws on an invalid date; a message with a broken `ts` should
+// lose its time line, not take the whole chat down.
+const hasTime = computed(() => Number.isFinite(props.message.ts))
+const timeOfDay = computed(() => (hasTime.value ? timeFormat.format(props.message.ts) : ''))
+const fullDateTime = computed(() => (hasTime.value ? dateTimeFormat.format(props.message.ts) : ''))
+const isoDateTime = computed(() => (hasTime.value ? new Date(props.message.ts).toISOString() : undefined))
+
+// Only the operator's own messages have a delivery state; absent means
+// delivered (anything replayed from the transcript).
+const delivery = computed(() => (isUser.value ? props.message.delivery ?? 'delivered' : 'delivered'))
+
+/** Short, plain reason next to "Not delivered" — one per failure code. */
+const failureReason = computed(() => {
+  switch (props.message.failureCode) {
+    case 'AGENT_OFFLINE':
+      return 'the agent is offline'
+    case 'OFFLINE':
+      return 'the chat is not connected'
+    case 'TIMEOUT':
+      return 'no confirmation from the server'
+    case 'ATTACHMENT_FAILED':
+      return 'an attachment could not be read'
+    default:
+      return 'the server rejected it'
+  }
+})
+
 // Markdown rendering applies only to assistant messages — user input stays
 // plain text so pasted content can't accidentally be rendered as HTML.
 function htmlFor(text: string): string {
@@ -85,7 +120,11 @@ onBeforeUnmount(() => {
 </script>
 
 <template>
+  <!-- data-* are hooks for browser checks: which message, whose, in what state. -->
   <div
+    :data-message-id="message.id"
+    :data-role="message.role"
+    :data-delivery="delivery"
     :class="cn(
       'flex gap-3 max-w-[85%]',
       isUser ? 'ml-auto flex-row-reverse' : 'mr-auto',
@@ -101,76 +140,119 @@ onBeforeUnmount(() => {
       <Bot v-else class="h-4 w-4" />
     </div>
 
-    <div
-      :class="cn(
-        'min-w-0 rounded-lg px-3 py-2 text-sm space-y-2',
-        isUser ? 'bg-primary text-primary-foreground' : 'bg-muted',
-        !isUser && markdownEnabled && 'chat-md',
-        message.streaming && 'border-l-2 border-primary',
-      )"
-    >
-      <template v-for="(part, i) in message.parts" :key="i">
-        <template v-if="part.type === BridlePartTypes.Text">
+    <!-- Bubble + the line under it (time, delivery state) as one column, so
+         the line hugs the bubble's own edge on either side of the chat. -->
+    <div :class="cn('flex min-w-0 flex-col gap-1', isUser ? 'items-end' : 'items-start')">
+      <div
+        :class="cn(
+          'min-w-0 rounded-lg px-3 py-2 text-sm space-y-2',
+          isUser ? 'bg-primary text-primary-foreground' : 'bg-muted',
+          !isUser && markdownEnabled && 'chat-md',
+          message.streaming && 'border-l-2 border-primary',
+        )"
+      >
+        <template v-for="(part, i) in message.parts" :key="i">
+          <template v-if="part.type === BridlePartTypes.Text">
+            <div
+              v-if="!isUser && markdownEnabled"
+              class="min-w-0 wrap-break-word"
+              v-html="htmlFor(part.text)"
+              @click="onMarkdownClick"
+            />
+            <p v-else class="whitespace-pre-wrap wrap-break-word">{{ part.text }}</p>
+          </template>
+
+          <img
+            v-else-if="part.type === BridlePartTypes.Image"
+            :src="`data:${part.mediaType};base64,${part.base64}`"
+            :alt="`Image ${i + 1}`"
+            class="max-w-full cursor-zoom-in rounded transition-opacity hover:opacity-90"
+            @click="openLightbox(`data:${part.mediaType};base64,${part.base64}`)"
+          />
+
+          <!-- An url-less chip is a replayed attachment whose stored object is
+               gone — still named, no longer clickable. -->
+          <component
+            :is="part.url ? 'a' : 'div'"
+            v-else-if="part.type === BridlePartTypes.File"
+            :href="part.url || undefined"
+            :target="part.url ? '_blank' : undefined"
+            :rel="part.url ? 'noopener' : undefined"
+            :title="part.url ? part.name : 'Attachment is no longer available'"
+            class="flex items-center gap-2 px-2 py-1 rounded border text-xs"
+            :class="part.url ? 'hover:bg-background/50' : 'opacity-60'"
+          >
+            <FileText class="h-3.5 w-3.5 shrink-0" />
+            <span class="truncate">{{ part.name }}</span>
+          </component>
+        </template>
+
+        <!-- Fallback: if no parts, show plain text (or markdown for assistant) -->
+        <template v-if="message.parts.length === 0 && !showAgentText">
           <div
             v-if="!isUser && markdownEnabled"
             class="min-w-0 wrap-break-word"
-            v-html="htmlFor(part.text)"
+            v-html="htmlFor(message.text)"
             @click="onMarkdownClick"
           />
-          <p v-else class="whitespace-pre-wrap wrap-break-word">{{ part.text }}</p>
+          <p v-else class="whitespace-pre-wrap wrap-break-word">{{ message.text }}</p>
         </template>
 
-        <img
-          v-else-if="part.type === BridlePartTypes.Image"
-          :src="`data:${part.mediaType};base64,${part.base64}`"
-          :alt="`Image ${i + 1}`"
-          class="max-w-full cursor-zoom-in rounded transition-opacity hover:opacity-90"
-          @click="openLightbox(`data:${part.mediaType};base64,${part.base64}`)"
-        />
-
-        <!-- An url-less chip is a replayed attachment whose stored object is
-             gone — still named, no longer clickable. -->
-        <component
-          :is="part.url ? 'a' : 'div'"
-          v-else-if="part.type === BridlePartTypes.File"
-          :href="part.url || undefined"
-          :target="part.url ? '_blank' : undefined"
-          :rel="part.url ? 'noopener' : undefined"
-          :title="part.url ? part.name : 'Attachment is no longer available'"
-          class="flex items-center gap-2 px-2 py-1 rounded border text-xs"
-          :class="part.url ? 'hover:bg-background/50' : 'opacity-60'"
-        >
-          <FileText class="h-3.5 w-3.5 shrink-0" />
-          <span class="truncate">{{ part.name }}</span>
-        </component>
-      </template>
-
-      <!-- Fallback: if no parts, show plain text (or markdown for assistant) -->
-      <template v-if="message.parts.length === 0 && !showAgentText">
-        <div
-          v-if="!isUser && markdownEnabled"
-          class="min-w-0 wrap-break-word"
-          v-html="htmlFor(message.text)"
-          @click="onMarkdownClick"
-        />
-        <p v-else class="whitespace-pre-wrap wrap-break-word">{{ message.text }}</p>
-      </template>
-
-      <!-- What the agent received: typed text + inlined attachment blocks.
-           Debug-only, collapsed by default — the bubble above is the message. -->
-      <div v-if="showAgentText" class="border-t border-primary-foreground/20 pt-1.5">
-        <button
-          type="button"
-          class="flex items-center gap-1 text-[11px] opacity-80 hover:opacity-100"
-          @click="agentTextOpen = !agentTextOpen"
-        >
-          <Info class="h-3 w-3" />
-          <span>{{ agentTextOpen ? 'Hide what the agent received' : 'What the agent received' }}</span>
-        </button>
-        <pre
-          v-if="agentTextOpen"
-          class="mt-1.5 max-h-[40vh] overflow-auto rounded bg-background/20 p-2 text-[11px] leading-snug whitespace-pre-wrap wrap-break-word"
-        >{{ message.agentText }}</pre>
+        <!-- What the agent received: typed text + inlined attachment blocks.
+             Debug-only, collapsed by default — the bubble above is the message. -->
+        <div v-if="showAgentText" class="border-t border-primary-foreground/20 pt-1.5">
+          <button
+            type="button"
+            class="flex items-center gap-1 text-[11px] opacity-80 hover:opacity-100"
+            @click="agentTextOpen = !agentTextOpen"
+          >
+            <Info class="h-3 w-3" />
+            <span>{{ agentTextOpen ? 'Hide what the agent received' : 'What the agent received' }}</span>
+          </button>
+          <pre
+            v-if="agentTextOpen"
+            class="mt-1.5 max-h-[40vh] overflow-auto rounded bg-background/20 p-2 text-[11px] leading-snug whitespace-pre-wrap wrap-break-word"
+          >{{ message.agentText }}</pre>
+        </div>
+      </div>
+
+      <div
+        v-if="hasTime || delivery !== 'delivered'"
+        class="flex flex-wrap items-center gap-x-1.5 gap-y-0.5 px-1 text-[10px] text-muted-foreground"
+        :class="isUser && 'justify-end'"
+      >
+        <time v-if="hasTime" :datetime="isoDateTime" :title="fullDateTime">{{ timeOfDay }}</time>
+
+        <!-- Delivered says nothing: the time alone is the normal case. -->
+        <span v-if="delivery === 'sending'" class="opacity-70" role="status">Sending…</span>
+
+        <span v-else-if="delivery === 'slow'" class="flex items-center gap-1" role="status">
+          <Loader2 class="h-3 w-3 animate-spin" />
+          Taking longer than usual…
+        </span>
+
+        <!-- Announced, not just coloured: this is the one state the person
+             has to act on, or the message is gone. -->
+        <template v-else-if="delivery === 'failed'">
+          <span class="flex items-center gap-1 text-destructive" role="alert">
+            <AlertCircle class="h-3 w-3 shrink-0" />
+            Not delivered — {{ failureReason }}
+          </span>
+          <button
+            type="button"
+            class="cursor-pointer font-medium text-foreground underline underline-offset-2 hover:no-underline"
+            @click="$emit('resend', message.id)"
+          >
+            Resend
+          </button>
+          <button
+            type="button"
+            class="cursor-pointer underline underline-offset-2 hover:no-underline"
+            @click="$emit('discard', message.id)"
+          >
+            Discard
+          </button>
+        </template>
       </div>
     </div>
 
diff --git a/admin/slices/bridle/components/bridle/Provider.vue b/admin/slices/bridle/components/bridle/Provider.vue
index fa5eb930..0a42566c 100644
--- a/admin/slices/bridle/components/bridle/Provider.vue
+++ b/admin/slices/bridle/components/bridle/Provider.vue
@@ -1,7 +1,8 @@
 <script setup lang="ts">
-import { ref, computed, nextTick, watch, onMounted, onUnmounted, type HTMLAttributes } from 'vue'
+import { ref, computed, nextTick, toRefs, watch, onMounted, onUnmounted, type HTMLAttributes } from 'vue'
 import { storeToRefs } from 'pinia'
-import { useBridleStore, type IBridleMessageData, type IBridleThinkingStep, type IThinkingBlock } from '../../stores/bridle'
+import { useBridleStore, type IBridleThinkingStep, type IThinkingBlock } from '../../stores/bridle'
+import { buildChatFlow, type IChatFlowDayItem } from '../../utils/chatFlow'
 import Message from './Message.vue'
 import Input from './Input.vue'
 import DropZone from './DropZone.vue'
@@ -20,6 +21,9 @@ import { shouldShowOfflineHint } from '../../utils/offlineHint'
 const props = withDefaults(defineProps<{
   apiUrl: string
   agentId: string
+  // Which of the agent's conversations this is. The admin panel has one —
+  // every Owner/Admin shares the `admin` channel.
+  channel?: string
   title?: string
   placeholder?: string
   class?: HTMLAttributes['class']
@@ -45,6 +49,7 @@ const props = withDefaults(defineProps<{
   // agent page otherwise loads the same agent twice on every open.
   initialDebugEnabled?: boolean | null
 }>(), {
+  channel: 'admin',
   title: 'Agent Chat',
   placeholder: 'Type a message...',
   showStatus: true,
@@ -56,34 +61,48 @@ const props = withDefaults(defineProps<{
 
 const store = useBridleStore()
 const authStore = useAuthStore()
+const { markdownEnabled } = storeToRefs(store)
+
+// This chat's own record in the store — messages, flags, socket, staged files.
+// Every mounted chat used to share one; the Rancher panel and an agent's Chat
+// tab then wrote into each other's conversation (CLEAN-102). Taken once, in
+// setup: hosts remount this widget per agent rather than swapping `agentId`.
+const conversation = store.acquire(props.agentId, props.channel)
+const conversationKey = conversation.key
 const {
   messages,
   isConnected,
   isAgentConnected,
   isTyping,
   debugEnabled,
-  markdownEnabled,
   hasMoreOlder,
   loadingOlder,
   thinkingBlocks,
-} = storeToRefs(store)
+  notice,
+} = toRefs(conversation)
 
 // ── Thinking timeline (CLEAN-10) ─────────────────────────────────────
-// Messages and thinking blocks interleaved by timestamp — a frozen block
-// stays anchored above the answer it produced, Rovo-style.
+// Messages and thinking blocks interleaved by arrival order (`seq`) — a frozen
+// block stays anchored above the answer it produced, Rovo-style. Never by
+// `ts`: the operator's message carries the browser's clock and the reply the
+// agent's, and a skew between them put answers above their questions.
 const thinkingLabel = computed(() => `${props.title} is thinking…`)
 const hasOpenThinking = computed(() => thinkingBlocks.value.some(b => b.status === 'thinking'))
 
-interface IChatFlowItem {
-  message?: IBridleMessageData
-  block?: IThinkingBlock
-  ts: number
+// Start of the local day — all "Today" / "Yesterday" needs. Derived from the
+// 1s clock below but only changes at midnight, so the flow is not rebuilt
+// every second.
+const dayStartMs = computed(() => new Date(nowMs.value).setHours(0, 0, 0, 0))
+
+const chatFlow = computed(() =>
+  buildChatFlow(messages.value, thinkingBlocks.value, { locale: 'en', now: dayStartMs.value }),
+)
+
+function dayLabel(item: IChatFlowDayItem): string {
+  if (item.relative === 'today') return 'Today'
+  if (item.relative === 'yesterday') return 'Yesterday'
+  return item.label
 }
-const chatFlow = computed<IChatFlowItem[]>(() => {
-  const items: IChatFlowItem[] = messages.value.map(m => ({ message: m, ts: m.ts }))
-  for (const b of thinkingBlocks.value) items.push({ block: b, ts: b.ts })
-  return items.sort((a, b) => a.ts - b.ts)
-})
 
 // A turn may span several segments (blocks) — turnId + seg identifies one.
 function blockKey(b: IThinkingBlock): string {
@@ -113,7 +132,7 @@ const togglingDebug = ref(false)
 async function onToggleDebug() {
   togglingDebug.value = true
   try {
-    await store.setDebugEnabled(props.apiUrl, props.agentId, !debugEnabled.value)
+    await store.setDebugEnabled(props.apiUrl, props.agentId, !debugEnabled.value, props.channel)
   } finally {
     togglingDebug.value = false
   }
@@ -121,7 +140,7 @@ async function onToggleDebug() {
 
 const inspectedMessageId = ref<string | null>(null)
 const inspectedDebug = computed(() =>
-  inspectedMessageId.value ? store.getDebugForMessage(inspectedMessageId.value) : null,
+  inspectedMessageId.value ? store.getDebugForMessage(conversationKey, inspectedMessageId.value) : null,
 )
 const isDebugOpen = computed({
   get: () => inspectedMessageId.value !== null,
@@ -273,7 +292,7 @@ async function onScroll() {
 
   const prevScrollHeight = viewport.scrollHeight
   const prevScrollTop = viewport.scrollTop
-  const added = await store.loadOlderTranscript(props.apiUrl, props.agentId)
+  const added = await store.loadOlderTranscript(props.apiUrl, props.agentId, props.channel)
   if (added <= 0) return
 
   // Preserve the visual position of whatever the user was looking at by
@@ -284,7 +303,7 @@ async function onScroll() {
 }
 
 watch(
-  () => [messages.value.length, isTyping.value, thinkingBlocks.value.reduce((n, b) => n + b.steps.length, 0)],
+  () => [messages.value.length, isTyping.value, thinkingBlocks.value.reduce((n, b) => n + b.steps.length, 0), notice.value],
   async () => {
     // Capture BEFORE the DOM grows: follow only a reader who was already at
     // the bottom — never yank back someone who scrolled up to re-read.
@@ -300,6 +319,7 @@ watch(
 // Cleanup handle for the viewport scroll listener attached in onMounted.
 // Stored as a let so onUnmounted can detach the exact same callback.
 let detachScrollListener: (() => void) | null = null
+let unmounted = false
 
 onMounted(async () => {
   // Start the clock before anything that awaits: both time-gated surfaces (the
@@ -311,24 +331,31 @@ onMounted(async () => {
   }, 1000)
   // Replay persisted history first so the chat isn't blank between
   // page refreshes / agent switches; then connect the WS for live updates.
-  // Clear before load so the previous agent's messages don't briefly leak
-  // through (the store is a shared singleton across providers).
-  store.clearMessages()
+  // No clearing first: the record is this conversation's alone, and the load
+  // MERGES — not-delivered messages and a turn still in flight stay put.
   // The host may already hold the agent record (admin page useAsyncData) —
   // seeding from the prop avoids a duplicate GET /agents/:id on every open.
   if (props.initialDebugEnabled !== null) {
-    store.debugEnabled = props.initialDebugEnabled
-    await store.loadTranscript(props.apiUrl, props.agentId)
+    conversation.debugEnabled = props.initialDebugEnabled
+    await store.loadTranscript(props.apiUrl, props.agentId, props.channel)
   } else {
     await Promise.all([
-      store.loadTranscript(props.apiUrl, props.agentId),
-      store.loadAgentMeta(props.apiUrl, props.agentId),
+      store.loadTranscript(props.apiUrl, props.agentId, props.channel),
+      store.loadAgentMeta(props.apiUrl, props.agentId, props.channel),
     ])
   }
+  // Left while the transcript was loading — connecting now would open a
+  // socket nobody is around to close.
+  if (unmounted) return
   // Re-attach debug snapshots saved in localStorage from previous sessions —
   // makes the inspect icon survive a page refresh.
-  store.loadPersistedDebug(props.agentId)
-  await store.connect(props.apiUrl, props.agentId)
+  store.loadPersistedDebug(props.agentId, props.channel)
+  await store.connect(props.apiUrl, props.agentId, props.channel)
+  if (unmounted) {
+    // Same race, one await later: hang up unless another chat holds the key.
+    if (conversation.holders === 0) store.disconnect(conversationKey)
+    return
+  }
   await nextTick()
   scrollToBottom('auto')
 
@@ -351,7 +378,10 @@ onUnmounted(() => {
     detachScrollListener()
     detachScrollListener = null
   }
-  store.disconnect()
+  unmounted = true
+  // The last chat showing this conversation closes its socket and drops the
+  // staged files (their object URLs would otherwise leak).
+  store.release(conversationKey)
 })
 
 /**
@@ -362,8 +392,20 @@ const inputDisabled = computed(
   () => !isConnected.value || !isAgentConnected.value || props.agentState !== null,
 )
 
-const handleSend = (text: string) => {
-  void store.sendMessage(text)
+const handleSend = async (text: string) => {
+  await store.sendMessage(conversationKey, text)
+  // Sending always lands on the new message, wherever the reader was — the
+  // near-bottom rule above is for INCOMING content only.
+  await nextTick()
+  scrollToBottom()
+}
+
+const onResend = (id: string) => {
+  store.resend(conversationKey, id)
+}
+
+const onDiscard = (id: string) => {
+  store.discard(conversationKey, id)
 }
 
 // ── Drag and drop ────────────────────────────
@@ -417,7 +459,7 @@ function onDrop(event: DragEvent) {
 
   const files = event.dataTransfer?.files
   if (files?.length) {
-    store.stageFiles(props.apiUrl, props.agentId, files)
+    store.stageFiles(conversationKey, props.apiUrl, files)
   }
 }
 
@@ -428,7 +470,7 @@ watch(
   () => authStore.isAuthenticated,
   (signedIn) => {
     if (signedIn && !isConnected.value) {
-      void store.connect(props.apiUrl, props.agentId)
+      void store.connect(props.apiUrl, props.agentId, props.channel)
     }
   },
 )
@@ -450,8 +492,6 @@ onMounted(() => {
 onUnmounted(() => {
   window.removeEventListener('dragover', preventWindowDrop)
   window.removeEventListener('drop', preventWindowDrop)
-  // Object URLs for anything still staged would otherwise leak.
-  store.clearStaged()
 })
 
 const confirmResetOpen = ref(false)
@@ -460,9 +500,9 @@ const resetting = ref(false)
 async function onConfirmReset() {
   resetting.value = true
   try {
-    store.disconnect()
-    await store.resetTranscript(props.apiUrl, props.agentId)
-    await store.connect(props.apiUrl, props.agentId)
+    store.disconnect(conversationKey)
+    await store.resetTranscript(props.apiUrl, props.agentId, props.channel)
+    await store.connect(props.apiUrl, props.agentId, props.channel)
   } finally {
     resetting.value = false
   }
@@ -549,18 +589,26 @@ async function onConfirmReset() {
 
           <template
             v-for="item in chatFlow"
-            :key="item.message ? item.message.id : (item.block ? blockKey(item.block) : '')"
+            :key="item.key"
           >
             <Message
-              v-if="item.message"
+              v-if="item.kind === 'message'"
               :message="item.message"
-              :has-debug="item.message.role === 'assistant' && !!store.getDebugForMessage(item.message.id)"
+              :has-debug="item.message.role === 'assistant' && !!store.getDebugForMessage(conversationKey, item.message.id)"
               :markdown-enabled="markdownEnabled"
               :debug-enabled="debugEnabled"
               @inspect="inspectedMessageId = $event"
+              @resend="onResend"
+              @discard="onDiscard"
             />
             <div
-              v-else-if="item.block"
+              v-else-if="item.kind === 'day'"
+              class="flex items-center justify-center py-1 text-[10px] uppercase tracking-wide text-muted-foreground/60"
+            >
+              {{ dayLabel(item) }}
+            </div>
+            <div
+              v-else-if="item.kind === 'block'"
               class="mr-auto flex max-w-full flex-col gap-1.5 px-1"
               :role="item.block.status === 'thinking' ? 'status' : undefined"
               :aria-label="item.block.status === 'thinking' ? thinkingLabel : undefined"
@@ -636,6 +684,16 @@ async function onConfirmReset() {
             </div>
             <span class="shimmer shimmer-duration-1600 text-sm font-medium text-muted-foreground">{{ thinkingLabel }}</span>
           </div>
+
+          <!-- A turn that went silent says so, instead of the shimmer just
+               disappearing as if nothing had been asked. -->
+          <p
+            v-if="notice"
+            class="text-center text-xs text-muted-foreground"
+            role="status"
+          >
+            {{ notice }}
+          </p>
         </div>
       </ScrollArea>
     </CardContent>
@@ -670,6 +728,7 @@ async function onConfirmReset() {
         v-else
         :api-url="apiUrl"
         :agent-id="agentId"
+        :channel="channel"
         :placeholder="placeholder"
         :disabled="inputDisabled"
         @send="handleSend"
diff --git a/admin/slices/bridle/stores/bridle.ts b/admin/slices/bridle/stores/bridle.ts
index 064a9834..d9c9c3ed 100644
--- a/admin/slices/bridle/stores/bridle.ts
+++ b/admin/slices/bridle/stores/bridle.ts
@@ -1,3 +1,4 @@
+import { markRaw } from 'vue'
 import { defineStore } from 'pinia'
 import { io, type Socket } from 'socket.io-client'
 import { useAuthStore } from '#auth/stores/auth'
@@ -16,6 +17,14 @@ import {
   type IStagedAttachment,
   type IUploadedAttachment,
 } from '../utils/attachment'
+import { nextSeq, numberLegacy } from '../utils/chatFlow'
+import {
+  FAILED_MS,
+  SLOW_MS,
+  nextDelivery,
+  type BridleDelivery,
+  type DeliveryEvent,
+} from '../utils/delivery'
 
 export enum BridlePartTypes {
   Text = 'text',
@@ -43,12 +52,52 @@ export interface IBridleFilePart {
 
 export type BridlePart = IBridleTextPart | IBridleImagePart | IBridleFilePart
 
+/**
+ * Stored-attachment reference. Metadata only — the bytes stay behind
+ * `GET /api/agent/:id/attachment/:id`, which needs the bearer, so the store
+ * downloads them and hands the DOM base64/object URLs.
+ */
+export interface IBridleAttachmentRef {
+  id: string
+  name: string
+  mimeType: string
+  size: number
+  kind: 'image' | 'text' | 'binary'
+}
+
+/** What the hub answers a `message` with (contracts/bridle-socket.md). */
+export type BridleSendAck =
+  | { status: 'accepted'; messageId: string; ts: number; duplicate?: true }
+  | { status: 'rejected'; code: string; message?: string }
+
 export interface IBridleMessageData {
+  /**
+   * One id per message end to end: the operator's message uses the UUID minted
+   * at send (also its `clientMessageId` on the wire), an agent message the wire
+   * `messageId`, a replayed message the transcript event id.
+   */
   id: string
   role: 'user' | 'assistant'
   text: string
   parts: BridlePart[]
+  /** Display only — two clocks stamp it. Never used for ordering (see `seq`). */
   ts: number
+  /**
+   * Per-conversation arrival sequence, assigned by the store on append. The
+   * only ordering key (utils/chatFlow.ts).
+   */
+  seq?: number
+  /** Operator's messages only. Absent means delivered (replayed messages). */
+  delivery?: BridleDelivery
+  /** Why `delivery` is `failed` — drives the wording under the bubble. */
+  failureCode?: string
+  /**
+   * References of the files sent with the operator's message. Kept so a resend
+   * — also after a reload, from the outbox — carries the same attachments.
+   */
+  attachments?: IBridleAttachmentRef[]
+  /** Came from the transcript, not from this session's live traffic. */
+  replayed?: true
   streaming?: boolean
   /**
    * Replayed user turns with attachments only: the full text the model
@@ -112,6 +161,8 @@ export interface IThinkingBlock {
   steps: IBridleThinkingStep[]
   status: 'thinking' | 'done'
   ts: number
+  /** Arrival sequence, assigned when the segment opens — orders it in the flow. */
+  seq?: number
 }
 
 /**
@@ -210,18 +261,8 @@ function clearDebugFromStorage(agentId: string): void {
 // covers the typical visible window without needing an immediate second page.
 const TRANSCRIPT_PAGE_SIZE = 50
 
-/**
- * Stored-attachment reference riding a transcript message. Metadata only —
- * the bytes stay behind `GET /api/agent/:id/attachment/:id`, which needs the
- * bearer, so the store downloads them and hands the DOM base64/object URLs.
- */
-interface ITranscriptAttachment {
-  id: string
-  name: string
-  mimeType: string
-  size: number
-  kind: 'image' | 'text' | 'binary'
-}
+/** Stored-attachment reference riding a transcript message. */
+type ITranscriptAttachment = IBridleAttachmentRef
 
 interface ITranscriptPageMessage {
   id: string
@@ -343,6 +384,7 @@ function toBridleMessage(m: ITranscriptPageMessage): IBridleMessageData {
     // a blank line above its image once hydration fills the parts in.
     parts: m.text ? [{ type: BridlePartTypes.Text as const, text: m.text }] : [],
     ts: m.ts,
+    replayed: true,
     ...(m.agentText ? { agentText: m.agentText } : {}),
   }
 }
@@ -369,127 +411,364 @@ function hasVisibleContent(text: string, parts: BridlePart[]): boolean {
   })
 }
 
-export const useBridleStore = defineStore('bridle', {
-  state: () => ({
-    messages: [] as IBridleMessageData[],
-    /**
-     * Opaque cursor returned by the API for fetching older messages. `null`
-     * means there are no more older messages to load (or transcript hasn't
-     * been fetched yet — `hasMoreOlder` distinguishes those).
-     */
-    transcriptCursor: null as string | null,
+// ── Conversations ────────────────────────────────────────────
+// One record per conversation, keyed `<agentId>:<channel>`. Before CLEAN-102
+// this store held ONE message list, ONE socket and ONE set of flags for every
+// mounted chat, so the Rancher panel and an agent's Chat tab wrote into each
+// other's conversation (research F3). Everything a chat renders from now lives
+// in its own record; only what is genuinely app-wide stays global.
+
+/** The admin panel's channel — every Owner/Admin shares it. */
+const DEFAULT_CHANNEL = 'admin'
+
+/** Key of one conversation record. */
+export function bridleKey(agentId: string, channel = DEFAULT_CHANNEL): string {
+  return `${agentId}:${channel}`
+}
+
+export interface IBridleConversation {
+  key: string
+  agentId: string
+  channel: string
+  /** Captured on connect — the socket's own recoveries need it (transcript merge). */
+  apiUrl: string | null
+  /**
+   * Mounted providers showing this conversation. The socket closes when the
+   * last one leaves, so a provider that unmounts during a route change cannot
+   * cut off the one that just mounted for the same key.
+   */
+  holders: number
+  messages: IBridleMessageData[]
+  /**
+   * Live thinking timelines, one per agent turn — opened by the first
+   * `thinking` event, frozen by its terminal `done` event (or when the stale
+   * watchdog fires). Session-only.
+   */
+  thinkingBlocks: IThinkingBlock[]
+  /** Turns terminally closed (done event / watchdog / deliberate disconnect) —
+   * straggler steps for these must not resurrect a segment. */
+  closedTurns: Record<string, true>
+  /** Next arrival sequence to hand out — see `IBridleMessageData.seq`. */
+  nextSeq: number
+  /**
+   * Highest hub `seq` applied. Sent as `lastSeq` on every (re)connect so the
+   * hub replays what a reconnect gap swallowed; anything at or below it is a
+   * replay overlap and is ignored.
+   */
+  lastHubSeq: number
+  /**
+   * `ts` of the newest message the loaded transcript holds (runtime clock).
+   * Agent content stamped at or before it is already on screen as transcript.
+   */
+  transcriptTailTs: number
+  /**
+   * Opaque cursor returned by the API for fetching older messages. `null`
+   * means there are no more older messages to load (or transcript hasn't
+   * been fetched yet — `hasMoreOlder` distinguishes those).
+   */
+  transcriptCursor: string | null
+  hasMoreOlder: boolean
+  loadingOlder: boolean
+  isConnected: boolean
+  /**
+   * Whether the agent runtime is currently registered with the bridle hub.
+   * Pushed by the hub via the `agent_status` event on connect and on every
+   * runtime register/unregister. Independent of `isConnected` (the client's
+   * own WS) — the chat header needs both signals to color the indicator.
+   */
+  isAgentConnected: boolean
+  isTyping: boolean
+  clientId: string | null
+  /** Plain line under the flow — a turn that died without an answer says so. */
+  notice: string | null
+  /**
+   * Debug snapshots keyed by messageId when the runtime supplies one;
+   * otherwise stored in `lastDebug` and attached to the most recent
+   * assistant message via `getDebugForMessage`.
+   */
+  debugByMessageId: Record<string, IBridleDebugData>
+  lastDebug: IBridleDebugData | null
+  /**
+   * Local mirror of the agent's `debugEnabled` flag, populated by
+   * `loadAgentMeta`. UI reads this to render the toggle state. Persistent
+   * source of truth lives on the API; runtime gets it via WS push.
+   */
+  debugEnabled: boolean
+  /** Files picked but not yet sent. Emptied when the message goes out. */
+  staged: IStagedAttachment[]
+  /** Last rejection, shown under the composer until the next action. */
+  attachmentError: string | null
+  /**
+   * Object URLs minted for the local echo of a sent non-image attachment.
+   * The download route needs a bearer token and a plain link cannot carry
+   * one, so the bubble links the bytes we already hold. Revoked when the
+   * transcript is cleared.
+   */
+  echoUrls: string[]
+  socket: Socket | null
+  thinkingStaleTimer: ReturnType<typeof setTimeout> | null
+  /**
+   * One reconnect per auth rejection: after the hub refuses the token we
+   * refresh and connect again once; a second refusal ends the session
+   * instead of looping. Reset on every successful connect.
+   */
+  authRetried: boolean
+}
+
+function createConversation(agentId: string, channel: string): IBridleConversation {
+  return {
+    key: bridleKey(agentId, channel),
+    agentId,
+    channel,
+    apiUrl: null,
+    holders: 0,
+    messages: [],
+    thinkingBlocks: [],
+    closedTurns: {},
+    nextSeq: 1,
+    lastHubSeq: 0,
+    transcriptTailTs: 0,
+    transcriptCursor: null,
     hasMoreOlder: false,
     loadingOlder: false,
     isConnected: false,
-    /**
-     * Whether the agent runtime is currently registered with the bridle hub.
-     * Pushed by the hub via the `agent_status` event on connect and on every
-     * runtime register/unregister. Independent of `isConnected` (the client's
-     * own WS) — the chat header needs both signals to color the indicator.
-     */
     isAgentConnected: false,
     isTyping: false,
-    isOpen: false,
-    clientId: null as string | null,
-    /**
-     * Live thinking timelines, one per agent turn — opened by the first
-     * `thinking` event, frozen by its terminal `done` event (or when the
-     * socket drops / the stale watchdog fires). Session-only.
-     */
-    thinkingBlocks: [] as IThinkingBlock[],
-    _thinkingStaleTimer: null as ReturnType<typeof setTimeout> | null,
-    /** Turns terminally closed (done event / watchdog / disconnect) —
-     * straggler steps for these must not resurrect a segment. */
-    _closedTurns: {} as Record<string, true>,
-    /**
-     * Debug snapshots keyed by messageId when the runtime supplies one;
-     * otherwise stored in `_lastDebug` and attached to the most recent
-     * assistant message via `getDebugForMessage`.
-     */
-    debugByMessageId: {} as Record<string, IBridleDebugData>,
-    _lastDebug: null as IBridleDebugData | null,
-    /**
-     * Local mirror of the agent's `debugEnabled` flag, populated by
-     * `loadAgentMeta`. UI reads this to render the toggle state. Persistent
-     * source of truth lives on the API; runtime gets it via WS push.
-     */
+    clientId: null,
+    notice: null,
+    debugByMessageId: {},
+    lastDebug: null,
     debugEnabled: false,
+    staged: [],
+    attachmentError: null,
+    echoUrls: [],
+    socket: null,
+    thinkingStaleTimer: null,
+    authRetried: false,
+  }
+}
+
+/**
+ * False for a hub event this conversation has already applied — after a
+ * reconnect the hub replays from `lastSeq`, and an overlap must be harmless.
+ * An event without `seq` (older hub) always passes.
+ */
+function acceptHubSeq(c: IBridleConversation, seq: unknown): boolean {
+  if (typeof seq !== 'number') return true
+  if (seq <= c.lastHubSeq) return false
+  c.lastHubSeq = seq
+  return true
+}
+
+function hasOpenTurn(c: IBridleConversation): boolean {
+  return (
+    c.isTyping ||
+    c.thinkingBlocks.some(b => b.status === 'thinking') ||
+    c.messages.some(m => m.streaming)
+  )
+}
+
+// ── Outbox ───────────────────────────────────────────────────
+// The admin keeps no conversation locally — a reload shows the transcript. A
+// message the agent never received is in no transcript, so without this it
+// would vanish on reload, silently (research F2). The outbox holds exactly the
+// operator's messages that are NOT delivered: text and attachment references,
+// never image bytes.
+
+const OUTBOX_STORAGE_PREFIX = 'bridle:outbox:'
+
+interface IOutboxEntry {
+  id: string
+  text: string
+  ts: number
+  delivery: BridleDelivery
+  failureCode?: string
+  attachments?: IBridleAttachmentRef[]
+}
+
+function loadOutbox(key: string): IOutboxEntry[] {
+  if (typeof window === 'undefined') return []
+  try {
+    const raw = window.localStorage.getItem(OUTBOX_STORAGE_PREFIX + key)
+    if (!raw) return []
+    const parsed = JSON.parse(raw) as unknown
+    if (!Array.isArray(parsed)) return []
+    return (parsed as IOutboxEntry[]).filter(
+      e => !!e && typeof e.id === 'string' && typeof e.text === 'string',
+    )
+  } catch (err) {
+    console.warn('[bridle] failed to load outbox', err)
+    return []
+  }
+}
+
+function saveOutbox(key: string, entries: IOutboxEntry[]): void {
+  if (typeof window === 'undefined') return
+  try {
+    if (!entries.length) {
+      window.localStorage.removeItem(OUTBOX_STORAGE_PREFIX + key)
+      return
+    }
+    window.localStorage.setItem(OUTBOX_STORAGE_PREFIX + key, JSON.stringify(entries))
+  } catch (err) {
+    // Quota exceeded or storage disabled — the message still shows its state
+    // for this session; it just will not survive a reload.
+    console.warn('[bridle] failed to persist outbox', err)
+  }
+}
+
+/** How far a transcript copy's clock may sit from the local send time. */
+const PERSISTED_MATCH_WINDOW_MS = 2 * 60_000
+
+/**
+ * Is this operator message already in the transcript page?
+ *
+ * By id — and, INTERIM, by exact text within ±2 minutes of its send time: the
+ * runtime does not persist the message id yet (research E2), so the id alone
+ * never matches today. Remove the text fallback once the runtime persists
+ * message ids — tasks.md T044.
+ */
+function isInTranscript(
+  m: { id: string; text: string; ts: number },
+  page: ITranscriptPageMessage[],
+): boolean {
+  return page.some(
+    t =>
+      t.id === m.id ||
+      (t.role === 'user' &&
+        t.text === m.text &&
+        Math.abs(t.ts - m.ts) <= PERSISTED_MATCH_WINDOW_MS),
+  )
+}
+
+// "Still no ack after 5 s" timers, keyed `<conversation>|<message id>`. Not
+// state: nothing renders from a timer handle.
+const slowTimers = new Map<string, ReturnType<typeof setTimeout>>()
+
+function clearSlowTimer(key: string, id: string): void {
+  const handle = slowTimers.get(`${key}|${id}`)
+  if (handle) clearTimeout(handle)
+  slowTimers.delete(`${key}|${id}`)
+}
+
+/** How long a turn may stay silent before it is declared dead. */
+const TURN_STALE_MS = 75_000
+
+const TURN_DIED_NOTICE = 'The agent did not finish this turn.'
+
+export const useBridleStore = defineStore('bridle', {
+  state: () => ({
+    /** Every conversation this tab has touched, keyed by `bridleKey`. */
+    conversations: {} as Record<string, IBridleConversation>,
+    isOpen: false,
     /**
      * Render assistant messages as markdown when true; otherwise show raw
      * text. Persisted in localStorage so the user's choice survives refresh.
      */
     markdownEnabled: loadMarkdownPref(),
-    /** Files picked but not yet sent. Emptied when the message goes out. */
-    staged: [] as IStagedAttachment[],
-    /** Last rejection, shown under the composer until the next action. */
-    attachmentError: null as string | null,
-    /**
-     * Object URLs minted for the local echo of a sent non-image attachment.
-     * The download route needs a bearer token and a plain link cannot carry
-     * one, so the bubble links the bytes we already hold. Revoked when the
-     * transcript is cleared.
-     */
-    _echoUrls: [] as string[],
-    _socket: null as Socket | null,
-    /** Active agentId — captured on connect, used to scope persisted debug. */
-    _agentId: null as string | null,
-    /**
-     * One reconnect per auth rejection: after the hub refuses the token we
-     * refresh and connect again once; a second refusal ends the session
-     * instead of looping. Reset on every successful connect.
-     */
-    _authRetried: false,
   }),
 
   getters: {
-    isUploadingAttachment: (state) =>
-      state.staged.some(a => a.state === BridleAttachmentStates.Uploading),
+    getIsOpen: (state) => state.isOpen,
+    // Read-only views for hosts that only watch a chat's connection (the
+    // agent lifecycle, the Rancher page). They never create a record — a
+    // conversation nobody mounted is simply "not connected".
+    isConnectedFor: (state) => (agentId: string, channel = DEFAULT_CHANNEL): boolean =>
+      state.conversations[bridleKey(agentId, channel)]?.isConnected ?? false,
+    isAgentConnectedFor: (state) => (agentId: string, channel = DEFAULT_CHANNEL): boolean =>
+      state.conversations[bridleKey(agentId, channel)]?.isAgentConnected ?? false,
+    getMessages: (state) => (key: string): IBridleMessageData[] =>
+      (state.conversations[key]?.messages ?? []) as IBridleMessageData[],
+    isUploadingAttachment: (state) => (key: string): boolean =>
+      (state.conversations[key]?.staged ?? []).some(
+        a => a.state === BridleAttachmentStates.Uploading,
+      ),
     /**
      * A failed upload blocks sending on purpose: the message is usually
      * *about* the file, and delivering it without the attachment is worse
      * than making the person retry or drop it.
      */
-    hasFailedAttachment: (state) =>
-      state.staged.some(a => a.state === BridleAttachmentStates.Failed),
-    readyAttachments: (state) =>
-      state.staged.filter(
+    hasFailedAttachment: (state) => (key: string): boolean =>
+      (state.conversations[key]?.staged ?? []).some(
+        a => a.state === BridleAttachmentStates.Failed,
+      ),
+    readyAttachments: (state) => (key: string): IStagedAttachment[] =>
+      ((state.conversations[key]?.staged ?? []) as IStagedAttachment[]).filter(
         a => a.state === BridleAttachmentStates.Ready && a.remoteId,
       ),
-    getMessages: (state) => state.messages,
-    getIsOpen: (state) => state.isOpen,
-    getDebugForMessage: (state) => (id: string): IBridleDebugData | null => {
-      const direct = state.debugByMessageId[id]
+    getDebugForMessage: (state) => (key: string, id: string): IBridleDebugData | null => {
+      const c = state.conversations[key]
+      if (!c) return null
+      const direct = c.debugByMessageId[id]
       if (direct) return direct
       // No messageId match: only attach the orphan debug to the *latest*
       // assistant message — older assistant messages keep no debug.
-      const lastAssistant = [...state.messages].reverse().find(m => m.role === 'assistant')
-      if (lastAssistant && lastAssistant.id === id) return state._lastDebug
+      const lastAssistant = [...c.messages].reverse().find(m => m.role === 'assistant')
+      if (lastAssistant && lastAssistant.id === id) return c.lastDebug
       return null
     },
   },
 
   actions: {
-    async connect(apiUrl: string, agentId: string) {
+    /**
+     * The reactive record of one conversation, created on demand. Call it from
+     * setup or an action — not from inside a computed, which must not write.
+     */
+    conversation(agentId: string, channel = DEFAULT_CHANNEL): IBridleConversation {
+      const key = bridleKey(agentId, channel)
+      if (!this.conversations[key]) {
+        this.conversations[key] = createConversation(agentId, channel)
+      }
+      return this.conversations[key] as IBridleConversation
+    },
+
+    _conv(key: string): IBridleConversation | null {
+      return (this.conversations[key] as IBridleConversation | undefined) ?? null
+    },
+
+    /** A provider starts showing this conversation. Pair with `release`. */
+    acquire(agentId: string, channel = DEFAULT_CHANNEL): IBridleConversation {
+      const c = this.conversation(agentId, channel)
+      c.holders++
+      return c
+    },
+
+    /**
+     * A provider stops showing this conversation. The last one out closes the
+     * socket and drops staged files (their object URLs would leak). Messages
+     * stay: the next mount merges the transcript into them.
+     */
+    release(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      c.holders = Math.max(0, c.holders - 1)
+      if (c.holders > 0) return
+      this.disconnect(key)
+      this.clearStaged(key)
+    },
+
+    async connect(apiUrl: string, agentId: string, channel = DEFAULT_CHANNEL) {
       const auth = useAuthStore()
+      const c = this.conversation(agentId, channel)
+      const key = c.key
+      c.apiUrl = apiUrl
 
-      if (this._socket) {
+      if (c.socket) {
         // A socket the hub dropped (auth rejection) does not reconnect on
         // its own — socket.io treats a server-initiated disconnect as final.
         // Give it the current token and try again.
-        if (!this._socket.connected) {
+        if (!c.socket.connected) {
           await auth.ensureFresh()
-          this._socket.connect()
+          c.socket?.connect()
         }
         return
       }
 
-      this._agentId = agentId
-
       // Never open the handshake with a token about to expire — the hub
       // would refuse it a moment later.
       await auth.ensureFresh()
       // Someone else connected while the refresh was in flight.
-      if (this._socket) return
+      if (c.socket) return
 
       const socket = io(`${apiUrl}/ws/client`, {
         transports: ['websocket'],
@@ -497,7 +776,8 @@ export const useBridleStore = defineStore('bridle', {
         reconnectionDelay: 2000,
         // `auth` as a function: socket.io calls it on every (re)connect, so
         // a reconnect after a renewal carries the current token, never the
-        // one captured when the widget mounted.
+        // one captured when the widget mounted — and the current `lastSeq`,
+        // so the hub replays exactly what this conversation has not applied.
         // What this client renders — the hub forwards the list to the agent
         // on every message; the runtime gates thinking-step emission on it.
         // No 'ui': the admin preview doesn't render interactive ui parts.
@@ -506,12 +786,13 @@ export const useBridleStore = defineStore('bridle', {
             token: useAuthStore().accessToken ?? '',
             agentId,
             capabilities: ['streaming', 'images', 'files', 'thinking'],
+            lastSeq: c.lastHubSeq,
           }),
       })
 
       socket.on('connect', () => {
-        this.isConnected = true
-        this._authRetried = false
+        c.isConnected = true
+        c.authRetried = false
       })
 
       // The hub refused the handshake token and is about to drop the socket.
@@ -521,8 +802,8 @@ export const useBridleStore = defineStore('bridle', {
       socket.on('bridle_error', async (e: { code?: string; agentId?: string; origin?: string }) => {
         const code = e?.code
         if (code !== 'TOKEN_EXPIRED' && code !== 'INVALID_TOKEN') return
-        if (!this._authRetried && (await useAuthStore().refresh())) {
-          this._authRetried = true
+        if (!c.authRetried && (await useAuthStore().refresh())) {
+          c.authRetried = true
           // The server's disconnect may land after the refresh round trip
           // or before it; `connect()` is a no-op on a still-open socket.
           const reconnect = () => socket.connect()
@@ -533,48 +814,96 @@ export const useBridleStore = defineStore('bridle', {
         }
       })
 
-      socket.on('disconnect', () => {
-        this.isConnected = false
+      socket.on('disconnect', (reason: string) => {
+        c.isConnected = false
         // We can't observe agent register/unregister while our own socket is
         // down; reset to false so the indicator doesn't lie about a stale
         // value while we're trying to reconnect.
-        this.isAgentConnected = false
-        // Nothing can finish an in-flight turn on a dead socket.
-        this.isTyping = false
-        this._closeAllTurns()
+        c.isAgentConnected = false
+        if (reason === 'io client disconnect') {
+          // We hung up (unmount, new chat) — nobody is left to watch the turn.
+          c.isTyping = false
+          this._closeAllTurns(key)
+          return
+        }
+        // A transient drop does NOT end the turn: the agent keeps working and
+        // the hub replays what we miss once we are back (`lastSeq`). Closing
+        // the turn here is what froze answers the agent's log already had
+        // (research F4). The watchdog decides — make sure one is running.
+        if (hasOpenTurn(c) && !c.thinkingStaleTimer) this._armThinkingWatchdog(key)
       })
 
       socket.on('connect_error', (err) => {
-        this.isConnected = false
-        this.isAgentConnected = false
+        c.isConnected = false
+        c.isAgentConnected = false
         console.error('[bridle] connection error:', err.message)
       })
 
-      socket.on('welcome', (data: { clientId: string }) => {
-        this.clientId = data.clientId
+      socket.on('welcome', (data: { clientId: string; seq?: number }) => {
+        c.clientId = data.clientId
+        // The hub's sequence is BEHIND ours: it restarted and lost its replay
+        // buffer. Nothing will be replayed — adopt its numbering and recover
+        // what we missed from the transcript instead.
+        if (typeof data.seq === 'number' && data.seq < c.lastHubSeq) {
+          c.lastHubSeq = data.seq
+          void this.loadTranscript(apiUrl, agentId, channel)
+        }
       })
 
       // The hub could not deliver a message — a dead attachment, usually.
       // Reported on its own event rather than by dropping the socket, so the
-      // conversation survives one bad file.
-      socket.on('message_error', (data: { message?: string }) => {
-        this.isTyping = false
-        this.attachmentError = data?.message ?? 'Message could not be delivered'
+      // conversation survives one bad file. The message's own state comes
+      // from the ack (`rejected / ATTACHMENT_FAILED`).
+      socket.on('message_error', (data: { message?: string; seq?: number }) => {
+        if (!acceptHubSeq(c, data?.seq)) return
+        c.isTyping = false
+        c.attachmentError = data?.message ?? 'Message could not be delivered'
       })
 
-      socket.on('agent_status', (data: { connected?: boolean }) => {
-        this.isAgentConnected = !!data?.connected
+      socket.on('agent_status', (data: { connected?: boolean; seq?: number }) => {
+        if (!acceptHubSeq(c, data?.seq)) return
+        c.isAgentConnected = !!data?.connected
       })
 
-      socket.on('message', (data: { text?: string; parts?: BridlePart[]; messageId?: string; ts?: number }) => {
-        this.isTyping = false
+      // Another view of this identity (second tab, a colleague) sent a
+      // message: show the question, not only the answer. Our own sends never
+      // come back — and if one did, its id is already here.
+      socket.on('user_message', (data: {
+        messageId?: string
+        text?: string
+        attachments?: IBridleAttachmentRef[]
+        ts?: number
+        seq?: number
+      }) => {
+        if (!acceptHubSeq(c, data?.seq)) return
+        const id = data?.messageId
+        if (!id || c.messages.some(m => m.id === id)) return
+        const text = data.text ?? ''
+        const attachments = (data.attachments ?? []).filter(a => !!a?.id && !!a?.name)
+        this._push(key, {
+          id,
+          role: 'user',
+          text,
+          parts: buildParts(text),
+          ts: data.ts ?? Date.now(),
+          delivery: 'delivered',
+          ...(attachments.length ? { attachments } : {}),
+        })
+        if (attachments.length) this._hydrateAttachments(apiUrl, agentId, channel, [{ id, attachments }])
+      })
+
+      socket.on('message', (data: { text?: string; parts?: BridlePart[]; messageId?: string; ts?: number; seq?: number }) => {
+        if (!acceptHubSeq(c, data.seq)) return
+        c.isTyping = false
         const text = data.text ?? ''
         const parts = data.parts ?? (text ? [{ type: BridlePartTypes.Text as const, text }] : [])
         if (!hasVisibleContent(text, parts)) return
+        if (data.messageId && c.messages.some(m => m.id === data.messageId)) return
+        if (this._isTranscriptContent(key, data.ts)) return
         // Content lands below the open segment — seal it so the next step
         // opens a fresh segment under this message (turn stays open).
-        this._freezeOpenThinking()
-        this.messages.push({
+        this._freezeOpenThinking(key)
+        this._push(key, {
           id: data.messageId ?? crypto.randomUUID(),
           role: 'assistant',
           text,
@@ -583,78 +912,87 @@ export const useBridleStore = defineStore('bridle', {
         })
       })
 
-      socket.on('typing', () => {
-        this.isTyping = true
-        this._armThinkingWatchdog()
+      socket.on('typing', (data?: { seq?: number }) => {
+        if (!acceptHubSeq(c, data?.seq)) return
+        c.isTyping = true
+        this._armThinkingWatchdog(key)
       })
 
-      socket.on('thinking', (e: IBridleThinkingEvent) => {
+      socket.on('thinking', (e: IBridleThinkingEvent & { seq?: number }) => {
         if (!e?.turnId) return
-        const turnBlocks = this.thinkingBlocks.filter(b => b.turnId === e.turnId)
+        if (!acceptHubSeq(c, e.seq)) return
+        const turnBlocks = c.thinkingBlocks.filter(b => b.turnId === e.turnId)
         if (e.done || !e.step) {
           // Terminal event — freeze every segment and refuse stragglers.
           for (const b of turnBlocks) this._freezeThinkingBlock(b)
-          this._closedTurns[e.turnId] = true
+          c.closedTurns[e.turnId] = true
           return
         }
-        if (this._closedTurns[e.turnId]) return // straggler after terminal
+        if (c.closedTurns[e.turnId]) return // straggler after terminal
         // `done` updates land in whichever segment holds the step id — the
         // segment may have sealed while the tool was still running.
         const owner = turnBlocks.find(b => b.steps.some(s => s.id === e.step!.id))
         if (owner) {
           owner.steps = owner.steps.map(s => (s.id === e.step!.id ? e.step! : s))
-          this.isTyping = true
-          this._armThinkingWatchdog()
+          c.isTyping = true
+          this._armThinkingWatchdog(key)
           return
         }
         // New step: continue the trailing open segment, or open a fresh one
         // below the newest message (segments seal when content lands).
         let block = turnBlocks[turnBlocks.length - 1]
         if (!block || block.status === 'done') {
+          // A replayed step of a turn the transcript already shows.
+          if (this._isTranscriptContent(key, e.ts)) return
           // Linear conversation: a new turn's first step closes other turns.
-          for (const b of this.thinkingBlocks) {
+          for (const b of c.thinkingBlocks) {
             if (b.turnId !== e.turnId && b.status === 'thinking') {
               this._freezeThinkingBlock(b)
-              this._closedTurns[b.turnId] = true
+              c.closedTurns[b.turnId] = true
             }
           }
-          // Anchor after every message on screen — wire ts is agent-clock.
-          const lastTs = this.messages[this.messages.length - 1]?.ts ?? 0
-          block = {
+          // Anchored by arrival `seq`, below everything on screen. `ts` is
+          // the agent's clock and says nothing about where the block belongs.
+          c.thinkingBlocks.push({
             turnId: e.turnId,
             seg: turnBlocks.length,
             steps: [],
             status: 'thinking',
-            ts: Math.max(e.ts ?? Date.now(), lastTs + 1),
-          }
-          this.thinkingBlocks.push(block)
+            ts: e.ts ?? Date.now(),
+            seq: c.nextSeq++,
+          })
+          // Re-read through the reactive list: the pushed literal is raw.
+          block = c.thinkingBlocks[c.thinkingBlocks.length - 1]!
         }
         block.steps.push(e.step)
         // Steps mean the agent is working — keep the shimmer alive through
         // tool execution and re-arm the watchdog.
-        this.isTyping = true
-        this._armThinkingWatchdog()
+        c.isTyping = true
+        this._armThinkingWatchdog(key)
       })
 
-      socket.on('stream', (data: { text?: string; parts?: BridlePart[]; messageId?: string; ts?: number }) => {
-        this.isTyping = false
-        // Streaming is activity too — keep the stale watchdog fed so an
-        // open block only freezes when the turn truly went silent.
-        if (this.thinkingBlocks.some(b => b.status === 'thinking')) this._armThinkingWatchdog()
+      socket.on('stream', (data: { text?: string; parts?: BridlePart[]; messageId?: string; ts?: number; seq?: number }) => {
+        if (!acceptHubSeq(c, data.seq)) return
+        c.isTyping = false
+        // Streaming is activity too — keep the stale watchdog fed so the
+        // turn is only closed when it truly went silent. Armed even with no
+        // open block: a half-streamed bubble is an open turn as well.
+        this._armThinkingWatchdog(key)
         const text = data.text ?? ''
         const parts = data.parts ?? (text ? [{ type: BridlePartTypes.Text as const, text }] : [])
-        const idx = this.messages.findIndex(m => m.id === data.messageId)
-        const current = this.messages[idx]
+        const idx = c.messages.findIndex(m => m.id === data.messageId)
+        const current = c.messages[idx]
         if (current) {
-          this.messages[idx] = { ...current, text, parts, streaming: true }
+          c.messages[idx] = { ...current, text, parts, streaming: true }
         } else {
           // Don't create a fresh bubble for an empty initial chunk — wait
           // until the runtime actually has visible content.
           if (!hasVisibleContent(text, parts)) return
+          if (this._isTranscriptContent(key, data.ts)) return
           // First visible chunk of a new bubble — seal the open segment so
           // subsequent steps continue below this message.
-          this._freezeOpenThinking()
-          this.messages.push({
+          this._freezeOpenThinking(key)
+          this._push(key, {
             id: data.messageId ?? crypto.randomUUID(),
             role: 'assistant',
             text,
@@ -665,34 +1003,35 @@ export const useBridleStore = defineStore('bridle', {
         }
       })
 
-      socket.on('debug', (data: IBridleDebugData & { messageId?: string }) => {
+      socket.on('debug', (data: IBridleDebugData & { messageId?: string; seq?: number }) => {
+        if (!acceptHubSeq(c, data.seq)) return
         if (data.messageId) {
-          this.debugByMessageId[data.messageId] = data
+          c.debugByMessageId[data.messageId] = data
         }
         // Always cache as last — covers the case where runtime didn't pass
         // a messageId so we can still attach to the most recent assistant
         // message via the getter.
-        this._lastDebug = data
+        c.lastDebug = data
         // Persist for survival across page reloads. Scoped per bot.
-        if (this._agentId) {
-          saveDebugToStorage(this._agentId, {
-            byMessageId: { ...this.debugByMessageId },
-            lastDebug: this._lastDebug,
-          })
-        }
+        saveDebugToStorage(agentId, {
+          byMessageId: { ...c.debugByMessageId },
+          lastDebug: c.lastDebug,
+        })
       })
 
-      socket.on('stream_end', (data: { text?: string; parts?: BridlePart[]; messageId?: string; ts?: number }) => {
-        this.isTyping = false
+      socket.on('stream_end', (data: { text?: string; parts?: BridlePart[]; messageId?: string; ts?: number; seq?: number }) => {
+        if (!acceptHubSeq(c, data.seq)) return
+        c.isTyping = false
         const text = data.text ?? ''
         const parts = data.parts ?? (text ? [{ type: BridlePartTypes.Text as const, text }] : [])
-        const idx = this.messages.findIndex(m => m.id === data.messageId)
-        const current = this.messages[idx]
+        const idx = c.messages.findIndex(m => m.id === data.messageId)
+        const current = c.messages[idx]
         if (current) {
-          this.messages[idx] = { ...current, text, parts, streaming: false }
+          c.messages[idx] = { ...current, text, parts, streaming: false }
         } else {
           if (!hasVisibleContent(text, parts)) return
-          this.messages.push({
+          if (this._isTranscriptContent(key, data.ts)) return
+          this._push(key, {
             id: data.messageId ?? crypto.randomUUID(),
             role: 'assistant',
             text,
@@ -702,14 +1041,43 @@ export const useBridleStore = defineStore('bridle', {
         }
       })
 
-      this._socket = socket
+      // Raw on purpose: a socket is not view state, and a reactive proxy
+      // around its internals only costs.
+      c.socket = markRaw(socket)
     },
 
-    disconnect() {
-      this._socket?.disconnect()
-      this._socket = null
-      this.isConnected = false
-      this.isAgentConnected = false
+    disconnect(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      c.socket?.disconnect()
+      c.socket = null
+      c.isConnected = false
+      c.isAgentConnected = false
+    },
+
+    /**
+     * Append with the next arrival `seq`. EVERY append goes through here —
+     * `seq` is the only ordering key, so an item without one has no place.
+     */
+    _push(key: string, message: IBridleMessageData) {
+      const c = this._conv(key)
+      if (!c) return
+      c.messages.push({ ...message, seq: c.nextSeq++ })
+      // Something new is on screen — a "turn died" line above it is stale.
+      c.notice = null
+    },
+
+    /**
+     * Agent content stamped at or before the transcript's newest message is
+     * already on screen as transcript. It comes back when the hub replays a
+     * turn that finished while this chat was closed — under wire ids the
+     * transcript does not share, so the id check cannot catch it. Both stamps
+     * are the runtime's clock, which is what makes them comparable. INTERIM,
+     * same cause as the outbox text match — tasks.md T044.
+     */
+    _isTranscriptContent(key: string, ts?: number): boolean {
+      const c = this._conv(key)
+      return !!c && typeof ts === 'number' && ts <= c.transcriptTailTs
     },
 
     /**
@@ -719,18 +1087,24 @@ export const useBridleStore = defineStore('bridle', {
      * bytes and expands them into the parts the agent receives, exactly as the
      * HTTP routes do. The parts built here are the local echo: what the person
      * sees in their own bubble, not what the agent is sent.
+     *
+     * An agent turn in flight does not block this: a follow-up is a message
+     * like any other.
      */
     async sendMessage(
+      key: string,
       text: string,
       images?: Array<{ base64: string; mediaType: string }>,
     ) {
+      const c = this._conv(key)
+      if (!c) return
       const trimmed = text.trim()
-      const ready = this.staged.filter(
+      const ready = c.staged.filter(
         a => a.state === BridleAttachmentStates.Ready && a.remoteId,
       )
       if (!trimmed && !ready.length) return
       // Refuse rather than silently dropping the file the message is about.
-      if (this.isUploadingAttachment || this.hasFailedAttachment) return
+      if (this.isUploadingAttachment(key) || this.hasFailedAttachment(key)) return
 
       const wireParts = buildParts(trimmed, images)
       const echoParts = buildParts(trimmed, images)
@@ -750,7 +1124,7 @@ export const useBridleStore = defineStore('bridle', {
           }
         }
         const url = URL.createObjectURL(entry.file)
-        this._echoUrls.push(url)
+        c.echoUrls.push(url)
         echoParts.push({
           type: BridlePartTypes.File,
           url,
@@ -759,26 +1133,167 @@ export const useBridleStore = defineStore('bridle', {
         })
       }
 
-      const attachmentIds = ready.map(a => a.remoteId as string)
-
-      this.messages.push({
-        id: crypto.randomUUID(),
+      const attachments: IBridleAttachmentRef[] = ready.map(a => ({
+        id: a.remoteId as string,
+        name: a.name,
+        mimeType: a.mimeType,
+        size: a.size,
+        kind: a.kind,
+      }))
+
+      // One id for the bubble, the wire (`clientMessageId`) and — once the
+      // runtime persists it — the transcript (research F7).
+      const id = crypto.randomUUID()
+      this._push(key, {
+        id,
         role: 'user',
         text: trimmed,
         parts: echoParts,
         ts: Date.now(),
+        ...nextDelivery({}, { type: 'sent' }),
+        ...(attachments.length ? { attachments } : {}),
       })
 
       // Empty the composer before the round trip so the next message can be
       // typed while the agent thinks.
-      this.clearStaged()
-      this.isTyping = true
+      this.clearStaged(key)
+      this._emitMessage(key, id, wireParts)
+    },
 
-      this._socket?.emit('message', {
-        text: trimmed,
-        parts: wireParts,
-        ...(attachmentIds.length ? { attachmentIds } : {}),
-      })
+    /**
+     * Hand one message to the hub and track what becomes of it. Shared by the
+     * first send and `resend` — same id both times, so the hub can tell a
+     * repeat from a new message.
+     */
+    _emitMessage(key: string, id: string, wireParts: BridlePart[]) {
+      const c = this._conv(key)
+      const message = c?.messages.find(m => m.id === id)
+      if (!c || !message) return
+      this._persistOutbox(key)
+
+      // socket.io BUFFERS an emit on a disconnected socket and sends it on
+      // reconnect — whenever that is, with no way to tell the person. Say
+      // "not delivered" now and let them decide.
+      const socket = c.socket
+      if (!socket || !socket.connected) {
+        this._applyDelivery(key, id, { type: 'ackRejected', code: 'OFFLINE' })
+        return
+      }
+
+      c.notice = null
+      c.isTyping = true
+      // The optimistic shimmer above must not outlive a turn that never starts.
+      this._armThinkingWatchdog(key)
+
+      clearSlowTimer(key, id)
+      slowTimers.set(
+        `${key}|${id}`,
+        setTimeout(() => {
+          slowTimers.delete(`${key}|${id}`)
+          this._applyDelivery(key, id, { type: 'tick', elapsedMs: SLOW_MS })
+        }, SLOW_MS),
+      )
+
+      const attachmentIds = (message.attachments ?? []).map(a => a.id)
+      socket.timeout(FAILED_MS).emit(
+        'message',
+        {
+          text: message.text,
+          parts: wireParts,
+          ...(attachmentIds.length ? { attachmentIds } : {}),
+          clientMessageId: id,
+        },
+        (err: Error | null, ack?: BridleSendAck) => {
+          if (err || !ack) {
+            // No answer in 30 s. The message may still have arrived — which
+            // is why Resend reuses the id and the hub de-duplicates.
+            this._applyDelivery(key, id, { type: 'tick', elapsedMs: FAILED_MS })
+            this._settleTypingAfterFailure(key)
+            return
+          }
+          if (ack.status === 'accepted') {
+            this._applyDelivery(key, id, { type: 'ackAccepted' })
+            // Show the hub's time from here on, so the live view and a later
+            // replay agree on when this was sent.
+            const sent = this._conv(key)?.messages.find(m => m.id === id)
+            if (sent && typeof ack.ts === 'number') sent.ts = ack.ts
+            return
+          }
+          this._applyDelivery(key, id, { type: 'ackRejected', code: ack.code })
+          this._settleTypingAfterFailure(key)
+        },
+      )
+    },
+
+    /** Run one delivery event through the state machine (utils/delivery.ts). */
+    _applyDelivery(key: string, id: string, event: DeliveryEvent) {
+      const message = this._conv(key)?.messages.find(m => m.id === id && m.role === 'user')
+      if (!message) return
+      const next = nextDelivery(
+        { delivery: message.delivery, failureCode: message.failureCode },
+        event,
+      )
+      message.delivery = next.delivery
+      message.failureCode = next.failureCode
+      if (next.delivery !== 'sending') clearSlowTimer(key, id)
+      this._persistOutbox(key)
+    },
+
+    /**
+     * The message did not go through, so nothing will answer it. Drop the
+     * optimistic shimmer — unless a turn is visibly running (a follow-up that
+     * failed must not hide the answer still being written).
+     */
+    _settleTypingAfterFailure(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      if (c.thinkingBlocks.some(b => b.status === 'thinking') || c.messages.some(m => m.streaming)) return
+      c.isTyping = false
+      if (c.thinkingStaleTimer) {
+        clearTimeout(c.thinkingStaleTimer)
+        c.thinkingStaleTimer = null
+      }
+    },
+
+    /** Try a failed message again — SAME id, so it can never arrive twice. */
+    resend(key: string, id: string) {
+      const message = this._conv(key)?.messages.find(m => m.id === id && m.role === 'user')
+      if (!message || message.delivery !== 'failed') return
+      this._applyDelivery(key, id, { type: 'resend' })
+      this._emitMessage(key, id, buildParts(message.text))
+    },
+
+    /** Drop a failed message from the conversation and the outbox. */
+    discard(key: string, id: string) {
+      const c = this._conv(key)
+      if (!c) return
+      const index = c.messages.findIndex(
+        m => m.id === id && m.role === 'user' && m.delivery === 'failed',
+      )
+      if (index < 0) return
+      c.messages.splice(index, 1)
+      clearSlowTimer(key, id)
+      this._persistOutbox(key)
+    },
+
+    /** Mirror the not-delivered messages of this conversation into storage. */
+    _persistOutbox(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      saveOutbox(
+        key,
+        c.messages
+          .filter(m => m.role === 'user' && !!m.delivery && m.delivery !== 'delivered')
+          .map(m => ({
+            id: m.id,
+            text: m.text,
+            ts: m.ts,
+            delivery: m.delivery as BridleDelivery,
+            ...(m.failureCode ? { failureCode: m.failureCode } : {}),
+            // References only — the echo's image bytes stay out of storage.
+            ...(m.attachments?.length ? { attachments: m.attachments } : {}),
+          })),
+      )
     },
 
     // ── Attachments ──────────────────────────
@@ -787,8 +1302,9 @@ export const useBridleStore = defineStore('bridle', {
      * Validate against the client mirror of the API's limits. Returns the
      * sentence to show, or null when the file is fine.
      */
-    _rejectReason(file: File, pendingBytes: number): string | null {
-      if (this.staged.length >= MAX_ATTACHMENTS_PER_MESSAGE) {
+    _rejectReason(key: string, file: File, pendingBytes: number): string | null {
+      const staged = this._conv(key)?.staged ?? []
+      if (staged.length >= MAX_ATTACHMENTS_PER_MESSAGE) {
         return `You can attach up to ${MAX_ATTACHMENTS_PER_MESSAGE} files`
       }
       if (file.size === 0) return `${file.name} is empty`
@@ -807,24 +1323,26 @@ export const useBridleStore = defineStore('bridle', {
      * is a .zip stages four.
      */
     stageFiles(
+      key: string,
       apiUrl: string,
-      agentId: string,
       files: File[] | FileList,
     ) {
+      const c = this._conv(key)
+      if (!c) return
       const list = Array.from(files)
       if (!list.length) return
-      this.attachmentError = null
+      c.attachmentError = null
 
-      let pendingBytes = this.staged.reduce((sum, a) => sum + a.size, 0)
+      let pendingBytes = c.staged.reduce((sum, a) => sum + a.size, 0)
 
       for (const file of list) {
         const mimeType = resolveMimeType(file)
         const problem = !isAllowedMimeType(mimeType)
           ? `${file.name} is not a supported file type. Try an image, a PDF, an Office document, or a text file.`
-          : this._rejectReason(file, pendingBytes)
+          : this._rejectReason(key, file, pendingBytes)
 
         if (problem) {
-          this.attachmentError = problem
+          c.attachmentError = problem
           continue
         }
 
@@ -846,18 +1364,20 @@ export const useBridleStore = defineStore('bridle', {
           error: null,
         }
 
-        this.staged.push(staging)
+        c.staged.push(staging)
         pendingBytes += file.size
-        void this.uploadStaged(apiUrl, agentId, staging.localId)
+        void this.uploadStaged(key, apiUrl, staging.localId)
       }
     },
 
     async uploadStaged(
+      key: string,
       apiUrl: string,
-      agentId: string,
       localId: string,
     ) {
-      const find = () => this.staged.find(a => a.localId === localId)
+      const c = this._conv(key)
+      if (!c) return
+      const find = () => c.staged.find(a => a.localId === localId)
       const entry = find()
       if (!entry) return
 
@@ -868,7 +1388,7 @@ export const useBridleStore = defineStore('bridle', {
       try {
         const stored = await uploadAttachment(
           apiUrl,
-          agentId,
+          c.agentId,
           entry.file,
           (percent) => {
             // The chip may have been removed mid-flight.
@@ -898,49 +1418,60 @@ export const useBridleStore = defineStore('bridle', {
     },
 
     retryStaged(
+      key: string,
       apiUrl: string,
-      agentId: string,
       localId: string,
     ) {
-      const entry = this.staged.find(a => a.localId === localId)
+      const entry = this._conv(key)?.staged.find(a => a.localId === localId)
       if (!entry || entry.state === BridleAttachmentStates.Uploading) return
-      void this.uploadStaged(apiUrl, agentId, localId)
+      void this.uploadStaged(key, apiUrl, localId)
     },
 
-    removeStaged(localId: string) {
-      const index = this.staged.findIndex(a => a.localId === localId)
+    removeStaged(key: string, localId: string) {
+      const c = this._conv(key)
+      if (!c) return
+      const index = c.staged.findIndex(a => a.localId === localId)
       if (index < 0) return
-      const [entry] = this.staged.splice(index, 1)
+      const [entry] = c.staged.splice(index, 1)
       if (entry?.previewUrl) URL.revokeObjectURL(entry.previewUrl)
-      this.attachmentError = null
+      c.attachmentError = null
     },
 
-    clearStaged() {
-      for (const entry of this.staged) {
+    clearStaged(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      for (const entry of c.staged) {
         if (entry.previewUrl) URL.revokeObjectURL(entry.previewUrl)
       }
-      this.staged = []
-      this.attachmentError = null
+      c.staged = []
+      c.attachmentError = null
     },
 
-    dismissAttachmentError() {
-      this.attachmentError = null
+    dismissAttachmentError(key: string) {
+      const c = this._conv(key)
+      if (c) c.attachmentError = null
     },
 
-    clearMessages() {
-      for (const url of this._echoUrls) URL.revokeObjectURL(url)
-      this._echoUrls = []
-      this.messages = []
-      this.transcriptCursor = null
-      this.hasMoreOlder = false
-      this.debugByMessageId = {}
-      this._lastDebug = null
-      this.thinkingBlocks = []
-      this._closedTurns = {}
-      this.isTyping = false
-      if (this._thinkingStaleTimer) {
-        clearTimeout(this._thinkingStaleTimer)
-        this._thinkingStaleTimer = null
+    /** Empty this conversation's view. The outbox in storage is untouched. */
+    clearMessages(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      for (const url of c.echoUrls) URL.revokeObjectURL(url)
+      c.echoUrls = []
+      c.messages = []
+      c.nextSeq = 1
+      c.transcriptTailTs = 0
+      c.transcriptCursor = null
+      c.hasMoreOlder = false
+      c.debugByMessageId = {}
+      c.lastDebug = null
+      c.thinkingBlocks = []
+      c.closedTurns = {}
+      c.isTyping = false
+      c.notice = null
+      if (c.thinkingStaleTimer) {
+        clearTimeout(c.thinkingStaleTimer)
+        c.thinkingStaleTimer = null
       }
     },
 
@@ -955,17 +1486,19 @@ export const useBridleStore = defineStore('bridle', {
      * Seal (collapse) every open segment. The turns stay open — later steps
      * of the same turn open a fresh segment below the newest message.
      */
-    _freezeOpenThinking() {
-      for (const b of this.thinkingBlocks) {
+    _freezeOpenThinking(key: string) {
+      for (const b of this._conv(key)?.thinkingBlocks ?? []) {
         if (b.status === 'thinking') this._freezeThinkingBlock(b)
       }
     },
 
-    /** Terminal paths (watchdog, disconnect): seal segments AND close their
-     * turns so straggler steps can't resurrect a zombie segment. */
-    _closeAllTurns() {
-      for (const b of this.thinkingBlocks) this._closedTurns[b.turnId] = true
-      this._freezeOpenThinking()
+    /** Terminal paths (watchdog, deliberate disconnect): seal segments AND
+     * close their turns so straggler steps can't resurrect a zombie segment. */
+    _closeAllTurns(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      for (const b of c.thinkingBlocks) c.closedTurns[b.turnId] = true
+      this._freezeOpenThinking(key)
     },
 
     /**
@@ -973,16 +1506,72 @@ export const useBridleStore = defineStore('bridle', {
      * terminal thinking event — without this watchdog the shimmer would
      * animate forever. Re-armed by every typing/thinking/stream event.
      */
-    _armThinkingWatchdog() {
-      if (this._thinkingStaleTimer) clearTimeout(this._thinkingStaleTimer)
-      this._thinkingStaleTimer = setTimeout(() => {
-        this._thinkingStaleTimer = null
-        this.isTyping = false
-        this._closeAllTurns()
-      }, 75_000)
+    _armThinkingWatchdog(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      if (c.thinkingStaleTimer) clearTimeout(c.thinkingStaleTimer)
+      c.thinkingStaleTimer = setTimeout(() => {
+        c.thinkingStaleTimer = null
+        void this._onTurnStale(key)
+      }, TURN_STALE_MS)
+    },
+
+    /**
+     * The watchdog ran out. If a turn was still open, the answer may exist
+     * all the same — finished while we were offline for longer than the hub's
+     * replay buffer covers. The transcript is the safety net: take assistant
+     * messages newer than the last one on screen; if there are none, say the
+     * turn died instead of quietly hiding the shimmer.
+     */
+    async _onTurnStale(key: string) {
+      const c = this._conv(key)
+      if (!c) return
+      const wasOpen = hasOpenTurn(c)
+      c.isTyping = false
+      this._closeAllTurns(key)
+      // A half-streamed bubble will get no more chunks.
+      for (const m of c.messages) {
+        if (m.streaming) m.streaming = false
+      }
+      if (!wasOpen) return
+
+      let page: ITranscriptPage | null = null
+      try {
+        if (c.apiUrl) page = await fetchTranscriptPage(c.apiUrl, c.agentId, c.channel)
+      } catch (err) {
+        console.warn('[bridle] failed to fetch transcript after a stale turn', err)
+      }
+
+      const shown = c.messages.filter(m => m.role === 'assistant')
+      const lastShownTs = shown[shown.length - 1]?.ts ?? 0
+      // What this session already shows of the running turn. The runtime
+      // saves a turn as ONE event with its pieces joined (research F6), so
+      // the saved copy of bubbles we already have is their concatenation.
+      const lastUserIndex = c.messages.map(m => m.role).lastIndexOf('user')
+      const turnText = c.messages
+        .slice(lastUserIndex + 1)
+        .filter(m => m.role === 'assistant')
+        .map(m => m.text)
+        .join('')
+      const missed = (page?.messages ?? []).filter(
+        t =>
+          t.role === 'assistant' &&
+          t.ts > lastShownTs &&
+          t.text !== turnText &&
+          !c.messages.some(m => m.id === t.id || (m.role === 'assistant' && m.text === t.text)),
+      )
+      // A turn that came alive again while we were fetching needs no verdict.
+      if (hasOpenTurn(c)) return
+      if (!missed.length) {
+        c.notice = TURN_DIED_NOTICE
+        return
+      }
+      for (const t of missed) this._push(key, toBridleMessage(t))
+      c.transcriptTailTs = Math.max(c.transcriptTailTs, ...missed.map(t => t.ts))
+      if (c.apiUrl) this._hydrateAttachments(c.apiUrl, c.agentId, c.channel, missed)
     },
 
-    async loadAgentMeta(apiUrl: string, agentId: string): Promise<void> {
+    async loadAgentMeta(apiUrl: string, agentId: string, channel = DEFAULT_CHANNEL): Promise<void> {
       const url = `${apiUrl.replace(/\/$/, '')}/agents/${encodeURIComponent(agentId)}`
       try {
         const res = await authedFetch(url)
@@ -990,13 +1579,18 @@ export const useBridleStore = defineStore('bridle', {
         type AgentMeta = { debugEnabled?: boolean }
         type Envelope = { data?: AgentMeta }
         const body = (await res.json()) as Envelope & AgentMeta
-        this.debugEnabled = !!(body.data?.debugEnabled ?? body.debugEnabled)
+        this.conversation(agentId, channel).debugEnabled = !!(body.data?.debugEnabled ?? body.debugEnabled)
       } catch (err) {
         console.warn('[bridle] failed to load agent meta', err)
       }
     },
 
-    async setDebugEnabled(apiUrl: string, agentId: string, enabled: boolean): Promise<boolean> {
+    async setDebugEnabled(
+      apiUrl: string,
+      agentId: string,
+      enabled: boolean,
+      channel = DEFAULT_CHANNEL,
+    ): Promise<boolean> {
       // Debug is persisted through the regular agent-update endpoint
       // (PUT /agents/:id). The API still pushes the live prompt-debug control
       // event over the bridle WS when `debugEnabled` is in the payload.
@@ -1017,7 +1611,7 @@ export const useBridleStore = defineStore('bridle', {
         type Envelope = { data?: Resp }
         const body = (await res.json()) as Envelope & Resp
         const next = body.data?.debugEnabled ?? body.debugEnabled ?? enabled
-        this.debugEnabled = next
+        this.conversation(agentId, channel).debugEnabled = next
         return next
       } catch (err) {
         console.warn('[bridle] failed to set debug flag', err)
@@ -1025,7 +1619,7 @@ export const useBridleStore = defineStore('bridle', {
       }
     },
 
-    async resetTranscript(apiUrl: string, agentId: string, channel = 'admin') {
+    async resetTranscript(apiUrl: string, agentId: string, channel = DEFAULT_CHANNEL) {
       const url = `${apiUrl.replace(/\/$/, '')}/api/agent/${encodeURIComponent(agentId)}/transcript?channel=${encodeURIComponent(channel)}`
       try {
         const res = await authedFetch(url, { method: 'DELETE' })
@@ -1033,14 +1627,22 @@ export const useBridleStore = defineStore('bridle', {
           console.warn('[bridle] transcript reset returned', res.status)
           return false
         }
-        for (const url of this._echoUrls) URL.revokeObjectURL(url)
-        this._echoUrls = []
-        this.messages = []
-        this.transcriptCursor = null
-        this.hasMoreOlder = false
-        this.debugByMessageId = {}
-        this._lastDebug = null
+        const c = this.conversation(agentId, channel)
+        for (const url of c.echoUrls) URL.revokeObjectURL(url)
+        c.echoUrls = []
+        c.messages = []
+        c.nextSeq = 1
+        c.transcriptTailTs = 0
+        c.transcriptCursor = null
+        c.hasMoreOlder = false
+        c.debugByMessageId = {}
+        c.lastDebug = null
+        c.thinkingBlocks = []
+        c.closedTurns = {}
+        c.notice = null
         clearDebugFromStorage(agentId)
+        // A new chat starts clean: undelivered leftovers of the old one go too.
+        saveOutbox(c.key, [])
         return true
       } catch (err) {
         console.warn('[bridle] failed to reset transcript', err)
@@ -1052,24 +1654,115 @@ export const useBridleStore = defineStore('bridle', {
      * Hydrate debug snapshots for the given bot from localStorage. Called from
      * the Provider on mount so the inspect icon survives a page refresh.
      */
-    loadPersistedDebug(agentId: string): void {
+    loadPersistedDebug(agentId: string, channel = DEFAULT_CHANNEL): void {
       const stored = loadDebugFromStorage(agentId)
       if (!stored) return
-      this.debugByMessageId = stored.byMessageId ?? {}
-      this._lastDebug = stored.lastDebug ?? null
+      const c = this.conversation(agentId, channel)
+      // Merged under what this session already holds: the record outlives a
+      // provider, and a snapshot received live is newer than the stored one.
+      c.debugByMessageId = { ...(stored.byMessageId ?? {}), ...c.debugByMessageId }
+      c.lastDebug = c.lastDebug ?? stored.lastDebug ?? null
     },
 
-    async loadTranscript(apiUrl: string, agentId: string, channel = 'admin') {
+    /**
+     * Load the newest transcript page and MERGE it into the conversation.
+     *
+     * It used to replace the list, which wiped whatever had been appended
+     * locally (research F3). Now the transcript is the authority for what it
+     * holds, and everything it does not hold yet stays, below it: the outbox
+     * (not-delivered messages, also from a previous page load) and this
+     * session's live items the runtime has not saved yet.
+     */
+    async loadTranscript(apiUrl: string, agentId: string, channel = DEFAULT_CHANNEL) {
+      const c = this.conversation(agentId, channel)
+      let page: ITranscriptPage | null = null
       try {
-        const page = await fetchTranscriptPage(apiUrl, agentId, channel)
-        if (!page) return
-        this.messages = page.messages.map(toBridleMessage)
-        this.transcriptCursor = page.nextCursor
-        this.hasMoreOlder = page.hasMore
-        this._hydrateAttachments(apiUrl, agentId, page.messages)
+        page = await fetchTranscriptPage(apiUrl, agentId, channel)
       } catch (err) {
         console.warn('[bridle] failed to load transcript', err)
       }
+
+      // Outbox entries that are not in memory were written by a previous page.
+      // Whatever was still in flight then can no longer be acknowledged.
+      const known = new Set(c.messages.map(m => m.id))
+      const restored: IBridleMessageData[] = loadOutbox(c.key)
+        .filter(e => !known.has(e.id))
+        .map(e => ({
+          id: e.id,
+          role: 'user' as const,
+          text: e.text,
+          parts: buildParts(e.text),
+          ts: e.ts,
+          ...nextDelivery(
+            { delivery: e.delivery, failureCode: e.failureCode },
+            { type: 'pageLoad' },
+          ),
+          ...(e.attachments?.length ? { attachments: e.attachments } : {}),
+        }))
+
+      const local = [...c.messages, ...restored]
+      const source = page?.messages ?? []
+      const tailTs = source.reduce((max, m) => Math.max(max, m.ts), 0)
+      // Without a page (fetch failed) nothing on screen is contradicted.
+      const kept = !page
+        ? local
+        : local.filter((m) => {
+            if (m.replayed) return false
+            if (m.role === 'assistant') {
+              // Same clock as the transcript: newer than its tail means the
+              // runtime has not saved it yet (it saves at the end of a turn).
+              return !!m.streaming || m.ts > tailTs
+            }
+            if (isInTranscript(m, source)) return false
+            const pending = !!m.delivery && m.delivery !== 'delivered'
+            // A delivered message the page does not show is further back
+            // than the page reaches — it belongs to an older page, not here.
+            return pending || m.ts >= tailTs - PERSISTED_MATCH_WINDOW_MS
+          })
+
+      // Thinking segments are session-only. Keep the ones that sit below the
+      // last local item the transcript took over; the rest belonged to turns
+      // that are plain transcript now.
+      const keptIds = new Set(kept.map(m => m.id))
+      const cutSeq = local.reduce(
+        (max, m) => (!keptIds.has(m.id) && typeof m.seq === 'number' ? Math.max(max, m.seq) : max),
+        Number.NEGATIVE_INFINITY,
+      )
+      const blocks = c.thinkingBlocks.filter(
+        b => b.status === 'thinking' || (b.seq ?? 0) > cutSeq,
+      )
+
+      // Transcript first, in the order returned, numbered from 1 — then the
+      // local tail in the order it happened (restored entries have no `seq`
+      // yet and go last).
+      const transcript = page ? numberLegacy(source.map(toBridleMessage)) : []
+      let seq = nextSeq(transcript)
+      const order = (s?: number) => s ?? Number.MAX_SAFE_INTEGER
+      const tail = [
+        ...kept.map(m => ({ seq: m.seq, message: m, block: null as IThinkingBlock | null })),
+        ...blocks.map(b => ({ seq: b.seq, message: null as IBridleMessageData | null, block: b })),
+      ].sort((a, b) => order(a.seq) - order(b.seq))
+      const messages: IBridleMessageData[] = [...transcript]
+      for (const item of tail) {
+        if (item.block) item.block.seq = seq++
+        else if (item.message) messages.push({ ...item.message, seq: seq++ })
+      }
+
+      c.messages = messages
+      c.thinkingBlocks = blocks
+      c.nextSeq = seq
+      if (page) {
+        c.transcriptTailTs = tailTs
+        c.transcriptCursor = page.nextCursor
+        c.hasMoreOlder = page.hasMore
+      }
+      this._persistOutbox(c.key)
+      this._hydrateAttachments(apiUrl, agentId, channel, [
+        ...source,
+        // A restored message lost its echo with the page — rebuild the chips
+        // from the references it kept.
+        ...restored.map(m => ({ id: m.id, attachments: m.attachments })),
+      ])
     },
 
     /**
@@ -1084,9 +1777,11 @@ export const useBridleStore = defineStore('bridle', {
     _hydrateAttachments(
       apiUrl: string,
       agentId: string,
-      source: ITranscriptPageMessage[],
+      channel: string,
+      source: Array<{ id: string; attachments?: ITranscriptAttachment[] }>,
     ) {
       const base = apiUrl.replace(/\/$/, '')
+      const key = bridleKey(agentId, channel)
       for (const m of source) {
         const attachments = m.attachments
         if (!attachments?.length) continue
@@ -1107,7 +1802,7 @@ export const useBridleStore = defineStore('bridle', {
                 })
               } else {
                 const url = URL.createObjectURL(blob)
-                this._echoUrls.push(url)
+                this._conv(key)?.echoUrls.push(url)
                 parts.push({
                   type: BridlePartTypes.File,
                   url,
@@ -1129,10 +1824,12 @@ export const useBridleStore = defineStore('bridle', {
           // Looked up at completion on purpose: if the transcript was
           // cleared or reloaded while bytes were in flight, the id is gone
           // and the late result is dropped instead of resurrecting a bubble.
-          const target = this.messages.find((x) => x.id === m.id)
+          const target = this._conv(key)?.messages.find((x) => x.id === m.id)
           if (!target) return
+          // A second load of the same page must not stack the media twice.
+          const text = target.parts.filter(p => p.type === BridlePartTypes.Text)
           // Media above the text, the way every chat client orders it.
-          target.parts = [...parts, ...target.parts]
+          target.parts = [...parts, ...text]
         })()
       }
     },
@@ -1146,31 +1843,40 @@ export const useBridleStore = defineStore('bridle', {
     async loadOlderTranscript(
       apiUrl: string,
       agentId: string,
-      channel = 'admin',
+      channel = DEFAULT_CHANNEL,
     ): Promise<number> {
-      if (this.loadingOlder || !this.hasMoreOlder || !this.transcriptCursor) {
+      const c = this.conversation(agentId, channel)
+      if (c.loadingOlder || !c.hasMoreOlder || !c.transcriptCursor) {
         return 0
       }
-      this.loadingOlder = true
+      c.loadingOlder = true
       try {
         const page = await fetchTranscriptPage(
           apiUrl,
           agentId,
           channel,
-          this.transcriptCursor,
+          c.transcriptCursor,
         )
         if (!page) return 0
-        const olderMessages = page.messages.map(toBridleMessage)
-        this.messages = [...olderMessages, ...this.messages]
-        this.transcriptCursor = page.nextCursor
-        this.hasMoreOlder = page.hasMore
-        this._hydrateAttachments(apiUrl, agentId, page.messages)
+        const known = new Set(c.messages.map(m => m.id))
+        const fresh = page.messages.filter(m => !known.has(m.id))
+        // Numbered BELOW the current minimum, so everything already on screen
+        // keeps its `seq` — and with it its place and its render key.
+        const floor = c.messages.reduce((min, m) => Math.min(min, m.seq ?? min), 1)
+        const olderMessages = fresh.map((m, i) => ({
+          ...toBridleMessage(m),
+          seq: floor - fresh.length + i,
+        }))
+        c.messages = [...olderMessages, ...c.messages]
+        c.transcriptCursor = page.nextCursor
+        c.hasMoreOlder = page.hasMore
+        this._hydrateAttachments(apiUrl, agentId, channel, fresh)
         return olderMessages.length
       } catch (err) {
         console.warn('[bridle] failed to load older transcript', err)
         return 0
       } finally {
-        this.loadingOlder = false
+        c.loadingOlder = false
       }
     },
 
diff --git a/admin/slices/bridle/utils/bun-test.d.ts b/admin/slices/bridle/utils/bun-test.d.ts
new file mode 100644
index 00000000..157411ba
--- /dev/null
+++ b/admin/slices/bridle/utils/bun-test.d.ts
@@ -0,0 +1,18 @@
+/**
+ * The `*.test.ts` files beside this one run under `bun test`, which ships
+ * `bun:test` itself. `nuxt typecheck` walks the same folder with no Bun types
+ * installed, and adding `@types/bun` for three matchers is a dependency this
+ * slice does not need — so this declares just the surface the tests use.
+ * Delete it if `@types/bun` ever lands in admin/package.json.
+ */
+declare module 'bun:test' {
+  interface IMatchers {
+    toBe(expected: unknown): void
+    toEqual(expected: unknown): void
+    not: IMatchers
+  }
+
+  export function describe(name: string, fn: () => void): void
+  export function test(name: string, fn: () => void | Promise<void>): void
+  export function expect(actual: unknown): IMatchers
+}
diff --git a/admin/slices/bridle/utils/chatFlow.test.ts b/admin/slices/bridle/utils/chatFlow.test.ts
new file mode 100644
index 00000000..f3edbc55
--- /dev/null
+++ b/admin/slices/bridle/utils/chatFlow.test.ts
@@ -0,0 +1,137 @@
+// TWIN FILE: `app/slices/bridle/utils/chatFlow.test.ts` — change them together.
+import { describe, expect, test } from 'bun:test'
+import { buildChatFlow, nextSeq, numberLegacy } from './chatFlow'
+
+// Local-time constructor on purpose: day separators follow the reader's
+// calendar, so the fixtures must not depend on the machine's timezone.
+const at = (y: number, m: number, d: number, h = 12, min = 0) =>
+  new Date(y, m - 1, d, h, min).getTime()
+
+const NOW = at(2026, 9, 18, 15)
+const options = { locale: 'en', now: NOW }
+
+const msg = (id: string, ts: number, seq?: number, role: 'user' | 'assistant' = 'user') => ({
+  id,
+  role,
+  ts,
+  ...(seq === undefined ? {} : { seq }),
+})
+
+const block = (turnId: string, seg: number, ts: number, seq: number) => ({
+  turnId,
+  seg,
+  ts,
+  seq,
+  status: 'done' as const,
+})
+
+describe('buildChatFlow', () => {
+  test('a reply stamped 2 minutes EARLIER than the question still renders after it', () => {
+    // Browser clock runs 2 min ahead of the agent's (research F1).
+    const question = msg('q', at(2026, 9, 18, 12, 2), 1)
+    const reply = msg('a', at(2026, 9, 18, 12, 0), 2, 'assistant')
+    const flow = buildChatFlow([reply, question], [], options)
+    expect(flow.map(i => i.key)).toEqual(['m-q', 'm-a'])
+  })
+
+  test('equal ts is ordered by seq', () => {
+    const ts = at(2026, 9, 18)
+    const flow = buildChatFlow([msg('b', ts, 2), msg('a', ts, 1), msg('c', ts, 3)], [], options)
+    expect(flow.map(i => i.key)).toEqual(['m-a', 'm-b', 'm-c'])
+  })
+
+  test('thinking segments interleave by seq, whatever their ts says', () => {
+    const ts = at(2026, 9, 18)
+    const flow = buildChatFlow(
+      [msg('q', ts + 5000, 1), msg('a', ts, 3, 'assistant')],
+      // Agent-clock ts far in the past — must still sit between q and a.
+      [block('t1', 0, ts - 60_000, 2)],
+      options,
+    )
+    expect(flow.map(i => i.key)).toEqual(['m-q', 'b-t1#0', 'm-a'])
+    expect(flow.map(i => i.kind)).toEqual(['message', 'block', 'message'])
+  })
+
+  test('inserts a day separator where the calendar day changes, and above a first message that is not from today', () => {
+    const flow = buildChatFlow(
+      [
+        msg('old', at(2026, 9, 10), 1),
+        msg('y1', at(2026, 9, 17, 23, 50), 2),
+        msg('t1', at(2026, 9, 18, 0, 5), 3),
+        msg('t2', at(2026, 9, 18, 9), 4),
+      ],
+      [],
+      options,
+    )
+    expect(flow.map(i => i.key)).toEqual(['d-old', 'm-old', 'd-y1', 'm-y1', 'd-t1', 'm-t1', 'm-t2'])
+    const days = flow.filter(i => i.kind === 'day')
+    expect(days.map(d => d.kind === 'day' && d.relative)).toEqual([null, 'yesterday', 'today'])
+    // The separator takes the seq of the message it precedes.
+    expect(days.map(d => d.seq)).toEqual([1, 2, 3])
+  })
+
+  test('a day that is neither today nor yesterday gets a long date label', () => {
+    const flow = buildChatFlow(
+      [msg('a', at(2026, 3, 1), 1), msg('b', at(2026, 3, 2), 2)],
+      [],
+      options,
+    )
+    const days = flow.filter(i => i.kind === 'day')
+    expect(days.map(d => d.kind === 'day' && d.relative)).toEqual([null, null])
+    expect(days.map(d => d.kind === 'day' && d.label)).toEqual(['March 1, 2026', 'March 2, 2026'])
+  })
+
+  test('a conversation that started today has no separator, and a thinking segment never opens one', () => {
+    const flow = buildChatFlow(
+      [msg('a', at(2026, 9, 18, 9), 1), msg('b', at(2026, 9, 18, 10), 3)],
+      [block('t', 0, at(2026, 9, 17), 2)],
+      options,
+    )
+    expect(flow.some(i => i.kind === 'day')).toBe(false)
+  })
+
+  test('messages without seq keep their array order; a block without one sinks to the end', () => {
+    const ts = at(2026, 9, 18)
+    const orphan = { turnId: 't', seg: 0, ts: ts - 60_000, status: 'done' as const }
+    const flow = buildChatFlow([msg('x', ts + 2), msg('y', ts + 1), msg('z', ts)], [orphan], options)
+    expect(flow.map(i => i.key)).toEqual(['m-x', 'm-y', 'm-z', 'b-t#0'])
+  })
+
+  test('hands back the message objects it was given, not copies', () => {
+    const legacy = msg('x', at(2026, 9, 18))
+    const flow = buildChatFlow([legacy], [], options)
+    expect(flow[0]?.kind === 'message' && flow[0].message).toBe(legacy)
+  })
+})
+
+describe('nextSeq', () => {
+  test('starts at 1', () => {
+    expect(nextSeq([])).toBe(1)
+    expect(nextSeq([{}])).toBe(1)
+  })
+
+  test('is one above the highest seq, negatives included', () => {
+    expect(nextSeq([{ seq: 4 }, { seq: 9 }, { seq: -3 }])).toBe(10)
+  })
+})
+
+describe('numberLegacy', () => {
+  test('numbers messages without seq in array order', () => {
+    const out = numberLegacy([msg('a', 30), msg('b', 10), msg('c', 20)])
+    expect(out.map(m => [m.id, m.seq])).toEqual([['a', 1], ['b', 2], ['c', 3]])
+  })
+
+  test('fills only the gaps: one past the highest seq seen so far', () => {
+    const out = numberLegacy([msg('a', 1, 5), msg('b', 2), msg('c', 3)])
+    expect(out.map(m => m.seq)).toEqual([5, 6, 7])
+  })
+
+  test('leaves a fully numbered list alone and does not mutate its input', () => {
+    const input = [msg('a', 1, 7), msg('b', 2, 9)]
+    const out = numberLegacy(input)
+    expect(out.map(m => m.seq)).toEqual([7, 9])
+    const legacy = [msg('x', 1)]
+    numberLegacy(legacy)
+    expect('seq' in legacy[0]!).toBe(false)
+  })
+})
diff --git a/admin/slices/bridle/utils/chatFlow.ts b/admin/slices/bridle/utils/chatFlow.ts
new file mode 100644
index 00000000..79475007
--- /dev/null
+++ b/admin/slices/bridle/utils/chatFlow.ts
@@ -0,0 +1,174 @@
+/**
+ * The visible order of a conversation — messages, thinking segments and day
+ * separators — as one pure function.
+ *
+ * TWIN FILE: `app/slices/bridle/utils/chatFlow.ts` holds the same logic for the
+ * app console. Change them together.
+ *
+ * Ordering is by `seq` ONLY. `seq` is the per-conversation arrival sequence the
+ * store assigns on append; `ts` comes from whichever clock stamped the item
+ * (browser for the operator's own message, agent runtime for replies) and is
+ * for display. Sorting by `ts` is what put a reply above its question whenever
+ * the two clocks disagreed (CLEAN-102, research F1).
+ *
+ * No Vue / Nuxt imports: this file runs under `bun test`.
+ */
+
+/** The least a message must carry to be placed in the flow. */
+export interface IChatFlowMessage {
+  id: string
+  ts: number
+  seq?: number
+}
+
+/** The least a thinking segment must carry to be placed in the flow. */
+export interface IChatFlowBlock {
+  turnId: string
+  seg: number
+  ts: number
+  seq?: number
+}
+
+export interface IChatFlowMessageItem<M> {
+  key: string
+  seq: number
+  kind: 'message'
+  message: M
+}
+
+export interface IChatFlowBlockItem<B> {
+  key: string
+  seq: number
+  kind: 'block'
+  block: B
+}
+
+export interface IChatFlowDayItem {
+  key: string
+  /** The `seq` of the message this separator precedes. */
+  seq: number
+  kind: 'day'
+  /** `ts` of the first message of the new day. */
+  ts: number
+  /** Set when the day is today / yesterday relative to `now`. */
+  relative: 'today' | 'yesterday' | null
+  /** Long date in `locale` — what to show when `relative` is null. */
+  label: string
+}
+
+export type ChatFlowItem<M, B> =
+  | IChatFlowMessageItem<M>
+  | IChatFlowBlockItem<B>
+  | IChatFlowDayItem
+
+export interface IChatFlowOptions {
+  locale: string
+  /** Epoch ms "now" — injected so today / yesterday is testable. */
+  now: number
+}
+
+/** Local calendar day as a comparable number (y*10000 + m*100 + d). */
+function dayOf(ts: number): number {
+  const d = new Date(ts)
+  return d.getFullYear() * 10000 + (d.getMonth() + 1) * 100 + d.getDate()
+}
+
+function relativeDay(ts: number, now: number): 'today' | 'yesterday' | null {
+  const day = dayOf(ts)
+  if (day === dayOf(now)) return 'today'
+  const y = new Date(now)
+  // Calendar arithmetic, not `now - 24h`: a DST day is 23 or 25 hours long.
+  y.setDate(y.getDate() - 1)
+  return day === dayOf(y.getTime()) ? 'yesterday' : null
+}
+
+/**
+ * Build the flow the template iterates.
+ *
+ * Messages without a `seq` (there should be none once the store numbers every
+ * append) are numbered in array order; a thinking segment without one sinks to
+ * the end rather than being placed by its agent-clock `ts`.
+ *
+ * A `day` separator goes where the calendar day of `ts` changes between two
+ * consecutive MESSAGES — and above the first message when the conversation did
+ * not start today, or the times under an old conversation would belong to no
+ * date at all. Thinking segments never open a day.
+ */
+export function buildChatFlow<M extends IChatFlowMessage, B extends IChatFlowBlock>(
+  messages: readonly M[],
+  blocks: readonly B[],
+  options: IChatFlowOptions,
+): ChatFlowItem<M, B>[] {
+  const items: Array<IChatFlowMessageItem<M> | IChatFlowBlockItem<B>> = [
+    ...numberLegacy(messages).map((m, i) => ({
+      key: `m-${m.id}`,
+      seq: m.seq,
+      kind: 'message' as const,
+      // The caller's own object, not numberLegacy's copy: the template must
+      // render the store's reactive message.
+      message: messages[i]!,
+    })),
+    ...blocks.map(b => ({
+      key: `b-${b.turnId}#${b.seg}`,
+      seq: b.seq ?? Number.MAX_SAFE_INTEGER,
+      kind: 'block' as const,
+      block: b,
+    })),
+  ]
+  // Array.prototype.sort is stable: equal `seq` keeps the given order.
+  items.sort((a, b) => a.seq - b.seq)
+
+  let dateFormat: Intl.DateTimeFormat | null = null
+  const flow: ChatFlowItem<M, B>[] = []
+  let previousDay: number | null = null
+  const today = dayOf(options.now)
+
+  for (const item of items) {
+    if (item.kind === 'message') {
+      const day = dayOf(item.message.ts)
+      if (previousDay === null ? day !== today : day !== previousDay) {
+        dateFormat ??= new Intl.DateTimeFormat(options.locale, { dateStyle: 'long' })
+        flow.push({
+          key: `d-${item.message.id}`,
+          seq: item.seq,
+          kind: 'day',
+          ts: item.message.ts,
+          relative: relativeDay(item.message.ts, options.now),
+          label: dateFormat.format(item.message.ts),
+        })
+      }
+      previousDay = day
+    }
+    flow.push(item)
+  }
+  return flow
+}
+
+/** The next free `seq` for a conversation holding `items`. Starts at 1. */
+export function nextSeq(items: ReadonlyArray<{ seq?: number }>): number {
+  let max = 0
+  for (const item of items) {
+    if (typeof item.seq === 'number' && item.seq > max) max = item.seq
+  }
+  return max + 1
+}
+
+/**
+ * Number the items that lack a `seq`, in array order — a transcript page comes
+ * in file order, which is the order it happened in. An item that already
+ * carries a `seq` is returned untouched; one that lacks it gets one past the
+ * highest seen so far. The input is not mutated.
+ */
+export function numberLegacy<T extends { seq?: number }>(
+  items: readonly T[],
+): Array<T & { seq: number }> {
+  let last = 0
+  return items.map((item) => {
+    if (typeof item.seq === 'number') {
+      last = Math.max(last, item.seq)
+      return item as T & { seq: number }
+    }
+    last += 1
+    return { ...item, seq: last }
+  })
+}
diff --git a/admin/slices/bridle/utils/delivery.test.ts b/admin/slices/bridle/utils/delivery.test.ts
new file mode 100644
index 00000000..9dc6e7ed
--- /dev/null
+++ b/admin/slices/bridle/utils/delivery.test.ts
@@ -0,0 +1,76 @@
+// TWIN FILE: `app/slices/bridle/utils/delivery.test.ts` — change them together.
+import { describe, expect, test } from 'bun:test'
+import { FAILED_MS, SLOW_MS, nextDelivery, type IDeliveryState } from './delivery'
+
+const sending: IDeliveryState = { delivery: 'sending' }
+const slow: IDeliveryState = { delivery: 'slow' }
+const delivered: IDeliveryState = { delivery: 'delivered' }
+const failed: IDeliveryState = { delivery: 'failed', failureCode: 'AGENT_OFFLINE' }
+
+describe('nextDelivery', () => {
+  test('thresholds are the documented ones', () => {
+    expect(SLOW_MS).toBe(5000)
+    expect(FAILED_MS).toBe(30000)
+  })
+
+  test('sent → sending', () => {
+    expect(nextDelivery({}, { type: 'sent' })).toEqual({ delivery: 'sending' })
+  })
+
+  test('tick below 5 s changes nothing', () => {
+    expect(nextDelivery(sending, { type: 'tick', elapsedMs: SLOW_MS - 1 })).toEqual(sending)
+  })
+
+  test('tick at 5 s: sending → slow', () => {
+    expect(nextDelivery(sending, { type: 'tick', elapsedMs: SLOW_MS })).toEqual(slow)
+  })
+
+  test('tick at 30 s: sending / slow → failed TIMEOUT', () => {
+    const timeout = { delivery: 'failed', failureCode: 'TIMEOUT' }
+    expect(nextDelivery(slow, { type: 'tick', elapsedMs: FAILED_MS })).toEqual(timeout)
+    expect(nextDelivery(sending, { type: 'tick', elapsedMs: FAILED_MS })).toEqual(timeout)
+  })
+
+  test('tick never touches a settled message', () => {
+    expect(nextDelivery(delivered, { type: 'tick', elapsedMs: FAILED_MS })).toEqual(delivered)
+    expect(nextDelivery(failed, { type: 'tick', elapsedMs: FAILED_MS })).toEqual(failed)
+    expect(nextDelivery({}, { type: 'tick', elapsedMs: FAILED_MS })).toEqual({})
+  })
+
+  test('ackAccepted: sending / slow → delivered', () => {
+    expect(nextDelivery(sending, { type: 'ackAccepted' })).toEqual(delivered)
+    expect(nextDelivery(slow, { type: 'ackAccepted' })).toEqual(delivered)
+  })
+
+  test('a late ackAccepted moves failed → delivered and drops the code', () => {
+    const timedOut: IDeliveryState = { delivery: 'failed', failureCode: 'TIMEOUT' }
+    expect(nextDelivery(timedOut, { type: 'ackAccepted' })).toEqual(delivered)
+  })
+
+  test('ackRejected: sending / slow → failed with the code', () => {
+    expect(nextDelivery(sending, { type: 'ackRejected', code: 'AGENT_OFFLINE' })).toEqual(failed)
+    expect(nextDelivery(slow, { type: 'ackRejected', code: 'ATTACHMENT_FAILED' })).toEqual({
+      delivery: 'failed',
+      failureCode: 'ATTACHMENT_FAILED',
+    })
+  })
+
+  test('ackRejected cannot un-deliver a message', () => {
+    expect(nextDelivery(delivered, { type: 'ackRejected', code: 'EMPTY' })).toEqual(delivered)
+    expect(nextDelivery({}, { type: 'ackRejected', code: 'EMPTY' })).toEqual({})
+  })
+
+  test('pageLoad: sending / slow → failed TIMEOUT, settled states stay', () => {
+    const timeout = { delivery: 'failed', failureCode: 'TIMEOUT' }
+    expect(nextDelivery(sending, { type: 'pageLoad' })).toEqual(timeout)
+    expect(nextDelivery(slow, { type: 'pageLoad' })).toEqual(timeout)
+    expect(nextDelivery(failed, { type: 'pageLoad' })).toEqual(failed)
+    expect(nextDelivery(delivered, { type: 'pageLoad' })).toEqual(delivered)
+  })
+
+  test('resend: failed → sending, code cleared; a no-op anywhere else', () => {
+    expect(nextDelivery(failed, { type: 'resend' })).toEqual(sending)
+    expect(nextDelivery(delivered, { type: 'resend' })).toEqual(delivered)
+    expect(nextDelivery(slow, { type: 'resend' })).toEqual(slow)
+  })
+})
diff --git a/admin/slices/bridle/utils/delivery.ts b/admin/slices/bridle/utils/delivery.ts
new file mode 100644
index 00000000..d60aa833
--- /dev/null
+++ b/admin/slices/bridle/utils/delivery.ts
@@ -0,0 +1,80 @@
+/**
+ * Delivery state of the operator's own message, as a pure reducer.
+ *
+ * TWIN FILE: `app/slices/bridle/utils/delivery.ts` holds the same state machine
+ * for the app console. Change them together.
+ *
+ *            send()              5 s without ack          30 s without ack
+ *   (none) ─────────► sending ──────────────────► slow ──────────────────► failed
+ *                        │                         │                        │ ▲
+ *                        │ ack accepted            │ ack accepted           │ │ resend() (same id)
+ *                        ▼                         ▼                        ▼ │
+ *                    delivered ◄───────────────────┘                     sending
+ *                        ▲
+ *                        │ ack rejected ──► failed (with failureCode)
+ *
+ * See specs/015-chat-message-reliability/data-model.md. No Vue / Nuxt imports:
+ * this file runs under `bun test`.
+ */
+
+/** Without an ack for this long the bubble says "taking longer than usual". */
+export const SLOW_MS = 5000
+/** Without an ack for this long the message is shown as not delivered. */
+export const FAILED_MS = 30000
+
+export type BridleDelivery = 'sending' | 'slow' | 'delivered' | 'failed'
+
+export interface IDeliveryState {
+  /** Absent means delivered — replayed and legacy messages carry no state. */
+  delivery?: BridleDelivery
+  failureCode?: string
+}
+
+export type DeliveryEvent =
+  | { type: 'sent' }
+  | { type: 'tick'; elapsedMs: number }
+  | { type: 'ackAccepted' }
+  | { type: 'ackRejected'; code: string }
+  | { type: 'pageLoad' }
+  | { type: 'resend' }
+
+function isPending(state: IDeliveryState): boolean {
+  return state.delivery === 'sending' || state.delivery === 'slow'
+}
+
+export function nextDelivery(
+  state: IDeliveryState,
+  event: DeliveryEvent,
+): IDeliveryState {
+  switch (event.type) {
+    case 'sent':
+      return { delivery: 'sending' }
+
+    case 'tick':
+      if (!isPending(state)) return state
+      if (event.elapsedMs >= FAILED_MS) {
+        return { delivery: 'failed', failureCode: 'TIMEOUT' }
+      }
+      if (event.elapsedMs >= SLOW_MS) return { delivery: 'slow' }
+      return state
+
+    case 'ackAccepted':
+      // Also out of `failed`: an ack that arrives after we gave up still
+      // means the hub handed the message over.
+      return { delivery: 'delivered' }
+
+    case 'ackRejected':
+      // A message the hub already accepted cannot be un-delivered.
+      if (state.delivery === 'delivered' || state.delivery === undefined) return state
+      return { delivery: 'failed', failureCode: event.code }
+
+    case 'pageLoad':
+      // The ack can no longer arrive: the socket it was due on is gone.
+      if (!isPending(state)) return state
+      return { delivery: 'failed', failureCode: 'TIMEOUT' }
+
+    case 'resend':
+      if (state.delivery !== 'failed') return state
+      return { delivery: 'sending' }
+  }
+}
diff --git a/admin/slices/rancher/components/rancher/Provider.vue b/admin/slices/rancher/components/rancher/Provider.vue
index 14c87ac9..9235d39f 100644
--- a/admin/slices/rancher/components/rancher/Provider.vue
+++ b/admin/slices/rancher/components/rancher/Provider.vue
@@ -65,8 +65,13 @@ const adminConnected = computed(() => {
   return a.status === 'running';
 });
 
+// The Rancher's OWN chat socket — chat state is per conversation now, so an
+// agent chat open elsewhere no longer answers for this one.
 const fullyConnected = computed(
-  () => adminConnected.value && bridleStore.isConnected,
+  () =>
+    adminConnected.value &&
+    !!admin.value &&
+    bridleStore.isConnectedFor(admin.value.id),
 );
 
 if (import.meta.client) {
diff --git a/api/src/slices/agent/agent/agent.controller.ts b/api/src/slices/agent/agent/agent.controller.ts
index 47df8fc0..f61444bd 100644
--- a/api/src/slices/agent/agent/agent.controller.ts
+++ b/api/src/slices/agent/agent/agent.controller.ts
@@ -118,6 +118,9 @@ export class AgentController {
           agent.workflowId,
           `deploy workflow ${phase.toLowerCase()}`,
         );
+        // Only the caller of this GET would learn about the flip otherwise —
+        // push it to every open status stream (lists, other operators).
+        this.agentStatusService.notifyStatusChanged(agentId);
         return this.agentGateway.findById(agentId);
       }
     } catch {
diff --git a/api/src/slices/agent/agent/domain/agentStatus.service.spec.ts b/api/src/slices/agent/agent/domain/agentStatus.service.spec.ts
index 5c34113a..b319b961 100644
--- a/api/src/slices/agent/agent/domain/agentStatus.service.spec.ts
+++ b/api/src/slices/agent/agent/domain/agentStatus.service.spec.ts
@@ -1,5 +1,8 @@
 import { Subject } from 'rxjs';
-import { AgentStatusService } from './agentStatus.service';
+import {
+  AgentStatusService,
+  AgentStatusStreamMessage,
+} from './agentStatus.service';
 import { IAgentData } from './agent.types';
 import { IAgentPodStatus } from '#/agent/pod/domain/pod.types';
 
@@ -69,7 +72,10 @@ interface ITestBed {
   deployTracker: { mark: jest.Mock; clear: jest.Mock; isStale: jest.Mock };
 }
 
-function createTestBed(agents: IAgentData[], pods: IAgentPodStatus[]): ITestBed {
+function createTestBed(
+  agents: IAgentData[],
+  pods: IAgentPodStatus[],
+): ITestBed {
   const agentGateway = {
     findAll: jest.fn().mockResolvedValue(agents),
     findById: jest
@@ -217,6 +223,65 @@ describe('AgentStatusService bridle connectivity', () => {
     );
   });
 
+  // The sweep's DB-only transitions have no pod or hub event behind them. If
+  // the stream stays silent, a list keeps showing 'deploying' for an agent
+  // nobody has open while its detail view (which polls) already says 'failed'.
+  test('startup timeout on an agent nobody has open reaches the status stream', async () => {
+    const agents = [
+      makeAgent({ id: 'a1' }),
+      makeAgent({ id: 'a2', name: 'Stuck', status: 'deploying' }),
+    ];
+    const bed = createTestBed(agents, [makePod({ agentId: 'a1' })]);
+    bed.bridleGateway.isAgentConnected.mockImplementation(
+      (id: string) => id === 'a1',
+    );
+    bed.agentGateway.updateStatus.mockImplementation(
+      (id: string, status: IAgentData['status'], _wf, reason?: string) => {
+        const row = agents.find((a) => a.id === id);
+        if (row) Object.assign(row, { status, statusReason: reason ?? null });
+        return Promise.resolve(row);
+      },
+    );
+
+    const frames: AgentStatusStreamMessage[] = [];
+    const sub = bed.service.stream$().subscribe((msg) => frames.push(msg));
+    await sweep(bed.service);
+    await new Promise((resolve) => setImmediate(resolve));
+    sub.unsubscribe();
+
+    const events = frames.filter((f) => f.type === 'event');
+    expect(events).toHaveLength(1);
+    expect(events[0].payload).toMatchObject({
+      eventType: 'modified',
+      status: {
+        agent: {
+          id: 'a2',
+          status: 'failed',
+          statusReason:
+            'startup did not produce a running agent within 5 minutes',
+        },
+        pod: null,
+        bridleConnected: false,
+      },
+    });
+  });
+
+  test('notifyStatusChanged pushes the current row for writes made elsewhere', async () => {
+    const bed = createTestBed([makeAgent({ status: 'failed' })], []);
+
+    const frames: AgentStatusStreamMessage[] = [];
+    const sub = bed.service.stream$().subscribe((msg) => frames.push(msg));
+    bed.service.notifyStatusChanged('a1');
+    await new Promise((resolve) => setImmediate(resolve));
+    sub.unsubscribe();
+
+    const events = frames.filter((f) => f.type === 'event');
+    expect(events).toHaveLength(1);
+    expect(events[0].payload).toMatchObject({
+      status: { agent: { id: 'a1', status: 'failed' } },
+    });
+  });
+
   test('snapshot carries live bridleConnected per agent', async () => {
     const bed = createTestBed(
       [makeAgent({ id: 'a1' }), makeAgent({ id: 'a2', name: 'Second' })],
@@ -229,11 +294,11 @@ describe('AgentStatusService bridle connectivity', () => {
     const snapshot = await bed.service.snapshot();
 
     expect(snapshot).toHaveLength(2);
-    expect(
-      snapshot.find((s) => s.agent.id === 'a1')?.bridleConnected,
-    ).toBe(true);
-    expect(
-      snapshot.find((s) => s.agent.id === 'a2')?.bridleConnected,
-    ).toBe(false);
+    expect(snapshot.find((s) => s.agent.id === 'a1')?.bridleConnected).toBe(
+      true,
+    );
+    expect(snapshot.find((s) => s.agent.id === 'a2')?.bridleConnected).toBe(
+      false,
+    );
   });
 });
diff --git a/api/src/slices/agent/agent/domain/agentStatus.service.ts b/api/src/slices/agent/agent/domain/agentStatus.service.ts
index 95f3ae86..6a86fb8c 100644
--- a/api/src/slices/agent/agent/domain/agentStatus.service.ts
+++ b/api/src/slices/agent/agent/domain/agentStatus.service.ts
@@ -8,6 +8,7 @@ import {
 } from '@nestjs/common';
 import {
   Observable,
+  Subject,
   Subscription,
   defer,
   filter,
@@ -89,6 +90,11 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
   // First-observed timestamps of "running pod, no hub connection" per agent.
   // In-memory on purpose: resets on API restart, which IS the restart grace.
   private readonly bridleDownSince = new Map<string, number>();
+  // Ids of agents whose DB status was just written. The drift sweep changes
+  // rows with no pod or hub event behind it (startup timeout → 'failed',
+  // 'unreachable'), so without this the SSE stream stayed silent and every
+  // list kept showing 'deploying' until someone opened that agent.
+  private readonly statusWrites$ = new Subject<string>();
 
   constructor(
     private readonly agentGateway: IAgentGateway,
@@ -193,11 +199,7 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
     this.logger.log(
       `Reconciling agent ${agentId}: bridle runtime registered — marking running`,
     );
-    await this.agentGateway.updateStatus(
-      agentId,
-      'running',
-      agent.workflowId ?? undefined,
-    );
+    await this.writeStatus(agentId, 'running', agent.workflowId ?? undefined);
     // Sync-conflict marker (CLEAN-50): a not-yet-running agent that just
     // registered on bridle is a fresh boot, and the runtime pulls its S3
     // working copy at boot, right before this connect. Deliberately NOT set
@@ -208,6 +210,21 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
     this.deployTracker.clear(agentId);
   }
 
+  // Every status write in this service goes through here so SSE consumers
+  // hear about it — whatever triggered the write.
+  private async writeStatus(
+    ...args: Parameters<IAgentGateway['updateStatus']>
+  ): Promise<void> {
+    await this.agentGateway.updateStatus(...args);
+    this.statusWrites$.next(args[0]);
+  }
+
+  // For status writes made outside this service (GET /agents/:id syncStatus):
+  // pushes the agent's current row to every open status stream.
+  notifyStatusChanged(agentId: string): void {
+    this.statusWrites$.next(agentId);
+  }
+
   async snapshot(): Promise<IAgentStatus[]> {
     const [agents, pods] = await Promise.all([
       this.agentGateway.findAll(),
@@ -309,7 +326,42 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
       filter((msg): msg is AgentStatusStreamMessage => msg !== null),
     );
 
-    return merge(initial$, updates$, bridleUpdates$);
+    // DB-only transitions (see statusWrites$) — no pod or hub event carries
+    // them, so they get a frame of their own.
+    const statusUpdates$ = this.statusWrites$.pipe(
+      mergeMap((agentId) =>
+        from(
+          Promise.all([
+            // A failed lookup must cost this one frame, not the whole stream:
+            // an error here would end the SSE connection of every listener.
+            this.agentGateway.findById(agentId).catch(() => null),
+            Promise.resolve()
+              .then(() => this.podGateway.list())
+              .catch(() => []),
+          ]),
+        ).pipe(
+          map(([agent, pods]): AgentStatusStreamMessage | null =>
+            agent
+              ? {
+                  type: 'event',
+                  payload: {
+                    eventType: 'modified',
+                    status: {
+                      agent,
+                      pod: pods.find((p) => p.agentId === agentId) ?? null,
+                      bridleConnected:
+                        this.bridleGateway.isAgentConnected(agentId),
+                    },
+                  },
+                }
+              : null,
+          ),
+        ),
+      ),
+      filter((msg): msg is AgentStatusStreamMessage => msg !== null),
+    );
+
+    return merge(initial$, updates$, bridleUpdates$, statusUpdates$);
   }
 
   private async detectDrift(reason: 'startup' | 'periodic'): Promise<string[]> {
@@ -352,7 +404,7 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
             this.logger.log(
               `Drift: agent ${agent.id} (${agent.name}) is ${agent.status} in DB but bridle has it registered — marking running`,
             );
-            await this.agentGateway.updateStatus(
+            await this.writeStatus(
               agent.id,
               'running',
               agent.workflowId ?? undefined,
@@ -393,7 +445,7 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
             this.logger.warn(
               `Drift: agent ${agent.id} (${agent.name}) is ${agent.status} in DB but no pod exists — marking failed (${reason})`,
             );
-            await this.agentGateway.updateStatus(
+            await this.writeStatus(
               agent.id,
               'failed',
               agent.workflowId ?? undefined,
@@ -434,7 +486,7 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
             this.logger.warn(
               `Drift: agent ${agent.id} (${agent.name}) pod is Running+Ready but the runtime never registered on the bridle hub — marking unreachable`,
             );
-            await this.agentGateway.updateStatus(
+            await this.writeStatus(
               agent.id,
               'unreachable',
               agent.workflowId ?? undefined,
@@ -543,7 +595,7 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
               : '') +
             ` — marking failed`,
         );
-        await this.agentGateway.updateStatus(
+        await this.writeStatus(
           agent.id,
           'failed',
           agent.workflowId ?? undefined,
@@ -575,7 +627,7 @@ export class AgentStatusService implements OnModuleInit, OnModuleDestroy {
       this.logger.log(
         `Reconciling agent ${agent.id}: pod ${podStatus.podName} is Running+Ready — marking running`,
       );
-      await this.agentGateway.updateStatus(
+      await this.writeStatus(
         agent.id,
         'running',
         agent.workflowId ?? undefined,
diff --git a/api/src/slices/agent/file/domain/transcriptReader.bubbles.spec.ts b/api/src/slices/agent/file/domain/transcriptReader.bubbles.spec.ts
new file mode 100644
index 00000000..c432b50e
--- /dev/null
+++ b/api/src/slices/agent/file/domain/transcriptReader.bubbles.spec.ts
@@ -0,0 +1,107 @@
+import { TranscriptReaderService } from './transcriptReader.service';
+import type { IFileGateway } from './file.gateway';
+import type { IFileChunk } from './file.types';
+
+const PATH = 'data/sessions/bridle:admin.jsonl';
+
+function fakeFiles(content: string): IFileGateway {
+  return {
+    readRange: async (): Promise<IFileChunk> => ({
+      path: PATH,
+      content,
+      size: Buffer.byteLength(content),
+      totalSize: Buffer.byteLength(content),
+      offset: 0,
+      nextOffset: null,
+      hasMore: false,
+      updatedAt: new Date(0),
+    }),
+  } as unknown as IFileGateway;
+}
+
+const read = (events: Array<Record<string, unknown>>) =>
+  new TranscriptReaderService(
+    fakeFiles(events.map((e) => JSON.stringify(e)).join('\n')),
+  ).read('agent-1', PATH);
+
+/**
+ * A streamed turn is watched as several bubbles and stored as one event. The
+ * replay used to show that event's whole text — "Проверю:Ха! Работает!" — in
+ * a single bubble (CLEAN-102). The runtime now records the bubbles on the
+ * event; the reader plays those back.
+ */
+describe('TranscriptReaderService — bubbles of one turn', () => {
+  const question = {
+    id: 'q1',
+    type: 'user',
+    ts: 1000,
+    data: { text: 'работает?' },
+  };
+
+  it('replays the bubbles the person saw, under their wire ids', async () => {
+    const messages = await read([
+      question,
+      {
+        id: 'turn-1',
+        type: 'assistant',
+        ts: 5000,
+        data: {
+          text: 'Проверю:Ха! Работает!',
+          messages: [
+            { id: 'wire-1', text: 'Проверю:', ts: 2000 },
+            { id: 'wire-2', text: 'Ха! Работает!', ts: 4000 },
+          ],
+        },
+      },
+    ]);
+
+    expect(messages.map((m) => [m.id, m.role, m.text])).toEqual([
+      ['q1', 'user', 'работает?'],
+      ['wire-1', 'assistant', 'Проверю:'],
+      ['wire-2', 'assistant', 'Ха! Работает!'],
+    ]);
+  });
+
+  it('keeps showing turns stored before bubbles were recorded', async () => {
+    const messages = await read([
+      question,
+      { id: 'turn-1', type: 'assistant', ts: 5000, data: { text: 'Да.' } },
+    ]);
+
+    expect(messages.map((m) => [m.id, m.text])).toEqual([
+      ['q1', 'работает?'],
+      ['turn-1', 'Да.'],
+    ]);
+  });
+
+  it('falls back to the whole text rather than replay only some of it', async () => {
+    const messages = await read([
+      {
+        id: 'turn-1',
+        type: 'assistant',
+        ts: 5000,
+        data: {
+          text: 'Проверю:Ха! Работает!',
+          messages: [
+            { id: 'wire-1', text: 'Проверю:', ts: 2000 },
+            { id: 'wire-2', text: 'Ха! Работает!' },
+          ],
+        },
+      },
+    ]);
+
+    expect(messages.map((m) => [m.id, m.text])).toEqual([
+      ['turn-1', 'Проверю:Ха! Работает!'],
+    ]);
+  });
+
+  it('keeps the order of the file for messages written in the same millisecond', async () => {
+    const messages = await read([
+      { id: 'a', type: 'user', ts: 1000, data: { text: 'first' } },
+      { id: 'b', type: 'assistant', ts: 1000, data: { text: 'second' } },
+      { id: 'c', type: 'user', ts: 1000, data: { text: 'third' } },
+    ]);
+
+    expect(messages.map((m) => m.id)).toEqual(['a', 'b', 'c']);
+  });
+});
diff --git a/api/src/slices/agent/file/domain/transcriptReader.service.ts b/api/src/slices/agent/file/domain/transcriptReader.service.ts
index fc4f7610..b03eb7bf 100644
--- a/api/src/slices/agent/file/domain/transcriptReader.service.ts
+++ b/api/src/slices/agent/file/domain/transcriptReader.service.ts
@@ -75,11 +75,41 @@ interface RawEvent {
     params?: unknown;
     result?: unknown;
     attachments?: unknown;
+    /** `assistant` only: the bubbles the turn was shown as (runtime ≥ CLEAN-102). */
+    messages?: unknown;
   };
 }
 
 const ATTACHMENT_KINDS = new Set(['image', 'text', 'binary']);
 
+/**
+ * Same stance as {@link sanitizeAttachments}: runtime-authored, still external
+ * input. All or nothing — one malformed entry and the caller falls back to
+ * the event's whole text, because replaying only the valid bubbles would
+ * silently drop part of what the agent said.
+ */
+function sanitizeBubbles(
+  raw: unknown,
+): Array<Pick<TranscriptMessage, 'id' | 'text' | 'ts'>> {
+  if (!Array.isArray(raw)) return [];
+  const out: Array<Pick<TranscriptMessage, 'id' | 'text' | 'ts'>> = [];
+  for (const entry of raw) {
+    const b = entry as Record<string, unknown>;
+    if (
+      typeof b?.id !== 'string' ||
+      !b.id ||
+      typeof b?.text !== 'string' ||
+      !b.text.trim() ||
+      typeof b?.ts !== 'number' ||
+      !Number.isFinite(b.ts)
+    ) {
+      return [];
+    }
+    out.push({ id: b.id, text: b.text, ts: b.ts });
+  }
+  return out;
+}
+
 /**
  * The JSONL is runtime-authored but still external input to this API —
  * filter each entry down to the exact replayable shape and drop anything
@@ -159,6 +189,18 @@ export class TranscriptReaderService {
       // split result proves the turn happened even when the runtime stored
       // no attachment metadata (legacy records).
       if (rendered === null && !attachments.length) return;
+      // A streamed turn reached the person as several bubbles but is stored
+      // as one event (its `text` is what the model sees). When the runtime
+      // recorded the bubbles, replay THOSE — same ids, same boundaries —
+      // instead of one paragraph with the sentences glued together (CLEAN-102).
+      const bubbles =
+        evt.type === 'assistant' ? sanitizeBubbles(evt.data?.messages) : [];
+      if (bubbles.length) {
+        for (const bubble of bubbles) {
+          messages.push({ ...bubble, role: 'assistant' });
+        }
+        return;
+      }
       messages.push({
         id: evt.id,
         role: evt.type as TranscriptMessage['role'],
diff --git a/api/src/slices/bridle/data/bridle.gateway.channels.spec.ts b/api/src/slices/bridle/data/bridle.gateway.channels.spec.ts
new file mode 100644
index 00000000..774f00ca
--- /dev/null
+++ b/api/src/slices/bridle/data/bridle.gateway.channels.spec.ts
@@ -0,0 +1,228 @@
+import { BridleGateway } from './bridle.gateway';
+
+type Event = Record<string, unknown>;
+
+function collector(into: Event[]) {
+  return (data: unknown) => {
+    into.push(data as Event);
+  };
+}
+
+/**
+ * One identity, several places (CLEAN-102). Every Owner/Admin chats as
+ * `admin`, and a conversation is routinely open in two tabs or in the admin
+ * panel next to the console. With one slot per identity the last socket to
+ * connect took every event and the tab that asked the question got nothing.
+ */
+describe('BridleGateway — several sockets on one conversation', () => {
+  function twoTabs() {
+    const gateway = new BridleGateway();
+    const toAgent: Event[] = [];
+    const tabA: Event[] = [];
+    const tabB: Event[] = [];
+    gateway.registerAgent('agent-1', 'agent-socket', collector(toAgent));
+    gateway.registerClient('admin', 'agent-1', 'tab-a', collector(tabA), true);
+    gateway.registerClient('admin', 'agent-1', 'tab-b', collector(tabB), true);
+    return { gateway, toAgent, tabA, tabB };
+  }
+
+  it('delivers the answer to the tab that asked, not only the newest one', () => {
+    const { gateway, tabA, tabB } = twoTabs();
+
+    gateway.handleAgentEvent('agent-1', {
+      type: 'message',
+      clientId: 'admin',
+      text: 'hi',
+      messageId: 'm1',
+    });
+
+    expect(tabA.map((e) => e.type)).toEqual(['message']);
+    expect(tabB.map((e) => e.type)).toEqual(['message']);
+    expect(tabA[0].seq).toBe(tabB[0].seq);
+  });
+
+  it('keeps the other tab receiving when one of them leaves', () => {
+    const { gateway, tabA, tabB } = twoTabs();
+
+    gateway.unregisterClient('admin', 'agent-1', 'tab-b');
+    gateway.handleAgentEvent('agent-1', {
+      type: 'message',
+      clientId: 'admin',
+      text: 'hi',
+      messageId: 'm1',
+    });
+
+    expect(tabA).toHaveLength(1);
+    expect(tabB).toHaveLength(0);
+  });
+
+  it('shows the question in the other tab, not in the one that sent it', () => {
+    const { gateway, tabA, tabB } = twoTabs();
+
+    gateway.sendToAgent('admin', 'agent-1', 'model text', [], undefined, {
+      socketId: 'tab-a',
+      clientMessageId: 'c1',
+      displayText: 'typed text',
+    });
+
+    expect(tabA).toHaveLength(0);
+    expect(tabB).toHaveLength(1);
+    expect(tabB[0]).toMatchObject({
+      type: 'user_message',
+      messageId: 'c1',
+      text: 'typed text',
+    });
+  });
+
+  it('counts sockets, not identities, in health', () => {
+    const { gateway } = twoTabs();
+
+    expect(gateway.agentHealth('agent-1').browserClients).toBe(2);
+  });
+});
+
+describe('BridleGateway — acknowledged sends', () => {
+  function setup(agentOnline = true) {
+    const gateway = new BridleGateway();
+    const toAgent: Event[] = [];
+    const toBrowser: Event[] = [];
+    if (agentOnline) {
+      gateway.registerAgent('agent-1', 'agent-socket', collector(toAgent));
+    }
+    gateway.registerClient(
+      'admin',
+      'agent-1',
+      'tab-a',
+      collector(toBrowser),
+      true,
+    );
+    return { gateway, toAgent, toBrowser };
+  }
+  const withAck = { socketId: 'tab-a', clientMessageId: 'c1', withAck: true };
+
+  it('forwards the id the browser minted and reports it accepted', () => {
+    const { gateway, toAgent } = setup();
+
+    const result = gateway.sendToAgent(
+      'admin',
+      'agent-1',
+      'hi',
+      [],
+      undefined,
+      withAck,
+    );
+
+    expect(result).toMatchObject({ status: 'accepted', messageId: 'c1' });
+    expect(toAgent).toHaveLength(1);
+    expect(toAgent[0].messageId).toBe('c1');
+  });
+
+  it('hands a resend to the agent only once', () => {
+    const { gateway, toAgent } = setup();
+
+    gateway.sendToAgent('admin', 'agent-1', 'hi', [], undefined, withAck);
+    const again = gateway.sendToAgent(
+      'admin',
+      'agent-1',
+      'hi',
+      [],
+      undefined,
+      withAck,
+    );
+
+    expect(again).toMatchObject({ status: 'accepted', duplicate: true });
+    expect(toAgent).toHaveLength(1);
+  });
+
+  it('rejects instead of faking an agent reply when the caller wants an ack', () => {
+    const { gateway, toBrowser } = setup(false);
+
+    const result = gateway.sendToAgent(
+      'admin',
+      'agent-1',
+      'hi',
+      [],
+      undefined,
+      withAck,
+    );
+
+    expect(result).toEqual({ status: 'rejected', code: 'AGENT_OFFLINE' });
+    expect(toBrowser).toHaveLength(0);
+  });
+
+  it('keeps the synthetic reply for callers that send no id (embed widget)', () => {
+    const { gateway, toBrowser } = setup(false);
+
+    const result = gateway.sendToAgent('admin', 'agent-1', 'hi', []);
+
+    expect(result).toEqual({ status: 'rejected', code: 'AGENT_OFFLINE' });
+    expect(toBrowser).toHaveLength(1);
+    expect(toBrowser[0]).toMatchObject({ type: 'message' });
+  });
+});
+
+/**
+ * The answer that landed while the browser was reconnecting used to be gone
+ * for good: the agent's log had it, the chat kept spinning (CLEAN-102).
+ */
+describe('BridleGateway — catching up after a reconnect', () => {
+  function emit(
+    gateway: BridleGateway,
+    messageId: string,
+    type: 'message' | 'stream' | 'stream_end' = 'message',
+  ) {
+    gateway.handleAgentEvent('agent-1', {
+      type,
+      clientId: 'admin',
+      text: messageId,
+      messageId,
+    });
+  }
+
+  it('keeps events that arrive while no socket is connected', () => {
+    const gateway = new BridleGateway();
+    const first: Event[] = [];
+    gateway.registerClient('admin', 'agent-1', 'tab-a', collector(first), true);
+    emit(gateway, 'm1');
+    const lastSeq = first[0].seq as number;
+
+    gateway.unregisterClient('admin', 'agent-1', 'tab-a');
+    emit(gateway, 'm2');
+
+    const missed = gateway.replaySince('admin', 'agent-1', lastSeq) as Event[];
+    expect(missed.map((e) => e.messageId)).toEqual(['m2']);
+    expect(missed[0].seq as number).toBeGreaterThan(lastSeq);
+  });
+
+  it('replays nothing that the browser already has', () => {
+    const gateway = new BridleGateway();
+    gateway.registerClient('admin', 'agent-1', 'tab-a', () => undefined, true);
+    emit(gateway, 'm1');
+
+    const upToDate = gateway.currentSeq('admin', 'agent-1');
+
+    expect(gateway.replaySince('admin', 'agent-1', upToDate)).toEqual([]);
+  });
+
+  it('replays only the newest frame of a streamed message', () => {
+    const gateway = new BridleGateway();
+    gateway.registerClient('admin', 'agent-1', 'tab-a', () => undefined, true);
+    const before = gateway.currentSeq('admin', 'agent-1');
+
+    emit(gateway, 'm1', 'stream');
+    emit(gateway, 'm1', 'stream');
+    emit(gateway, 'm1', 'stream_end');
+
+    const missed = gateway.replaySince('admin', 'agent-1', before) as Event[];
+    expect(missed.map((e) => e.type)).toEqual(['stream', 'stream_end']);
+  });
+
+  it('knows nothing about an identity that never connected', () => {
+    const gateway = new BridleGateway();
+
+    emit(gateway, 'm1');
+
+    expect(gateway.currentSeq('admin', 'agent-1')).toBe(0);
+    expect(gateway.replaySince('admin', 'agent-1', 0)).toEqual([]);
+  });
+});
diff --git a/api/src/slices/bridle/data/bridle.gateway.ts b/api/src/slices/bridle/data/bridle.gateway.ts
index e913123c..34cfa2bd 100644
--- a/api/src/slices/bridle/data/bridle.gateway.ts
+++ b/api/src/slices/bridle/data/bridle.gateway.ts
@@ -15,6 +15,8 @@ import type {
   BridlePart,
   IBridleAttachment,
   IActiveTurn,
+  IBridleSendOptions,
+  BridleSendResult,
 } from '../domain/bridle.types';
 import { randomUUID } from 'crypto';
 
@@ -27,6 +29,31 @@ interface IPendingSync {
 
 const DEFAULT_SYNC_TIMEOUT_MS = 15_000;
 
+/** How much a reconnecting browser can catch up on — whichever runs out first. */
+const REPLAY_MAX_EVENTS = 500;
+const REPLAY_MAX_AGE_MS = 10 * 60_000;
+/** A conversation nobody is connected to is forgotten after this long. */
+const CHANNEL_IDLE_MS = REPLAY_MAX_AGE_MS;
+/** How long a message id is remembered, so a resend is not delivered twice. */
+const SEEN_TTL_MS = 10 * 60_000;
+const SEEN_MAX = 200;
+
+interface IBufferedEvent {
+  at: number;
+  event: Record<string, unknown> & { seq: number };
+}
+
+interface IClientChannel {
+  /** Every socket open on this conversation, by socket id. */
+  sockets: Map<string, IBridleClientData>;
+  /** Last number issued; strictly increasing for the conversation's life. */
+  seq: number;
+  buffer: IBufferedEvent[];
+  /** clientMessageId → when it was accepted. */
+  seen: Map<string, number>;
+  idleTimer?: NodeJS.Timeout;
+}
+
 /**
  * Hub implementation — manages per-agent connections and per-agent browser
  * client connections. Routes messages between them scoped by agentId.
@@ -49,17 +76,97 @@ export class BridleGateway extends IBridleGateway {
   /**
    * Browser clients keyed by `${clientId}\u0000${agentId}`. Keying by the pair
    * (not clientId alone) lets ONE user hold several concurrent conversations —
-   * e.g. a multi-slot dashboard chatting with N agents on N sockets — without
-   * later sockets overwriting earlier ones (they share clientId='admin'/sub).
+   * e.g. a multi-slot dashboard chatting with N agents.
+   *
+   * A conversation holds EVERY socket open on it, not one (CLEAN-102). An
+   * identity is routinely open in several places at once — two tabs, the admin
+   * panel beside the console, a colleague (every Owner/Admin shares
+   * clientId='admin'), an HTTP sendAndAwait — and with a single slot the last
+   * one to connect took every event while the others sat on a spinner for an
+   * answer that was delivered somewhere else.
+   *
+   * It also outlives its sockets for a while: events are numbered and kept in
+   * a bounded buffer so a browser that was mid-reconnect when the answer
+   * landed can ask for what it missed instead of never seeing it.
    */
-  private clients = new Map<string, IBridleClientData>();
+  private channels = new Map<string, IClientChannel>();
 
   private clientKey(clientId: string, agentId: string): string {
     return `${clientId}\u0000${agentId}`;
   }
 
+  private *sockets(): IterableIterator<IBridleClientData> {
+    for (const channel of this.channels.values()) {
+      yield* channel.sockets.values();
+    }
+  }
+
+  private channelFor(clientId: string, agentId: string): IClientChannel {
+    const key = this.clientKey(clientId, agentId);
+    let channel = this.channels.get(key);
+    if (!channel) {
+      channel = {
+        sockets: new Map(),
+        // Seeded from the clock, not zero: after an API restart the new
+        // numbers are still above any `lastSeq` a browser kept, so its
+        // catch-up request returns the new buffer instead of skipping it.
+        seq: Date.now(),
+        buffer: [],
+        seen: new Map(),
+      };
+      this.channels.set(key, channel);
+    }
+    return channel;
+  }
+
   /**
-   * Turns in flight, keyed like `clients`. Written from the thinking events
+   * Number an event, remember it, and hand it to every socket on the
+   * conversation — minus the one that caused it, for `user_message`.
+   */
+  private route(
+    channel: IClientChannel,
+    data: Record<string, unknown>,
+    exceptSocketId?: string,
+  ): void {
+    const now = Date.now();
+    const event: IBufferedEvent['event'] = { ...data, seq: ++channel.seq };
+    // A `stream` frame carries the whole text so far, so only the newest one
+    // per message is worth replaying — keeping them all would fill the buffer
+    // with every intermediate state of one long answer.
+    if (data.type === 'stream' && typeof data.messageId === 'string') {
+      channel.buffer = channel.buffer.filter(
+        (b) =>
+          !(b.event.type === 'stream' && b.event.messageId === data.messageId),
+      );
+    }
+    channel.buffer.push({ at: now, event });
+    while (
+      channel.buffer.length > REPLAY_MAX_EVENTS ||
+      (channel.buffer.length > 0 &&
+        now - channel.buffer[0].at > REPLAY_MAX_AGE_MS)
+    ) {
+      channel.buffer.shift();
+    }
+    for (const socket of channel.sockets.values()) {
+      if (socket.socketId !== exceptSocketId) socket.send(event);
+    }
+  }
+
+  replaySince(clientId: string, agentId: string, lastSeq: number): unknown[] {
+    const channel = this.channels.get(this.clientKey(clientId, agentId));
+    if (!channel) return [];
+    const cutoff = Date.now() - REPLAY_MAX_AGE_MS;
+    return channel.buffer
+      .filter((b) => b.at >= cutoff && b.event.seq > lastSeq)
+      .map((b) => b.event);
+  }
+
+  currentSeq(clientId: string, agentId: string): number {
+    return this.channels.get(this.clientKey(clientId, agentId))?.seq ?? 0;
+  }
+
+  /**
+   * Turns in flight, keyed like `channels`. Written from the thinking events
    * the hub already relays, so the API can drop a step of its own into the
    * timeline a person is watching (CLEAN-74) instead of minting a turnId that
    * would close the runtime's own block in every console.
@@ -126,7 +233,7 @@ export class BridleGateway extends IBridleGateway {
    * agent connected) vs orange (one side down) without polling.
    */
   private broadcastAgentStatus(agentId: string, connected: boolean): void {
-    for (const client of this.clients.values()) {
+    for (const client of this.sockets()) {
       if (client.agentId !== agentId) continue;
       client.send({ type: 'agent_status', agentId, connected });
     }
@@ -145,7 +252,12 @@ export class BridleGateway extends IBridleGateway {
     prompt?: string,
     capabilities?: string[],
   ): void {
-    this.clients.set(this.clientKey(clientId, agentId), {
+    const channel = this.channelFor(clientId, agentId);
+    if (channel.idleTimer) {
+      clearTimeout(channel.idleTimer);
+      channel.idleTimer = undefined;
+    }
+    channel.sockets.set(socketId, {
       clientId,
       agentId,
       socketId,
@@ -155,29 +267,28 @@ export class BridleGateway extends IBridleGateway {
       ...(capabilities && capabilities.length ? { capabilities } : {}),
     });
     this.logger.log(
-      `Browser client registered: ${clientId} agentId=${agentId} socket=${socketId} admin=${isAdmin}${capabilities?.length ? ` caps=[${capabilities.join(',')}]` : ''} (total: ${this.clients.size})`,
+      `Browser client registered: ${clientId} agentId=${agentId} socket=${socketId} admin=${isAdmin}${capabilities?.length ? ` caps=[${capabilities.join(',')}]` : ''} (sockets on this conversation: ${channel.sockets.size})`,
     );
   }
 
   unregisterClient(clientId: string, agentId: string, socketId: string): void {
     const key = this.clientKey(clientId, agentId);
-    const current = this.clients.get(key);
-    if (!current) return;
-    if (current.socketId !== socketId) {
-      // A stale/blackholed connection (detected late via ping timeout) is
-      // disconnecting after a reconnect already took over this clientId —
-      // the live registration must survive, or the browser silently stops
-      // receiving stream/message events until the page is reloaded.
-      this.logger.log(
-        `Ignoring stale disconnect for client=${clientId} agentId=${agentId}: socket=${socketId} is not the current owner (${current.socketId})`,
-      );
-      return;
-    }
-    this.clients.delete(key);
-    this.activeTurns.delete(key);
+    const channel = this.channels.get(key);
+    // Removing by socket id is what makes a stale/blackholed connection's late
+    // disconnect harmless: it can only ever remove itself.
+    if (!channel?.sockets.delete(socketId)) return;
     this.logger.log(
-      `Browser client unregistered: ${clientId} agentId=${agentId} (total: ${this.clients.size})`,
+      `Browser client unregistered: ${clientId} agentId=${agentId} socket=${socketId} (sockets left: ${channel.sockets.size})`,
     );
+    if (channel.sockets.size > 0) return;
+
+    this.activeTurns.delete(key);
+    // Keep the numbering and the buffer for a while — the usual reason for an
+    // empty conversation is a page that is about to reconnect.
+    channel.idleTimer = setTimeout(() => {
+      if (channel.sockets.size === 0) this.channels.delete(key);
+    }, CHANNEL_IDLE_MS);
+    channel.idleTimer.unref?.();
   }
 
   sendToAgent(
@@ -186,28 +297,58 @@ export class BridleGateway extends IBridleGateway {
     text: string,
     parts: BridlePart[],
     attachments?: IBridleAttachment[],
-  ): void {
+    options: IBridleSendOptions = {},
+  ): BridleSendResult {
+    const channel = this.channelFor(clientId, agentId);
+    const now = Date.now();
+
+    // A resend of something already handed over (the ack was lost, not the
+    // message) must not make the agent answer twice.
+    const { clientMessageId } = options;
+    if (clientMessageId) {
+      const acceptedAt = channel.seen.get(clientMessageId);
+      if (acceptedAt !== undefined && now - acceptedAt < SEEN_TTL_MS) {
+        return {
+          status: 'accepted',
+          messageId: clientMessageId,
+          ts: acceptedAt,
+          duplicate: true,
+        };
+      }
+    }
+
     const agentSend = this.agents.get(agentId)?.send;
     if (!agentSend) {
       this.logger.warn(
         `Cannot send to agent — not connected (agentId=${agentId})`,
       );
-      this.sendToClient(clientId, agentId, {
-        type: 'message',
-        text: 'Agent is not connected. Please try again later.',
-        parts: [
-          {
-            type: 'text',
-            text: 'Agent is not connected. Please try again later.',
-          },
-        ],
-        messageId: randomUUID(),
-        ts: Date.now(),
-      });
-      return;
+      // A caller that asked for an acknowledgement is told the truth and shows
+      // it under the person's own message. Everyone else (embed widget, older
+      // bundles) keeps the sentence they have always rendered as a reply.
+      if (!options.withAck) {
+        this.sendToClient(clientId, agentId, {
+          type: 'message',
+          text: 'Agent is not connected. Please try again later.',
+          parts: [
+            {
+              type: 'text',
+              text: 'Agent is not connected. Please try again later.',
+            },
+          ],
+          messageId: randomUUID(),
+          ts: now,
+        });
+      }
+      return { status: 'rejected', code: 'AGENT_OFFLINE' };
     }
 
-    const client = this.clients.get(this.clientKey(clientId, agentId));
+    // The browser's own id travels end to end when it sent one, so the bubble
+    // on screen, the message the agent gets and (once the runtime stores it)
+    // the transcript entry are one and the same message.
+    const messageId = clientMessageId ?? randomUUID();
+    const client =
+      (options.socketId && channel.sockets.get(options.socketId)) ||
+      channel.sockets.values().next().value;
     agentSend({
       type: 'message',
       clientId,
@@ -232,15 +373,47 @@ export class BridleGateway extends IBridleGateway {
             })),
           }
         : {}),
-      messageId: randomUUID(),
+      messageId,
     });
+
+    if (clientMessageId) {
+      channel.seen.set(clientMessageId, now);
+      for (const [id, at] of channel.seen) {
+        if (channel.seen.size <= SEEN_MAX && now - at < SEEN_TTL_MS) break;
+        channel.seen.delete(id);
+      }
+    }
+
+    // The other places this conversation is open get the question too —
+    // otherwise they would show an answer to something nobody asked there.
+    this.route(
+      channel,
+      {
+        type: 'user_message',
+        messageId,
+        text: options.displayText ?? text,
+        ...(attachments?.length
+          ? {
+              attachments: attachments.map((a) => ({
+                id: a.id,
+                name: a.name,
+                mimeType: a.mimeType,
+                size: a.size,
+                kind: a.kind,
+              })),
+            }
+          : {}),
+        ts: now,
+      },
+      options.socketId,
+    );
+
+    return { status: 'accepted', messageId, ts: now };
   }
 
   sendToClient(clientId: string, agentId: string, data: unknown): void {
-    const client = this.clients.get(this.clientKey(clientId, agentId));
-    if (client) {
-      client.send(data);
-    }
+    const channel = this.channels.get(this.clientKey(clientId, agentId));
+    if (channel) this.route(channel, data as Record<string, unknown>);
   }
 
   handleAgentEvent(agentId: string, data: IBridleOutgoingEvent): void {
@@ -251,10 +424,10 @@ export class BridleGateway extends IBridleGateway {
       this.trackTurn(agentId, clientId, data);
     }
 
-    const client = this.clients.get(this.clientKey(clientId, agentId));
-    if (client) {
-      client.send(data);
-    }
+    // No socket right now is not a reason to drop the event: `route` keeps it
+    // for the reconnect. An identity the hub has never seen gets nothing.
+    const channel = this.channels.get(this.clientKey(clientId, agentId));
+    if (channel) this.route(channel, { ...data });
   }
 
   /** A step opens or refreshes the turn; the terminal `done` closes it. */
@@ -331,7 +504,7 @@ export class BridleGateway extends IBridleGateway {
     // only knows the immediate sender, but multiple admins may be observing
     // the same agent and they all want to see prompt traces.
     let delivered = 0;
-    for (const client of this.clients.values()) {
+    for (const client of this.sockets()) {
       if (client.agentId !== agentId) continue;
       if (!client.isAdmin) continue;
       client.send(data);
@@ -348,13 +521,13 @@ export class BridleGateway extends IBridleGateway {
     return {
       ok: true,
       agentConnected: this.agents.size > 0,
-      browserClients: this.clients.size,
+      browserClients: [...this.sockets()].length,
     };
   }
 
   agentHealth(agentId: string): IBridleAgentHealthData {
     let clientCount = 0;
-    for (const client of this.clients.values()) {
+    for (const client of this.sockets()) {
       if (client.agentId === agentId) clientCount++;
     }
     return {
@@ -409,7 +582,7 @@ export class BridleGateway extends IBridleGateway {
     const result: Array<{ agentId: string; clients: number }> = [];
     for (const agentId of this.agents.keys()) {
       let clients = 0;
-      for (const c of this.clients.values()) {
+      for (const c of this.sockets()) {
         if (c.agentId === agentId) clients++;
       }
       result.push({ agentId, clients });
diff --git a/api/src/slices/bridle/domain/bridle.gateway.ts b/api/src/slices/bridle/domain/bridle.gateway.ts
index 1367fe67..4509df0b 100644
--- a/api/src/slices/bridle/domain/bridle.gateway.ts
+++ b/api/src/slices/bridle/domain/bridle.gateway.ts
@@ -8,6 +8,8 @@ import type {
   BridlePart,
   IBridleAttachment,
   IActiveTurn,
+  IBridleSendOptions,
+  BridleSendResult,
 } from './bridle.types';
 
 export interface ISyncAgentResult {
@@ -35,12 +37,26 @@ export abstract class IBridleGateway {
     text: string,
     parts: BridlePart[],
     attachments?: IBridleAttachment[],
-  ): void;
-  /** Send an event to a specific browser client (scoped to clientId + agentId) */
+    options?: IBridleSendOptions,
+  ): BridleSendResult;
+  /** Send an event to every socket open on this conversation (clientId +
+   * agentId), numbered and kept for replay like the agent's own events. */
   abstract sendToClient(clientId: string, agentId: string, data: unknown): void;
-  /** Register a browser client for a specific agent. `socketId` marks the
-   * owning socket so a stale connection's late disconnect can't wipe a newer
-   * registration for the same clientId+agentId (mirrors registerAgent). */
+  /**
+   * Events routed to this conversation after `lastSeq`, oldest first — what a
+   * browser missed while it was reconnecting. Empty when nothing is buffered
+   * or the conversation is unknown.
+   */
+  abstract replaySince(
+    clientId: string,
+    agentId: string,
+    lastSeq: number,
+  ): unknown[];
+  /** Last sequence number issued for this conversation; 0 when unknown. */
+  abstract currentSeq(clientId: string, agentId: string): number;
+  /** Register a browser socket on a conversation. Several sockets may share
+   * one clientId+agentId — they all receive its events; `socketId` tells them
+   * apart so each one can only ever unregister itself. */
   abstract registerClient(
     clientId: string,
     agentId: string,
@@ -54,8 +70,9 @@ export abstract class IBridleGateway {
      * every message so runtimes can gate `thinking`/`ui` emission. */
     capabilities?: string[],
   ): void;
-  /** Unregister a browser client — no-op unless `socketId` still owns the
-   * current registration for clientId+agentId. */
+  /** Unregister one browser socket. The conversation's other sockets are
+   * untouched; its numbering and replay buffer outlive the last one for a
+   * while so a reconnect can catch up. */
   abstract unregisterClient(
     clientId: string,
     agentId: string,
diff --git a/api/src/slices/bridle/domain/bridle.types.ts b/api/src/slices/bridle/domain/bridle.types.ts
index b75b5dc9..84710c8b 100644
--- a/api/src/slices/bridle/domain/bridle.types.ts
+++ b/api/src/slices/bridle/domain/bridle.types.ts
@@ -101,6 +101,65 @@ export interface IBridleIncomingMessage {
   capabilities?: string[];
 }
 
+/**
+ * What a browser is told about a message it sent, through the socket.io
+ * acknowledgement (CLEAN-102). `accepted` means "handed to a connected agent",
+ * not "answered": it is what lets the chat show delivered / not delivered
+ * under a person's own message instead of a bubble that looks the same either
+ * way. Only callers that pass an ack callback get one — the embed widget and
+ * older bundles send none and behave exactly as before.
+ */
+export type BridleSendAck =
+  | {
+      status: 'accepted';
+      /** The browser's own `clientMessageId` when it sent one. */
+      messageId: string;
+      /** Hub clock at acceptance — the time both live and replayed views show. */
+      ts: number;
+      /** A resend of something already handed over; not forwarded again. */
+      duplicate?: true;
+    }
+  | {
+      status: 'rejected';
+      code: 'AGENT_OFFLINE' | 'ATTACHMENT_FAILED' | 'SHARE_REJECTED' | 'EMPTY';
+      message?: string;
+    };
+
+/** The subset of {@link BridleSendAck} the hub itself can produce. */
+export type BridleSendResult =
+  | Extract<BridleSendAck, { status: 'accepted' }>
+  | { status: 'rejected'; code: 'AGENT_OFFLINE' };
+
+export interface IBridleSendOptions {
+  /** Id minted by the browser; becomes the message id end to end. */
+  clientMessageId?: string;
+  /** The sending socket: its prompt/capabilities go to the agent, and it is
+   * the one socket that does NOT get the `user_message` echo. */
+  socketId?: string;
+  /** The caller renders the outcome itself, so no synthetic "Agent is not
+   * connected" reply is sent on its behalf. */
+  withAck?: boolean;
+  /** What the person typed, without the attachment blocks inlined for the
+   * model — that is what the other open views should show. */
+  displayText?: string;
+}
+
+/**
+ * Hub → browser: a message sent from ANOTHER socket of the same conversation
+ * (second tab, the admin next to the console). Without it that view would
+ * show an answer to a question nobody asked there.
+ */
+export interface IBridleUserMessageEvent {
+  type: 'user_message';
+  messageId: string;
+  text: string;
+  attachments?: Array<
+    Pick<IBridleAttachment, 'id' | 'name' | 'mimeType' | 'size' | 'kind'>
+  >;
+  ts: number;
+  seq: number;
+}
+
 /** Agent → Hub: events routed to browser clients */
 export interface IBridleOutgoingEvent {
   type:
diff --git a/api/src/slices/bridle/domain/bridleSync.service.ts b/api/src/slices/bridle/domain/bridleSync.service.ts
index 30455377..7891b2fb 100644
--- a/api/src/slices/bridle/domain/bridleSync.service.ts
+++ b/api/src/slices/bridle/domain/bridleSync.service.ts
@@ -111,7 +111,11 @@ export class BridleSyncService {
         capabilities,
       );
 
-      this.hub.sendToAgent(clientId, agentId, text, parts, attachments);
+      // `socketId` makes this call's own capabilities travel with the message
+      // now that a conversation can hold several sockets at once.
+      this.hub.sendToAgent(clientId, agentId, text, parts, attachments, {
+        socketId,
+      });
     });
   }
 }
diff --git a/api/src/slices/bridle/handlers/bridleClientWs.ack.spec.ts b/api/src/slices/bridle/handlers/bridleClientWs.ack.spec.ts
new file mode 100644
index 00000000..c6da1492
--- /dev/null
+++ b/api/src/slices/bridle/handlers/bridleClientWs.ack.spec.ts
@@ -0,0 +1,113 @@
+import type { Socket } from 'socket.io';
+import { BridleClientWsHandler } from './bridleClientWs.handler';
+import type { BridleAttachmentService, IBridleSendOptions } from '../domain';
+
+/**
+ * What the browser is told about a message it sent (CLEAN-102). The value
+ * `handleMessage` returns is the socket.io acknowledgement: Nest passes it to
+ * the callback the browser supplied. Before this, a send was fire-and-forget
+ * and a bubble looked the same whether or not anyone received it.
+ */
+function makeHandler(expand: BridleAttachmentService['expand']) {
+  const forwarded: Array<IBridleSendOptions | undefined> = [];
+  const hub = {
+    sendToAgent: (
+      _clientId: string,
+      _agentId: string,
+      _text: string,
+      _parts: unknown[],
+      _attachments: unknown,
+      options?: IBridleSendOptions,
+    ) => {
+      forwarded.push(options);
+      return { status: 'accepted', messageId: 'from-hub', ts: 42 };
+    },
+  };
+  const handler = new BridleClientWsHandler(
+    hub as never,
+    { expand } as BridleAttachmentService,
+    {} as never,
+    {} as never,
+    {} as never,
+  );
+  const emitted: string[] = [];
+  const client = {
+    id: 'socket-1',
+    data: { clientId: 'admin', agentId: 'agent-1' },
+    emit: (event: string) => {
+      emitted.push(event);
+      return true;
+    },
+    disconnect: () => undefined,
+  } as unknown as Socket;
+  return { handler, client, forwarded, emitted };
+}
+
+const passThrough: BridleAttachmentService['expand'] = async (_a, text) => ({
+  text,
+  parts: [],
+  attachments: [],
+});
+
+describe('BridleClientWsHandler — acknowledging a sent message', () => {
+  it('answers with what the hub decided', async () => {
+    const { handler, client } = makeHandler(passThrough);
+
+    const ack = await handler.handleMessage(client, {
+      text: 'hello',
+      clientMessageId: 'c1',
+    });
+
+    expect(ack).toEqual({ status: 'accepted', messageId: 'from-hub', ts: 42 });
+  });
+
+  it('asks the hub for an honest outcome only when the browser minted an id', async () => {
+    const { handler, client, forwarded } = makeHandler(passThrough);
+
+    await handler.handleMessage(client, {
+      text: 'hello',
+      clientMessageId: 'c1',
+    });
+    await handler.handleMessage(client, { text: 'from the embed widget' });
+
+    expect(forwarded[0]).toMatchObject({
+      socketId: 'socket-1',
+      clientMessageId: 'c1',
+      withAck: true,
+      displayText: 'hello',
+    });
+    expect(forwarded[1]?.withAck).toBeUndefined();
+    expect(forwarded[1]?.clientMessageId).toBeUndefined();
+  });
+
+  it('rejects a message with nothing in it', async () => {
+    const { handler, client, forwarded } = makeHandler(passThrough);
+
+    const ack = await handler.handleMessage(client, {
+      text: '',
+      clientMessageId: 'c1',
+    });
+
+    expect(ack).toEqual({ status: 'rejected', code: 'EMPTY' });
+    expect(forwarded).toHaveLength(0);
+  });
+
+  it('rejects when an attachment cannot be read, and still raises the notice', async () => {
+    const { handler, client, emitted } = makeHandler(async () => {
+      throw new Error('file is gone');
+    });
+
+    const ack = await handler.handleMessage(client, {
+      text: 'look',
+      attachmentIds: ['a1'],
+      clientMessageId: 'c1',
+    });
+
+    expect(ack).toEqual({
+      status: 'rejected',
+      code: 'ATTACHMENT_FAILED',
+      message: 'file is gone',
+    });
+    expect(emitted).toEqual(['message_error']);
+  });
+});
diff --git a/api/src/slices/bridle/handlers/bridleClientWs.handler.spec.ts b/api/src/slices/bridle/handlers/bridleClientWs.handler.spec.ts
index c8716f28..d63efb8a 100644
--- a/api/src/slices/bridle/handlers/bridleClientWs.handler.spec.ts
+++ b/api/src/slices/bridle/handlers/bridleClientWs.handler.spec.ts
@@ -51,6 +51,7 @@ function makeHandler(
       attachments?: IBridleAttachment[],
     ) => {
       sent.push({ clientId, agentId, text, parts, attachments });
+      return { status: 'accepted', messageId: 'm1', ts: 1 };
     },
   };
   const attachments = { expand } as BridleAttachmentService;
@@ -213,6 +214,8 @@ function makeConnection(options: IConnectOptions) {
       registered.push({ clientId, agentId });
     },
     isAgentConnected: () => true,
+    currentSeq: () => 0,
+    replaySince: () => [],
   };
   const shareLinks = {
     authorizeChat: options.authorizeChat ?? rejectEveryShare,
@@ -477,7 +480,10 @@ describe('BridleClientWsHandler — share-link handshake', () => {
       share: { token: 'sl_good', visitorId: 'v7' },
     });
     expect(registered).toEqual([{ clientId: 'share-v7', agentId: 'agent-1' }]);
-    expect(emitted[0]).toEqual({ event: 'welcome', payload: { clientId: 'share-v7' } });
+    expect(emitted[0]).toEqual({
+      event: 'welcome',
+      payload: { clientId: 'share-v7', seq: 0 },
+    });
   });
 
   it('rejects a dead link with the service code and never registers the socket', async () => {
diff --git a/api/src/slices/bridle/handlers/bridleClientWs.handler.ts b/api/src/slices/bridle/handlers/bridleClientWs.handler.ts
index adf02829..7c7d978e 100644
--- a/api/src/slices/bridle/handlers/bridleClientWs.handler.ts
+++ b/api/src/slices/bridle/handlers/bridleClientWs.handler.ts
@@ -18,6 +18,7 @@ import {
   IBridleGateway,
   BridleAttachmentService,
   type BridlePart,
+  type BridleSendAck,
   type ChatRequesterKinds,
   buildParts,
   clientIdFromJwtPayload,
@@ -100,6 +101,7 @@ export class BridleClientWsHandler
       capabilities?: unknown;
       shareToken?: unknown;
       shareVisitor?: unknown;
+      lastSeq?: unknown;
     };
     // Offered AT ALL, like `hasShareToken` on the HTTP side: an empty token
     // must reach `authorizeChat` and come back rejected, never slip past into
@@ -289,6 +291,22 @@ export class BridleClientWsHandler
       client.emit(event, data);
     };
 
+    // A reconnecting browser says how far it got (CLEAN-102). What it missed
+    // goes out before the socket joins the conversation — all in one tick, so
+    // nothing live can slip in between and arrive ahead of older events.
+    const lastSeq =
+      typeof auth.lastSeq === 'number' && Number.isFinite(auth.lastSeq)
+        ? auth.lastSeq
+        : 0;
+    client.emit('welcome', {
+      clientId,
+      seq: this.hub.currentSeq(clientId, agentId),
+    });
+    if (lastSeq > 0) {
+      for (const missed of this.hub.replaySince(clientId, agentId, lastSeq)) {
+        send(missed);
+      }
+    }
     this.hub.registerClient(
       clientId,
       agentId,
@@ -298,7 +316,6 @@ export class BridleClientWsHandler
       prompt,
       capabilities,
     );
-    client.emit('welcome', { clientId });
     // Tell the new client whether the agent runtime is currently online so the
     // chat header can render the right indicator color before any subsequent
     // register/unregister broadcasts.
@@ -333,12 +350,26 @@ export class BridleClientWsHandler
       parts?: BridlePart[];
       images?: Array<{ base64: string; mediaType: string }>;
       attachmentIds?: string[];
+      clientMessageId?: string;
     },
-  ) {
+  ): Promise<BridleSendAck | undefined> {
     const clientId = client.data?.clientId as string;
     const agentId = client.data?.agentId as string;
     if (!clientId || !agentId) return;
 
+    // The return value is the socket.io acknowledgement (CLEAN-102): Nest hands
+    // it to the callback the browser passed, and drops it when there is none.
+    // A browser that mints a `clientMessageId` is one that renders the outcome
+    // under the person's message, so it is also the one that must not get the
+    // hub's synthetic "Agent is not connected" reply. The embed widget and
+    // older bundles send no id and keep today's behaviour byte for byte.
+    const clientMessageId =
+      typeof data.clientMessageId === 'string' &&
+      data.clientMessageId.length > 0 &&
+      data.clientMessageId.length <= 100
+        ? data.clientMessageId
+        : undefined;
+
     // A share link is re-validated per message, as the HTTP routes do: a
     // revoked link must stop a socket that is already open, not only the next
     // page load. The rejection goes out as `bridle_error` so the share page
@@ -358,7 +389,7 @@ export class BridleClientWsHandler
         );
         client.emit('bridle_error', { code, agentId });
         client.disconnect();
-        return;
+        return { status: 'rejected', code: 'SHARE_REJECTED', message: code };
       }
     }
 
@@ -392,18 +423,25 @@ export class BridleClientWsHandler
         `Attachment expansion failed: clientId=${clientId} agentId=${agentId}: ${message}`,
       );
       client.emit('message_error', { message });
-      return;
+      return { status: 'rejected', code: 'ATTACHMENT_FAILED', message };
     }
 
     const parts = [...base, ...expanded.parts];
-    if (!expanded.text && parts.length === 0) return;
+    if (!expanded.text && parts.length === 0) {
+      return { status: 'rejected', code: 'EMPTY' };
+    }
 
-    this.hub.sendToAgent(
+    return this.hub.sendToAgent(
       clientId,
       agentId,
       expanded.text,
       parts,
       expanded.attachments,
+      {
+        socketId: client.id,
+        displayText: text,
+        ...(clientMessageId ? { clientMessageId, withAck: true } : {}),
+      },
     );
   }
 
diff --git a/app/i18n.sync.json b/app/i18n.sync.json
index 242298a4..91d0ca8c 100644
--- a/app/i18n.sync.json
+++ b/app/i18n.sync.json
@@ -52,6 +52,11 @@
       "chat.attachment_retry": "f7b639b88e74",
       "chat.attachment_unavailable": "1393bb3706f6",
       "chat.attachment_uploading": "215b57dec11d",
+      "chat.day_today": "2b065c7c9ce4",
+      "chat.day_yesterday": "566181254b29",
+      "chat.delivery_sending": "b8ed5279e897",
+      "chat.delivery_slow": "319087a56d80",
+      "chat.discard": "eb1a70e39274",
       "chat.dismiss": "48845bff334a",
       "chat.drop_disabled": "4352d245c367",
       "chat.drop_hint": "bedb284f4954",
@@ -60,14 +65,21 @@
       "chat.error": "a95d0d36ee79",
       "chat.error_empty": "0b50d48fcbac",
       "chat.error_message": "75635185962d",
-      "chat.error_offline": "a10fd223d334",
       "chat.error_rejected": "242da51e8085",
       "chat.error_size": "5dd5c28ddbbd",
       "chat.error_total": "2a28704f7f5c",
+      "chat.error_turn_unfinished": "be04dec39ae4",
       "chat.error_type": "8c3cacb2300a",
       "chat.input_hint": "8a8c17c82d18",
+      "chat.not_delivered": "f498742c19d9",
+      "chat.not_delivered_agent_offline": "40d3a13fddc9",
+      "chat.not_delivered_attachment_failed": "10eb08a55b35",
+      "chat.not_delivered_hint": "01d5963b02c1",
+      "chat.not_delivered_offline": "94410111c768",
+      "chat.not_delivered_timeout": "78c624394a4a",
       "chat.placeholder": "57ef13894e3b",
       "chat.reconnecting": "3686e2b79128",
+      "chat.resend": "1f94843777ae",
       "chat.send": "f6f4688ff23d",
       "chat.starter_hint": "76085886cbdf",
       "chat.thinking": "98a06dc7c627",
diff --git a/app/package.json b/app/package.json
index c5a03aaf..e34f4d09 100644
--- a/app/package.json
+++ b/app/package.json
@@ -12,7 +12,7 @@
     "pretypecheck": "openapi-ts",
     "typecheck": "nuxt typecheck",
     "lint": "echo 'app lint: not configured (see eslint.config.mjs TODO)'",
-    "test": "echo 'app test: no tests yet'"
+    "test": "bun test slices"
   },
   "dependencies": {
     "@hey-api/client-axios": "^0.6",
diff --git a/app/slices/agent/components/agent/Provider.vue b/app/slices/agent/components/agent/Provider.vue
index 771bb236..b788aa79 100644
--- a/app/slices/agent/components/agent/Provider.vue
+++ b/app/slices/agent/components/agent/Provider.vue
@@ -10,8 +10,11 @@
 const route = useRoute();
 const agentStore = useAgentStore();
 
-const { data: agent, pending, error } = await useAsyncData(
+// The request is for `pending` / `error`; what renders is the store's record
+// (docs/state.md), which `fetchById` upserts into.
+const { pending, error } = await useAsyncData(
   `agent-${route.params.id}`,
   () => agentStore.fetchById(route.params.id as string),
 );
+const agent = computed(() => agentStore.byId(route.params.id as string));
 </script>
diff --git a/app/slices/agent/components/agent/chat/Provider.vue b/app/slices/agent/components/agent/chat/Provider.vue
index 65748b49..677f5348 100644
--- a/app/slices/agent/components/agent/chat/Provider.vue
+++ b/app/slices/agent/components/agent/chat/Provider.vue
@@ -4,10 +4,14 @@ const props = defineProps<{ id: string }>();
 const agentStore = useAgentStore();
 const authStore = useAuthStore();
 
-const { data: agent, pending, error, refresh } = await useAsyncData(
+// The request is for `pending` / `error` / `refresh`; what renders is the
+// store's record (docs/state.md) — the same object the rail row shows, so the
+// header pill and the row cannot disagree. `fetchById` upserts into it.
+const { pending, error, refresh } = await useAsyncData(
   `agent-${props.id}`,
   () => agentStore.fetchById(props.id),
 );
+const agent = computed(() => agentStore.byId(props.id));
 
 const canManage = computed(() =>
   authStore.hasRole(UserRoleTypes.Owner, UserRoleTypes.Admin),
@@ -32,14 +36,13 @@ async function onRestart() {
   restartError.value = null;
   restartFailed.value = false;
   restartStartedAt.value = Date.now();
-  const previous = agent.value.status;
-  // Optimistic flip — overlay appears immediately, status pill animates.
-  agent.value = { ...agent.value, status: 'deploying' };
+  // The optimistic 'deploying' flip — overlay appears immediately, status
+  // pill animates — and its rollback happen inside `agentStore.restart`, on
+  // the one store record, so the rail row flips with this header.
   try {
     await agentStore.restart(agent.value.id);
     await refresh();
   } catch (err) {
-    if (agent.value) agent.value = { ...agent.value, status: previous };
     restartFailed.value = true;
     // A 401 the api plugin could not recover from is the session-ended
     // dialog's story to tell; the banner falls back to `chat.restart_failed`
diff --git a/app/slices/agent/components/agent/workspace/Provider.vue b/app/slices/agent/components/agent/workspace/Provider.vue
index 8b9ba211..facaa0f4 100644
--- a/app/slices/agent/components/agent/workspace/Provider.vue
+++ b/app/slices/agent/components/agent/workspace/Provider.vue
@@ -11,9 +11,13 @@ const canCreate = computed(() =>
 
 // One list request for the whole workspace, shared with the resolver page by
 // its key so landing here does not re-fetch what it already read.
-const { data: agents, pending, refresh } = await useAsyncData('agents', () =>
+//
+// The request gives `pending` and `refresh`; the rail renders the store's
+// collection (docs/state.md), the same records the open chat reads by id.
+const { pending, refresh } = await useAsyncData('agents', () =>
   agentStore.fetchAll(),
 );
+const { agents } = storeToRefs(agentStore);
 
 // The rail shows every agent's runtime state, so it has to keep up with
 // agents other people start and stop. The app console has no status stream
diff --git a/app/slices/agent/pages/agents/index.vue b/app/slices/agent/pages/agents/index.vue
index 9a937cbe..57f2cd70 100644
--- a/app/slices/agent/pages/agents/index.vue
+++ b/app/slices/agent/pages/agents/index.vue
@@ -11,14 +11,15 @@ const canCreate = computed(() =>
   authStore.hasRole(UserRoleTypes.Owner, UserRoleTypes.Admin),
 );
 
-const { data: agents, pending } = await useAsyncData('agents', () =>
-  agentStore.fetchAll(),
-);
+// Awaited for its loading state; the list itself is read from the store like
+// everywhere else (docs/state.md).
+const { pending } = await useAsyncData('agents', () => agentStore.fetchAll());
+const { agents } = storeToRefs(agentStore);
 
 // Remembered agent → first running → first in the list. The remembered id is
 // only honoured while it is still in this user's visible list, so a deleted
 // or newly-hidden agent is a non-event rather than a dead landing.
-const landing = computed(() => resolveLanding(agents.value ?? []));
+const landing = computed(() => resolveLanding(agents.value));
 
 watchEffect(() => {
   if (landing.value) {
@@ -28,7 +29,7 @@ watchEffect(() => {
 </script>
 
 <template>
-  <div v-if="pending && !agents?.length" class="flex flex-col gap-4">
+  <div v-if="pending && !agents.length" class="flex flex-col gap-4">
     <div class="h-8 w-48 animate-pulse rounded bg-muted" />
     <div class="h-64 w-full animate-pulse rounded-xl bg-muted/70" />
   </div>
diff --git a/app/slices/agent/stores/agent.ts b/app/slices/agent/stores/agent.ts
index 6aa8a0ac..abcf2722 100644
--- a/app/slices/agent/stores/agent.ts
+++ b/app/slices/agent/stores/agent.ts
@@ -18,13 +18,55 @@ export type {
 const getService = createServiceGetter<AgentService>('$agentService');
 
 export const useAgentStore = defineStore('agent', () => {
+  // Single source of truth (docs/state.md): an agent lives here once. Every
+  // fetch upserts into this collection and components render `byId(id)` —
+  // never the value a fetch handed back — so the rail row and the open chat's
+  // header are the same object and cannot disagree.
   const agents = ref<IAgentData[]>([]);
+  // A separate projection on purpose: the landing page's public cards are a
+  // different audience and a different query, not a view of `agents`.
   const publicAgents = ref<IAgentData[]>([]);
-  const current = ref<IAgentData | null>(null);
   const capacity = ref<IClusterCapacityData | null>(null);
   const loading = ref(false);
   const error = ref<string | null>(null);
 
+  // Plain lookup — reactive when read inside a computed.
+  function byId(id: string): IAgentData | undefined {
+    return agents.value.find((a) => a.id === id);
+  }
+
+  // Full records only (anything the API returned for one agent): replaces the
+  // row in place so the list keeps its order, appends when the id is new.
+  function upsert(agent: IAgentData): IAgentData {
+    agents.value = agents.value.some((a) => a.id === agent.id)
+      ? agents.value.map((a) => (a.id === agent.id ? agent : a))
+      : [...agents.value, agent];
+    return agent;
+  }
+
+  // Partial change to a known record — the one road for optimistic flips.
+  // Returns a rollback that restores only the fields still holding the patched
+  // value: if a fetch wrote something fresher in between, undoing the guess
+  // must not undo the truth.
+  function patch(id: string, partial: Partial<IAgentData>): () => void {
+    const previous = byId(id);
+    if (!previous) return () => {};
+    agents.value = agents.value.map((a) =>
+      a.id === id ? { ...a, ...partial } : a,
+    );
+    return () => {
+      const current = byId(id);
+      if (!current) return;
+      const restored: Record<string, unknown> = {};
+      for (const key of Object.keys(partial) as (keyof IAgentData)[]) {
+        if (current[key] === partial[key]) restored[key] = previous[key];
+      }
+      agents.value = agents.value.map((a) =>
+        a.id === id ? { ...a, ...(restored as Partial<IAgentData>) } : a,
+      );
+    };
+  }
+
   // Silent degradation on purpose: 403 (non-admin), K8s unreachable, or
   // network failure all mean "no number to show" — never an error banner.
   async function fetchCapacity() {
@@ -42,8 +84,9 @@ export const useAgentStore = defineStore('agent', () => {
     try {
       agents.value = await getService().findAll();
     } catch (err) {
+      // Keep the rows we have: this runs on a 30s poll, and the open chat
+      // renders from the same collection — one failed poll must not unmount it.
       error.value = (err as Error).message;
-      agents.value = [];
     } finally {
       loading.value = false;
     }
@@ -64,23 +107,25 @@ export const useAgentStore = defineStore('agent', () => {
     return publicAgents.value;
   }
 
+  // Null on failure, and the record (if any) is left alone — this is also the
+  // 3s status poll, and a failed poll is not "the agent is gone".
   async function fetchById(id: string) {
     loading.value = true;
     error.value = null;
     try {
-      current.value = await getService().findById(id);
+      const agent = await getService().findById(id);
+      return agent ? upsert(agent) : null;
     } catch (err) {
       error.value = (err as Error).message;
-      current.value = null;
+      return null;
     } finally {
       loading.value = false;
     }
-    return current.value;
   }
 
   async function create(input: IAgentCreateInput) {
     const created = await getService().create(input);
-    if (created) agents.value.push(created);
+    if (created) upsert(created);
     // Fire-and-forget: the new agent reserves a slot server-side the moment
     // create returns, so a refetch already sees the counter drop.
     void fetchCapacity();
@@ -89,10 +134,7 @@ export const useAgentStore = defineStore('agent', () => {
 
   async function update(id: string, input: IAgentUpdateInput) {
     const updated = await getService().update(id, input);
-    if (updated) {
-      const idx = agents.value.findIndex((a) => a.id === id);
-      if (idx >= 0) agents.value[idx] = updated;
-    }
+    if (updated) upsert(updated);
     return updated;
   }
 
@@ -102,20 +144,27 @@ export const useAgentStore = defineStore('agent', () => {
     void fetchCapacity();
   }
 
+  // Optimistic: flip to 'deploying' so every screen showing this agent reacts
+  // before the API resolves (cancel + submit takes seconds). Revert on error.
   async function restart(id: string) {
-    const updated = await getService().restart(id);
-    if (updated) {
-      const idx = agents.value.findIndex((a) => a.id === id);
-      if (idx >= 0) agents.value[idx] = updated;
+    const rollback = patch(id, { status: 'deploying' });
+    try {
+      const updated = await getService().restart(id);
+      if (updated) upsert(updated);
+      void fetchCapacity();
+      return updated;
+    } catch (err) {
+      rollback();
+      throw err;
     }
-    void fetchCapacity();
-    return updated;
   }
 
   return {
     agents,
     publicAgents,
-    current,
+    byId,
+    upsert,
+    patch,
     capacity,
     loading,
     error,
diff --git a/app/slices/bridle/components/bridle/chat/Message.vue b/app/slices/bridle/components/bridle/chat/Message.vue
index 3309a7ab..4e4c096b 100644
--- a/app/slices/bridle/components/bridle/chat/Message.vue
+++ b/app/slices/bridle/components/bridle/chat/Message.vue
@@ -1,9 +1,11 @@
 <script setup lang="ts">
 import {
+  BridleDeliveryStates,
   BridleRoleTypes,
   type IBridleConversation,
   type IBridleMessage,
 } from '#bridle/stores/bridle';
+import { failureHintKey } from '#bridle/utils/delivery';
 import { renderMarkdown } from '#bridle/utils/markdown';
 
 const props = defineProps<{
@@ -12,9 +14,57 @@ const props = defineProps<{
   conversation: IBridleConversation;
   agentName?: string;
 }>();
+const emit = defineEmits<{ resend: [id: string]; discard: [id: string] }>();
+
+// The locale itself, for date formatting — the one use of `useI18n()` that
+// docs/i18n.md keeps; every string below still goes through `$t`.
+const { locale } = useI18n();
 
 const isUser = computed(() => props.message.role === BridleRoleTypes.User);
 
+// ── Time ───────────────────────────────────────────────────────
+// Time of day under the bubble, the whole date-time on hover. The date itself
+// is the day separator's job (Provider), so it is not repeated per message.
+
+/** Null for a stored message with a broken `ts` — `Intl` throws on NaN, and
+ *  one bad record must not take the whole conversation down with it. */
+const sentAt = computed(() =>
+  Number.isFinite(props.message.ts) ? new Date(props.message.ts) : null,
+);
+const timeLabel = computed(() =>
+  sentAt.value
+    ? new Intl.DateTimeFormat(locale.value, {
+        hour: '2-digit',
+        minute: '2-digit',
+      }).format(sentAt.value)
+    : '',
+);
+const timeTitle = computed(() =>
+  sentAt.value
+    ? new Intl.DateTimeFormat(locale.value, {
+        dateStyle: 'long',
+        timeStyle: 'medium',
+      }).format(sentAt.value)
+    : '',
+);
+
+// ── Delivery ───────────────────────────────────────────────────
+// Only the person's own messages have one, and a delivered message says
+// nothing: silence is the normal case, words are for when something is off.
+
+const delivery = computed(() =>
+  isUser.value
+    ? (props.message.delivery ?? BridleDeliveryStates.Delivered)
+    : BridleDeliveryStates.Delivered,
+);
+const isSending = computed(
+  () => delivery.value === BridleDeliveryStates.Sending,
+);
+const isSlow = computed(() => delivery.value === BridleDeliveryStates.Slow);
+const isFailed = computed(() => delivery.value === BridleDeliveryStates.Failed);
+/** Copy decided in script travels as a key (docs/i18n.md). */
+const failureHint = computed(() => failureHintKey(props.message.failureCode));
+
 const agentInitial = computed(() => {
   const source = props.agentName?.trim() || 'Agent';
   const first = source.split(/\s+/).filter(Boolean)[0]?.[0];
@@ -30,9 +80,13 @@ const renderedHtml = computed(() =>
 </script>
 
 <template>
+  <!-- data-* are hooks for browser checks: which message, whose, in what state. -->
   <div
     class="flex items-start gap-2"
     :class="isUser ? 'justify-end' : 'justify-start'"
+    :data-message-id="message.id"
+    :data-role="message.role"
+    :data-delivery="delivery"
   >
     <div
       v-if="!isUser"
@@ -42,23 +96,87 @@ const renderedHtml = computed(() =>
       {{ agentInitial }}
     </div>
 
+    <!-- The column owns the width cap so the lines under the bubble wrap to
+         the bubble's measure instead of running across the whole chat. -->
     <div
-      class="max-w-[85%] sm:max-w-[75%] wrap-break-word px-4 py-2.5 text-sm leading-relaxed shadow-sm"
-      :class="
-        isUser
-          ? 'whitespace-pre-wrap rounded-2xl rounded-br-md bg-primary text-primary-foreground'
-          : 'chat-md rounded-2xl rounded-tl-md bg-muted text-foreground'
-      "
+      class="flex min-w-0 max-w-[85%] flex-col gap-1 sm:max-w-[75%]"
+      :class="isUser ? 'items-end' : 'items-start'"
     >
-      <!-- Media above the text, the way every chat client orders it -->
-      <BridleChatAttachmentList
-        v-if="message.attachments?.length"
-        :attachments="message.attachments"
-        :conversation="conversation"
-        :on-primary="isUser"
-      />
-      <template v-if="isUser">{{ message.text }}</template>
-      <div v-else v-html="renderedHtml" />
+      <!-- Dimmed while on its way: not there yet, and looks it — without a
+           word for as long as it is quick. -->
+      <div
+        class="max-w-full wrap-break-word px-4 py-2.5 text-sm leading-relaxed shadow-sm transition-opacity"
+        :class="[
+          isUser
+            ? 'whitespace-pre-wrap rounded-2xl rounded-br-md bg-primary text-primary-foreground'
+            : 'chat-md rounded-2xl rounded-tl-md bg-muted text-foreground',
+          (isSending || isSlow) && 'opacity-70',
+        ]"
+      >
+        <!-- Media above the text, the way every chat client orders it -->
+        <BridleChatAttachmentList
+          v-if="message.attachments?.length"
+          :attachments="message.attachments"
+          :conversation="conversation"
+          :on-primary="isUser"
+        />
+        <template v-if="isUser">{{ message.text }}</template>
+        <div v-else v-html="renderedHtml" />
+      </div>
+
+      <div
+        class="flex flex-wrap items-center gap-x-1.5 px-1 text-[11px] text-muted-foreground"
+        :class="isUser && 'justify-end'"
+      >
+        <span
+          v-if="isSlow"
+          class="flex items-center gap-1"
+          role="status"
+        >
+          <Icon name="loader-2" :size="11" class="animate-spin" />
+          {{ $t('chat.delivery_slow') }}
+        </span>
+        <span v-else-if="isSending" class="sr-only" role="status">
+          {{ $t('chat.delivery_sending') }}
+        </span>
+        <span
+          v-else-if="isFailed"
+          class="flex items-center gap-1 font-medium text-destructive"
+        >
+          <Icon name="alert-circle" :size="11" />
+          {{ $t('chat.not_delivered') }}
+        </span>
+        <time v-if="sentAt" :datetime="sentAt.toISOString()" :title="timeTitle">
+          {{ timeLabel }}
+        </time>
+      </div>
+
+      <!-- Announced, not just coloured — and the way out sits right under
+           the explanation: nothing here needs the message to be retyped. -->
+      <div
+        v-if="isFailed"
+        class="flex flex-col items-end gap-1 px-1 text-right text-[11px] text-muted-foreground"
+        role="status"
+        aria-live="polite"
+      >
+        <p>{{ $t(failureHint) }}</p>
+        <div class="flex items-center gap-3">
+          <button
+            type="button"
+            class="font-medium text-foreground underline underline-offset-2 hover:opacity-80"
+            @click="emit('resend', message.id)"
+          >
+            {{ $t('chat.resend') }}
+          </button>
+          <button
+            type="button"
+            class="underline underline-offset-2 hover:opacity-80"
+            @click="emit('discard', message.id)"
+          >
+            {{ $t('chat.discard') }}
+          </button>
+        </div>
+      </div>
     </div>
   </div>
 </template>
diff --git a/app/slices/bridle/components/bridle/chat/Provider.vue b/app/slices/bridle/components/bridle/chat/Provider.vue
index bb9dcbe4..8b95c567 100644
--- a/app/slices/bridle/components/bridle/chat/Provider.vue
+++ b/app/slices/bridle/components/bridle/chat/Provider.vue
@@ -2,9 +2,8 @@
 import {
   BridleChannelStates,
   type IBridleConversation,
-  type IBridleMessage,
-  type IBridleThinkingBlock,
 } from '#bridle/stores/bridle';
+import { buildChatFlow } from '#bridle/utils/chatFlow';
 
 const props = withDefaults(
   defineProps<{
@@ -23,6 +22,9 @@ const props = withDefaults(
   { showHeader: true },
 );
 const bridleStore = useBridleStore();
+// The locale itself, for the date on a day separator (docs/i18n.md keeps
+// `useI18n()` for exactly this); every string still goes through `$t`.
+const { locale } = useI18n();
 
 /**
  * The descriptor every store call goes through. `withDefaults` can't derive a
@@ -46,16 +48,17 @@ watch(
   { immediate: true },
 );
 
-// The live channel follows the conversation: opened when the key settles,
-// closed when it changes or the chat unmounts. Messages are persisted, the
-// socket is not — so coming back re-opens a fresh one over the same history.
+// The live channel follows the conversation: held from the moment the key
+// settles, let go when it changes or the chat unmounts. Held, not owned — the
+// landing hero and the agent page show the same conversation, and the store
+// keeps one socket open across the handoff between them (CLEAN-102).
 watch(
   () => activeConversation.value?.key,
   (_key, _old, onCleanup) => {
     const conversation = activeConversation.value;
     if (!conversation) return;
-    void bridleStore.connect(conversation);
-    onCleanup(() => bridleStore.disconnect(conversation));
+    void bridleStore.acquire(conversation);
+    onCleanup(() => bridleStore.release(conversation));
   },
   { immediate: true },
 );
@@ -94,27 +97,22 @@ const reconnecting = computed(() => {
 });
 
 // ── Chat flow ─────────────────────────────────────────────────
-// Messages and thinking blocks interleaved by timestamp, so a frozen block
-// stays above the answer it produced and the live one always sits last.
-
-interface IFlowItem {
-  key: string;
-  ts: number;
-  message?: IBridleMessage;
-  block?: IBridleThinkingBlock;
-}
+// Messages and thinking blocks interleaved in the order they ARRIVED, so a
+// frozen block stays above the answer it produced and the live one always
+// sits last. Never by timestamp: the person's clock and the agent's disagree,
+// and sorting by them is what used to put an answer above its question.
+
+const chatFlow = computed(() =>
+  buildChatFlow(messages.value, thinkingBlocks.value, {
+    locale: locale.value,
+    now: Date.now(),
+  }),
+);
 
-const chatFlow = computed<IFlowItem[]>(() => {
-  const items: IFlowItem[] = messages.value.map((m) => ({
-    key: m.id,
-    ts: m.ts,
-    message: m,
-  }));
-  for (const b of thinkingBlocks.value) {
-    items.push({ key: `${b.turnId}:${b.seg}`, ts: b.ts, block: b });
-  }
-  return items.sort((a, b) => a.ts - b.ts);
-});
+/** Long form for the separator's tooltip; the label may just say "Today". */
+function dayTitle(ts: number): string {
+  return new Intl.DateTimeFormat(locale.value, { dateStyle: 'full' }).format(ts);
+}
 
 const agentLabel = computed(
   () => props.title?.trim() || props.agentId || 'Agent',
@@ -125,7 +123,19 @@ function dismissError() {
   if (conversation) bridleStore.dismissError(conversation);
 }
 
+// ── Scrolling ─────────────────────────────────────────────────
+// One rule (CLEAN-102, research D8): sending always goes to the bottom;
+// incoming content is followed only by a reader who is already there.
+
 const scrollEl = ref<HTMLElement | null>(null);
+/** How close to the end still counts as "reading the newest message". */
+const NEAR_BOTTOM_PX = 80;
+
+function isNearBottom(): boolean {
+  const el = scrollEl.value;
+  if (!el) return true;
+  return el.scrollHeight - el.scrollTop - el.clientHeight <= NEAR_BOTTOM_PX;
+}
 
 function scrollToBottom() {
   const el = scrollEl.value;
@@ -138,7 +148,22 @@ function scrollToBottom() {
 async function onSend(text: string) {
   const conversation = activeConversation.value;
   if (!conversation) return;
-  await bridleStore.sendMessage(conversation, text);
+  bridleStore.sendMessage(conversation, text);
+  // Wherever the person was reading, they just spoke: show them their
+  // message. The watcher below would not — it only follows a reader who was
+  // already at the bottom.
+  await nextTick();
+  scrollToBottom();
+}
+
+function onResend(id: string) {
+  const conversation = activeConversation.value;
+  if (conversation) bridleStore.resend(conversation, id);
+}
+
+function onDiscard(id: string) {
+  const conversation = activeConversation.value;
+  if (conversation) bridleStore.discard(conversation, id);
 }
 
 watch(
@@ -148,10 +173,16 @@ watch(
     // Every new step and every streamed chunk grows the flow.
     thinkingBlocks.value.reduce((n, b) => n + b.steps.length, 0),
     messages.value[messages.value.length - 1]?.text.length ?? 0,
+    // A delivery line appearing under the last message grows it too.
+    messages.value[messages.value.length - 1]?.delivery,
   ],
   async () => {
+    // Measured BEFORE the DOM grows (a watcher runs ahead of the render):
+    // afterwards the new content itself would push a reader who was at the
+    // bottom out of range. Someone scrolled up to read is left where they are.
+    const follow = isNearBottom();
     await nextTick();
-    scrollToBottom();
+    if (follow) scrollToBottom();
   },
 );
 
@@ -195,9 +226,7 @@ function onDragOver(event: DragEvent) {
   if (!dragHasFiles(event)) return;
   // Without this the browser treats the drop as a navigation.
   event.preventDefault();
-  if (event.dataTransfer) {
-    event.dataTransfer.dropEffect = sending.value ? 'none' : 'copy';
-  }
+  if (event.dataTransfer) event.dataTransfer.dropEffect = 'copy';
 }
 
 function onDragLeave(event: DragEvent) {
@@ -214,7 +243,7 @@ function onDrop(event: DragEvent) {
   dragDepth.value = 0;
   isDraggingFile.value = false;
   const conversation = activeConversation.value;
-  if (sending.value || !conversation) return;
+  if (!conversation) return;
 
   const files = event.dataTransfer?.files;
   if (files?.length) bridleStore.stageFiles(conversation, files);
@@ -293,14 +322,31 @@ onBeforeUnmount(() => {
 
           <template v-for="item in chatFlow" :key="item.key">
             <BridleChatMessage
-              v-if="item.message"
+              v-if="item.kind === 'message'"
               :message="item.message"
               :conversation="activeConversation"
               :agent-name="title"
+              @resend="onResend"
+              @discard="onDiscard"
             />
+            <!-- The times under the bubbles are times of day; this says of
+                 which day. Today / yesterday are keys, older days arrive
+                 already formatted for the locale. -->
+            <div
+              v-else-if="item.kind === 'day'"
+              class="flex justify-center py-1"
+              role="separator"
+            >
+              <span
+                class="rounded-full bg-muted px-2.5 py-0.5 text-[11px] font-medium text-muted-foreground"
+                :title="dayTitle(item.ts)"
+              >
+                {{ item.labelKey ? $t(item.labelKey) : item.label }}
+              </span>
+            </div>
             <!-- A thinking segment sits where the agent's work happened:
                  above the answer it led to, below the message it answers. -->
-            <div v-else-if="item.block" class="flex items-start gap-2">
+            <div v-else class="flex items-start gap-2">
               <div
                 class="flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-linear-to-br from-primary/25 to-primary/5 text-[11px] font-semibold text-primary"
                 :title="title"
@@ -362,15 +408,13 @@ onBeforeUnmount(() => {
 
       <!-- The compose area is replaced, not covered: the dashed block takes
            its place while a file is overhead. Draft text and staged files live
-           in the store, so the swap cannot lose them. -->
-      <BridleChatDropZone
-        v-if="isDraggingFile"
-        :disabled="sending"
-      />
+           in the store, so the swap cannot lose them. Neither is disabled
+           while the agent answers: a follow-up mid-turn is a normal thing to
+           send, and the store gates sending on uploads alone. -->
+      <BridleChatDropZone v-if="isDraggingFile" />
       <BridleChatInput
         v-else
         :conversation="activeConversation"
-        :disabled="sending"
         @send="onSend"
       />
     </template>
diff --git a/app/slices/bridle/data/bridle.gateway.ts b/app/slices/bridle/data/bridle.gateway.ts
index c130e047..4cca5d6a 100644
--- a/app/slices/bridle/data/bridle.gateway.ts
+++ b/app/slices/bridle/data/bridle.gateway.ts
@@ -1,4 +1,5 @@
 import { io } from 'socket.io-client';
+import { BridleService as BridleApi } from '#api';
 import { client as apiClient } from '#api/data/repositories/api/client.gen';
 import { BaseGateway } from '#common/data/BaseGateway';
 import { unwrapEnvelope } from '#common/data/unwrapEnvelope';
@@ -8,8 +9,11 @@ import type {
   IBridleChannel,
   IBridleChannelAuth,
   IBridleChannelEvents,
+  IBridleMessage,
+  IBridleSendAck,
   IBridleShareContext,
 } from '../domain/bridle.types';
+import { FAILED_MS, FAILURE_TIMEOUT } from '../utils/delivery';
 import { BridleMapper } from './bridle.mapper';
 
 /**
@@ -78,6 +82,9 @@ export class BridleGateway extends BaseGateway implements IBridleGateway {
    * A share visitor sends the pair and no bearer: on the hub a valid JWT
    * wins over the pair, and an owner opening their own link must chat as a
    * visitor (the HTTP calls send `Authorization: null` for the same reason).
+   *
+   * `lastSeq` rides in the same function for the same reason: read at
+   * (re)connect time, it tells the hub what to replay after THIS gap.
    */
   openChannel(
     agentId: string,
@@ -98,10 +105,16 @@ export class BridleGateway extends BaseGateway implements IBridleGateway {
                 shareVisitor: auth.share.visitorId,
               }
             : { token: auth.token?.() ?? '' }),
+          ...(auth.lastSeq ? { lastSeq: auth.lastSeq() } : {}),
         }),
     });
+    // The channel object below is a plain literal — no `this` inside it.
+    const mapper = this.mapper;
 
     socket.on('connect', () => events.onConnected());
+    socket.on('welcome', (raw: unknown) =>
+      events.onWelcome(mapper.toWelcome(raw)),
+    );
     socket.on('disconnect', () => events.onDisconnected());
     socket.on('connect_error', (err: Error) => {
       // Network-level: socket.io keeps retrying on its own. Logged so a
@@ -116,9 +129,10 @@ export class BridleGateway extends BaseGateway implements IBridleGateway {
       const message = (raw as { message?: unknown } | null)?.message;
       events.onMessageError(
         typeof message === 'string' ? message : 'Message could not be delivered',
+        mapper.toSeq(raw),
       );
     });
-    socket.on('typing', () => events.onTyping());
+    socket.on('typing', (raw: unknown) => events.onTyping(mapper.toSeq(raw)));
     socket.on('thinking', (raw: unknown) => {
       const event = this.mapper.toThinkingEvent(raw);
       if (event) events.onThinking(event);
@@ -132,14 +146,33 @@ export class BridleGateway extends BaseGateway implements IBridleGateway {
     socket.on('message', (raw: unknown) =>
       events.onMessage(this.mapper.toReply(raw)),
     );
+    socket.on('user_message', (raw: unknown) => {
+      const message = mapper.toUserMessage(raw);
+      if (message) events.onUserMessage(message);
+    });
 
     return {
-      send(text, attachmentIds) {
-        // `attachmentIds` is omitted entirely when empty so a plain text
-        // message is byte-identical to what the embed SDK sends.
-        socket.emit('message', {
-          text,
-          ...(attachmentIds?.length ? { attachmentIds } : {}),
+      send(text, attachmentIds, clientMessageId) {
+        // Always resolves: the store turns the verdict into a delivery state,
+        // and "no answer in time" is one of the verdicts. socket.io drops a
+        // timed-out packet from its send buffer, so a message that failed
+        // here is not quietly sent after a later reconnect.
+        return new Promise<IBridleSendAck>((resolve) => {
+          socket.timeout(FAILED_MS).emit(
+            'message',
+            {
+              text,
+              // Omitted entirely when empty, the way the embed SDK sends it.
+              ...(attachmentIds?.length ? { attachmentIds } : {}),
+              clientMessageId,
+            },
+            (err: Error | null, raw: unknown) =>
+              resolve(
+                err
+                  ? { status: 'rejected', code: FAILURE_TIMEOUT }
+                  : mapper.toSendAck(raw, clientMessageId),
+              ),
+          );
         });
       },
       reconnect() {
@@ -220,4 +253,21 @@ export class BridleGateway extends BaseGateway implements IBridleGateway {
       return res.data as Blob;
     });
   }
+
+  transcriptTail(
+    agentId: string,
+    channel: string,
+    share?: IBridleShareContext,
+  ): Promise<IBridleMessage[]> {
+    return this.execute(async () => {
+      const headers = shareHeaders(share);
+      const res = await BridleApi.getBridleTranscript({
+        path: { agentId },
+        query: { channel },
+        ...(headers ? { headers } : {}),
+        throwOnError: true,
+      });
+      return this.mapper.toTranscript(unwrapEnvelope(res.data));
+    });
+  }
 }
diff --git a/app/slices/bridle/data/bridle.mapper.ts b/app/slices/bridle/data/bridle.mapper.ts
index 0812a278..cd243a72 100644
--- a/app/slices/bridle/data/bridle.mapper.ts
+++ b/app/slices/bridle/data/bridle.mapper.ts
@@ -1,10 +1,16 @@
+import type { TranscriptResponseDto } from '#api';
 import {
   BridleAttachmentKinds,
+  BridleRoleTypes,
   BridleThinkingStepStates,
   type IBridleAttachment,
+  type IBridleMessage,
   type IBridleReply,
+  type IBridleSendAck,
   type IBridleThinkingEvent,
   type IBridleThinkingStep,
+  type IBridleUserMessageEvent,
+  type IBridleWelcome,
 } from '../domain/bridle.types';
 
 /**
@@ -20,9 +26,84 @@ export class BridleMapper {
       messageId: typeof o.messageId === 'string' ? o.messageId : null,
       text: typeof o.text === 'string' ? o.text : '',
       ts: typeof o.ts === 'number' ? o.ts : null,
+      ...seqOf(o),
     };
   }
 
+  /**
+   * The hub's per-identity sequence, carried by every hub → browser frame
+   * (CLEAN-102). A hub that predates it sends none — the store then treats
+   * the frame as live.
+   */
+  toSeq(raw: unknown): number | undefined {
+    return seqOf(asRecord(raw)).seq;
+  }
+
+  toWelcome(raw: unknown): IBridleWelcome {
+    const o = asRecord(raw);
+    return {
+      clientId: typeof o.clientId === 'string' && o.clientId ? o.clientId : null,
+      seq: seqOf(o).seq ?? null,
+    };
+  }
+
+  /**
+   * The ack of one `message` emit. Anything that is not a well-formed verdict
+   * counts as a rejection: showing "delivered" on the strength of a frame we
+   * could not read is the one mistake the ack exists to prevent.
+   */
+  toSendAck(raw: unknown, clientMessageId: string): IBridleSendAck {
+    const o = asRecord(raw);
+    if (o.status === 'accepted') {
+      return {
+        status: 'accepted',
+        messageId:
+          typeof o.messageId === 'string' && o.messageId
+            ? o.messageId
+            : clientMessageId,
+        ts: typeof o.ts === 'number' ? o.ts : Date.now(),
+        ...(o.duplicate === true ? { duplicate: true as const } : {}),
+      };
+    }
+    return {
+      status: 'rejected',
+      code: typeof o.code === 'string' && o.code ? o.code : 'UNKNOWN',
+      ...(typeof o.message === 'string' && o.message
+        ? { message: o.message }
+        : {}),
+    };
+  }
+
+  /** A `user_message` echo, or null when it names no message to match by. */
+  toUserMessage(raw: unknown): IBridleUserMessageEvent | null {
+    const o = asRecord(raw);
+    if (typeof o.messageId !== 'string' || !o.messageId) return null;
+    const attachments = Array.isArray(o.attachments)
+      ? o.attachments.map((a) => this.toAttachment(a)).filter((a) => a.id)
+      : [];
+    return {
+      messageId: o.messageId,
+      text: typeof o.text === 'string' ? o.text : '',
+      ts: typeof o.ts === 'number' ? o.ts : null,
+      ...(attachments.length ? { attachments } : {}),
+      ...seqOf(o),
+    };
+  }
+
+  /**
+   * A transcript page as conversation messages, oldest first as the API
+   * returns them. Typed by the generated DTO — this one arrives over the SDK,
+   * not as an untyped socket frame.
+   */
+  toTranscript(dto: TranscriptResponseDto | null): IBridleMessage[] {
+    return (dto?.messages ?? []).map((m) => ({
+      id: m.id,
+      role: m.role === 'user' ? BridleRoleTypes.User : BridleRoleTypes.Agent,
+      text: m.text,
+      ts: m.ts,
+    }));
+  }
+
   /**
    * A `thinking` frame, or null when it names no turn — the store keys every
    * block by turn, so a frame without one could only corrupt the timeline.
@@ -36,6 +117,7 @@ export class BridleMapper {
       ...(step ? { step } : {}),
       ...(o.done === true ? { done: true } : {}),
       ts: typeof o.ts === 'number' ? o.ts : Date.now(),
+      ...seqOf(o),
     };
   }
 
@@ -97,3 +179,10 @@ export class BridleMapper {
 function asRecord(raw: unknown): Record<string, unknown> {
   return raw && typeof raw === 'object' ? (raw as Record<string, unknown>) : {};
 }
+
+/** Spreadable, so a frame without a `seq` yields no `seq` key at all. */
+function seqOf(o: Record<string, unknown>): { seq?: number } {
+  return typeof o.seq === 'number' && Number.isFinite(o.seq)
+    ? { seq: o.seq }
+    : {};
+}
diff --git a/app/slices/bridle/domain/bridle.gateway.ts b/app/slices/bridle/domain/bridle.gateway.ts
index f9d541e3..d70f234a 100644
--- a/app/slices/bridle/domain/bridle.gateway.ts
+++ b/app/slices/bridle/domain/bridle.gateway.ts
@@ -3,6 +3,7 @@ import type {
   IBridleChannel,
   IBridleChannelAuth,
   IBridleChannelEvents,
+  IBridleMessage,
   IBridleShareContext,
 } from './bridle.types';
 
@@ -57,4 +58,16 @@ export abstract class IBridleGateway {
     attachmentId: string,
     share?: IBridleShareContext,
   ): Promise<Blob>;
+
+  /**
+   * The newest page of what the agent runtime wrote down for one channel,
+   * oldest message first. Not a live data path: the store asks only when a
+   * turn went silent, to recover an answer the socket never delivered.
+   * `channel` is the chat identity the hub reported in `welcome`.
+   */
+  abstract transcriptTail(
+    agentId: string,
+    channel: string,
+    share?: IBridleShareContext,
+  ): Promise<IBridleMessage[]>;
 }
diff --git a/app/slices/bridle/domain/bridle.service.ts b/app/slices/bridle/domain/bridle.service.ts
index ab1be1a2..78a0ef1b 100644
--- a/app/slices/bridle/domain/bridle.service.ts
+++ b/app/slices/bridle/domain/bridle.service.ts
@@ -4,6 +4,7 @@ import type {
   IBridleChannel,
   IBridleChannelAuth,
   IBridleChannelEvents,
+  IBridleMessage,
   IBridleShareContext,
 } from './bridle.types';
 
@@ -44,4 +45,12 @@ export class BridleService {
   ): Promise<Blob> {
     return this.gateway.fetchAttachment(agentId, attachmentId, share);
   }
+
+  transcriptTail(
+    agentId: string,
+    channel: string,
+    share?: IBridleShareContext,
+  ): Promise<IBridleMessage[]> {
+    return this.gateway.transcriptTail(agentId, channel, share);
+  }
 }
diff --git a/app/slices/bridle/domain/bridle.types.ts b/app/slices/bridle/domain/bridle.types.ts
index 908e3fa7..8ad0f4d1 100644
--- a/app/slices/bridle/domain/bridle.types.ts
+++ b/app/slices/bridle/domain/bridle.types.ts
@@ -72,11 +72,59 @@ export interface IBridleNotice {
 /** A rejection or failure of one attachment. Same shape, named for its place. */
 export type IBridleAttachmentError = IBridleNotice;
 
+/**
+ * Where one of the person's own messages stands on its way to the agent
+ * (CLEAN-102). `sending` until the hub acknowledges it, `slow` once that has
+ * taken long enough to say so, `failed` when the hub refused it or never
+ * answered. Transitions live in `utils/delivery.ts`.
+ */
+export enum BridleDeliveryStates {
+  Sending = 'sending',
+  Slow = 'slow',
+  Delivered = 'delivered',
+  Failed = 'failed',
+}
+
+/**
+ * The hub's answer to one `message` emit — see
+ * specs/015-chat-message-reliability/contracts/bridle-socket.md. `accepted`
+ * means handed to the agent's socket; `duplicate` marks a resend of an id the
+ * hub had already accepted (it was not forwarded twice). `code` is one of the
+ * hub's (`AGENT_OFFLINE`, `ATTACHMENT_FAILED`, `SHARE_REJECTED`, `EMPTY`) or
+ * the client's own `TIMEOUT` / `OFFLINE`.
+ */
+export type IBridleSendAck =
+  | { status: 'accepted'; messageId: string; ts: number; duplicate?: true }
+  | { status: 'rejected'; code: string; message?: string };
+
 export interface IBridleMessage {
+  /**
+   * The person's message: the UUID minted at send, which is also the
+   * `clientMessageId` on the wire — one id end to end, so a resend is
+   * recognisable. Agent message: the wire `messageId`.
+   */
   id: string;
   role: BridleRoleTypes;
   text: string;
+  /**
+   * Display only. The person's message shows its local send time until the
+   * ack brings the hub's; agent messages carry the agent's clock. Two clocks
+   * — which is why nothing is ever ordered by it.
+   */
   ts: number;
+  /**
+   * Arrival order within the conversation, assigned by the store on append.
+   * The only ordering key. Optional because conversations persisted before
+   * CLEAN-102 lack it — `hydrate` numbers those in stored order.
+   */
+  seq?: number;
+  /**
+   * The person's messages only. Absent means delivered: legacy and
+   * echoed-from-another-view messages never had anything else to say.
+   */
+  delivery?: BridleDeliveryStates;
+  /** Why a `failed` message failed — picks the wording under the bubble. */
+  failureCode?: string;
   /**
    * Present on messages sent with attachments. Optional so conversations
    * persisted before this feature still hydrate unchanged.
@@ -118,6 +166,8 @@ export interface IBridleThinkingEvent {
   step?: IBridleThinkingStep;
   done?: boolean;
   ts: number;
+  /** Hub sequence of the frame — see `IBridleReply.seq`. */
+  seq?: number;
 }
 
 export enum BridleThinkingBlockStates {
@@ -137,8 +187,10 @@ export interface IBridleThinkingBlock {
   seg: number;
   steps: IBridleThinkingStep[];
   state: BridleThinkingBlockStates;
-  /** Where the block sits in the flow; agent-clock, bumped past the last message. */
+  /** When the segment opened, agent-clock. Informational — never ordered by. */
   ts: number;
+  /** Where the block sits in the flow: the conversation's arrival sequence. */
+  seq?: number;
 }
 
 // ── Live channel ────────────────────────────────────────────────
@@ -154,10 +206,38 @@ export enum BridleChannelStates {
  * in-memory bearer on every (re)connect so a renewed token is what travels;
  * the share page sends the visitor's pair and NO bearer — an owner opening
  * their own link must chat as a visitor, the way the HTTP calls already do.
+ *
+ * `lastSeq` rides along on the same handshake and is a getter for the same
+ * reason the token is: a reconnect must report the highest hub `seq` applied
+ * by then, so the hub replays exactly what the gap swallowed.
  */
 export interface IBridleChannelAuth {
   token?: () => string | null;
   share?: IBridleShareContext;
+  lastSeq?: () => number;
+}
+
+/**
+ * The hub's greeting. `clientId` is the chat identity the hub resolved for
+ * this socket — and the name of the transcript channel the agent writes this
+ * conversation to. `seq` is the hub's current sequence for the identity; one
+ * lower than ours means the hub restarted and has nothing to replay.
+ */
+export interface IBridleWelcome {
+  clientId: string | null;
+  seq: number | null;
+}
+
+/**
+ * The person's own message, echoed by the hub to their OTHER open views so a
+ * second tab shows the question and not only the answer.
+ */
+export interface IBridleUserMessageEvent {
+  messageId: string;
+  text: string;
+  ts: number | null;
+  attachments?: IBridleAttachment[];
+  seq?: number;
 }
 
 /** What a live channel reports back. Every callback is optional-free on
@@ -165,23 +245,35 @@ export interface IBridleChannelAuth {
 export interface IBridleChannelEvents {
   onConnected(): void;
   onDisconnected(): void;
+  onWelcome(welcome: IBridleWelcome): void;
   /** The hub is about to drop the socket, and says why (`TOKEN_EXPIRED`,
    *  `SHARE_LINK_INVALID`, …). */
   onRejected(code: string): void;
   /** A message the hub could not deliver; the socket stays up. */
-  onMessageError(message: string): void;
+  onMessageError(message: string, seq?: number): void;
   /** The agent started a turn. */
-  onTyping(): void;
+  onTyping(seq?: number): void;
   onThinking(event: IBridleThinkingEvent): void;
   /** `text` is the whole answer so far, not a delta; `done` on the last frame. */
   onStream(reply: IBridleReply, done: boolean): void;
   /** A complete agent message in one piece. */
   onMessage(reply: IBridleReply): void;
+  /** Sent from another view of the same identity. */
+  onUserMessage(message: IBridleUserMessageEvent): void;
 }
 
 /** A live conversation channel to one agent. */
 export interface IBridleChannel {
-  send(text: string, attachmentIds?: string[]): void;
+  /**
+   * Resolves with the hub's verdict — never rejects. No answer within
+   * `FAILED_MS` resolves as `rejected / TIMEOUT`. `clientMessageId` is the
+   * message's own id; resending with the same one is what makes a retry safe.
+   */
+  send(
+    text: string,
+    attachmentIds: string[] | undefined,
+    clientMessageId: string,
+  ): Promise<IBridleSendAck>;
   /** Re-open after the hub dropped the socket — e.g. once a token was renewed. */
   reconnect(): void;
   close(): void;
@@ -196,6 +288,12 @@ export interface IBridleReply {
   messageId: string | null;
   text: string;
   ts: number | null;
+  /**
+   * The hub's per-identity sequence of the frame that carried this. Not the
+   * message's place in the flow (`IBridleMessage.seq`) — it exists so a
+   * replayed frame that was already applied can be told apart and dropped.
+   */
+  seq?: number;
 }
 
 /**
diff --git a/app/slices/bridle/i18n/locales/en.json b/app/slices/bridle/i18n/locales/en.json
index 379eef5a..a515e7ac 100644
--- a/app/slices/bridle/i18n/locales/en.json
+++ b/app/slices/bridle/i18n/locales/en.json
@@ -28,8 +28,20 @@
     "thought": "Thought for a moment",
     "thinking_toggle": "Show what the agent did",
     "reconnecting": "Reconnecting to the agent…",
-    "error_offline": "Not connected to the agent yet. Your message is back in the composer — try again in a moment.",
     "error_message": "The agent could not take that message: {message}",
-    "error_rejected": "The agent refused the connection ({code})"
+    "error_rejected": "The agent refused the connection ({code})",
+    "error_turn_unfinished": "The agent did not finish this turn. Send your message again to continue.",
+    "delivery_sending": "Sending…",
+    "delivery_slow": "Still sending…",
+    "not_delivered": "Not delivered",
+    "not_delivered_hint": "The agent did not receive this message — it will be gone unless you resend it",
+    "not_delivered_agent_offline": "The agent is not running right now, so it did not receive this message. Resend it once the agent is back.",
+    "not_delivered_offline": "There was no connection to the agent when you sent this. Resend it once the chat has reconnected.",
+    "not_delivered_timeout": "No confirmation came back, so the agent may not have this message. Resending is safe — it will not be delivered twice.",
+    "not_delivered_attachment_failed": "An attached file could not be read, so the message did not reach the agent.",
+    "resend": "Resend",
+    "discard": "Discard",
+    "day_today": "Today",
+    "day_yesterday": "Yesterday"
   }
 }
diff --git a/app/slices/bridle/i18n/locales/ru.json b/app/slices/bridle/i18n/locales/ru.json
index 2617a5e2..fbd71e0d 100644
--- a/app/slices/bridle/i18n/locales/ru.json
+++ b/app/slices/bridle/i18n/locales/ru.json
@@ -28,8 +28,20 @@
     "thought": "Немного подумал",
     "thinking_toggle": "Показать, что делал агент",
     "reconnecting": "Переподключение к агенту…",
-    "error_offline": "Пока нет соединения с агентом. Сообщение вернулось в поле ввода — повторите попытку через мгновение.",
     "error_message": "Агент не принял это сообщение: {message}",
-    "error_rejected": "Агент отклонил подключение ({code})"
+    "error_rejected": "Агент отклонил подключение ({code})",
+    "error_turn_unfinished": "Агент не завершил этот ход. Отправьте сообщение ещё раз, чтобы продолжить.",
+    "delivery_sending": "Отправка…",
+    "delivery_slow": "Всё ещё отправляется…",
+    "not_delivered": "Не доставлено",
+    "not_delivered_hint": "Агент не получил это сообщение — оно будет потеряно, если не отправить его снова",
+    "not_delivered_agent_offline": "Агент сейчас не запущен, поэтому не получил это сообщение. Отправьте его снова, когда агент заработает.",
+    "not_delivered_offline": "В момент отправки не было связи с агентом. Отправьте сообщение снова, когда чат переподключится.",
+    "not_delivered_timeout": "Подтверждение не пришло, поэтому агент мог не получить это сообщение. Повторная отправка безопасна — дважды оно не доставится.",
+    "not_delivered_attachment_failed": "Не удалось прочитать вложенный файл, поэтому сообщение не дошло до агента.",
+    "resend": "Отправить снова",
+    "discard": "Удалить",
+    "day_today": "Сегодня",
+    "day_yesterday": "Вчера"
   }
 }
diff --git a/app/slices/bridle/stores/bridle.ts b/app/slices/bridle/stores/bridle.ts
index 2ef480db..0394e924 100644
--- a/app/slices/bridle/stores/bridle.ts
+++ b/app/slices/bridle/stores/bridle.ts
@@ -14,6 +14,7 @@ import {
 import {
   BridleAttachmentKinds,
   BridleChannelStates,
+  BridleDeliveryStates,
   BridleThinkingBlockStates,
   BridleThinkingStepStates,
 } from '#bridle/domain';
@@ -22,14 +23,26 @@ import type {
   IBridleAttachment,
   IBridleAttachmentError,
   IBridleChannel,
+  IBridleChannelEvents,
   IBridleConversation,
   IBridleMessage,
   IBridleNotice,
   IBridleReply,
+  IBridleSendAck,
   IBridleStagedAttachment,
   IBridleThinkingBlock,
   IBridleThinkingEvent,
+  IBridleUserMessageEvent,
+  IBridleWelcome,
 } from '#bridle/domain';
+import { nextSeq, numberLegacy } from '#bridle/utils/chatFlow';
+import {
+  FAILURE_OFFLINE,
+  SLOW_MS,
+  nextDelivery,
+  type IDeliveryEvent,
+} from '#bridle/utils/delivery';
+import { missedReplies } from '#bridle/utils/transcriptTail';
 
 // Re-export the domain enums/types so consumers importing them from
 // `#bridle/stores/bridle` (Message.vue) keep working. The enums are used as
@@ -39,6 +52,7 @@ export {
   BridleAttachmentKinds,
   BridleAttachmentStates,
   BridleChannelStates,
+  BridleDeliveryStates,
   BridleThinkingBlockStates,
   BridleThinkingStepStates,
 } from '#bridle/domain';
@@ -64,6 +78,14 @@ const getService = createServiceGetter<BridleService>('$bridleService');
  */
 const THINKING_STALE_MS = 75_000;
 
+/**
+ * How long a channel nobody holds stays open (CLEAN-102, research D7). Going
+ * from the landing page's hero chat to the agent page unmounts one chat and
+ * mounts another for the same conversation; closing at once would drop the
+ * socket mid-answer, so the next holder gets a moment to take it over.
+ */
+const RELEASE_GRACE_MS = 3000;
+
 /** Hub handshake rejections the console can recover from by renewing. */
 const RENEWABLE_CODES = new Set(['TOKEN_EXPIRED', 'INVALID_TOKEN']);
 /** Hub rejections that mean the share link itself is dead. */
@@ -76,6 +98,12 @@ const SHARE_DEAD_CODES = new Set(['SHARE_LINK_INVALID', 'SHARE_VISITOR_INVALID']
 // pre-descriptor version wrote — already-stored conversations still load.
 // Mirrors the admin's per-bot persistence pattern for debug snapshots.
 const CONVERSATION_STORAGE_PREFIX = 'bridle:conversation:';
+/**
+ * The highest hub `seq` applied to a conversation, kept next to it so a reload
+ * can ask the hub for what arrived while the page was gone. A key of its own:
+ * the conversation entry is a bare message array that older builds still read.
+ */
+const HUB_SEQ_STORAGE_PREFIX = 'bridle:seq:';
 
 /**
  * Sent with attachments when the person typed nothing. The shared
@@ -123,6 +151,57 @@ function clearConversationFromStorage(key: string): void {
   }
 }
 
+function loadHubSeqFromStorage(key: string): number {
+  if (typeof window === 'undefined') return 0;
+  try {
+    const seq = Number(window.localStorage.getItem(HUB_SEQ_STORAGE_PREFIX + key));
+    return Number.isFinite(seq) && seq > 0 ? seq : 0;
+  } catch {
+    return 0;
+  }
+}
+
+function saveHubSeqToStorage(key: string, seq: number): void {
+  if (typeof window === 'undefined') return;
+  try {
+    window.localStorage.setItem(HUB_SEQ_STORAGE_PREFIX + key, String(seq));
+  } catch {
+    // Best-effort: a lost value only means the hub replays a little more.
+  }
+}
+
+/**
+ * The message id, which is also the `clientMessageId` on the wire.
+ * `randomUUID` exists only in a secure context; a console served over plain
+ * http on a LAN must still be able to send, so it falls back to an id that is
+ * merely unique enough for the hub's ten-minute idempotency window.
+ */
+function newMessageId(): string {
+  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+    return crypto.randomUUID();
+  }
+  return `u-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+}
+
+/**
+ * The message after a delivery event. The old state is dropped before the new
+ * one is spread in, so a `failureCode` never outlives the failure it explained.
+ */
+function withDelivery(
+  message: IBridleMessage,
+  event: IDeliveryEvent,
+): IBridleMessage {
+  const { delivery: _d, failureCode: _f, ...rest } = message;
+  return { ...rest, ...nextDelivery(message, event) };
+}
+
+/** One live channel and how many mounted chats are holding it open. */
+interface IChannelHold {
+  channel: IBridleChannel | null;
+  holders: number;
+  closeTimer?: ReturnType<typeof setTimeout>;
+}
+
 function resolveKind(mimeType: string): BridleAttachmentKinds | null {
   if ((IMAGE_MIME_TYPES as readonly string[]).includes(mimeType)) {
     return BridleAttachmentKinds.Image;
@@ -137,8 +216,9 @@ export const useBridleStore = defineStore('bridle', () => {
   const conversations = ref<Record<string, IBridleMessage[]>>({});
   /**
    * True from the moment a message is sent until the agent's first visible
-   * content lands (or the turn dies). Gates the composer and drives the
-   * shimmer status line when no thinking block is open.
+   * content lands (or the turn dies). Drives the shimmer status line when no
+   * thinking block is open. It does NOT gate the composer: a follow-up while
+   * the agent is still answering is a normal thing to send (CLEAN-102).
    */
   const pending = ref<Record<string, boolean>>({});
   const errors = ref<Record<string, IBridleNotice | null>>({});
@@ -161,8 +241,28 @@ export const useBridleStore = defineStore('bridle', () => {
 
   // Plain maps, not refs: sockets and timers are not view state, and a
   // reactive proxy around a socket.io client would only get in the way.
-  const channels = new Map<string, IBridleChannel>();
+  /**
+   * One channel per conversation, shared by every chat that shows it. The
+   * landing hero and the agent page mount the SAME conversation, and during a
+   * route change both exist at once — so a channel is held, not owned:
+   * `channel` is null while the handshake prerequisites are still in flight,
+   * `closeTimer` runs while nobody holds it (see RELEASE_GRACE_MS).
+   */
+  const channels = new Map<string, IChannelHold>();
   const watchdogs = new Map<string, ReturnType<typeof setTimeout>>();
+  /** Next arrival `seq` per conversation — the flow's only ordering key. */
+  const nextSeqs = new Map<string, number>();
+  /** Highest hub `seq` applied per conversation; what a reconnect reports. */
+  const lastHubSeqs = new Map<string, number>();
+  /**
+   * The chat identity the hub resolved for this conversation (`welcome`). It
+   * is also the transcript channel the agent writes to — `admin` for owners
+   * and admins, the user id otherwise, `share-<visitorId>` for a visitor — and
+   * the hub is the only side that knows which.
+   */
+  const hubClientIds = new Map<string, string>();
+  /** "Still sending…" timers, keyed by message id. */
+  const slowTimers = new Map<string, ReturnType<typeof setTimeout>>();
   /** Turns whose terminal event arrived; straggler steps are ignored. */
   const closedTurns = new Map<string, Set<string>>();
   /** One renew-and-reconnect per rejection, never a loop. */
@@ -206,9 +306,10 @@ export const useBridleStore = defineStore('bridle', () => {
    * Sending is allowed with text OR at least one ready attachment, and is
    * blocked while anything is still uploading or has failed — an incomplete
    * message would reach the agent missing exactly the file it was about.
+   * A turn in progress is no reason to wait: the follow-up is queued behind
+   * it by the agent, not by the composer.
    */
   function canSend(key: string, draft: string): boolean {
-    if (isPending(key)) return false;
     if (isUploading(key) || hasFailedAttachment(key)) return false;
     const hasReady = stagedFor(key).some(
       (a) => a.state === BridleAttachmentStates.Ready,
@@ -231,10 +332,31 @@ export const useBridleStore = defineStore('bridle', () => {
     if (stored && stored.length) {
       // Belt and braces: `persist` strips the flag, but a bubble that was
       // stored mid-stream by an older build must not reload as "in progress".
-      conversations.value[key] = stored.map(({ streaming: _s, ...m }) => m);
+      // Conversations stored before CLEAN-102 carry no `seq`: number them in
+      // stored order, which is the order the person saw them arrive in.
+      conversations.value[key] = numberLegacy(
+        stored.map(({ streaming: _s, ...m }) => m),
+      ).map((m) =>
+        // A message that was still on its way when the page went away: its
+        // ack was owed to a socket that no longer exists. Say so, and let the
+        // person decide — resending is safe, the id is the same.
+        m.role === BridleRoleTypes.User && m.delivery
+          ? withDelivery(m, { type: 'pageLoad' })
+          : m,
+      );
+      nextSeqs.set(key, nextSeq(conversations.value[key]));
+      persist(conv);
     }
   }
 
+  /** Hand out the next arrival number — messages and thinking blocks alike. */
+  function takeSeq(key: string): number {
+    const seq =
+      nextSeqs.get(key) ?? nextSeq([...messagesFor(key), ...thinkingFor(key)]);
+    nextSeqs.set(key, seq + 1);
+    return seq;
+  }
+
   function persist(conv: IBridleConversation) {
     const messages = conversations.value[conv.key];
     if (messages && messages.length) {
@@ -247,12 +369,57 @@ export const useBridleStore = defineStore('bridle', () => {
     }
   }
 
+  /**
+   * Every message enters the conversation here or in `onStream`, and both
+   * stamp it with the next arrival `seq`: the order things reached THIS
+   * screen is the order the person experienced, whatever the clocks say.
+   */
   function appendMessage(conv: IBridleConversation, message: IBridleMessage) {
     if (!conversations.value[conv.key]) conversations.value[conv.key] = [];
-    conversations.value[conv.key].push(message);
+    conversations.value[conv.key].push({ ...message, seq: takeSeq(conv.key) });
     persist(conv);
   }
 
+  function findMessage(key: string, id: string): IBridleMessage | undefined {
+    return conversations.value[key]?.find((m) => m.id === id);
+  }
+
+  /** Replace one message in place — the list keeps its order and its `seq`s. */
+  function replaceMessage(conv: IBridleConversation, next: IBridleMessage) {
+    const list = conversations.value[conv.key];
+    const index = list?.findIndex((m) => m.id === next.id) ?? -1;
+    if (!list || index === -1) return;
+    list[index] = next;
+    persist(conv);
+  }
+
+  // ── Hub sequence ───────────────────────────────────────────
+
+  /** Highest hub `seq` applied, read back from storage on first use. */
+  function lastHubSeq(key: string): number {
+    let seq = lastHubSeqs.get(key);
+    if (seq === undefined) {
+      seq = loadHubSeqFromStorage(key);
+      lastHubSeqs.set(key, seq);
+    }
+    return seq;
+  }
+
+  /**
+   * Gate for every hub frame. A frame at or below the highest `seq` already
+   * applied is a replay overlap and is dropped; a frame without a `seq` comes
+   * from a hub that predates sequencing and is always live. `save: false` is
+   * for stream chunks: the final frame saves, and a value that lags only
+   * makes the hub replay a few frames that are dropped here again.
+   */
+  function acceptSeq(key: string, seq: number | undefined, save = true) {
+    if (seq === undefined) return true;
+    if (seq <= lastHubSeq(key)) return false;
+    lastHubSeqs.set(key, seq);
+    if (save) saveHubSeqToStorage(key, seq);
+    return true;
+  }
+
   // ── Attachments ────────────────────────────────────────────
 
   /**
@@ -427,19 +594,67 @@ export const useBridleStore = defineStore('bridle', () => {
 
   // ── Live channel ───────────────────────────────────────────
 
-  function armWatchdog(key: string) {
+  function armWatchdog(conv: IBridleConversation) {
+    const key = conv.key;
     const current = watchdogs.get(key);
     if (current) clearTimeout(current);
     watchdogs.set(
       key,
       setTimeout(() => {
         watchdogs.delete(key);
-        pending.value[key] = false;
-        closeAllTurns(key);
+        void onTurnStale(conv);
       }, THINKING_STALE_MS),
     );
   }
 
+  /**
+   * The watchdog's verdict. It also fires, harmlessly, a while after every
+   * turn that ended well — nothing disarms it on the last frame — so the
+   * safety net is reserved for a turn that was still visibly open: the agent
+   * may well have answered (its log says so) while the frames never reached
+   * this browser. Ask the transcript before telling the person it went wrong.
+   */
+  async function onTurnStale(conv: IBridleConversation) {
+    const key = conv.key;
+    const open = isPending(key) || hasOpenThinking(key);
+    pending.value[key] = false;
+    closeAllTurns(key);
+    if (!open) return;
+    if (!(await recoverFromTranscript(conv))) {
+      errors.value[key] = { key: 'chat.error_turn_unfinished' };
+    }
+  }
+
+  /**
+   * Append the agent messages the transcript holds and the screen does not.
+   * Returns whether anything was recovered. A failed read is "nothing
+   * recovered", never an error of its own — this is the fallback already.
+   */
+  async function recoverFromTranscript(conv: IBridleConversation) {
+    const key = conv.key;
+    const channel = hubClientIds.get(key);
+    if (!channel) return false;
+    let tail: IBridleMessage[];
+    try {
+      tail = await getService().transcriptTail(conv.agentId, channel, conv.share);
+    } catch (err) {
+      console.warn('[bridle] transcript read failed', err);
+      return false;
+    }
+    // Measured against the screen as it is NOW: the answer may have arrived
+    // over the socket while the request was in flight.
+    const missed = missedReplies(messagesFor(key), tail);
+    for (const m of missed) {
+      appendMessage(conv, {
+        id: m.id,
+        role: BridleRoleTypes.Agent,
+        text: m.text,
+        ts: m.ts,
+      });
+    }
+    return missed.length > 0;
+  }
+
   function disarmWatchdog(key: string) {
     const current = watchdogs.get(key);
     if (current) clearTimeout(current);
@@ -464,8 +679,9 @@ export const useBridleStore = defineStore('bridle', () => {
     }
   }
 
-  /** Terminal paths (watchdog, disconnect): seal segments AND close their
-   *  turns so a straggler step cannot resurrect a zombie segment. */
+  /** Terminal paths (watchdog, hub rejection, the channel closing): seal
+   *  segments AND close their turns so a straggler step cannot resurrect a
+   *  zombie segment. A socket that merely dropped is NOT one of them. */
   function closeAllTurns(key: string) {
     const closed = closedTurns.get(key) ?? new Set<string>();
     for (const b of thinkingFor(key)) closed.add(b.turnId);
@@ -476,6 +692,7 @@ export const useBridleStore = defineStore('bridle', () => {
 
   function onThinking(conv: IBridleConversation, e: IBridleThinkingEvent) {
     const key = conv.key;
+    if (!acceptSeq(key, e.seq)) return;
     if (!thinking.value[key]) thinking.value[key] = [];
     const blocks = thinking.value[key];
     const closed = closedTurns.get(key) ?? new Set<string>();
@@ -497,7 +714,7 @@ export const useBridleStore = defineStore('bridle', () => {
     if (owner) {
       owner.steps = owner.steps.map((s) => (s.id === step.id ? step : s));
       pending.value[key] = true;
-      armWatchdog(key);
+      armWatchdog(conv);
       return;
     }
 
@@ -515,15 +732,16 @@ export const useBridleStore = defineStore('bridle', () => {
           closed.add(b.turnId);
         }
       }
-      // Anchor after every message on screen — wire ts is agent-clock.
-      const list = messagesFor(key);
-      const lastTs = list[list.length - 1]?.ts ?? 0;
+      // Anchored by arrival, like a message: below everything on screen
+      // now, above whatever lands next. `ts` is the agent's clock and says
+      // nothing about where the block belongs.
       block = {
         turnId: e.turnId,
         seg: turnBlocks.length,
         steps: [],
         state: BridleThinkingBlockStates.Thinking,
-        ts: Math.max(e.ts, lastTs + 1),
+        ts: e.ts,
+        seq: takeSeq(key),
       };
       blocks.push(block);
     }
@@ -531,7 +749,7 @@ export const useBridleStore = defineStore('bridle', () => {
     // Steps mean the agent is working — keep the shimmer alive through tool
     // execution and re-arm the watchdog.
     pending.value[key] = true;
-    armWatchdog(key);
+    armWatchdog(conv);
   }
 
   function onStream(
@@ -540,9 +758,10 @@ export const useBridleStore = defineStore('bridle', () => {
     done: boolean,
   ) {
     const key = conv.key;
+    if (!acceptSeq(key, reply.seq, done)) return;
     // Streaming is activity too — keep the stale watchdog fed so an open
     // block only freezes when the turn truly went silent.
-    if (!done && hasOpenThinking(key)) armWatchdog(key);
+    if (!done && hasOpenThinking(key)) armWatchdog(conv);
     const list = conversations.value[key] ?? (conversations.value[key] = []);
     const index = reply.messageId
       ? list.findIndex((m) => m.id === reply.messageId)
@@ -565,6 +784,7 @@ export const useBridleStore = defineStore('bridle', () => {
         role: BridleRoleTypes.Agent,
         text: reply.text,
         ts: reply.ts ?? Date.now(),
+        seq: takeSeq(key),
         ...(done ? {} : { streaming: true }),
       });
     }
@@ -577,8 +797,16 @@ export const useBridleStore = defineStore('bridle', () => {
 
   function onMessage(conv: IBridleConversation, reply: IBridleReply) {
     const key = conv.key;
+    if (!acceptSeq(key, reply.seq)) return;
     pending.value[key] = false;
     if (!reply.text.trim()) return;
+    // A message already on screen — replayed after a reload that lost the
+    // hub sequence, say — updates its bubble and never adds a second one.
+    const existing = reply.messageId ? findMessage(key, reply.messageId) : null;
+    if (existing) {
+      replaceMessage(conv, { ...existing, text: reply.text });
+      return;
+    }
     // Content lands below the open segment — seal it so the next step opens
     // a fresh segment under this message (turn stays open).
     freezeOpenThinking(key);
@@ -611,8 +839,9 @@ export const useBridleStore = defineStore('bridle', () => {
       const auth = useAuthStore();
       if (!authRetried.has(key) && (await auth.refresh())) {
         authRetried.add(key);
-        channels.get(key)?.reconnect();
+        channels.get(key)?.channel?.reconnect();
       } else {
+        handBackUnsent(conv);
         auth.endSession(code);
       }
       return;
@@ -621,72 +850,175 @@ export const useBridleStore = defineStore('bridle', () => {
   }
 
   /**
-   * Open the live channel for a conversation. Idempotent — the Provider calls
-   * it whenever its conversation key settles, and a channel that is already
-   * open is left alone. The console makes sure its bearer is not about to
-   * expire first: the hub would refuse it a moment later.
+   * The session ended under a message that never left (CLEAN-72): put its
+   * text back in the composer, so signing in again leads straight to sending
+   * it. This is the ONE path that still hands text back — everywhere else an
+   * unsent message stays in the conversation as "not delivered", which
+   * survives a reload and cannot be retyped into a duplicate. Moved, not
+   * copied, for the same reason. A message with files stays where it is: the
+   * composer can take the words back, not the uploads.
    */
-  async function connect(conv: IBridleConversation) {
+  function handBackUnsent(conv: IBridleConversation) {
     const key = conv.key;
-    if (channels.has(key)) return;
-    connection.value[key] = BridleChannelStates.Connecting;
-    if (!conv.share) await useAuthStore().ensureFresh();
-    // Someone else connected (or the chat unmounted) while that was in flight.
-    if (
-      channels.has(key) ||
-      connection.value[key] !== BridleChannelStates.Connecting
-    ) {
+    const list = messagesFor(key);
+    const last = list[list.length - 1];
+    if (!last || last.role !== BridleRoleTypes.User) return;
+    const unsent =
+      last.delivery === BridleDeliveryStates.Sending ||
+      last.delivery === BridleDeliveryStates.Slow ||
+      (last.delivery === BridleDeliveryStates.Failed &&
+        last.failureCode === FAILURE_OFFLINE);
+    if (!unsent || !last.text || last.attachments?.length) return;
+    drafts.value[key] = last.text;
+    removeMessage(conv, last.id);
+  }
+
+  /** Every frame of one channel lands here, gated by `acceptSeq`. */
+  function channelEvents(conv: IBridleConversation): IBridleChannelEvents {
+    const key = conv.key;
+    return {
+      onConnected() {
+        connection.value[key] = BridleChannelStates.Connected;
+        authRetried.delete(key);
+      },
+      onDisconnected() {
+        // Only the badge changes. A dropped socket reconnects on its own and
+        // the hub replays what the gap swallowed (`lastSeq`), so the turn is
+        // left open: if it really died, the watchdog says so — after asking
+        // the transcript (CLEAN-102, research F4).
+        connection.value[key] = BridleChannelStates.Offline;
+      },
+      onWelcome: (welcome) => onWelcome(conv, welcome),
+      onRejected: (code) => void onRejected(conv, code),
+      onMessageError(message, seq) {
+        if (!acceptSeq(key, seq)) return;
+        pending.value[key] = false;
+        errors.value[key] = {
+          key: 'chat.error_message',
+          params: { message },
+        };
+      },
+      onTyping(seq) {
+        if (!acceptSeq(key, seq)) return;
+        pending.value[key] = true;
+        armWatchdog(conv);
+      },
+      onThinking: (e) => onThinking(conv, e),
+      onStream: (reply, done) => onStream(conv, reply, done),
+      onMessage: (reply) => onMessage(conv, reply),
+      onUserMessage: (message) => onUserMessage(conv, message),
+    };
+  }
+
+  function onWelcome(conv: IBridleConversation, welcome: IBridleWelcome) {
+    const key = conv.key;
+    if (welcome.clientId) hubClientIds.set(key, welcome.clientId);
+    if (welcome.seq === null || welcome.seq >= lastHubSeq(key)) return;
+    // The hub counts from below what we have applied: it restarted and its
+    // replay buffer went with it. Adopt its numbering — or every frame from
+    // now on would look stale — and ask the transcript for the answer a
+    // replay can no longer bring. Only when one is owed: the last word on
+    // screen is the person's, or a turn is visibly open.
+    lastHubSeqs.set(key, welcome.seq);
+    saveHubSeqToStorage(key, welcome.seq);
+    const list = messagesFor(key);
+    const last = list[list.length - 1];
+    const owed =
+      isPending(key) ||
+      hasOpenThinking(key) ||
+      (last?.role === BridleRoleTypes.User &&
+        last.delivery !== BridleDeliveryStates.Failed);
+    if (owed) void recoverFromTranscript(conv);
+  }
+
+  /**
+   * The person's own message, sent from another tab or device. Shown as
+   * delivered — the hub only echoes what it accepted — unless this view is
+   * the one that sent it, which the id tells.
+   */
+  function onUserMessage(
+    conv: IBridleConversation,
+    e: IBridleUserMessageEvent,
+  ) {
+    const key = conv.key;
+    if (!acceptSeq(key, e.seq)) return;
+    if (findMessage(key, e.messageId)) return;
+    const attachments = e.attachments?.map((a) => ({
+      ...a,
+      url:
+        a.url ||
+        `/api/agent/${encodeURIComponent(conv.agentId)}/attachment/${a.id}`,
+    }));
+    appendMessage(conv, {
+      id: e.messageId,
+      role: BridleRoleTypes.User,
+      text: e.text.trim(),
+      ts: e.ts ?? Date.now(),
+      ...(attachments?.length ? { attachments } : {}),
+    });
+  }
+
+  /**
+   * Hold the live channel for a conversation, opening it for the first
+   * holder. Every chat showing the conversation holds it for as long as it is
+   * mounted, so one unmounting cannot pull the socket from under another
+   * (CLEAN-102, research F5). The console makes sure its bearer is not about
+   * to expire first: the hub would refuse it a moment later.
+   */
+  async function acquire(conv: IBridleConversation) {
+    const key = conv.key;
+    const held = channels.get(key);
+    if (held) {
+      held.holders++;
+      if (held.closeTimer) clearTimeout(held.closeTimer);
+      held.closeTimer = undefined;
       return;
     }
 
-    const channel = getService().openChannel(
+    // Registered before the first await, so a second holder arriving while
+    // the token is being checked joins this hold instead of opening a socket
+    // of its own.
+    const hold: IChannelHold = { channel: null, holders: 1 };
+    channels.set(key, hold);
+    connection.value[key] = BridleChannelStates.Connecting;
+    if (!conv.share) await useAuthStore().ensureFresh();
+    // Released and closed while that was in flight.
+    if (channels.get(key) !== hold) return;
+
+    hold.channel = getService().openChannel(
       conv.agentId,
-      conv.share
-        ? { share: conv.share }
-        : { token: () => useAuthStore().accessToken },
       {
-        onConnected() {
-          connection.value[key] = BridleChannelStates.Connected;
-          authRetried.delete(key);
-          // A stale "not connected" notice is answered by the reconnect itself.
-          if (errors.value[key]?.key === 'chat.error_offline') {
-            errors.value[key] = null;
-          }
-        },
-        onDisconnected() {
-          connection.value[key] = BridleChannelStates.Offline;
-          // Nothing can finish an in-flight turn on a dead socket.
-          pending.value[key] = false;
-          closeAllTurns(key);
-        },
-        onRejected: (code) => void onRejected(conv, code),
-        onMessageError(message) {
-          pending.value[key] = false;
-          errors.value[key] = {
-            key: 'chat.error_message',
-            params: { message },
-          };
-        },
-        onTyping() {
-          pending.value[key] = true;
-          armWatchdog(key);
-        },
-        onThinking: (e) => onThinking(conv, e),
-        onStream: (reply, done) => onStream(conv, reply, done),
-        onMessage: (reply) => onMessage(conv, reply),
+        ...(conv.share
+          ? { share: conv.share }
+          : { token: () => useAuthStore().accessToken }),
+        lastSeq: () => lastHubSeq(key),
       },
+      channelEvents(conv),
     );
-    channels.set(key, channel);
   }
 
-  /** Close the channel. Messages stay: they are persisted, the socket is not. */
-  function disconnect(conv: IBridleConversation) {
+  /**
+   * Let go of the channel. With holders left, nothing at all changes — not
+   * the connection state, not `pending`, not the thinking blocks: the
+   * conversation is still on someone's screen. The last release closes the
+   * socket after a grace delay, so a page-to-page handoff whose unmount runs
+   * before the next mount still reuses it. Messages stay either way: they are
+   * persisted, the socket is not.
+   */
+  function release(conv: IBridleConversation) {
     const key = conv.key;
-    channels.get(key)?.close();
-    channels.delete(key);
-    connection.value[key] = BridleChannelStates.Offline;
-    pending.value[key] = false;
-    closeAllTurns(key);
+    const held = channels.get(key);
+    if (!held) return;
+    held.holders = Math.max(0, held.holders - 1);
+    if (held.holders > 0 || held.closeTimer) return;
+    held.closeTimer = setTimeout(() => {
+      if (channels.get(key) !== held || held.holders > 0) return;
+      held.channel?.close();
+      channels.delete(key);
+      connection.value[key] = BridleChannelStates.Offline;
+      pending.value[key] = false;
+      closeAllTurns(key);
+    }, RELEASE_GRACE_MS);
   }
 
   // ── Sending ────────────────────────────────────────────────
@@ -698,21 +1030,10 @@ export const useBridleStore = defineStore('bridle', () => {
       (a) => a.state === BridleAttachmentStates.Ready && a.remoteId,
     );
 
-    if (pending.value[key]) return;
     if (!trimmed && !ready.length) return;
     // Refuse rather than silently dropping the file the message is about.
     if (isUploading(key) || hasFailedAttachment(key)) return;
 
-    const channel = channels.get(key);
-    if (!channel || connectionFor(key) !== BridleChannelStates.Connected) {
-      // The composer already cleared itself; the draft mechanism (CLEAN-72)
-      // hands the text straight back so nothing typed is lost. Staged files
-      // are left where they are.
-      if (trimmed) drafts.value[key] = trimmed;
-      errors.value[key] = { key: 'chat.error_offline' };
-      return;
-    }
-
     const attachments: IBridleAttachment[] = ready.map((a) => ({
       id: a.remoteId as string,
       name: a.name,
@@ -723,25 +1044,134 @@ export const useBridleStore = defineStore('bridle', () => {
       readableByAgent: isReadableByAgent(a.kind, a.mimeType),
     }));
 
-    appendMessage(conv, {
-      id: `u-${Date.now()}`,
+    const message: IBridleMessage = {
+      id: newMessageId(),
       role: BridleRoleTypes.User,
       text: trimmed,
       ts: Date.now(),
       ...(attachments.length ? { attachments } : {}),
-    });
+    };
+    // In the conversation — and so in localStorage — before anything can
+    // fail: what the person sent is never silently gone, only ever visibly
+    // not delivered.
+    appendMessage(conv, withDelivery(message, { type: 'sent' }));
 
     // Clear the compose area before the round trip so the person can start
     // typing the next message while the agent thinks.
     clearStaged(conv);
-    pending.value[key] = true;
     errors.value[key] = null;
-    armWatchdog(key);
+    transmit(conv, message.id);
+  }
+
+  /**
+   * Put one `sending` message on the wire and see it through to a verdict.
+   * Shared by the first send and by `resend`, which is why it takes the id:
+   * the wire `clientMessageId` IS the message id, so the hub recognises a
+   * repeat and answers `duplicate` instead of handing it to the agent twice.
+   */
+  function transmit(conv: IBridleConversation, id: string) {
+    const key = conv.key;
+    const message = findMessage(key, id);
+    if (!message) return;
+
+    const channel = channels.get(key)?.channel;
+    if (!channel || connectionFor(key) !== BridleChannelStates.Connected) {
+      // Never emit into a socket that is not there: socket.io would buffer
+      // it, and the bubble would claim a send that is not happening.
+      settle(conv, id, { type: 'ackRejected', code: FAILURE_OFFLINE });
+      return;
+    }
 
-    channel.send(
-      trimmed || EMPTY_TEXT_PLACEHOLDER,
-      attachments.length ? attachments.map((a) => a.id) : undefined,
+    pending.value[key] = true;
+    armWatchdog(conv);
+    slowTimers.set(
+      id,
+      setTimeout(() => {
+        slowTimers.delete(id);
+        applyDelivery(conv, id, { type: 'tick', elapsedMs: SLOW_MS });
+      }, SLOW_MS),
     );
+
+    void channel
+      .send(
+        message.text || EMPTY_TEXT_PLACEHOLDER,
+        message.attachments?.length
+          ? message.attachments.map((a) => a.id)
+          : undefined,
+        id,
+      )
+      .then((ack) => onAck(conv, id, ack));
+  }
+
+  function applyDelivery(
+    conv: IBridleConversation,
+    id: string,
+    event: IDeliveryEvent,
+    patch: Partial<IBridleMessage> = {},
+  ) {
+    const message = findMessage(conv.key, id);
+    // Discarded, or the conversation was reset, while the ack was on its way.
+    if (!message) return;
+    replaceMessage(conv, { ...withDelivery(message, event), ...patch });
+  }
+
+  /** A verdict is in: stop the "still sending" timer and record it. */
+  function settle(
+    conv: IBridleConversation,
+    id: string,
+    event: IDeliveryEvent,
+    patch: Partial<IBridleMessage> = {},
+  ) {
+    const timer = slowTimers.get(id);
+    if (timer) clearTimeout(timer);
+    slowTimers.delete(id);
+    applyDelivery(conv, id, event, patch);
+  }
+
+  function onAck(conv: IBridleConversation, id: string, ack: IBridleSendAck) {
+    const key = conv.key;
+    if (ack.status === 'accepted') {
+      // The hub's clock from here on, so the time under the bubble is the
+      // same live and after a replay. Display only — order stays with `seq`.
+      settle(conv, id, { type: 'ackAccepted' }, { ts: ack.ts });
+      return;
+    }
+    settle(conv, id, { type: 'ackRejected', code: ack.code });
+    // No turn will come of a message the agent never got. Leave the shimmer
+    // alone if something else is still on its way or visibly in progress.
+    const inFlight = messagesFor(key).some(
+      (m) =>
+        m.delivery === BridleDeliveryStates.Sending ||
+        m.delivery === BridleDeliveryStates.Slow,
+    );
+    if (!inFlight && !hasOpenThinking(key)) {
+      pending.value[key] = false;
+      disarmWatchdog(key);
+    }
+  }
+
+  /** Try a message that was not delivered again — same id, text and files. */
+  function resend(conv: IBridleConversation, id: string) {
+    const message = findMessage(conv.key, id);
+    if (message?.delivery !== BridleDeliveryStates.Failed) return;
+    errors.value[conv.key] = null;
+    applyDelivery(conv, id, { type: 'resend' });
+    transmit(conv, id);
+  }
+
+  /** Drop a message that was not delivered. Anything else is history. */
+  function discard(conv: IBridleConversation, id: string) {
+    const message = findMessage(conv.key, id);
+    if (message?.delivery !== BridleDeliveryStates.Failed) return;
+    removeMessage(conv, id);
+  }
+
+  function removeMessage(conv: IBridleConversation, id: string) {
+    const list = conversations.value[conv.key];
+    const index = list?.findIndex((m) => m.id === id) ?? -1;
+    if (!list || index === -1) return;
+    list.splice(index, 1);
+    persist(conv);
   }
 
   function dismissError(conv: IBridleConversation) {
@@ -750,12 +1180,20 @@ export const useBridleStore = defineStore('bridle', () => {
 
   function reset(conv: IBridleConversation) {
     clearStaged(conv);
+    for (const m of messagesFor(conv.key)) {
+      const timer = slowTimers.get(m.id);
+      if (timer) clearTimeout(timer);
+      slowTimers.delete(m.id);
+    }
     delete conversations.value[conv.key];
     delete pending.value[conv.key];
     delete errors.value[conv.key];
     delete drafts.value[conv.key];
     delete thinking.value[conv.key];
     closedTurns.delete(conv.key);
+    // `lastHubSeqs` stays: the hub keeps counting, and frames of the
+    // conversation just cleared must not be replayed into the new one.
+    nextSeqs.delete(conv.key);
     disarmWatchdog(conv.key);
     clearConversationFromStorage(conv.key);
   }
@@ -770,10 +1208,12 @@ export const useBridleStore = defineStore('bridle', () => {
     clearDraft,
     hydrate,
     sendMessage,
+    resend,
+    discard,
     reset,
     // live channel
-    connect,
-    disconnect,
+    acquire,
+    release,
     connectionFor,
     thinkingFor,
     hasOpenThinking,
diff --git a/app/slices/bridle/utils/bun-test.d.ts b/app/slices/bridle/utils/bun-test.d.ts
new file mode 100644
index 00000000..a3ac642d
--- /dev/null
+++ b/app/slices/bridle/utils/bun-test.d.ts
@@ -0,0 +1,22 @@
+/**
+ * Twin of admin/slices/bridle/utils/bun-test.d.ts.
+ *
+ * The `*.test.ts` files beside this one run under `bun test`, which ships
+ * `bun:test` itself. `nuxt typecheck` walks the same folder with no Bun types
+ * installed, and adding `@types/bun` for a handful of matchers is a dependency
+ * this slice does not need — so this declares just the surface the tests use.
+ * Delete it if `@types/bun` ever lands in app/package.json.
+ */
+declare module 'bun:test' {
+  interface IMatchers {
+    toBe(expected: unknown): void;
+    toEqual(expected: unknown): void;
+    toMatchObject(expected: Record<string, unknown>): void;
+    toHaveProperty(name: string): void;
+    not: IMatchers;
+  }
+
+  export function describe(name: string, fn: () => void): void;
+  export function test(name: string, fn: () => void | Promise<void>): void;
+  export function expect(actual: unknown): IMatchers;
+}
diff --git a/app/slices/bridle/utils/chatFlow.test.ts b/app/slices/bridle/utils/chatFlow.test.ts
new file mode 100644
index 00000000..b761975d
--- /dev/null
+++ b/app/slices/bridle/utils/chatFlow.test.ts
@@ -0,0 +1,152 @@
+import { describe, expect, test } from 'bun:test';
+import {
+  BridleRoleTypes,
+  BridleThinkingBlockStates,
+  type IBridleMessage,
+  type IBridleThinkingBlock,
+} from '../domain/bridle.types';
+import { buildChatFlow, nextSeq, numberLegacy } from './chatFlow';
+
+// Local-time constructors throughout, so the day arithmetic holds in whatever
+// timezone the test machine runs.
+const NOON = new Date(2026, 8, 18, 12, 0, 0).getTime();
+const options = { locale: 'en-US', now: NOON };
+
+function message(
+  id: string,
+  role: BridleRoleTypes,
+  ts: number,
+  seq?: number,
+): IBridleMessage {
+  return { id, role, text: id, ts, ...(seq === undefined ? {} : { seq }) };
+}
+
+function block(turnId: string, ts: number, seq?: number): IBridleThinkingBlock {
+  return {
+    turnId,
+    seg: 0,
+    steps: [],
+    state: BridleThinkingBlockStates.Done,
+    ts,
+    ...(seq === undefined ? {} : { seq }),
+  };
+}
+
+const keys = (flow: ReturnType<typeof buildChatFlow>) => flow.map((i) => i.key);
+
+describe('buildChatFlow', () => {
+  test('a reply stamped two minutes before its question still renders after it', () => {
+    // The browser clock runs ahead of the agent's: the defect behind CLEAN-102.
+    const flow = buildChatFlow(
+      [
+        message('question', BridleRoleTypes.User, NOON, 1),
+        message('answer', BridleRoleTypes.Agent, NOON - 120_000, 3),
+      ],
+      [block('turn', NOON - 121_000, 2)],
+      options,
+    );
+    expect(keys(flow)).toEqual(['question', 'turn:0', 'answer']);
+  });
+
+  test('equal ts keeps arrival order', () => {
+    const flow = buildChatFlow(
+      [
+        message('b', BridleRoleTypes.Agent, NOON, 2),
+        message('a', BridleRoleTypes.User, NOON, 1),
+        message('c', BridleRoleTypes.Agent, NOON, 3),
+      ],
+      [],
+      options,
+    );
+    expect(keys(flow)).toEqual(['a', 'b', 'c']);
+  });
+
+  test('legacy messages without seq render in stored order', () => {
+    // Stored order is the order the person saw, whatever the timestamps say.
+    const flow = buildChatFlow(
+      [
+        message('first', BridleRoleTypes.User, NOON),
+        message('second', BridleRoleTypes.Agent, NOON - 5_000),
+        message('third', BridleRoleTypes.User, NOON + 1_000),
+      ],
+      [],
+      options,
+    );
+    expect(keys(flow)).toEqual(['first', 'second', 'third']);
+    expect(flow.map((i) => i.seq)).toEqual([1, 2, 3]);
+  });
+
+  test('a conversation that happened today has no separator', () => {
+    const flow = buildChatFlow(
+      [
+        message('a', BridleRoleTypes.User, NOON - 3_600_000, 1),
+        message('b', BridleRoleTypes.Agent, NOON, 2),
+      ],
+      [],
+      options,
+    );
+    expect(flow.every((i) => i.kind === 'message')).toBe(true);
+  });
+
+  test('a day boundary between two messages inserts a separator before the later one', () => {
+    const yesterday = new Date(2026, 8, 17, 23, 50).getTime();
+    const flow = buildChatFlow(
+      [
+        message('old', BridleRoleTypes.User, yesterday, 1),
+        message('new', BridleRoleTypes.User, NOON, 3),
+      ],
+      [block('turn', NOON, 2)],
+      options,
+    );
+    // The block that led to the later message stays above the separator's
+    // message, and the separator sits directly on top of that message.
+    expect(keys(flow)).toEqual(['day:old', 'old', 'turn:0', 'day:new', 'new']);
+    const [first, , , second] = flow;
+    expect(first).toMatchObject({ kind: 'day', labelKey: 'chat.day_yesterday' });
+    expect(second).toMatchObject({
+      kind: 'day',
+      labelKey: 'chat.day_today',
+      seq: 3,
+    });
+  });
+
+  test('older days carry a date formatted for the locale', () => {
+    const old = new Date(2026, 2, 5, 9, 30).getTime();
+    const [separator] = buildChatFlow(
+      [message('old', BridleRoleTypes.User, old, 1)],
+      [],
+      options,
+    );
+    expect(separator).toMatchObject({ kind: 'day', label: 'March 5, 2026' });
+    expect(separator).not.toHaveProperty('labelKey');
+
+    const [ru] = buildChatFlow([message('old', BridleRoleTypes.User, old, 1)], [], {
+      ...options,
+      locale: 'ru',
+    });
+    expect(ru).toMatchObject({ kind: 'day', label: '5 марта 2026 г.' });
+  });
+});
+
+describe('nextSeq', () => {
+  test('starts at 1 and continues past the highest seq in use', () => {
+    expect(nextSeq([])).toBe(1);
+    expect(nextSeq([{ seq: 4 }, { seq: 9 }, {}])).toBe(10);
+  });
+});
+
+describe('numberLegacy', () => {
+  test('numbers only the items that lack a seq, after the ones that have one', () => {
+    const numbered = numberLegacy([{ id: 'a', seq: 7 }, { id: 'b' }, { id: 'c' }]);
+    expect(numbered).toEqual([
+      { id: 'a', seq: 7 },
+      { id: 'b', seq: 8 },
+      { id: 'c', seq: 9 },
+    ]);
+  });
+
+  test('leaves already numbered items as the same objects', () => {
+    const item = { id: 'a', seq: 1 };
+    expect(numberLegacy([item])[0]).toBe(item);
+  });
+});
diff --git a/app/slices/bridle/utils/chatFlow.ts b/app/slices/bridle/utils/chatFlow.ts
new file mode 100644
index 00000000..2e52de98
--- /dev/null
+++ b/app/slices/bridle/utils/chatFlow.ts
@@ -0,0 +1,159 @@
+// Twin of admin/slices/bridle/utils/chatFlow.ts — change them together.
+//
+// What the chat template iterates (CLEAN-102, research D1): messages and
+// thinking blocks in ARRIVAL order, with day separators between them. Ordered
+// by `seq` and nothing else — `ts` mixes the browser's clock with the agent's,
+// and sorting by it is what used to put an answer above its question. Pure on
+// purpose: no Vue, no Nuxt aliases, so `bun test` runs it.
+
+import type {
+  IBridleMessage,
+  IBridleThinkingBlock,
+} from '../domain/bridle.types';
+
+export interface IChatFlowOptions {
+  /** Formats the long date on a separator older than yesterday. */
+  locale: string;
+  /** "Now" in epoch ms — injected so today / yesterday are testable. */
+  now: number;
+}
+
+export interface IChatFlowMessageItem {
+  key: string;
+  seq: number;
+  kind: 'message';
+  message: IBridleMessage;
+}
+
+export interface IChatFlowBlockItem {
+  key: string;
+  seq: number;
+  kind: 'block';
+  block: IBridleThinkingBlock;
+}
+
+export interface IChatFlowDayItem {
+  key: string;
+  /** The `seq` of the message it precedes. */
+  seq: number;
+  kind: 'day';
+  ts: number;
+  /** Today / yesterday travel as a translation key (docs/i18n.md)… */
+  labelKey?: 'chat.day_today' | 'chat.day_yesterday';
+  /** …anything older as a date already formatted for the locale. */
+  label?: string;
+}
+
+export type IChatFlowItem =
+  | IChatFlowMessageItem
+  | IChatFlowBlockItem
+  | IChatFlowDayItem;
+
+/** The next free sequence number: one past the highest in use, from 1. */
+export function nextSeq(items: ReadonlyArray<{ seq?: number }>): number {
+  let max = 0;
+  for (const item of items) {
+    if (typeof item.seq === 'number' && item.seq > max) max = item.seq;
+  }
+  return max + 1;
+}
+
+/**
+ * Number the items that lack a `seq`, in array order — the order a
+ * conversation stored before CLEAN-102 was appended in, which is the order
+ * the person saw. Items that already carry one are returned untouched.
+ */
+export function numberLegacy<T extends { seq?: number }>(
+  items: readonly T[],
+): Array<T & { seq: number }> {
+  let last = 0;
+  return items.map((item) => {
+    if (typeof item.seq === 'number') {
+      last = Math.max(last, item.seq);
+      return item as T & { seq: number };
+    }
+    last += 1;
+    return { ...item, seq: last };
+  });
+}
+
+/** Local midnight of the day `ts` falls on. */
+function startOfDay(ts: number): number {
+  const d = new Date(ts);
+  return new Date(d.getFullYear(), d.getMonth(), d.getDate()).getTime();
+}
+
+function dayItem(
+  message: IBridleMessage & { seq: number },
+  options: IChatFlowOptions,
+): IChatFlowDayItem {
+  const day = startOfDay(message.ts);
+  const today = startOfDay(options.now);
+  // Through the calendar, not `today - 24h`: a DST day is not 24 hours long.
+  const t = new Date(today);
+  const yesterday = new Date(
+    t.getFullYear(),
+    t.getMonth(),
+    t.getDate() - 1,
+  ).getTime();
+
+  const base = {
+    key: `day:${message.id}`,
+    seq: message.seq,
+    kind: 'day' as const,
+    ts: message.ts,
+  };
+  if (day === today) return { ...base, labelKey: 'chat.day_today' };
+  if (day === yesterday) return { ...base, labelKey: 'chat.day_yesterday' };
+  return {
+    ...base,
+    label: new Intl.DateTimeFormat(options.locale, { dateStyle: 'long' }).format(
+      message.ts,
+    ),
+  };
+}
+
+/**
+ * Build the visible flow. A day separator goes in wherever the calendar day
+ * changes between two consecutive messages, and above the first message when
+ * the conversation did not start today — otherwise the times under an old
+ * conversation would belong to no date at all.
+ */
+export function buildChatFlow(
+  messages: readonly IBridleMessage[],
+  blocks: readonly IBridleThinkingBlock[],
+  options: IChatFlowOptions,
+): IChatFlowItem[] {
+  const items: Array<IChatFlowMessageItem | IChatFlowBlockItem> = [];
+  for (const message of numberLegacy(messages)) {
+    items.push({ key: message.id, seq: message.seq, kind: 'message', message });
+  }
+  for (const block of blocks) {
+    items.push({
+      key: `${block.turnId}:${block.seg}`,
+      // A block without a `seq` cannot come from the store; sink it to the
+      // end rather than guess a position from its agent-clock `ts`.
+      seq: block.seq ?? Number.MAX_SAFE_INTEGER,
+      kind: 'block',
+      block,
+    });
+  }
+  // Array.prototype.sort is stable: equal `seq` keeps insertion order.
+  items.sort((a, b) => a.seq - b.seq);
+
+  const flow: IChatFlowItem[] = [];
+  let previousDay: number | null = null;
+  const today = startOfDay(options.now);
+  for (const item of items) {
+    if (item.kind === 'message') {
+      const day = startOfDay(item.message.ts);
+      const changed = previousDay === null ? day !== today : day !== previousDay;
+      if (changed) {
+        flow.push(dayItem({ ...item.message, seq: item.seq }, options));
+      }
+      previousDay = day;
+    }
+    flow.push(item);
+  }
+  return flow;
+}
diff --git a/app/slices/bridle/utils/delivery.test.ts b/app/slices/bridle/utils/delivery.test.ts
new file mode 100644
index 00000000..ddc44087
--- /dev/null
+++ b/app/slices/bridle/utils/delivery.test.ts
@@ -0,0 +1,147 @@
+import { describe, expect, test } from 'bun:test';
+import { BridleDeliveryStates } from '../domain/bridle.types';
+import {
+  FAILED_MS,
+  SLOW_MS,
+  failureHintKey,
+  nextDelivery,
+} from './delivery';
+
+const { Sending, Slow, Delivered, Failed } = BridleDeliveryStates;
+
+describe('nextDelivery', () => {
+  test('sent starts a message as sending', () => {
+    expect(nextDelivery({}, { type: 'sent' })).toEqual({ delivery: Sending });
+  });
+
+  test('thresholds are the documented ones', () => {
+    expect(SLOW_MS).toBe(5000);
+    expect(FAILED_MS).toBe(30000);
+  });
+
+  test('tick below the slow threshold changes nothing', () => {
+    expect(
+      nextDelivery({ delivery: Sending }, { type: 'tick', elapsedMs: 4999 }),
+    ).toEqual({ delivery: Sending });
+  });
+
+  test('tick at 5 s turns sending into slow', () => {
+    expect(
+      nextDelivery({ delivery: Sending }, { type: 'tick', elapsedMs: SLOW_MS }),
+    ).toEqual({ delivery: Slow });
+  });
+
+  test('tick at 30 s fails sending and slow with TIMEOUT', () => {
+    for (const delivery of [Sending, Slow]) {
+      expect(
+        nextDelivery({ delivery }, { type: 'tick', elapsedMs: FAILED_MS }),
+      ).toEqual({ delivery: Failed, failureCode: 'TIMEOUT' });
+    }
+  });
+
+  test('a late tick never touches a settled message', () => {
+    expect(
+      nextDelivery({ delivery: Delivered }, { type: 'tick', elapsedMs: 60000 }),
+    ).toEqual({ delivery: Delivered });
+    expect(
+      nextDelivery(
+        { delivery: Failed, failureCode: 'AGENT_OFFLINE' },
+        { type: 'tick', elapsedMs: 60000 },
+      ),
+    ).toEqual({ delivery: Failed, failureCode: 'AGENT_OFFLINE' });
+  });
+
+  test('ackAccepted delivers from sending and from slow', () => {
+    for (const delivery of [Sending, Slow]) {
+      expect(nextDelivery({ delivery }, { type: 'ackAccepted' })).toEqual({
+        delivery: Delivered,
+      });
+    }
+  });
+
+  test('a late ackAccepted moves failed to delivered and drops the code', () => {
+    expect(
+      nextDelivery(
+        { delivery: Failed, failureCode: 'TIMEOUT' },
+        { type: 'ackAccepted' },
+      ),
+    ).toEqual({ delivery: Delivered });
+  });
+
+  test('ackRejected fails an in-flight message with the hub code', () => {
+    for (const delivery of [Sending, Slow]) {
+      expect(
+        nextDelivery({ delivery }, { type: 'ackRejected', code: 'AGENT_OFFLINE' }),
+      ).toEqual({ delivery: Failed, failureCode: 'AGENT_OFFLINE' });
+    }
+  });
+
+  test('ackRejected never un-delivers a message', () => {
+    expect(
+      nextDelivery(
+        { delivery: Delivered },
+        { type: 'ackRejected', code: 'TIMEOUT' },
+      ),
+    ).toEqual({ delivery: Delivered });
+  });
+
+  test('pageLoad fails what was still in flight', () => {
+    for (const delivery of [Sending, Slow]) {
+      expect(nextDelivery({ delivery }, { type: 'pageLoad' })).toEqual({
+        delivery: Failed,
+        failureCode: 'TIMEOUT',
+      });
+    }
+  });
+
+  test('pageLoad keeps delivered, failed and legacy messages as they are', () => {
+    expect(nextDelivery({ delivery: Delivered }, { type: 'pageLoad' })).toEqual({
+      delivery: Delivered,
+    });
+    expect(
+      nextDelivery(
+        { delivery: Failed, failureCode: 'OFFLINE' },
+        { type: 'pageLoad' },
+      ),
+    ).toEqual({ delivery: Failed, failureCode: 'OFFLINE' });
+    // No `delivery` at all: stored before CLEAN-102, which means delivered.
+    expect(nextDelivery({}, { type: 'pageLoad' })).toEqual({
+      delivery: Delivered,
+    });
+  });
+
+  test('resend puts a failed message back in flight and drops the code', () => {
+    expect(
+      nextDelivery(
+        { delivery: Failed, failureCode: 'AGENT_OFFLINE' },
+        { type: 'resend' },
+      ),
+    ).toEqual({ delivery: Sending });
+  });
+
+  test('resend is refused for anything that has not failed', () => {
+    for (const delivery of [Sending, Slow, Delivered]) {
+      expect(nextDelivery({ delivery }, { type: 'resend' })).toEqual({
+        delivery,
+      });
+    }
+  });
+});
+
+describe('failureHintKey', () => {
+  test('known codes have wording of their own', () => {
+    expect(failureHintKey('AGENT_OFFLINE')).toBe(
+      'chat.not_delivered_agent_offline',
+    );
+    expect(failureHintKey('OFFLINE')).toBe('chat.not_delivered_offline');
+    expect(failureHintKey('TIMEOUT')).toBe('chat.not_delivered_timeout');
+    expect(failureHintKey('ATTACHMENT_FAILED')).toBe(
+      'chat.not_delivered_attachment_failed',
+    );
+  });
+
+  test('anything else falls back to the general hint', () => {
+    expect(failureHintKey('SHARE_REJECTED')).toBe('chat.not_delivered_hint');
+    expect(failureHintKey(undefined)).toBe('chat.not_delivered_hint');
+  });
+});
diff --git a/app/slices/bridle/utils/delivery.ts b/app/slices/bridle/utils/delivery.ts
new file mode 100644
index 00000000..83d2c06b
--- /dev/null
+++ b/app/slices/bridle/utils/delivery.ts
@@ -0,0 +1,119 @@
+// Twin of admin/slices/bridle/utils/delivery.ts — change them together.
+//
+// The delivery state machine for the person's own messages (CLEAN-102,
+// specs/015-chat-message-reliability/data-model.md). Pure on purpose: no Vue,
+// no Nuxt aliases, so `bun test` runs it and the store only has to feed it
+// events.
+
+import { BridleDeliveryStates } from '../domain/bridle.types';
+
+/** Without an ack for this long the bubble says it is still trying. */
+export const SLOW_MS = 5000;
+/** Without an ack for this long the message counts as not delivered. */
+export const FAILED_MS = 30000;
+
+/** Set by the client itself; every other code comes from the hub's ack. */
+export const FAILURE_TIMEOUT = 'TIMEOUT';
+export const FAILURE_OFFLINE = 'OFFLINE';
+
+export interface IDeliveryState {
+  /** Absent means delivered — messages stored before CLEAN-102 have none. */
+  delivery?: BridleDeliveryStates;
+  failureCode?: string;
+}
+
+/** What the reducer hands back: the state is always named, never implied. */
+export interface IDeliveryResult {
+  delivery: BridleDeliveryStates;
+  failureCode?: string;
+}
+
+export type IDeliveryEvent =
+  | { type: 'sent' }
+  | { type: 'tick'; elapsedMs: number }
+  | { type: 'ackAccepted' }
+  | { type: 'ackRejected'; code: string }
+  | { type: 'pageLoad' }
+  | { type: 'resend' };
+
+function isInFlight(delivery: BridleDeliveryStates): boolean {
+  return (
+    delivery === BridleDeliveryStates.Sending ||
+    delivery === BridleDeliveryStates.Slow
+  );
+}
+
+/**
+ * The next state of one message. An event that does not apply to the current
+ * state returns the state unchanged, so a late timer or a stray ack can never
+ * move a message backwards.
+ */
+export function nextDelivery(
+  state: IDeliveryState,
+  event: IDeliveryEvent,
+): IDeliveryResult {
+  const delivery = state.delivery ?? BridleDeliveryStates.Delivered;
+  const same: IDeliveryResult = {
+    delivery,
+    ...(state.failureCode ? { failureCode: state.failureCode } : {}),
+  };
+
+  switch (event.type) {
+    case 'sent':
+      return { delivery: BridleDeliveryStates.Sending };
+
+    case 'tick':
+      if (!isInFlight(delivery)) return same;
+      if (event.elapsedMs >= FAILED_MS) {
+        return {
+          delivery: BridleDeliveryStates.Failed,
+          failureCode: FAILURE_TIMEOUT,
+        };
+      }
+      if (event.elapsedMs >= SLOW_MS) {
+        return { delivery: BridleDeliveryStates.Slow };
+      }
+      return same;
+
+    case 'ackAccepted':
+      // Also from `failed`: an ack that outlived our patience still means the
+      // agent has the message, and saying otherwise would invite a duplicate.
+      return { delivery: BridleDeliveryStates.Delivered };
+
+    case 'ackRejected':
+      if (delivery === BridleDeliveryStates.Delivered) return same;
+      return { delivery: BridleDeliveryStates.Failed, failureCode: event.code };
+
+    case 'pageLoad':
+      // The ack was owed to a socket that no longer exists.
+      if (!isInFlight(delivery)) return same;
+      return {
+        delivery: BridleDeliveryStates.Failed,
+        failureCode: FAILURE_TIMEOUT,
+      };
+
+    case 'resend':
+      if (delivery !== BridleDeliveryStates.Failed) return same;
+      return { delivery: BridleDeliveryStates.Sending };
+  }
+}
+
+/**
+ * The line explaining a failed message, as a translation key — copy decided
+ * in script travels as a key (docs/i18n.md). Codes without wording of their
+ * own fall back to the general hint.
+ */
+export function failureHintKey(code: string | undefined): string {
+  switch (code) {
+    case 'AGENT_OFFLINE':
+      return 'chat.not_delivered_agent_offline';
+    case FAILURE_OFFLINE:
+      return 'chat.not_delivered_offline';
+    case FAILURE_TIMEOUT:
+      return 'chat.not_delivered_timeout';
+    case 'ATTACHMENT_FAILED':
+      return 'chat.not_delivered_attachment_failed';
+    default:
+      return 'chat.not_delivered_hint';
+  }
+}
diff --git a/app/slices/bridle/utils/transcriptTail.test.ts b/app/slices/bridle/utils/transcriptTail.test.ts
new file mode 100644
index 00000000..26e81b79
--- /dev/null
+++ b/app/slices/bridle/utils/transcriptTail.test.ts
@@ -0,0 +1,118 @@
+import { describe, expect, test } from 'bun:test';
+import {
+  BridleDeliveryStates,
+  BridleRoleTypes,
+  type IBridleMessage,
+} from '../domain/bridle.types';
+import { missedReplies } from './transcriptTail';
+
+const user = (id: string, text: string, ts = 0): IBridleMessage => ({
+  id,
+  role: BridleRoleTypes.User,
+  text,
+  ts,
+});
+const agent = (id: string, text: string, ts = 0): IBridleMessage => ({
+  id,
+  role: BridleRoleTypes.Agent,
+  text,
+  ts,
+});
+
+describe('missedReplies', () => {
+  test('returns the answer the screen never received', () => {
+    const missed = missedReplies(
+      [user('u1', 'hello'), agent('a1', 'hi'), user('u2', 'and the report?')],
+      [
+        user('t1', 'hello'),
+        agent('t2', 'hi'),
+        user('t3', 'and the report?'),
+        agent('t4', 'Here it is.'),
+      ],
+    );
+    expect(missed.map((m) => m.id)).toEqual(['t4']);
+  });
+
+  test('ignores clocks: an answer stamped before the question is still news', () => {
+    // Browser two minutes ahead of the agent — the skew behind CLEAN-102.
+    const missed = missedReplies(
+      [user('u1', 'ping', 1_000_000)],
+      [user('t1', 'ping', 880_000), agent('t2', 'pong', 881_000)],
+    );
+    expect(missed.map((m) => m.id)).toEqual(['t2']);
+  });
+
+  test('nothing when the transcript has no answer after the question', () => {
+    expect(
+      missedReplies([user('u1', 'ping')], [user('t1', 'ping')]),
+    ).toEqual([]);
+  });
+
+  test('nothing when the question is not in the tail at all', () => {
+    expect(
+      missedReplies(
+        [user('u1', 'ping')],
+        [user('t1', 'something else'), agent('t2', 'an old answer')],
+      ),
+    ).toEqual([]);
+  });
+
+  test('nothing for an empty screen', () => {
+    expect(missedReplies([], [agent('t1', 'hello')])).toEqual([]);
+  });
+
+  test('a question that failed to send does not anchor the search', () => {
+    const missed = missedReplies(
+      [
+        user('u1', 'first'),
+        {
+          ...user('u2', 'never left the browser'),
+          delivery: BridleDeliveryStates.Failed,
+        },
+      ],
+      [user('t1', 'first'), agent('t2', 'answer to first')],
+    );
+    expect(missed.map((m) => m.id)).toEqual(['t2']);
+  });
+
+  test('an answer already on screen is not added again, whitespace aside', () => {
+    expect(
+      missedReplies(
+        [user('u1', 'ping'), agent('a1', 'pong\n')],
+        [user('t1', 'ping'), agent('t2', ' pong')],
+      ),
+    ).toEqual([]);
+  });
+
+  test('a fused turn that starts with what is on screen is not news', () => {
+    // Live: two bubbles. Transcript: one event with both glued together.
+    expect(
+      missedReplies(
+        [user('u1', 'ping'), agent('a1', 'Let me check:'), agent('a2', 'Pong!')],
+        [user('t1', 'ping'), agent('t2', 'Let me check:Pong!')],
+      ),
+    ).toEqual([]);
+  });
+
+  test('the same wording earlier in the conversation does not hide a new answer', () => {
+    const missed = missedReplies(
+      [user('u1', 'save it'), agent('a1', 'Done.'), user('u2', 'and this one')],
+      [
+        user('t1', 'save it'),
+        agent('t2', 'Done.'),
+        user('t3', 'and this one'),
+        agent('t4', 'Done.'),
+      ],
+    );
+    expect(missed.map((m) => m.id)).toEqual(['t4']);
+  });
+
+  test('a transcript event whose id is already on screen is skipped', () => {
+    expect(
+      missedReplies(
+        [user('u1', 'ping'), agent('same-id', 'pong (edited)')],
+        [user('t1', 'ping'), agent('same-id', 'pong')],
+      ),
+    ).toEqual([]);
+  });
+});
diff --git a/app/slices/bridle/utils/transcriptTail.ts b/app/slices/bridle/utils/transcriptTail.ts
new file mode 100644
index 00000000..5a8be7cf
--- /dev/null
+++ b/app/slices/bridle/utils/transcriptTail.ts
@@ -0,0 +1,70 @@
+// The safety net behind the live channel (CLEAN-102, research D5): when a turn
+// goes silent, the agent's own transcript is asked what it answered. Pure on
+// purpose: no Vue, no Nuxt aliases, so `bun test` runs it.
+
+import {
+  BridleDeliveryStates,
+  BridleRoleTypes,
+  type IBridleMessage,
+} from '../domain/bridle.types';
+
+/** Whitespace-blind, so a trimmed or re-wrapped copy still compares equal. */
+function squash(text: string): string {
+  return text.replace(/\s+/g, '');
+}
+
+/**
+ * The agent messages in a transcript tail (oldest first, as the API returns
+ * it) that the screen is missing: whatever the transcript holds after the
+ * person's last question and the screen does not show yet.
+ *
+ * Nothing here compares timestamps or ids, deliberately. The screen mixes the
+ * browser's clock with the agent's, and the runtime stores ids of its own,
+ * unrelated to the wire `messageId` (research E2) — so the question is found
+ * by its text and "newer" means "after it in the file". And until the runtime
+ * persists one event per message (tasks T043) a whole turn is ONE transcript
+ * event with its messages glued together: an event that starts with an answer
+ * already on screen for this turn is that turn again, not news.
+ */
+export function missedReplies(
+  onScreen: readonly IBridleMessage[],
+  tail: readonly IBridleMessage[],
+): IBridleMessage[] {
+  // A question that never left this browser is in no transcript.
+  let asked = -1;
+  onScreen.forEach((m, i) => {
+    if (
+      m.role === BridleRoleTypes.User &&
+      m.delivery !== BridleDeliveryStates.Failed
+    ) {
+      asked = i;
+    }
+  });
+  const question = onScreen[asked];
+  if (!question) return [];
+
+  const wanted = squash(question.text);
+  let anchor = -1;
+  tail.forEach((m, i) => {
+    if (m.role === BridleRoleTypes.User && squash(m.text) === wanted) anchor = i;
+  });
+  // Not in the tail: the agent never wrote the question down, or it is older
+  // than this page — either way nothing after it can be trusted to be news.
+  if (anchor === -1) return [];
+
+  const ids = new Set(onScreen.map((m) => m.id));
+  // Only what arrived for THIS question counts as shown: an agent that says
+  // "Done." twice in one conversation said it twice.
+  const answers = onScreen
+    .slice(asked + 1)
+    .filter((m) => m.role === BridleRoleTypes.Agent && squash(m.text));
+  const shown = new Set(answers.map((m) => squash(m.text)));
+  const turnPrefix = answers[0] ? squash(answers[0].text) : null;
+
+  return tail.slice(anchor + 1).filter((m) => {
+    if (m.role !== BridleRoleTypes.Agent) return false;
+    const text = squash(m.text);
+    if (!text || ids.has(m.id) || shown.has(text)) return false;
+    return !(turnPrefix && text.startsWith(turnPrefix));
+  });
+}
diff --git a/docs/state.md b/docs/state.md
new file mode 100644
index 00000000..9430b88e
--- /dev/null
+++ b/docs/state.md
@@ -0,0 +1,92 @@
+# Client state: one record per entity
+
+Applies to `admin/` and `app/`.
+
+## The one rule that explains the rest
+
+**An entity lives once, in its Pinia store. Everything on screen is a view of
+that record.**
+
+The defect this rule exists for: the agents screen showed one agent as
+"Deploying" in the left list and "Failed" in its own header, on the same page.
+Nothing was wrong with either request. The list rendered the array one
+`useAsyncData` call returned, the header rendered the object another one
+returned, a status stream fed a third copy, and an optimistic flip edited a
+fourth. Four copies of one agent, each free to move on without the others.
+Refreshing one of them more often does not fix that; having one does.
+
+## The rules
+
+1. **Fetches upsert.** A list fetch replaces the store's collection; any call
+   that returns a single entity (`fetchById`, create, update, restart, …)
+   upserts it by id before returning. No store action hands back an entity it
+   did not also store.
+2. **Pushes patch the same record.** A stream, socket or poll writes into the
+   store's record. It never keeps a map of its own "fresher" copies for
+   components to prefer — that is a second source of truth with a nicer name.
+3. **Components render by id.** `computed(() => store.byId(id))`, or the
+   store's collection through `storeToRefs`. Never the value a fetch returned.
+4. **`useAsyncData` is for loading state, not a render source.** Keep it for
+   `pending` / `error` / `refresh`; ignore its `data`.
+5. **Optimistic changes go through a store action with rollback.**
+   `const rollback = store.patch(id, { … })`, and `rollback()` when the call
+   fails. Never `localRef.value = { ...localRef.value, … }` in a component or
+   composable.
+6. **One fact, one derivation.** If a label is computed from the record (a
+   display status, a tone), compute it the same way everywhere or in one shared
+   place. A row that overlays pod state on the status and a header that does
+   not will disagree even when they read the same record.
+
+## Worked example: the agent store
+
+`admin/slices/agent/agent/stores/agent.ts` (the app's
+`app/slices/agent/stores/agent.ts` has the same three functions):
+
+```ts
+byId(id): IAgentData | undefined          // lookup; reactive inside a computed
+upsert(agent): IAgentData                 // full record in, replaces or appends
+patch(id, partial): () => void            // partial change, returns a rollback
+```
+
+- `fetchAll` replaces `agents`; `fetchById`, `fetchAdmin`, `create`, `update`,
+  `restart`, `stop`, `start`, `demoteAdmin` upsert.
+- `restart` / `stop` / `start` flip the status with `patch` before the request
+  and roll back if it throws — callers (`useAgentLifecycle`, the app's chat
+  header) do not flip anything themselves. The rollback restores a field only
+  if it still holds the optimistic value, so a fresher server write that
+  landed in between survives.
+- The status stream (`stores/agentStatus.ts`) upserts the agent row each frame
+  carries into this store and keeps only what exists nowhere else: pod state
+  and hub connectivity. Its frames carry the full `AgentDto` and are decoded
+  by the same `AgentMapper` as REST responses, so a frame can never thin out a
+  record.
+- The rail (`workspace/Provider.vue`), the header (`workspace/Main.vue`), the
+  Overview card, the edit page and the Files tab all read `agentStore.agents`
+  / `agentStore.byId(id)`.
+
+In code:
+
+```ts
+// loading state from the request, content from the store
+const { pending, refresh } = useAsyncData(`admin-agent-${props.id}`, () =>
+  agentStore.fetchById(props.id),
+);
+const agent = computed(() => agentStore.byId(props.id));
+```
+
+A projection for a different audience is a different collection, not a second
+copy: the app's `publicAgents` (landing-page cards from `GET /agents/public`)
+stays separate from `agents` on purpose.
+
+The chat conversation record in the bridle stores follows the same rule: one
+conversation per key in the store, written to by the socket and rendered by
+key.
+
+## Review checklist
+
+- Does the template read `data` from `useAsyncData` / `useFetch`? Render from
+  the store instead.
+- Does a store action return an entity without storing it?
+- Is there a `live…` / `fresh…` / `current…` ref next to a store that already
+  holds that entity?
+- Does anything assign to a local copy of an entity to "update" it?
diff --git a/package.json b/package.json
index 2a7abb97..716a3b2d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ranch",
-  "version": "0.3.55",
+  "version": "0.3.56",
   "private": true,
   "packageManager": "bun@1.2.12",
   "workspaces": [
diff --git a/specs/015-chat-message-reliability/checklists/requirements.md b/specs/015-chat-message-reliability/checklists/requirements.md
new file mode 100644
index 00000000..89669ca3
--- /dev/null
+++ b/specs/015-chat-message-reliability/checklists/requirements.md
@@ -0,0 +1,43 @@
+# Specification Quality Checklist: Chat message reliability
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning
+**Created**: 2026-09-18
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- Validated in one pass on 2026-09-18; no items failed.
+- No [NEEDS CLARIFICATION] markers were used. The choices that could have been questions
+  were settled as documented defaults under Assumptions and are the ones most worth a
+  second look in `/speckit-clarify`: the slow / not-delivered thresholds (5 s / 30 s),
+  unsent messages kept per device with manual resend only, and no retroactive repair of
+  conversations already saved with fused agent messages.
+- The spec names product surfaces (admin panel, app console, home page) and refers to
+  the screenshots; these are scope and evidence, not implementation.
+- Every reported failure is intermittent and none has been reproduced yet. The
+  Assumptions section says so; reproduction is the first job of `/speckit-plan`.
diff --git a/specs/015-chat-message-reliability/contracts/bridle-socket.md b/specs/015-chat-message-reliability/contracts/bridle-socket.md
new file mode 100644
index 00000000..88f06124
--- /dev/null
+++ b/specs/015-chat-message-reliability/contracts/bridle-socket.md
@@ -0,0 +1,147 @@
+# Contract: browser ↔ hub socket protocol (additive changes)
+
+Namespace and events as handled by
+`api/src/slices/bridle/handlers/bridleClientWs.handler.ts`. **Every change is optional
+and additive**: a client that sends none of the new fields and passes no ack callback —
+the embed widget, an old cached bundle — gets exactly today's behaviour.
+
+## Handshake `auth`
+
+| Field | Type | Status | Meaning |
+|-------|------|--------|---------|
+| `token` / share fields / `capabilities` / `prompt` | — | unchanged | |
+| `lastSeq` | number | **new, optional** | Highest hub `seq` this client has applied for this agent. When present, the hub replays buffered events with `seq > lastSeq`, in order, immediately after `welcome` and before any live event. Absent or `0`: no replay (first connect). |
+
+## `welcome` (hub → browser)
+
+`{ clientId }` → `{ clientId, seq }` where `seq` is the hub's current sequence for this
+client. **New, optional to read.** A client whose `lastSeq` is greater than `seq` (the
+hub restarted and lost its buffer) resets its `lastSeq` to `seq` and runs the transcript
+reconcile instead of waiting for a replay.
+
+## `message` (browser → hub)
+
+```ts
+{
+  text?: string
+  parts?: BridlePart[]
+  images?: Array<{ base64: string; mediaType: string }>
+  attachmentIds?: string[]
+  clientMessageId?: string   // NEW, optional — UUID minted by the browser
+}
+```
+
+**Acknowledgement (NEW, optional)** — when the browser passes a socket.io ack callback,
+the hub calls it exactly once:
+
+```ts
+| { status: 'accepted'; messageId: string; ts: number; duplicate?: true }
+| { status: 'rejected'; code: 'AGENT_OFFLINE' | 'ATTACHMENT_FAILED' | 'SHARE_REJECTED' | 'EMPTY'; message?: string }
+```
+
+Rules:
+
+1. `accepted` is sent after the message has been handed to a connected agent socket.
+   `messageId` equals `clientMessageId` when one was supplied, otherwise the id the hub
+   minted. `ts` is the hub's clock at acceptance.
+2. The hub forwards `clientMessageId` to the agent as the message's `messageId`
+   (today: a hub-minted UUID).
+3. **Idempotency**: a `clientMessageId` already accepted from the same client within the
+   last 10 minutes is answered `accepted` with `duplicate: true` and is **not** forwarded
+   again.
+4. **Agent offline**: with an ack callback → `rejected / AGENT_OFFLINE`, and the
+   synthetic "Agent is not connected. Please try again later." agent message is **not**
+   sent. Without an ack callback → today's synthetic message, unchanged.
+5. **Attachment failure**: with an ack callback → `rejected / ATTACHMENT_FAILED` *and*
+   the existing `message_error` event (kept for the composer-level notice). Without →
+   `message_error` only, unchanged.
+6. **Share link rejected**: `rejected / SHARE_REJECTED`, then the existing
+   `bridle_error` + disconnect, unchanged.
+7. The browser treats a missing ack after 30 s as `failed / TIMEOUT`. A late ack for a
+   message already marked failed moves it to delivered.
+
+## Events hub → browser (`message`, `stream`, `stream_end`, `typing`, `thinking`, `debug`, `agent_status`, `message_error`)
+
+Each payload gains **`seq: number`** (new; per client, strictly increasing, assigned by
+the hub when it routes the event). Payloads are otherwise unchanged. Old clients ignore
+it.
+
+Browser rules:
+
+- Remember the highest `seq` applied per conversation (`lastSeq`), in memory and, for
+  the app, alongside the persisted conversation.
+- Ignore an event whose `seq` is not greater than `lastSeq` (replay overlap is harmless).
+- Applying a replayed `stream` / `stream_end` for a `messageId` already on screen updates
+  that bubble; it never adds a second one (unchanged rule, now relied upon).
+
+## Several sockets per identity (NEW behaviour)
+
+Today the hub holds one socket per `clientId:agentId` and a new connection silently
+replaces the previous one (every Owner/Admin has `clientId = "admin"`). New rule:
+
+- Any number of sockets may be registered for one identity. Every hub → browser event for
+  that identity is sent to **all** of them, with the same `seq`.
+- Each socket reports its own `lastSeq` and gets its own replay.
+- Disconnecting one socket does not affect the others; per-identity turn tracking is
+  cleared when the last socket leaves.
+- **`user_message` (hub → browser, NEW)**: when a socket's `message` is accepted, the hub
+  sends `{ type: 'user_message', messageId, text, attachments?, ts, seq }` to the
+  identity's **other** sockets, so a second view shows the question and not only the
+  answer. Clients ignore a `user_message` whose `messageId` they already hold. Old
+  clients ignore the unknown event.
+
+## Buffering guarantees (hub)
+
+- Events addressed to a client are buffered even while no socket is registered for it.
+- Bounds: last 500 events or 10 minutes per client; whichever is hit first evicts the
+  oldest. Buffer and sequence are dropped after 10 minutes without a registered socket.
+- In-memory only: a hub restart loses buffers; clients detect it via `welcome.seq` and
+  fall back to the transcript.
+
+## HTTP
+
+No new routes. `GET /api/agent/:agentId/transcript` (existing, used by the admin) is
+additionally called by the app console for the watchdog safety net, through a new method
+on the app's bridle gateway using the generated SDK. Response shape unchanged; equal
+`ts` values are returned in file order.
+
+## As implemented (2026-09-18) — where the code refines the text above
+
+- **Who gets an ack.** The handler returns the ack from `handleMessage`; Nest passes it
+  to the socket.io callback when there is one. "The caller renders the outcome itself"
+  is keyed on **`clientMessageId` being present**, not on detecting a callback: a
+  message with an id is acknowledged truthfully and never gets the synthetic "Agent is
+  not connected" reply; a message without one (embed widget, old bundles) behaves as
+  before.
+- **Which events carry `seq`.** Everything routed to a conversation: `message`,
+  `stream`, `stream_end`, `typing`, `thinking`, `user_message`, and API-originated
+  steps sent through `sendToClient`. **Not** `agent_status`, `debug`, `welcome`,
+  `message_error`, `bridle_error` — those are state or per-socket notices, sent
+  unnumbered and never replayed. Clients must ignore the `seq` rule for events without
+  one.
+- **`seq` is seeded from the hub's clock** when a conversation is first seen, then
+  incremented by one per event. After an API restart the new numbers are therefore
+  still above any `lastSeq` a browser kept, and its catch-up returns the new buffer.
+  `welcome.seq` lower than `lastSeq` can still happen (first connect to a hub that has
+  never seen the conversation reports `0`); clients treat that as "nothing to replay".
+- **Streamed frames are coalesced in the buffer**: a `stream` frame carries the whole
+  text so far, so only the newest one per `messageId` is kept for replay.
+- **`user_message`** is sent to the conversation's other sockets for every accepted
+  message, including ones that arrived over HTTP (`sendAndAwait`), and is buffered like
+  any other event; the sending socket recognises its own on replay by `messageId`.
+
+## Agent ↔ hub — `CleanSlice/runtime` (branch `fix/CLEAN-102-transcript-per-message`)
+
+The model-facing history must not change shape (four LLM providers build prompts from
+it), so the turn is still **one** `assistant` event whose `data.text` is the whole turn.
+What changed:
+
+- The `assistant` event gains display-only **`data.messages: [{ id, text, ts }]`** — the
+  bubbles the turn was streamed as, `id` being the wire `messageId`. The API's transcript
+  reader replays those instead of `data.text`; an event without them, or with a malformed
+  array, is replayed whole as before.
+- On the `bridle` channel the `user` event's `id` is the incoming `messageId` — which is
+  the browser's `clientMessageId` — so a reload can match a bubble with its saved copy.
+
+Still desirable, not done: a `persisted` acknowledgement to the hub once the user event
+is written, so "delivered" can mean "saved" rather than "handed over".
diff --git a/specs/015-chat-message-reliability/data-model.md b/specs/015-chat-message-reliability/data-model.md
new file mode 100644
index 00000000..7ab3ca9e
--- /dev/null
+++ b/specs/015-chat-message-reliability/data-model.md
@@ -0,0 +1,104 @@
+# Data Model: Chat message reliability
+
+No database entity changes. Everything below is client-side view state, browser storage,
+or in-memory hub state. Names are the intended TypeScript shapes; the app uses the
+`IBridle*` naming of `app/slices/bridle/domain/bridle.types.ts`, the admin mirrors them
+in its store file.
+
+## Message (client)
+
+Extends today's `IBridleMessage` / `IBridleMessageData`. New fields are optional so that
+conversations already stored in `localStorage` still load.
+
+| Field | Type | Notes |
+|-------|------|-------|
+| `id` | string | Person's message: the `clientMessageId` (UUID) generated at send. Agent message: the wire `messageId`. Replayed message: the transcript event id. One id per message end to end (research F7). |
+| `role` | user \| agent | unchanged |
+| `text`, `attachments` / `parts` | — | unchanged |
+| `ts` | number (epoch ms) | **Display only.** Local send time until the ack returns the hub's `ts`, then that value. Never used for ordering. |
+| `seq` | number | Per-conversation arrival sequence, assigned by the store on append. The only ordering key. |
+| `delivery` | `sending` \| `slow` \| `delivered` \| `failed` | Person's messages only. Absent means delivered (legacy and replayed messages). |
+| `failureCode` | string? | `AGENT_OFFLINE`, `TIMEOUT`, `ATTACHMENT_FAILED`, `SHARE_REJECTED`, `OFFLINE`. Drives the wording under the bubble. |
+| `streaming` | boolean? | unchanged; never persisted |
+
+**Validation**: `seq` is strictly increasing within a conversation. A message with
+`delivery` other than `delivered` always has `role = user`.
+
+**Migration of stored conversations (app)**: on hydrate, messages without `seq` are
+numbered in stored array order; messages without `delivery` are treated as delivered.
+
+## Delivery state machine
+
+```text
+            send()                 5 s without ack            30 s without ack
+  (none) ──────────► sending ───────────────────► slow ─────────────────────► failed
+                        │                          │                            │ ▲
+                        │ ack accepted             │ ack accepted               │ │ resend()  (same id)
+                        ▼                          ▼                            ▼ │
+                    delivered ◄────────────────────┘                         sending
+                        ▲
+                        │ ack rejected / message_error ──► failed (with failureCode)
+```
+
+- A page load turns every persisted `sending` / `slow` into `failed` (`TIMEOUT`): the
+  ack can no longer arrive on a socket that no longer exists.
+- `discard()` removes a `failed` message from the conversation and the outbox.
+- Thresholds (`SLOW_MS = 5000`, `FAILED_MS = 30000`) live in `utils/delivery.ts`.
+
+## Thinking block (client)
+
+Unchanged except: gains `seq` (assigned when the segment opens) and is ordered by it.
+The `ts` anchor workaround `Math.max(e.ts, lastTs + 1)` is removed.
+
+## Flow item (view)
+
+What the template iterates: `{ key, seq, kind: 'message' | 'block' | 'day', … }`,
+produced by the pure `buildChatFlow(messages, blocks, locale)` in `utils/chatFlow.ts`,
+sorted by `seq`. A `day` separator is inserted where the calendar day of `ts` changes
+between two consecutive messages (it takes the `seq` of the message it precedes).
+
+## Outbox (browser storage)
+
+- **App**: no separate structure — the persisted conversation
+  (`bridle:conversation:<key>`) already holds the person's messages; `delivery` and
+  `failureCode` ride along.
+- **Admin**: `localStorage["bridle:outbox:<agentId>:<channel>"]` = array of person's
+  messages whose `delivery !== 'delivered'`, without image bytes (attachment references
+  only). Merged under the loaded transcript; an entry is dropped once its id is present
+  in the transcript (interim fallback: same text within ±2 min — research D3).
+
+## Conversation (admin store)
+
+The admin store's single `messages` / `thinkingBlocks` / socket become a record keyed by
+conversation (`<agentId>:<channel>`), mirroring the app store:
+
+| State | Scope |
+|-------|-------|
+| `messages`, `thinkingBlocks`, `closedTurns`, `nextSeq`, `lastHubSeq` | per conversation |
+| `isTyping`, `isConnected`, `isAgentConnected`, transcript cursor | per conversation |
+| socket | per conversation |
+| `markdownEnabled`, panel open/closed | global (unchanged) |
+
+## Channel ownership (app store)
+
+`channels: Map<key, { channel, holders: number, closeTimer? }>`. `acquire(conv)`
+increments (and cancels a pending close); `release(conv)` decrements and, at zero,
+schedules the close after a short grace delay so a route change reuses the socket.
+
+## Hub state (API, in memory)
+
+| Structure | Key | Contents | Bounds |
+|-----------|-----|----------|--------|
+| `outSeq` | clientKey (`clientId:agentId`) | last sequence number issued | — |
+| `replay` | clientKey | ring buffer of `{ seq, event }` routed to that client, kept whether or not a socket is registered | 500 events **or** 10 min, evicted with the client's other state after 10 min idle |
+| `seenMessageIds` | clientKey | `clientMessageId → acceptedAt` | 10 min TTL, max 200 per client |
+
+Registering a client no longer resets these; unregistering keeps them for the idle
+window so a reconnect can catch up.
+
+## Transcript message (API read model)
+
+`TranscriptMessage` is unchanged in shape. Behavioural changes: equal `ts` values keep
+file (append) order; one `assistant` event per emitted message is the expected runtime
+format going forward (research D6). Older single-event turns keep rendering as one
+bubble.
diff --git a/specs/015-chat-message-reliability/e2e/chat.mjs b/specs/015-chat-message-reliability/e2e/chat.mjs
new file mode 100644
index 00000000..0daf30f9
--- /dev/null
+++ b/specs/015-chat-message-reliability/e2e/chat.mjs
@@ -0,0 +1,144 @@
+// CLEAN-102 browser check: order under clock skew, delivery state, time, scroll, reload.
+//   node chat.mjs admin|app
+import { launch, newPage, login, ADMIN, APP, AGENT, sleep } from './lib.mjs';
+
+const which = process.argv[2] || 'admin';
+const base = which === 'admin' ? ADMIN : APP;
+const SKEW = 120_000;
+
+const results = [];
+const check = (name, ok, detail = '') => {
+  results.push({ name, ok });
+  console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? '  — ' + detail : ''}`);
+};
+
+const bubbles = (page) =>
+  page.$$eval('[data-message-id]', (els) =>
+    els.map((el) => ({
+      id: el.getAttribute('data-message-id'),
+      role: el.getAttribute('data-role'),
+      delivery: el.getAttribute('data-delivery'),
+      time: el.querySelector('time')?.textContent?.trim() ?? null,
+      text: (el.innerText || '').replace(/\s+/g, ' ').slice(0, 60),
+    })),
+  );
+
+const scroller = (page) =>
+  page.evaluate(() => {
+    const first = document.querySelector('[data-message-id]');
+    let el = first?.parentElement;
+    while (el && !(el.scrollHeight > el.clientHeight + 4 && /(auto|scroll)/.test(getComputedStyle(el).overflowY))) {
+      el = el.parentElement;
+    }
+    if (!el) return null;
+    el.setAttribute('data-e2e-scroller', '1');
+    return { top: el.scrollTop, max: el.scrollHeight - el.clientHeight };
+  });
+
+async function send(page, text) {
+  const box = page.locator('textarea').last();
+  await box.fill(text);
+  await box.press('Enter');
+}
+
+async function waitForAgentReply(page, afterCount, timeout = 60000) {
+  const t0 = Date.now();
+  while (Date.now() - t0 < timeout) {
+    const list = await bubbles(page);
+    const agent = list.filter((b) => b.role !== 'user');
+    if (agent.length > afterCount) {
+      await sleep(2500); // let the stream finish
+      return true;
+    }
+    await sleep(500);
+  }
+  return false;
+}
+
+const browser = await launch();
+try {
+  const page = await newPage(browser, { skewMs: SKEW });
+  await login(page, base);
+  await page.goto(`${base}/agents/${AGENT}`, { waitUntil: 'networkidle' });
+  await sleep(3000);
+
+  // ── 1. order under a browser clock 2 minutes ahead ────────────────────
+  const before = await bubbles(page);
+  const agentBefore = before.filter((b) => b.role !== 'user').length;
+  const q1 = `Порядок ${Date.now() % 100000}. Ответь одним словом: ок.`;
+  await send(page, q1);
+  const replied = await waitForAgentReply(page, agentBefore);
+  check('agent replied', replied);
+  let list = await bubbles(page);
+  const qi = list.findIndex((b) => b.role === 'user' && b.text.includes(q1.slice(0, 14)));
+  const ai = list.findIndex((b, i) => i > -1 && b.role !== 'user' && !before.some((x) => x.id === b.id));
+  check('question is rendered above its answer with the clock +2 min', qi !== -1 && ai !== -1 && qi < ai, `question#${qi} answer#${ai}`);
+  check('question appears once', list.filter((b) => b.text.includes(q1.slice(0, 14))).length === 1);
+  check('delivered', list[qi]?.delivery === 'delivered', `delivery=${list[qi]?.delivery}`);
+  check('every bubble shows a time', list.every((b) => /\d{1,2}:\d{2}/.test(b.time ?? '')), list.map((b) => b.time).join(' | '));
+
+  // ── 2. reload: same order, same times ─────────────────────────────────
+  const timesBefore = list.map((b) => `${b.id}@${b.time}`);
+  await page.reload({ waitUntil: 'networkidle' });
+  await sleep(3500);
+  const afterReload = await bubbles(page);
+  const stillThere = afterReload.some((b) => b.text.includes(q1.slice(0, 14)));
+  if (which === 'admin' && !stillThere) {
+    console.log('NOTE  admin reload replays the server transcript; on this Windows box the runtime writes it into an NTFS stream the API cannot read, so an empty chat after reload is the local-environment gap, not the code under test.');
+  } else {
+    check('message survives a reload', stillThere);
+    const qr = afterReload.findIndex((b) => b.text.includes(q1.slice(0, 14)));
+    const ar = afterReload.findIndex((b, i) => i > qr && b.role !== 'user');
+    check('order is the same after reload', qr !== -1 && ar > qr, `question#${qr} answer#${ar}`);
+    const timesAfter = afterReload.map((b) => `${b.id}@${b.time}`);
+    check('times are unchanged by the reload', timesBefore.every((t) => timesAfter.includes(t)), '');
+  }
+
+  // ── 3. scroll: fill the chat, scroll up, incoming must not pull, send must ──
+  for (let i = 0; i < 3; i++) {
+    const n = (await bubbles(page)).filter((b) => b.role !== 'user').length;
+    await send(page, `Заполнение ${i}. Напиши нумерованный список из 12 коротких пунктов о лошадях.`);
+    await waitForAgentReply(page, n, 90000);
+  }
+  let s = await scroller(page);
+  check('chat is scrollable', !!s && s.max > 200, JSON.stringify(s));
+  if (s && s.max > 200) {
+    await page.evaluate(() => { document.querySelector('[data-e2e-scroller]').scrollTop = 0; });
+    await sleep(500);
+    const n = (await bubbles(page)).filter((b) => b.role !== 'user').length;
+    await send(page, 'Прокрутка. Ответь одним словом: ок.');
+    await sleep(1200);
+    s = await scroller(page);
+    check('sending scrolls to the bottom from the top', s.max - s.top < 120, JSON.stringify(s));
+    await waitForAgentReply(page, n);
+
+    await page.evaluate(() => { document.querySelector('[data-e2e-scroller]').scrollTop = 0; });
+    await sleep(500);
+    // Incoming content while scrolled up: ask from a second page of the same login.
+    const other = await newPage(browser);
+    await login(other, base);
+    await other.goto(`${base}/agents/${AGENT}`, { waitUntil: 'networkidle' });
+    await sleep(3000);
+    const n2 = (await bubbles(page)).filter((b) => b.role !== 'user').length;
+    const q2 = `Вторая вкладка ${Date.now() % 100000}. Ответь одним словом: ок.`;
+    await send(other, q2);
+    await waitForAgentReply(other, 0);
+    await sleep(1500);
+    s = await scroller(page);
+    check('incoming content does not pull a reader who scrolled up', s.top < 60, JSON.stringify(s));
+    const mine = await bubbles(page);
+    check('first tab shows the question asked in the second tab, once', mine.filter((b) => b.text.includes(q2.slice(0, 18))).length === 1);
+    check('first tab received the answer to it', mine.filter((b) => b.role !== 'user').length > n2);
+    const theirs = await bubbles(other);
+    check('second tab shows its own question once', theirs.filter((b) => b.text.includes(q2.slice(0, 18))).length === 1);
+  }
+  await page.screenshot({ path: `chat-${which}.png` });
+} catch (err) {
+  console.log('ERROR', String(err).slice(0, 400));
+  results.push({ name: 'script completed', ok: false });
+} finally {
+  await browser.close();
+}
+const failed = results.filter((r) => !r.ok).length;
+console.log(`\n${results.length - failed}/${results.length} checks passed (${which})`);
+process.exit(failed ? 1 : 0);
diff --git a/specs/015-chat-message-reliability/e2e/handoff.mjs b/specs/015-chat-message-reliability/e2e/handoff.mjs
new file mode 100644
index 00000000..2b396319
--- /dev/null
+++ b/specs/015-chat-message-reliability/e2e/handoff.mjs
@@ -0,0 +1,59 @@
+// CLEAN-102 / US1 scenario 1: ask in the landing-page chat, move to the agent page mid-answer.
+import { launch, newPage, login, APP, sleep } from './lib.mjs';
+
+const bubbles = (page) =>
+  page.$$eval('[data-message-id]', (els) =>
+    els.map((el) => ({ role: el.getAttribute('data-role'), delivery: el.getAttribute('data-delivery'), text: (el.innerText || '').replace(/\s+/g, ' ').slice(0, 50) })),
+  );
+
+const browser = await launch();
+let failed = 0;
+const check = (name, ok, detail = '') => { if (!ok) failed++; console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? '  — ' + detail : ''}`); };
+try {
+  const page = await newPage(browser);
+  await login(page, APP);
+  await page.goto(APP + '/', { waitUntil: 'networkidle' });
+  await sleep(2500);
+  const hasChat = await page.locator('textarea').count();
+  if (!hasChat) {
+    console.log('SKIP  the landing page shows no live chat (no featured public agent on this stack)');
+  } else {
+    const q = `Главная ${Date.now() % 100000}. Перечисли пять фактов о лошадях, по одному предложению.`;
+    const box = page.locator('textarea').last();
+    await box.fill(q);
+    await box.press('Enter');
+    await sleep(900); // the agent has started, the answer has not finished
+    const agentLink = page.locator('a[href^="/agents/agent-"]').first();
+    const href = (await agentLink.count()) ? await agentLink.getAttribute('href') : null;
+    const target = href ?? (await page.evaluate(() => {
+      const el = document.querySelector('[data-message-id]');
+      return null;
+    }));
+    if (!target) {
+      // No link on the landing page — navigate client-side the way a NuxtLink would.
+      const id = await page.evaluate(() => Object.keys(localStorage).find((k) => k.startsWith('bridle:conversation:'))?.split(':').pop());
+      check('found the conversation key to navigate to', !!id, String(id));
+      await page.evaluate((agentId) => window.useNuxtApp?.().$router.push(`/agents/${agentId}`), id);
+    } else {
+      await agentLink.click();
+    }
+    await page.waitForURL(/\/agents\//, { timeout: 15000 }).catch(() => undefined);
+    console.log('now at', new URL(page.url()).pathname);
+    await sleep(15000);
+    const list = await bubbles(page);
+    const mine = list.filter((b) => b.text.includes(q.slice(0, 12)));
+    check('the question asked on the landing page is in the agent chat, once', mine.length === 1, `count=${mine.length}`);
+    check('it is delivered', mine[0]?.delivery === 'delivered', String(mine[0]?.delivery));
+    const qi = list.findIndex((b) => b.text.includes(q.slice(0, 12)));
+    check('the answer arrived after the move, below the question', list.slice(qi + 1).some((b) => b.role !== 'user'), `${list.length} bubbles`);
+    const reconnecting = await page.getByText(/Reconnecting|Переподключ/i).count();
+    check('no "Reconnecting…" banner', reconnecting === 0);
+    await page.screenshot({ path: 'handoff-app.png' });
+  }
+} catch (err) {
+  failed++;
+  console.log('ERROR', String(err).slice(0, 300));
+} finally {
+  await browser.close();
+}
+process.exit(failed ? 1 : 0);
diff --git a/specs/015-chat-message-reliability/e2e/leave.mjs b/specs/015-chat-message-reliability/e2e/leave.mjs
new file mode 100644
index 00000000..1cd60edb
--- /dev/null
+++ b/specs/015-chat-message-reliability/e2e/leave.mjs
@@ -0,0 +1,45 @@
+// CLEAN-102: leave the agent page mid-answer (SPA navigation), come back — nothing lost, nothing doubled.
+import { launch, newPage, login, APP, AGENT, sleep } from './lib.mjs';
+
+const bubbles = (page) =>
+  page.$$eval('[data-message-id]', (els) =>
+    els.map((el) => ({ role: el.getAttribute('data-role'), delivery: el.getAttribute('data-delivery'), text: (el.innerText || '').replace(/\s+/g, ' ').slice(0, 50) })),
+  );
+
+const away = Number(process.argv[2] || 1500); // ms spent on the other page
+const browser = await launch();
+let failed = 0;
+const check = (name, ok, detail = '') => { if (!ok) failed++; console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? '  — ' + detail : ''}`); };
+try {
+  const page = await newPage(browser);
+  await login(page, APP);
+  await page.goto(`${APP}/agents/${AGENT}`, { waitUntil: 'networkidle' });
+  await sleep(3000);
+  const q = `Уход ${Date.now() % 100000}. Перечисли семь фактов о лошадях, по одному предложению на факт.`;
+  const box = page.locator('textarea').last();
+  await box.fill(q);
+  await box.press('Enter');
+  await sleep(1200);
+  const link = page.locator('a[href="/agents"]').first();
+  check('found an in-app link to leave the page', (await link.count()) > 0);
+  await link.click();
+  await page.waitForURL((u) => u.pathname === '/agents', { timeout: 10000 });
+  console.log(`away for ${away} ms on`, new URL(page.url()).pathname);
+  await sleep(away);
+  await page.goBack();
+  await page.waitForURL(/\/agents\/agent-/, { timeout: 10000 });
+  await sleep(20000);
+  const list = await bubbles(page);
+  const qi = list.findIndex((b) => b.text.includes(q.slice(0, 10)));
+  check('the question is there once', list.filter((b) => b.text.includes(q.slice(0, 10))).length === 1);
+  check('it is delivered', list[qi]?.delivery === 'delivered', String(list[qi]?.delivery));
+  const answers = list.slice(qi + 1).filter((b) => b.role !== 'user');
+  check('the answer that finished while away is shown, once', answers.length === 1, `answers after the question: ${answers.length}`);
+  check('no "Reconnecting…" banner', (await page.getByText(/Reconnecting|Переподключ/i).count()) === 0);
+} catch (err) {
+  failed++;
+  console.log('ERROR', String(err).slice(0, 300));
+} finally {
+  await browser.close();
+}
+process.exit(failed ? 1 : 0);
diff --git a/specs/015-chat-message-reliability/e2e/lib.mjs b/specs/015-chat-message-reliability/e2e/lib.mjs
new file mode 100644
index 00000000..6c13daca
--- /dev/null
+++ b/specs/015-chat-message-reliability/e2e/lib.mjs
@@ -0,0 +1,79 @@
+// Shared helpers for the CLEAN-102 browser checks. Prints no secrets.
+//
+// Playwright is deliberately NOT a dependency of this repo. Install it anywhere
+// outside the repo and point PLAYWRIGHT_DIR at that folder:
+//
+//   mkdir ~/pw && cd ~/pw && bun init -y && bun add playwright-core
+//   PLAYWRIGHT_DIR=~/pw node specs/015-chat-message-reliability/e2e/chat.mjs app
+//
+// It drives an installed Chrome (CHROME_PATH overrides the default location).
+// Credentials: RANCH_LOGIN / RANCH_PASS in .env.project at the repo root.
+//
+//   chat.mjs admin|app   order under a +2 min browser clock, delivery, time, reload, scroll, two tabs
+//   leave.mjs [ms]       leave the agent page mid-answer and come back
+//   status.mjs           agents list row vs header status (admin)
+//   handoff.mjs          landing-page chat → agent page (needs a featured public agent)
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
+const require = createRequire(resolve(process.env.PLAYWRIGHT_DIR || process.cwd(), 'package.json'));
+const { chromium } = require('playwright-core');
+
+export const ADMIN = process.env.ADMIN_URL || 'http://localhost:3001';
+export const APP = process.env.APP_URL || 'http://localhost:3000';
+export const AGENT = process.env.AGENT_ID || 'agent-bb620efe-abb5-4123-8ace-6d9b963387c7';
+const CHROME =
+  process.env.CHROME_PATH ||
+  (process.platform === 'win32'
+    ? 'C:/Program Files/Google/Chrome/Application/chrome.exe'
+    : process.platform === 'darwin'
+      ? '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
+      : '/usr/bin/google-chrome');
+
+const env = {};
+for (const line of readFileSync(resolve(REPO, '.env.project'), 'utf8').split(/\r?\n/)) {
+  const i = line.indexOf('=');
+  if (i > 0) env[line.slice(0, i).trim()] = line.slice(i + 1).trim();
+}
+
+export async function launch() {
+  return chromium.launch({ executablePath: CHROME, headless: true });
+}
+
+/** New page; `skewMs` shifts the page's clock forward (Date.now and new Date()). */
+export async function newPage(browser, { skewMs = 0 } = {}) {
+  const context = await browser.newContext({ viewport: { width: 1280, height: 800 } });
+  if (skewMs) {
+    await context.addInitScript((skew) => {
+      const RealDate = Date;
+      const now = () => RealDate.now() + skew;
+      class SkewedDate extends RealDate {
+        constructor(...args) {
+          if (args.length === 0) super(now());
+          else super(...args);
+        }
+        static now() { return now(); }
+      }
+      // eslint-disable-next-line no-global-assign
+      Date = SkewedDate;
+    }, skewMs);
+  }
+  const page = await context.newPage();
+  page.on('pageerror', (e) => console.log('  [pageerror]', String(e).slice(0, 200)));
+  return page;
+}
+
+export async function login(page, base) {
+  await page.goto(base + '/login', { waitUntil: 'networkidle' });
+  await page.locator('input[type="email"], input[name="email"]').first().fill(env.RANCH_LOGIN);
+  await page.locator('input[type="password"]').first().fill(env.RANCH_PASS);
+  await Promise.all([
+    page.waitForURL((u) => !u.pathname.startsWith('/login'), { timeout: 20000 }),
+    page.locator('button[type="submit"]').first().click(),
+  ]);
+}
+
+export const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
diff --git a/specs/015-chat-message-reliability/e2e/status.mjs b/specs/015-chat-message-reliability/e2e/status.mjs
new file mode 100644
index 00000000..971956b9
--- /dev/null
+++ b/specs/015-chat-message-reliability/e2e/status.mjs
@@ -0,0 +1,33 @@
+// CLEAN-102 / US6: does the agents list row agree with the header, and do stream frames decode?
+import { launch, newPage, login, ADMIN, AGENT, sleep } from './lib.mjs';
+
+const browser = await launch();
+try {
+  const page = await newPage(browser);
+  const frames = [];
+  page.on('response', (r) => { if (r.url().includes('/agents/status/stream')) frames.push(r.status()); });
+  await login(page, ADMIN);
+  await page.goto(`${ADMIN}/agents/${AGENT}`, { waitUntil: 'domcontentloaded' });
+  await sleep(6000);
+  const seen = await page.evaluate(() => {
+    const statuses = ['Running', 'Deploying', 'Failed', 'Stopped', 'Pending', 'Unreachable'];
+    const find = (root) => {
+      const text = (root?.innerText || '').replace(/\s+/g, ' ');
+      // Case-sensitive: status badges are capitalised, "Log fetch failed" is not one.
+      return statuses.filter((s) => new RegExp(`\\b${s}\\b`).test(text));
+    };
+    const aside = [...document.querySelectorAll('aside, [class*="rail"], nav')].find((el) => /Search agents/i.test(el.innerHTML) || el.querySelector('input[placeholder*="Search"]'));
+    const rowHost = document.querySelector('input[placeholder*="Search agents"]')?.closest('div')?.parentElement;
+    const header = document.querySelector('h1, h2')?.closest('div')?.parentElement;
+    const pinia = window.__NUXT__ ? null : null;
+    return { list: find(rowHost ?? aside), header: find(header), url: location.pathname };
+  });
+  console.log('status stream HTTP:', frames.join(',') || 'not requested');
+  console.log('list row status  :', seen.list.join(',') || '(none found)');
+  console.log('header status    :', seen.header.join(',') || '(none found)');
+  const agree = seen.list.length && seen.header.length && seen.list.some((s) => seen.header.includes(s));
+  console.log(agree ? 'PASS  list row and header agree' : 'CHECK list and header could not be matched by this script');
+  await page.screenshot({ path: 'status-admin.png' });
+} finally {
+  await browser.close();
+}
diff --git a/specs/015-chat-message-reliability/plan.md b/specs/015-chat-message-reliability/plan.md
new file mode 100644
index 00000000..65fde545
--- /dev/null
+++ b/specs/015-chat-message-reliability/plan.md
@@ -0,0 +1,232 @@
+# Implementation Plan: Chat message reliability
+
+**Branch**: `fix/CLEAN-102-chat-message-reliability` (spec dir `015-chat-message-reliability`) | **Date**: 2026-09-18 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/015-chat-message-reliability/spec.md`, plus
+the planning request: "что насчёт сообщений где порядок не правильный? и при отправке
+сообщения нужно скроллить вниз если мы где-то наверху, это обычное поведение".
+
+**Note**: `setup_plan.py` was not run — Python is not installed on this machine. The
+plan file and feature directory were set up by hand; `.specify/feature.json` points at
+this feature.
+
+## Summary
+
+The chat loses, doubles and reorders messages because it has no delivery confirmation,
+no stable message identity, no recovery of missed events, and orders the timeline by
+timestamps taken from two different clocks. The plan fixes these at their source rather
+than per symptom:
+
+1. **Order by arrival sequence, not by time** (answers the ordering question directly —
+   see below). Time becomes display-only.
+2. **Acknowledged sends** with a client-generated message id, an idempotent hub, and a
+   per-device outbox — gives "sending / slow / delivered / not delivered", Resend, and
+   survival across reloads.
+3. **Hub replay buffer** so events that arrive while a browser is reconnecting are
+   delivered afterwards — fixes hung answers and the landing → agent handoff.
+4. **Conversation-scoped chat state** in the admin store and reference-counted channel
+   ownership in the app store — stops two chat views from clobbering each other.
+5. **Timestamps and delivery state under each message**, and one scroll rule: sending
+   always scrolls to the bottom, incoming content only follows a reader already there.
+6. **Message boundaries in the transcript** — a change in the sibling repository
+   `CleanSlice/runtime` (see Dependencies).
+7. **Several sockets per identity** *(added after the local experiments)* — the hub keeps
+   one socket per identity and every Owner/Admin shares the identity `admin`, so the last
+   view to connect takes all events and earlier views go silent. Reproduced (research
+   E3/F10). The hub fans out to every socket of the identity.
+8. **Single source of truth for agents** *(added on request; approach set by the
+   request: SSOT, so the class of defect does not come back)* — the list row stays on
+   "Deploying" while the detail shows "Failed" because the same agent exists as several
+   independent copies (research F11). An agent lives once in `agentStore`; every fetch
+   upserts into it, the status stream patches it, components render from it by id — in
+   both `admin/` and `app/` (research D12).
+
+**Testing approach** (per the request: test whichever way is convenient; the goal is to
+find the cause and fix the defect): no test-first mandate. Hub behaviour is checked with
+the existing jest specs and the scripted socket probe; ordering, delivery and
+reconciliation logic as pure functions with `bun test`; browser-only behaviour with a
+headless Playwright script where that is quicker than doing it by hand.
+
+**What has been reproduced** (local stack, scripted socket client — research "Update:
+experiments"): no delivery ack (E1), three unrelated ids per message (E2), a second view
+stealing the first one's events (E3), an answer lost across a reconnect while the
+transcript has it (E4). **Not yet observed in a browser**: the ordering bug (needs clock
+skew), scrolling, the landing-page handoff (F5) and the admin store clobbering (F3).
+
+### The ordering question, answered
+
+The wrong order has a concrete cause, confirmed in the source (research F1). Both chat
+views sort the timeline with `items.sort((a, b) => a.ts - b.ts)`. Your message carries
+the **browser's** clock; the agent's messages carry the **agent's** clock. When the
+browser clock is ahead by more than the agent's response time, the reply sorts above
+your question — so your message "drops below" it. It is intermittent because it depends
+on the skew and on how quickly the first agent message arrives (a greeting or a short
+acknowledgement arrives in milliseconds).
+
+Fix (research D1): every item gets a per-conversation sequence number when it is
+appended, and the view orders by that. Arrival order is the order you experienced, and
+clock skew cannot affect it. This is the first implementation slice because it is small,
+self-contained and removes the most visible artifact.
+
+The duplicate in the same screenshot is a different defect (research F5/F2 — the send
+that silently went nowhere and was sent again); it is covered by items 2–4.
+
+## Technical Context
+
+**Language/Version**: TypeScript 5.x throughout. API: NestJS on Bun/Node. Clients: Nuxt 4
+/ Vue 3 (`app/` console with Pinia setup stores and i18n; `admin/` with a Pinia options
+store, English only).
+
+**Primary Dependencies**: socket.io (server + client) for the hub; Pinia; generated
+OpenAPI SDK (`openapi-ts`) for HTTP. No new runtime dependency is planned.
+
+**Storage**: No database change. Browser `localStorage` (app: existing
+`bridle:conversation:<key>` gains fields; admin: new `bridle:outbox:<agentId>:<channel>`).
+Hub state stays in memory (new bounded replay buffer and seen-id cache). Transcript JSONL
+on S3 is written by the agent runtime and only read here.
+
+**Testing**: API — jest (`cd api && bun run test`), extending the existing specs.
+`app/` and `admin/` have no test runner; pure logic goes under each slice's `utils/` and
+is covered with `bun test` (no new dependency). UI behaviour is validated via
+[quickstart.md](./quickstart.md). Type safety: `npx nuxt typecheck` in `app/` and
+`admin/` (not `bun run typecheck` in `app/` — it regenerates the SDK).
+
+**Target Platform**: Browsers (desktop first) against the API in the k3s cluster; local
+stack via the repo's Makefile.
+
+**Project Type**: Web application — one API, two web clients sharing a wire protocol.
+
+**Performance Goals**: Delivery state visible within 5 s (slow) / 30 s (failed). A
+finished answer visible in an open chat within 10 s in ≥ 99 % of turns (SC-005). Replay
+after reconnect completes before live traffic resumes.
+
+**Constraints**: The `message` wire contract is shared with the embed widget — every
+protocol change must be additive and optional. The hub is single-instance in memory
+(already true today). New user-visible strings in `app/` follow `docs/i18n.md`. The
+agent runtime's source is outside this repository.
+
+**Scale/Scope**: Two chat surfaces (three entry points in the app: landing hero, agent
+page, share page; two in the admin: Rancher panel, agent chat tab), one hub, one
+transcript reader. Roughly: API ~4 files + specs, app ~8 files, admin ~5 files, where
+the admin store refactor (singleton → conversation-scoped) is the largest piece.
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+`.specify/memory/constitution.md` is still the unfilled template — it defines no
+principles, so there are no constitutional gates to evaluate. The gates applied instead
+are the repository's own rules (`CLAUDE.md`, `.cursor/rules/project.mdc`):
+
+| Gate | Status |
+|------|--------|
+| Work tracked under a `CLEAN-` id, branch from `origin/main` | Pass — CLEAN-102, `fix/CLEAN-102-chat-message-reliability` |
+| No hand-written types where OpenAPI generates them | Pass — HTTP surface unchanged except reuse of the existing transcript route; socket payload types are not OpenAPI-generated |
+| `app/` strings via `en.json` + `i18n:sync`; `admin/` English only | Pass — planned in D9 |
+| Slice structure respected (`data/`, `domain/`, `stores/`, `components/`, `utils/`) | Pass — see Project Structure |
+
+**Post-design re-check**: unchanged. No violations, Complexity Tracking left empty.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/015-chat-message-reliability/
+├── spec.md
+├── plan.md              # this file
+├── research.md          # Phase 0 — findings F1–F9, decisions D1–D10, open items
+├── data-model.md        # Phase 1 — client-side entities and state machines
+├── quickstart.md        # Phase 1 — validation scenarios
+├── contracts/
+│   └── bridle-socket.md # Phase 1 — additive changes to the browser ↔ hub protocol
+├── checklists/requirements.md
+└── tasks.md             # Phase 2 (/speckit-tasks — not created here)
+```
+
+### Source Code (repository root)
+
+```text
+api/src/slices/bridle/
+├── handlers/bridleClientWs.handler.ts   # ack callback, clientMessageId, lastSeq handshake
+├── data/bridle.gateway.ts               # forward client id, seen-id cache, per-client seq + replay buffer
+├── domain/bridle.types.ts               # additive payload types
+├── domain/bridle.gateway.ts             # interface additions
+└── (specs next to each file)
+api/src/slices/agent/file/domain/
+└── transcriptReader.service.ts          # file-order tie-break, per-message assistant events
+
+app/slices/bridle/
+├── domain/bridle.types.ts               # seq, delivery, clientMessageId on IBridleMessage
+├── domain/bridle.gateway.ts             # send() returns an ack promise; transcript tail
+├── data/bridle.gateway.ts               # emit with ack + timeout, lastSeq in handshake
+├── stores/bridle.ts                     # seq, delivery machine, outbox, acquire/release, replay
+├── utils/chatFlow.ts                    # pure: ordering + day separators            (new, tested)
+├── utils/delivery.ts                    # pure: state machine + thresholds           (new, tested)
+├── components/bridle/chat/Provider.vue  # order by seq, scroll rule
+├── components/bridle/chat/Message.vue   # time, delivery state, Resend / Discard
+└── i18n/locales/en.json                 # new keys → `bun run i18n:sync` (never hand-write ru.json)
+
+admin/slices/bridle/
+├── stores/bridle.ts                     # conversation-scoped state, ack, outbox, replay, seq
+├── utils/chatFlow.ts, utils/delivery.ts # same pure logic as the app                 (new, tested)
+├── components/bridle/Provider.vue       # order by seq, scroll on send
+└── components/bridle/Message.vue        # time, delivery state, Resend / Discard
+admin/slices/rancher/components/rancher/Provider.vue   # passes its own conversation key
+```
+
+**Structure Decision**: No new slice and no shared package. `app/` and `admin/` are
+separate Nuxt projects with no shared workspace library today, so the two small pure
+modules (`chatFlow`, `delivery`) are duplicated rather than introducing cross-project
+packaging for this fix; the duplication is deliberate and noted for a later cleanup.
+
+## Implementation slices (order)
+
+Each slice is independently shippable; the order follows the spec's priorities and puts
+the cheapest high-value fix first.
+
+1. **Ordering by sequence + scroll rule** (both clients, no API change) — spec US2,
+   FR-006/007/024/025. Smallest change, removes the most visible artifact.
+2. **Timestamps under messages** (both clients) — US5 part 1, FR-017/018.
+3. **Acknowledged send + idempotent hub + delivery states + outbox** (API + both
+   clients) — US1, US5 part 2, FR-001–005, 019–021.
+4. **Channel ownership (app) and conversation-scoped store (admin)** — US1/US2,
+   FR-001/008; removes the handoff and cross-chat clobbering.
+5. **Hub replay buffer + reconnect catch-up + transcript safety net** — US4,
+   FR-012/014–016.
+6. **Transcript boundaries** — US3, FR-010–013. API reader part here; the runtime part is
+   a separate ticket and PR in `CleanSlice/runtime`.
+7. **Agent status consistency (admin)** — US6, FR-027. Independent of everything above;
+   small; can ship as its own PR at any point.
+
+**Fan-out to several sockets per identity** (FR-026, research D11) is part of slice 3's
+hub work: the ack, the seen-id cache, the sequence and the replay buffer are all keyed by
+identity, so the registry has to become multi-socket before they are built on it. It is
+the change most likely to remove "the answer never arrived" reports on its own.
+
+Slices 3 and 4 touch the same admin store; 4 is sequenced after 3 only for the app —
+for the admin the refactor in 4 should land **before** 3 to avoid writing the outbox
+twice. `/speckit-tasks` should order them that way.
+
+## Dependencies and risks
+
+- **Agent runtime — `CleanSlice/runtime`, sibling checkout `../runtime`** — needed for
+  slice 6 (one transcript event per emitted message with the wire `messageId` as its id;
+  persist the forwarded user `messageId`) and for closing the delivered-vs-saved gap in
+  D2. Confirmed in its source: `loop.service.ts` `sendFinalResponse` writes one
+  `assistant` event per turn with the accumulated text and a random id. Without that
+  change US3 cannot be met for the admin and the chat history pages; everything else can
+  ship. It needs its own ticket, branch and PR in that repository.
+- **Local validation gap** — on this Windows machine the runtime's session file lands in
+  an NTFS alternate data stream and the API's transcript route returns nothing, so
+  reload-from-transcript scenarios must be validated on the cluster.
+- **Two hypotheses (F3, F5)** are not reproduced. The fixes in slice 4 are sound
+  independently, but the claim that they explain the vanished landing-page question must
+  be confirmed in a running stack.
+- **Embed widget compatibility** — all wire changes are optional fields and an optional
+  ack; a client that sends neither behaves as today.
+- **Single API instance** — the replay buffer and seen-id cache are in memory.
+
+## Complexity Tracking
+
+No constitution violations to justify.
diff --git a/specs/015-chat-message-reliability/probe.mjs b/specs/015-chat-message-reliability/probe.mjs
new file mode 100644
index 00000000..45d75bf6
--- /dev/null
+++ b/specs/015-chat-message-reliability/probe.mjs
@@ -0,0 +1,161 @@
+// Probe the bridle hub the way a browser does (CLEAN-102). Prints no secrets.
+//
+//   node specs/015-chat-message-reliability/probe.mjs <mode>
+//
+//   normal   one turn; shows the delivery ack and every event with its seq
+//   steal    two sockets of one login, the FIRST one sends — who gets the answer?
+//   gap      drop the socket mid-turn, reconnect with lastSeq — is the answer replayed?
+//   offline  send while the agent is disconnected — rejection, or a fake agent reply?
+//
+// API_URL / AGENT_ID override the local defaults. Credentials come from
+// RANCH_LOGIN / RANCH_PASS in .env.project at the repo root.
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const require = createRequire(resolve(REPO, 'package.json'));
+const { io } = require('socket.io-client');
+
+const API = process.env.API_URL || 'http://localhost:3333';
+const AGENT = process.env.AGENT_ID || 'agent-bb620efe-abb5-4123-8ace-6d9b963387c7';
+const MODE = process.argv[2] || 'normal';
+
+const env = {};
+for (const line of readFileSync(resolve(REPO, '.env.project'), 'utf8').split(/\r?\n/)) {
+  const i = line.indexOf('=');
+  if (i > 0) env[line.slice(0, i).trim()] = line.slice(i + 1).trim();
+}
+
+const t0 = Date.now();
+const rel = () => String(Date.now() - t0).padStart(6) + 'ms';
+const log = (...a) => console.log(rel(), ...a);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const short = (s) => (s ?? '').replace(/\s+/g, ' ').slice(0, 70);
+const id8 = (s) => String(s).slice(0, 8);
+
+async function login() {
+  const res = await fetch(API + '/auth/login', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email: env.RANCH_LOGIN, password: env.RANCH_PASS }),
+  });
+  const json = await res.json().catch(() => ({}));
+  const token = (json.data ?? json).accessToken;
+  log('login', res.status, 'token:', token ? 'yes' : 'NO');
+  if (!token) throw new Error('login failed');
+  return token;
+}
+
+function connect(token, name, lastSeq = 0) {
+  const socket = io(API + '/ws/client', {
+    transports: ['websocket'],
+    reconnection: false,
+    auth: { agentId: AGENT, capabilities: ['thinking'], token, lastSeq },
+  });
+  const state = { socket, seen: [], lastSeq };
+  const note = (type, seq) => {
+    state.seen.push(type);
+    if (typeof seq === 'number') state.lastSeq = Math.max(state.lastSeq, seq);
+  };
+  const tag = `[${name}]`;
+  socket.on('connect', () => log(tag, 'connect'));
+  socket.on('disconnect', (r) => log(tag, 'disconnect', r));
+  socket.on('connect_error', (e) => log(tag, 'connect_error', e.message));
+  socket.on('welcome', (d) => log(tag, 'welcome', JSON.stringify(d)));
+  socket.on('bridle_error', (d) => log(tag, 'bridle_error', JSON.stringify(d)));
+  socket.on('message_error', (d) => log(tag, 'message_error', JSON.stringify(d)));
+  socket.on('agent_status', (d) => log(tag, 'agent_status connected=' + d.connected));
+  socket.on('typing', (d) => { note('typing', d?.seq); log(tag, 'typing', 'seq=' + d?.seq); });
+  socket.on('thinking', (e) => {
+    note('thinking', e.seq);
+    log(tag, 'thinking', e.done ? 'DONE' : 'step', 'seq=' + e.seq);
+  });
+  let chunks = 0;
+  socket.on('stream', (d) => {
+    note('stream', d.seq);
+    if (++chunks === 1) log(tag, 'stream (first chunk)', 'id=' + id8(d.messageId), 'seq=' + d.seq);
+  });
+  socket.on('stream_end', (d) => {
+    note('stream_end', d.seq);
+    chunks = 0;
+    log(tag, 'stream_end', 'id=' + id8(d.messageId), 'seq=' + d.seq, 'skew=' + ((d.ts ?? NaN) - Date.now()) + 'ms', '"' + short(d.text) + '"');
+  });
+  socket.on('message', (d) => {
+    note('message', d.seq);
+    log(tag, 'message', 'id=' + id8(d.messageId), 'seq=' + d.seq, '"' + short(d.text) + '"');
+  });
+  socket.on('user_message', (d) => {
+    note('user_message', d.seq);
+    log(tag, 'user_message', 'id=' + id8(d.messageId), 'seq=' + d.seq, '"' + short(d.text) + '"');
+  });
+  return state;
+}
+
+function send(state, text, clientMessageId = 'probe-' + Date.now()) {
+  return new Promise((done) => {
+    const timer = setTimeout(() => { log('ACK: none within 30s'); done(null); }, 30000);
+    state.socket.emit('message', { text, clientMessageId }, (ack) => {
+      clearTimeout(timer);
+      log('ACK', JSON.stringify(ack));
+      done(ack);
+    });
+  });
+}
+
+const summary = (s) => (s.seen.length ? [...new Set(s.seen)].join(',') : 'NOTHING');
+const token = await login();
+
+if (MODE === 'normal') {
+  const a = connect(token, 'A');
+  await sleep(1500);
+  log('SEND');
+  await send(a, 'Привет! Это тест чата. Ответь одним коротким предложением.');
+  await sleep(15000);
+  log('received:', summary(a));
+  a.socket.close();
+}
+
+if (MODE === 'steal') {
+  const a = connect(token, 'A');
+  await sleep(1200);
+  const b = connect(token, 'B');
+  await sleep(1200);
+  log('SEND from A — the socket that connected FIRST');
+  await send(a, 'Тест двух вкладок. Ответь одним словом: ок.');
+  await sleep(15000);
+  log('A received:', summary(a));
+  log('B received:', summary(b));
+  a.socket.close();
+  b.socket.close();
+}
+
+if (MODE === 'gap') {
+  const a = connect(token, 'A');
+  await sleep(1500);
+  log('SEND long question');
+  void send(a, 'Тест обрыва связи. Перечисли пять фактов о лошадях, по одному предложению на факт.');
+  while (!a.seen.includes('typing') && Date.now() - t0 < 30000) await sleep(50);
+  log('>>> dropping the socket mid-turn; lastSeq=' + a.lastSeq);
+  a.socket.close();
+  await sleep(25000);
+  log('>>> reconnecting with lastSeq=' + a.lastSeq);
+  const b = connect(token, 'A2', a.lastSeq);
+  await sleep(8000);
+  log('after reconnect received:', summary(b));
+  b.socket.close();
+}
+
+if (MODE === 'offline') {
+  const a = connect(token, 'A');
+  await sleep(1500);
+  log('SEND (expecting the agent to be disconnected)');
+  await send(a, 'Это сообщение не должно потеряться молча.');
+  await sleep(3000);
+  log('received:', summary(a), '— a "message" here means the hub faked an agent reply');
+  a.socket.close();
+}
+
+await sleep(500);
+process.exit(0);
diff --git a/specs/015-chat-message-reliability/quickstart.md b/specs/015-chat-message-reliability/quickstart.md
new file mode 100644
index 00000000..d0aa9e8d
--- /dev/null
+++ b/specs/015-chat-message-reliability/quickstart.md
@@ -0,0 +1,139 @@
+# Quickstart: validating chat message reliability
+
+How to prove the feature works end to end. Shapes and rules are in
+[data-model.md](./data-model.md) and [contracts/bridle-socket.md](./contracts/bridle-socket.md);
+this file only says what to run and what to expect.
+
+## Prerequisites
+
+- Local stack: `make setup` once, then `make dev` (API :3000, app :3001, admin :3002,
+  k3d). At least one agent in `running` state; for the delegation-style multi-message
+  turns, Rancher plus one peer.
+- An admin login and an app console login.
+- Browser DevTools (Network → throttling / Offline, Application → Local Storage).
+
+## Step 0 — Before any fix: capture the evidence (research open items 1 and 3)
+
+1. Pick one conversation that showed fused bubbles after reload. In the admin, open the
+   agent's Files → `data/sessions/<sessionKey>.jsonl` and look at one multi-message turn.
+   **Record**: is there one `assistant` event for the turn or one per message? Does the
+   `user` event's `id` equal the `messageId` the hub forwarded (API log line for the
+   send)? This settles research F6 / F7 and the de-duplication rule in D3.
+2. Reproduce the ordering bug on purpose: set the OS clock **2 minutes ahead**, send
+   "привет" to an agent that replies quickly. **Expected today**: the reply renders
+   above the question. Keep the clock skewed for scenario 1 below.
+3. Reproduce the handoff: ask a question in the landing-page chat, immediately click
+   through to that agent's page. **Record** whether the chat shows "Reconnecting…", and
+   whether the answer arrives (research F5).
+4. Admin: open the Rancher panel and an agent's Chat tab, start a turn in one, open the
+   other. **Record** whether the first chat's messages change (research F3).
+
+## Automated checks
+
+```bash
+cd api && bun run test -- bridle transcriptReader   # hub ack, idempotency, replay buffer, reader order
+cd app && bun test slices/bridle/utils              # chatFlow ordering, delivery state machine
+cd admin && bun test slices/bridle/utils
+cd app && npx nuxt typecheck                        # not `bun run typecheck` — it regenerates the SDK
+cd admin && npx nuxt typecheck
+bun run i18n:sync                                   # after adding keys to app/slices/bridle/i18n/locales/en.json
+```
+
+## Manual scenarios
+
+Run each in **both** surfaces unless marked.
+
+### 1 — Order survives clock skew (US2, FR-006/007)
+
+With the OS clock 2 minutes ahead: send a question, wait for a multi-message answer,
+send a follow-up while the agent is still working.
+**Expect**: question above its answer; follow-up exactly where it was sent; identical
+order after a reload. Reset the clock afterwards.
+
+### 2 — Scroll (FR-024/025)
+
+Fill the chat past one screen. Scroll to the top. (a) Wait for an incoming agent message
+→ the view **does not move**. (b) Send a message → the view **scrolls to the bottom**
+and the new message is visible. (c) At the bottom during a streamed answer → the view
+follows the stream.
+
+### 3 — Timestamps (US5, FR-017/018)
+
+Every bubble shows a time of day; hovering shows full date and time; a separator appears
+between messages from different days. Reload: every time is unchanged. App in Russian:
+separators and states are in Russian; admin is English.
+
+### 4 — Delivery states (US5, FR-019–021)
+
+- Normal network: the message shows no warning state (delivered).
+- DevTools throttling "Slow 3G", or pause the API process for ~8 s: a loading state
+  appears under the message after ~5 s and clears on delivery.
+- Stop the agent (scale to 0 / stop from the admin), send: "not delivered" appears under
+  the message with Resend and Discard. **No** "Agent is not connected" agent bubble.
+
+### 5 — Nothing is lost across reload (US1, FR-002–005)
+
+- Send, reload within one second → the message is there once, either delivered or not
+  delivered — never missing, never twice.
+- With the agent stopped: send, reload → the message is still there, marked not
+  delivered. Start the agent, press Resend → it becomes delivered, the agent answers
+  **once**, and a further reload shows one copy.
+- Discard a not-delivered message, reload → it stays gone.
+- Idempotency (a resend whose original did arrive) is not practical to stage by hand; it
+  is covered by the hub's jest spec for a repeated `clientMessageId` in the automated
+  checks above.
+
+### 6 — Landing page → agent page (US1 scenario 1, app only)
+
+Ask a question in the landing hero chat, click through to the agent page while the agent
+is still answering.
+**Expect**: the question is the first item, shown once; no "Reconnecting…"; the answer
+continues in place; nothing to retype.
+
+### 7 — Two chats at once (admin only)
+
+Rancher panel open with a turn running; open an agent's Chat tab and send there.
+**Expect**: each chat keeps its own messages and its own thinking timeline.
+
+### 8 — Answer arrives after a connection gap (US4, FR-014–016)
+
+Start a long turn. DevTools → Offline for ~10 s across the moment the agent finishes
+(watch the API log for the `stream_end`), then back Online.
+**Expect**: the answer appears without a reload within 10 s of reconnecting; the
+thinking indicator ends; no duplicate bubbles. Then repeat, but restart the API during
+the gap (buffer lost): the client falls back to the transcript and still shows the
+answer.
+
+### 10 — Two views of one conversation (FR-026)
+
+Open the same agent's chat in two tabs (or the admin panel and the app console) under the
+same login. Send from the tab that was opened **first**.
+**Expect**: both tabs show the question once and the answer once. *Before the fix
+(reproduced 2026-09-18 with a scripted client): the sending tab receives nothing and the
+other tab receives the answer.*
+
+### 11 — Agent status is the same everywhere (US6, admin only)
+
+Agents screen, an agent selected. Trigger a deploy that ends in `failed` (or `running`).
+**Expect**: list row, header pill and Overview card change together within 10 s, no
+reload; the failure reason is reachable from the list row. Repeat with a **different**
+agent selected: the changing agent's row still updates.
+
+### 9 — Reload looks like live (US3, FR-010–013) — *needs the runtime change*
+
+Agent answers in ≥ 3 messages with a list, inline code and bold text. Screenshot, reload
+(admin) and open the same conversation under `/chats` (app), compare.
+**Expect**: same number of bubbles, same boundaries, same formatting, no glued sentences.
+Until the runtime persists one event per message this scenario is expected to **fail**
+for the admin and the history pages, and must be reported as such.
+
+## Success criteria mapping
+
+| Criterion | Scenario |
+|-----------|----------|
+| SC-001, SC-002 | 5, 6, 8 (scripted ×100 for the numbers) |
+| SC-003 | 9 |
+| SC-004 | 1, 6 |
+| SC-005 | 8 |
+| SC-006 | 3 |
+| SC-007 | 4 |
diff --git a/specs/015-chat-message-reliability/research.md b/specs/015-chat-message-reliability/research.md
new file mode 100644
index 00000000..8bfd8926
--- /dev/null
+++ b/specs/015-chat-message-reliability/research.md
@@ -0,0 +1,512 @@
+# Research: Chat message reliability (CLEAN-102)
+
+**Date**: 2026-09-18 · **Method**: static reading of the chat code in `app/`, `admin/`
+and `api/` on `origin/main` @ `71f8351`. Nothing here was reproduced in a running stack
+yet. Each finding is marked **Confirmed in code** (the defect is visible in the source)
+or **Hypothesis** (a plausible cause that needs a reproduction before it is trusted).
+
+## How the chat works today
+
+- One in-memory hub in the API (`api/src/slices/bridle/data/bridle.gateway.ts`) relays
+  between browser sockets and the agent runtime's socket. It stores nothing.
+- The **app console** keeps each conversation in `localStorage`
+  (`bridle:conversation:<key>`, `app/slices/bridle/stores/bridle.ts`). A reload replays
+  that, never the server transcript. The landing-page hero chat and the agent page mount
+  the same `BridleChatProvider` with the same key (`agentId`).
+- The **admin panel** keeps nothing locally. On mount it calls `clearMessages()`, loads
+  the transcript over HTTP, then opens the socket
+  (`admin/slices/bridle/components/bridle/Provider.vue:316-331`).
+- The **transcript** is an append-only JSONL written by the agent runtime. The runtime's
+  source is **not in this repository**; the API only reads the file
+  (`api/src/slices/agent/file/domain/transcriptReader.service.ts`).
+
+## Findings
+
+### F1 — Wrong order: the timeline is sorted by timestamps from two different clocks — *Confirmed in code*
+
+Both surfaces build the visible flow by sorting messages and thinking blocks by `ts`:
+`app/slices/bridle/components/bridle/chat/Provider.vue:116` and
+`admin/slices/bridle/components/bridle/Provider.vue:85`
+(`items.sort((a, b) => a.ts - b.ts)`).
+
+The person's message is stamped with the **browser** clock (`ts: Date.now()` in both
+`sendMessage`s). Agent messages are stamped with the **agent's** clock
+(`ts: reply.ts ?? Date.now()`). The code already knows this — the thinking-block anchor
+carries the comment "wire ts is agent-clock" and compensates with
+`Math.max(e.ts, lastTs + 1)` — but messages get no such treatment.
+
+So whenever the browser clock runs ahead of the agent's by more than the agent's
+response time, the reply sorts **above** the question. That is exactly "сначала пишу я,
+а потом ответ агента, но моё сообщение опускается". It is intermittent because it
+depends on clock skew and on how fast the first agent message arrives (a greeting or a
+short acknowledgement arrives within milliseconds, a long answer does not).
+
+It also explains order changing after a reload in the admin: live order uses mixed
+clocks, replayed order uses only runtime timestamps.
+
+### F2 — Sent messages are fire-and-forget; nothing confirms delivery — *Confirmed in code*
+
+`socket.emit('message', …)` has no acknowledgement in either client
+(`app/slices/bridle/data/bridle.gateway.ts:140`, `admin/…/stores/bridle.ts:777`). The
+hub's `handleMessage` returns nothing. The local bubble is added before the emit and
+looks identical whether or not anyone received it.
+
+When the agent's socket is not connected, the hub does not reject the message: it sends
+back a fake **agent** message, "Agent is not connected. Please try again later."
+(`bridle.gateway.ts:190-207`), and drops the person's text. In the admin, a reload then
+shows the transcript, which never contained that message — "сообщение проглатывалось
+после перезагрузки". In the app the bubble survives in `localStorage` but is
+indistinguishable from a delivered one.
+
+### F3 — Admin: the transcript load replaces the message list — *Confirmed in code*
+
+`loadTranscript` does `this.messages = page.messages.map(…)`
+(`admin/…/stores/bridle.ts:1066`). Anything appended locally before it resolves is
+wiped. The mount sequence awaits it before connecting, which protects the first mount,
+but the store is a **singleton shared by every provider** (the comment at
+`Provider.vue:314` says so): the Rancher panel and an agent's chat tab write into the
+same `messages`, `thinkingBlocks` and socket. Opening one while the other is mid-turn
+clears and replaces the other's list. *Hypothesis*: this is a source of vanished and
+mixed-up messages in the admin; needs a reproduction with both chats open.
+
+### F4 — Events sent while the browser is not registered are dropped — *Confirmed in code*
+
+`handleAgentEvent` looks the client up and, if it is not registered at that instant,
+discards the event (`bridle.gateway.ts:254-257`). There is no buffer and no replay. Both
+clients, on `disconnect`, set typing/pending to false and close all turns. After the
+socket reconnects nothing re-requests what was missed.
+
+Consequence: a `stream_end` / `message` that lands during a reconnect gap never reaches
+the browser. The agent's logs show the answer; the chat shows a frozen or vanished
+thinking indicator until a reload — "зависает ответ, хотя в логах он уже отображается".
+In the app a reload does not help either, because the app replays `localStorage`, which
+never received the answer.
+
+### F5 — Landing page → agent page handoff tears down the shared channel — *Hypothesis*
+
+The hero chat and the agent page use the same conversation key. `connect()` is
+idempotent per key (`if (channels.has(key)) return`), and each provider's watcher
+registers `onCleanup(() => disconnect(conversation))`. The agent page has a top-level
+`await useAsyncData`, so it resolves under Suspense: its provider can mount (and find
+the channel already open, so it opens none) **before** the landing page unmounts and
+closes that channel. The agent page is then left with no channel: "Reconnecting…"
+forever, the in-flight answer is lost (F4), and the next send takes the offline path,
+which hands the text back to the composer as a draft — sending it again produces the
+second copy seen in screenshot 4.
+
+This fits "задал вопрос на главной, перешёл в агента — сообщения нет / ответ не пришёл"
+and the duplicate, but the mount/unmount order must be observed in a running app before
+it is treated as the cause. The fix (reference-counted channel ownership) is correct
+regardless of whether this is the only cause.
+
+### F6 — Separate agent messages fuse into one bubble after reload — *Cause outside this repo; to verify*
+
+Live, each agent message arrives as its own `message` / `stream_end` with its own
+`messageId`, and renders as its own bubble. After a reload the admin shows what the
+transcript holds. The reader emits one message per JSONL event and the admin maps them
+one to one — nothing in this repository joins messages. The fused text has no separator
+at all ("Проверю:Ха!", "о себе.Skyhunter"), which is what plain concatenation of text
+blocks produces.
+
+Working conclusion: **the runtime persists one `assistant` event per turn, with the
+turn's text blocks concatenated**, while it emits them on the wire one by one. This must
+be confirmed by reading a real session JSONL for one of the screenshot conversations
+(first task). The app's own reload is not affected (it replays its local copy), but the
+app's chat history pages (`/chats/:id`) read the same transcript and are.
+
+### F7 — No stable message identity across live and replay — *Confirmed in code*
+
+The local echo id is `u-<Date.now()>` (app) or a random UUID (admin). The hub mints a
+different `messageId: randomUUID()` when forwarding to the agent
+(`bridle.gateway.ts:235`). The transcript's user event has its own `id`. Three ids for
+one message: a local copy can never be matched with its saved copy, which is the
+precondition for both "show it once" (FR-009) and "keep the unsent one after reload".
+Whether the runtime stores the hub's `messageId` as the event `id` is unknown — same
+JSONL inspection as F6.
+
+### F8 — Scrolling — *Confirmed in code*
+
+- Admin follows new content only when the reader is within 80 px of the bottom
+  (`Provider.vue:286-298`). Sending is treated like any other change, so sending while
+  scrolled up leaves the view where it was. This is the behaviour the request calls out.
+- App scrolls to the bottom on **every** change, including each streamed chunk
+  (`chat/Provider.vue:144-156`), which pulls a reader back down while they are reading
+  earlier messages.
+
+### F9 — Timestamps exist in the data and are not rendered — *Confirmed in code*
+
+Every message already has `ts` in both stores and in the transcript DTO. Neither
+`Message.vue` displays it.
+
+## Decisions
+
+### D1 — Order by sequence, display by time
+
+- **Decision**: The visible flow is ordered by a per-conversation **arrival sequence**
+  (`seq`) assigned by the store when an item is appended: messages and thinking blocks
+  alike. `ts` is kept for display only and never used for ordering. Replayed history is
+  taken in transcript (file) order and numbered from there. A thinking block is anchored
+  by `seq`, replacing the `Math.max(e.ts, lastTs + 1)` workaround.
+- **Rationale**: Arrival order at the client *is* the order the person experienced, it is
+  immune to clock skew, and it needs no server change. Removes F1 completely.
+- **Alternatives considered**: (a) normalise agent timestamps by an estimated clock
+  offset — fragile, still wrong for sub-second gaps; (b) have the hub stamp every event
+  with its own clock and sort by that — still loses to the browser-stamped local echo
+  unless the echo is re-stamped from the ack, and adds nothing `seq` does not give.
+- **Display time**: a person's message shows its local send time until the hub's ack
+  returns the server time, then shows that (so live and replay agree, FR-018).
+
+### D2 — Acknowledged sends with a client-generated id
+
+- **Decision**: The client generates `clientMessageId` (UUID) per message and sends it
+  with the `message` event using a socket.io acknowledgement callback. The hub replies
+  `{ status: 'accepted', messageId, ts }` once it has handed the message to a connected
+  agent socket, or `{ status: 'rejected', code }` (`AGENT_OFFLINE`,
+  `ATTACHMENT_FAILED`, `SHARE_REJECTED`). The hub forwards the **client's** id to the
+  agent as `messageId` instead of minting its own.
+- **Backward compatibility**: a client that passes no ack callback (embed widget, older
+  bundles) keeps today's behaviour, including the "Agent is not connected" message. New
+  clients get the rejection instead and never see that fake agent message.
+- **Rationale**: Smallest change that gives a truthful delivery state (F2) and one id
+  end to end (F7).
+- **Limit, stated plainly**: "accepted" means *handed to the agent's socket*, not
+  *written to the transcript*. The spec's definition of delivered is the latter. Closing
+  that gap needs the runtime to acknowledge persistence — see D6 / Open items. Until
+  then a message can in rare cases be "delivered" and still be missing after a reload
+  (agent crash between receive and write). The plan treats hub acceptance as delivered
+  and records this as a known gap rather than hiding it.
+- **Alternatives considered**: HTTP `POST /send` for delivery + socket for replies — a
+  bigger change to two clients and the embed contract, for the same guarantee.
+
+### D3 — Delivery state machine and a per-device outbox
+
+- **Decision**: States `sending → slow (5 s) → delivered | failed (30 s or rejected)`.
+  Messages that are not `delivered` are persisted per device: the app already persists
+  the conversation and gains a `delivery` field; the admin gains a small outbox in
+  `localStorage` keyed by agent + channel, merged under the transcript on load. On
+  reload, anything still `sending`/`slow` is shown as `failed` with Resend / Discard.
+- **Resend** re-emits with the **same** `clientMessageId` (see D4). No automatic resend,
+  per the spec.
+- **De-duplication on load (admin)**: an outbox entry whose id appears in the transcript
+  is dropped from the outbox. If the JSONL inspection shows the runtime does *not*
+  persist the forwarded id, the interim rule is: drop an outbox entry when a transcript
+  user message with identical text exists within ±2 minutes of its send time. That
+  heuristic is a stop-gap and is called out as such in tasks.
+
+### D4 — Idempotent receive in the hub
+
+- **Decision**: The hub remembers recently seen `clientMessageId`s per client
+  (in-memory, 10-minute TTL, bounded). A repeat is acknowledged
+  `{ status: 'accepted', duplicate: true }` and **not** forwarded again.
+- **Rationale**: Makes Resend safe when the original did arrive but its ack was lost
+  (FR-005).
+
+### D5 — Replay buffer for missed events, transcript as the safety net
+
+- **Decision**: The hub stamps every event it routes to a browser client with a
+  monotonically increasing per-client `seq` and keeps a bounded ring buffer of recent
+  events per client (last 500 events or 10 minutes, whichever is smaller). It buffers
+  even when the client is not currently registered. On (re)connect the client sends
+  `lastSeq` in the handshake; the hub replays everything after it before live traffic.
+  Clients stop force-closing turns on a transient disconnect; they close them only when
+  the watchdog expires or the replay says the turn ended.
+- **Safety net**: when the watchdog expires with a turn still open, the client fetches
+  the transcript tail and reconciles (admin already has the route; the app gains a
+  gateway method for the existing `GET /api/agent/:id/transcript`).
+- **Rationale**: Fixes F4 for both surfaces and for the landing → agent handoff, without
+  making the transcript a live data path.
+- **Constraint**: the hub is in-memory, so this assumes a single API instance — the same
+  assumption the hub's client and agent registries already make. Noted in the plan.
+- **Alternatives considered**: transcript polling only — slow, and useless for the app's
+  local-first history; persistent event store — out of proportion for this problem.
+
+### D6 — Message boundaries in the transcript
+
+- **Decision**: In this repository: the reader gains support for per-message assistant
+  events (it already emits one bubble per event, so this is mostly tests and a
+  tie-break on file order instead of `ts`). The **runtime** must persist one assistant
+  event per emitted message, with the wire `messageId` as the event id, and persist the
+  forwarded user `messageId` too. That change lives outside this repo and is tracked as
+  a dependency.
+- **Interim**: none that is honest. Text blocks concatenated without a separator cannot
+  be split back reliably. Existing fused conversations stay fused (already an assumption
+  in the spec).
+
+### D7 — Channel ownership by reference count (app), conversation-scoped state (admin)
+
+- **Decision (app)**: `connect`/`disconnect` become acquire/release with a reference
+  count per conversation key; the socket closes when the last holder releases, after a
+  short grace delay so a page-to-page handoff reuses the live socket. In-flight turn
+  state survives the handoff.
+- **Decision (admin)**: the singleton store's chat state becomes keyed by conversation
+  (agent + channel), mirroring the app store, so the Rancher panel and an agent tab no
+  longer share one message list and one socket.
+- **Rationale**: F5 and F3. The admin change is the largest single piece of work here;
+  it is also the precondition for the outbox and sequence numbers being per
+  conversation.
+
+### D8 — Scrolling
+
+- **Decision**: One rule in both surfaces: *sending* always scrolls to the bottom;
+  *incoming* content follows only a reader who is within 80 px of the bottom. The app's
+  unconditional scroll-on-every-chunk is replaced by the admin's near-bottom rule; the
+  admin gains the scroll-on-send.
+
+### D9 — Timestamps
+
+- **Decision**: Time of day under each message, a date separator between days, full
+  date-time in the `title` tooltip. Formatting via `Intl.DateTimeFormat` with the active
+  locale in the app (no new strings for the time itself); the admin uses `en`. New
+  wording (delivery states, Resend, Discard, date separators "Today"/"Yesterday") goes
+  through `docs/i18n.md`: keys in the slice's `en.json`, `bun run i18n:sync` for `ru`.
+
+### D10 — Testing
+
+- **Decision**: API changes are covered in the existing jest specs
+  (`bridleClientWs.handler.spec.ts`, `bridle.gateway.spec.ts`,
+  `transcriptReader.service.spec.ts`). `app/` and `admin/` have no test runner today
+  (`"test": "echo 'no tests yet'"`), so the logic that matters — sequencing, the
+  delivery state machine, outbox/transcript reconciliation, replay application — is
+  written as pure functions under each slice's `utils/` and covered with `bun test`,
+  which needs no new dependency (Bun is already the runtime). UI behaviour (scroll,
+  labels) is validated through `quickstart.md`.
+
+## Update 2026-09-18 — runtime source located
+
+The runtime is the sibling repository `CleanSlice/runtime` (the API already looks for it
+at `../runtime`, see `paddockRunner.resolveRuntimeRoot`). Read at `da3e74f`, not run:
+
+- **F6 confirmed in source.** `src/slices/runtime/loop/domain/loop.service.ts`
+  (`sendFinalResponse`) appends **one** `assistant` event per turn with
+  `data: { text: fullText }` — the text accumulated over the whole turn — while the
+  channel receives the pieces as separate messages. That is the fused bubble.
+- **F7 answered.** That event's `id` is a fresh `randomUUID()`, not the wire
+  `messageId`. Whether the `user` event keeps the forwarded `messageId` was not checked.
+- Open items 1 and 2 below are therefore mostly closed: slice 6 is a change in
+  `CleanSlice/runtime` (its own ticket/PR), and D3's interim text-match rule is needed
+  until that lands.
+
+## Update 2026-09-18 — experiments against the local stack
+
+Stack: API :3333, app :3000, admin :3001, local `CleanSlice/runtime` connected to the hub
+as `agent-bb620efe-…`. Method: a Node script using `socket.io-client`, logging in through
+`POST /auth/login` and connecting to `/ws/client` exactly as the browser does. The UI
+itself was not driven — ordering, scrolling, the landing handoff (F5) and the admin
+singleton (F3) are still unobserved in a browser.
+
+| # | Experiment | Result |
+|---|-----------|--------|
+| E1 | Send with a socket.io ack callback and a `clientMessageId` | Reply arrived in 1.2 s. **Ack callback never called** (waited 45 s). F2 reproduced. |
+| E2 | Compare ids for one exchange | Wire agent `messageId` `38379ecb…`; transcript `assistant` event id `f421a550…`; transcript `user` event id `51a748fc…`, its `data` holds only `text, from` — no message id at all. **Three unrelated ids. F7 reproduced**, and the runtime does not persist the forwarded id. |
+| E3 | Two connections of the same login; the **first** one sends | First connection received **nothing**. The second, which sent nothing, received `typing` and the answer. **New finding F10, reproduced.** |
+| E4 | Send, drop the socket 100 ms after `typing`, reconnect 25 s later, wait 25 s | **No events after reconnect.** The runtime's transcript contains the full 306-character answer. **F4 reproduced.** |
+| — | Clock skew on this machine | `ts` on agent events was within 1 ms of the local clock (same host), so F1 cannot show up locally without skewing the clock; it needs the browser scenario in quickstart. |
+
+### F10 — One registration per identity: a second view steals the first one's events — *Reproduced (E3)*
+
+The hub keeps exactly one socket per `clientId:agentId`
+(`BridleGateway.clients`, `registerClient` overwrites). And
+`clientIdFromJwtPayload` gives **every Owner and Admin the same `clientId`: `admin`**
+("they share one channel so their history lives in one place",
+`api/src/slices/bridle/domain/chatIdentity.ts:93`); other users get their `sub`.
+
+So the last view to connect receives everything and every earlier view silently receives
+nothing: a second tab, the admin panel next to the app console, a colleague who is also
+an admin opening the same agent, or a page that reconnected. For the view that lost, the
+turn looks exactly like the reports: the question is sent, the indicator spins, no answer
+arrives although the agent's log has it; the *other* view shows an answer to a question
+nobody asked there. This is very likely the most frequent cause of "зависает ответ" and
+of messages turning up in the wrong place, and it makes F4 worse (any reconnect
+elsewhere cuts this view off).
+
+Shared history for admins is a product decision and stays. What has to change is the
+delivery: fan out to **all** sockets registered for the identity.
+
+### D11 — Several sockets per identity (decision)
+
+- **Decision**: `clients` becomes `clientKey → Set<socket registration>`. Events for a
+  client are sent to every registered socket. The sequence and replay buffer (D5) stay
+  per `clientKey`; each socket reports its own `lastSeq`. `unregisterClient` removes one
+  socket; turn tracking is cleared when the last one leaves.
+- **Consequence for the person's own messages**: a message sent from view A is echoed by
+  the hub to the identity's *other* sockets as a new `user_message` event
+  (`{ messageId, text, attachments, ts, seq }`), so view B shows the question as well as
+  the answer instead of an orphan answer. View A ignores it by id.
+- **Rationale**: Required by FR-008 / FR-026; without it the ack and replay work would
+  still leave multi-view use broken.
+
+### F11 — Agent status disagrees between the list and the detail — *Confirmed in code*
+
+In the admin's agents screen the list (`workspace/Rail.vue`) renders the array loaded
+once by `useAsyncData('admin-agents', () => agentStore.fetchAll())` in
+`workspace/Provider.vue:12`. It is refreshed only after a delete; nothing polls it (the
+30-second timer there refreshes capacity only). The detail pane (`workspace/Main.vue`)
+loads its own copy with `fetchById`, refreshes it through `useAgentLifecycle` and also
+reads the live status stream (`useAgentStatusStore().agents[id]`). `fetchById` does not
+write its result back into `agentStore.agents`. So the list keeps whatever status it saw
+at load time — "Deploying" — while the detail moves on to "Failed".
+
+### D12 — Single source of truth (SSOT) for agents (decision, revised on request)
+
+*Direction from the request: "используй SSOT для таких проблем чтобы не возвращаться к
+ним" — fix the class of defect, not the one screen.*
+
+The defect is not "the list is not refreshed"; it is that **the same agent exists as
+several independent copies**: the list array from `fetchAll`, a `useAsyncData` copy per
+detail component from `fetchById` (`workspace/Main.vue`, `edit/Provider.vue`,
+`agentFile/Provider.vue`; in the app `agent/Provider.vue`, `agent/chat/Provider.vue`),
+the live copy in `agentStatusStore.agents`, and optimistic edits applied to a local ref
+in `useAgentLifecycle`. Any of them can move on without the others.
+
+- **Decision**: An agent lives **once**, in `agentStore.agents`. Rules, in both `admin/`
+  and `app/`:
+  1. Every read that returns an agent writes it into the store: `fetchAll` replaces the
+     collection, `fetchById` / create / update / restart **upsert** by id.
+  2. Components render from the store by id (`agentStore.byId(id)`), never from the
+     value a fetch returned. `useAsyncData` is kept for SSR and `pending`/`error`, not
+     as the render source.
+  3. Pushes write into the same record: the status stream's `applyMessage` patches
+     `agentStore` instead of holding a parallel `agents` map.
+  4. Optimistic changes go through one store action (`patch(id, partial)`) with rollback,
+     not through a component-local ref.
+- **Result**: the list row, the header and the Overview card are the same object; they
+  cannot disagree, and a future screen that shows an agent gets this for free.
+- **Also to check**: `useAgentLifecycle` notes that the backend reconciles status on each
+  `fetchById` ("Backend syncStatus runs on each fetchById"). If the list endpoint does
+  not reconcile, a non-selected agent's row depends on the stream alone — verify, and
+  make sure the stream covers every listed agent.
+- **Written down so it sticks**: a short rule in `docs/` linked from `AGENTS.md`.
+- **Alternatives considered**: polling `fetchAll`, or overlaying the stream on the list
+  in the rail only — both patch this screen and leave the duplicated state that caused
+  it.
+- The chat work follows the same principle: one conversation record per key in the store
+  (D7), one id per message (D2), one ordering key (D1).
+- **Scope note**: this is unrelated to the chat code. It is included in this feature on
+  request; it is a small, separate slice and could equally ship as its own PR.
+
+### F12 — Server side of F11 (T051) — *Confirmed in code and against the running API*
+
+- **The database does not stay stale.** `AgentStatusService.detectDrift` runs every 30 s
+  over *every* agent (`api/src/slices/agent/agent/domain/agentStatus.service.ts`, the
+  `for (const agent of agents)` loop) and writes the startup timeout itself — the exact
+  reason in the screenshot, "startup did not produce a running agent within 5 minutes".
+  Pod events reconcile every agent too. `syncStatus` in `agent.controller.ts` (the
+  "runs on each fetchById" path) only adds an *earlier* `failed` when the deploy workflow
+  ends in a terminal phase; without it the sweep gets there after the grace window.
+- **The stream did not say so.** `stream$()` emitted on pod events and hub
+  connect/disconnect only. The sweep's DB-only transitions (no pod → `failed`,
+  `unreachable`) and `syncStatus`'s write have no such event behind them, so a list
+  never heard about them. Fixed: every status write in the service goes through
+  `writeStatus`, which feeds a `statusWrites$` subject merged into the stream as a
+  `modified` frame; `syncStatus` calls `notifyStatusChanged`. Spec:
+  `agentStatus.service.spec.ts`.
+- **And the admin was not listening at all.** The response interceptor wraps SSE
+  emissions as well, so a frame arrives as `{ "data": { "type": … } }`;
+  `AgentStatusMapper.toStreamMessage` read `type` off the wrapper and returned `null`
+  for every frame (checked by piping a live frame from `:3333` through the mapper). The
+  indicator still said "Live" because `onopen` fires. Every "live-first" fallback in the
+  admin was therefore always falling through to the fetched copy. The mapper now accepts
+  both shapes.
+- **Also found**: the REST `AgentMapper` did not know the `unreachable` status and decoded
+  it as `pending`; and a pod `deleted` event means the *pod* went away, not the agent —
+  the record must stay (T047's "remove the record on `deleted`" would have dropped
+  agents on every restart).
+
+### Local-environment note
+
+On this Windows machine the runtime writes the session to `data/sessions/bridle:admin.jsonl`;
+NTFS treats the colon as an alternate data stream, so the file appears as an empty
+`bridle` with a stream `admin.jsonl`. The API's transcript route reads through the file
+gateway and returned 0 messages locally. **Reload-from-transcript scenarios (US3, and the
+admin's reload in general) cannot be validated on this local setup as it stands**; they
+need the cluster or a non-Windows runtime.
+
+## Open items
+
+1. **Read a real session JSONL** for one of the screenshot conversations to confirm F6
+   and answer F7 (does the runtime store the forwarded `messageId`?). Blocks the final
+   shape of D3's de-duplication and D6.
+2. **Where the agent runtime's source lives and who changes it** — needed for D6 and for
+   a persistence-level delivery ack (D2's stated gap). Not discoverable from this repo.
+3. **Reproduce F5 and F3** in a running stack before and after the fix; they are the two
+   hypotheses in this document.
+4. **API replica count in production** — D5 assumes one instance.
+
+## Update 2026-09-18 — results after the fix
+
+Same local stack (API :3333, admin :3001, app moved to :3002 because the runtime took
+:3000 after a restart). Tools: `probe.mjs` (scripted socket client) and the headless
+Chrome checks in `e2e/`. "Before" for E1–E4 is the table above; the browser scenarios
+were **not** run against the old code, so for ordering and scrolling the "before" rests on
+the code reading (F1, F8) plus the screenshots in the request, not on an observed failure.
+
+### Hub, scripted client
+
+| Check | Before | After |
+|---|---|---|
+| `probe.mjs normal` — delivery ack | never called (45 s) | `{"status":"accepted","messageId":"probe-…","ts":…}` after 3 ms; every routed event carries `seq` |
+| `probe.mjs steal` — two sockets, the first one sends | sender got nothing, the other got the answer | both got `typing` + `stream_end` with equal `seq`; the other socket also got `user_message` |
+| `probe.mjs gap` — socket dropped after `typing`, reconnect 25 s later with `lastSeq` | no events after reconnect | `stream` + `stream_end` replayed immediately (the answer was 23 s old) |
+| `probe.mjs offline` | — | **not exercised live**: the agent reconnected before the send, and stopping the requester's runtime was not mine to do. Covered by jest (`rejects instead of faking an agent reply…`, `keeps the synthetic reply for callers that send no id`). |
+
+jest: `src/slices/bridle` + `src/slices/agent` — all suites pass (545 tests in the first
+run of bridle + peer; 416 in agent; 55 in transcript reader + chat history).
+
+### Browser, headless Chrome (`e2e/chat.mjs`), page clock +2 minutes
+
+| Check | admin | app |
+|---|---|---|
+| question rendered above its answer | pass | pass |
+| question appears once, state `delivered` | pass | pass |
+| every bubble shows a time | pass | pass |
+| message, order and times survive a reload | n/a locally (see below) | pass |
+| sending from the top scrolls to the bottom | pass | pass |
+| incoming content does not pull a reader who scrolled up | pass | pass |
+| question asked in a second tab shows here once, with its answer | pass | pass |
+
+`e2e/leave.mjs` (app): leave the agent page 1.2 s into an answer, return after 1.5 s
+(inside the 3 s grace close) and after 8 s (socket closed, answer recovered by `lastSeq`
+replay) — question once, delivered, answer once, no "Reconnecting…" in both runs.
+
+`e2e/status.mjs` (admin): list row and header both show `Running`; the status stream
+answers 200 and, since the mapper fix (F12), its frames decode. **Not exercised**: a live
+`deploying → failed` transition in the browser — it needs a deploy that fails, which was
+not staged. The server side of it is covered by the two new jest cases in
+`agentStatus.service.spec.ts`.
+
+### Still not observed
+
+- **Landing page → agent page (F5).** This stack has no featured public agent, so the
+  landing page renders no chat (`e2e/handoff.mjs` skips). The mechanism — two providers
+  sharing one channel key across a route change — is what `leave.mjs` exercises, but the
+  exact landing flow is unverified.
+- **Admin reload from the transcript, and US3 (bubbles after reload).** On this Windows
+  machine the runtime writes the session into an NTFS alternate data stream and the API
+  reads 0 messages, so the admin chat is empty after any reload here. The reader is
+  covered by `transcriptReader.bubbles.spec.ts` and the runtime by
+  `loop.bubbles.spec.ts`; the two have **not** been run together. Needs the cluster, with
+  the runtime image built from `fix/CLEAN-102-transcript-per-message`.
+- **Not-delivered UI in a browser** (agent stopped → "Not delivered", Resend, Discard,
+  reload). Logic covered by `delivery.test.ts` in both clients and by the agents' store
+  tests, which were run and then deleted rather than kept.
+- **Admin: Rancher panel + agent Chat tab together (F3).** The store is per conversation
+  now; the two-chats-at-once scenario itself was not driven.
+
+### Found along the way
+
+- **F12 (SSOT track): the admin never decoded a status-stream frame.** The API wraps SSE
+  payloads in its response envelope; `AgentStatusMapper.toStreamMessage` read `type` off
+  the wrapper and returned `null` for every frame, while the "Live" dot stayed green
+  because `onopen` still fired. The REST mapper also decoded `unreachable` as `pending`,
+  and the API never pushed DB-only transitions (`failed` by startup timeout,
+  `unreachable`) to the stream. All three are fixed; together with the duplicated agent
+  copies they are why the list said "Deploying".
+- **Runtime design correction.** D6 proposed one `assistant` event per bubble. That would
+  have changed the history every LLM provider builds prompts from (an assistant text
+  message in front of each tool call, across four provider adapters). Implemented
+  instead: the turn stays one event, `data.text` untouched, plus display-only
+  `data.messages: [{ id, text, ts }]`.
+- **An accident worth recording.** `bun run test` in `api/` runs `prisma generate` in
+  `pretest`; with the dev API running on Windows that half-wrote the Prisma client and the
+  watching API crashed, taking `turbo dev` (app + admin) down with it. Regenerated and
+  restarted; specs are now run with jest directly.
diff --git a/specs/015-chat-message-reliability/spec.md b/specs/015-chat-message-reliability/spec.md
new file mode 100644
index 00000000..fa24b939
--- /dev/null
+++ b/specs/015-chat-message-reliability/spec.md
@@ -0,0 +1,433 @@
+# Feature Specification: Chat message reliability — nothing lost, nothing doubled, same after reload
+
+**Feature Branch**: `015-chat-message-reliability` (git: `fix/CLEAN-102-chat-message-reliability`, Jira: CLEAN-102)
+
+**Created**: 2026-09-18
+
+**Status**: Draft
+
+**Input**: User description: "Необходимо решить проблему с чатом, где возникают артефакты в виде неправильной группировки сообщений, иногда они просто исчезают, когда задал вопрос на главной странице, перешел в агента и этого сообщения нет, иногда возникало такое что сообщение просто проглатывалось после перезагрузки страницы и все, приходится писать заново. Иногда сообщения дублируются. Нужно отображать время когда было отправлено сообщение. Если оно было отправлено но не доставлено, из-за чего исчезнет после обновления страницы, это нужно помечать под самим письмом, загрузку, если слишком долго доставляется. Иногда зависает ответ, хотя в логах он уже отображается. Агент может писать разными сообщениями, а после перезагрузки ломается форматирование и все в один пузырь накладывается. Сообщение почему-то мое опускается, хотя сначала пишу я, а потом ответ агента."
+
+## Evidence from the screenshots *(context, supplied with the request 2026-09-18)*
+
+Four screenshots came with the request. What they show, as observed:
+
+- **Live turn, correct** (admin, "Chat with Rancher"): the agent answers in several
+  separate bubbles, each followed by its own "Thought for a moment" step, with the
+  person's question sitting between them where it was asked.
+- **Same kind of turn after a reload, broken** (admin, two screenshots): the agent's
+  separate messages are fused into one bubble with no break between them — "Проверю:Ха!
+  **Работает!**", "Попробую с токеном:✅ **Хост доступен**", "…с полной информацией о
+  себе.Skyhunter сообщает…". The thinking steps that separated them are gone.
+- **Wrong order and a duplicate** (app console, conversation started from the home
+  page): the person's question "Спроси у Elderly Care Match: assisted living near
+  Seattle, WA" appears first, then the agent's greeting "Access granted! Send me a
+  message." and its first reply, and then **the same question again**, below the reply
+  it caused.
+
+Reported without a screenshot: a question asked on the home page is missing once the
+agent chat opens; a sent message is gone after a reload and has to be typed again; the
+reply stays on "thinking" although the agent's logs already contain the answer. None of
+these has been reproduced on demand yet — all are described as "sometimes".
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - What I sent is never silently lost (Priority: P1)
+
+A person types a question — on the home page or in an agent's chat — and sends it. From
+that moment the message is theirs to keep: it is visible in the conversation it belongs
+to, it survives moving from the home page into the agent's chat, and it survives a page
+reload. If the agent never received it, the message is still there, says so, and can be
+sent again without retyping.
+
+**Why this priority**: Losing what a person wrote is the most damaging failure in a
+chat: it costs the work of writing it again and removes any reason to trust the
+conversation. Every other story assumes the message exists.
+
+**Independent Test**: Send a question from the home page and confirm it is the first
+message in the agent chat that opens. Send a message in an agent chat, reload
+immediately, and confirm it is still there. Send a message while the agent is
+unreachable, reload, and confirm the text is still there, marked as not delivered, with
+a way to resend.
+
+**Acceptance Scenarios**:
+
+1. **Given** a person on the home page, **When** they send a question and are taken to
+   the agent's chat, **Then** that question is shown in the chat exactly once, before
+   any agent reply to it.
+2. **Given** a message that the agent has received, **When** the person reloads the page
+   at any moment afterwards — including while the agent is still answering —, **Then**
+   the message is shown in the same place in the conversation.
+3. **Given** a message that was sent but never reached the agent, **When** the person
+   reloads the page on the same device, **Then** the text is not lost: it is shown as not
+   delivered and can be resent in one action, without retyping.
+4. **Given** a not-delivered message, **When** the person resends it and it is received,
+   **Then** it becomes an ordinary delivered message and appears once.
+5. **Given** a not-delivered message, **When** the person chooses to discard it,
+   **Then** it is removed and does not come back after a reload.
+
+---
+
+### User Story 2 - The conversation reads in the order it happened, each message once (Priority: P1)
+
+A person reads a conversation top to bottom and it matches what happened: their question
+comes before the reply it caused, a greeting the agent sent before the question comes
+before the question, and no message — theirs or the agent's — appears twice.
+
+**Why this priority**: A conversation in the wrong order or with repeats cannot be read
+or quoted, and a doubled question looks like it was sent twice (and may make the person
+wonder whether the agent acted on it twice).
+
+**Independent Test**: Run a scripted conversation — greeting, question from the home
+page, multi-message reply, follow-up question sent while the agent is still answering —
+and compare the displayed sequence with the sequence of events, live and after a reload.
+
+**Acceptance Scenarios**:
+
+1. **Given** a person sends a question and the agent replies, **When** the conversation
+   is displayed, **Then** the question is above the reply, live and after a reload.
+2. **Given** a conversation opened from the home page where the agent also sends a
+   greeting, **When** it is displayed, **Then** greeting, question and reply each appear
+   once, in the order they actually happened.
+3. **Given** a connection that drops and recovers in the middle of a turn, **When** the
+   chat catches up, **Then** no message already on screen is shown a second time.
+4. **Given** the same conversation open in two tabs, **When** a message is sent from
+   one, **Then** each tab shows it once.
+5. **Given** a person sends a follow-up while the agent is still answering, **When** the
+   turn completes, **Then** the follow-up stays where it was sent relative to the agent
+   messages that came before and after it.
+6. **Given** a person has scrolled up to re-read earlier messages, **When** they send a
+   message, **Then** the view scrolls to the bottom so the message they just sent is
+   visible — the usual chat behaviour.
+7. **Given** a person has scrolled up and has not sent anything, **When** the agent's
+   messages or thinking steps arrive, **Then** the view stays where the person left it.
+
+---
+
+### User Story 3 - A reloaded conversation looks like the one I watched (Priority: P2)
+
+A person watches an agent work through a task: several separate messages, with thinking
+steps between them. After a reload, or when opening the conversation later from the chat
+history, they see the same thing — the same number of agent messages, split in the same
+places, with the same formatting.
+
+**Why this priority**: History is how people return to an answer and how operators
+review what an agent did. Today a reload glues messages together and destroys the
+paragraph breaks, so the saved conversation is harder to read than the live one and
+looks like a different answer.
+
+**Independent Test**: Have an agent answer in at least three separate messages with
+formatted content (list, inline code, bold). Record the live view, reload, open the same
+conversation from history, and compare message count, boundaries and formatting.
+
+**Acceptance Scenarios**:
+
+1. **Given** an agent turn that produced N separate messages, **When** the conversation
+   is reloaded or opened from history, **Then** it shows N separate agent messages with
+   the same text in each.
+2. **Given** an agent message containing lists, inline code, bold text or line breaks,
+   **When** the conversation is reloaded, **Then** the formatting is the same as it was
+   live, and no two sentences that were in different messages run together.
+3. **Given** a turn where thinking steps were shown between agent messages, **When** the
+   conversation is reloaded, **Then** the messages stay separate where those steps were;
+   whether the steps themselves are shown again is covered under Assumptions.
+4. **Given** a conversation reloaded while the agent is still answering, **When** the
+   rest of the answer arrives, **Then** it continues as further messages in the same
+   turn rather than restarting, doubling or merging into an earlier bubble.
+
+---
+
+### User Story 4 - The answer shows up when the agent has answered (Priority: P2)
+
+When the agent has finished answering, the person sees the answer. The chat does not
+stay on "thinking" after the agent is done, and when something really has gone wrong the
+person is told, instead of watching an indicator that will never finish.
+
+**Why this priority**: A reply that exists but is not shown is indistinguishable from an
+agent that failed; people reload, resend and create the duplicates above. It ranks below
+the first two stories because a reload currently recovers the answer, whereas lost and
+doubled messages are not recoverable by the person.
+
+**Independent Test**: Trigger turns of different lengths, including one where the
+connection is interrupted just before the agent finishes, and check that the answer
+appears without a manual reload and the thinking indicator ends.
+
+**Acceptance Scenarios**:
+
+1. **Given** the agent has completed its answer, **When** the completion was missed by
+   the open chat (for example because the connection dropped for a moment), **Then** the
+   chat recovers the answer on its own and shows it without a manual reload.
+2. **Given** a turn that ends in an error on the agent's side, **When** this happens,
+   **Then** the thinking indicator stops and the person sees that the turn failed.
+3. **Given** a turn that is legitimately long, **When** the person waits, **Then** the
+   chat keeps showing that the agent is working and does not declare a failure while
+   progress is still arriving.
+
+---
+
+### User Story 5 - I can see when a message was sent and whether it got through (Priority: P2)
+
+Every message shows the time it was sent. Under their own messages a person can tell
+the state at a glance: still sending, taking unusually long, delivered, or not delivered.
+Delivered is the quiet default; the states that need attention are the ones that stand
+out.
+
+**Why this priority**: This is the new capability in the request and it is what turns
+the failures above from silent into visible. It comes after the fixes because marking a
+lost message is a poor substitute for not losing it, but it is what lets a person act
+when delivery does fail.
+
+**Independent Test**: Send messages under normal conditions, under a slow connection and
+with the agent unreachable, and check the time and the state shown under each, live and
+after a reload.
+
+**Acceptance Scenarios**:
+
+1. **Given** any message in a conversation, **When** it is displayed, **Then** the time
+   it was sent is visible with it, in the viewer's local time, and the date is
+   recognisable for messages from earlier days.
+2. **Given** a message the person has just sent, **When** delivery takes longer than the
+   "slow" threshold, **Then** a loading state appears under that message until it is
+   delivered or marked not delivered.
+3. **Given** a message that did not reach the agent within the "failed" threshold or was
+   rejected, **When** this is determined, **Then** "not delivered" is shown under that
+   message together with the way to resend it.
+4. **Given** a delivered message, **When** the conversation is reloaded, **Then** its
+   time is unchanged — the time shown is when it was sent, not when the page was loaded.
+5. **Given** the app console in Russian, **When** times and states are shown, **Then**
+   the wording is localised; the admin panel stays in English.
+
+---
+
+### User Story 6 - An agent shows the same status everywhere (Priority: P3)
+
+*Added 2026-09-18 on request, with a screenshot: the admin's agent list shows Rancher as
+"Deploying" while the same agent's header and Overview, on the same screen, show
+"Failed — startup did not produce a running agent within 5 minutes".*
+
+An operator looking at the agents screen sees one status per agent. When an agent's
+status changes — deploying to running, deploying to failed, running to stopped — every
+place on screen that shows that agent's status changes with it, without a reload.
+
+**Why this priority**: It is not a chat defect, but it undermines the same trust: an
+operator watching the list waits for a deploy that has already failed. It is ranked
+last because the correct status is visible one click away and nothing is lost.
+
+**Independent Test**: Start a deploy that will fail (or succeed) and keep the agents
+screen open with that agent selected. Compare the status in the list row, the header and
+the Overview card at the moment the status changes and one minute later.
+
+**Acceptance Scenarios**:
+
+1. **Given** the agents screen open with an agent in "Deploying", **When** the deploy
+   fails or completes, **Then** the list row, the header and the Overview card show the
+   new status within the same few seconds, without a reload.
+2. **Given** an agent that is not the selected one, **When** its status changes,
+   **Then** its row in the list reflects the change without the operator opening it.
+3. **Given** a status with a reason (for example the start-up timeout), **When** it is
+   shown in the list, **Then** the reason is available there too.
+
+---
+
+### Edge Cases
+
+- The person sends a question from the home page, and the agent is starting up or
+  unreachable: the question must be waiting in the agent chat, marked according to its
+  real state, not dropped.
+- The person sends, then reloads before any confirmation arrives: after the reload the
+  message is either shown as delivered (it did arrive) or as not delivered — never both,
+  never neither.
+- A resend races with a late confirmation of the original: the agent must not receive or
+  act on the same message twice, and the conversation shows it once.
+- The device clock is wrong or differs from the agent's: order must still follow what
+  actually happened, not the device clock.
+- Two messages are sent within the same second: both are kept, in send order.
+- The agent sends an empty or whitespace-only message between two real ones: it must not
+  create an empty bubble, and must not cause its neighbours to merge.
+- A message carries attachments: the delivery state and the resend action cover the
+  message together with its files.
+- A very long conversation is loaded in pages: grouping and order stay correct across
+  the page boundary, and a message on the boundary is not duplicated.
+- A not-delivered message is kept on one device and the person opens the conversation on
+  another: the other device shows only what the agent received (see Assumptions).
+- Conversations saved before this change, where messages were already fused: see
+  Assumptions.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+**Keeping what was sent**
+
+- **FR-001**: A message sent from the home page MUST appear in the agent chat that opens
+  for it, exactly once, positioned before any agent reply to it.
+- **FR-002**: A message the agent has received MUST be shown in the conversation after
+  any page reload, including a reload during the agent's answer.
+- **FR-003**: A message that was sent but has not been confirmed as received MUST be
+  retained on the sending device across reloads until it is delivered or the person
+  discards it.
+- **FR-004**: A person MUST be able to resend a not-delivered message in one action,
+  with its text and attachments intact, and MUST be able to discard it.
+- **FR-005**: Resending MUST NOT result in the agent handling the same message twice,
+  even if the original turns out to have been received.
+
+**Order and uniqueness**
+
+- **FR-006**: Messages MUST be displayed in the order the events happened in the
+  conversation, and this order MUST be the same live and after a reload.
+- **FR-007**: The displayed order MUST NOT depend on the clock of the viewer's device.
+- **FR-008**: Each message MUST be displayed at most once per conversation view,
+  including after reconnects, catch-up after a dropped connection, paged loading of
+  older history, and when the conversation is open in several tabs.
+- **FR-009**: A message the person sent MUST be recognised as the same message when the
+  saved conversation is loaded, so that the local copy and the saved copy never appear
+  side by side.
+
+**Same conversation after reload**
+
+- **FR-010**: Separate agent messages within one turn MUST remain separate when the
+  conversation is reloaded or opened from history, with the same boundaries as live.
+- **FR-011**: The text and formatting of each message MUST be the same live and after a
+  reload; text from different messages MUST NOT be joined without a break.
+- **FR-012**: When a conversation is reloaded during an agent's answer, the remainder of
+  the answer MUST continue the same turn without duplicating or merging with messages
+  already shown.
+- **FR-013**: Empty agent messages MUST NOT be rendered and MUST NOT change how
+  neighbouring messages are grouped.
+
+**Answers that arrive**
+
+- **FR-014**: When the agent has completed an answer and the open chat has not shown it,
+  the chat MUST obtain and display it without the person reloading, within the recovery
+  time in SC-005.
+- **FR-015**: The thinking indicator MUST end when the turn ends — by completion, by
+  failure or by cancellation — and a failed turn MUST be shown to the person as failed.
+- **FR-016**: A long-running turn MUST NOT be reported as failed while progress from the
+  agent is still arriving.
+
+**Time and delivery state**
+
+- **FR-017**: Every message, from the person and from the agent, MUST show the time it
+  was sent, in the viewer's local time; messages from earlier days MUST be attributable
+  to their date.
+- **FR-018**: The time shown for a message MUST be stable: the same value live, after a
+  reload and in the chat history.
+- **FR-019**: Under each of the person's own messages the chat MUST be able to show one
+  of: sending, slow (loading shown because delivery is taking longer than usual),
+  delivered, not delivered. "Delivered" MAY be shown unobtrusively or implied by the
+  absence of any other state.
+- **FR-020**: The loading state MUST appear once delivery has taken longer than the
+  "slow" threshold, and the message MUST be marked not delivered once the "failed"
+  threshold passes or delivery is rejected (defaults under Assumptions).
+- **FR-021**: The not-delivered mark MUST be placed under the message it refers to, and
+  MUST make clear that the message will not be kept by the agent unless resent.
+
+**Scrolling**
+
+- **FR-024**: Sending a message MUST scroll the conversation to the bottom, wherever the
+  person was scrolled to, so that the message they sent is in view.
+- **FR-025**: Incoming content (agent messages, streamed text, thinking steps) MUST keep
+  the view pinned to the bottom only for a person who is already at the bottom; it MUST
+  NOT pull back a person who scrolled up to read. This holds in both surfaces.
+
+**Several views of one conversation**
+
+- **FR-026**: When the same person has the same conversation open in more than one
+  place — two tabs, the admin panel and the app console, a second device — every open
+  view MUST receive the agent's messages. Opening a second view MUST NOT stop the first
+  one from receiving them.
+
+**Agent status consistency (admin)**
+
+- **FR-027**: Every place in the admin that shows an agent's status MUST show the same
+  value, and MUST reflect a status change within 10 seconds without a reload — including
+  list rows for agents other than the selected one.
+
+**Scope**
+
+- **FR-022**: All of the above MUST hold in every place the product shows a live agent
+  chat: the admin panel's chats with Rancher and with agents, and the app console's
+  agent chat including conversations started from the home page.
+- **FR-023**: New user-visible wording in the app console MUST be available in every
+  language the console supports; the admin panel remains English-only.
+
+### Key Entities
+
+- **Conversation**: one continuous exchange between a person and an agent; has an
+  ordered sequence of messages and may be viewed live or from history.
+- **Message**: one bubble's worth of content from the person or the agent. Has a stable
+  identity that is the same live and in the saved conversation, an author, content with
+  formatting, optional attachments, the time it was sent, and a position in the
+  conversation's order.
+- **Turn**: the person's message plus everything the agent produced in response —
+  possibly several agent messages with thinking steps between them. Has a state:
+  running, completed, failed or cancelled.
+- **Delivery state**: for a person's message — sending, slow, delivered, not delivered.
+- **Unsent message**: a person's message retained on their device because delivery was
+  never confirmed; can be resent or discarded.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: In 100 scripted sends across the covered chats — including sends from the
+  home page and sends followed by an immediate reload — zero messages are lost: each one
+  is visible afterwards either as delivered or as not delivered with its text intact.
+- **SC-002**: In the same run, and in runs with the connection interrupted mid-turn,
+  zero messages are displayed twice.
+- **SC-003**: For 20 scripted conversations including multi-message agent turns, the
+  sequence of messages shown after a reload is identical to the sequence shown live:
+  same count, same order, same boundaries, same formatting.
+- **SC-004**: A person's question is never displayed below the agent reply it caused —
+  zero occurrences in the scripted conversations, including those started from the home
+  page.
+- **SC-005**: When an agent has finished answering, the answer is visible in an open
+  chat within 10 seconds in at least 99% of turns, and in 100% of turns without a manual
+  reload.
+- **SC-006**: Every message in the covered chats shows its sent time, and that time is
+  identical before and after a reload.
+- **SC-007**: When a message cannot be delivered, the person sees the not-delivered mark
+  under it within 35 seconds of sending, and can resend it in one action without
+  retyping.
+- **SC-009**: With one conversation open in two views, 100% of agent messages appear in
+  both views.
+- **SC-010**: After an agent's status changes, no two places on the admin's agents screen
+  disagree about it for longer than 10 seconds.
+- **SC-008**: People no longer need to retype a message because the chat lost it: zero
+  such reports in the two weeks after release, against the recurring reports that
+  prompted this work.
+
+## Assumptions
+
+- **Both surfaces are in scope.** The screenshots show the admin panel ("Chat with
+  Rancher") and the app console (Russian "Немного подумал", home-page flow), and they
+  share the same chat behaviour, so the fix covers both. Read-only transcript viewers in
+  the chat history are in scope only for User Story 3 and the sent time.
+- **Thresholds.** "Slow" is 5 seconds without confirmation; "not delivered" is 30
+  seconds without confirmation, or an explicit rejection. These are starting values to
+  be tuned during planning, not contractual numbers beyond SC-007.
+- **"Delivered" means received by the agent's side and saved to the conversation** — the
+  point after which a reload will show the message. It does not mean the agent has read
+  or answered it.
+- **Unsent messages are kept per device.** A message that never reached the agent exists
+  only on the device that wrote it; another device shows the conversation as the agent
+  knows it. Syncing unsent messages between devices is out of scope.
+- **No automatic resend.** A not-delivered message is resent by the person, not silently
+  by the chat, so that an agent never acts on something the person has given up on.
+  Re-establishing the connection and catching up on the agent's answer is automatic.
+- **Thinking steps after reload.** Whether the collapsed "Thought for a moment" steps
+  are shown again in a reloaded conversation is existing behaviour and is not changed
+  here; what this work guarantees is that messages stay split where those steps were.
+- **Time format.** Time of day under each message, with a date separator between days;
+  the full date and time are available on demand (for example on hover). Relative times
+  ("5 min ago") are not required.
+- **Existing conversations.** Conversations saved before this change whose agent
+  messages were already stored fused together are not repaired retroactively unless the
+  original boundaries can be recovered at no extra cost; the guarantees apply to
+  conversations and turns created after release.
+- **Other channels are out of scope.** Telegram and other messenger channels have their
+  own delivery model (see `003-telegram-restart-recovery`) and are not changed here.
+- **Root causes are not yet established.** All failures are reported as intermittent.
+  Planning starts with reproducing each one; if a reported symptom turns out to have a
+  cause outside the chat (for example agent start-up, covered by
+  `001-stabilize-agent-startup`), it is tracked there and referenced from this feature.
diff --git a/specs/015-chat-message-reliability/tasks.md b/specs/015-chat-message-reliability/tasks.md
new file mode 100644
index 00000000..a59f4b30
--- /dev/null
+++ b/specs/015-chat-message-reliability/tasks.md
@@ -0,0 +1,255 @@
+---
+
+description: "Task list for chat message reliability (CLEAN-102)"
+---
+
+# Tasks: Chat message reliability — nothing lost, nothing doubled, same after reload
+
+**Input**: Design documents from `/specs/015-chat-message-reliability/`
+
+**Prerequisites**: [plan.md](./plan.md), [spec.md](./spec.md), [research.md](./research.md),
+[data-model.md](./data-model.md), [contracts/bridle-socket.md](./contracts/bridle-socket.md),
+[quickstart.md](./quickstart.md)
+
+**Branch / ticket**: `fix/CLEAN-102-chat-message-reliability` · CLEAN-102
+
+**Tests**: No test-first mandate. Direction from the request: *"тести как удобно, лишь
+выявить причину и исправить дефект"*. Each story ends with a **Verify** task that uses
+whatever is quickest for that defect — the scripted socket probe, a jest spec next to the
+hub code, `bun test` for a pure function, or a headless browser script. A defect counts as
+fixed only when its verify task was run and the result written into `research.md`.
+
+**SSOT**: Direction from the request — fix duplicated state at the source so the class of
+defect does not return (research D12). It shapes Phase 2 (one conversation record per key)
+and Phase 8 (one agent record per id), and is written down as a project rule in T053.
+
+**Organization**: Grouped by user story. US2 comes before US1 although both are P1: it has
+no API dependency, is the smallest change, and removes the artifact asked about first
+(wrong order).
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: can run in parallel (different files, no dependency on an unfinished task)
+- **[Story]**: US1–US6 from spec.md
+- Paths are relative to the repository root
+
+## Local stack (for every Verify task)
+
+API `http://localhost:3333`, app `:3000`, admin `:3001`, local `CleanSlice/runtime`
+connected as `agent-bb620efe-abb5-4123-8ace-6d9b963387c7`; login `RANCH_LOGIN` /
+`RANCH_PASS` from `.env.project` (never print them). Every Owner/Admin login shares the
+chat identity `admin`, so a probe run steals events from an open admin tab until T010
+lands — reload that tab afterwards.
+
+---
+
+## Phase 1: Setup
+
+**Purpose**: Tools to reproduce and verify; nothing user-visible.
+
+- [X] T001 Save the scripted socket client used for research E1–E4 as `specs/015-chat-message-reliability/probe.mjs`: modes `normal` (send with ack callback + `clientMessageId`, log every event with `messageId`, `seq`, clock skew), `steal` (two sockets, first one sends, report what each received), `gap` (drop the socket after the first `typing`, reconnect after 25 s, report events), new mode `offline` (send while the agent is disconnected, print ack and any synthetic agent message). Read `API_URL`, `AGENT_ID` from env with the local defaults above; read credentials from `.env.project`; resolve `socket.io-client` via `createRequire` from the repo root; print no secrets.
+- [X] T002 [P] Replace the placeholder test scripts with `"test": "bun test slices"` in `app/package.json` and `admin/package.json` so pure-function tests under `slices/**/utils/*.test.ts` run with `cd app && bun test` / `cd admin && bun test`.
+- [X] T003 [P] Create a headless browser harness `specs/015-chat-message-reliability/e2e/chat.e2e.mjs` run with `bunx playwright` (install browsers on first run; do **not** add Playwright to any `package.json`): helpers to log in to the app (`:3000`) and the admin (`:3001`), open an agent chat, send a message, read the rendered bubbles in DOM order (role + text + time), read scroll position, and start a page with a skewed clock (`addInitScript` overriding `Date.now` by +120 000 ms). If Playwright cannot be installed on this machine, record that in `research.md` and fall back to the manual steps in `quickstart.md`.
+- [ ] T004 With T003 (or by hand), observe the four defects not yet seen in a browser and write what happened under a new "Observed in browser" heading in `specs/015-chat-message-reliability/research.md`: F1 (reply above question with the clock +2 min), F8 (no scroll on send in admin; forced scroll on every chunk in app), F5 (landing hero chat → agent page: does the chat stay connected, does the answer arrive), F3 (admin: Rancher panel + agent Chat tab open together). Mark each hypothesis confirmed or refuted; if F5 or F3 is refuted, note it on T028 / T009 before doing them.
+
+---
+
+## Phase 2: Foundational (blocking prerequisites)
+
+**Purpose**: Shared shapes, the pure logic both clients use, one conversation record per
+key in the admin store (SSOT), and a hub that can talk to more than one socket per
+identity. **No user story work starts before this phase is done.**
+
+- [X] T005 [P] Extend the message and thinking-block types in `app/slices/bridle/domain/bridle.types.ts` with optional `seq: number`, `delivery: 'sending' | 'slow' | 'delivered' | 'failed'`, `failureCode?: string`, and add `BridleDeliveryStates` / `IBridleSendAck` (`accepted` with `messageId`, `ts`, `duplicate?` | `rejected` with `code`, `message?`) exactly as in data-model.md and contracts/bridle-socket.md; keep every new field optional so stored conversations still load.
+- [X] T006 [P] Create `app/slices/bridle/utils/chatFlow.ts`: pure `buildChatFlow(messages, blocks, { locale, now })` returning flow items `{ key, seq, kind: 'message' | 'block' | 'day', ... }` ordered **only by `seq`**, inserting a `day` item where the calendar day of `ts` changes between consecutive messages, plus `nextSeq(items)` and `numberLegacy(messages)` (assign `seq` in array order to items that lack one). Cover in `app/slices/bridle/utils/chatFlow.test.ts`: reply stamped 2 minutes earlier than the question still renders after it; equal `ts`; day boundary; legacy messages without `seq`.
+- [X] T007 [P] Create `app/slices/bridle/utils/delivery.ts`: constants `SLOW_MS = 5000`, `FAILED_MS = 30000`, pure reducer `nextDelivery(state, event)` for events `sent | tick(elapsedMs) | ackAccepted | ackRejected(code) | pageLoad | resend`, implementing the state machine in data-model.md (a late `ackAccepted` moves `failed` to `delivered`; `pageLoad` turns `sending`/`slow` into `failed` with `TIMEOUT`). Cover every transition in `app/slices/bridle/utils/delivery.test.ts`.
+- [X] T008 [P] Mirror T006 and T007 for the admin as `admin/slices/bridle/utils/chatFlow.ts`, `admin/slices/bridle/utils/delivery.ts` with their `.test.ts` files, adapted to the admin's `IBridleMessageData` / `IThinkingBlock` (status `'thinking' | 'done'`) shapes; add a header comment in all four files naming the twin file so they are changed together.
+- [X] T009 SSOT for admin chat state — refactor `admin/slices/bridle/stores/bridle.ts` from one global `messages` / `thinkingBlocks` / socket / `isTyping` / `isConnected` / `isAgentConnected` / transcript cursor into a record keyed by conversation `"<agentId>:<channel>"` (mirroring `app/slices/bridle/stores/bridle.ts`): per-key state object with `messages`, `thinkingBlocks`, `closedTurns`, `nextSeq`, `lastHubSeq`, flags, cursor and its own socket; actions take the key (`connect(apiUrl, agentId, channel)`, `sendMessage(key, …)`, `loadTranscript`, `loadOlderTranscript`, `clearMessages(key)`, `resetTranscript`); keep `markdownEnabled`, panel open/close, debug storage global. Update every consumer to pass and read its own key: `admin/slices/bridle/components/bridle/Provider.vue`, `admin/slices/bridle/components/bridle/Input.vue`, `admin/slices/rancher/components/rancher/Provider.vue`, `admin/slices/agent/agent/composables/useAgentLifecycle.ts`. Remove the mount-time `store.clearMessages()` "previous agent leaks through" workaround in `Provider.vue` — it exists only because of the singleton.
+- [X] T010 Several sockets per identity in the hub — in `api/src/slices/bridle/data/bridle.gateway.ts` change `clients` from one registration per `clientKey` to `Map<clientKey, Map<socketId, registration>>`: `registerClient` adds, `unregisterClient(clientId, agentId, socketId)` removes that socket only and clears `activeTurns` for the key when the last one leaves, `sendToClient` / `handleAgentEvent` / `broadcastAgentStatus` / `handleDebugEvent` send to **every** socket of the key, `prompt` / `capabilities` forwarded to the agent come from the sending socket, `health` / `agentHealth` / `listAgents` count sockets. Update the abstract class in `api/src/slices/bridle/domain/bridle.gateway.ts` and the callers in `api/src/slices/bridle/handlers/bridleClientWs.handler.ts`. Add cases to `api/src/slices/bridle/data/bridle.gateway.spec.ts`: two sockets of one identity both receive an agent event; disconnecting one leaves the other receiving.
+- [X] T011 Verify Phase 2: `cd api && bun run test -- bridle`, `cd app && bun test`, `cd admin && bun test`, `cd admin && npx nuxt typecheck`; run `node specs/015-chat-message-reliability/probe.mjs steal` and confirm **both** sockets now receive `typing` and the answer (before: only the second one did — research E3). Record the output in `research.md`.
+
+**Checkpoint**: the hub fans out to every view; the admin keeps one conversation record per key; ordering and delivery logic exist as tested pure functions.
+
+---
+
+## Phase 3: User Story 2 — The conversation reads in the order it happened, each message once (P1) 🎯 MVP
+
+**Goal**: Question above its answer regardless of clock skew; no message twice; sending
+scrolls to the bottom, incoming content never pulls a reader back down.
+
+**Independent Test**: quickstart scenarios 1, 2 and 10 — clock +2 min, send, multi-message
+answer, follow-up mid-turn, reload; scroll up and send; two tabs.
+
+- [X] T012 [US2] In `app/slices/bridle/stores/bridle.ts` assign `seq` from a per-conversation counter on every append: `appendMessage`, the new-bubble branch of `onStream`, `onMessage`, and when `onThinking` opens a block (replace `ts: Math.max(e.ts, lastTs + 1)` with `ts: e.ts` plus `seq`); in `hydrate` run `numberLegacy` over stored messages and restore the counter; keep `ts` untouched for display.
+- [X] T013 [US2] In `app/slices/bridle/components/bridle/chat/Provider.vue` replace the `chatFlow` computed (currently `items.sort((a, b) => a.ts - b.ts)`) with `buildChatFlow` from `#bridle/utils/chatFlow` (use the slice's existing alias), keying rows by the item `key`.
+- [X] T014 [US2] Scroll rule in `app/slices/bridle/components/bridle/chat/Provider.vue`: measure "near bottom" (within 80 px) **before** the DOM grows and follow incoming changes only then; in `onSend` always call `scrollToBottom()` after `nextTick`; keep the instant jump on mount.
+- [X] T015 [US2] In `admin/slices/bridle/stores/bridle.ts` assign `seq` per conversation on every push (`message`, `stream` new bubble, `stream_end` new bubble, `sendMessage` echo, thinking block open — drop the `Math.max(... lastTs + 1)` anchor); `loadTranscript` numbers messages in returned order starting at 1 and sets the counter; `loadOlderTranscript` numbers the prepended page with values **below** the current minimum so existing items keep their `seq`.
+- [X] T016 [US2] In `admin/slices/bridle/components/bridle/Provider.vue` build the flow with `buildChatFlow` from `admin/slices/bridle/utils/chatFlow.ts` instead of the `ts` sort, and scroll to the bottom on send regardless of position (keep the near-bottom rule for incoming content).
+- [X] T017 [US2] Echo the sender's message to the identity's other sockets: in `api/src/slices/bridle/data/bridle.gateway.ts` `sendToAgent`, after handing the message to the agent, send `{ type: 'user_message', messageId, text, attachments?, ts }` to every socket of the key **except** the sending one (pass the sending `socketId` in from `api/src/slices/bridle/handlers/bridleClientWs.handler.ts`); add the type to `api/src/slices/bridle/domain/bridle.types.ts`; cover in `bridle.gateway.spec.ts`.
+- [X] T018 [P] [US2] Handle `user_message` in the app: `socket.on('user_message')` in `app/slices/bridle/data/bridle.gateway.ts` (+ `onUserMessage` in `app/slices/bridle/domain/bridle.gateway.ts` events), and in `app/slices/bridle/stores/bridle.ts` append it as a delivered user message unless a message with that `id` already exists.
+- [X] T019 [P] [US2] Handle `user_message` in `admin/slices/bridle/stores/bridle.ts` the same way (skip when the id is already in that conversation).
+- [X] T020 [US2] Verify US2: `bun test` for chatFlow in both clients; with T003 run the skewed-clock scenario in app and admin and assert DOM order question → answer live and after reload; assert scroll-on-send from the top and no movement on incoming content while scrolled up; two pages of one login, send from the first, assert both show question once and answer once. Write results into `research.md` ("Observed in browser").
+
+**Checkpoint**: wrong order and the scroll complaint are fixed and demonstrable on their own.
+
+---
+
+## Phase 4: User Story 1 — What I sent is never silently lost (P1)
+
+**Goal**: Every send is acknowledged or visibly fails; failed messages survive a reload and
+can be resent once without retyping; the landing → agent page handoff keeps the chat alive.
+
+**Independent Test**: quickstart scenarios 5 and 6, plus `probe.mjs normal` / `offline`.
+
+- [X] T021 [US1] Wire contract types in `api/src/slices/bridle/domain/bridle.types.ts`: optional `clientMessageId` on the browser → hub `message` payload and the `BridleSendAck` union from contracts/bridle-socket.md.
+- [X] T022 [US1] In `api/src/slices/bridle/data/bridle.gateway.ts` make `sendToAgent` take an optional `clientMessageId` and a `withAck` flag and **return** `{ status: 'accepted', messageId, ts, duplicate? } | { status: 'rejected', code: 'AGENT_OFFLINE' }`: forward `clientMessageId` to the agent as `messageId` when present (else mint one as today); keep a per-`clientKey` seen-id cache (10-minute TTL, max 200) and answer a repeat with `duplicate: true` **without** forwarding; when the agent is offline return the rejection and send the synthetic "Agent is not connected" agent message **only** when `withAck` is false. Update the abstract signature in `api/src/slices/bridle/domain/bridle.gateway.ts` and the HTTP callers (`bridle.controller.ts`, `domain/bridleSync.service.ts`) to the new return type without changing their behaviour.
+- [X] T023 [US1] In `api/src/slices/bridle/handlers/bridleClientWs.handler.ts` `handleMessage`: accept the socket.io ack callback, call it exactly once on every path — `rejected/EMPTY` (nothing to send), `rejected/SHARE_REJECTED` (before the existing `bridle_error` + disconnect), `rejected/ATTACHMENT_FAILED` (alongside the existing `message_error`), or the result of `sendToAgent`; behave exactly as today when no callback is passed (embed widget).
+- [X] T024 [P] [US1] Add cases to `api/src/slices/bridle/handlers/bridleClientWs.handler.spec.ts` and `api/src/slices/bridle/data/bridle.gateway.spec.ts`: accepted ack carries the client's id; agent offline → rejection and **no** synthetic message with ack, synthetic message without ack; same `clientMessageId` twice → second is `duplicate` and the agent receives one message; attachment failure → rejection plus `message_error`.
+- [X] T025 [US1] App transport: in `app/slices/bridle/domain/bridle.gateway.ts` change `IBridleChannel.send` to `send(text, attachmentIds, clientMessageId): Promise<IBridleSendAck>`; in `app/slices/bridle/data/bridle.gateway.ts` emit with `socket.timeout(30_000).emit('message', { text, attachmentIds?, clientMessageId }, cb)` and resolve a timeout as `{ status: 'rejected', code: 'TIMEOUT' }`.
+- [X] T026 [US1] App store delivery in `app/slices/bridle/stores/bridle.ts`: `sendMessage` uses `crypto.randomUUID()` as the message `id` and `clientMessageId`, appends with `delivery: 'sending'`, starts a 5 s timer to `slow`, applies the ack through `nextDelivery` (on accept replace `ts` with the ack's `ts`), persists `delivery` with the conversation; `hydrate` applies `pageLoad` to every stored `sending`/`slow` message; new actions `resend(conv, id)` (same id, same text and attachment ids) and `discard(conv, id)`; when not connected, append the message as `failed` with `failureCode: 'OFFLINE'` instead of handing the text back to the composer — keep the CLEAN-72 draft hand-back only for the session-ended path in `onRejected`; `pending` no longer blocks a second send (FR: follow-up while the agent answers) — gate the composer on uploads only.
+- [X] T027 [US1] Admin store delivery in `admin/slices/bridle/stores/bridle.ts`: same rules as T026 on the per-conversation record — uuid as `id` + `clientMessageId`, emit with ack + 30 s timeout, never emit into a null or disconnected socket (mark `failed/OFFLINE` instead), `resend` / `discard` actions; persist non-delivered messages (text + attachment references, no image bytes) under `localStorage["bridle:outbox:<agentId>:<channel>"]`; after `loadTranscript` merge the outbox under the transcript, dropping an entry whose id is in the transcript **or** (interim, until the runtime persists ids — research E2) whose exact text appears in a transcript user message within ±2 minutes of its send time; mark that fallback with a comment pointing at T044.
+- [X] T028 [US1] Channel ownership in the app (research D7/F5): in `app/slices/bridle/stores/bridle.ts` turn `connect` / `disconnect` into reference-counted `acquire(conv)` / `release(conv)` — `channels: Map<key, { channel, holders, closeTimer? }>`, `release` at zero schedules the close after 3 s and `acquire` cancels it; a release with holders left must **not** touch `pending`, thinking blocks or the connection state. Switch the watcher in `app/slices/bridle/components/bridle/chat/Provider.vue` to acquire/release. Check the other mount points still behave: `app/slices/common/components/landing/hero/Provider.vue`, `app/slices/agent/components/agent/chat/Provider.vue`, `app/slices/share/components/share/page/Provider.vue`.
+- [ ] T029 [US1] Verify US1: `probe.mjs normal` prints an `accepted` ack with the client's id; `probe.mjs offline` (stop the local runtime first) prints `rejected/AGENT_OFFLINE` and no agent bubble; jest specs from T024 pass; with T003: send → reload within 1 s → message present once; runtime stopped → send → reload → message present, not delivered → start runtime → Resend → delivered, one answer, one copy after another reload; Discard → gone after reload; landing hero question → click through to the agent page mid-answer → question once, no "Reconnecting…", answer continues. Record results in `research.md`.
+
+**Checkpoint**: nothing a person sends can disappear without a visible state.
+
+---
+
+## Phase 5: User Story 5 — I can see when a message was sent and whether it got through (P2)
+
+**Goal**: Time under every message, date separators, delivery state with Resend / Discard
+under the person's own messages. (Placed before US3/US4 because it is the visible half of
+US1 and shares its code.)
+
+**Independent Test**: quickstart scenarios 3 and 4.
+
+- [X] T030 [US5] Add keys to `app/slices/bridle/i18n/locales/en.json` — delivery (`sending`, `slow`, `not_delivered`, `not_delivered_hint` "The agent did not receive this message — it will be gone unless you resend it", per-code variants for `AGENT_OFFLINE` / `OFFLINE` / `TIMEOUT` / `ATTACHMENT_FAILED`), actions (`resend`, `discard`), day separators (`today`, `yesterday`) — following `docs/i18n.md`; then run `bun run i18n:sync` from the repo root to generate `ru.json`. Do not hand-write `ru.json`.
+- [X] T031 [US5] In `app/slices/bridle/components/bridle/chat/Message.vue` render under each bubble the time of day via `Intl.DateTimeFormat(locale, { hour: '2-digit', minute: '2-digit' })` with the full date-time in `title`; for the person's messages render the delivery line from `message.delivery` (nothing extra when delivered, spinner + `slow` text, `not_delivered` + hint + Resend / Discard buttons emitting `resend` / `discard`); copy decided in script travels as an i18n key, templates use `$t`.
+- [X] T032 [US5] In `app/slices/bridle/components/bridle/chat/Provider.vue` render `day` flow items as a centred separator (`today` / `yesterday` keys, otherwise a localised long date) and wire `resend` / `discard` from `Message.vue` to the store actions from T026.
+- [X] T033 [P] [US5] Admin equivalents in English only: time + tooltip + delivery line + Resend / Discard in `admin/slices/bridle/components/bridle/Message.vue`; day separators and action wiring in `admin/slices/bridle/components/bridle/Provider.vue`.
+- [ ] T034 [US5] Verify US5 with T003: every bubble shows a time; times identical before and after reload; throttled network shows the loading state after ~5 s; runtime stopped shows "not delivered" under the message within 35 s; app in `ru` shows Russian wording, admin English.
+
+---
+
+## Phase 6: User Story 4 — The answer shows up when the agent has answered (P2)
+
+**Goal**: Events that arrive while a browser is reconnecting are replayed; a transient
+disconnect no longer kills the turn; a dead turn says so.
+
+**Independent Test**: quickstart scenario 8, `probe.mjs gap`.
+
+- [X] T035 [US4] Sequence + replay buffer in `api/src/slices/bridle/data/bridle.gateway.ts`: per-`clientKey` counter stamped as `seq` on **every** event routed to a browser (`handleAgentEvent`, `sendToClient`, `user_message`, status, debug); per-key ring buffer (last 500 events or 10 minutes) filled **whether or not a socket is registered**; idle eviction of counter + buffer 10 minutes after the key's last socket left; `replaySince(clientKey, lastSeq)` returning buffered events in order; `currentSeq(clientKey)`. Add to the abstract class in `api/src/slices/bridle/domain/bridle.gateway.ts`.
+- [X] T036 [US4] In `api/src/slices/bridle/handlers/bridleClientWs.handler.ts` `handleConnection`: read optional numeric `lastSeq` from the handshake `auth`, emit `welcome` as `{ clientId, seq: currentSeq }`, then emit `replaySince(lastSeq)` to **this** socket before it is added to the fan-out set, so replay and live traffic cannot interleave out of order.
+- [X] T037 [P] [US4] Spec cases in `api/src/slices/bridle/data/bridle.gateway.spec.ts` and `bridleClientWs.handler.spec.ts`: event routed with no socket registered is replayed on reconnect with `lastSeq`; events at or below `lastSeq` are not replayed; buffer bounds and idle eviction; `welcome.seq` lower than the client's `lastSeq` (hub restarted).
+- [X] T038 [US4] App client in `app/slices/bridle/data/bridle.gateway.ts` + `app/slices/bridle/stores/bridle.ts`: pass `lastSeq` from the store in the `auth` function (called on every reconnect); store `lastHubSeq` per conversation and persist it with the conversation; ignore any event whose `seq` ≤ `lastHubSeq`; on `welcome` with a lower `seq` reset `lastHubSeq` and run the transcript reconcile (T040); in `onDisconnected` stop calling `closeAllTurns` and stop clearing `pending` — leave the turn open and let the watchdog decide.
+- [X] T039 [US4] Same in `admin/slices/bridle/stores/bridle.ts`: `lastSeq` in the socket `auth` callback, per-conversation `lastHubSeq`, drop stale `seq`, no `_closeAllTurns()` / `isTyping = false` on a transient `disconnect`, `welcome.seq` fallback to `loadTranscript` merge.
+- [X] T040 [US4] Safety net + visible failure: add `transcriptTail(agentId, channel)` to `app/slices/bridle/domain/bridle.gateway.ts` / `app/slices/bridle/data/bridle.gateway.ts` using the generated SDK call for `GET /api/agent/:agentId/transcript` (if the SDK lacks it, regenerate with `cd app && bun run build:api`, do not hand-write types); when the watchdog in `app/slices/bridle/stores/bridle.ts` expires with a turn still open, fetch the tail, append assistant messages newer than the last one on screen, and if there are none show a "the agent did not finish this turn" notice (new key in `en.json`, then `i18n:sync`). Same behaviour in `admin/slices/bridle/stores/bridle.ts` using its existing `fetchTranscriptPage`.
+- [ ] T041 [US4] Verify US4: `probe.mjs gap` extended to send `lastSeq` on reconnect now reports the missed `stream_end` after reconnecting (before: none — research E4); jest specs from T037 pass; with T003: go offline across the end of a turn, come back, answer visible within 10 s with no duplicate bubble; restart the API during the gap and confirm the transcript fallback path runs (on this Windows machine the transcript route returns nothing — see research "Local-environment note" — so assert the *notice*, and validate the recovery itself on the cluster).
+
+---
+
+## Phase 7: User Story 3 — A reloaded conversation looks like the one I watched (P2)
+
+**Goal**: One bubble per agent message after reload, same boundaries and formatting.
+**The decisive change is in `CleanSlice/runtime`, not in this repository.**
+
+**Independent Test**: quickstart scenario 9, on the cluster.
+
+- [X] T042 [US3] Add cases to `api/src/slices/agent/file/domain/transcriptReader.service.spec.ts` proving the reader already does the right thing once the runtime writes per-message events: several consecutive `assistant` events in one turn come back as separate messages in file order; events with equal `ts` keep file order; `transient` partial chunks are still dropped. Fix `transcriptReader.service.ts` only if a case fails.
+- [X] T043 [US3] **Separate repository — confirm with the requester before starting; needs its own CLEAN ticket, branch and PR in `CleanSlice/runtime` (`E:/code/dream/cleanslice/runtime`).** In `src/slices/runtime/loop/domain/loop.service.ts` persist one `assistant` event per message emitted to the channel, with the wire `messageId` as the event `id`, instead of one event per turn with the accumulated `fullText` in `sendFinalResponse`; persist the incoming `messageId` as the `id` of the `user` event. Keep the model-facing history equivalent (the next LLM call must still see the whole turn). Desirable: emit a `persisted` acknowledgement to the hub after the user event is written.
+- [ ] T044 [US3] After T043 ships: remove the interim text-match fallback from T027 (match by id only) and treat a `persisted` ack, if implemented, as the `delivered` signal in `api/src/slices/bridle/data/bridle.gateway.ts`; update contracts/bridle-socket.md accordingly.
+- [ ] T045 [US3] Verify US3 on the cluster: agent answers in ≥ 3 messages with list, inline code and bold; compare live view, admin after reload and the app's `/chats/:id` page — same count, boundaries and formatting, no glued sentences. Until T043 ships this is expected to **fail** and must be reported as failing, not skipped.
+
+---
+
+## Phase 8: User Story 6 — An agent shows the same status everywhere (P3) — SSOT
+
+**Goal**: One agent record per id; every screen renders from it; fetches upsert into it;
+pushes patch it. Independent of Phases 3–7 — can ship as its own PR.
+
+**Independent Test**: quickstart scenario 11.
+
+- [X] T046 [US6] SSOT in `admin/slices/agent/agent/stores/agent.ts`: add `byId(id)` (computed lookup into `agents`), `upsert(agent)` (replace by id or append), `patch(id, partial)` returning a rollback function; make `fetchById` upsert its result before returning, `fetchAdmin` likewise; keep `fetchAll` as the collection load; route the existing optimistic status flips in `update` / restart / stop through `patch`.
+- [X] T047 [US6] In `admin/slices/agent/agent/stores/agentStatus.ts` `applyMessage`: write `status.agent` into the agent store with `useAgentStore().patch(status.agent.id, status.agent)` (upsert when the id is unknown), remove the record on `deleted`, and make the store's own `agents` map a derived view of the agent store (or delete it and update its readers) so there is no second copy.
+- [X] T048 [US6] Render from the store: in `admin/slices/agent/agent/components/agent/workspace/Main.vue` keep `useAsyncData(() => agentStore.fetchById(id))` for loading/error only and pass `computed(() => agentStore.byId(props.id))` to the template and to `useAgentLifecycle`; in `admin/slices/agent/agent/composables/useAgentLifecycle.ts` replace every `agent.value = { ...agent.value, status }` with `agentStore.patch(agentId, { status })` + rollback, and drop `liveAgent` merging that T047 makes redundant; do the same for `admin/slices/agent/agent/components/agent/edit/Provider.vue` and the two `fetchById` calls in `admin/slices/agent/file/components/agentFile/Provider.vue`.
+- [X] T049 [US6] In `admin/slices/agent/agent/components/agent/workspace/Provider.vue` pass `agentStore.agents` (via `storeToRefs`) to `AgentWorkspaceRail` instead of the `useAsyncData` `data` ref, and make sure `RailItem.vue` shows `statusReason` for the row; check the other list consumers read the store too: `admin/slices/agent/agent/pages/agents/index.vue`, `admin/slices/chat/components/chat/list/Provider.vue`, `admin/slices/paddock/components/paddock/evaluation/list/Provider.vue`, `admin/slices/llm/composables/useLlmUsageOverview.ts`.
+- [X] T050 [P] [US6] Same SSOT in the app: `app/slices/agent/stores/agent.ts` (`byId`, `upsert`, `patch`; `fetchById`, `create`, `update`, `restart` upsert; `fetchPublic` stays separate — public cards are a different projection), and render from the store in `app/slices/agent/components/agent/Provider.vue`, `app/slices/agent/components/agent/chat/Provider.vue` (its optimistic `agent.value = { ...status: 'deploying' }` becomes `patch` + rollback) and `app/slices/agent/components/agent/workspace/Provider.vue`.
+- [X] T051 [US6] Check the server side of the same defect: `useAgentLifecycle` says "Backend syncStatus runs on each fetchById". In `api/src/slices/agent/agent/` find where status is reconciled and whether the list endpoint (`findAll`) and the `/agents/status/stream` SSE reconcile too; if a non-selected agent's status can stay stale in the database until someone opens it, make the periodic reconciler / stream cover every agent, and add a spec next to the service. Record the finding in `research.md` either way.
+- [ ] T052 [US6] Verify US6: on the agents screen trigger a deploy that ends in `failed` — list row, header pill and Overview card change together within 10 s without reload and the reason is on the row; repeat with a different agent selected; `cd admin && npx nuxt typecheck`, `cd app && npx nuxt typecheck`.
+
+---
+
+## Phase 9: Polish & cross-cutting
+
+- [X] T053 [P] Write the SSOT rule down so the defect class does not return: `docs/state.md` — "an entity lives once in its Pinia store; fetches upsert; pushes patch; components render by id; `useAsyncData` is for loading state, not a render source; optimistic changes go through a store action with rollback" — with the agent store and the chat conversation record as the two worked examples; link it from `AGENTS.md` and `CLAUDE.md`.
+- [ ] T054 [P] Update `README.md` / `docs/operations/` where they describe the chat socket protocol (ack, `clientMessageId`, `seq` / `lastSeq`, `user_message`, several sockets per identity) — point to `specs/015-chat-message-reliability/contracts/bridle-socket.md` rather than duplicating it.
+- [ ] T055 Full gate: `cd api && bun run lint && bun run test`; `cd app && bun test && npx nuxt typecheck`; `cd admin && bun test && npx nuxt typecheck` (not `bun run typecheck` in `app/` — it regenerates the SDK); confirm no generated file under `*/slices/setup/api/data/repositories/api/` is staged unless T040 required a regeneration.
+- [ ] T056 Run every scenario in `specs/015-chat-message-reliability/quickstart.md`, fill the "Observed" results into `research.md`, and update `spec.md` success-criteria status honestly — including anything that still fails (US3 until T043).
+- [ ] T057 Delivery cycle: CLEAN-102 checkpoint comments after each phase, Conventional Commits with `(CLEAN-102)` — `fix(api):`, `fix(app):`, `fix(admin):` — PR into `main` with the ticket linked, PR URL on the ticket, move to In Testing; a separate ticket + PR for T043 in `CleanSlice/runtime`; if Phase 8 ships on its own, give it its own PR from the same ticket or a new one, as the requester prefers.
+
+---
+
+## Dependencies & execution order
+
+### Phase dependencies
+
+- **Phase 1** → no dependencies. T004 informs T009 and T028 (it confirms or refutes F3 / F5).
+- **Phase 2** → blocks Phases 3–7. T009 blocks every admin chat task; T010 blocks T017, T022, T035.
+- **Phase 3 (US2)** → after Phase 2. No API dependency except T017–T019.
+- **Phase 4 (US1)** → after Phase 2; T026/T027 build on the `seq` work of T012/T015 (same files — do not run in parallel with Phase 3).
+- **Phase 5 (US5)** → after Phase 4 (renders what US1 stores).
+- **Phase 6 (US4)** → after Phase 2; touches the same store files as Phases 3–4, so sequence it after them.
+- **Phase 7 (US3)** → T042 any time; T043 is external; T044–T045 after T043.
+- **Phase 8 (US6)** → independent of all chat phases; can run in parallel with them (different slices) or ship first.
+- **Phase 9** → last.
+
+### Same-file serialisation
+
+`app/slices/bridle/stores/bridle.ts`: T012 → T018 → T026 → T028 → T038 → T040.
+`admin/slices/bridle/stores/bridle.ts`: T009 → T015 → T019 → T027 → T039 → T040.
+`api/src/slices/bridle/data/bridle.gateway.ts`: T010 → T017 → T022 → T035.
+`api/src/slices/bridle/handlers/bridleClientWs.handler.ts`: T010 → T017 → T023 → T036.
+
+### Parallel opportunities
+
+- Phase 1: T002, T003 alongside T001.
+- Phase 2: T005, T006, T007, T008 together; T009 (admin) and T010 (API) are different projects and can run side by side.
+- Phase 3: T018 (app) and T019 (admin) together after T017.
+- Phase 4: T024 (specs) alongside T025–T027; T026 (app) and T027 (admin) are different projects.
+- Phase 5: T033 (admin) alongside T030–T032 (app).
+- Phase 6: T037 alongside T038–T039; T038 (app) and T039 (admin) side by side.
+- Phase 8 as a whole, and T050 (app) alongside T046–T049 (admin).
+
+## Parallel example: Phase 2
+
+```text
+Task: "T006 chatFlow.ts + tests in app/slices/bridle/utils/"
+Task: "T007 delivery.ts + tests in app/slices/bridle/utils/"
+Task: "T008 admin twins in admin/slices/bridle/utils/"
+Task: "T010 several sockets per identity in api/src/slices/bridle/data/bridle.gateway.ts"
+# then, on its own: T009 admin store refactor
+```
+
+## Implementation strategy
+
+### MVP
+
+Phase 1 → Phase 2 → **Phase 3 (US2)**. That alone fixes the wrong order, the scroll
+complaint and — through T010 — the reproduced "the tab that sent gets nothing" defect,
+which is the likeliest cause of hung answers. Stop, verify with T011 and T020, demo.
+
+### Incremental delivery
+
+1. MVP above → PR 1 (or keep on the branch and continue).
+2. Phase 4 + Phase 5 (US1 + US5): acknowledged sends, outbox, time and delivery state.
+3. Phase 6 (US4): replay after reconnect.
+4. Phase 8 (US6, SSOT for agents): independent; ship whenever convenient.
+5. Phase 7 (US3): gated on the runtime change (T043) — schedule it with whoever owns `CleanSlice/runtime`.
+
+## Notes
+
+- Verify tasks are the definition of done for a story; "should work" is not a result —
+  write the observed output into `research.md`.
+- Every wire change is additive and optional (embed widget compatibility).
+- The hub's new state is in memory; the plan assumes one API instance, as the hub already does.
+- Commit after each task or logical group; never commit `.env.project` or regenerated SDK files by accident.