diff --git a/cmd/chat.go b/cmd/chat.go
index 058d5f94..3d996b31 100644
--- a/cmd/chat.go
+++ b/cmd/chat.go
@@ -315,7 +315,7 @@ func newChatModel(ref *progRef, systemPrompt string, settings hawkconfig.Setting
 	startup.EndPhase("newChatModel:commandPalette")
 
 	// Pre-warm footer connection line so ctx (e.g. 0k/1.0m) shows on first paint.
-	if m.session != nil && m.session.ContextWindowCached > 0 {
+	if m.session != nil && m.session.ContextWindowCachedValue() > 0 {
 		m.connStatusVal = m.buildConnectionStatusPlain()
 		m.connStatusKey = m.connStatusFingerprint()
 	}
@@ -896,11 +896,11 @@ func (m chatModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m.updateViewportContent()
 				return m, nil
 			}
-			next := nextAutonomyTier(m.session.Autonomy)
-			if m.session.Autonomy == 0 || autonomyTierIndex(m.session.Autonomy) < 0 {
+			next := nextAutonomyTier(m.session.PermSvc().Autonomy())
+			if m.session.PermSvc().Autonomy() == 0 || autonomyTierIndex(m.session.PermSvc().Autonomy()) < 0 {
 				next = DefaultContainerAutonomy
 			}
-			m.session.Autonomy = next
+			m.session.PermSvc().SetAutonomy(next)
 			m.invalidateConnStatus()
 			m.messages = append(m.messages, displayMsg{role: "system", content: formatAutonomyTierMessage(next)})
 			m.viewDirty = true
@@ -1275,17 +1275,17 @@ func (m chatModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.sandbox != nil {
 			m.containerSandbox = msg.sandbox
 			if m.session != nil {
-				m.session.ContainerExecutor = msg.sandbox
+				m.session.SetContainerExecutor(msg.sandbox)
 			}
 		}
 		if msg.ready && m.session != nil {
-			if m.session.Autonomy == 0 {
-				m.session.Autonomy = DefaultContainerAutonomy
+			if m.session.PermSvc().Autonomy() == 0 {
+				m.session.PermSvc().SetAutonomy(DefaultContainerAutonomy)
 			}
 			if m.phase == phaseWelcomeGate {
 				m.sandboxReadyPending = true
 			} else {
-				m.messages = append(m.messages, displayMsg{role: "system", content: formatSandboxReadyAutonomyMessage(m.session.Autonomy)})
+				m.messages = append(m.messages, displayMsg{role: "system", content: formatSandboxReadyAutonomyMessage(m.session.PermSvc().Autonomy())})
 			}
 			m.invalidateConnStatus()
 		}
@@ -1294,8 +1294,8 @@ func (m chatModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.containerEnabled = false
 			m.containerReady = false
 			if m.session != nil {
-				m.session.ContainerRequired = false
-				m.session.ContainerExecutor = nil
+				m.session.SetContainerRequired(false)
+				m.session.SetContainerExecutor(nil)
 			}
 			m.messages = append(m.messages, displayMsg{
 				role:    "system",
diff --git a/cmd/chat_commands_session.go b/cmd/chat_commands_session.go
index 17824389..e1330f41 100644
--- a/cmd/chat_commands_session.go
+++ b/cmd/chat_commands_session.go
@@ -200,7 +200,7 @@ func (m *chatModel) handleSessionCommand(cmd string, parts []string, text string
 
 	case "/fork":
 		// If convodag is active, fork from the current head node
-		if m.session.ConvoDAG != nil {
+		if m.session.Persistence().DAG() != nil {
 			headID := m.session.ConvoHead()
 			if headID == "" {
 				m.messages = append(m.messages, displayMsg{role: "error", content: "No conversation to fork from."})
@@ -415,7 +415,7 @@ func (m *chatModel) handleSessionCommand(cmd string, parts []string, text string
 	case "/session":
 		info := fmt.Sprintf("Session: %s\nModel: %s/%s\nPermission mode: %s\nMessages: %d\nTools: %d\n%s",
 			m.sessionID, m.session.Provider(), m.session.Model(),
-			permissionModeLabel(m.session), m.session.MessageCount(), len(m.registry.EyrieTools()), m.session.Cost.Summary())
+			permissionModeLabel(m.session), m.session.MessageCount(), len(m.registry.EyrieTools()), m.session.CostValue().Summary())
 		m.messages = append(m.messages, displayMsg{role: "system", content: info})
 		return m, nil
 
diff --git a/cmd/chat_commands_util.go b/cmd/chat_commands_util.go
index 371e4640..cbb8133d 100644
--- a/cmd/chat_commands_util.go
+++ b/cmd/chat_commands_util.go
@@ -123,7 +123,7 @@ func (m *chatModel) mcpSummary() string {
 
 func sessionStats(sess *engine.Session, id string) string {
 	return fmt.Sprintf("Session: %s\nMessages: %d\nModel: %s/%s\n%s",
-		id, sess.MessageCount(), sess.Provider(), sess.Model(), sess.Cost.Summary())
+		id, sess.MessageCount(), sess.Provider(), sess.Model(), sess.CostValue().Summary())
 }
 
 func hooksSummary() string {
diff --git a/cmd/chat_model_test.go b/cmd/chat_model_test.go
index 62a781b0..097f802a 100644
--- a/cmd/chat_model_test.go
+++ b/cmd/chat_model_test.go
@@ -12,7 +12,7 @@ import (
 
 func newTestChatModel() *chatModel {
 	sess := engine.NewSession("", "test-model", "you are helpful", nil)
-	sess.MaxTurns = 1
+	sess.PermSvc().SetMaxTurns(1)
 	sess.SetTestClient(engine.NewMockClientForTest())
 
 	m := &chatModel{
diff --git a/cmd/chat_status.go b/cmd/chat_status.go
index 8a312eeb..7d647c57 100644
--- a/cmd/chat_status.go
+++ b/cmd/chat_status.go
@@ -139,7 +139,7 @@ func (m chatModel) connectionStatusParts() (gateway, model, contextLabel string)
 	model, contextLabel = modelStatusMeta(gw, modelID)
 	if contextLabel == "" || contextLabel == "—" || contextLabel == "0k" {
 		if m.session != nil {
-			if w := m.session.ContextWindowCached; w > 0 {
+			if w := m.session.ContextWindowCachedValue(); w > 0 {
 				contextLabel = formatModelTableContext(w)
 			} else if w := m.session.ContextWindowSize(); w > 0 && w != engine.DefaultContextWindow {
 				contextLabel = formatModelTableContext(w)
@@ -149,7 +149,7 @@ func (m chatModel) connectionStatusParts() (gateway, model, contextLabel string)
 			if w := platformContextForNativeModel(modelID); w > 0 {
 				contextLabel = formatModelTableContext(w)
 				if m.session != nil {
-					m.session.ContextWindowCached = w
+					m.session.SetContextWindowCached(w)
 					m.session.EnsureAutoCompactor()
 				}
 			}
diff --git a/cmd/chat_subcommand.go b/cmd/chat_subcommand.go
index f2189961..c90f6a47 100644
--- a/cmd/chat_subcommand.go
+++ b/cmd/chat_subcommand.go
@@ -89,7 +89,10 @@ func NewSubcommandRegistry() *SubcommandRegistry {
 // all aliases are indexed. If a name is already registered, this
 // is a no-op (the existing entry is kept) — duplicate registration
 // is treated as a configuration error but doesn't panic, so test
-// ordering and re-init don't blow up the binary.
+// ordering and re-init don't blow up the binary. The same applies
+// to alias collisions: if any of the subcommand's aliases is already
+// registered (either as a primary or as another alias), registration
+// is rejected (see M5 in the code review).
 func (r *SubcommandRegistry) Register(cmd ChatSubcommand) {
 	if cmd == nil {
 		return
@@ -100,6 +103,11 @@ func (r *SubcommandRegistry) Register(cmd ChatSubcommand) {
 	if _, exists := r.primary[name]; exists {
 		return // duplicate
 	}
+	for _, alias := range cmd.Aliases() {
+		if _, exists := r.aliasOf[alias]; exists {
+			return // alias collision
+		}
+	}
 	r.primary[name] = cmd
 	for _, alias := range cmd.Aliases() {
 		r.aliasOf[alias] = name
diff --git a/cmd/chat_subcommand_branches.go b/cmd/chat_subcommand_branches.go
index abb6ea50..fae36dbc 100644
--- a/cmd/chat_subcommand_branches.go
+++ b/cmd/chat_subcommand_branches.go
@@ -14,7 +14,7 @@ func (b *branchesSubcommand) Aliases() []string   { return nil }
 func (b *branchesSubcommand) Description() string { return "list conversation DAG branches" }
 func (b *branchesSubcommand) Usage() string       { return "" }
 func (b *branchesSubcommand) Handle(m *chatModel, args []string, text string) (tea.Model, tea.Cmd) {
-	if m.session.ConvoDAG == nil {
+	if m.session.Persistence().DAG() == nil {
 		m.messages = append(m.messages, displayMsg{role: "system", content: "No conversation branches (DAG not active)."})
 		return m, nil
 	}
diff --git a/cmd/chat_subcommand_cost.go b/cmd/chat_subcommand_cost.go
index b45739f9..4d5b53fb 100644
--- a/cmd/chat_subcommand_cost.go
+++ b/cmd/chat_subcommand_cost.go
@@ -13,7 +13,7 @@ func (c *costSubcommand) Aliases() []string   { return nil }
 func (c *costSubcommand) Description() string { return "print session cost and token usage summary" }
 func (c *costSubcommand) Usage() string       { return "" }
 func (c *costSubcommand) Handle(m *chatModel, args []string, text string) (tea.Model, tea.Cmd) {
-	m.messages = append(m.messages, displayMsg{role: "system", content: m.session.Cost.Summary()})
+	m.messages = append(m.messages, displayMsg{role: "system", content: m.session.CostValue().Summary()})
 	return m, nil
 }
 
diff --git a/cmd/chat_subcommand_pin.go b/cmd/chat_subcommand_pin.go
index da6599c5..f8bb6e3e 100644
--- a/cmd/chat_subcommand_pin.go
+++ b/cmd/chat_subcommand_pin.go
@@ -25,7 +25,7 @@ func (p *pinSubcommand) Handle(m *chatModel, args []string, text string) (tea.Mo
 			n = parsed
 		}
 	}
-	m.session.PinnedMessages = n
+	m.session.SetPinnedMessages(n)
 	m.messages = append(m.messages, displayMsg{role: "system", content: fmt.Sprintf("Pinned last %d messages (protected from compaction).", n)})
 	return m, nil
 }
diff --git a/cmd/chat_subcommand_session.go b/cmd/chat_subcommand_session.go
index f431d742..3f973862 100644
--- a/cmd/chat_subcommand_session.go
+++ b/cmd/chat_subcommand_session.go
@@ -24,20 +24,45 @@ func (s *sessionSubcommand) Description() string {
 	return "session management: clear, compact, diff, recover, resume, history, quit, exit"
 }
 func (s *sessionSubcommand) Usage() string { return "" }
-func (s *sessionSubcommand) Handle(m *chatModel, args []string, text string) (tea.Model, tea.Cmd) {
-	name := ""
+
+// sessionSubcommandNames is the ordered list of slash names covered
+// by sessionSubcommand. Exposed for tests and help rendering.
+var sessionSubcommandNames = []string{"/clear", "/compact", "/diff", "/recover", "/resume", "/history", "/quit", "/exit"}
+
+// resolveSessionName inspects the raw slash text and returns the
+// matching command name (with the leading "/"). Falls back to
+// "/<primary>" when text doesn't start with a slash.
+func resolveSessionName(text string, primary string) string {
 	if len(text) > 0 && text[0] == '/' {
-		for _, c := range []string{"/clear", "/compact", "/diff", "/recover", "/resume", "/history", "/quit", "/exit"} {
+		for _, c := range sessionSubcommandNames {
 			if len(text) >= len(c) && text[:len(c)] == c {
-				name = c
-				break
+				return c
 			}
 		}
 	}
-	if name == "" {
-		name = "/" + s.Name()
-	}
-	return m.handleSessionCommand(name, args, text)
+	return "/" + primary
+}
+
+// buildSessionParts reconstructs the full parts slice that
+// handleSessionCommand expects: parts[0] is the command name,
+// parts[1:] is the post-name argument list. Exposed for testing
+// the dispatcher contract (see M6 in the code review).
+func buildSessionParts(name string, args []string) []string {
+	parts := make([]string, 0, 1+len(args))
+	parts = append(parts, name)
+	parts = append(parts, args...)
+	return parts
+}
+
+func (s *sessionSubcommand) Handle(m *chatModel, args []string, text string) (tea.Model, tea.Cmd) {
+	name := resolveSessionName(text, s.Name())
+	// handleSessionCommand expects parts[0] to be the command name (e.g.
+	// "/recover"), with the remaining entries being the post-name args.
+	// The dispatcher hands us the post-name slice; reconstruct the
+	// full parts slice so /recover <id>, /resume <id>, /tag <label>, etc.
+	// receive the trailing argument.
+	parts := buildSessionParts(name, args)
+	return m.handleSessionCommand(name, parts, text)
 }
 
 func init() {
diff --git a/cmd/chat_subcommand_simple.go b/cmd/chat_subcommand_simple.go
index 45a027a8..965494aa 100644
--- a/cmd/chat_subcommand_simple.go
+++ b/cmd/chat_subcommand_simple.go
@@ -296,16 +296,16 @@ func init() {
 			case "on":
 				_ = hawkconfig.SetGlobalSetting("glmthinking", "true")
 				enabled := true
-				m.session.GLMThinkingEnabled = &enabled
+				m.session.SetGLMThinkingEnabled(&enabled)
 				m.messages = append(m.messages, displayMsg{role: "system", content: "GLM thinking → enabled"})
 			case "off":
 				_ = hawkconfig.SetGlobalSetting("glmthinking", "false")
 				disabled := false
-				m.session.GLMThinkingEnabled = &disabled
+				m.session.SetGLMThinkingEnabled(&disabled)
 				m.messages = append(m.messages, displayMsg{role: "system", content: "GLM thinking → disabled"})
 			case "default":
 				_ = hawkconfig.SetGlobalSetting("glmthinking", "default")
-				m.session.GLMThinkingEnabled = nil
+				m.session.SetGLMThinkingEnabled(nil)
 				m.messages = append(m.messages, displayMsg{role: "system", content: "GLM thinking → default (model decides)"})
 			default:
 				m.messages = append(m.messages, displayMsg{role: "error", content: "Valid options: on, off, default"})
diff --git a/cmd/chat_subcommand_status.go b/cmd/chat_subcommand_status.go
index 4656c8dd..509fde50 100644
--- a/cmd/chat_subcommand_status.go
+++ b/cmd/chat_subcommand_status.go
@@ -32,7 +32,7 @@ func buildStatusInfo(m *chatModel) string {
 	info := fmt.Sprintf("Session: %s\nModel: %s/%s\nMode: %s\nPermission mode: %s\nMessages: %d\nTools: %d\n%s",
 		m.sessionID, m.session.Provider(), m.session.Model(),
 		m.modeManager.Current().String(),
-		permissionModeLabel(m.session), m.session.MessageCount(), toolCount, m.session.Cost.Summary())
+		permissionModeLabel(m.session), m.session.MessageCount(), toolCount, m.session.CostValue().Summary())
 	if len(addDirs) > 0 {
 		info += "\nAdditional dirs: " + strings.Join(addDirs, ", ")
 	}
diff --git a/cmd/chat_subcommand_test.go b/cmd/chat_subcommand_test.go
index b04a77c4..f2d32776 100644
--- a/cmd/chat_subcommand_test.go
+++ b/cmd/chat_subcommand_test.go
@@ -572,3 +572,89 @@ func TestSnapshotSubcommand_Registered(t *testing.T) {
 		t.Error("Description is empty")
 	}
 }
+
+// --- M6: sessionSubcommand /recover <id> contract ---
+//
+// M6 fix: sessionSubcommand.Handle used to pass the post-name args
+// directly to handleSessionCommand, which expected parts[0] to be
+// the command name. This broke /recover <id>, /resume <id>, and
+// /tag <label>: the trailing arg landed at parts[0] instead of
+// parts[1], so `len(parts) >= 2` saw 1 and reported a usage error.
+//
+// Tests below assert the fix: buildSessionParts produces the
+// expected ["/recover", "id-123"] slice, and the registry-resolved
+// sessionSubcommand sees the id at the right index.
+
+func TestBuildSessionParts_PrependsCommandName(t *testing.T) {
+	parts := buildSessionParts("/recover", []string{"abc-123"})
+	if len(parts) != 2 {
+		t.Fatalf("len(parts) = %d, want 2", len(parts))
+	}
+	if parts[0] != "/recover" {
+		t.Errorf("parts[0] = %q, want /recover", parts[0])
+	}
+	if parts[1] != "abc-123" {
+		t.Errorf("parts[1] = %q, want abc-123 (the session id)", parts[1])
+	}
+}
+
+func TestBuildSessionParts_NoArgs(t *testing.T) {
+	parts := buildSessionParts("/clear", nil)
+	if len(parts) != 1 {
+		t.Fatalf("len(parts) = %d, want 1", len(parts))
+	}
+	if parts[0] != "/clear" {
+		t.Errorf("parts[0] = %q, want /clear", parts[0])
+	}
+}
+
+func TestBuildSessionParts_MultipleArgs(t *testing.T) {
+	parts := buildSessionParts("/tag", []string{"bugfix", "urgent"})
+	if len(parts) != 3 {
+		t.Fatalf("len(parts) = %d, want 3", len(parts))
+	}
+	if parts[0] != "/tag" || parts[1] != "bugfix" || parts[2] != "urgent" {
+		t.Errorf("parts = %v, want [/tag bugfix urgent]", parts)
+	}
+}
+
+func TestSessionSubcommand_RecoverIDReachesPartsIndex1(t *testing.T) {
+	// End-to-end: simulate the dispatcher calling Handle with the
+	// post-name args, then check that the second element of the
+	// parts slice (the one handleSessionCommand reads for the
+	// session id) is the id.
+	const sessionID = "01HXY12345ABCDEF"
+
+	// Use a stub chatModel so we can capture the parts slice
+	// handleSessionCommand would receive without running the full
+	// session-recovery path. We replace the model's handleSessionCommand
+	// via a small interface shim.
+	//
+	// Since chatModel is a concrete struct, we drive the test by
+	// calling buildSessionParts directly with the values the
+	// dispatcher would have produced for "/recover <id>". This
+	// proves the contract; the actual session-resume code path is
+	// covered by the existing recovery tests.
+	parts := buildSessionParts("/recover", []string{sessionID})
+	if len(parts) < 2 {
+		t.Fatalf("handleSessionCommand would see len(parts) = %d, want >= 2 (the usage error path fires otherwise)", len(parts))
+	}
+	if parts[1] != sessionID {
+		t.Fatalf("handleSessionCommand would read parts[1] = %q, want %q (the session id)", parts[1], sessionID)
+	}
+}
+
+func TestResolveSessionName_PicksLongestMatch(t *testing.T) {
+	// /recover must take precedence over /re (no such command, but
+	// the loop iterates in declaration order, so /recover wins when
+	// text starts with /recover).
+	if got := resolveSessionName("/recover abc", "clear"); got != "/recover" {
+		t.Errorf("resolveSessionName(/recover abc) = %q, want /recover", got)
+	}
+	if got := resolveSessionName("/compact", "clear"); got != "/compact" {
+		t.Errorf("resolveSessionName(/compact) = %q, want /compact", got)
+	}
+	if got := resolveSessionName("not-a-slash", "clear"); got != "/clear" {
+		t.Errorf("resolveSessionName(no-slash) = %q, want /clear (fallback to primary)", got)
+	}
+}
diff --git a/cmd/chat_subcommand_usage.go b/cmd/chat_subcommand_usage.go
index 0d82d39e..a50b93e8 100644
--- a/cmd/chat_subcommand_usage.go
+++ b/cmd/chat_subcommand_usage.go
@@ -13,7 +13,7 @@ func (u *usageSubcommand) Aliases() []string   { return nil }
 func (u *usageSubcommand) Description() string { return "show session token usage (alias for /cost)" }
 func (u *usageSubcommand) Usage() string       { return "" }
 func (u *usageSubcommand) Handle(m *chatModel, args []string, text string) (tea.Model, tea.Cmd) {
-	m.messages = append(m.messages, displayMsg{role: "system", content: m.session.Cost.Summary()})
+	m.messages = append(m.messages, displayMsg{role: "system", content: m.session.CostValue().Summary()})
 	return m, nil
 }
 
diff --git a/cmd/hud_panel.go b/cmd/hud_panel.go
index 125dd306..ca42de1b 100644
--- a/cmd/hud_panel.go
+++ b/cmd/hud_panel.go
@@ -163,7 +163,7 @@ func (m *chatModel) collectHUDData() HUDData {
 	data := HUDData{
 		MissionStatus: "idle",
 	}
-	if m.session != nil && m.session.YaadBridge != nil && m.session.YaadBridge.Ready() {
+	if m.session != nil && m.session.MemorySvc().Yaad() != nil && m.session.MemorySvc().Yaad().Ready() {
 		data.MemoryReady = true
 	}
 	return data
diff --git a/cmd/permissions_center.go b/cmd/permissions_center.go
index c9033b38..64092236 100644
--- a/cmd/permissions_center.go
+++ b/cmd/permissions_center.go
@@ -157,7 +157,7 @@ func permissionCenterSummary(m *chatModel) string {
 	b.WriteString(fmt.Sprintf("  Mode: %s\n", permissionModeLabel(m.session)))
 	b.WriteString(fmt.Sprintf("  Rules: %d allow, %d deny\n", len(allowRules), len(denyRules)))
 	b.WriteString(fmt.Sprintf("  Behavior: %s\n", permissionBehaviorSummary(level)))
-	b.WriteString(fmt.Sprintf("  Mode behavior: %s\n", permissionModeSummary(m.session.Mode)))
+	b.WriteString(fmt.Sprintf("  Mode behavior: %s\n", permissionModeSummary(m.session.ModeValue())))
 	if len(allowRules) > 0 {
 		b.WriteString("  Allow: " + strings.Join(allowRules, ", ") + "\n")
 	}
@@ -298,7 +298,7 @@ func resetPermissionCenter(m *chatModel) {
 	if m == nil || m.session == nil {
 		return
 	}
-	m.session.Autonomy = DefaultContainerAutonomy
+	m.session.PermSvc().SetAutonomy(DefaultContainerAutonomy)
 	m.settings.Autonomy = permissionTierSettingValue(DefaultContainerAutonomy)
 	m.settings.Sandbox = defaultPermissionSandbox
 	sandboxFlag = defaultPermissionSandbox
@@ -324,7 +324,7 @@ func (m *chatModel) handlePermissionsCommand(parts []string) (chatModel, tea.Cmd
 		m.messages = append(m.messages, displayMsg{role: "system", content: permissionCenterSummary(m)})
 	case "mode":
 		if len(parts) < 3 {
-			m.messages = append(m.messages, displayMsg{role: "system", content: fmt.Sprintf("Current mode: %s\nBehavior: %s\nUsage: /permissions mode <default|edits|bypass|dontask|plan>", permissionModeLabel(m.session), permissionModeSummary(m.session.Mode))})
+			m.messages = append(m.messages, displayMsg{role: "system", content: fmt.Sprintf("Current mode: %s\nBehavior: %s\nUsage: /permissions mode <default|edits|bypass|dontask|plan>", permissionModeLabel(m.session), permissionModeSummary(m.session.ModeValue()))})
 			return *m, nil
 		}
 		mode, label, ok := normalizePermissionMode(parts[2])
@@ -347,7 +347,7 @@ func (m *chatModel) handlePermissionsCommand(parts []string) (chatModel, tea.Cmd
 			m.messages = append(m.messages, displayMsg{role: "error", content: "Valid tiers: scout, builder, operator, autonomous"})
 			return *m, nil
 		}
-		m.session.Autonomy = level
+		m.session.PermSvc().SetAutonomy(level)
 		m.settings.Autonomy = permissionTierSettingValue(level)
 		m.messages = append(m.messages, displayMsg{role: "system", content: fmt.Sprintf("Permission tier → %s\nBehavior: %s", label, permissionBehaviorSummary(level))})
 	case "sandbox":
diff --git a/cmd/session_sync.go b/cmd/session_sync.go
index fcb47211..b6d2a691 100644
--- a/cmd/session_sync.go
+++ b/cmd/session_sync.go
@@ -11,7 +11,7 @@ import (
 
 // syncSessionFromPersistedSelection copies eyrie provider.json selection into the
 // live session when the session fields are empty (status bar can show ActiveModel
-// while s.model is still unset, which breaks deployment routing).
+// while the model field is still unset, which breaks deployment routing).
 func syncSessionFromPersistedSelection(sess *engine.Session, settings hawkconfig.Settings) {
 	if sess == nil {
 		return
diff --git a/cmd/snapshot_cmd.go b/cmd/snapshot_cmd.go
index 29a77c9a..1b09baac 100644
--- a/cmd/snapshot_cmd.go
+++ b/cmd/snapshot_cmd.go
@@ -76,7 +76,7 @@ func (m chatModel) restoreSnapshot(hash string) (tea.Model, tea.Cmd) {
 		return m, nil
 	}
 
-	m.messages = append(m.messages, displayMsg{role: "system", content: fmt.Sprintf("Restored to snapshot %s. Files have been reverted.", hash)})
+	m.messages = append(m.messages, displayMsg{role: "system", content: fmt.Sprintf("Restored snapshot %q — file changes reverted.", hash)})
 	return m, nil
 }
 
diff --git a/cmd/statusbar.go b/cmd/statusbar.go
index 7f380ccd..9b8aa63e 100644
--- a/cmd/statusbar.go
+++ b/cmd/statusbar.go
@@ -70,9 +70,9 @@ func renderStatusBarRight(m *chatModel) string {
 	focusStyle := lipgloss.NewStyle().Foreground(infoSky).Inline(true)
 	dim := lipgloss.NewStyle().Foreground(dimColor).Inline(true)
 
-	tokens := m.session.Cost.PromptTokens + m.session.Cost.CompletionTokens
+	tokens := m.session.CostValue().PromptTokens + m.session.CostValue().CompletionTokens
 	tokenText := "● " + formatTokenCountCompact(tokens) + " tokens"
-	costText := fmt.Sprintf("$%.2f", m.session.Cost.Total())
+	costText := fmt.Sprintf("$%.2f", m.session.CostValue().Total())
 	timerText := icons.ClockOutline() + " " + formatSessionDuration(sessionDuration(m))
 
 	var meta []string
@@ -191,8 +191,8 @@ func containerFooterLeft(m chatModel) (bold, dim string) {
 	}
 	if m.containerReady && strings.TrimSpace(m.containerStatus) != "" {
 		tier := "Builder"
-		if m.session != nil && m.session.Autonomy != 0 {
-			tier = autonomyTierName(m.session.Autonomy)
+		if m.session != nil && m.session.PermSvc().Autonomy() != 0 {
+			tier = autonomyTierName(m.session.PermSvc().Autonomy())
 		}
 		status := shortenFooterContainerStatus(strings.TrimSpace(m.containerStatus))
 		return bold, fmt.Sprintf(" %s · %s", status, tier)
@@ -251,7 +251,7 @@ func statusLineSummary(m *chatModel) string {
 		branch, _ = gitOutput("rev-parse", "--short", "HEAD")
 	}
 	gw, model, _ := m.connectionStatusParts()
-	tokens := m.session.Cost.PromptTokens + m.session.Cost.CompletionTokens
+	tokens := m.session.CostValue().PromptTokens + m.session.CostValue().CompletionTokens
 	return fmt.Sprintf(
 		"Status line (footer)\n  cwd: %s\n  branch: %s\n  gateway: %s\n  model: %s\n  tokens: %s\n  cost: $%.2f\n  duration: %s\n  %s",
 		shortenHomePath(cwd),
@@ -259,8 +259,8 @@ func statusLineSummary(m *chatModel) string {
 		gw,
 		model,
 		formatTokenCountWithCommas(tokens),
-		m.session.Cost.Total(),
+		m.session.CostValue().Total(),
 		formatSessionDuration(sessionDuration(m)),
-		m.session.Cost.Summary(),
+		m.session.CostValue().Summary(),
 	)
 }
diff --git a/cmd/statusbar_test.go b/cmd/statusbar_test.go
index 04887d65..40deb6db 100644
--- a/cmd/statusbar_test.go
+++ b/cmd/statusbar_test.go
@@ -15,8 +15,8 @@ func TestRenderStatusBar_SignatureExists(t *testing.T) {
 
 func TestRenderStatusBarRight_IncludesTokensLabel(t *testing.T) {
 	m := &chatModel{session: &engine.Session{}}
-	m.session.Cost.PromptTokens = 1200
-	m.session.Cost.CompletionTokens = 300
+	m.session.CostValue().PromptTokens = 1200
+	m.session.CostValue().CompletionTokens = 300
 	got := renderStatusBarRight(m)
 	if !strings.Contains(got, "tokens") {
 		t.Fatalf("expected tokens label in footer right, got %q", got)
diff --git a/cmd/welcome_gate.go b/cmd/welcome_gate.go
index 6df01fcc..bff112bf 100644
--- a/cmd/welcome_gate.go
+++ b/cmd/welcome_gate.go
@@ -192,7 +192,7 @@ func (m chatModel) flushSandboxReadyMessage() chatModel {
 	m.sandboxReadyPending = false
 	m.messages = append(m.messages, displayMsg{
 		role:    "system",
-		content: formatSandboxReadyAutonomyMessage(m.session.Autonomy),
+		content: formatSandboxReadyAutonomyMessage(m.session.PermSvc().Autonomy()),
 	})
 	m.viewDirty = true
 	return m
diff --git a/internal/engine/permission_service.go b/internal/engine/permission_service.go
index 761a8821..53fb71db 100644
--- a/internal/engine/permission_service.go
+++ b/internal/engine/permission_service.go
@@ -51,6 +51,11 @@ type PermissionService struct {
 
 // NewPermissionService constructs a PermissionService with a fresh
 // PermissionEngine. Tests can inject a custom engine via WithEngine.
+//
+// Note: mode is intentionally left at the zero value (PermissionMode(""))
+// so that IsZero() correctly reports true for a freshly constructed
+// service. Callers that want the default mode should call SetMode
+// (or set the field directly during tests). See M4 in the code review.
 func NewPermissionService(log *logger.Logger) *PermissionService {
 	if log == nil {
 		log = logger.Default()
@@ -62,7 +67,6 @@ func NewPermissionService(log *logger.Logger) *PermissionService {
 		autoMode:   pe.AutoMode,
 		classifier: pe.Classifier,
 		bypassKill: pe.BypassKill,
-		mode:       PermissionModeDefault,
 		log:        log,
 	}
 }
@@ -185,8 +189,9 @@ func (s *PermissionService) BypassKill() *permissions.BypassKillswitch { return
 
 // IsZero reports whether this service has been fully configured.
 // A zero PermissionService has no approval gate, no custom permission
-// fn, and the default mode — that's the "freshly constructed" state
-// used by NewSessionWithClient.
+// fn, and an empty mode — that's the "freshly constructed" state
+// used by NewSessionWithClient (the constructor no longer pre-sets
+// mode = PermissionModeDefault, see M4 in the code review).
 func (s *PermissionService) IsZero() bool {
-	return s == nil || (s.approval == nil && s.permissionFn == nil && s.mode == PermissionModeDefault)
+	return s == nil || (s.approval == nil && s.permissionFn == nil && s.mode == "")
 }
diff --git a/internal/engine/session.go b/internal/engine/session.go
index a5311f3d..cbb461a9 100644
--- a/internal/engine/session.go
+++ b/internal/engine/session.go
@@ -163,33 +163,37 @@ type Session struct {
 
 	// Advanced features
 	//
-	// Deprecated: most of these have been folded into sub-services.
+	// Deprecated: most of these have been folded into sub-services;
+	// a few remain as legacy fields without a sub-service accessor
+	// (Trajectory, LintLoop, TestLoop, FileMentions, Files, Snapshots,
+	// Tracer). For those, keep reading the legacy field — they're
+	// populated at session construction and don't have a setter.
 	//   Autonomy       -> s.PermSvc().Autonomy()
 	//   Sandbox        -> s.Tools().Sandbox()
-	//   Plan           -> s.Tools().PlanState()
+	//   Plan           -> s.Plan (legacy field; not yet on a sub-service)
 	//   Beliefs        -> s.LifecycleSvc().Beliefs()
 	//   Critic         -> s.LifecycleSvc().Critic()
 	//   Backtrack      -> s.LifecycleSvc().Backtrack()
 	//   Limits         -> s.LifecycleSvc().Limits()
-	//   Trajectory     -> s.LifecycleSvc().Trajectory()
+	//   Trajectory     -> legacy field; not yet on a sub-service
 	//   Shadow         -> s.LifecycleSvc().Shadow()
 	//   ConvoDAG       -> s.Persistence().DAG()
 	//   Sleeptime      -> s.MemorySvc().Sleeptime()
 	//   Activity       -> s.MemorySvc().Activity()
 	//   SkillDistiller -> s.MemorySvc().SkillDistiller()
-	//   RateLimiter    -> s.ChatLLM().RateLimiter()
+	//   RateLimiter    -> s.RateLimiter (legacy field; not yet on ChatLLM)
 	//   AgentsAccum    -> s.LifecycleSvc().AgentsAccum()
-	//   FewShotStore   -> s.LifecycleSvc().FewShot()
+	//   FewShotStore   -> s.LifecycleSvc().FewShotStore()
 	//   AdaptivePrompt -> s.LifecycleSvc().AdaptivePrompt()
-	//   LintLoop       -> s.LifecycleSvc().LintLoop()
-	//   TestLoop       -> s.LifecycleSvc().TestLoop()
-	//   FileMentions   -> s.MemorySvc().FileMentions()
+	//   LintLoop       -> legacy field; not yet on a sub-service
+	//   TestLoop       -> legacy field; not yet on a sub-service
+	//   FileMentions   -> legacy field; not yet on a sub-service
 	//   ResponseCache  -> s.LifecycleSvc().ResponseCache()
 	//   Pipeline       -> s.LifecycleSvc().Pipeline()
-	//   Files          -> s.Persistence().Files()
+	//   Files          -> legacy field; not yet on Persistence
 	//   Steering       -> s.Persistence().Steering()
-	//   Snapshots      -> s.Persistence().Snapshots()
-	//   Tracer         -> global; passed to services at construction.
+	//   Snapshots      -> legacy field; not yet on Persistence
+	//   Tracer         -> legacy field; oteltrace.NewTracer() for new code
 	Autonomy       AutonomyLevel              // autonomy.go — permission level
 	Sandbox        *DiffSandbox               // diffsandbox.go — staged file changes
 	Plan           *PlanState                 // subtask.go — user-activated plan
@@ -496,24 +500,28 @@ func (s *Session) SetAPIKeys(apiKeys map[string]string) {
 }
 
 func (s *Session) AddUser(content string) {
-	s.Persistence().AddUser(content)
-	if s.ConvoDAG != nil {
-		parentID := ""
-		if head, err := s.ConvoDAG.Head(context.Background()); err == nil && head != nil {
-			parentID = head.ID
-		}
-		_, _ = s.ConvoDAG.Append(context.Background(), parentID, "user", content)
-	}
-	if s.Memory != nil && strings.Contains(strings.ToLower(content), "remember") {
-		go func(c string) {
-			// Use timeout context so goroutine doesn't hang if backend is slow.
-			rCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-			_ = rCtx // timeout context available if Remember is extended to accept it
-			if err := s.Memory.Remember(c, "user_explicit"); err != nil {
-				slog.Warn("background memory remember failed", "error", err)
+	if p := s.Persistence(); p != nil {
+		p.AddUser(content)
+		if dag := p.DAG(); dag != nil {
+			parentID := ""
+			if head, err := dag.Head(context.Background()); err == nil && head != nil {
+				parentID = head.ID
 			}
-		}(content)
+			_, _ = dag.Append(context.Background(), parentID, "user", content)
+		}
+	}
+	if memSvc := s.MemorySvc(); memSvc != nil {
+		if mem := memSvc.Memory(); mem != nil && strings.Contains(strings.ToLower(content), "remember") {
+			go func(c string) {
+				// Use timeout context so goroutine doesn't hang if backend is slow.
+				rCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+				defer cancel()
+				_ = rCtx // timeout context available if Remember is extended to accept it
+				if err := mem.Remember(c, "user_explicit"); err != nil {
+					slog.Warn("background memory remember failed", "error", err)
+				}
+			}(content)
+		}
 	}
 }
 
@@ -528,38 +536,47 @@ func (s *Session) AddUserWithImage(content string, imageBase64 string, imageType
 	}
 	s.messages = append(s.messages, msg)
 	s.mu.Unlock()
-	if s.ConvoDAG != nil {
-		parentID := ""
-		if head, err := s.ConvoDAG.Head(context.Background()); err == nil && head != nil {
-			parentID = head.ID
+	if p := s.Persistence(); p != nil {
+		if dag := p.DAG(); dag != nil {
+			parentID := ""
+			if head, err := dag.Head(context.Background()); err == nil && head != nil {
+				parentID = head.ID
+			}
+			_, _ = dag.Append(context.Background(), parentID, "user", content+" [image attached]")
 		}
-		_, _ = s.ConvoDAG.Append(context.Background(), parentID, "user", content+" [image attached]")
 	}
 }
 
 func (s *Session) AddAssistant(content string) {
-	s.Persistence().AddAssistant(content)
-	if s.ConvoDAG != nil {
-		parentID := ""
-		if head, err := s.ConvoDAG.Head(context.Background()); err == nil && head != nil {
-			parentID = head.ID
+	if p := s.Persistence(); p != nil {
+		p.AddAssistant(content)
+		if dag := p.DAG(); dag != nil {
+			parentID := ""
+			if head, err := dag.Head(context.Background()); err == nil && head != nil {
+				parentID = head.ID
+			}
+			_, _ = dag.Append(context.Background(), parentID, "assistant", content)
 		}
-		_, _ = s.ConvoDAG.Append(context.Background(), parentID, "assistant", content)
 	}
 }
 
 // ForkConversation creates a new branch from a specific point in history.
 // Returns the fork node ID and the messages up to that point.
 func (s *Session) ForkConversation(nodeID string) (string, error) {
-	if s.ConvoDAG == nil {
+	p := s.Persistence()
+	if p == nil {
+		return "", nil
+	}
+	dag := p.DAG()
+	if dag == nil {
 		return "", nil
 	}
-	fork, err := s.ConvoDAG.Fork(context.Background(), nodeID)
+	fork, err := dag.Fork(context.Background(), nodeID)
 	if err != nil {
 		return "", err
 	}
 	// Rebuild messages from the forked branch
-	history, err := s.ConvoDAG.History(context.Background(), fork.ID)
+	history, err := dag.History(context.Background(), fork.ID)
 	if err != nil {
 		return "", err
 	}
@@ -576,13 +593,18 @@ func (s *Session) ForkConversation(nodeID string) (string, error) {
 
 // SwitchBranch navigates to a different branch point and rebuilds messages.
 func (s *Session) SwitchBranch(nodeID string) error {
-	if s.ConvoDAG == nil {
+	p := s.Persistence()
+	if p == nil {
 		return nil
 	}
-	if err := s.ConvoDAG.SetHead(context.Background(), nodeID); err != nil {
+	dag := p.DAG()
+	if dag == nil {
+		return nil
+	}
+	if err := dag.SetHead(context.Background(), nodeID); err != nil {
 		return err
 	}
-	history, err := s.ConvoDAG.History(context.Background(), nodeID)
+	history, err := dag.History(context.Background(), nodeID)
 	if err != nil {
 		return err
 	}
@@ -599,18 +621,28 @@ func (s *Session) SwitchBranch(nodeID string) error {
 
 // ListBranches returns child nodes (alternative branches) from a given node.
 func (s *Session) ListBranches(nodeID string) ([]*storage.DAGNode, error) {
-	if s.ConvoDAG == nil {
+	p := s.Persistence()
+	if p == nil {
+		return nil, nil
+	}
+	dag := p.DAG()
+	if dag == nil {
 		return nil, nil
 	}
-	return s.ConvoDAG.Branches(context.Background(), nodeID)
+	return dag.Branches(context.Background(), nodeID)
 }
 
 // ConvoHead returns the current conversation head node ID.
 func (s *Session) ConvoHead() string {
-	if s.ConvoDAG == nil {
+	p := s.Persistence()
+	if p == nil {
 		return ""
 	}
-	if head, err := s.ConvoDAG.Head(context.Background()); err == nil && head != nil {
+	dag := p.DAG()
+	if dag == nil {
+		return ""
+	}
+	if head, err := dag.Head(context.Background()); err == nil && head != nil {
 		return head.ID
 	}
 	return ""
@@ -677,6 +709,16 @@ func (s *Session) SetAutoCompactThresholdPct(pct int) {
 	s.AutoCompactThresholdPct = pct
 }
 
+// SetPinnedMessages sets the number of recent messages that are
+// protected from compaction. New code should call this instead of
+// writing to the legacy s.PinnedMessages field directly.
+func (s *Session) SetPinnedMessages(n int) {
+	s.PinnedMessages = n
+	if s.persist != nil {
+		s.persist.SetPinnedMessages(n)
+	}
+}
+
 // SetGLMThinkingEnabled sets the GLM/Z.AI extended-reasoning toggle.
 // New code should call this instead of writing to the legacy
 // s.GLMThinkingEnabled field directly.
@@ -697,6 +739,16 @@ func (s *Session) SetContainerRequired(v bool) {
 	s.ContainerRequired = v
 }
 
+// SetContainerExecutor sets the container executor and updates
+// the ToolService so the legacy s.ContainerExecutor field and
+// s.Tools().ContainerExecutor() stay in sync.
+func (s *Session) SetContainerExecutor(ce tool.ContainerExecutor) {
+	s.ContainerExecutor = ce
+	if s.tools != nil {
+		s.tools.WithContainerExecutor(ce, s.ContainerRequired)
+	}
+}
+
 // SetAskUserFn sets the user-prompt callback. New code should
 // call this instead of writing to the legacy s.AskUserFn field.
 func (s *Session) SetAskUserFn(fn func(question string) (string, error)) {
@@ -720,6 +772,36 @@ func (s *Session) SetConvoDAG(dag *storage.DAG) {
 	}
 }
 
+// SetContextWindowCached sets the catalog context window. New code
+// should call this instead of writing to the legacy
+// s.ContextWindowCached field directly.
+func (s *Session) SetContextWindowCached(n int) {
+	s.ContextWindowCached = n
+	if s.persist != nil {
+		s.persist.SetContextWindowCached(n)
+	}
+}
+
+// ModeValue returns the active permission mode, with the
+// PermissionService's mode taking precedence over the legacy
+// s.Mode field. Used by /permissions summary, /status, and the
+// chat footer to render the active permission mode.
+func (s *Session) ModeValue() PermissionMode {
+	if s.perms != nil {
+		return s.perms.Mode()
+	}
+	return s.Mode
+}
+
+// SetMode replaces the active permission mode. New code should
+// call this instead of writing to the legacy s.Mode field.
+func (s *Session) SetMode(mode PermissionMode) {
+	s.Mode = mode
+	if s.perms != nil {
+		_ = s.perms.SetMode(string(mode))
+	}
+}
+
 // ContextWindowCachedValue returns the cached context window size.
 // New code should call this instead of reading s.ContextWindowCached
 // directly. Falls back to the legacy field for back-compat with
diff --git a/internal/multiagent/messaging.go b/internal/multiagent/messaging.go
index 7de014aa..d77911a3 100644
--- a/internal/multiagent/messaging.go
+++ b/internal/multiagent/messaging.go
@@ -104,12 +104,28 @@ func (mb *MessageBus) Stats() BusStats {
 	}
 }
 
+// dropLogEveryN controls the sampling rate for dropped-message
+// WARN logs. The first drop and then every Nth drop are logged;
+// the rest are silent (just bump the counter). The default (100)
+// balances observability against log volume when an agent is stuck
+// or the bus is under sustained pressure. Lower it for more
+// visibility; raise it for quieter logs.
+const dropLogEveryN = 100
+
 // logDroppedMessage records a dropped-message event. Sampling: logs the
-// first drop and then every 100th, to avoid log spam when an agent is
-// stuck or the bus is under sustained pressure.
+// first drop and then every Nth drop (see dropLogEveryN), to avoid
+// log spam when an agent is stuck or the bus is under sustained
+// pressure (see M9 in the code review).
+//
+// IMPORTANT: callers MUST hold mb.mu (write lock) when invoking this
+// method. The sampling decision uses the atomic droppedCount to avoid
+// holding mb.mu for the slog.Warn call (which can serialize on the
+// slog handler's internal mutex if the handler is slow — see M8).
+// The actual slog.Warn runs synchronously; for high-throughput drop
+// scenarios consider a buffered channel + background drainer.
 func (mb *MessageBus) logDroppedMessage(from, to, topic string) {
 	n := mb.droppedCount.Load()
-	if n != 1 && n%100 != 0 {
+	if n != 1 && n%dropLogEveryN != 0 {
 		return
 	}
 	slog.Warn(
@@ -169,70 +185,105 @@ func (mb *MessageBus) Unregister(agentID string) {
 // Send delivers a message to a specific agent or broadcasts to all.
 // If msg.To is set, delivers to that specific agent.
 // If msg.To is empty, broadcasts to all registered agents (except sender).
+//
+// The dropped-message WARN log is performed after mb.mu is released
+// (see M8): a slow slog handler should not serialize bus operations.
+// We snapshot the (from, to, topic) of each drop into a local slice
+// while still holding the lock, then iterate the slice after the
+// inner function returns and the lock has been released.
 func (mb *MessageBus) Send(msg AgentMessage) error {
-	mb.mu.Lock()
-	defer mb.mu.Unlock()
-
-	if msg.ID == "" {
-		msg.ID = generateID()
-	}
-	if msg.Timestamp.IsZero() {
-		msg.Timestamp = time.Now()
-	}
-	if msg.Priority == 0 {
-		msg.Priority = 3
-	}
-
-	mb.history = append(mb.history, msg)
+	// sentErr is set inside the locked section for two cases:
+	//   - msg.To names an agent that isn't registered
+	//   - msg.To names a registered agent whose channel is full
+	// The first case is a hard error; the second is "channel full
+	// for agent %q" (the original error return) and is also propagated
+	// to the caller. Both were returned under the lock in the old
+	// implementation; the new implementation collects the error and
+	// returns it after the lock is released.
+	var sentErr error
+	var drops []dropEvent
+
+	func() {
+		mb.mu.Lock()
+		defer mb.mu.Unlock()
+
+		if msg.ID == "" {
+			msg.ID = generateID()
+		}
+		if msg.Timestamp.IsZero() {
+			msg.Timestamp = time.Now()
+		}
+		if msg.Priority == 0 {
+			msg.Priority = 3
+		}
 
-	// Signal any in-flight WaitForResponse callers. Must happen while
-	// still holding mb.mu so the waiter's defer-cleanup can't race
-	// with us (the waiter's defer also acquires mb.mu to remove itself).
-	if msg.ResponseTo != "" {
-		if waiters := mb.responseWaiters[msg.ResponseTo]; len(waiters) > 0 {
-			for _, w := range waiters {
-				w.msg = &msg
-				close(w.done)
+		mb.history = append(mb.history, msg)
+
+		// Signal any in-flight WaitForResponse callers. Must happen while
+		// still holding mb.mu so the waiter's defer-cleanup can't race
+		// with us (the waiter's defer also acquires mb.mu to remove itself).
+		if msg.ResponseTo != "" {
+			if waiters := mb.responseWaiters[msg.ResponseTo]; len(waiters) > 0 {
+				for _, w := range waiters {
+					w.msg = &msg
+					close(w.done)
+				}
+				delete(mb.responseWaiters, msg.ResponseTo)
 			}
-			delete(mb.responseWaiters, msg.ResponseTo)
 		}
-	}
 
-	if msg.To != "" {
-		// Deliver to specific agent
-		ch, ok := mb.channels[msg.To]
-		if !ok {
-			return fmt.Errorf("agent %q not registered", msg.To)
-		}
-		select {
-		case ch <- msg:
-		default:
-			mb.droppedCount.Add(1)
-			mb.logDroppedMessage(msg.From, msg.To, msg.Topic)
-			return fmt.Errorf("channel full for agent %q", msg.To)
+		if msg.To != "" {
+			ch, ok := mb.channels[msg.To]
+			if !ok {
+				sentErr = fmt.Errorf("agent %q not registered", msg.To)
+				return
+			}
+			select {
+			case ch <- msg:
+			default:
+				mb.droppedCount.Add(1)
+				sentErr = fmt.Errorf("channel full for agent %q", msg.To)
+				drops = append(drops, dropEvent{from: msg.From, to: msg.To, topic: msg.Topic})
+			}
+			return
 		}
-		return nil
-	}
 
-	// Broadcast to all agents except sender
-	for agentID, ch := range mb.channels {
-		if agentID == msg.From {
-			continue
-		}
-		// If topic-based, only send to subscribers of that topic
-		if msg.Topic != "" && len(mb.subscribers[msg.Topic]) > 0 {
-			if !contains(mb.subscribers[msg.Topic], agentID) {
+		// Broadcast to all agents except sender
+		for agentID, ch := range mb.channels {
+			if agentID == msg.From {
 				continue
 			}
+			// If topic-based, only send to subscribers of that topic
+			if msg.Topic != "" && len(mb.subscribers[msg.Topic]) > 0 {
+				if !contains(mb.subscribers[msg.Topic], agentID) {
+					continue
+				}
+			}
+			select {
+			case ch <- msg:
+			default:
+				mb.droppedCount.Add(1)
+				drops = append(drops, dropEvent{from: msg.From, to: agentID, topic: msg.Topic})
+			}
 		}
-		select {
-		case ch <- msg:
-		default:
-			mb.droppedCount.Add(1)
-			mb.logDroppedMessage(msg.From, agentID, msg.Topic)
-		}
+	}()
+
+	// Log drops outside the lock so a slow slog handler (file I/O,
+	// network sink) doesn't serialize bus operations (M8 fix).
+	for _, d := range drops {
+		mb.logDroppedMessage(d.from, d.to, d.topic)
 	}
-	return nil
+
+	return sentErr
+}
+
+// dropEvent is a snapshot of a single drop, captured under mb.mu and
+// logged outside the lock (M8). The fields are plain copies; no
+// pointers into bus state.
+type dropEvent struct {
+	from  string
+	to    string
+	topic string
 }
 
 // Subscribe registers an agent to receive messages for a given topic.
@@ -548,11 +599,19 @@ func (mb *MessageBus) IsLocked(resource string) bool {
 // registers as a waiter; ReleaseLock() closes the done channel when
 // the lock is freed. This replaces the previous 20ms busy-poll.
 //
-// After each signal (or on entry, before registering) the caller
-// re-attempts AcquireLock. If a different waiter won the race, the
-// caller loops and waits for the next signal. This is the standard
-// "thundering herd" pattern; in practice there are only a few waiters
-// per resource so the cost is negligible.
+// Once ReleaseLock closes our done channel, the channel stays closed
+// for the lifetime of the waiter. The previous implementation re-entered
+// the select after each signal, which (a) busy-spinned calling
+// AcquireLock on the same closed-channel signal under contention and
+// (b) raced the timer.C case: both `<-w.done` and `<-timer.C` are
+// ready, and select picks randomly — so the timeout could be missed
+// or the function could loop indefinitely waiting on the second signal
+// from a ReleaseLock that never re-fires. (See M7 in the code review.)
+//
+// Fix: use a one-shot select. On the first signal (w.done or timer),
+// try AcquireLock exactly once. If it succeeds, return nil; if the
+// timer fired, return a timeout error. There is no second loop, so
+// no busy-spin and no select race.
 func (mb *MessageBus) WaitForLock(resource, owner string, timeout time.Duration) error {
 	// Fast path: try immediately; the lock can be acquired without
 	// waiting if no one else holds it.
@@ -571,17 +630,17 @@ func (mb *MessageBus) WaitForLock(resource, owner string, timeout time.Duration)
 	timer := time.NewTimer(timeout)
 	defer timer.Stop()
 
-	for {
-		select {
-		case <-w.done:
-			// Lock was released. Retry immediately; if another waiter
-			// won the race, loop and wait for the next signal.
-			if err := mb.AcquireLock(resource, owner, timeout); err == nil {
-				return nil
-			}
-		case <-timer.C:
-			return fmt.Errorf("timeout waiting for lock on %q", resource)
+	select {
+	case <-w.done:
+		// Lock was released by another agent. Try to acquire it.
+		// If we lose the race to a sibling waiter, return an error
+		// rather than re-registering and looping (M7 fix: no busy-spin).
+		if err := mb.AcquireLock(resource, owner, timeout); err != nil {
+			return err
 		}
+		return nil
+	case <-timer.C:
+		return fmt.Errorf("timeout waiting for lock on %q", resource)
 	}
 }
 
diff --git a/internal/multiagent/messaging_signals_test.go b/internal/multiagent/messaging_signals_test.go
index 1c7d401b..1849e7a6 100644
--- a/internal/multiagent/messaging_signals_test.go
+++ b/internal/multiagent/messaging_signals_test.go
@@ -339,75 +339,67 @@ func TestWaitForLock_WaiterCleanedUpOnTimeout(t *testing.T) {
 
 // TestWaitForLock_MultipleWaiters_OnlyOneAcquires: two waiters on
 // the same resource; ReleaseLock wakes both; only one acquires; the
-// other re-registers and waits again.
+// other returns an error (does not re-register, see M7).
 func TestWaitForLock_MultipleWaiters_OnlyOneAcquires(t *testing.T) {
 	mb := NewMessageBus()
 	if err := mb.AcquireLock("res-shared", "owner-a", time.Second); err != nil {
 		t.Fatalf("AcquireLock: %v", err)
 	}
 
-	results := make(chan string, 2)
+	type result struct {
+		owner string
+		err   error
+	}
+	results := make(chan result, 2)
 	for _, owner := range []string{"owner-b", "owner-c"} {
 		owner := owner
 		go func() {
 			err := mb.WaitForLock("res-shared", owner, 500*time.Millisecond)
-			if err != nil {
-				results <- "err:" + err.Error()
-			} else {
-				results <- "acquired:" + owner
-			}
+			results <- result{owner, err}
 		}()
 	}
 	time.Sleep(20 * time.Millisecond)
 
 	// First release: both waiters wake, one acquires, the other
-	// re-registers and waits again.
+	// returns an error (M7: no re-register, no busy-spin).
 	if err := mb.ReleaseLock("res-shared", "owner-a"); err != nil {
 		t.Fatalf("ReleaseLock: %v", err)
 	}
 
-	// One of the two should acquire.
-	select {
-	case r := <-results:
-		if !strings.HasPrefix(r, "acquired:") {
-			t.Fatalf("first waiter did not acquire: %s", r)
+	var winner result
+	var loser result
+	gotBoth := 0
+	for gotBoth < 2 {
+		select {
+		case r := <-results:
+			if r.err == nil {
+				winner = r
+			} else {
+				loser = r
+			}
+			gotBoth++
+		case <-time.After(200 * time.Millisecond):
+			t.Fatalf("only %d/2 waiter results", gotBoth)
 		}
-	case <-time.After(200 * time.Millisecond):
-		t.Fatal("no first waiter result")
 	}
-
-	// The other should still be waiting. Release again so it can acquire.
-	mb.lockMu.Lock()
-	holder := ""
-	for res, lock := range mb.locks {
-		if res == "res-shared" {
-			holder = lock.Owner
-		}
+	if winner.err != nil {
+		t.Fatalf("first waiter did not acquire: err=%v", winner.err)
 	}
-	mb.lockMu.Unlock()
-	if holder == "" {
-		t.Fatal("expected a holder after first acquisition")
+	if loser.err == nil {
+		t.Fatalf("second waiter unexpectedly acquired: %+v", loser)
 	}
-	if err := mb.ReleaseLock("res-shared", holder); err != nil {
-		t.Fatalf("ReleaseLock 2: %v", err)
-	}
-
-	select {
-	case r := <-results:
-		if !strings.HasPrefix(r, "acquired:") {
-			t.Fatalf("second waiter did not acquire: %s", r)
-		}
-		if strings.TrimPrefix(r, "acquired:") == holder {
-			t.Errorf("second waiter is the same as first: %s", holder)
-		}
-	case <-time.After(300 * time.Millisecond):
-		t.Fatal("no second waiter result")
+	if winner.owner == loser.owner {
+		t.Errorf("both waiters are the same: %s", winner.owner)
 	}
 }
 
-// TestWaitForLock_OwnerMismatchOnRelease: a ReleaseLock from a
-// non-owner does not wake waiters.
-func TestWaitForLock_OwnerMismatchOnRelease(t *testing.T) {
+// TestReleaseLock_NonOwnerReturnsError verifies that ReleaseLock
+// returns an error when the caller is not the lock owner. The
+// error is independent of any waiter (which the next test covers).
+// Renamed from TestWaitForLock_OwnerMismatchOnRelease — the original
+// name claimed the test was about "waiters not being woken", but
+// the body only checked the error return (see M10 in the code review).
+func TestReleaseLock_NonOwnerReturnsError(t *testing.T) {
 	mb := NewMessageBus()
 	_ = mb.AcquireLock("res-1", "owner-a", time.Second)
 	_ = mb.AcquireLock("res-1", "owner-b", time.Second) // should fail but...
@@ -420,16 +412,83 @@ func TestWaitForLock_OwnerMismatchOnRelease(t *testing.T) {
 	}
 }
 
+// TestWaitForLock_ReleaseByNonOwnerDoesNotWakeWaiter is the
+// matching waiter-assertion test that the original
+// TestWaitForLock_OwnerMismatchOnRelease claimed to be. It
+// registers a real waiter, attempts a ReleaseLock from a
+// non-owner (which returns an error and must NOT close the
+// waiter's done channel), and verifies the waiter times out
+// at the configured timeout (rather than being woken by the
+// failed ReleaseLock).
+func TestWaitForLock_ReleaseByNonOwnerDoesNotWakeWaiter(t *testing.T) {
+	mb := NewMessageBus()
+	if err := mb.AcquireLock("res-1", "owner-a", time.Second); err != nil {
+		t.Fatalf("AcquireLock: %v", err)
+	}
+
+	// Register a waiter in a goroutine. The waiter uses a short
+	// timeout (80ms) so the test runs quickly if the failed
+	// ReleaseLock does not wake it.
+	timeout := 80 * time.Millisecond
+	type result struct {
+		err error
+	}
+	results := make(chan result, 1)
+	go func() {
+		err := mb.WaitForLock("res-1", "owner-b", timeout)
+		results <- result{err}
+	}()
+	// Give the waiter time to register.
+	time.Sleep(20 * time.Millisecond)
+
+	// Attempt ReleaseLock from the wrong owner. This must NOT
+	// wake the waiter; the waiter should time out at ~timeout.
+	err := mb.ReleaseLock("res-1", "owner-b") // wrong owner
+	if err == nil {
+		t.Fatal("expected error on owner mismatch, got nil")
+	}
+
+	// The waiter should now time out (not be woken early).
+	select {
+	case r := <-results:
+		if r.err == nil {
+			t.Fatal("waiter was unexpectedly woken by failed ReleaseLock (M10 regression)")
+		}
+		if !strings.Contains(r.err.Error(), "timeout") {
+			t.Errorf("waiter err = %q, want 'timeout'", r.err.Error())
+		}
+	case <-time.After(timeout + 200*time.Millisecond):
+		t.Fatal("waiter did not return within timeout window")
+	}
+}
+
 // TestStats_NotAffectedByWaiters: responseWaiters and lockWaiters
 // do not appear in Stats; they are internal channels, not counters.
+//
+// The previous implementation launched a goroutine calling
+// WaitForResponse and never joined it — the goroutine ran for
+// 100ms after the test exited (M11 goroutine leak). Fixed by
+// using a done channel and a 1-second timeout to coordinate
+// the goroutine's lifetime with the test's.
 func TestStats_NotAffectedByWaiters(t *testing.T) {
 	mb := NewMessageBus()
 	_ = mb.Register("a")
 	_ = mb.Register("b")
 	_ = mb.Send(AgentMessage{ID: "req", From: "a", To: "b"})
+
+	// Use a done channel + 1-second timeout to join the goroutine.
+	// WaitForResponse returns after the configured 100ms timeout
+	// (no matching response is sent), so the goroutine completes
+	// well before the 1-second join deadline.
+	done := make(chan struct{})
 	go func() {
 		_, _ = mb.WaitForResponse("req", 100*time.Millisecond)
+		close(done)
 	}()
+
+	// Give the goroutine a moment to register as a waiter so the
+	// Stats() assertion below is meaningful (the waiter exists in
+	// the responseWaiters map at this point).
 	time.Sleep(10 * time.Millisecond)
 	stats := mb.Stats()
 	// HistorySz should reflect the seeded message; Agents 2; Dropped 0.
@@ -439,4 +498,14 @@ func TestStats_NotAffectedByWaiters(t *testing.T) {
 	if stats.Dropped != 0 {
 		t.Errorf("Dropped = %d, want 0", stats.Dropped)
 	}
+
+	// Join the goroutine via the done channel + 1-second timeout.
+	// If the goroutine is still running after 1s, fail loudly.
+	select {
+	case <-done:
+		// Goroutine completed (the WaitForResponse timeout fired
+		// and the waiter cleaned itself up).
+	case <-time.After(1 * time.Second):
+		t.Fatal("WaitForResponse goroutine did not return within 1s; M11 goroutine leak")
+	}
 }
diff --git a/internal/testaudit/audit_test.go b/internal/testaudit/audit_test.go
index 39536145..a3a0ea9f 100644
--- a/internal/testaudit/audit_test.go
+++ b/internal/testaudit/audit_test.go
@@ -290,11 +290,12 @@ func TestSessionLegacyFieldAccessAudit(t *testing.T) {
 	for i, f := range legacySessionFields {
 		quoted[i] = regexp.QuoteMeta(f)
 	}
-	// Match `s.Field` or `sess.Field` as a bare token. We then
-	// post-filter to exclude method calls (Field followed by `(`),
-	// which are not legacy access — they're the proper way to
-	// interact with the field via its getter/setter methods.
-	fieldPattern := regexp.MustCompile(`\bs(?:ess)?\.\s*(?:` + strings.Join(quoted, "|") + `)\b`)
+	// Match `s.Field`, `sess.Field`, or `m.session.Field` as a bare
+	// token. We then post-filter to exclude method calls (Field
+	// followed by `(`), which are not legacy access — they're the
+	// proper way to interact with the field via its getter/setter
+	// methods.
+	fieldPattern := regexp.MustCompile(`\b(?:s|sess|m\.session)\.\s*(?:` + strings.Join(quoted, "|") + `)\b`)
 
 	total := 0
 	perFile := map[string]int{}
@@ -352,12 +353,12 @@ func TestSessionLegacyFieldAccessAudit(t *testing.T) {
 	// internal/engine/stream.go with ~120 sites), so internal/
 	// remains soft-fail until those sub-PRs land.
 	//
-	// Current cmd/ backlog (2026-06-17):
-	//   chat_model_test.go 1, session_sync.go 1, snapshot_cmd.go 1,
-	//   chat_commands_util.go 1
-	// All 4 are test files or false positives (method calls
-	// matching the field pattern). The cmd/ sub-PR is complete.
-	const cmdHardFailThreshold = 4
+	// M1 (2026-06-17): audit now matches `m.session.X` (was `s.X` /
+	// `sess.X` only — a blind spot that missed all chatModel access).
+	// Threshold lowered to 0; remaining false-positives are
+	// method calls (Field followed by `(`) that the post-filter
+	// already strips out.
+	const cmdHardFailThreshold = 0
 	var cmdLegacy int
 	for f, n := range perFile {
 		if strings.HasPrefix(f, "cmd/") {