diff --git a/docs/plans/2026-09-26-tldr-store-evict.md b/docs/plans/2026-09-26-tldr-store-evict.md
new file mode 100644
index 000000000..49baa6ff2
--- /dev/null
+++ b/docs/plans/2026-09-26-tldr-store-evict.md
@@ -0,0 +1,97 @@
+# TLDR and Goal stores evict instead of filling up (#1277)
+
+## Problem
+`TldrStore.update()` throws `TLDR storage is full.` for a new identity once the store holds `MAX_RECORDS` (10,000). Nothing ever deletes a record, and the store is never told an agent closed. The owner's live store holds 412 TLDR and 374 Goal records after 15 days (~27 new identities a day), so it reaches the wall in about a year. From then on, every NEW agent's `tldr_update` and `goal_set` fails for good, while agents that already have a record keep working. Both stores are instances of this class (`src/main/index.ts`), so both fail.
+
+## Evidence
+- `src/main/tldr/TldrStore.ts` has `MAX_RECORDS = 10_000` and the throw in `update()`. `load()` refuses a file with more records than that.
+- The owner's store (`~/.config/agent-code/{tldr,goal}.json`, 2026-09-26): 412 and 374 records, oldest `updatedAt` 2026-09-12 and 2026-09-13.
+- The committed fixture `testing/fixtures/tldr-store/real-records-2026-09-25.json` supplies real record shapes for the test.
+
+## Decisions (defaults)
+1. **Evict the least recently written record that nothing is using, in the same atomic write that adds the new one.** (Revised after review; see below.) "Written" is the later of `updatedAt` and `completedAt`, because a completion is a write and a just-completed goal is exactly what the close menu shows. The store drops exactly enough records to fit, which is one.
+2. **An evicted identity's revision is remembered in memory** (the same map as set-aside records, #1247 review A). If that identity reports again in the same run, it continues above its old revision, so a reader that still holds the old record does not discard the new one as stale. Across a restart, readers start empty too, so nothing is lost there.
+3. **History files are left alone.** They have their own cap (`MAX_HISTORY_FILES`, oldest mtime first), and a user reading an old agent's timeline should still see it.
+4. **No change event is sent for an eviction.** The evicted record is the least recently written of 10,000; no pane on screen relies on it, and `TldrUpdate` has no removal shape.
+5. **`load()` still refuses a file over the cap.** The store can no longer write one, so a file over it is damage (or a newer build's larger cap). Refusing preserves it, which is the file's existing rule.
+
+## Tests (fail-first)
+In `TldrStore.system.test.ts`, on records built from the real fixture:
+- A store at exactly `MAX_RECORDS` accepts a new identity's report. It evicts the least recently written record, keeps the rest, and stays at `MAX_RECORDS` on disk.
+- A completed goal whose `completedAt` is recent is not the one evicted, even though its `updatedAt` is oldest.
+- An evicted identity that reports again continues above its evicted revision.
+
+## Review round 1 (#1328): the eviction policy changed
+All three reviewers (and steering q45) found that age alone can evict a goal that is still active. A goal is set once per task, so the oldest goal can belong to a running agent. After eviction, that agent's `goal_complete` failed, and views that had already read the record kept showing it: the peek, Agent Activity, and a tickable row in Close Completed Agents. No removal event exists.
+
+**Policy (final).** An identity is **in use** while any window's persisted workspace names it (`projectWorkspace`, the same projection Agent Activity and remote use), or while a registered, unrevoked MCP session reports as it (`BuiltInMcpHttpHost.liveTldrIdentities`, which covers an agent spawned since the last autosave). In-use identities are never evicted.
+- Every renderer view reads identities of workspace sessions only, so an evicted record is one no view shows. That is why no removal event or renderer change is needed.
+- When no candidate exists, or in-use is unknown (the workspace file has not opened yet), the store refuses with `<label> storage is full.` and writes nothing: ambiguity fails closed (q40). This also fixes the Goal store's error, which used to say "TLDR".
+
+**Declined: a renderer removal path.** With the in-use rule, no mounted view can hold an evicted identity, because views are keyed by workspace sessions and the rule excludes exactly those. A removal event would add a new wire shape through IPC, remote frames and three readers to handle a state that cannot occur. Instead, the protection is tested at its source of truth: the recorded workspace fixture's own identities are made the oldest records and are not evicted.
+
+**Residual wording corrected.** The earlier body said turn-end enforcement "re-creates" an evicted record. It does not: it prompts or blocks, and only the agent's own `goal_set`/`tldr_update` writes. Under the final policy a running agent is never evicted, so that path no longer matters.
+
+**Tests added:**
+- a workspace-named goal is never evicted and can still be completed;
+- all-in-use and unknown both refuse and leave the file byte-identical;
+- revision continuity for both stores, from the highest real revision;
+- one atomic write under an injected rename fault (a two-write implementation is killed);
+- history is kept for the evicted identity and written for the new one;
+- the host lists unrevoked identities only.
+
+## Review round 2 (#1328): the in-use set was incomplete and could go stale
+- **Session-id fallback (a, b, c, Major).** The renderer reads a session that has TLDR or Goal enabled but no explicit `tldrIdentity` under its session id (`tldrIdentityForSession`). The in-use set had only explicit identities, so such a parked goal could be evicted. **Every persisted session id is now protected as well.** That is a superset of the renderer rule, so it cannot drift from it.
+- **Stale in-use during the write (a, b).** In-use was sampled before the commit's disk I/O. `commit()` now asks again right before the rename. If an evictee has come into use, it refuses (`<label> storage is busy; try again.`) and writes nothing; the agent's retry then chooses afresh. What is left is the rename syscall itself.
+- **TLDR protection unpinned (a).** The workspace test now runs for both stores.
+- **Main wiring unpinned (c).** The stores are built by `createReportingStores(stateDir, inUse)`, where `inUse` is required, and a test drives both stores through it.
+- **Declined: remember revisions before the commit (b's survivor).** b found no user-visible effect, and neither do I: after a refused write the record is still in memory, and its own revision wins.
+- **Residual:** a pane added in the renderer is not in the persisted workspace until its autosave, up to 400 ms later. If it also has no live MCP registration in that window, its identity is unprotected. A new agent's pane has a live registration, so that needs an agent that spawned and exited within 400 ms, while the store is at the cap.
+
+## Steering q51/q52: final design, no deletion ever races registration
+The q51 attempt, "evict, then give the record back if its identity registered during the rename", was withdrawn. q52 showed it still loses a live goal: when the evictee is the only unused record, there is no second record to displace, so it cannot be given back. It also left a crash window between two renames. Each round had found a new loss path, because the design deleted first and compensated after.
+
+**Final design.**
+- Each store counts **pins** per identity. `pin()` and `unpin()` run in the store's own `serialize` queue, the same queue every `update` and `complete` runs in.
+- The spawn path awaits `BuiltInMcpHttpHost.pinReportingIdentity(scope)` **before** `registerSession`. It pins the exact identity the registration will report as (explicit, or the session-id fallback). `revokeSession` releases it. Counting matters because a replacement registers its successor before revoking its predecessor under the same identity.
+- An eviction chooses its victim (the least recently written record that is neither pinned nor named by the persisted workspace) and commits it inside ONE queued operation. A pin queued before that operation protects the record. A pin queued behind an eviction in flight waits for that write to land, so the session never becomes live while a write deleting its record is landing.
+- When no unused record exists, the new identity's write is **refused** with `<label> storage is full.`, and nothing is deleted.
+- Removed: the restore pass, the pre-rename "busy" recheck, and `liveTldrIdentities` (the host's registration scan). There is one mechanism, not a compensation.
+
+**What the invariant is.** A record is never deleted while its identity is live or named by the persisted workspace. Consider a session that registers AFTER an eviction chose its identity: at the moment of choosing, the identity was unused, so that eviction was correct. The session starts with "No goal yet", exactly like any identity evicted earlier.
+
+**Residual (stated concretely).** A pane added in the renderer reaches the persisted workspace at its autosave, up to 400 ms later. Its live session is pinned from spawn, so the pane is protected; the window only matters for a pane whose session is not live, which a new pane is not.
+
+**Tests.** Each is red on the q51 head `659adf13` (where `pin` does not exist) and each is mutation-checked:
+- the sole-unused-record case from q52 is refused, the file is byte-identical, and the live goal can still be completed;
+- a pin requested during an eviction's rename resolves only after that write has landed;
+- pins are counted;
+- the spawn path pins before it registers (`sessionManager.wake.test.ts`);
+- the host pins exactly the registration's identity and releases it on revoke.
+
+Mutations: ignoring pins in the choice fails 5 tests; a pin that bypasses the queue fails the race test.
+
+## Verification pass (a, b, c) and steering q56
+Two reproduced loss paths remained after the q52 redesign:
+- **A workspace save naming the evictee during the eviction's write (a, b, c; Major).** Pins protect live sessions, but a parked pane is named only by the workspace file, and `WorkspaceFileStore.commit` had its own queue. **Fix:** a small shared lock, `withReportingPublicationLock` (`src/main/storage/reportingPublicationLock.ts`).
+  - `WorkspaceFileStore.commit` holds it for write, rename, and the `this.file` advance that the stores' in-use answer reads.
+  - An *evicting* store write holds it for sample, choose, write and rename.
+  - Lock order is always "own queue, then the lock", and neither side waits on the other's queue, so there is no deadlock. Non-evicting store writes take no lock.
+  - A save that names the evictee after the choice waits until the write has landed. It never overlaps it.
+- **A pre-registration pin with no owner (a, b, c; Major).** A spawn cancelled after pinning, or a `registerSession` that threw, left a pin nothing could release. At a full store whose only free record it protected, every new agent was refused until restart. **Fix:** `pinReportingIdentity` returns an idempotent `release`, and `SessionManager.spawn` calls it when cancellation or registration throws. A partial pin failure (one store pinned, the other failed) releases the store that pinned before rethrowing (`allSettled`). Once registered, `revokeSession` releases, as before.
+
+Tests (all mutation-checked; each mutant fails exactly one test):
+- a workspace save requested during the eviction's rename sees the completed write, and its naming then protects that identity;
+- `WorkspaceFileStore` does not rename or advance while the lock is held;
+- through the real host and a real capped store, an unregistered pin's release frees the sole candidate, and a partial pin failure releases the other store;
+- `SessionManager.spawn` registers only after the pin settles and releases it when cancelled.
+
+Mutants: the store without the lock; the workspace without the lock; no release on cancel; an unawaited pin.
+
+**Invariant, as it now stands:** a record is never deleted while its identity is pinned by a live or registering session, or named by the committed workspace. A pane or session that names an identity only AFTER an eviction chose it starts without that record ("No goal yet").
+
+## Second verification (a, b, c)
+- **A registration that creates no token (a, b, c; Major).** The q56 release covered a cancelled spawn and a throwing `registerSession`, but not a *successful* call that registers nothing. A recovered Claude session with an explicit identity and only the `workflows` domain (which the provider policy filters away) got `[]` and no token. Its pin was then never released: the spawn treated it as registered, and `revokeSession` had no token to release through. **Fix, by ownership:** `registerSession(scope, releasePin)` takes the release. It calls it at once when no registration is created, and otherwise stores it on the registration, which `revokeSession` calls exactly once. `revokeSession` no longer unpins by identity, so every pin has exactly one owner.
+- The q56 lock and the other release paths were verified by all three reviewers: mutations removing either lock, or the cancel, throw or partial releases, went red, and no cyclic wait was found.
+
+Test: through the real host and a capped Goal store, a policy-filtered registration returns `[]` and the sole candidate is free again (red on `62d52c98`).
diff --git a/src/main/index.ts b/src/main/index.ts
index b737647d1..7f7fb2807 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -7,7 +7,6 @@ import { mainOperations } from '@main/performance/operations.js'
 import { monitorCoordinator } from '@main/performance/MonitorCoordinator.js'
 import { mainProbe } from '@main/performance/MainProbe.js'
 import { performanceTraceController } from '@main/performance/PerformanceTraceController.js'
-import { TldrStore } from '@main/tldr/TldrStore.js'
 import { registerGoalIpc, registerTldrIpc } from '@main/tldr/ipc.js'
 import { BrowserPocketController, type GuestLike } from '@main/browserPocket/controller/BrowserPocketController.js'
 import { LanePortWatcher } from '@main/browserPocket/LanePortWatcher.js'
@@ -123,6 +122,8 @@ import { createConversationService } from '@main/conversations/service.js'
 import { listWorktreesForCwd } from '@main/ipc/git.js'
 import { AGENT_NAMES_FILE } from '@main/agentNames/ipc.js'
 import { RemoteWorkspaceProjection } from '@main/remote/workspaceProjection.js'
+import { tldrIdentitiesInUse } from '@main/tldr/identitiesInUse.js'
+import { createReportingStores } from '@main/tldr/reportingStores.js'
 import { getUsageSnapshot } from '@main/usage/usageService.js'
 import { CONVERSATIONS_LEDGER_FILE } from '@main/storage/paths.js'
 import { isSessionRecordingEnabled, isSessionRecordingAutoStart } from '@main/ipc/devDebug.js'
@@ -287,6 +288,9 @@ const vaultService = new VaultService({
 let manager: SessionManager | null = null
 let remoteController: RemoteController | null = null
 let remoteWorkspaceProjection: RemoteWorkspaceProjection | null = null
+// The TLDR/Goal stores are built before the workspace file opens; they read
+// the persisted windows through this once it has (see identitiesInUse).
+let reportingWorkspaceWindows: (() => readonly PersistedWindow[]) | null = null
 let tmuxRegistry: TmuxRegistry | null = null
 // The running-app tmux reaper's timer handle, so quit can stop it (#1030).
 let detachedTmuxSweep: DetachedSweepSchedule | null = null
@@ -1216,8 +1220,13 @@ async function startApp(): Promise<void> {
   })
   await externalSettings.initialize()
   assertStartupOpen()
-  const tldrStore = new TldrStore(join(STATE_DIR, 'tldr.json'))
-  const goalStore = new TldrStore(join(STATE_DIR, 'goal.json'), undefined, { historyDirectoryName: 'goal-history', label: 'Goal' })
+  // Which identities the stores may never evict at their cap (#1277 review):
+  // see tldrIdentitiesInUse. Read lazily, only when a new identity arrives at
+  // the cap. Until the workspace file has opened the answer is unknown, and a
+  // store at its cap then refuses new identities for those startup seconds
+  // instead of guessing (steering q40).
+  const identitiesInUse = () => tldrIdentitiesInUse(reportingWorkspaceWindows?.() ?? null)
+  const { tldrStore, goalStore } = createReportingStores(STATE_DIR, identitiesInUse)
   const tldrEnforcement = new TldrEnforcement(tldrStore, undefined, goalStore)
   // Before any session can register: the sweep removes every entry, and each
   // one left by an earlier run holds a bearer that run's host already revoked.
@@ -1391,6 +1400,7 @@ async function startApp(): Promise<void> {
   // renderer, which requires a window.
   const workspaceFileStore = await WorkspaceFileStore.open()
   shutdownWorkspaceStore = workspaceFileStore
+  reportingWorkspaceWindows = () => workspaceFileStore.windows()
   assertStartupOpen()
   // Conversation ledger (docs/decomposition/conversations.md, Stage 3): a
   // projection of every window's sessions keyed by native id, so the picker
diff --git a/src/main/sessionManager.codexReplacement.test.ts b/src/main/sessionManager.codexReplacement.test.ts
index e0f56deaa..a422bf153 100644
--- a/src/main/sessionManager.codexReplacement.test.ts
+++ b/src/main/sessionManager.codexReplacement.test.ts
@@ -655,6 +655,7 @@ describe('SessionManager Codex replacement handoff', () => {
     )
     createSession.mockImplementationOnce(() => predecessor)
     const builtInMcpHost = {
+      pinReportingIdentity: async () => () => {},
       registerSession: vi.fn(() => {
         throw new Error('recorded successor MCP preflight failure')
       }),
@@ -755,6 +756,7 @@ describe('SessionManager Codex replacement handoff', () => {
     )
     const activeMcpRegistrations = new Set<string>()
     const builtInMcpHost = {
+      pinReportingIdentity: async () => () => {},
       registerSession: vi.fn((scope: { sessionId: string }) => {
         activeMcpRegistrations.add(scope.sessionId)
         return []
diff --git a/src/main/sessionManager.recover.test.ts b/src/main/sessionManager.recover.test.ts
index 53634ed31..bb8731d17 100644
--- a/src/main/sessionManager.recover.test.ts
+++ b/src/main/sessionManager.recover.test.ts
@@ -419,7 +419,7 @@ describe('SessionManager recover', () => {
     createSession.mockImplementationOnce(() => {
       throw new Error('secret-token-from-provider-constructor')
     })
-    const manager = new SessionManager(null, { registerSession, revokeSession } as never)
+    const manager = new SessionManager(null, { pinReportingIdentity: async () => () => {}, registerSession, revokeSession } as never)
 
     await expect(manager.recover({
       sessionId: 'constructor-failure',
@@ -487,6 +487,7 @@ describe('SessionManager recover', () => {
     const revokeSession = vi.fn()
     const sessionDomains = vi.fn(() => ['orchestration'])
     const manager = new SessionManager(null, {
+      pinReportingIdentity: async () => () => {},
       registerSession,
       revokeSession,
       sessionDomains,
@@ -520,7 +521,7 @@ describe('SessionManager recover', () => {
       cwd: '/tmp/project',
       providerKind: 'claude',
       domains: ['orchestration'],
-    })
+    }, expect.any(Function))
     expect(sessionDomains).toHaveBeenCalledWith('mcp-session')
     expect(createSession).toHaveBeenCalledWith(expect.objectContaining({
       builtInMcpServers: [serverConfig],
@@ -608,7 +609,7 @@ describe('SessionManager recover', () => {
     createSession.mockImplementation(() => session)
     const registerSession = vi.fn(() => [])
     const revokeSession = vi.fn()
-    const manager = new SessionManager(null, { registerSession, revokeSession } as never)
+    const manager = new SessionManager(null, { pinReportingIdentity: async () => () => {}, registerSession, revokeSession } as never)
 
     const recovery = manager.recover({
       sessionId: 'cancelled-session',
diff --git a/src/main/sessionManager.ts b/src/main/sessionManager.ts
index 3d463350c..f29bc10f8 100644
--- a/src/main/sessionManager.ts
+++ b/src/main/sessionManager.ts
@@ -3035,13 +3035,28 @@ export class SessionManager extends EventEmitter {
         if (!this.builtInMcpHost) {
           throw new Error('Built-in MCP host is not available')
         }
-        builtInMcpServers = this.builtInMcpHost.registerSession({
+        const mcpScope = {
           sessionId,
           cwd: options.cwd,
           providerKind: kind,
           domains: options.builtInMcpDomains,
           tldrIdentity: options.tldrIdentity,
-        })
+        }
+        // Pinned in the TLDR/Goal stores' write queues BEFORE the session
+        // becomes live, so a store at its cap can never be mid-way through
+        // evicting this identity's record once it is (#1328 q52).
+        const releasePin = await this.builtInMcpHost.pinReportingIdentity(mcpScope)
+        try {
+          this.throwIfSpawnCancelled(recoveryClaim, codexReplacementHandoff)
+          // The registration owns the pin from here: it releases it on revoke,
+          // or at once if policy leaves no domain to register.
+          builtInMcpServers = this.builtInMcpHost.registerSession(mcpScope, releasePin)
+        } catch (error) {
+          // Not registered, so revokeSession will never release this pin;
+          // left, it would protect the identity forever (#1328 q56).
+          releasePin()
+          throw error
+        }
         mcpRegistered = true
       }
       const { servers: userMcpServers, codexShellPolicy: userMcpCodexShellPolicy } =
diff --git a/src/main/sessionManager.wake.test.ts b/src/main/sessionManager.wake.test.ts
index 5465053aa..248c7f1f8 100644
--- a/src/main/sessionManager.wake.test.ts
+++ b/src/main/sessionManager.wake.test.ts
@@ -212,7 +212,7 @@ describe('SessionManager restart wake recovery', () => {
 
   it('launches a TLDR agent without the skill when the TLDR skill cannot deploy, and says so', async () => {
     const { SessionManager } = await import('./sessionManager')
-    const host = { registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
+    const host = { pinReportingIdentity: vi.fn(async () => () => {}), registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
     const journal = journalSpy()
     const skillError = new Error('TLDR skill destination is user-owned')
     const reconcile = vi.fn(async () => [{ skill: 'tldr' as const, error: skillError }])
@@ -230,6 +230,10 @@ describe('SessionManager restart wake recovery', () => {
     // the way the old abort path revoked it. Losing the skill costs guidance,
     // and the tool still brings its own server instructions.
     expect(host.revokeSession).not.toHaveBeenCalled()
+    // #1328 q52: the reporting identity is pinned in the stores' write
+    // queues BEFORE the session is registered (becomes live), never after.
+    expect(host.pinReportingIdentity).toHaveBeenCalledWith(expect.objectContaining({ tldrIdentity: 'summary-agent', domains: ['tldr'] }))
+    expect(host.pinReportingIdentity.mock.invocationCallOrder[0]!).toBeLessThan(host.registerSession.mock.invocationCallOrder[0]!)
     expect(warnings).toEqual([{ sessionId: result.sessionId, skills: ['tldr'] }])
     // The raw error stays in main's journal, keyed by which step failed.
     // Keyed by ids.sessionId like the `.degraded` row, so triage filtering on
@@ -249,7 +253,7 @@ describe('SessionManager restart wake recovery', () => {
 
   it('launches a Goal-only agent the same way when the Goal skill cannot deploy', async () => {
     const { SessionManager } = await import('./sessionManager')
-    const host = { registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
+    const host = { pinReportingIdentity: vi.fn(async () => () => {}), registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
     const reconcile = vi.fn(async () => [{ skill: 'goal' as const, error: new Error('Goal skill destination is user-owned') }])
     const manager = new SessionManager(null, host as unknown as BuiltInMcpHttpHost, null, reconcile)
     const warnings: unknown[] = []
@@ -268,7 +272,7 @@ describe('SessionManager restart wake recovery', () => {
     // the user informed, where silence would bring back the omission the old
     // strict rule existed to prevent.
     const { SessionManager } = await import('./sessionManager')
-    const host = { registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
+    const host = { pinReportingIdentity: vi.fn(async () => () => {}), registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
     const journal = journalSpy()
     const reconcile = vi.fn(async () => { throw new Error('managed skills state unreadable') })
     const manager = new SessionManager(null, host as unknown as BuiltInMcpHttpHost, journal as never, reconcile)
@@ -289,6 +293,35 @@ describe('SessionManager restart wake recovery', () => {
     expect(journal.recordError).toHaveBeenCalledTimes(2)
   })
 
+  // #1328 q52/q56: the reporting pin must be SETTLED before the session is
+  // registered (a pin still in the store queue protects nothing yet), and a
+  // spawn cancelled after pinning must release the pin, since no
+  // registration exists for revokeSession to release it through.
+  it('registers only after the reporting pin settles, and releases it when the spawn is cancelled', async () => {
+    const { SessionManager } = await import('./sessionManager')
+    let settlePin!: () => void
+    const pinGate = new Promise<void>(resolve => { settlePin = resolve })
+    const release = vi.fn()
+    const host = {
+      pinReportingIdentity: vi.fn(async () => { await pinGate; return release }),
+      registerSession: vi.fn((_scope: { sessionId: string }) => []),
+      revokeSession: vi.fn(),
+    }
+    const manager = new SessionManager(null, host as unknown as BuiltInMcpHttpHost, journalSpy() as never, vi.fn(async () => []))
+    const recovering = manager.recover({ sessionId: 'closing-pane', kind: 'claude', cwd: '/tmp/project', builtInMcpDomains: ['goal'] })
+    await vi.waitFor(() => expect(host.pinReportingIdentity).toHaveBeenCalledTimes(1))
+    // Still pinning: nothing may be registered yet.
+    await new Promise(resolve => setTimeout(resolve, 20))
+    expect(host.registerSession).not.toHaveBeenCalled()
+    // The pane closes while the pin is in the store queue.
+    const killing = manager.kill('closing-pane')
+    settlePin()
+    await killing
+    await expect(recovering).resolves.toMatchObject({ ok: false, code: 'cancelled' })
+    expect(host.registerSession).not.toHaveBeenCalled()
+    expect(release).toHaveBeenCalledTimes(1)
+  })
+
   it('neither warns nor journals a degraded launch for a restore cancelled during the reconcile', async () => {
     // The reconcile serializes behind other skill writes, so a pane can close
     // while it runs. That session never launches. A `.degraded` row or a toast
@@ -296,7 +329,7 @@ describe('SessionManager restart wake recovery', () => {
     // reconcile's own `.error` row still lands, because the skill really is
     // broken machine-wide.
     const { SessionManager } = await import('./sessionManager')
-    const host = { registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
+    const host = { pinReportingIdentity: vi.fn(async () => () => {}), registerSession: vi.fn((_scope: { sessionId: string }) => []), revokeSession: vi.fn() }
     const journal = journalSpy()
     let releaseReconcile!: () => void
     const reconcileGate = new Promise<void>(resolve => { releaseReconcile = resolve })
diff --git a/src/main/storage/reportingPublicationLock.ts b/src/main/storage/reportingPublicationLock.ts
new file mode 100644
index 000000000..19cf6bb91
--- /dev/null
+++ b/src/main/storage/reportingPublicationLock.ts
@@ -0,0 +1,29 @@
+/**
+ * One process-wide lock shared by the two writers whose interleaving can
+ * delete a goal a pane still shows (#1328, steering q56).
+ *
+ * The TLDR/Goal stores never evict an identity the persisted workspace names.
+ * But the workspace file and the stores have separate write queues: a
+ * workspace save could publish a parked pane naming identity X while a store
+ * was mid-way through a write that deletes X's record (chosen when nothing
+ * named it). Holding this lock across the store's whole eviction (read who is
+ * named, choose, write, rename) and across the workspace save (write, rename,
+ * advance the in-memory document the stores read) makes those two atomic
+ * with respect to each other. A save that names X after the eviction chose X
+ * waits for that write to land; it never overlaps it.
+ *
+ * WHY a module and not a method on either store: neither owns the other, and
+ * the stores are built before the workspace file opens. Lock order is always
+ * "own queue, then this lock", and neither side waits on the other's queue
+ * while holding it, so there is no deadlock.
+ *
+ * Only evicting store writes take it (a new identity at the cap), so ordinary
+ * TLDR and Goal updates never wait on a workspace save.
+ */
+let tail: Promise<unknown> = Promise.resolve()
+
+export function withReportingPublicationLock<T>(operation: () => Promise<T>): Promise<T> {
+  const result = tail.then(operation)
+  tail = result.catch(() => undefined)
+  return result
+}
diff --git a/src/main/storage/workspaceFileStore.test.ts b/src/main/storage/workspaceFileStore.test.ts
index bcd9f18d3..9a4499bbe 100644
--- a/src/main/storage/workspaceFileStore.test.ts
+++ b/src/main/storage/workspaceFileStore.test.ts
@@ -70,6 +70,24 @@ describe('workspace persistence ordering', () => {
     expect(writeFile).toHaveBeenCalledOnce()
   })
 
+  // #1328 q56: the TLDR/Goal stores read "who is named" from this document
+  // while an evicting write holds the shared reporting lock. A save must not
+  // rename (or advance the document) while that lock is held.
+  it('waits for the shared reporting lock before publishing a save', async () => {
+    const { withReportingPublicationLock } = await import('@main/storage/reportingPublicationLock.js')
+    const store = await WorkspaceFileStore.open()
+    const evictionWrite = deferred()
+    const holding = withReportingPublicationLock(() => evictionWrite.promise)
+    const save = store.saveSlice('w1', slice(['parked-agent']), NO_GEOMETRY)
+    await new Promise(resolve => setTimeout(resolve, 20))
+    expect(rename).not.toHaveBeenCalled()
+    expect(store.windows()).toEqual([])
+    evictionWrite.resolve()
+    await Promise.all([holding, save])
+    expect(rename).toHaveBeenCalledOnce()
+    expect(store.windows()).toHaveLength(1)
+  })
+
   it('commits overlapping saves in admission order', async () => {
     const firstWriteGate = deferred()
     const tempContents = new Map<string, string>()
diff --git a/src/main/storage/workspaceFileStore.ts b/src/main/storage/workspaceFileStore.ts
index 5c211e380..aa7b0522f 100644
--- a/src/main/storage/workspaceFileStore.ts
+++ b/src/main/storage/workspaceFileStore.ts
@@ -3,6 +3,7 @@ import { randomUUID } from 'node:crypto'
 import { mkdir, readFile, rename, unlink, writeFile } from 'fs/promises'
 
 import { STATE_DIR, STATE_FILE } from '@main/storage/paths.js'
+import { withReportingPublicationLock } from '@main/storage/reportingPublicationLock.js'
 import { sweepAbandonedScratch } from '@main/storage/scratchSweep.js'
 import {
   collectSessionIds,
@@ -293,7 +294,10 @@ export class WorkspaceFileStore {
    * life, so this cannot be left to luck.
    */
   private commit(compose: (current: WorkspaceFile) => WorkspaceFile): Promise<void> {
-    const save = this.saveTail.then(async () => {
+    // Inside the shared reporting lock (#1328 q56): this save's rename and the
+    // `this.file` advance the TLDR/Goal stores read their in-use answer from
+    // must never overlap a store write that evicts a record.
+    const save = this.saveTail.then(() => withReportingPublicationLock(async () => {
       const next = compose(this.file)
       await mkdir(STATE_DIR, { recursive: true })
       // WHY this temp file is still unique even though saves are serialized:
@@ -365,7 +369,7 @@ export class WorkspaceFileStore {
           console.warn('[workspace] observer failed', error)
         }
       }
-    })
+    }))
     this.saveTail = save.catch(() => undefined)
     return save
   }
diff --git a/src/main/tldr/TldrStore.system.test.ts b/src/main/tldr/TldrStore.system.test.ts
index 40e4f686d..d8b2266f5 100644
--- a/src/main/tldr/TldrStore.system.test.ts
+++ b/src/main/tldr/TldrStore.system.test.ts
@@ -10,9 +10,25 @@ import { createBuiltInMcpServer } from '@mcp/runtime/createBuiltInMcpServer.js'
 import { BuiltInMcpHttpHost } from '@mcp/runtime/BuiltInMcpHttpHost.js'
 import type { BuiltInMcpDomain } from '@mcp/shared/types.js'
 import { GOAL_INSTRUCTIONS, TLDR_INSTRUCTIONS } from '@shared/types/tldr.js'
-import { TldrStore } from './TldrStore.js'
+import { TLDR_MAX_RECORDS, TldrStore } from './TldrStore.js'
+import { tldrIdentitiesInUse } from './identitiesInUse.js'
+import { createReportingStores } from './reportingStores.js'
+import { withReportingPublicationLock } from '@main/storage/reportingPublicationLock.js'
 
 vi.mock('@main/performance/PerformanceService.js', () => ({ performanceService: { record: vi.fn() } }))
+// A pass-through `rename` a test can fault (#1328 review B1). Everything else
+// in node:fs/promises, and every rename no test targets, is the real thing.
+const renameFault = vi.hoisted(() => ({ current: null as null | ((to: string) => boolean) }))
+vi.mock('node:fs/promises', async importOriginal => {
+  const actual = await importOriginal<typeof import('node:fs/promises')>()
+  return {
+    ...actual,
+    rename: async (from: string, to: string) => {
+      if (renameFault.current?.(to)) throw Object.assign(new Error('injected rename failure'), { code: 'EIO' })
+      return actual.rename(from, to)
+    },
+  }
+})
 
 const directories: string[] = []
 const clients: Array<{ close(): Promise<void> }> = []
@@ -563,3 +579,327 @@ describe('one invalid record in a real store (#1247)', () => {
     expect(await readFile(file, 'utf8')).toBe(source)
   })
 })
+
+// #1277: nothing ever deleted a record, so at TLDR_MAX_RECORDS every NEW
+// agent's tldr_update and goal_set failed for good. The store is grown to the
+// cap by cycling the committed fixture's real record shapes (field
+// combinations, revisions and text lengths; the text itself was redacted at
+// the same length when the fixture was recorded). Identities and times are
+// synthetic, except where a test uses the recorded workspace's identities.
+describe('a store at its record cap (#1277)', () => {
+  type Shape = { text: string; revision: number; updatedAt: string; completedAt?: string; completionNote?: string }
+  const t0 = Date.parse('2026-09-12T00:00:00.000Z')
+  const NOW = () => new Date('2026-09-26T12:00:00.000Z')
+  /** `oldest[i]` is written i minutes after t0 and `identity-<n>` after
+   *  those, so the order of eviction is exactly the order of the ids. The
+   *  first identity takes `firstShape` when given. */
+  function fullDocument(source: Record<string, Shape>, options: { oldest?: string[]; firstShape?: Shape } = {}) {
+    const shapes = Object.values(source)
+    const ids = [...(options.oldest ?? [])]
+    for (let i = 0; ids.length < TLDR_MAX_RECORDS; i++) ids.push(`identity-${i}`)
+    const records: Record<string, Shape> = {}
+    ids.forEach((id, i) => {
+      const shape = i === 0 && options.firstShape ? options.firstShape : shapes[i % shapes.length]!
+      records[id] = {
+        ...shape,
+        updatedAt: new Date(t0 + i * 60_000).toISOString(),
+        ...(shape.completedAt !== undefined ? { completedAt: new Date(t0 + i * 60_000 + 1_000).toISOString() } : {}),
+      }
+    })
+    return { version: 1 as const, records }
+  }
+  async function storeAtCap(name: string, document: unknown, options: ConstructorParameters<typeof TldrStore>[2] = {}) {
+    const directory = await mkdtemp(join(tmpdir(), 'agent-code-tldr-cap-'))
+    directories.push(directory)
+    const file = join(directory, name)
+    await writeFile(file, JSON.stringify(document))
+    return { directory, file, store: new TldrStore(file, NOW, options) }
+  }
+  const GOAL = { historyDirectoryName: 'goal-history', label: 'Goal' }
+  const onDisk = async (file: string) => JSON.parse(await readFile(file, 'utf8')).records as Record<string, unknown>
+  afterEach(() => { renameFault.current = null })
+
+  it('accepts a new agent’s report by evicting the least recently written record', async () => {
+    const { file, store } = await storeAtCap('tldr.json', fullDocument(realRecords.tldr.records as never))
+    expect((await store.update('new-agent', 'Starting work.', () => true)).revision).toBe(1)
+    const first = await onDisk(file)
+    expect(Object.keys(first)).toHaveLength(TLDR_MAX_RECORDS)
+    expect(first).toHaveProperty('new-agent')
+    expect(first).not.toHaveProperty('identity-0')
+    expect(first).toHaveProperty('identity-1')
+    // A second new agent evicts the next oldest, and only it.
+    await store.update('newer-agent', 'Starting too.', () => true)
+    const second = await onDisk(file)
+    expect(Object.keys(second)).toHaveLength(TLDR_MAX_RECORDS)
+    expect(second).not.toHaveProperty('identity-1')
+    expect(second).toHaveProperty('new-agent')
+  })
+
+  it('counts a completion as a write, so a just-completed goal is not the one evicted', async () => {
+    const document = fullDocument(realRecords.goal.records as never)
+    const completed = Object.values(realRecords.goal.records).find(record => record.completedAt)!
+    document.records['identity-0'] = { ...document.records['identity-0']!, completedAt: '2026-09-26T11:59:00.000Z', completionNote: completed.completionNote! }
+    const { file, store } = await storeAtCap('goal.json', document, GOAL)
+    await store.update('new-agent', 'Starting work.', () => true)
+    const records = await onDisk(file)
+    expect(records).toHaveProperty('identity-0')
+    expect(records).not.toHaveProperty('identity-1')
+  })
+
+  // #1328 review (a, c): the oldest goal can belong to an agent that is still
+  // running, since a goal is set once per task. Age alone evicted it, its
+  // goal_complete then failed, and views that had read it kept showing it.
+  // The in-use set is computed from the owner's recorded workspace, as main
+  // computes it, and those real identities are made the OLDEST records.
+  const recordedWorkspace = async () => JSON.parse(await readFile(join(import.meta.dirname,
+    '../../../testing/fixtures/workspace-v3/2026-09-20-live-workspace.sanitized.json'), 'utf8')) as {
+    windows: Array<{ workspace: { sessions: Record<string, Record<string, unknown>> } }>
+  }
+  it.each([
+    ['TLDR', 'tldr.json', realRecords.tldr.records, {}],
+    ['Goal', 'goal.json', realRecords.goal.records, GOAL],
+  ] as const)('never evicts a %s record the recorded workspace still names', async (label, name, source, options) => {
+    const recorded = await recordedWorkspace()
+    const inUse = tldrIdentitiesInUse(recorded.windows as never)!
+    const explicit = Object.values(recorded.windows[0]!.workspace.sessions).map(meta => meta.tldrIdentity as string).filter(Boolean)
+    expect(explicit.length).toBeGreaterThan(5)
+    const document = fullDocument(source as never, { oldest: [...explicit, 'live-unsaved-agent'] })
+    const { file, store } = await storeAtCap(name, document, { ...options, inUse: () => inUse })
+    // A live agent not yet in the saved workspace is protected by its pin.
+    await store.pin('live-unsaved-agent')
+    await store.update('new-agent', 'Starting work.', () => true)
+    const records = await onDisk(file)
+    for (const id of [...explicit, 'live-unsaved-agent']) expect(records).toHaveProperty(id)
+    // The oldest record nothing uses went instead.
+    expect(records).not.toHaveProperty('identity-0')
+    if (label === 'Goal') expect((await store.complete(explicit[0]!, 'Delivered.', () => true)).completionNote).toBe('Delivered.')
+  })
+
+  // #1328 round 2 (a, b, c): a session with TLDR or Goal enabled and no
+  // explicit identity is read by the renderer under its SESSION ID
+  // (tldrIdentityForSession). The recorded workspace has no such session, so
+  // one of its real reporting sessions is given that shape.
+  it('never evicts a parked goal the renderer reads under its session id', async () => {
+    const recorded = await recordedWorkspace()
+    const sessions = recorded.windows[0]!.workspace.sessions
+    const [sessionId, meta] = Object.entries(sessions).find(([, row]) => row.tldrIdentity)!
+    delete meta.tldrIdentity
+    meta.builtInMcpDomains = ['goal']
+    expect(sessions[sessionId]).toBe(meta)
+    const inUse = tldrIdentitiesInUse(recorded.windows as never)!
+    const { file, store } = await storeAtCap('goal.json', fullDocument(realRecords.goal.records as never, { oldest: [sessionId] }), { ...GOAL, inUse: () => inUse })
+    await store.update('new-agent', 'Starting work.', () => true)
+    expect(await onDisk(file)).toHaveProperty(sessionId)
+    expect((await store.complete(sessionId, 'Delivered.', () => true)).completionNote).toBe('Delivered.')
+  })
+
+  // #1328 steering q52: the sole unused record's identity goes live. Every
+  // other record is named by the workspace; the new agent's write must be
+  // REFUSED and nothing deleted (the compensating design evicted it anyway
+  // and then had no second victim to give it back with).
+  it('refuses a new identity when the only unused record belongs to a live session', async () => {
+    const document = fullDocument(realRecords.goal.records as never)
+    const workspace = new Set(Object.keys(document.records).filter(id => id !== 'identity-0'))
+    const { file, store } = await storeAtCap('goal.json', document, { ...GOAL, inUse: () => workspace })
+    const before = await readFile(file, 'utf8')
+    await store.pin('identity-0')
+    await expect(store.update('new-agent', 'Starting work.', () => true)).rejects.toThrow('Goal storage is full.')
+    expect(await readFile(file, 'utf8')).toBe(before)
+    expect((await store.complete('identity-0', 'Delivered.', () => true)).completionNote).toBe('Delivered.')
+    // Released, it is the one record a new agent may displace.
+    await store.unpin('identity-0')
+    await store.update('new-agent', 'Starting work.', () => true)
+    expect(await onDisk(file)).not.toHaveProperty('identity-0')
+  })
+
+  // #1328 steering q51/q52: a registration arriving while an eviction is
+  // being written (here, inside its rename) must not become live until that
+  // write's outcome is known. Its pin waits in the store's queue, so by the
+  // time the session is registered the eviction has fully landed, and every
+  // later eviction skips it.
+  it('makes a pin requested during an eviction wait for that write to land', async () => {
+    const { file, store } = await storeAtCap('goal.json', fullDocument(realRecords.goal.records as never), GOAL)
+    const order: string[] = []
+    let pinned!: Promise<void>
+    renameFault.current = to => {
+      if (to === file && !pinned) pinned = store.pin('identity-1').then(() => { order.push('pin resolved') })
+      return false
+    }
+    await store.update('new-agent', 'Starting work.', () => true).then(() => { order.push('eviction landed') })
+    await pinned
+    expect(order).toEqual(['eviction landed', 'pin resolved'])
+    // identity-0 was chosen before the pin was queued; identity-1 is now live.
+    await store.update('newer-agent', 'Starting too.', () => true)
+    const records = await onDisk(file)
+    expect(records).not.toHaveProperty('identity-0')
+    expect(records).toHaveProperty('identity-1')
+    expect(records).not.toHaveProperty('identity-2')
+  })
+
+  // #1328 verification (a, b, c) and steering q56, through the REAL host and
+  // a real store at the cap. A pin whose session never registered had no
+  // owner; at a full store whose only free record it protected, every new
+  // agent was refused until restart.
+  it('frees the record again when a pinned session never registers', async () => {
+    const document = fullDocument(realRecords.goal.records as never)
+    const workspace = new Set(Object.keys(document.records).filter(id => id !== 'identity-0'))
+    const { store } = await storeAtCap('goal.json', document, { ...GOAL, inUse: () => workspace })
+    const host = new BuiltInMcpHttpHost()
+    host.setDependencies({ goalStore: store } as never)
+    const scope = { sessionId: 's', tldrIdentity: 'identity-0', cwd: '/tmp/project', providerKind: 'claude' as const, domains: ['goal' as const] }
+    const release = await host.pinReportingIdentity(scope)
+    await expect(store.update('new-agent', 'Starting work.', () => true)).rejects.toThrow('Goal storage is full.')
+    // The spawn is cancelled (or registerSession throws: this host was never
+    // started) and releases; the record is the free one again.
+    expect(() => host.registerSession(scope)).toThrow()
+    release()
+    release()
+    await expect(store.update('new-agent', 'Starting work.', () => true)).resolves.toMatchObject({ revision: 1 })
+  })
+
+  // #1328 second verification (a, b, c): a recovered Claude session with an
+  // explicit identity whose only domain (`workflows`) the provider policy
+  // filters away. registerSession returns [] and creates no token; the pin
+  // it was handed must be released right there, or nothing ever can.
+  it('releases the pin when policy leaves nothing to register', async () => {
+    const document = fullDocument(realRecords.goal.records as never)
+    const workspace = new Set(Object.keys(document.records).filter(id => id !== 'identity-0'))
+    const { store } = await storeAtCap('goal.json', document, { ...GOAL, inUse: () => workspace })
+    const host = new BuiltInMcpHttpHost()
+    host.setDependencies({ goalStore: store } as never)
+    await host.start()
+    try {
+      const scope = { sessionId: 's', tldrIdentity: 'identity-0', cwd: '/tmp/project', providerKind: 'claude' as const, domains: ['workflows' as const] }
+      expect(host.registerSession(scope, await host.pinReportingIdentity(scope))).toEqual([])
+      await expect(store.update('new-agent', 'Starting work.', () => true)).resolves.toMatchObject({ revision: 1 })
+    } finally { await host.stop() }
+  })
+
+  it('releases the pin that succeeded when the other store’s pin fails', async () => {
+    const document = fullDocument(realRecords.goal.records as never)
+    const workspace = new Set(Object.keys(document.records).filter(id => id !== 'identity-0'))
+    const { store } = await storeAtCap('goal.json', document, { ...GOAL, inUse: () => workspace })
+    const failing = { update: async () => { throw new Error('unused') }, pin: async () => { throw new Error('pin failed') }, unpin: async () => {} }
+    const host = new BuiltInMcpHttpHost()
+    host.setDependencies({ tldrStore: failing, goalStore: store } as never)
+    await expect(host.pinReportingIdentity({ sessionId: 's', tldrIdentity: 'identity-0', providerKind: 'claude', domains: ['goal', 'tldr'] }))
+      .rejects.toThrow('pin failed')
+    await expect(store.update('new-agent', 'Starting work.', () => true)).resolves.toMatchObject({ revision: 1 })
+  })
+
+  // #1328 steering q56: a workspace save that names the evictee while the
+  // eviction is being written waits for that write; the two never overlap.
+  // Driven through the shared lock both writers hold, on the real files.
+  it('makes a workspace save requested mid-eviction wait for the eviction to land', async () => {
+    const workspace = new Set<string>()
+    const { file, store } = await storeAtCap('goal.json', fullDocument(realRecords.goal.records as never), { ...GOAL, inUse: () => workspace })
+    // What the save sees on disk when it runs: the eviction's write must have
+    // landed completely (new record in, evictee out) before it may run.
+    let seenBySave: Record<string, unknown> | null = null
+    let saved!: Promise<void>
+    renameFault.current = to => {
+      if (to === file && !saved) {
+        saved = withReportingPublicationLock(async () => {
+          seenBySave = await onDisk(file)
+          workspace.add('identity-1')
+        })
+      }
+      return false
+    }
+    await store.update('new-agent', 'Starting work.', () => true)
+    await saved
+    expect(seenBySave).toHaveProperty('new-agent')
+    expect(seenBySave).not.toHaveProperty('identity-0')
+    // The save that landed after it protects identity-1 from the next one.
+    await store.update('newer-agent', 'Starting too.', () => true)
+    const records = await onDisk(file)
+    expect(records).not.toHaveProperty('identity-0')
+    expect(records).toHaveProperty('identity-1')
+    expect(records).not.toHaveProperty('identity-2')
+  })
+
+  // Replacement registers its successor before revoking its predecessor
+  // under the same identity: the predecessor's unpin must not release it.
+  it('counts pins, so one session’s release does not unprotect another’s', async () => {
+    const { file, store } = await storeAtCap('goal.json', fullDocument(realRecords.goal.records as never), GOAL)
+    await store.pin('identity-0')
+    await store.pin('identity-0')
+    await store.unpin('identity-0')
+    await store.update('new-agent', 'Starting work.', () => true)
+    expect(await onDisk(file)).toHaveProperty('identity-0')
+  })
+
+  // #1328 round 2 (c): the app's stores are built by createReportingStores;
+  // both must consult the in-use answer, or the running app evicts by age.
+  it('builds both app stores with the in-use answer', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'agent-code-tldr-cap-'))
+    directories.push(directory)
+    await writeFile(join(directory, 'tldr.json'), JSON.stringify(fullDocument(realRecords.tldr.records as never)))
+    await writeFile(join(directory, 'goal.json'), JSON.stringify(fullDocument(realRecords.goal.records as never)))
+    const { tldrStore, goalStore } = createReportingStores(directory, () => null)
+    await expect(tldrStore.update('new-agent', 'Starting work.', () => true)).rejects.toThrow('TLDR storage is full.')
+    await expect(goalStore.update('new-agent', 'Starting work.', () => true)).rejects.toThrow('Goal storage is full.')
+  })
+
+  it('refuses a new identity, changing nothing, when every record is in use or in-use is unknown', async () => {
+    for (const inUse of [() => null, (ids: string[]) => new Set(ids)] as const) {
+      const document = fullDocument(realRecords.goal.records as never)
+      const { file, store } = await storeAtCap('goal.json', document, { ...GOAL, inUse: () => inUse(Object.keys(document.records)) })
+      const before = await readFile(file, 'utf8')
+      await expect(store.update('new-agent', 'Starting work.', () => true)).rejects.toThrow('Goal storage is full.')
+      expect(await readFile(file, 'utf8')).toBe(before)
+      // An identity that already has a record is never refused.
+      await expect(store.update('identity-5', 'Still working.', () => true)).resolves.toMatchObject({ text: 'Still working.' })
+    }
+  })
+
+  // #1328 review (a3, b3): continuity must hold for BOTH stores and from a
+  // real high revision, not the revision-1 shape that happened to be first.
+  it.each([
+    ['TLDR', 'tldr.json', realRecords.tldr.records, {}],
+    ['Goal', 'goal.json', realRecords.goal.records, GOAL],
+  ] as const)('continues an evicted %s identity above its real, highest revision', async (_label, name, source, options) => {
+    const highest = Object.values(source as Record<string, Shape>).sort((a, b) => b.revision - a.revision)[0]!
+    expect(highest.revision).toBeGreaterThan(2)
+    const { store } = await storeAtCap(name, fullDocument(source as never, { firstShape: highest }), options)
+    await store.update('new-agent', 'Starting work.', () => true)
+    expect(await store.read(['identity-0'])).toEqual({})
+    expect((await store.update('identity-0', 'Back again.', () => true)).revision).toBe(highest.revision + 1)
+  })
+
+  // #1328 review (b1): the eviction and the new record are ONE write. Two
+  // writes, faulted between them, left a file over the cap, and load()
+  // refuses such a file, which failed every TLDR and Goal read and write.
+  it('adds the record and evicts in one write, so a fault leaves the old file intact', async () => {
+    const { file, store } = await storeAtCap('tldr.json', fullDocument(realRecords.tldr.records as never))
+    let writes = 0
+    renameFault.current = to => to === file && ++writes > 1
+    await store.update('new-agent', 'Starting work.', () => true)
+    expect(writes).toBe(1)
+    expect(Object.keys(await new TldrStore(file, NOW).read(['new-agent']))).toEqual(['new-agent'])
+    const afterFirst = await readFile(file, 'utf8')
+    // And when that one write fails, the file is exactly what it was.
+    renameFault.current = to => to === file
+    await expect(store.update('another-agent', 'Starting too.', () => true)).rejects.toThrow('injected rename failure')
+    renameFault.current = null
+    const reopened = new TldrStore(file, NOW)
+    expect(await reopened.read(['another-agent'])).toEqual({})
+    expect(await readFile(file, 'utf8')).toBe(afterFirst)
+  })
+
+  // #1328 review (b2, c3): eviction removes the CURRENT record only. The
+  // evicted agent's timeline stays readable, and the new agent's report gets
+  // its own history row like any other.
+  it('keeps the evicted identity’s history and writes the new agent’s', async () => {
+    const { directory, file } = await storeAtCap('tldr.json', { version: 1, records: {} })
+    await new TldrStore(file, () => new Date(t0 - 60_000)).update('identity-0', 'An early report.', () => true)
+    await writeFile(file, JSON.stringify(fullDocument(realRecords.tldr.records as never)))
+    const store = new TldrStore(file, NOW)
+    await store.update('new-agent', 'Starting work.', () => true)
+    expect(await store.read(['identity-0'])).toEqual({})
+    expect((await store.history('identity-0')).map(entry => entry.text)).toEqual(['An early report.'])
+    expect((await store.history('new-agent')).map(entry => entry.text)).toEqual(['Starting work.'])
+    expect(await readdir(join(directory, 'tldr-history'))).toHaveLength(2)
+  })
+})
+type PersistedWindowLike = { workspace: unknown }
diff --git a/src/main/tldr/TldrStore.ts b/src/main/tldr/TldrStore.ts
index 8be5f88f2..43a848589 100644
--- a/src/main/tldr/TldrStore.ts
+++ b/src/main/tldr/TldrStore.ts
@@ -3,9 +3,13 @@ import { mkdir, readdir, readFile, rename, stat, unlink, writeFile } from 'node:
 import { dirname, join } from 'node:path'
 import { EventEmitter } from 'node:events'
 import { normalizeTldrText, TLDR_HISTORY_LIMIT, validTldrIdentity } from '@shared/types/tldr.js'
+import { withReportingPublicationLock } from '@main/storage/reportingPublicationLock.js'
 import type { TldrHistoryEntry, TldrRecord, TldrUpdate } from '@shared/types/tldr.js'
 
-const MAX_RECORDS = 10_000
+// The cap is a bound on the file, not on how many agents may ever report: past
+// it the least recently written record is evicted (#1277). Exported so the
+// test grows a store to exactly this size instead of copying the number.
+export const TLDR_MAX_RECORDS = 10_000
 const MAX_FILE_BYTES = 24 * 1024 * 1024
 // Every agent that ever reported keeps a history file, and closed agents are
 // never told to the store. Bounding the file count keeps the directory from
@@ -20,10 +24,13 @@ const MAX_HISTORY_FILE_BYTES = 512 * 1024
  * preserve a conversation; it is deliberately independent of PTY routing IDs. */
 export class TldrStore extends EventEmitter {
   private records: Record<string, TldrRecord> | null = null
-  /** The last revision of each record set aside at load (#1247 review A):
-   *  every reader keeps the HIGHER revision when a read and a change event
-   *  race, so an identity that reports again after its record was set aside
-   *  must continue above it, not restart at 1 and be discarded as stale. */
+  /** The last revision of each record set aside at load (#1247 review A), or
+   *  evicted at the cap (#1277): every reader keeps the HIGHER revision when a
+   *  read and a change event race, so an identity that reports again after
+   *  its record went away must continue above it, not restart at 1 and be
+   *  discarded as stale. In memory only: readers' caches do not survive a
+   *  restart either. It grows by one per eviction, i.e. per NEW identity past
+   *  the cap in one run, which is tens a day. */
   private readonly setAsideRevisions = new Map<string, number>()
   /** The loaded file's bytes while set-aside records are not yet preserved.
    *  The next write drops them from the file, so it must not run until a
@@ -42,6 +49,13 @@ export class TldrStore extends EventEmitter {
 
   private readonly label: string
 
+  private readonly inUse: () => ReadonlySet<string> | null
+
+  /** Identities of live sessions, counted: a replacement registers its
+   *  successor before revoking its predecessor under the same identity, so
+   *  the predecessor's unpin must not release the successor. */
+  private readonly pins = new Map<string, number>()
+
   /**
    * The Goal capability (#936) is a second instance rather than a second store
    * class: goals need exactly these guarantees — one serialized atomic writer,
@@ -53,12 +67,21 @@ export class TldrStore extends EventEmitter {
   constructor(
     private readonly file: string,
     private readonly now = () => new Date(),
-    options: { maxHistoryFiles?: number; historyDirectoryName?: string; label?: string } = {},
+    options: {
+      maxHistoryFiles?: number
+      historyDirectoryName?: string
+      label?: string
+      /** Identities the persisted workspace names, never evicted at the cap;
+       *  null = unknown, which evicts nothing. Live sessions are protected by
+       *  pin() instead. Omitted = none (tests of unrelated behavior). */
+      inUse?: () => ReadonlySet<string> | null
+    } = {},
   ) {
     super()
     this.historyDirectory = join(dirname(file), options.historyDirectoryName ?? 'tldr-history')
     this.maxHistoryFiles = options.maxHistoryFiles ?? MAX_HISTORY_FILES
     this.label = options.label ?? 'TLDR'
+    this.inUse = options.inUse ?? (() => new Set())
   }
 
   private serialize<T>(operation: () => Promise<T>): Promise<T> {
@@ -80,7 +103,7 @@ export class TldrStore extends EventEmitter {
     }
     const document = JSON.parse(source)
     if (document?.version !== 1 || !document.records || typeof document.records !== 'object'
-      || Array.isArray(document.records) || Object.keys(document.records).length > MAX_RECORDS) {
+      || Array.isArray(document.records) || Object.keys(document.records).length > TLDR_MAX_RECORDS) {
       throw new Error('TLDR storage is invalid; the original file has been preserved.')
     }
     const records = Object.create(null) as Record<string, TldrRecord>
@@ -146,9 +169,28 @@ export class TldrStore extends EventEmitter {
     console.warn(`[${this.label.toLowerCase()}] set aside ${setAside} invalid record(s); original preserved at ${copy}`)
   }
 
+  /** Mark an identity live before its session is registered (#1328 q52).
+   *  Runs in the write queue: an eviction already in flight finishes first,
+   *  and every eviction chosen after this skips the identity. */
+  pin(identity: string): Promise<void> {
+    return this.serialize(async () => {
+      this.pins.set(identity, (this.pins.get(identity) ?? 0) + 1)
+    })
+  }
+
+  /** The session holding a pin was revoked. Queued like pin(), so a revoke
+   *  and a re-registration keep their order. */
+  unpin(identity: string): Promise<void> {
+    return this.serialize(async () => {
+      const count = (this.pins.get(identity) ?? 0) - 1
+      if (count > 0) this.pins.set(identity, count)
+      else this.pins.delete(identity)
+    })
+  }
+
   read(identities: string[]): Promise<Record<string, TldrRecord>> {
     return this.serialize(async () => {
-      if (identities.length > MAX_RECORDS || !identities.every(validTldrIdentity)) throw new Error('Invalid TLDR identities.')
+      if (identities.length > TLDR_MAX_RECORDS || !identities.every(validTldrIdentity)) throw new Error('Invalid TLDR identities.')
       const records = await this.load()
       return Object.fromEntries(identities.filter(id => records[id]).map(id => [id, { ...records[id]! }]))
     })
@@ -295,13 +337,59 @@ export class TldrStore extends EventEmitter {
       const text = normalizeTldrText(value, this.label)
       const records = await this.load()
       if (!authorized()) throw new Error(`This ${this.label} session is no longer active.`)
-      if (!records[identity] && Object.keys(records).length >= MAX_RECORDS) throw new Error('TLDR storage is full.')
+      // WHY evict rather than refuse (#1277): nothing ever deletes a record
+      // (the store is never told an agent closed), so a refusal here was
+      // permanent. Once the file held TLDR_MAX_RECORDS identities every NEW
+      // agent's tldr_update and goal_set failed forever, while old agents
+      // kept working. At the owner's ~27 new identities a day that is about
+      // a year out, and it is certain.
+      //
+      // WHY age alone does not choose (#1328 review, all three reviewers):
+      // a goal is set once per task, so the OLDEST goal can belong to an
+      // agent that is still running. Evicting it made that agent's
+      // goal_complete fail, and a view that had already read it kept showing
+      // it (no removal event exists), including as a tickable row in Close
+      // Completed Agents. So an identity still named by any workspace or a
+      // live session is never a candidate. Every view reads identities of
+      // workspace sessions only, so an evicted record is one no view shows.
+      // When no candidate exists, or in-use is unknown, the store refuses as
+      // before: ambiguity fails closed (steering q40).
+      //
+      // WHY live sessions protect themselves through `pin()` and this queue
+      // (#1328, steering q51/q52): the first design asked main for its live
+      // registrations while choosing, then wrote. A session registering
+      // during the awaited rename was still evicted, and every repair that
+      // tried to give its record back afterwards found a new way to lose it
+      // (no second victim, a crash between two renames). Now the choice and
+      // the write are ONE queued operation, and a session pins its identity
+      // through the same queue before it becomes live: a pin queued first
+      // protects it, a pin queued behind an eviction waits for its outcome.
+      // A record is therefore never deleted while its identity is live, and
+      // nothing is ever deleted and then compensated.
+      const needed = records[identity] ? 0 : Object.keys(records).length + 1 - TLDR_MAX_RECORDS
       // A fresh record, deliberately WITHOUT any completion carried over: for
       // the Goal store this is how a new goal clears the old one's completion
       // (#1182). The agent sets a new goal exactly when it is given new work.
       const previousRevision = records[identity]?.revision ?? this.setAsideRevisions.get(identity) ?? 0
       const record: TldrRecord = { text, updatedAt: this.now().toISOString(), revision: previousRevision + 1 }
-      await this.commit(identity, records, record, authorized)
+      // An evicting write reads who the workspace names, chooses, writes and
+      // renames while holding the lock workspace saves also hold (#1328 q56):
+      // a save naming the chosen record cannot land in the middle. Every
+      // other write (an existing identity, or room left) takes no lock.
+      const evictedRecords = new Map<string, TldrRecord>()
+      const write = async () => {
+        const workspace = needed > 0 ? this.inUse() : null
+        const protectedIds = workspace === null ? null : new Set([...workspace, ...this.pins.keys()])
+        const evicted = needed > 0 ? leastRecentlyWritten(records, needed, protectedIds) : []
+        if (evicted.length < needed) throw new Error(`${this.label} storage is full.`)
+        for (const id of evicted) evictedRecords.set(id, records[id]!)
+        // Same atomic write as the new record: a crash between two writes
+        // must not leave the file over the cap, which load() refuses as damage.
+        await this.commit(identity, records, record, authorized, evicted)
+      }
+      await (needed > 0 ? withReportingPublicationLock(write) : write())
+      // Only once the eviction is durable: a refused write evicted nothing.
+      for (const [id, evictedRecord] of evictedRecords) this.setAsideRevisions.set(id, evictedRecord.revision)
       // The current record is already durable and acknowledged. History is the
       // secondary view of it, so a history failure (a full disk, a corrupt file)
       // must not turn a successful report into a failed tool call that the
@@ -359,6 +447,11 @@ export class TldrStore extends EventEmitter {
     records: Record<string, TldrRecord>,
     record: TldrRecord,
     authorized: () => boolean,
+    // Identities dropped in this same write (#1277). History files are left:
+    // they have their own cap, and an old agent's timeline stays readable.
+    // No change event either: TldrUpdate has no removal shape, and only
+    // identities no workspace names are evicted, so no view holds one.
+    evict: readonly string[] = [],
   ): Promise<void> {
     // Writing now would drop set-aside records whose bytes are not yet
     // preserved anywhere; the copy is retried, and the write refused if it
@@ -368,6 +461,13 @@ export class TldrStore extends EventEmitter {
     // Otherwise a valid opaque key such as "constructor" can read inherited
     // object properties and persist an invalid revision instead of entry 1.
     const next = Object.assign(Object.create(null) as Record<string, TldrRecord>, records, { [identity]: record })
+    for (const id of evict) delete next[id]
+    await this.write(next, authorized)
+  }
+
+  /** Temp file, revocation re-checked after the I/O, atomic rename, then the
+   *  in-memory swap. Must run inside `serialize`. */
+  private async write(next: Record<string, TldrRecord>, authorized: () => boolean): Promise<void> {
     const temporary = `${this.file}.${randomUUID()}.tmp`
     await mkdir(dirname(this.file), { recursive: true })
     try {
@@ -383,6 +483,23 @@ export class TldrStore extends EventEmitter {
   }
 }
 
+/** Up to `count` identities, written longest ago, that nothing is using.
+ *  `inUse === null` (unknown) yields none, so the caller refuses. The
+ *  "written" time is the later of the set time and the completion time
+ *  (#1277): completing a goal is a write, and
+ *  a just-completed goal is exactly what the close menu lists, so a goal set
+ *  long ago but completed a minute ago must not be the first to go. Both times
+ *  are validated ISO strings by the time a record is in memory. */
+function leastRecentlyWritten(records: Record<string, TldrRecord>, count: number, inUse: ReadonlySet<string> | null): string[] {
+  if (count <= 0 || inUse === null) return []
+  const writtenAt = (record: TldrRecord) =>
+    Math.max(Date.parse(record.updatedAt), record.completedAt ? Date.parse(record.completedAt) : 0)
+  return Object.keys(records)
+    .filter(id => !inUse.has(id))
+    .sort((a, b) => writtenAt(records[a]!) - writtenAt(records[b]!))
+    .slice(0, count)
+}
+
 /** Completion is all-or-nothing: a time without a note (or the reverse) is not
  * something this store ever writes, so it can only be damage. Rejecting it
  * follows the file's existing rule — refuse and preserve rather than guess. */
diff --git a/src/main/tldr/identitiesInUse.ts b/src/main/tldr/identitiesInUse.ts
new file mode 100644
index 000000000..d2722df41
--- /dev/null
+++ b/src/main/tldr/identitiesInUse.ts
@@ -0,0 +1,37 @@
+import { projectWorkspace } from '@main/agentActivity/workspaceProjection.js'
+import type { PersistedWindow } from '@main/storage/workspaceFile.js'
+
+/**
+ * The TLDR/Goal identities the persisted workspace names, which the stores may
+ * never evict at their cap (#1277, #1328 review).
+ *
+ * - The persisted workspace of EVERY window: a parked or hibernated agent has
+ *   no backend, yet its pane, peek, Agent Activity row and Close Completed
+ *   Agents row all read its TLDR and goal by this identity. Every renderer
+ *   view reads identities of workspace sessions only, which is what makes
+ *   "not in any workspace" a safe definition of "nobody is looking".
+ * Live sessions are NOT read here: they pin their identity through each
+ * store's own write queue before registering (TldrStore.pin), which is the
+ * only way to order "became live" against an eviction's write (#1328 q52).
+ *
+ * `windows === null` means the workspace file has not opened yet: unknown, so
+ * the caller evicts nothing (steering q40).
+ */
+export function tldrIdentitiesInUse(
+  windows: readonly PersistedWindow[] | null,
+): ReadonlySet<string> | null {
+  if (windows === null) return null
+  const inUse = new Set<string>()
+  for (const placement of projectWorkspace(windows).sessions.values()) {
+    if (placement.tldrIdentity) inUse.add(placement.tldrIdentity)
+    // WHY the session id as well, for every session (#1328 round 2, all
+    // three reviewers): the renderer reads a session with no explicit
+    // `tldrIdentity` under its SESSION ID when TLDR or Goal is enabled
+    // (tldrIdentityForSession, for main-created and older agents), and the
+    // peek, Agent Activity and Close Completed Agents all use that fallback.
+    // Protecting every persisted session id is a superset of that rule, so
+    // it cannot drift from it; the cost is a few extra ids never evicted.
+    inUse.add(placement.sessionId)
+  }
+  return inUse
+}
diff --git a/src/main/tldr/reportingStores.ts b/src/main/tldr/reportingStores.ts
new file mode 100644
index 000000000..48c0c134c
--- /dev/null
+++ b/src/main/tldr/reportingStores.ts
@@ -0,0 +1,22 @@
+import { join } from 'node:path'
+import { TldrStore } from './TldrStore.js'
+
+/**
+ * The TLDR and Goal stores, as the app runs them.
+ *
+ * WHY a factory and not two lines in index.ts (#1328 round 2 c): which
+ * identities a store may evict at its cap is decided by the `inUse` callback
+ * passed here, and a store built without one evicts by age alone, which is
+ * the bug that let a running agent's goal disappear. As two constructor
+ * calls in index.ts nothing tested that wiring. Here `inUse` is a required
+ * parameter the test drives, and both stores must receive it.
+ */
+export function createReportingStores(
+  stateDirectory: string,
+  inUse: () => ReadonlySet<string> | null,
+): { tldrStore: TldrStore; goalStore: TldrStore } {
+  return {
+    tldrStore: new TldrStore(join(stateDirectory, 'tldr.json'), undefined, { inUse }),
+    goalStore: new TldrStore(join(stateDirectory, 'goal.json'), undefined, { historyDirectoryName: 'goal-history', label: 'Goal', inUse }),
+  }
+}
diff --git a/src/mcp/runtime/BuiltInMcpHttpHost.test.ts b/src/mcp/runtime/BuiltInMcpHttpHost.test.ts
index 544c86842..a7967543e 100644
--- a/src/mcp/runtime/BuiltInMcpHttpHost.test.ts
+++ b/src/mcp/runtime/BuiltInMcpHttpHost.test.ts
@@ -271,3 +271,33 @@ it('a browser client connected while disabled needs no second discovery or reloa
     expect((await client.callTool({ name: 'browser_network', arguments: {} })).isError).toBe(true)
   } finally { await client.close(); await host.stop() }
 })
+
+// #1328 q52: a session's reporting identity is pinned in both stores before
+// it registers, and released when it is revoked. Pins are counted by the
+// store; this pins exactly the identity the registration will report as,
+// including the session-id fallback.
+it('pins the identity a session will report as, and releases it on revoke', async () => {
+  const host = new BuiltInMcpHttpHost()
+  const calls: string[] = []
+  const store = (name: string) => ({
+    update: async () => { throw new Error('unused') },
+    complete: async () => { throw new Error('unused') },
+    pin: async (id: string) => { calls.push(`${name}.pin ${id}`) },
+    unpin: async (id: string) => { calls.push(`${name}.unpin ${id}`) },
+  })
+  host.setDependencies({ tldrStore: store('tldr'), goalStore: store('goal') } as never)
+  await host.start()
+  try {
+    const explicit = { sessionId: 'running', tldrIdentity: 'identity-running', cwd: '/tmp/project', providerKind: 'claude' as const, domains: ['tldr' as const] }
+    const fallback = { sessionId: 'no-explicit-identity', cwd: '/tmp/project', providerKind: 'codex' as const, domains: ['goal' as const] }
+    const none = { sessionId: 'no-reporting', cwd: '/tmp/project', providerKind: 'codex' as const, domains: ['ping' as const] }
+    for (const scope of [explicit, fallback, none]) {
+      host.registerSession(scope, await host.pinReportingIdentity(scope))
+    }
+    expect(calls).toEqual(['tldr.pin identity-running', 'goal.pin identity-running', 'tldr.pin no-explicit-identity', 'goal.pin no-explicit-identity'])
+    calls.length = 0
+    host.revokeSession('no-explicit-identity')
+    host.revokeSession('no-reporting')
+    expect(calls).toEqual(['tldr.unpin no-explicit-identity', 'goal.unpin no-explicit-identity'])
+  } finally { await host.stop() }
+})
diff --git a/src/mcp/runtime/BuiltInMcpHttpHost.ts b/src/mcp/runtime/BuiltInMcpHttpHost.ts
index f7972dddf..902bd1ef8 100644
--- a/src/mcp/runtime/BuiltInMcpHttpHost.ts
+++ b/src/mcp/runtime/BuiltInMcpHttpHost.ts
@@ -65,6 +65,9 @@ type SessionRegistration = {
   token: string
   scope: McpSessionScope
   revoked: boolean
+  /** The reporting pin taken for this registration (#1328), released
+   *  exactly once when the registration is revoked. */
+  releasePin?: () => void
 }
 
 type BuiltInMcpServerFactory = (
@@ -73,8 +76,10 @@ type BuiltInMcpServerFactory = (
 ) => McpServer
 
 export type BuiltInMcpDependencies = UserMcpToolDependencies & SkillsToolDependencies & {
-  tldrStore?: Pick<TldrStore, 'update'>
-  goalStore?: Pick<TldrStore, 'update' | 'complete'>
+  // pin/unpin are optional only so tests of unrelated tools can pass a bare
+  // `update`; the app's stores always have them (see pinReportingIdentity).
+  tldrStore?: Pick<TldrStore, 'update'> & Partial<Pick<TldrStore, 'pin' | 'unpin'>>
+  goalStore?: Pick<TldrStore, 'update' | 'complete'> & Partial<Pick<TldrStore, 'pin' | 'unpin'>>
   tldrEnforcement?: Pick<TldrEnforcement, 'handle' | 'forget'>
   isTldrWriteAuthorized?: () => boolean
   orchestrationBridge?: OrchestrationBridge
@@ -243,13 +248,67 @@ export class BuiltInMcpHttpHost {
     await new Promise<void>(resolve => server.close(() => resolve()))
   }
 
+  /** The TLDR/Goal identity a registration with this scope reports as: the
+   *  same rule registerSession's scope uses. */
+  private reportingIdentity(scope: { tldrIdentity?: string; sessionId: string; providerKind: AgentProviderKind; domains: readonly BuiltInMcpDomain[] | undefined }): string | undefined {
+    return scope.tldrIdentity
+      ?? (hasReportingDomain(filterBuiltInMcpDomainsForProvider(scope.providerKind, scope.domains)) ? scope.sessionId : undefined)
+  }
+
+  /**
+   * Pin the identity a session is about to register as, in both reporting
+   * stores, and wait until the pin is in each store's write queue (#1328 q52).
+   * Returns the release for the caller to call if the session does NOT end up
+   * registered (cancelled, or registerSession threw); once it is registered,
+   * revokeSession releases it instead.
+   *
+   * WHY the spawn path awaits this BEFORE registerSession: registerSession is
+   * synchronous, and the stores' cap eviction must be ordered against "this
+   * identity became live". A pin queued before an eviction protects the
+   * record; one queued behind an in-flight eviction waits for its outcome.
+   *
+   * WHY a release, and allSettled (#1328 verification, steering q56): a pin
+   * with no registration had no owner — revokeSession finds no token — so a
+   * cancelled spawn left its identity protected forever, and at a full store
+   * whose only free record it was, every new agent was refused until
+   * restart. A pin that succeeded in one store while the other failed is
+   * released before the error propagates.
+   */
+  async pinReportingIdentity(scope: { tldrIdentity?: string; sessionId: string; providerKind: AgentProviderKind; domains: readonly BuiltInMcpDomain[] | undefined }): Promise<() => void> {
+    const identity = this.reportingIdentity(scope)
+    if (!identity) return () => {}
+    const stores = [this.dependencies.tldrStore, this.dependencies.goalStore].filter(store => store?.pin && store.unpin)
+    const pinned = await Promise.allSettled(stores.map(store => store!.pin!(identity)))
+    const release = (only: typeof stores) => { for (const store of only) void store!.unpin!(identity).catch(() => {}) }
+    const failed = pinned.find(result => result.status === 'rejected')
+    if (failed) {
+      release(stores.filter((_, index) => pinned[index]!.status === 'fulfilled'))
+      throw (failed as PromiseRejectedResult).reason
+    }
+    let released = false
+    return () => {
+      if (released) return
+      released = true
+      release(stores)
+    }
+  }
+
   registerSession(scope: {
     tldrIdentity?: string
     sessionId: string
     cwd: string
     providerKind: AgentProviderKind
     domains: readonly BuiltInMcpDomain[] | undefined
-  }): BuiltInMcpServerConfig[] {
+  },
+  // The release pinReportingIdentity returned for this spawn. WHY the
+  // registration takes it (#1328 second verification, all three): a pin
+  // needs exactly one owner. Released by identity on revoke, a pin whose
+  // registration was never created had none: a recovered session whose only
+  // domains the provider policy filters away returns `[]`, no token exists,
+  // and its identity stayed protected forever. Now the pin is released right
+  // here when no registration is created, and otherwise by revokeSession.
+  releasePin?: () => void,
+  ): BuiltInMcpServerConfig[] {
     // WHY provider filtering is repeated at this main-owned boundary even
     // though the renderer resolves the same policy: session metadata and IPC
     // payloads are inputs, not authority. In particular, stale persisted data
@@ -276,6 +335,7 @@ export class BuiltInMcpHttpHost {
       // revoke any token left under that id rather than letting the stale
       // registration outlive the now-capability-free replacement.
       this.revokeSession(scope.sessionId)
+      releasePin?.()
       return []
     }
     if (!this.server || this.port === null) {
@@ -285,7 +345,7 @@ export class BuiltInMcpHttpHost {
     this.revokeSession(scope.sessionId)
     const token = randomBytes(32).toString('base64url')
     const mcpScope = {
-      tldrIdentity: scope.tldrIdentity ?? (hasReportingDomain(domains) ? scope.sessionId : undefined),
+      tldrIdentity: this.reportingIdentity(scope),
       sessionId: scope.sessionId,
       cwd: scope.cwd,
       domains,
@@ -297,6 +357,7 @@ export class BuiltInMcpHttpHost {
       token,
       scope: mcpScope,
       revoked: false,
+      ...(releasePin ? { releasePin } : {}),
     })
     this.tokensBySession.set(scope.sessionId, token)
 
@@ -354,6 +415,10 @@ export class BuiltInMcpHttpHost {
     // tear down — each request owns and closes its own scoped server.
     if (registration) registration.revoked = true
     this.dependencies.tldrEnforcement?.forget(token)
+    // Release the pin pinReportingIdentity took for this registration. The
+    // stores count pins, so a replacement's successor (registered before its
+    // predecessor is revoked, same identity) stays protected.
+    registration?.releasePin?.()
   }
 
   private serverConfig(token: string): BuiltInMcpServerConfig {
diff --git a/src/renderer/src/workspace/hook/persistence/sessionRecovery.integration.test.ts b/src/renderer/src/workspace/hook/persistence/sessionRecovery.integration.test.ts
index 2d7c508a6..56143e12a 100644
--- a/src/renderer/src/workspace/hook/persistence/sessionRecovery.integration.test.ts
+++ b/src/renderer/src/workspace/hook/persistence/sessionRecovery.integration.test.ts
@@ -132,6 +132,9 @@ const TEST_MCP_SERVER_CONFIG = {
 function makeMcpHost() {
   let registered = false
   return {
+    // #1328: spawn pins the reporting identity before registering, and hands
+    // the release to registerSession.
+    pinReportingIdentity: vi.fn(async () => () => {}),
     registerSession: vi.fn(() => {
       registered = true
       return [TEST_MCP_SERVER_CONFIG]
@@ -237,7 +240,7 @@ describe('cross-layer session restart reconciliation', () => {
       cwd: '/tmp/project',
       providerKind: 'codex',
       domains: ['workflows'],
-    })
+    }, expect.any(Function))
     expect(createSession.mock.calls[0]?.[0]).toMatchObject({
       cwd: '/tmp/project',
       resumeSessionId: 'provider-history',