From 4cdb71eb4892af04ad3f1eb406e2a52a2043cb2a Mon Sep 17 00:00:00 2001
From: bo <bohuang1994@gmail.com>
Date: Tue, 4 Aug 2026 16:54:56 +0800
Subject: [PATCH 1/3] feat(runtime): add resilient recovery control plane

---
 apps/server/src/app.test.ts                   |    6 -
 apps/server/src/app.ts                        |    3 -
 apps/server/src/boot.ts                       |    8 +-
 apps/server/src/errors.ts                     |   10 +-
 apps/server/src/main.ts                       |    8 +
 .../server/src/routes/config-recovery.test.ts |   75 +
 apps/server/src/routes/config-recovery.ts     |  296 ++++
 .../server/src/routes/runtime-control.test.ts |  129 ++
 apps/server/src/routes/runtime-control.ts     |   82 ++
 apps/server/src/server-host.test.ts           | 1274 ++++++++++++++++-
 apps/server/src/server-host.ts                |  631 ++++++--
 apps/server/src/setup-grant.test.ts           |   12 +-
 .../src/{setup-grant.ts => terminal-grant.ts} |   15 +-
 apps/web/package.json                         |    2 +-
 apps/web/src/api/config-recovery.test.ts      |   55 +
 apps/web/src/api/config-recovery.ts           |   54 +
 apps/web/src/api/runtime-data.test.ts         |   48 +
 apps/web/src/api/runtime-data.ts              |   24 +
 apps/web/src/api/update.ts                    |   37 +-
 .../bootstrap/BootstrapGate.test.tsx          |   78 +-
 .../components/bootstrap/BootstrapGate.tsx    |   74 +-
 .../features/ConfigRecoverySettings.tsx       |   28 +
 ...ettingsConfigRecoveryPanel.interaction.tsx |  185 +++
 .../features/SettingsConfigRecoveryPanel.tsx  |  326 +++++
 .../features/SettingsDialog.interaction.tsx   |  266 +++-
 .../features/SettingsDialog.test.tsx          |   38 +-
 .../components/features/SettingsDialog.tsx    |   62 +-
 .../SettingsRuntimeDataPanel.interaction.tsx  |  178 +++
 .../features/SettingsRuntimeDataPanel.tsx     |  298 ++++
 .../features/SettingsUpdatesPanel.tsx         |   10 +-
 .../components/features/settings-helpers.ts   |    2 +-
 .../components/features/settings-panels.tsx   |   36 +-
 apps/web/src/main.tsx                         |   38 +-
 design-system/pages/settings.md               |  117 ++
 ...untime-control-plane-recovery-plan-goal.md |  192 +++
 ...runtime-control-plane-recovery-progress.md |   92 ++
 .../__arch__/automation-boundaries.test.ts    |    9 +-
 .../__arch__/runtime-data-boundaries.test.ts  |   37 +
 packages/agent-core/src/config/index.ts       |    6 +
 .../src/config/server-config-service.test.ts  |  335 ++++-
 .../src/config/server-config-service.ts       |  516 ++++++-
 packages/agent-core/src/index.ts              |    7 +
 ...ead-architecture-flows.integration.test.ts |    3 +-
 packages/agent-core/src/main.test.ts          |   50 +-
 .../runtime-automations.integration.test.ts   |    3 +-
 .../src/runtime-automations.test.ts           |    3 +-
 packages/agent-core/src/runtime-data/index.ts |    9 +
 .../src/runtime-data/service.test.ts          |  543 +++++++
 .../agent-core/src/runtime-data/service.ts    |  588 ++++++++
 packages/agent-core/src/runtime-mcp.test.ts   |   64 +-
 packages/agent-core/src/runtime.ts            |   96 +-
 .../tool-output/artifact-lifecycle.test.ts    |   14 +-
 packages/protocol/src/bootstrap.ts            |   58 +-
 packages/protocol/src/index.ts                |    1 +
 packages/protocol/src/runtime-data.ts         |   63 +
 55 files changed, 6891 insertions(+), 303 deletions(-)
 create mode 100644 apps/server/src/routes/config-recovery.test.ts
 create mode 100644 apps/server/src/routes/config-recovery.ts
 create mode 100644 apps/server/src/routes/runtime-control.test.ts
 create mode 100644 apps/server/src/routes/runtime-control.ts
 rename apps/server/src/{setup-grant.ts => terminal-grant.ts} (63%)
 create mode 100644 apps/web/src/api/config-recovery.test.ts
 create mode 100644 apps/web/src/api/config-recovery.ts
 create mode 100644 apps/web/src/api/runtime-data.test.ts
 create mode 100644 apps/web/src/api/runtime-data.ts
 create mode 100644 apps/web/src/components/features/ConfigRecoverySettings.tsx
 create mode 100644 apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx
 create mode 100644 apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx
 create mode 100644 apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
 create mode 100644 apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
 create mode 100644 design-system/pages/settings.md
 create mode 100644 docs/goals/runtime-control-plane-recovery-plan-goal.md
 create mode 100644 docs/goals/runtime-control-plane-recovery-progress.md
 create mode 100644 packages/agent-core/src/__arch__/runtime-data-boundaries.test.ts
 create mode 100644 packages/agent-core/src/runtime-data/index.ts
 create mode 100644 packages/agent-core/src/runtime-data/service.test.ts
 create mode 100644 packages/agent-core/src/runtime-data/service.ts
 create mode 100644 packages/protocol/src/runtime-data.ts

diff --git a/apps/server/src/app.test.ts b/apps/server/src/app.test.ts
index 7d6f3a7f..18944de0 100644
--- a/apps/server/src/app.test.ts
+++ b/apps/server/src/app.test.ts
@@ -5,12 +5,6 @@ import { createRuntimeApp } from "./app";
 import { globalEventBus } from "./events/global-event-bus";
 
 const mockRuntime = {
-  configService: {
-    getSnapshot: mock(async () => ({ config: { provider: {}, profiles: {} }, revision: "test", modelRuntimeRevision: "test", configPath: "/test", restartRequiredSections: [] })),
-    getModelRuntimeCatalog: mock(() => ({ revision: "test", providers: [], profileDefaults: {} })),
-    getProviderAdapterCatalog: mock(() => []),
-    save: mock(async () => ({ config: { provider: {}, profiles: {} }, revision: "test", modelRuntimeRevision: "test", configPath: "/test", restartRequiredSections: [] })),
-  },
   listAgentDescriptors: mock(() => []),
   subscribeSessionEvents: mock(() => () => undefined),
   subscribeHitlEvents: mock(() => () => undefined),
diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index cef76075..83d04482 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -7,7 +7,6 @@ import {
 } from "@archcode/agent-core";
 import type { GlobalSSEEvent } from "@archcode/protocol";
 import { errorHandler } from "./error-handler";
-import { createConfigRoutes } from "./routes/config";
 import { createAgentsRoutes } from "./routes/agents";
 import { createCompressionRoutes } from "./routes/compression";
 import { createDirectoriesRoutes } from "./routes/directories";
@@ -83,7 +82,6 @@ export function createRuntimeApp(
   const files = createFilesRoutes(serverRuntime);
   const directories = createDirectoriesRoutes();
   const mcp = createMcpRoutes(serverRuntime);
-  const config = createConfigRoutes(serverRuntime.configService);
 
   app.route("/api", globalWork);
   app.route("/api/projects", projects);
@@ -98,7 +96,6 @@ export function createRuntimeApp(
   app.route("/api/events", globalEvents);
   app.route("/api/projects", files);
   app.route("/api/mcp", mcp);
-  app.route("/api/config", config);
   app.route("/api/sessions", new Hono());
   app.route("/api/agents", agents);
   app.route("/api/files", new Hono());
diff --git a/apps/server/src/boot.ts b/apps/server/src/boot.ts
index 0f960239..56ecbea8 100644
--- a/apps/server/src/boot.ts
+++ b/apps/server/src/boot.ts
@@ -45,10 +45,14 @@ export async function bootServer(
       ...(options.version ? { version: options.version } : {}),
     },
   });
-  for (const instruction of host.setupInstructions(url)) {
-    logger.info("server.setup.required", { message: instruction });
+  for (const instruction of host.terminalInstructions(url)) {
+    logger.info("server.terminal_action.required", { message: instruction });
   }
 
+  // The listener is deliberately published before Runtime activation begins.
+  // Runtime startup may be slow or fail; the control plane remains responsive.
+  host.startRuntimeActivation();
+
   if (Bun.env[ENV_OPEN_BROWSER]) {
     // Browser opening will be implemented when the web UI workflow is ready.
   }
diff --git a/apps/server/src/errors.ts b/apps/server/src/errors.ts
index 09c946b2..35bf4bcd 100644
--- a/apps/server/src/errors.ts
+++ b/apps/server/src/errors.ts
@@ -27,6 +27,7 @@ export type ServerErrorCode =
   | "PROJECT_TODO_DISCUSSION_UNAUTHORIZED"
   | "CONFIG_REVISION_CONFLICT"
   | "CONFIG_VALIDATION_ERROR"
+  | "CONFIG_RECOVERY_CONFLICT"
   | "TOOL_OUTPUT_FORBIDDEN"
   | "TOOL_OUTPUT_NOT_FOUND"
   | "TOOL_OUTPUT_EXPIRED"
@@ -55,7 +56,14 @@ export type ServerErrorCode =
   | "UPDATE_INSTALL_FAILED"
   | "UPDATE_NOT_AVAILABLE"
   | "UPDATE_RESTART_UNAVAILABLE"
-  | "UPDATE_RUNTIME_BUSY";
+  | "UPDATE_RUNTIME_BUSY"
+  | "RUNTIME_BUSY"
+  | "RUNTIME_CLEANUP_INCOMPLETE"
+  | "EMPTY_PROJECT_SLUGS"
+  | "DUPLICATE_PROJECT_SLUG"
+  | "PROJECT_NOT_REGISTERED"
+  | "PROJECT_HAS_NO_ISSUES"
+  | "DELETE_TARGET_UNSAFE";
 
 export class ServerError extends Error {
   constructor(
diff --git a/apps/server/src/main.ts b/apps/server/src/main.ts
index 6d61b96d..d207babf 100755
--- a/apps/server/src/main.ts
+++ b/apps/server/src/main.ts
@@ -3,6 +3,8 @@ import {
   createConsoleLogger,
   createRuntime,
   type Logger,
+  ProjectRegistry,
+  RuntimeDataService,
   ServerConfigService,
 } from "@archcode/agent-core";
 import {
@@ -46,6 +48,10 @@ async function main(
   const configService = new ServerConfigService();
   const compiled = isCompiledRuntime();
   const restartController = new ServerRestartController();
+  const projectRegistry = new ProjectRegistry({
+    logger: logger.child({ module: "projects.registry" }),
+  });
+  const runtimeDataService = new RuntimeDataService({ projectRegistry });
   const updateService = new UpdateService({
     currentVersion: options.version ?? "development",
     executablePath: process.execPath,
@@ -71,6 +77,8 @@ async function main(
     version: options.version,
     updateService,
     restartController,
+    projectRegistry,
+    runtimeDataService,
   });
   await bootServer(host, {
     port: options.port,
diff --git a/apps/server/src/routes/config-recovery.test.ts b/apps/server/src/routes/config-recovery.test.ts
new file mode 100644
index 00000000..e58cef45
--- /dev/null
+++ b/apps/server/src/routes/config-recovery.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+import { safeConfigRecoveryStatus } from "./config-recovery";
+
+describe("safe Config Recovery diagnostics", () => {
+  test("removes dynamic Config keys and raw validation values", () => {
+    const text = JSON.stringify(safeConfigRecoveryStatus(
+      "/Users/test/.archcode/config.json",
+      [{
+        path: "provider.raw-secret-provider.options.raw-secret-option",
+        message: "Unsupported provider package \"raw-secret-package\"",
+      }, {
+        path: "provider.raw-secret-provider.models.raw-secret-model.variants.raw-secret-variant.temperature",
+        message: "raw-secret-value is invalid",
+      }, {
+        path: "mcp.servers.raw-secret-server.headers.raw-secret-header",
+        message: "raw-secret-header-value is invalid",
+      }, {
+        path: "memory.raw-secret-field",
+        message: "raw-secret-memory-value is invalid",
+      }],
+    ));
+
+    expect(text).not.toContain("raw-secret");
+    expect(JSON.parse(text)).toEqual({
+      configPath: "/Users/test/.archcode/config.json",
+      removableItems: [],
+      issues: [{
+        path: "provider.<provider>.options.<option>",
+        message: "A configured provider package is not supported by this ArchCode release.",
+      }, {
+        path: "provider.<provider>.models.<model>.variants.<variant>",
+        message: "This value does not match the current ArchCode configuration format.",
+      }, {
+        path: "mcp.servers.<server>.headers.<header>",
+        message: "This value does not match the current ArchCode configuration format.",
+      }, {
+        path: "memory.<field>",
+        message: "This value does not match the current ArchCode configuration format.",
+      }],
+    });
+  });
+
+  test("exposes only opaque removable identities and bounded impact descriptions", () => {
+    const text = JSON.stringify(safeConfigRecoveryStatus(
+      "/Users/test/.archcode/config.json",
+      [],
+      {
+        revision: "revision-sentinel-safe",
+        items: [{
+          id: "abcdefghijklmnopqrstuv",
+          path: ["provider", "raw-secret-provider", "models", "raw-secret-model"],
+        }, {
+          id: "zyxwvutsrqponmlkjihgfe",
+          path: ["mcp", "servers", "raw-secret-server"],
+        }],
+      },
+    ));
+
+    expect(text).not.toContain("raw-secret");
+    expect(JSON.parse(text)).toMatchObject({
+      revision: "revision-sentinel-safe",
+      removableItems: [{
+        id: "abcdefghijklmnopqrstuv",
+        label: "Invalid model entry",
+        path: "provider.<provider>.models.<model>",
+        impact: expect.stringContaining("Other models remain configured"),
+      }, {
+        id: "zyxwvutsrqponmlkjihgfe",
+        label: "Invalid MCP server",
+        path: "mcp.servers.<server>",
+        impact: expect.stringContaining("Other MCP servers remain configured"),
+      }],
+    });
+  });
+});
diff --git a/apps/server/src/routes/config-recovery.ts b/apps/server/src/routes/config-recovery.ts
new file mode 100644
index 00000000..f91ac41f
--- /dev/null
+++ b/apps/server/src/routes/config-recovery.ts
@@ -0,0 +1,296 @@
+import { Hono } from "hono";
+import type {
+  ConfigRecoveryActionResponse,
+  ConfigRecoveryRemovableItem,
+  ConfigRecoveryStatus,
+  RemoveInvalidConfigItemsRequest,
+  ResetInvalidConfigRequest,
+  ServerConfigValidationIssue,
+} from "@archcode/protocol";
+import type { InvalidConfigRemovalPlan } from "@archcode/agent-core";
+import { assertMutationOrigin } from "../auth-http";
+import type { AuthSession } from "../server-auth-service";
+import { writeSessionCookie } from "../auth-http";
+import { BadRequestError } from "../errors";
+import { readBoundedJsonBody } from "../request-body";
+
+const RESET_BODY_MAX_BYTES = 256;
+const REMOVE_ITEMS_BODY_MAX_BYTES = 4_096;
+
+export interface ConfigRecoveryActionResult {
+  response: ConfigRecoveryActionResponse;
+  session?: AuthSession;
+}
+
+export interface ConfigRecoveryCoordinatorPort {
+  getConfigRecoveryStatus(authorization: string | undefined): ConfigRecoveryStatus;
+  retryConfigRecovery(authorization: string | undefined): Promise<ConfigRecoveryActionResult>;
+  removeInvalidConfigItems(
+    authorization: string | undefined,
+    request: RemoveInvalidConfigItemsRequest,
+  ): Promise<ConfigRecoveryActionResult>;
+  resetInvalidConfig(
+    authorization: string | undefined,
+    request: ResetInvalidConfigRequest,
+  ): Promise<ConfigRecoveryActionResult>;
+}
+
+export function createConfigRecoveryRoutes(
+  coordinator: ConfigRecoveryCoordinatorPort,
+  options: { readonly dev?: boolean } = {},
+): Hono {
+  const app = new Hono();
+
+  app.get("/", (c) => c.json(
+    coordinator.getConfigRecoveryStatus(c.req.header("Authorization")),
+  ));
+
+  app.post("/retry", async (c) => {
+    assertMutationOrigin(c.req.raw, options);
+    const result = await coordinator.retryConfigRecovery(
+      c.req.header("Authorization"),
+    );
+    if (result.session !== undefined) writeSessionCookie(c, result.session);
+    return c.json(result.response);
+  });
+
+  app.post("/reset", async (c) => {
+    assertMutationOrigin(c.req.raw, options);
+    const request = parseResetRequest(await readBoundedJsonBody(c.req.raw, {
+      maxBytes: RESET_BODY_MAX_BYTES,
+      label: "Config reset request",
+    }));
+    const result = await coordinator.resetInvalidConfig(
+      c.req.header("Authorization"),
+      request,
+    );
+    return c.json(result.response);
+  });
+
+  app.post("/remove-items", async (c) => {
+    assertMutationOrigin(c.req.raw, options);
+    const request = parseRemoveItemsRequest(await readBoundedJsonBody(c.req.raw, {
+      maxBytes: REMOVE_ITEMS_BODY_MAX_BYTES,
+      label: "Config item removal request",
+    }));
+    const result = await coordinator.removeInvalidConfigItems(
+      c.req.header("Authorization"),
+      request,
+    );
+    if (result.session !== undefined) writeSessionCookie(c, result.session);
+    return c.json(result.response);
+  });
+
+  return app;
+}
+
+export function safeConfigRecoveryStatus(
+  configPath: string,
+  issues: readonly ServerConfigValidationIssue[],
+  plan: InvalidConfigRemovalPlan = { items: [] },
+): ConfigRecoveryStatus {
+  return {
+    configPath,
+    issues: issues.map((issue) => ({
+      path: safeIssuePath(issue.path, configPath),
+      message: safeIssueMessage(issue.message),
+    })),
+    ...(plan.revision === undefined ? {} : { revision: plan.revision }),
+    removableItems: safeRemovableItems(plan.items, configPath),
+  };
+}
+
+function safeRemovableItems(
+  items: InvalidConfigRemovalPlan["items"],
+  configPath: string,
+): ConfigRecoveryRemovableItem[] {
+  const baseLabels = items.map((item) => removableItemPresentation(item.path, configPath));
+  const totals = new Map<string, number>();
+  for (const item of baseLabels) totals.set(item.label, (totals.get(item.label) ?? 0) + 1);
+  const seen = new Map<string, number>();
+  return items.map((item, index) => {
+    const presentation = baseLabels[index]!;
+    const ordinal = (seen.get(presentation.label) ?? 0) + 1;
+    seen.set(presentation.label, ordinal);
+    return {
+      id: item.id,
+      label: (totals.get(presentation.label) ?? 0) > 1
+        ? `${presentation.label} ${ordinal}`
+        : presentation.label,
+      path: presentation.path,
+      impact: presentation.impact,
+    };
+  });
+}
+
+function removableItemPresentation(
+  rawPath: readonly string[],
+  configPath: string,
+): Omit<ConfigRecoveryRemovableItem, "id"> {
+  const [root] = rawPath;
+  if (root === "provider" && rawPath[2] === "models" && rawPath[4] === "variants") {
+    return {
+      label: "Invalid model variant",
+      path: "provider.<provider>.models.<model>.variants.<variant>",
+      impact: "Removes this invalid variant only. The provider and model remain configured.",
+    };
+  }
+  if (root === "provider" && rawPath[2] === "models") {
+    return {
+      label: "Invalid model entry",
+      path: "provider.<provider>.models.<model>",
+      impact: "Removes this invalid model and its variants. Other models remain configured.",
+    };
+  }
+  if (root === "provider" && rawPath[2] === "options") {
+    return {
+      label: "Invalid provider option",
+      path: "provider.<provider>.options.<option>",
+      impact: "Removes this invalid option only. The provider and its models remain configured.",
+    };
+  }
+  if (root === "provider") {
+    return {
+      label: "Invalid provider entry",
+      path: "provider.<provider>",
+      impact: "Removes this provider and its models. Other providers remain configured.",
+    };
+  }
+  if (root === "mcp" && rawPath[1] === "servers") {
+    return {
+      label: "Invalid MCP server",
+      path: "mcp.servers.<server>",
+      impact: "Removes this MCP server only. Other MCP servers remain configured.",
+    };
+  }
+  if (root === "memory") {
+    return {
+      label: "Invalid memory settings",
+      path: "memory",
+      impact: "Removes the invalid global memory settings. Project Runtime data is not deleted.",
+    };
+  }
+  if (root === "integrations" && rawPath[1] === "github") {
+    return {
+      label: "Invalid GitHub integration",
+      path: "integrations.github",
+      impact: "Removes the invalid GitHub integration settings only.",
+    };
+  }
+  return {
+    label: "Invalid configuration field",
+    path: safeIssuePath(rawPath.join("."), configPath),
+    impact: "Removes this invalid field only. Other valid settings remain configured.",
+  };
+}
+
+function parseRemoveItemsRequest(value: unknown): RemoveInvalidConfigItemsRequest {
+  if (!isRecord(value)) throw new BadRequestError("Config item removal request must be an object");
+  const keys = Object.keys(value).sort();
+  if (keys.length !== 3 || keys[0] !== "confirmation" || keys[1] !== "expectedRevision" || keys[2] !== "itemIds") {
+    throw new BadRequestError("Config item removal request has unexpected fields");
+  }
+  if (value.confirmation !== "REMOVE_SELECTED_INVALID_CONFIG_ITEMS") {
+    throw new BadRequestError("Config item removal confirmation is invalid");
+  }
+  if (typeof value.expectedRevision !== "string" || value.expectedRevision.length < 16 || value.expectedRevision.length > 128) {
+    throw new BadRequestError("Config item removal revision is invalid");
+  }
+  if (!Array.isArray(value.itemIds) || value.itemIds.length === 0 || value.itemIds.length > 64) {
+    throw new BadRequestError("Select between 1 and 64 invalid Config items");
+  }
+  if (value.itemIds.some((id) => typeof id !== "string" || !/^[A-Za-z0-9_-]{16,64}$/.test(id))) {
+    throw new BadRequestError("Config item removal identity is invalid");
+  }
+  if (new Set(value.itemIds).size !== value.itemIds.length) {
+    throw new BadRequestError("Config item removal identities must be unique");
+  }
+  return {
+    expectedRevision: value.expectedRevision,
+    itemIds: value.itemIds as string[],
+    confirmation: "REMOVE_SELECTED_INVALID_CONFIG_ITEMS",
+  };
+}
+
+function parseResetRequest(value: unknown): ResetInvalidConfigRequest {
+  if (!isRecord(value)) throw new BadRequestError("Config reset request must be an object");
+  const keys = Object.keys(value);
+  if (keys.length !== 1 || keys[0] !== "confirmation") {
+    throw new BadRequestError("Config reset request must contain only confirmation");
+  }
+  if (value.confirmation !== "DELETE_INVALID_CONFIG") {
+    throw new BadRequestError("Config reset confirmation is invalid");
+  }
+  return { confirmation: "DELETE_INVALID_CONFIG" };
+}
+
+function safeIssuePath(path: string, configPath: string): string {
+  if (path === configPath || path === "") return "configuration";
+  const segments = path.split(".");
+  if (segments[0] === "provider") {
+    const structural = segments[2];
+    if (structural === "models") {
+      const modelField = segments[4];
+      if (modelField === "variants") {
+        return "provider.<provider>.models.<model>.variants.<variant>";
+      }
+      const knownModelFields = new Set(["name", "limit", "modalities", "options"]);
+      return knownModelFields.has(modelField ?? "")
+        ? ["provider", "<provider>", "models", "<model>", modelField].join(".")
+        : "provider.<provider>.models.<model>";
+    }
+    if (structural === "options") return "provider.<provider>.options.<option>";
+    return structural === "npm" || structural === "name"
+      ? `provider.<provider>.${structural}`
+      : "provider.<provider>";
+  }
+  if (segments[0] === "mcp" && segments[1] === "servers") {
+    const field = segments[3];
+    const tail = field === "headers"
+      ? ["headers", "<header>"]
+      : field === "url" || field === "timeout" ? [field] : [];
+    return ["mcp", "servers", "<server>", ...tail].join(".");
+  }
+  if (segments[0] === "profiles") {
+    const profile = new Set(["principal", "deep", "fast"]).has(segments[1] ?? "")
+      ? segments[1]!
+      : "<profile>";
+    const field = segments[2];
+    if (field === "options") return `profiles.${profile}.options.<option>`;
+    return field === "model" || field === "variant"
+      ? `profiles.${profile}.${field}`
+      : `profiles.${profile}`;
+  }
+  if (segments[0] === "memory") {
+    const field = segments[1];
+    return new Set(["enabled", "minMessages", "minContentLength", "cooldownMs"]).has(field ?? "")
+      ? `memory.${field}`
+      : "memory.<field>";
+  }
+  if (segments[0] === "integrations" && segments[1] === "github") {
+    const field = segments[2];
+    return new Set(["enabled", "tokenEnv", "defaultOwner", "defaultRepo"]).has(field ?? "")
+      ? `integrations.github.${field}`
+      : "integrations.github.<field>";
+  }
+  if (segments[0] === "auth") {
+    return segments[1] === "passwordHash" ? "auth.passwordHash" : "auth.<field>";
+  }
+  return "configuration";
+}
+
+function safeIssueMessage(message: string): string {
+  if (message.includes("Invalid JSON")) return "The file is not valid JSON.";
+  if (message.includes("Failed to read")) return "The configuration file could not be read.";
+  if (message.includes("Unsupported provider package")) {
+    return "A configured provider package is not supported by this ArchCode release.";
+  }
+  if (message.includes("reserved for a built-in server")) {
+    return "A configured MCP server name is reserved by ArchCode.";
+  }
+  return "This value does not match the current ArchCode configuration format.";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
diff --git a/apps/server/src/routes/runtime-control.test.ts b/apps/server/src/routes/runtime-control.test.ts
new file mode 100644
index 00000000..d86ce51c
--- /dev/null
+++ b/apps/server/src/routes/runtime-control.test.ts
@@ -0,0 +1,129 @@
+import { describe, expect, mock, test } from "bun:test";
+import { RuntimeDataRequestError } from "@archcode/agent-core";
+
+import { errorHandler } from "../error-handler";
+import { createRuntimeControlRoutes } from "./runtime-control";
+
+function createCoordinator() {
+  return {
+    getRuntimeStatus: mock(() => ({
+      state: "error" as const,
+      error: { message: "safe", recoveryAllowed: true },
+    })),
+    retryRuntime: mock(async () => ({ state: "ready" as const })),
+    inspectRuntimeData: mock(async () => ({ projects: [] })),
+    deleteRuntimeData: mock(async (projectSlugs: readonly string[]) => ({
+      results: projectSlugs.map((projectSlug) => ({
+        projectSlug,
+        status: "deleted" as const,
+      })),
+      runtime: { state: "ready" as const },
+    })),
+  };
+}
+
+describe("runtime control routes", () => {
+  test("returns Runtime status and retries through the coordinator", async () => {
+    const coordinator = createCoordinator();
+    const routes = createRuntimeControlRoutes(coordinator);
+    routes.runtime.onError(errorHandler);
+
+    expect(await (await routes.runtime.request("/status")).json()).toEqual({
+      state: "error",
+      error: { message: "safe", recoveryAllowed: true },
+    });
+    expect(await (await routes.runtime.request("/retry", { method: "POST" })).json())
+      .toEqual({ state: "ready" });
+    expect(coordinator.retryRuntime).toHaveBeenCalledTimes(1);
+  });
+
+  test("inspects and deletes only with the strict projectSlugs request", async () => {
+    const coordinator = createCoordinator();
+    const routes = createRuntimeControlRoutes(coordinator);
+    routes.runtimeData.onError(errorHandler);
+
+    expect(await (await routes.runtimeData.request("/")).json()).toEqual({ projects: [] });
+    const response = await routes.runtimeData.request("/", {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ projectSlugs: ["alpha"] }),
+    });
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      results: [{ projectSlug: "alpha", status: "deleted" }],
+      runtime: { state: "ready" },
+    });
+    expect(coordinator.deleteRuntimeData).toHaveBeenCalledWith(["alpha"]);
+
+    for (const body of [
+      { projectSlugs: ["alpha"], path: "/tmp/runtime" },
+      { path: "/tmp/runtime" },
+      { projectSlugs: "alpha" },
+      { projectSlugs: [""] },
+    ]) {
+      const rejected = await routes.runtimeData.request("/", {
+        method: "DELETE",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+      });
+      expect(rejected.status).toBe(400);
+    }
+  });
+
+  test("maps Runtime data preflight errors without exposing filesystem causes", async () => {
+    const coordinator = createCoordinator();
+    coordinator.deleteRuntimeData = mock(async () => {
+      throw new RuntimeDataRequestError(
+        "DELETE_TARGET_UNSAFE",
+        "The project Runtime tree is not safe to delete.",
+        "alpha",
+      );
+    });
+    const routes = createRuntimeControlRoutes(coordinator);
+    routes.runtimeData.onError(errorHandler);
+
+    const response = await routes.runtimeData.request("/", {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ projectSlugs: ["alpha"] }),
+    });
+    expect(response.status).toBe(409);
+    expect(await response.json()).toEqual({
+      error: {
+        code: "DELETE_TARGET_UNSAFE",
+        message: "The project Runtime tree is not safe to delete.",
+        details: { projectSlug: "alpha" },
+      },
+    });
+  });
+
+  test("preserves empty and duplicate slug validation errors from the service", async () => {
+    const coordinator = createCoordinator();
+    coordinator.deleteRuntimeData = mock(async (projectSlugs: readonly string[]) => {
+      if (projectSlugs.length === 0) {
+        throw new RuntimeDataRequestError(
+          "EMPTY_PROJECT_SLUGS",
+          "At least one project slug is required.",
+        );
+      }
+      throw new RuntimeDataRequestError(
+        "DUPLICATE_PROJECT_SLUG",
+        "Project slugs must not contain duplicates.",
+      );
+    });
+    const routes = createRuntimeControlRoutes(coordinator);
+    routes.runtimeData.onError(errorHandler);
+
+    for (const projectSlugs of [[], ["alpha", "alpha"]]) {
+      const response = await routes.runtimeData.request("/", {
+        method: "DELETE",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectSlugs }),
+      });
+      expect(response.status).toBe(400);
+      expect((await response.json()).error.code).toBe(
+        projectSlugs.length === 0 ? "EMPTY_PROJECT_SLUGS" : "DUPLICATE_PROJECT_SLUG",
+      );
+    }
+  });
+});
diff --git a/apps/server/src/routes/runtime-control.ts b/apps/server/src/routes/runtime-control.ts
new file mode 100644
index 00000000..0df72c42
--- /dev/null
+++ b/apps/server/src/routes/runtime-control.ts
@@ -0,0 +1,82 @@
+import { Hono } from "hono";
+import { RuntimeDataRequestError } from "@archcode/agent-core";
+import type {
+  RuntimeDataDeleteResponse,
+  RuntimeDataInspectionResponse,
+  RuntimeStatus,
+} from "@archcode/protocol";
+
+import { BadRequestError, ServerError } from "../errors";
+import { readBoundedJsonBody } from "../request-body";
+
+const RUNTIME_DATA_DELETE_BODY_MAX_BYTES = 64 * 1024;
+
+export interface RuntimeControlCoordinatorPort {
+  getRuntimeStatus(): RuntimeStatus;
+  retryRuntime(): Promise<RuntimeStatus>;
+  inspectRuntimeData(): Promise<RuntimeDataInspectionResponse>;
+  deleteRuntimeData(projectSlugs: readonly string[]): Promise<RuntimeDataDeleteResponse>;
+}
+
+export function createRuntimeControlRoutes(
+  coordinator: RuntimeControlCoordinatorPort,
+): { runtime: Hono; runtimeData: Hono } {
+  const runtime = new Hono();
+  runtime.get("/status", (c) => c.json(coordinator.getRuntimeStatus()));
+  runtime.post("/retry", async (c) => c.json(await coordinator.retryRuntime()));
+
+  const runtimeData = new Hono();
+  runtimeData.get("/", async (c) => c.json(await coordinator.inspectRuntimeData()));
+  runtimeData.delete("/", async (c) => {
+    const body = parseDeleteRequest(await readBoundedJsonBody(c.req.raw, {
+      maxBytes: RUNTIME_DATA_DELETE_BODY_MAX_BYTES,
+      label: "Runtime data delete request",
+    }));
+    try {
+      return c.json(await coordinator.deleteRuntimeData(body.projectSlugs));
+    } catch (error) {
+      throw mapRuntimeDataRequestError(error);
+    }
+  });
+
+  return { runtime, runtimeData };
+}
+
+function parseDeleteRequest(value: unknown): { projectSlugs: string[] } {
+  if (!isRecord(value)) {
+    throw new BadRequestError("Runtime data delete request must be an object");
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 1 || keys[0] !== "projectSlugs") {
+    throw new BadRequestError(
+      "Runtime data delete request must contain only projectSlugs",
+    );
+  }
+  if (!Array.isArray(value.projectSlugs) || value.projectSlugs.some(
+    (projectSlug) => typeof projectSlug !== "string" || projectSlug.length === 0,
+  )) {
+    throw new BadRequestError("projectSlugs must be an array of non-empty strings");
+  }
+  return { projectSlugs: value.projectSlugs };
+}
+
+function mapRuntimeDataRequestError(error: unknown): Error {
+  if (!(error instanceof RuntimeDataRequestError)) {
+    return error instanceof Error ? error : new Error("Runtime data operation failed");
+  }
+  const status = error.code === "PROJECT_NOT_REGISTERED"
+    ? 404
+    : error.code === "PROJECT_HAS_NO_ISSUES" || error.code === "DELETE_TARGET_UNSAFE"
+      ? 409
+      : 400;
+  return new ServerError(
+    error.code,
+    error.message,
+    status,
+    error.projectSlug === undefined ? undefined : { projectSlug: error.projectSlug },
+  );
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
diff --git a/apps/server/src/server-host.test.ts b/apps/server/src/server-host.test.ts
index 041d0390..6ba8183f 100644
--- a/apps/server/src/server-host.test.ts
+++ b/apps/server/src/server-host.test.ts
@@ -1,10 +1,13 @@
 import { afterAll, describe, expect, mock, test } from "bun:test";
-import { mkdir, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { mkdtemp } from "node:fs/promises";
 import {
+  createRuntime,
   createInMemoryLogger,
+  ProjectRegistry,
+  RuntimeDataService,
   ServerConfigService,
   resolveServerConfigPath,
   silentLogger,
@@ -19,6 +22,7 @@ import {
 } from "./server-host";
 import { ServerRestartController } from "./restart-controller";
 import { UpdateService } from "./updater";
+import { startServer } from "./listen";
 
 const roots: string[] = [];
 
@@ -88,6 +92,7 @@ function fakeRuntime(configService: ServerConfigService): AgentRuntime {
 }
 
 function hostInfrastructure(home: string, logger: Logger = silentLogger) {
+  const projectRegistry = new ProjectRegistry({ homeDir: home, logger });
   return {
     restartController: new ServerRestartController(),
     updateService: new UpdateService({
@@ -98,6 +103,16 @@ function hostInfrastructure(home: string, logger: Logger = silentLogger) {
       homeDir: home,
       logger,
     }),
+    projectRegistry,
+    runtimeDataService: {
+      inspect: mock(async () => ({ projects: [] })),
+      delete: mock(async (projectSlugs: readonly string[]) => ({
+        results: projectSlugs.map((projectSlug) => ({
+          projectSlug,
+          status: "deleted" as const,
+        })),
+      })),
+    },
   };
 }
 
@@ -108,6 +123,7 @@ async function createSetupHost(overrides: {
   accessLog?: boolean;
   updateService?: ServerHostOptions["updateService"];
   restartController?: ServerRestartController;
+  runtimeDataService?: ServerHostOptions["runtimeDataService"];
 } = {}) {
   const home = await createHome();
   const configService = new ServerConfigService({ homeDir: home });
@@ -129,12 +145,56 @@ async function createSetupHost(overrides: {
     ...(overrides.restartController === undefined
       ? {}
       : { restartController: overrides.restartController }),
+    ...(overrides.runtimeDataService === undefined
+      ? {}
+      : { runtimeDataService: overrides.runtimeDataService }),
   });
-  const setupUrl = host.setupInstructions("http://localhost:4096")[0]!;
+  const setupUrl = host.terminalInstructions("http://localhost:4096")[0]!;
   const token = new URL(setupUrl.slice(setupUrl.indexOf("http"))).hash.slice("#token=".length);
   return { host, home, configService, runtime, createRuntime, token };
 }
 
+async function createConfigErrorHost(extraInvalid: Record<string, unknown> = {}) {
+  const home = await createHome();
+  await mkdir(join(home, ".archcode"), { recursive: true });
+  await writeFile(resolveServerConfigPath(home), JSON.stringify({
+    ...diskConfig(),
+    unsupportedLegacyConfig: "raw-secret-sentinel",
+    ...extraInvalid,
+  }), { mode: 0o600 });
+  const configService = new ServerConfigService({ homeDir: home });
+  const runtime = fakeRuntime(configService);
+  const createRuntime = mock(async () => runtime);
+  const host = await ArchCodeServerHost.create({
+    configService,
+    createRuntime,
+    logger: silentLogger,
+    dev: false,
+    version: "1.2.3",
+    ...hostInfrastructure(home),
+  });
+  const instruction = host.terminalInstructions("http://localhost:4096")[0]!;
+  const recoveryUrl = instruction.slice(instruction.indexOf("http"));
+  const token = new URL(recoveryUrl).hash.slice("#token=".length);
+  return { host, home, configService, runtime, createRuntime, token, recoveryUrl };
+}
+
+function configRecoveryRequest(
+  token: string,
+  method: "POST" = "POST",
+  body?: Record<string, unknown>,
+): RequestInit {
+  return {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Origin: "http://localhost",
+      ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+  };
+}
+
 function setupRequest(
   token: string,
   input: CompleteSetupRequest,
@@ -151,6 +211,70 @@ function setupRequest(
 }
 
 describe("ArchCodeServerHost", () => {
+  test("publishes the listener and control plane before a deferred Runtime settles", async () => {
+    const home = await createHome();
+    await mkdir(join(home, ".archcode"), { recursive: true });
+    await writeFile(
+      resolveServerConfigPath(home),
+      `${JSON.stringify(diskConfig())}\n`,
+      { mode: 0o600 },
+    );
+    const configService = new ServerConfigService({ homeDir: home });
+    let runtimeEntered!: () => void;
+    const entered = new Promise<void>((resolve) => { runtimeEntered = resolve; });
+    let releaseRuntime!: () => void;
+    const gate = new Promise<void>((resolve) => { releaseRuntime = resolve; });
+    const candidate = fakeRuntime(configService);
+    candidate.recoverSessionContinuations = mock(async () => {
+      throw new Error("deferred recovery failed");
+    });
+    const createRuntime = mock(async () => {
+      runtimeEntered();
+      await gate;
+      return candidate;
+    });
+    const indexPath = join(home, "index.html");
+    await writeFile(indexPath, "<!doctype html><title>ArchCode</title>");
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime,
+      logger: silentLogger,
+      embeddedWebAssets: new Map([["/index.html", indexPath]]),
+      ...hostInfrastructure(home),
+    });
+
+    expect(createRuntime).not.toHaveBeenCalled();
+    const listener = await startServer(host.app, { hostname: "127.0.0.1", port: 0 });
+    try {
+      host.startRuntimeActivation();
+      await entered;
+      expect(await (await fetch(`${listener.url}/api/bootstrap`)).json()).toEqual({
+        mode: "ready",
+        authRequired: false,
+        authenticated: true,
+        runtime: { state: "activating" },
+      });
+      expect((await fetch(`${listener.url}/api/health`)).status).toBe(200);
+      expect((await fetch(`${listener.url}/api/config`)).status).toBe(200);
+      expect((await fetch(`${listener.url}/api/update`)).status).toBe(200);
+      expect((await fetch(`${listener.url}/api/auth/status`)).status).toBe(200);
+      expect((await fetch(`${listener.url}/api/agents`)).status).toBe(503);
+      expect((await fetch(`${listener.url}/`)).status).toBe(200);
+      releaseRuntime();
+      await waitForRuntimeState(host, "error");
+      expect(await (await fetch(`${listener.url}/api/bootstrap`)).json()).toMatchObject({
+        mode: "ready",
+        runtime: { state: "error" },
+      });
+      expect((await fetch(`${listener.url}/api/health`)).status).toBe(200);
+      expect((await fetch(`${listener.url}/`)).status).toBe(200);
+      expect(candidate.shutdown).toHaveBeenCalledTimes(1);
+    } finally {
+      listener.server.stop(true);
+      await host.shutdown();
+    }
+  });
+
   test("applies structured access logging at the shared HTTP shell", async () => {
     const { logger, entries } = createInMemoryLogger();
     const { host } = await createSetupHost({ logger });
@@ -218,6 +342,7 @@ describe("ArchCodeServerHost", () => {
         mode: "ready",
         authRequired: false,
         authenticated: true,
+        runtime: { state: "ready" },
       },
     });
     expect(createRuntime).toHaveBeenCalledTimes(1);
@@ -287,6 +412,60 @@ describe("ArchCodeServerHost", () => {
     })).status).toBe(409);
   });
 
+  test("blocks restart only during activation and allows it after Runtime failure", async () => {
+    const home = await createHome();
+    await mkdir(join(home, ".archcode"), { recursive: true });
+    await writeFile(
+      resolveServerConfigPath(home),
+      `${JSON.stringify(diskConfig())}\n`,
+      { mode: 0o600 },
+    );
+    const configService = new ServerConfigService({ homeDir: home });
+    let entered!: () => void;
+    const runtimeEntered = new Promise<void>((resolve) => { entered = resolve; });
+    let release!: () => void;
+    const gate = new Promise<void>((resolve) => { release = resolve; });
+    const status: UpdateStatus = {
+      currentVersion: "1.2.3",
+      phase: "restart_pending",
+      managed: true,
+      restartSupported: true,
+      updateAvailable: false,
+      restartRequired: true,
+    };
+    const updateService = {
+      getStatus: mock(async () => status),
+      check: mock(async () => status),
+      install: mock(async () => status),
+      stop: mock(async () => undefined),
+      closeAdmissionIfIdle: mock(() => true),
+      reopenAdmission: mock(() => undefined),
+    };
+    const restartController = new ServerRestartController({ schedule: () => undefined });
+    restartController.bind(async () => undefined);
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime: async () => {
+        entered();
+        await gate;
+        throw new Error("activation failed");
+      },
+      logger: silentLogger,
+      ...hostInfrastructure(home),
+      updateService,
+      restartController,
+    });
+    host.startRuntimeActivation();
+    await runtimeEntered;
+
+    expect((await host.app.request("/api/update/restart", { method: "POST" })).status)
+      .toBe(409);
+    release();
+    await waitForRuntimeState(host, "error");
+    expect((await host.app.request("/api/update/restart", { method: "POST" })).status)
+      .toBe(202);
+  });
+
   test("rejects client-supplied authentication state without consuming Setup", async () => {
     const { host, token, configService } = await createSetupHost();
     const config = setupConfig() as CompleteSetupRequest["config"] & {
@@ -463,34 +642,213 @@ describe("ArchCodeServerHost", () => {
     }));
     releaseRuntime();
 
-    expect(second.status).toBe(409);
+    expect(second.status).toBe(404);
     expect((await first).status).toBe(200);
   });
 
-  test("shows config_error for an existing invalid Config and never opens Setup", async () => {
-    const home = await createHome();
-    await mkdir(join(home, ".archcode"), { recursive: true });
-    await writeFile(resolveServerConfigPath(home), "{invalid", { mode: 0o600 });
-    const configService = new ServerConfigService({ homeDir: home });
-    const createRuntime = mock(async () => fakeRuntime(configService));
-
-    const host = await ArchCodeServerHost.create({
-      configService,
-      createRuntime,
-      logger: silentLogger,
-      ...hostInfrastructure(home),
-    });
+  test("exposes token-protected, redacted Config Recovery without opening Setup", async () => {
+    const { host, createRuntime, token, recoveryUrl } = await createConfigErrorHost();
     const bootstrap = await host.app.request("/api/bootstrap");
 
     expect(await bootstrap.json()).toEqual({
       mode: "config_error",
-      message: "The global configuration is invalid. Repair it and restart ArchCode.",
+      message: "The global configuration is invalid. Open Config Recovery from the server terminal.",
     });
+    expect(recoveryUrl).toMatch(/^http:\/\/localhost:4096\/config-recovery#token=/);
     expect((await host.app.request("/api/setup/provider-adapters")).status).toBe(404);
+    expect((await host.app.request("/api/config-recovery")).status).toBe(401);
+    const recovery = await host.app.request("/api/config-recovery", {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(recovery.status).toBe(200);
+    const recoveryText = await recovery.text();
+    expect(recoveryText).not.toContain("raw-secret-sentinel");
+    expect(recoveryText).not.toContain("unsupportedLegacyConfig");
+    expect(JSON.parse(recoveryText)).toMatchObject({
+      configPath: expect.stringContaining("/.archcode/config.json"),
+      revision: expect.any(String),
+      removableItems: [{
+        id: expect.any(String),
+        label: "Invalid configuration field",
+        path: "configuration",
+      }],
+      issues: [{
+        path: "configuration",
+        message: "This value does not match the current ArchCode configuration format.",
+      }],
+    });
+    expect((await host.app.request("/api/update")).status).toBe(401);
+    expect((await host.app.request("/api/update", {
+      headers: { Authorization: `Bearer ${token}` },
+    })).status).toBe(200);
     expect(createRuntime).not.toHaveBeenCalled();
   });
 
-  test("cleans a partially started Runtime and exposes startup_error", async () => {
+  test("removes a selected invalid Config item while preserving valid settings", async () => {
+    const { host, configService, createRuntime, token } = await createConfigErrorHost();
+    const status = await (await host.app.request("/api/config-recovery", {
+      headers: { Authorization: `Bearer ${token}` },
+    })).json() as { revision: string; removableItems: Array<{ id: string }> };
+    const removalBody = {
+      expectedRevision: status.revision,
+      itemIds: [status.removableItems[0]!.id],
+      confirmation: "REMOVE_SELECTED_INVALID_CONFIG_ITEMS",
+    };
+    expect((await host.app.request("/api/config-recovery/remove-items", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Origin: "http://localhost" },
+      body: JSON.stringify(removalBody),
+    })).status).toBe(401);
+    expect((await host.app.request("/api/config-recovery/remove-items", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        Origin: "https://attacker.example",
+      },
+      body: JSON.stringify(removalBody),
+    })).status).toBe(403);
+
+    expect((await host.app.request("/api/config-recovery/remove-items", configRecoveryRequest(
+      token,
+      "POST",
+      {
+        expectedRevision: status.revision,
+        itemIds: [status.removableItems[0]!.id],
+        confirmation: true,
+      },
+    ))).status).toBe(400);
+    const beforeUnknown = await readFile(configService.configPath, "utf8");
+    expect((await host.app.request("/api/config-recovery/remove-items", configRecoveryRequest(
+      token,
+      "POST",
+      { ...removalBody, itemIds: ["abcdefghijklmnopqrstuv"] },
+    ))).status).toBe(409);
+    expect(await readFile(configService.configPath, "utf8")).toBe(beforeUnknown);
+
+    const removed = await host.app.request("/api/config-recovery/remove-items", configRecoveryRequest(
+      token,
+      "POST",
+      removalBody,
+    ));
+    expect(removed.status).toBe(200);
+    expect(await removed.json()).toMatchObject({
+      status: { mode: "ready", runtime: { state: "activating" } },
+    });
+    const saved = JSON.parse(await readFile(configService.configPath, "utf8"));
+    expect(saved.unsupportedLegacyConfig).toBeUndefined();
+    expect(saved.provider.local.options.apiKey).toBe("provider-secret");
+    expect(saved.profiles).toEqual(diskConfig().profiles);
+    await waitForRuntimeState(host, "ready");
+    expect(createRuntime).toHaveBeenCalledTimes(1);
+  });
+
+  test("rejects a partial invalid-item removal with zero Config mutation", async () => {
+    const { host, configService, token } = await createConfigErrorHost({
+      anotherLegacyConfig: "second-invalid-value",
+    });
+    const status = await (await host.app.request("/api/config-recovery", {
+      headers: { Authorization: `Bearer ${token}` },
+    })).json() as { revision: string; removableItems: Array<{ id: string }> };
+    const before = await readFile(configService.configPath, "utf8");
+
+    const response = await host.app.request("/api/config-recovery/remove-items", configRecoveryRequest(
+      token,
+      "POST",
+      {
+        expectedRevision: status.revision,
+        itemIds: [status.removableItems[0]!.id],
+        confirmation: "REMOVE_SELECTED_INVALID_CONFIG_ITEMS",
+      },
+    ));
+
+    expect(response.status).toBe(422);
+    expect(await response.json()).toMatchObject({
+      error: {
+        code: "CONFIG_VALIDATION_ERROR",
+        message: "The selected removals would not leave a valid configuration. Nothing was changed.",
+      },
+    });
+    expect(await readFile(configService.configPath, "utf8")).toBe(before);
+  });
+
+  test("retries a repaired Config in the same process and activates Runtime", async () => {
+    const { host, configService, createRuntime, token } = await createConfigErrorHost();
+    const stillInvalid = await host.app.request(
+      "/api/config-recovery/retry",
+      configRecoveryRequest(token),
+    );
+    expect(stillInvalid.status).toBe(200);
+    expect(await stillInvalid.json()).toMatchObject({
+      status: { mode: "config_error" },
+      recovery: { issues: [{ path: "configuration" }] },
+    });
+
+    await writeFile(configService.configPath, `${JSON.stringify(diskConfig())}\n`, { mode: 0o600 });
+    const repaired = await host.app.request(
+      "/api/config-recovery/retry",
+      configRecoveryRequest(token),
+    );
+    expect(repaired.status).toBe(200);
+    expect(await repaired.json()).toMatchObject({
+      status: {
+        mode: "ready",
+        authenticated: true,
+        runtime: { state: "activating" },
+      },
+    });
+    await waitForRuntimeState(host, "ready");
+    expect(createRuntime).toHaveBeenCalledTimes(1);
+    expect((await host.app.request("/api/config-recovery", {
+      headers: { Authorization: `Bearer ${token}` },
+    })).status).toBe(404);
+  });
+
+  test("resets only the invalid Config and carries the same terminal grant into Setup", async () => {
+    const { host, configService, createRuntime, token } = await createConfigErrorHost();
+    expect((await host.app.request("/api/config-recovery/reset", configRecoveryRequest(
+      token,
+      "POST",
+      { confirmation: true },
+    ))).status).toBe(400);
+    expect((await configService.activateForStartup()).status).toBe("config_error");
+
+    const reset = await host.app.request("/api/config-recovery/reset", configRecoveryRequest(
+      token,
+      "POST",
+      { confirmation: "DELETE_INVALID_CONFIG" },
+    ));
+    expect(reset.status).toBe(200);
+    expect(await reset.json()).toEqual({ status: { mode: "setup" } });
+    expect(await configService.activateForStartup()).toEqual({ status: "setup" });
+    expect((await host.app.request("/api/setup/provider-adapters", {
+      headers: { Authorization: `Bearer ${token}` },
+    })).status).toBe(200);
+    expect(createRuntime).not.toHaveBeenCalled();
+  });
+
+  test("fails closed on cross-origin recovery and never deletes a Config repaired concurrently", async () => {
+    const { host, configService, token } = await createConfigErrorHost();
+    expect((await host.app.request("/api/config-recovery/retry", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Origin: "https://attacker.example",
+      },
+    })).status).toBe(403);
+
+    await writeFile(configService.configPath, `${JSON.stringify(diskConfig())}\n`, { mode: 0o600 });
+    const before = await readFile(configService.configPath, "utf8");
+    const reset = await host.app.request("/api/config-recovery/reset", configRecoveryRequest(
+      token,
+      "POST",
+      { confirmation: "DELETE_INVALID_CONFIG" },
+    ));
+    expect(reset.status).toBe(409);
+    expect(await readFile(configService.configPath, "utf8")).toBe(before);
+  });
+
+  test("publishes a ready control plane and cleans a failed Runtime candidate", async () => {
     const home = await createHome();
     await mkdir(join(home, ".archcode"), { recursive: true });
     await writeFile(
@@ -512,10 +870,884 @@ describe("ArchCodeServerHost", () => {
     });
 
     expect(await (await host.app.request("/api/bootstrap")).json()).toEqual({
-      mode: "startup_error",
-      message: "The saved configuration is valid, but ArchCode could not start. Check the server log and restart.",
+      mode: "ready",
+      authRequired: false,
+      authenticated: true,
+      runtime: { state: "activating" },
+    });
+    expect((await host.app.request("/api/health")).status).toBe(200);
+    host.startRuntimeActivation();
+    await waitForRuntimeState(host, "error");
+
+    expect(await (await host.app.request("/api/bootstrap")).json()).toEqual({
+      mode: "ready",
+      authRequired: false,
+      authenticated: true,
+      runtime: {
+        state: "error",
+        error: {
+          message: "ArchCode Runtime could not start. Check Runtime Data or the server log, then retry.",
+          recoveryAllowed: true,
+        },
+      },
     });
     expect(runtime.shutdown).toHaveBeenCalledTimes(1);
-    expect((await host.app.request("/api/agents")).status).toBe(503);
+    for (const path of [
+      "/api/projects",
+      "/api/projects/test-project/sessions",
+      "/api/projects/test-project/todos",
+      "/api/projects/test-project/automations",
+      "/api/projects/test-project/hitl",
+      "/api/mcp/status",
+      "/api/events",
+    ]) {
+      expect((await host.app.request(path)).status).toBe(503);
+    }
   });
+
+  test("fails closed when a failed Runtime candidate cannot be fully shut down", async () => {
+    const home = await createHome();
+    await mkdir(join(home, ".archcode"), { recursive: true });
+    await writeFile(
+      resolveServerConfigPath(home),
+      `${JSON.stringify(diskConfig())}\n`,
+      { mode: 0o600 },
+    );
+    const { logger, entries } = createInMemoryLogger();
+    const configService = new ServerConfigService({ homeDir: home });
+    const runtime = fakeRuntime(configService);
+    runtime.recoverSessionContinuations = mock(async () => {
+      throw new Error("candidate recovery failed", {
+        cause: new Error("invalid session cause"),
+      });
+    });
+    let shutdownAttempts = 0;
+    runtime.shutdown = mock(async () => {
+      shutdownAttempts += 1;
+      if (shutdownAttempts === 1) {
+        throw new Error("candidate cleanup exploded", {
+          cause: new Error("cleanup transport cause"),
+        });
+      }
+    });
+    const createRuntime = mock(async () => runtime);
+    const runtimeDataService = {
+      inspect: mock(async () => ({ projects: [] })),
+      delete: mock(async () => ({ results: [] })),
+    };
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime,
+      logger,
+      ...hostInfrastructure(home, logger),
+      runtimeDataService,
+    });
+    host.startRuntimeActivation();
+    await waitForRuntimeState(host, "error");
+
+    expect(host.getRuntimeStatus()).toEqual({
+      state: "error",
+      error: {
+        message: "Runtime cleanup did not complete. Restart ArchCode before retrying or deleting Runtime data.",
+        recoveryAllowed: false,
+      },
+    });
+    expect(runtime.shutdown).toHaveBeenCalledTimes(1);
+    expect(createRuntime).toHaveBeenCalledTimes(1);
+    for (const request of [
+      host.app.request("/api/runtime/retry", { method: "POST" }),
+      host.app.request("/api/runtime-data", {
+        method: "DELETE",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectSlugs: ["alpha"] }),
+      }),
+    ]) {
+      const response = await request;
+      expect(response.status).toBe(409);
+      expect(await response.json()).toMatchObject({
+        error: { code: "RUNTIME_CLEANUP_INCOMPLETE" },
+      });
+    }
+    expect(createRuntime).toHaveBeenCalledTimes(1);
+    expect(runtimeDataService.delete).not.toHaveBeenCalled();
+    for (const path of [
+      "/api/health",
+      "/api/auth/status",
+      "/api/config",
+      "/api/update",
+      "/api/runtime-data",
+    ]) {
+      expect((await host.app.request(path)).status).toBe(200);
+    }
+    expect(entries.find((entry) => entry.event === "server.runtime.start_failed")?.error)
+      .toMatchObject({
+        name: "Error",
+        message: "candidate recovery failed",
+        stack: expect.any(String),
+      });
+    expect(entries.find((entry) => entry.event === "server.runtime.start_failed")?.meta)
+      .toMatchObject({
+        cause: {
+          name: "Error",
+          message: "invalid session cause",
+          stack: expect.any(String),
+        },
+      });
+    expect(entries.find((entry) => entry.event === "server.runtime.cleanup_failed")?.error)
+      .toMatchObject({
+        name: "Error",
+        message: "candidate cleanup exploded",
+        stack: expect.any(String),
+      });
+    expect(entries.find((entry) => entry.event === "server.runtime.cleanup_failed")?.meta)
+      .toMatchObject({
+        activationError: {
+          name: "Error",
+          message: "candidate recovery failed",
+          stack: expect.any(String),
+        },
+        cause: {
+          name: "Error",
+          message: "cleanup transport cause",
+          stack: expect.any(String),
+        },
+      });
+    await host.shutdown();
+    expect(runtime.shutdown).toHaveBeenCalledTimes(2);
+  });
+
+  test("retries only failed production Runtime cleanup during Host shutdown", async () => {
+    const home = await createHome();
+    await mkdir(join(home, ".archcode"), { recursive: true });
+    await writeFile(
+      resolveServerConfigPath(home),
+      `${JSON.stringify(diskConfig())}\n`,
+      { mode: 0o600 },
+    );
+    const workspaceRoot = join(home, "production-cleanup-project");
+    await mkdir(workspaceRoot, { recursive: true });
+    const projectRegistry = new ProjectRegistry({ homeDir: home, logger: silentLogger });
+    const project = await projectRegistry.add({
+      workspaceRoot,
+      name: "Production Cleanup Project",
+    });
+    const invalidSessionPath = join(
+      workspaceRoot,
+      ".archcode",
+      "runtime",
+      "sessions",
+      "broken",
+      "session.json",
+    );
+    await mkdir(
+      join(workspaceRoot, ".archcode", "runtime", "sessions", "broken"),
+      { recursive: true },
+    );
+    await writeFile(invalidSessionPath, JSON.stringify({ id: "not-a-current-session" }));
+
+    let executionShutdownAttempts = 0;
+    const executionManagerShutdown = mock(async () => {
+      executionShutdownAttempts += 1;
+      if (executionShutdownAttempts === 1) {
+        throw new Error("production execution cleanup failed once");
+      }
+    });
+    const sessionAgentManagerDisposeAll = mock(() => undefined);
+    const configService = new ServerConfigService({ homeDir: home });
+    const createRuntimeFactory = mock(async (options: AgentRuntimeOptions) => {
+      const internalOptions = {
+        ...options,
+        runtimeStorageHomeDir: home,
+        executionManagerShutdown,
+        sessionAgentManagerDisposeAll,
+      };
+      return await createRuntime(internalOptions);
+    });
+    const runtimeDataService = {
+      inspect: mock(async () => ({ projects: [] })),
+      delete: mock(async () => ({ results: [] })),
+    };
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime: createRuntimeFactory,
+      ...hostInfrastructure(home),
+      projectRegistry,
+      runtimeDataService,
+      logger: silentLogger,
+    });
+
+    host.startRuntimeActivation();
+    await waitForRuntimeState(host, "error");
+
+    expect(host.getRuntimeStatus()).toEqual({
+      state: "error",
+      error: {
+        message: "Runtime cleanup did not complete. Restart ArchCode before retrying or deleting Runtime data.",
+        recoveryAllowed: false,
+      },
+    });
+    expect(createRuntimeFactory).toHaveBeenCalledTimes(1);
+    expect(executionManagerShutdown).toHaveBeenCalledTimes(1);
+    expect(sessionAgentManagerDisposeAll).toHaveBeenCalledTimes(1);
+
+    for (const request of [
+      host.app.request("/api/runtime/retry", { method: "POST" }),
+      host.app.request("/api/runtime-data", {
+        method: "DELETE",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectSlugs: [project.slug] }),
+      }),
+    ]) {
+      const response = await request;
+      expect(response.status).toBe(409);
+      expect(await response.json()).toMatchObject({
+        error: { code: "RUNTIME_CLEANUP_INCOMPLETE" },
+      });
+    }
+    expect(createRuntimeFactory).toHaveBeenCalledTimes(1);
+    expect(runtimeDataService.delete).not.toHaveBeenCalled();
+
+    await expect(host.shutdown()).resolves.toBeUndefined();
+    expect(executionManagerShutdown).toHaveBeenCalledTimes(2);
+    expect(sessionAgentManagerDisposeAll).toHaveBeenCalledTimes(1);
+    expect(createRuntimeFactory).toHaveBeenCalledTimes(1);
+  });
+
+  test("keeps committed Setup, authentication and Settings APIs after Runtime failure", async () => {
+    const updateStatus: UpdateStatus = {
+      currentVersion: "1.2.3",
+      phase: "idle",
+      managed: false,
+      restartSupported: false,
+      updateAvailable: false,
+      restartRequired: false,
+    };
+    const updateService = {
+      getStatus: mock(async () => updateStatus),
+      check: mock(async () => updateStatus),
+      install: mock(async () => updateStatus),
+      stop: mock(async () => undefined),
+      closeAdmissionIfIdle: mock(() => true),
+      reopenAdmission: mock(() => undefined),
+    };
+    const runtimeDataService = {
+      inspect: mock(async () => ({ projects: [] })),
+      delete: mock(async () => ({ results: [] })),
+    };
+    const fixture = await createSetupHost({
+      createRuntime: async (options) => {
+        const runtime = fakeRuntime(options.configService);
+        runtime.startAutomationSchedulers = mock(async () => {
+          throw new Error("scheduler failed");
+        });
+        return runtime;
+      },
+      updateService,
+      runtimeDataService,
+    });
+
+    const response = await fixture.host.app.request("/api/setup", setupRequest(
+      fixture.token,
+      {
+        config: setupConfig(),
+        requireLogin: true,
+        password: "correct horse battery",
+      },
+    ));
+    expect(response.status).toBe(200);
+    expect(await response.json()).toMatchObject({
+      status: {
+        mode: "ready",
+        authRequired: true,
+        authenticated: true,
+        runtime: { state: "error" },
+      },
+    });
+    const committedConfig = await readFile(
+      resolveServerConfigPath(fixture.home),
+      "utf8",
+    );
+    const cookie = response.headers.get("set-cookie")!.split(";")[0]!;
+    expect((await fixture.host.app.request("/api/setup/provider-adapters", {
+      headers: { Authorization: `Bearer ${fixture.token}` },
+    })).status).toBe(404);
+    expect((await fixture.host.app.request("/api/config", {
+      headers: { Cookie: cookie },
+    })).status).toBe(200);
+    expect((await fixture.host.app.request("/api/update", {
+      headers: { Cookie: cookie },
+    })).status).toBe(200);
+    expect((await fixture.host.app.request("/api/update/check", {
+      method: "POST",
+      headers: { Cookie: cookie, Origin: "http://localhost" },
+    })).status).toBe(200);
+    expect((await fixture.host.app.request("/api/update/install", {
+      method: "POST",
+      headers: { Cookie: cookie, Origin: "http://localhost" },
+    })).status).toBe(200);
+    expect((await fixture.host.app.request("/api/config/provider-adapters", {
+      headers: { Cookie: cookie },
+    })).status).toBe(200);
+    expect((await fixture.host.app.request("/api/config", {
+      method: "PUT",
+      headers: {
+        Cookie: cookie,
+        Origin: "https://evil.example",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({}),
+    })).status).toBe(403);
+    expect((await fixture.host.app.request("/api/agents")).status).toBe(401);
+    expect((await fixture.host.app.request("/api/agents", {
+      headers: { Cookie: cookie },
+    })).status).toBe(503);
+    expect((await fixture.host.app.request("/api/runtime-data")).status).toBe(401);
+    expect((await fixture.host.app.request("/api/runtime/retry", {
+      method: "POST",
+    })).status).toBe(401);
+    expect((await fixture.host.app.request("/api/runtime-data", {
+      method: "DELETE",
+      headers: {
+        Cookie: cookie,
+        Origin: "https://evil.example",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({ projectSlugs: ["alpha"] }),
+    })).status).toBe(403);
+    expect(runtimeDataService.delete).not.toHaveBeenCalled();
+    expect(updateService.check).toHaveBeenCalledTimes(1);
+    expect(updateService.install).toHaveBeenCalledTimes(1);
+    expect(await readFile(resolveServerConfigPath(fixture.home), "utf8"))
+      .toBe(committedConfig);
+  });
+
+  test("retries with a fresh saved Config activation and atomically publishes Runtime", async () => {
+    const home = await createHome();
+    await mkdir(join(home, ".archcode"), { recursive: true });
+    await writeFile(
+      resolveServerConfigPath(home),
+      `${JSON.stringify(diskConfig())}\n`,
+      { mode: 0o600 },
+    );
+    const configService = new ServerConfigService({ homeDir: home });
+    const activations: AgentRuntimeOptions["activation"][] = [];
+    const createRuntime = mock(async (options: AgentRuntimeOptions) => {
+      activations.push(options.activation);
+      const runtime = fakeRuntime(configService);
+      if (activations.length === 1) {
+        runtime.recoverSessionContinuations = mock(async () => {
+          throw new Error("first activation failed");
+        });
+      }
+      return runtime;
+    });
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime,
+      logger: silentLogger,
+      ...hostInfrastructure(home),
+    });
+    host.startRuntimeActivation();
+    await waitForRuntimeState(host, "error");
+
+    const snapshot = await (await host.app.request("/api/config")).json() as any;
+    snapshot.config.provider.local.models["test-model"].name = "Changed model";
+    snapshot.config.provider.local.options.apiKey = { action: "preserve" };
+    const saved = await host.app.request("/api/config", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        expectedRevision: snapshot.revision,
+        config: snapshot.config,
+      }),
+    });
+    expect(saved.status).toBe(200);
+
+    const retried = await host.app.request("/api/runtime/retry", { method: "POST" });
+    expect(retried.status).toBe(200);
+    expect(await retried.json()).toEqual({ state: "ready" });
+    expect(createRuntime).toHaveBeenCalledTimes(2);
+    expect(activations[1]).not.toBe(activations[0]);
+    expect((activations[1] as any).runtimeConfig.provider.local.models["test-model"].name)
+      .toBe("Changed model");
+    expect((await host.app.request("/api/agents")).status).toBe(200);
+    expect((await host.app.request("/api/runtime/retry", { method: "POST" })).status)
+      .toBe(409);
+    expect((await host.app.request("/api/runtime-data", {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ projectSlugs: ["alpha"] }),
+    })).status).toBe(409);
+  });
+
+  test("serializes concurrent Config save before delete and retry recovery mutations", async () => {
+    for (const recovery of ["delete", "retry"] as const) {
+      const home = await createHome();
+      await mkdir(join(home, ".archcode"), { recursive: true });
+      await writeFile(
+        resolveServerConfigPath(home),
+        `${JSON.stringify(diskConfig())}\n`,
+        { mode: 0o600 },
+      );
+      const configService = new ServerConfigService({ homeDir: home });
+      const order: string[] = [];
+      let activationAttempts = 0;
+      const createRuntime = mock(async (options: AgentRuntimeOptions) => {
+        activationAttempts += 1;
+        const modelName = (options.activation as any).runtimeConfig
+          .provider.local.models["test-model"].name;
+        order.push(`activate:${modelName}`);
+        const runtime = fakeRuntime(configService);
+        if (activationAttempts === 1) {
+          runtime.recoverSessionContinuations = mock(async () => {
+            throw new Error("initial failure");
+          });
+        }
+        return runtime;
+      });
+      const runtimeDataService = {
+        delete: mock(async () => {
+          order.push("delete");
+          return {
+            results: [{ projectSlug: "alpha", status: "deleted" as const }],
+          };
+        }),
+        inspect: mock(async () => {
+          order.push("inspect");
+          return { projects: [] };
+        }),
+      };
+      const host = await ArchCodeServerHost.create({
+        configService,
+        createRuntime,
+        logger: silentLogger,
+        ...hostInfrastructure(home),
+        runtimeDataService,
+      });
+      host.startRuntimeActivation();
+      await waitForRuntimeState(host, "error");
+      order.length = 0;
+
+      const originalSave = configService.save.bind(configService);
+      let signalSaveEntered!: () => void;
+      const saveEntered = new Promise<void>((resolve) => { signalSaveEntered = resolve; });
+      let releaseSave!: () => void;
+      const saveGate = new Promise<void>((resolve) => { releaseSave = resolve; });
+      configService.save = mock(async (request) => {
+        order.push("save:start");
+        signalSaveEntered();
+        await saveGate;
+        const response = await originalSave(request);
+        order.push("save:end");
+        return response;
+      });
+      const snapshot = await (await host.app.request("/api/config")).json() as any;
+      const changedName = `Changed ${recovery}`;
+      snapshot.config.provider.local.models["test-model"].name = changedName;
+      snapshot.config.provider.local.options.apiKey = { action: "preserve" };
+      const saving = host.app.request("/api/config", {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          expectedRevision: snapshot.revision,
+          config: snapshot.config,
+        }),
+      });
+      await saveEntered;
+      const recovering = recovery === "retry"
+        ? host.app.request("/api/runtime/retry", { method: "POST" })
+        : host.app.request("/api/runtime-data", {
+          method: "DELETE",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ projectSlugs: ["alpha"] }),
+        });
+      await Bun.sleep(1);
+      expect(order).toEqual(["save:start"]);
+      if (recovery === "delete") {
+        expect((await host.app.request("/api/runtime/retry", { method: "POST" })).status)
+          .toBe(409);
+      }
+      releaseSave();
+      expect((await saving).status).toBe(200);
+      expect((await recovering).status).toBe(200);
+      expect(order).toEqual(recovery === "retry"
+        ? ["save:start", "save:end", `activate:${changedName}`]
+        : ["save:start", "save:end", "delete", "inspect", `activate:${changedName}`]);
+      expect(host.getRuntimeStatus()).toEqual({ state: "ready" });
+      await host.shutdown();
+    }
+  });
+
+  test("activates once after complete Runtime data deletion and never after partial failure", async () => {
+    for (const deletionSucceeded of [true, false]) {
+      const home = await createHome();
+      await mkdir(join(home, ".archcode"), { recursive: true });
+      await writeFile(
+        resolveServerConfigPath(home),
+        `${JSON.stringify(diskConfig())}\n`,
+        { mode: 0o600 },
+      );
+      const configService = new ServerConfigService({ homeDir: home });
+      let attempts = 0;
+      const order: string[] = [];
+      const createRuntime = mock(async () => {
+        attempts += 1;
+        order.push("activate");
+        const runtime = fakeRuntime(configService);
+        if (attempts === 1) {
+          runtime.recoverSessionContinuations = mock(async () => {
+            throw new Error("initial failure");
+          });
+        }
+        return runtime;
+      });
+      const runtimeDataService = {
+        inspect: mock(async () => {
+          order.push("inspect");
+          return { projects: [] };
+        }),
+        delete: mock(async () => {
+          order.push("delete");
+          return {
+            results: [{
+              projectSlug: "alpha",
+              ...(deletionSucceeded
+                ? { status: "deleted" as const }
+                : {
+                  status: "error" as const,
+                  error: { code: "delete_failed" as const, message: "failed" },
+                }),
+            }],
+          };
+        }),
+      };
+      const host = await ArchCodeServerHost.create({
+        configService,
+        createRuntime,
+        logger: silentLogger,
+        ...hostInfrastructure(home),
+        runtimeDataService,
+      });
+      host.startRuntimeActivation();
+      await waitForRuntimeState(host, "error");
+      order.length = 0;
+
+      const response = await host.app.request("/api/runtime-data", {
+        method: "DELETE",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectSlugs: ["alpha"] }),
+      });
+      expect(response.status).toBe(200);
+      expect(await response.json()).toMatchObject(deletionSucceeded
+        ? {
+          results: [{ projectSlug: "alpha", status: "deleted" }],
+          runtime: { state: "ready" },
+        }
+        : {
+          results: [{ projectSlug: "alpha", status: "error" }],
+          runtime: {
+            state: "error",
+            error: { recoveryAllowed: true },
+          },
+        });
+      expect(attempts).toBe(deletionSucceeded ? 2 : 1);
+      expect(host.getRuntimeStatus().state).toBe(deletionSucceeded ? "ready" : "error");
+      expect(order).toEqual(deletionSucceeded
+        ? ["delete", "inspect", "activate"]
+        : ["delete"]);
+    }
+  });
+
+  test("returns the final Runtime error when automatic post-delete activation fails", async () => {
+    const home = await createHome();
+    await mkdir(join(home, ".archcode"), { recursive: true });
+    await writeFile(
+      resolveServerConfigPath(home),
+      `${JSON.stringify(diskConfig())}\n`,
+      { mode: 0o600 },
+    );
+    const configService = new ServerConfigService({ homeDir: home });
+    let attempts = 0;
+    const createRuntime = mock(async () => {
+      attempts += 1;
+      const runtime = fakeRuntime(configService);
+      runtime.recoverSessionContinuations = mock(async () => {
+        throw new Error(`activation ${attempts} failed`);
+      });
+      return runtime;
+    });
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime,
+      logger: silentLogger,
+      ...hostInfrastructure(home),
+      runtimeDataService: {
+        delete: mock(async () => ({
+          results: [{ projectSlug: "alpha", status: "deleted" as const }],
+        })),
+        inspect: mock(async () => ({ projects: [] })),
+      },
+    });
+    host.startRuntimeActivation();
+    await waitForRuntimeState(host, "error");
+
+    const response = await host.app.request("/api/runtime-data", {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ projectSlugs: ["alpha"] }),
+    });
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      results: [{ projectSlug: "alpha", status: "deleted" }],
+      runtime: {
+        state: "error",
+        error: {
+          message: "ArchCode Runtime could not start. Check Runtime Data or the server log, then retry.",
+          recoveryAllowed: true,
+        },
+      },
+    });
+    expect(attempts).toBe(2);
+  });
+
+  test("recovers in process with the real Runtime data service while preserving healthy project data", async () => {
+    const home = await createHome();
+    await mkdir(join(home, ".archcode"), { recursive: true });
+    await writeFile(
+      resolveServerConfigPath(home),
+      `${JSON.stringify(diskConfig())}\n`,
+      { mode: 0o600 },
+    );
+    const badWorkspace = join(home, "bad-project");
+    const healthyWorkspace = join(home, "healthy-project");
+    await mkdir(badWorkspace, { recursive: true });
+    await mkdir(healthyWorkspace, { recursive: true });
+    const projectRegistry = new ProjectRegistry({ homeDir: home, logger: silentLogger });
+    const badProject = await projectRegistry.add({
+      workspaceRoot: badWorkspace,
+      name: "Bad Project",
+    });
+    const healthyProject = await projectRegistry.add({
+      workspaceRoot: healthyWorkspace,
+      name: "Healthy Project",
+    });
+    const badRuntime = join(badWorkspace, ".archcode", "runtime");
+    const badSession = join(badRuntime, "sessions", "broken", "session.json");
+    await mkdir(join(badRuntime, "sessions", "broken"), { recursive: true });
+    await writeFile(badSession, JSON.stringify({ id: "broken" }));
+    const healthySentinel = join(
+      healthyWorkspace,
+      ".archcode",
+      "runtime",
+      "attachments",
+      "sentinel.bin",
+    );
+    await mkdir(join(healthyWorkspace, ".archcode", "runtime", "attachments"), {
+      recursive: true,
+    });
+    const healthyBytes = "healthy-runtime-sentinel\n";
+    await writeFile(healthySentinel, healthyBytes);
+
+    const configService = new ServerConfigService({ homeDir: home });
+    const runtimeDataService = new RuntimeDataService({ projectRegistry });
+    let activationAttempts = 0;
+    let observedDeletedRuntime = false;
+    const createRuntime = mock(async (options: AgentRuntimeOptions) => {
+      expect(options.projectRegistry).toBe(projectRegistry);
+      activationAttempts += 1;
+      const badSessionExists = await readFile(badSession).then(
+        () => true,
+        () => false,
+      );
+      const runtime = fakeRuntime(configService);
+      if (badSessionExists) {
+        runtime.recoverSessionContinuations = mock(async () => {
+          throw new Error("invalid durable Session");
+        });
+      } else {
+        observedDeletedRuntime = true;
+        await mkdir(badRuntime, { recursive: true });
+      }
+      return runtime;
+    });
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime,
+      logger: silentLogger,
+      ...hostInfrastructure(home),
+      projectRegistry,
+      runtimeDataService,
+    });
+    host.startRuntimeActivation();
+    await waitForRuntimeState(host, "error");
+
+    const inspection = await (await host.app.request("/api/runtime-data")).json() as any;
+    expect(inspection.projects.find((project: any) => project.projectSlug === badProject.slug).issues)
+      .toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          relativePath: "sessions/broken/session.json",
+          reason: "invalid_current_schema",
+        }),
+      ]));
+    expect(inspection.projects.find((project: any) => project.projectSlug === healthyProject.slug).issues)
+      .toEqual([]);
+
+    const deletion = await host.app.request("/api/runtime-data", {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ projectSlugs: [badProject.slug] }),
+    });
+    expect(deletion.status).toBe(200);
+    expect(await deletion.json()).toEqual({
+      results: [{ projectSlug: badProject.slug, status: "deleted" }],
+      runtime: { state: "ready" },
+    });
+    expect(host.getRuntimeStatus()).toEqual({ state: "ready" });
+    expect(activationAttempts).toBe(2);
+    expect(observedDeletedRuntime).toBe(true);
+    expect((await projectRegistry.list()).map((project) => project.slug).sort())
+      .toEqual([badProject.slug, healthyProject.slug].sort());
+    expect(await readFile(badSession).then(() => true, () => false)).toBe(false);
+    expect((await stat(badRuntime)).isDirectory()).toBe(true);
+    expect(await readFile(healthySentinel, "utf8")).toBe(healthyBytes);
+    await host.shutdown();
+  });
+
+  test("recovers an authenticated production Runtime through the embedded control-plane shell", async () => {
+    const home = await createHome();
+    const badWorkspace = join(home, "production-bad-project");
+    const healthyWorkspace = join(home, "production-healthy-project");
+    await mkdir(badWorkspace, { recursive: true });
+    await mkdir(healthyWorkspace, { recursive: true });
+    const projectRegistry = new ProjectRegistry({ homeDir: home, logger: silentLogger });
+    const badProject = await projectRegistry.add({
+      workspaceRoot: badWorkspace,
+      name: "Production Bad Project",
+    });
+    const healthyProject = await projectRegistry.add({
+      workspaceRoot: healthyWorkspace,
+      name: "Production Healthy Project",
+    });
+    const badSession = join(
+      badWorkspace,
+      ".archcode",
+      "runtime",
+      "sessions",
+      "broken",
+      "session.json",
+    );
+    await mkdir(join(badWorkspace, ".archcode", "runtime", "sessions", "broken"), {
+      recursive: true,
+    });
+    await writeFile(badSession, JSON.stringify({ id: "not-a-current-session" }));
+    const healthySentinel = join(
+      healthyWorkspace,
+      ".archcode",
+      "runtime",
+      "attachments",
+      "sentinel.bin",
+    );
+    await mkdir(join(healthyWorkspace, ".archcode", "runtime", "attachments"), {
+      recursive: true,
+    });
+    const healthyBytes = "production-healthy-sentinel\n";
+    await writeFile(healthySentinel, healthyBytes);
+    const indexPath = join(home, "index.html");
+    await writeFile(indexPath, "<!doctype html><title>ArchCode recovery</title>");
+
+    const configService = new ServerConfigService({ homeDir: home });
+    const runtimeDataService = new RuntimeDataService({ projectRegistry });
+    const host = await ArchCodeServerHost.create({
+      configService,
+      createRuntime: async (options) => await createRuntime({
+        ...options,
+        runtimeStorageHomeDir: home,
+      }),
+      ...hostInfrastructure(home),
+      projectRegistry,
+      runtimeDataService,
+      logger: silentLogger,
+      embeddedWebAssets: new Map([["/index.html", indexPath]]),
+    });
+    const setupUrl = host.terminalInstructions("http://localhost:4096")[0]!;
+    const token = new URL(setupUrl.slice(setupUrl.indexOf("http"))).hash
+      .slice("#token=".length);
+
+    try {
+      const setup = await host.app.request("/api/setup", setupRequest(token, {
+        config: setupConfig(),
+        requireLogin: true,
+        password: "production recovery password",
+      }));
+      expect(setup.status).toBe(200);
+      const cookie = setup.headers.get("set-cookie")!.split(";")[0]!;
+      expect(await setup.json()).toMatchObject({
+        status: {
+          mode: "ready",
+          authenticated: true,
+          runtime: {
+            state: "error",
+            error: { recoveryAllowed: true },
+          },
+        },
+      });
+      expect((await host.app.request("/")).status).toBe(200);
+      expect(await (await host.app.request("/api/bootstrap", {
+        headers: { Cookie: cookie },
+      })).json()).toMatchObject({
+        mode: "ready",
+        authenticated: true,
+        runtime: { state: "error" },
+      });
+      const inspection = await (await host.app.request("/api/runtime-data", {
+        headers: { Cookie: cookie },
+      })).json() as any;
+      expect(inspection.projects.find((project: any) => project.projectSlug === badProject.slug).issues)
+        .toEqual(expect.arrayContaining([
+          expect.objectContaining({
+            relativePath: "sessions/broken/session.json",
+            reason: "invalid_current_schema",
+          }),
+        ]));
+
+      const deletion = await host.app.request("/api/runtime-data", {
+        method: "DELETE",
+        headers: {
+          Cookie: cookie,
+          Origin: "http://localhost",
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({ projectSlugs: [badProject.slug] }),
+      });
+      expect(deletion.status).toBe(200);
+      expect(await deletion.json()).toEqual({
+        results: [{ projectSlug: badProject.slug, status: "deleted" }],
+        runtime: { state: "ready" },
+      });
+      expect((await projectRegistry.list()).map((project) => project.slug).sort())
+        .toEqual([badProject.slug, healthyProject.slug].sort());
+      expect(await readFile(badSession).then(() => true, () => false)).toBe(false);
+      expect(await readFile(healthySentinel, "utf8")).toBe(healthyBytes);
+      const sessions = await host.app.request(
+        `/api/projects/${badProject.slug}/sessions`,
+        { headers: { Cookie: cookie } },
+      );
+      expect(sessions.status).toBe(200);
+      expect(await sessions.json()).toEqual({ sessions: [] });
+    } finally {
+      await host.shutdown();
+    }
+  });
+
 });
+
+async function waitForRuntimeState(
+  host: ArchCodeServerHost,
+  state: "activating" | "ready" | "error",
+): Promise<void> {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    if (host.getRuntimeStatus().state === state) return;
+    await Bun.sleep(1);
+  }
+  throw new Error(`Runtime did not reach ${state}`);
+}
diff --git a/apps/server/src/server-host.ts b/apps/server/src/server-host.ts
index c48bdd13..121845f0 100644
--- a/apps/server/src/server-host.ts
+++ b/apps/server/src/server-host.ts
@@ -1,15 +1,30 @@
 import { Hono, type MiddlewareHandler } from "hono";
 import { cors } from "hono/cors";
+import {
+  ConfigRecoveryConflictError,
+  ConfigRevisionConflictError,
+  InvalidConfigRemovalError,
+  normalizeError,
+} from "@archcode/agent-core";
 import type {
   AgentRuntime,
   AgentRuntimeOptions,
   Logger,
-  ServerConfigActivation,
+  ProjectRegistry,
+  RuntimeDataService,
   ServerConfigService,
 } from "@archcode/agent-core";
 import type {
   BootstrapStatus,
   CompleteSetupRequest,
+  ConfigRecoveryActionResponse,
+  ConfigRecoveryStatus,
+  RemoveInvalidConfigItemsRequest,
+  ResetInvalidConfigRequest,
+  RuntimeDataDeleteResult,
+  RuntimeDataDeleteResponse,
+  RuntimeDataInspectionResponse,
+  RuntimeStatus,
   SetupProviderAdapterCatalogResponse,
 } from "@archcode/protocol";
 import { createRuntimeApp } from "./app";
@@ -27,11 +42,17 @@ import {
   type CompleteSetupResult,
   type SetupCoordinatorPort,
 } from "./routes/setup";
+import {
+  createConfigRecoveryRoutes,
+  safeConfigRecoveryStatus,
+  type ConfigRecoveryActionResult,
+  type ConfigRecoveryCoordinatorPort,
+} from "./routes/config-recovery";
 import {
   ServerAuthService,
   type AuthConfigWriter,
 } from "./server-auth-service";
-import { SetupGrant } from "./setup-grant";
+import { TerminalGrant } from "./terminal-grant";
 import { ServerError, UnauthorizedError } from "./errors";
 import {
   createEmbeddedAssetHandler,
@@ -41,6 +62,11 @@ import { globalEventBus } from "./events/global-event-bus";
 import { createUpdateRoutes } from "./routes/update";
 import type { ServerRestartController } from "./restart-controller";
 import type { UpdateService } from "./updater";
+import { createConfigRoutes } from "./routes/config";
+import {
+  createRuntimeControlRoutes,
+  type RuntimeControlCoordinatorPort,
+} from "./routes/runtime-control";
 
 export type AgentRuntimeFactory = (
   options: AgentRuntimeOptions,
@@ -64,32 +90,54 @@ export interface ServerHostOptions {
     | "reopenAdmission"
   >;
   readonly restartController: ServerRestartController;
+  readonly projectRegistry: ProjectRegistry;
+  readonly runtimeDataService: Pick<RuntimeDataService, "inspect" | "delete">;
+}
+
+function requireRecoveryGrant(authorized: boolean): void {
+  if (!authorized) {
+    throw new UnauthorizedError("A valid Config Recovery Grant is required");
+  }
 }
 
 type HostState =
-  | { readonly mode: "setup"; readonly grant: SetupGrant }
-  | { readonly mode: "activating"; readonly grant: SetupGrant }
+  | { readonly mode: "setup"; readonly grant: TerminalGrant; submitting: boolean }
   | { readonly mode: "ready" }
-  | { readonly mode: "config_error"; readonly message: string }
-  | { readonly mode: "startup_error"; readonly message: string };
+  | {
+    readonly mode: "config_error";
+    readonly grant: TerminalGrant;
+    readonly recovery: ConfigRecoveryStatus;
+  };
+
+type ReadyBootstrapStatus = Extract<BootstrapStatus, { mode: "ready" }>;
 
 /**
  * Owns the single HTTP shell, bootstrap mode and optional Runtime lifecycle.
  * It is also the one narrow first-run use-case coordinator.
  */
-export class ArchCodeServerHost implements SetupCoordinatorPort {
+export class ArchCodeServerHost implements SetupCoordinatorPort, ConfigRecoveryCoordinatorPort, RuntimeControlCoordinatorPort {
   readonly app: Hono;
   readonly auth: ServerAuthService;
   private readonly options: ServerHostOptions;
   private state: HostState;
+  private runtimeStatus: RuntimeStatus | undefined;
   private runtime: AgentRuntime | undefined;
   private runtimeApp: Hono | undefined;
+  private uncleanRuntimeCandidate: AgentRuntime | undefined;
+  private mutationTail: Promise<void> = Promise.resolve();
+  private initialRuntimeActivationStarted = false;
+  private runtimeMutationPending = false;
   private mutationAdmissionOpen = true;
   private activeMutations = 0;
 
-  private constructor(options: ServerHostOptions, state: HostState) {
+  private constructor(
+    options: ServerHostOptions,
+    state: HostState,
+    runtimeStatus?: RuntimeStatus,
+  ) {
     this.options = options;
     this.state = state;
+    this.runtimeStatus = runtimeStatus;
     this.auth = new ServerAuthService({
       configWriter: options.configService as AuthConfigWriter,
     });
@@ -101,7 +149,8 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
     if (result.status === "setup") {
       return new ArchCodeServerHost(options, {
         mode: "setup",
-        grant: new SetupGrant(),
+        grant: new TerminalGrant(),
+        submitting: false,
       });
     }
     if (result.status === "config_error") {
@@ -111,17 +160,21 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
       });
       return new ArchCodeServerHost(options, {
         mode: "config_error",
-        message: "The global configuration is invalid. Repair it and restart ArchCode.",
+        grant: new TerminalGrant(),
+        recovery: safeConfigRecoveryStatus(
+          options.configService.configPath,
+          result.error.issues,
+          options.configService.invalidConfigRemovalPlan(result.error),
+        ),
       });
     }
 
-    const host = new ArchCodeServerHost(options, { mode: "ready" });
+    const host = new ArchCodeServerHost(
+      options,
+      { mode: "ready" },
+      { state: "activating" },
+    );
     host.auth.activateCredential(result.auth?.passwordHash);
-    try {
-      await host.activateRuntime(result.activation);
-    } catch (error) {
-      host.recordStartupFailure(error);
-    }
     return host;
   }
 
@@ -129,18 +182,85 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
     switch (this.state.mode) {
       case "setup":
         return { mode: "setup" };
-      case "activating":
-        return { mode: "activating" };
       case "config_error":
-        return { mode: "config_error", message: this.state.message };
-      case "startup_error":
-        return { mode: "startup_error", message: this.state.message };
+        return {
+          mode: "config_error",
+          message: "The global configuration is invalid. Open Config Recovery from the server terminal.",
+        };
       case "ready":
+        return this.readyBootstrapStatus(sessionToken);
+    }
+  }
+
+  /** Starts the initial Runtime attempt without delaying listener publication. */
+  startRuntimeActivation(): void {
+    if (this.state.mode !== "ready" || this.runtime !== undefined) return;
+    if (this.initialRuntimeActivationStarted) return;
+    if (this.runtimeMutationPending) return;
+    this.initialRuntimeActivationStarted = true;
+    this.runtimeMutationPending = true;
+    void this.runHostMutation(async () => {
+      try {
+        await this.activateRuntimeFromCurrentConfig();
+      } finally {
+        this.runtimeMutationPending = false;
+      }
+    }).catch(() => undefined);
+  }
+
+  getRuntimeStatus(): RuntimeStatus {
+    return this.requireRuntimeStatus();
+  }
+
+  async retryRuntime(): Promise<RuntimeStatus> {
+    this.assertRuntimeMutationAvailable();
+    this.runtimeMutationPending = true;
+    try {
+      await this.runHostMutation(async () => {
+        try {
+          await this.activateRuntimeFromCurrentConfig();
+        } catch {
+          // The current safe error status is the retry result.
+        }
+      });
+      return this.requireRuntimeStatus();
+    } finally {
+      this.runtimeMutationPending = false;
+    }
+  }
+
+  async inspectRuntimeData(): Promise<RuntimeDataInspectionResponse> {
+    return await this.options.runtimeDataService.inspect();
+  }
+
+  async deleteRuntimeData(
+    projectSlugs: readonly string[],
+  ): Promise<RuntimeDataDeleteResponse> {
+    this.assertRuntimeMutationAvailable();
+    this.runtimeMutationPending = true;
+    try {
+      return await this.runHostMutation(async () => {
+        const response: RuntimeDataDeleteResult = await this.options.runtimeDataService.delete(
+          projectSlugs,
+        );
+        if (
+          response.results.length > 0
+          && response.results.every((result) => result.status === "deleted")
+        ) {
+          await this.options.runtimeDataService.inspect();
+          try {
+            await this.activateRuntimeFromCurrentConfig();
+          } catch {
+            // Deletion succeeded. Bootstrap carries the resulting Runtime error.
+          }
+        }
         return {
-          mode: "ready",
-          authRequired: this.auth.authRequired,
-          authenticated: this.auth.authenticate(sessionToken),
+          ...response,
+          runtime: this.requireRuntimeStatus(),
         };
+      });
+    } finally {
+      this.runtimeMutationPending = false;
     }
   }
 
@@ -158,55 +278,225 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
   ): Promise<CompleteSetupResult> {
     const state = this.requireSetupState();
     requireSetupGrant(state.grant.authorize(authorization));
-    this.state = { mode: "activating", grant: state.grant };
+    if (state.submitting) {
+      throw new ServerError("SETUP_CONFLICT", "Setup is already activating", 409);
+    }
+    state.submitting = true;
 
     let committed = false;
     try {
-      const passwordHash = request.requireLogin
-        ? await this.auth.hashPassword(request.password)
-        : undefined;
-      const candidate = {
-        ...request.config,
-        ...(passwordHash === undefined ? {} : { auth: { passwordHash } }),
-      };
-      const initialized = await this.options.configService.initialize(candidate);
-      committed = true;
-      state.grant.consume();
-      this.auth.activateCredential(initialized.auth?.passwordHash);
-      await this.activateRuntime(initialized.activation);
-      this.state = { mode: "ready" };
-      const session = this.auth.authRequired ? this.auth.issueSession() : undefined;
+      let session: ReturnType<ServerAuthService["issueSession"]> | undefined;
+      await this.runHostMutation(async () => {
+        const passwordHash = request.requireLogin
+          ? await this.auth.hashPassword(request.password)
+          : undefined;
+        const candidate = {
+          ...request.config,
+          ...(passwordHash === undefined ? {} : { auth: { passwordHash } }),
+        };
+        const initialized = await this.options.configService.initialize(candidate);
+        committed = true;
+        state.grant.consume();
+        this.auth.activateCredential(initialized.auth?.passwordHash);
+        this.state = { mode: "ready" };
+        this.runtimeStatus = { state: "activating" };
+        session = this.auth.authRequired ? this.auth.issueSession() : undefined;
+        try {
+          await this.activateRuntimeFromCurrentConfig();
+        } catch {
+          // A committed Setup is successful even when Runtime startup fails.
+          // activateRuntimeFromCurrentConfig records the safe Runtime status.
+        }
+      });
       return {
         response: {
-          status: {
-            mode: "ready",
-            authRequired: this.auth.authRequired,
-            authenticated: true,
-          },
+          status: this.readyBootstrapStatus(session?.token),
         },
         ...(session === undefined ? {} : { session }),
       };
     } catch (error) {
       if (!committed) {
-        this.state = { mode: "setup", grant: state.grant };
+        state.submitting = false;
         throw error;
       }
-      this.recordStartupFailure(error);
-      throw new ServerError(
-        "SERVER_NOT_READY",
-        "Setup was saved, but ArchCode could not start. Restart after checking the server log.",
-        500,
-      );
+      throw error;
     }
   }
 
-  setupInstructions(baseUrl: string): readonly string[] {
-    if (this.state.mode !== "setup") return [];
+  getConfigRecoveryStatus(
+    authorization: string | undefined,
+  ): ConfigRecoveryStatus {
+    const state = this.requireConfigRecoveryState();
+    requireRecoveryGrant(state.grant.authorize(authorization));
+    return state.recovery;
+  }
+
+  async retryConfigRecovery(
+    authorization: string | undefined,
+  ): Promise<ConfigRecoveryActionResult> {
+    const initial = this.requireConfigRecoveryState();
+    requireRecoveryGrant(initial.grant.authorize(authorization));
+    let session: ReturnType<ServerAuthService["issueSession"]> | undefined;
+    let response!: ConfigRecoveryActionResponse;
+    let activateRuntime = false;
+
+    await this.runHostMutation(async () => {
+      const state = this.requireConfigRecoveryState();
+      requireRecoveryGrant(state.grant === initial.grant && state.grant.authorize(authorization));
+      const current = await this.options.configService.activateForStartup();
+      if (current.status === "config_error") {
+        const recovery = safeConfigRecoveryStatus(
+          this.options.configService.configPath,
+          current.error.issues,
+          this.options.configService.invalidConfigRemovalPlan(current.error),
+        );
+        this.state = { mode: "config_error", grant: state.grant, recovery };
+        response = {
+          status: this.bootstrapStatus(undefined),
+          recovery,
+        };
+        return;
+      }
+      if (current.status === "setup") {
+        this.state = { mode: "setup", grant: state.grant, submitting: false };
+        response = { status: { mode: "setup" } };
+        return;
+      }
+
+      state.grant.consume();
+      this.auth.activateCredential(current.auth?.passwordHash);
+      this.state = { mode: "ready" };
+      this.runtimeStatus = { state: "activating" };
+      session = this.auth.authRequired ? this.auth.issueSession() : undefined;
+      response = { status: this.readyBootstrapStatus(session?.token) };
+      activateRuntime = true;
+    });
+
+    if (activateRuntime) this.startRuntimeActivation();
+    return {
+      response,
+      ...(session === undefined ? {} : { session }),
+    };
+  }
+
+  async removeInvalidConfigItems(
+    authorization: string | undefined,
+    request: RemoveInvalidConfigItemsRequest,
+  ): Promise<ConfigRecoveryActionResult> {
+    const initial = this.requireConfigRecoveryState();
+    requireRecoveryGrant(initial.grant.authorize(authorization));
+    let session: ReturnType<ServerAuthService["issueSession"]> | undefined;
+    let response!: ConfigRecoveryActionResponse;
+    let activateRuntime = false;
+
+    await this.runHostMutation(async () => {
+      const state = this.requireConfigRecoveryState();
+      requireRecoveryGrant(state.grant === initial.grant && state.grant.authorize(authorization));
+      let current;
+      try {
+        current = await this.options.configService.removeInvalidConfigItems(
+          request.expectedRevision,
+          request.itemIds,
+        );
+      } catch (error) {
+        if (error instanceof ConfigRevisionConflictError) {
+          throw new ServerError(
+            "CONFIG_RECOVERY_CONFLICT",
+            "The configuration changed. Reload Config Recovery before removing anything.",
+            409,
+          );
+        }
+        if (error instanceof InvalidConfigRemovalError) {
+          throw new ServerError(
+            "CONFIG_VALIDATION_ERROR",
+            "The selected removals would not leave a valid configuration. Nothing was changed.",
+            422,
+          );
+        }
+        if (error instanceof ConfigRecoveryConflictError) {
+          throw new ServerError(
+            "CONFIG_RECOVERY_CONFLICT",
+            "The configuration is now valid. Retry configuration instead.",
+            409,
+          );
+        }
+        throw error;
+      }
+
+      if (current.status === "config_error") {
+        const recovery = safeConfigRecoveryStatus(
+          this.options.configService.configPath,
+          current.error.issues,
+          this.options.configService.invalidConfigRemovalPlan(current.error),
+        );
+        this.state = { mode: "config_error", grant: state.grant, recovery };
+        response = { status: this.bootstrapStatus(undefined), recovery };
+        return;
+      }
+      if (current.status === "setup") {
+        throw new ServerError(
+          "CONFIG_RECOVERY_CONFLICT",
+          "The configuration no longer exists. Reload Config Recovery.",
+          409,
+        );
+      }
+
+      state.grant.consume();
+      this.auth.activateCredential(current.auth?.passwordHash);
+      this.state = { mode: "ready" };
+      this.runtimeStatus = { state: "activating" };
+      session = this.auth.authRequired ? this.auth.issueSession() : undefined;
+      response = { status: this.readyBootstrapStatus(session?.token) };
+      activateRuntime = true;
+    });
+
+    if (activateRuntime) this.startRuntimeActivation();
+    return {
+      response,
+      ...(session === undefined ? {} : { session }),
+    };
+  }
+
+  async resetInvalidConfig(
+    authorization: string | undefined,
+    _request: ResetInvalidConfigRequest,
+  ): Promise<ConfigRecoveryActionResult> {
+    const initial = this.requireConfigRecoveryState();
+    requireRecoveryGrant(initial.grant.authorize(authorization));
+    return await this.runHostMutation(async () => {
+      const state = this.requireConfigRecoveryState();
+      requireRecoveryGrant(state.grant === initial.grant && state.grant.authorize(authorization));
+      try {
+        await this.options.configService.discardInvalidConfig();
+      } catch (error) {
+        if (error instanceof ConfigRecoveryConflictError) {
+          throw new ServerError(
+            "CONFIG_RECOVERY_CONFLICT",
+            "The configuration is now valid and was not deleted. Retry configuration instead.",
+            409,
+          );
+        }
+        throw error;
+      }
+      this.state = { mode: "setup", grant: state.grant, submitting: false };
+      return { response: { status: { mode: "setup" } } };
+    });
+  }
+
+  terminalInstructions(baseUrl: string): readonly string[] {
+    if (this.state.mode === "ready") return [];
     const localBaseUrl = this.options.dev
       ? "http://localhost:5173"
       : baseUrl;
-    const url = this.state.grant.setupUrl(localBaseUrl);
+    const pathname = this.state.mode === "setup" ? "/setup" : "/config-recovery";
+    const url = this.state.grant.url(localBaseUrl, pathname);
     const fragment = new URL(url).hash;
+    if (this.state.mode === "config_error") {
+      return [
+        `Repair the invalid global configuration at ${url}`,
+        `For a remote HTTPS URL, open /config-recovery${fragment} on that host or use an SSH tunnel.`,
+      ];
+    }
     return [
       `Complete first-run setup at ${url}`,
       `For a remote HTTPS URL, open /setup${fragment} on that host or use an SSH tunnel.`,
@@ -216,13 +506,22 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
   async shutdown(reason: string = "server_shutdown"): Promise<void> {
     this.mutationAdmissionOpen = false;
     await this.options.updateService.stop();
+    await this.mutationTail;
     const runtime = this.runtime;
+    const uncleanRuntimeCandidate = this.uncleanRuntimeCandidate;
     this.runtime = undefined;
     this.runtimeApp = undefined;
-    if (runtime === undefined) return;
-    globalEventBus.emit({ type: "shutdown", reason });
-    runtime.notifyRuntimeShutdown(reason);
-    await runtime.shutdown();
+    this.uncleanRuntimeCandidate = undefined;
+    if (runtime !== undefined) {
+      globalEventBus.emit({ type: "shutdown", reason });
+      runtime.notifyRuntimeShutdown(reason);
+    }
+    const runtimes = runtime === undefined
+      ? uncleanRuntimeCandidate === undefined ? [] : [uncleanRuntimeCandidate]
+      : uncleanRuntimeCandidate === undefined || uncleanRuntimeCandidate === runtime
+        ? [runtime]
+        : [runtime, uncleanRuntimeCandidate];
+    await Promise.all(runtimes.map(async (ownedRuntime) => await ownedRuntime.shutdown()));
   }
 
   private createShell(): Hono {
@@ -258,9 +557,17 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
     app.use("/api/bootstrap", noStore);
     app.use("/api/setup", noStore);
     app.use("/api/setup/*", noStore);
+    app.use("/api/config-recovery", noStore);
+    app.use("/api/config-recovery/*", noStore);
     app.use("/api/auth/*", noStore);
+    app.use("/api/config", noStore);
+    app.use("/api/config/*", noStore);
     app.use("/api/update", noStore);
     app.use("/api/update/*", noStore);
+    app.use("/api/runtime", noStore);
+    app.use("/api/runtime/*", noStore);
+    app.use("/api/runtime-data", noStore);
+    app.use("/api/runtime-data/*", noStore);
 
     app.get("/api/health", (c) => c.json({
       ok: true,
@@ -272,6 +579,9 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
     app.route("/api/setup", createSetupRoutes(this, {
       dev: this.options.dev,
     }));
+    app.route("/api/config-recovery", createConfigRecoveryRoutes(this, {
+      dev: this.options.dev,
+    }));
     app.use("/api/auth/*", async (_c, next) => {
       if (this.state.mode !== "ready") {
         throw new ServerError(
@@ -286,11 +596,11 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
       dev: this.options.dev,
     }));
 
-    const updateAccess: MiddlewareHandler = async (c, next) => {
-      if (this.state.mode !== "ready" || this.runtime === undefined) {
+    const controlPlaneAccess: MiddlewareHandler = async (c, next) => {
+      if (this.state.mode !== "ready") {
         throw new ServerError(
           "SERVER_NOT_READY",
-          "ArchCode Runtime is not available",
+          "ArchCode control plane is not available",
           503,
         );
       }
@@ -305,6 +615,30 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
       }
       await next();
     };
+    app.use("/api/config", controlPlaneAccess);
+    app.use("/api/config/*", controlPlaneAccess);
+    app.route("/api/config", createConfigRoutes({
+      getSnapshot: () => this.options.configService.getSnapshot(),
+      getModelRuntimeCatalog: () => this.options.configService.getModelRuntimeCatalog(),
+      getProviderAdapterCatalog: () => this.options.configService.getProviderAdapterCatalog(),
+      save: (request) => this.runHostMutation(
+        () => this.options.configService.save(request),
+      ),
+    }));
+
+    const updateAccess: MiddlewareHandler = async (c, next) => {
+      if (this.state.mode === "config_error") {
+        requireRecoveryGrant(
+          this.state.grant.authorize(c.req.header("Authorization")),
+        );
+        if (!isSafeMethod(c.req.method)) {
+          assertMutationOrigin(c.req.raw, { dev: this.options.dev });
+        }
+        await next();
+        return;
+      }
+      await controlPlaneAccess(c, next);
+    };
     app.use("/api/update", updateAccess);
     app.use("/api/update/*", updateAccess);
     app.route("/api/update", createUpdateRoutes({
@@ -313,14 +647,15 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
       prepareForRestart: () => this.prepareForRestart(),
     }));
 
+    app.use("/api/runtime", controlPlaneAccess);
+    app.use("/api/runtime/*", controlPlaneAccess);
+    app.use("/api/runtime-data", controlPlaneAccess);
+    app.use("/api/runtime-data/*", controlPlaneAccess);
+    const runtimeControl = createRuntimeControlRoutes(this);
+    app.route("/api/runtime", runtimeControl.runtime);
+    app.route("/api/runtime-data", runtimeControl.runtimeData);
+
     app.all("/api/*", async (c) => {
-      if (this.state.mode !== "ready" || this.runtimeApp === undefined) {
-        throw new ServerError(
-          "SERVER_NOT_READY",
-          "ArchCode Runtime is not available",
-          503,
-        );
-      }
       if (
         this.auth.authRequired
         && !this.auth.authenticate(readSessionToken(c))
@@ -330,6 +665,13 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
       if (this.auth.authRequired && !isSafeMethod(c.req.method)) {
         assertMutationOrigin(c.req.raw, { dev: this.options.dev });
       }
+      if (this.state.mode !== "ready" || this.runtimeApp === undefined) {
+        throw new ServerError(
+          "SERVER_NOT_READY",
+          "ArchCode Runtime is not available",
+          503,
+        );
+      }
       return await this.runtimeApp.fetch(c.req.raw);
     });
 
@@ -340,9 +682,6 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
   }
 
   private requireSetupState(): Extract<HostState, { mode: "setup" }> {
-    if (this.state.mode === "activating") {
-      throw new ServerError("SETUP_CONFLICT", "Setup is already activating", 409);
-    }
     if (this.state.mode !== "setup") {
       throw new ServerError(
         "SERVER_NOT_READY",
@@ -353,6 +692,17 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
     return this.state;
   }
 
+  private requireConfigRecoveryState(): Extract<HostState, { mode: "config_error" }> {
+    if (this.state.mode !== "config_error") {
+      throw new ServerError(
+        "SERVER_NOT_READY",
+        "Config Recovery is not available",
+        404,
+      );
+    }
+    return this.state;
+  }
+
   private acquireMutationAdmission(): () => void {
     if (!this.mutationAdmissionOpen) {
       throw new ServerError(
@@ -384,14 +734,16 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
       return { ready: false, activeFamilyCount: 1 };
     }
 
+    if (this.runtimeMutationPending) {
+      this.options.updateService.reopenAdmission();
+      this.mutationAdmissionOpen = true;
+      return { ready: false, activeFamilyCount: 1 };
+    }
+
     try {
       const runtime = this.runtime;
       if (runtime === undefined) {
-        throw new ServerError(
-          "SERVER_NOT_READY",
-          "ArchCode Runtime is not available",
-          503,
-        );
+        return { ready: true };
       }
       const admission = runtime.prepareForRestart();
       if (!admission.ready) {
@@ -406,18 +758,36 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
     }
   }
 
-  private async activateRuntime(activation: ServerConfigActivation): Promise<void> {
+  private async activateRuntimeFromCurrentConfig(): Promise<void> {
+    this.runtimeStatus = { state: "activating" };
+    let current: Awaited<ReturnType<ServerConfigService["activateForStartup"]>>;
+    try {
+      current = await this.options.configService.activateForStartup();
+    } catch (error) {
+      this.recordRuntimeFailure(error);
+      throw error;
+    }
+    if (current.status !== "ready") {
+      const error = new Error(
+        current.status === "config_error"
+          ? "The current global configuration is invalid"
+          : "The current global configuration is missing",
+      );
+      this.recordRuntimeFailure(error);
+      throw error;
+    }
+
     let runtime: AgentRuntime | undefined;
     try {
       runtime = await this.options.createRuntime({
         configService: this.options.configService,
-        activation,
+        activation: current.activation,
+        projectRegistry: this.options.projectRegistry,
         logger: this.options.logger,
       });
       await runtime.recoverSessionContinuations();
       await runtime.startAutomationSchedulers();
-      this.runtime = runtime;
-      this.runtimeApp = createRuntimeApp(runtime, {
+      const runtimeApp = createRuntimeApp(runtime, {
         logger: this.options.logger.child({ module: "server.http" }),
         globalEventStreamLease: (request) => {
           if (!this.auth.authRequired) return undefined;
@@ -430,6 +800,9 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
           return lease;
         },
       }).app;
+      this.runtime = runtime;
+      this.runtimeApp = runtimeApp;
+      this.runtimeStatus = { state: "ready" };
     } catch (error) {
       if (runtime !== undefined) {
         try {
@@ -437,32 +810,122 @@ export class ArchCodeServerHost implements SetupCoordinatorPort {
         } catch (shutdownError) {
           this.options.logger.error("server.runtime.cleanup_failed", {
             message: "Runtime cleanup failed",
+            error: shutdownError,
             meta: {
               errorName: shutdownError instanceof Error
                 ? shutdownError.name
                 : "NonErrorThrow",
+              activationError: normalizeError(error, true),
+              ...(shutdownError instanceof Error && shutdownError.cause !== undefined
+                ? { cause: normalizeError(shutdownError.cause, true) }
+                : {}),
             },
           });
+          this.uncleanRuntimeCandidate = runtime;
+          this.recordRuntimeCleanupFailure(error);
+          throw error;
         }
       }
+      this.recordRuntimeFailure(error);
       throw error;
     }
   }
 
-  private recordStartupFailure(error: unknown): void {
+  private recordRuntimeFailure(error: unknown): void {
+    this.runtime = undefined;
+    this.runtimeApp = undefined;
+    this.logRuntimeStartFailure(error);
+    this.runtimeStatus = {
+      state: "error",
+      error: {
+        message: "ArchCode Runtime could not start. Check Runtime Data or the server log, then retry.",
+        recoveryAllowed: true,
+      },
+    };
+  }
+
+  private recordRuntimeCleanupFailure(activationError: unknown): void {
     this.runtime = undefined;
     this.runtimeApp = undefined;
+    this.logRuntimeStartFailure(activationError);
+    this.runtimeStatus = {
+      state: "error",
+      error: {
+        message: "Runtime cleanup did not complete. Restart ArchCode before retrying or deleting Runtime data.",
+        recoveryAllowed: false,
+      },
+    };
+  }
+
+  private logRuntimeStartFailure(error: unknown): void {
     this.options.logger.error("server.runtime.start_failed", {
       message: "Runtime startup failed",
+      error,
       meta: {
         errorName: error instanceof Error ? error.name : "NonErrorThrow",
+        ...(error instanceof Error && error.cause !== undefined
+          ? { cause: normalizeError(error.cause, true) }
+          : {}),
       },
     });
-    this.state = {
-      mode: "startup_error",
-      message: "The saved configuration is valid, but ArchCode could not start. Check the server log and restart.",
+  }
+
+  private requireRuntimeStatus(): RuntimeStatus {
+    if (this.runtimeStatus === undefined) {
+      throw new Error("Ready control plane requires a Runtime status");
+    }
+    return this.runtimeStatus;
+  }
+
+  private assertRuntimeMutationAvailable(): void {
+    if (this.state.mode !== "ready") {
+      throw new ServerError(
+        "SERVER_NOT_READY",
+        "ArchCode control plane is not available",
+        503,
+      );
+    }
+    const status = this.requireRuntimeStatus();
+    if (this.runtimeMutationPending || status.state === "activating") {
+      throw new ServerError(
+        "RUNTIME_BUSY",
+        "ArchCode Runtime activation is already in progress",
+        409,
+      );
+    }
+    if (status.state === "ready") {
+      throw new ServerError(
+        "RUNTIME_BUSY",
+        "ArchCode Runtime is already ready",
+        409,
+      );
+    }
+    if (!status.error.recoveryAllowed) {
+      throw new ServerError(
+        "RUNTIME_CLEANUP_INCOMPLETE",
+        "Restart ArchCode before retrying or deleting Runtime data",
+        409,
+      );
+    }
+  }
+
+  private readyBootstrapStatus(sessionToken: string | undefined): ReadyBootstrapStatus {
+    return {
+      mode: "ready",
+      authRequired: this.auth.authRequired,
+      authenticated: this.auth.authenticate(sessionToken),
+      runtime: this.requireRuntimeStatus(),
     };
   }
+
+  private runHostMutation<T>(operation: () => Promise<T>): Promise<T> {
+    const result = this.mutationTail.then(operation, operation);
+    this.mutationTail = result.then(
+      () => undefined,
+      () => undefined,
+    );
+    return result;
+  }
 }
 
 const noStore: MiddlewareHandler = async (c, next) => {
diff --git a/apps/server/src/setup-grant.test.ts b/apps/server/src/setup-grant.test.ts
index fcea688e..c21b307c 100644
--- a/apps/server/src/setup-grant.test.ts
+++ b/apps/server/src/setup-grant.test.ts
@@ -1,10 +1,10 @@
 import { describe, expect, test } from "bun:test";
-import { SetupGrant } from "./setup-grant";
+import { TerminalGrant } from "./terminal-grant";
 
-describe("SetupGrant", () => {
+describe("TerminalGrant", () => {
   test("authorizes only the random token embedded in the setup fragment", () => {
-    const grant = new SetupGrant();
-    const url = grant.setupUrl("http://localhost:4096");
+    const grant = new TerminalGrant();
+    const url = grant.url("http://localhost:4096", "/setup");
     const token = new URL(url).hash.slice("#token=".length);
 
     expect(token.length).toBeGreaterThanOrEqual(43);
@@ -14,8 +14,8 @@ describe("SetupGrant", () => {
   });
 
   test("cannot be reused after setup commits", () => {
-    const grant = new SetupGrant();
-    const token = new URL(grant.setupUrl("http://localhost:4096")).hash.slice("#token=".length);
+    const grant = new TerminalGrant();
+    const token = new URL(grant.url("http://localhost:4096", "/config-recovery")).hash.slice("#token=".length);
 
     grant.consume();
 
diff --git a/apps/server/src/setup-grant.ts b/apps/server/src/terminal-grant.ts
similarity index 63%
rename from apps/server/src/setup-grant.ts
rename to apps/server/src/terminal-grant.ts
index bd2db533..aef0c6cc 100644
--- a/apps/server/src/setup-grant.ts
+++ b/apps/server/src/terminal-grant.ts
@@ -1,17 +1,18 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 
-const SETUP_TOKEN_BYTES = 32;
+const TERMINAL_GRANT_BYTES = 32;
 
 /**
- * Process-local proof that the person completing first-run setup can read the
- * server terminal. It has no persistence or configuration responsibility.
+ * Process-local proof that a browser can read the server terminal. The same
+ * grant can carry Config Recovery into Setup, and is consumed after a valid
+ * Config becomes active.
  */
-export class SetupGrant {
-  private readonly token = randomBytes(SETUP_TOKEN_BYTES).toString("base64url");
+export class TerminalGrant {
+  private readonly token = randomBytes(TERMINAL_GRANT_BYTES).toString("base64url");
   private consumed = false;
 
-  setupUrl(baseUrl: string): string {
-    return `${baseUrl.replace(/\/$/, "")}/setup#token=${this.token}`;
+  url(baseUrl: string, pathname: "/setup" | "/config-recovery"): string {
+    return `${baseUrl.replace(/\/$/, "")}${pathname}#token=${this.token}`;
   }
 
   authorize(header: string | undefined): boolean {
diff --git a/apps/web/package.json b/apps/web/package.json
index 205e541e..fea541f5 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -9,7 +9,7 @@
     "typecheck": "tsc --noEmit",
     "preview": "vite preview",
     "test": "bun test --isolate && bun run test:interaction",
-    "test:interaction": "bun test --isolate ./src/routes/root-layout.interaction.tsx ./src/routes/project-todos.interaction.tsx ./src/context/workbench-layout.interaction.tsx ./src/components/primitives/IconAction.interaction.tsx ./src/components/primitives/StatusTransition.interaction.tsx ./src/components/features/ResizeHandle.interaction.tsx ./src/components/features/TodoProgressButton.interaction.tsx ./src/components/features/DiffTab.interaction.tsx ./src/components/features/ContextInspector.interaction.tsx ./src/components/features/InspectorToggleButton.interaction.tsx ./src/components/features/SettingsDialog.interaction.tsx ./src/components/features/EditAutomationDialog.interaction.tsx ./src/components/features/SessionComposerDock.interaction.tsx ./src/components/features/ComposerQueueList.interaction.tsx ./src/components/features/SessionGoalSummaryRow.interaction.tsx ./src/components/features/HitlBell.interaction.tsx ./src/components/features/AddProjectModal.interaction.tsx ./src/components/composite/ExecutionWorkstream.interaction.tsx ./src/components/composite/ToolCard.interaction.tsx"
+    "test:interaction": "bun test --isolate ./src/routes/root-layout.interaction.tsx ./src/routes/project-todos.interaction.tsx ./src/context/workbench-layout.interaction.tsx ./src/components/primitives/IconAction.interaction.tsx ./src/components/primitives/StatusTransition.interaction.tsx ./src/components/features/ResizeHandle.interaction.tsx ./src/components/features/TodoProgressButton.interaction.tsx ./src/components/features/DiffTab.interaction.tsx ./src/components/features/ContextInspector.interaction.tsx ./src/components/features/InspectorToggleButton.interaction.tsx ./src/components/features/SettingsDialog.interaction.tsx ./src/components/features/SettingsRuntimeDataPanel.interaction.tsx ./src/components/features/SettingsConfigRecoveryPanel.interaction.tsx ./src/components/features/EditAutomationDialog.interaction.tsx ./src/components/features/SessionComposerDock.interaction.tsx ./src/components/features/ComposerQueueList.interaction.tsx ./src/components/features/SessionGoalSummaryRow.interaction.tsx ./src/components/features/HitlBell.interaction.tsx ./src/components/features/AddProjectModal.interaction.tsx ./src/components/composite/ExecutionWorkstream.interaction.tsx ./src/components/composite/ToolCard.interaction.tsx"
   },
   "dependencies": {
     "@archcode/protocol": "workspace:*",
diff --git a/apps/web/src/api/config-recovery.test.ts b/apps/web/src/api/config-recovery.test.ts
new file mode 100644
index 00000000..061ec70b
--- /dev/null
+++ b/apps/web/src/api/config-recovery.test.ts
@@ -0,0 +1,55 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import {
+  getConfigRecoveryStatus,
+  removeInvalidConfigItems,
+  resetInvalidConfig,
+  retryConfigRecovery,
+} from "./config-recovery";
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("Config Recovery API", () => {
+  test("keeps the process-local grant in Authorization for every recovery action", async () => {
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      if (String(input) === "/api/config-recovery") return Response.json({
+        configPath: "/home/test/.archcode/config.json",
+        issues: [],
+        removableItems: [],
+      });
+      return Response.json({ status: { mode: "setup" } });
+    }) as unknown as typeof fetch;
+
+    await getConfigRecoveryStatus("grant-token");
+    await retryConfigRecovery("grant-token");
+    await removeInvalidConfigItems("grant-token", "revision-sentinel-1234", ["abcdefghijklmnopqrstuv"]);
+    await resetInvalidConfig("grant-token");
+
+    expect(fetch).toHaveBeenNthCalledWith(1, "/api/config-recovery", expect.objectContaining({
+      headers: expect.any(Headers),
+      credentials: "same-origin",
+    }));
+    for (const call of (fetch as unknown as ReturnType<typeof mock>).mock.calls) {
+      expect((call[1] as RequestInit).headers).toBeInstanceOf(Headers);
+      expect(((call[1] as RequestInit).headers as Headers).get("Authorization")).toBe("Bearer grant-token");
+    }
+    expect(fetch).toHaveBeenNthCalledWith(2, "/api/config-recovery/retry", expect.objectContaining({
+      method: "POST",
+    }));
+    expect(fetch).toHaveBeenNthCalledWith(3, "/api/config-recovery/remove-items", expect.objectContaining({
+      method: "POST",
+      body: JSON.stringify({
+        expectedRevision: "revision-sentinel-1234",
+        itemIds: ["abcdefghijklmnopqrstuv"],
+        confirmation: "REMOVE_SELECTED_INVALID_CONFIG_ITEMS",
+      }),
+    }));
+    expect(fetch).toHaveBeenNthCalledWith(4, "/api/config-recovery/reset", expect.objectContaining({
+      method: "POST",
+      body: JSON.stringify({ confirmation: "DELETE_INVALID_CONFIG" }),
+    }));
+  });
+});
diff --git a/apps/web/src/api/config-recovery.ts b/apps/web/src/api/config-recovery.ts
new file mode 100644
index 00000000..923a7107
--- /dev/null
+++ b/apps/web/src/api/config-recovery.ts
@@ -0,0 +1,54 @@
+import type {
+  ConfigRecoveryActionResponse,
+  ConfigRecoveryStatus,
+  RemoveInvalidConfigItemsRequest,
+  ResetInvalidConfigRequest,
+} from "@archcode/protocol";
+import { apiFetch } from "./client";
+
+function recoveryHeaders(grant: string): HeadersInit {
+  return { Authorization: `Bearer ${grant}` };
+}
+
+export function getConfigRecoveryStatus(grant: string): Promise<ConfigRecoveryStatus> {
+  return apiFetch<ConfigRecoveryStatus>("/api/config-recovery", {
+    headers: recoveryHeaders(grant),
+    authFailure: "ignore",
+  });
+}
+
+export function retryConfigRecovery(grant: string): Promise<ConfigRecoveryActionResponse> {
+  return apiFetch<ConfigRecoveryActionResponse>("/api/config-recovery/retry", {
+    method: "POST",
+    headers: recoveryHeaders(grant),
+    authFailure: "ignore",
+  });
+}
+
+export function resetInvalidConfig(grant: string): Promise<ConfigRecoveryActionResponse> {
+  const body: ResetInvalidConfigRequest = { confirmation: "DELETE_INVALID_CONFIG" };
+  return apiFetch<ConfigRecoveryActionResponse>("/api/config-recovery/reset", {
+    method: "POST",
+    headers: recoveryHeaders(grant),
+    body: body as unknown as Record<string, unknown>,
+    authFailure: "ignore",
+  });
+}
+
+export function removeInvalidConfigItems(
+  grant: string,
+  expectedRevision: string,
+  itemIds: readonly string[],
+): Promise<ConfigRecoveryActionResponse> {
+  const body: RemoveInvalidConfigItemsRequest = {
+    expectedRevision,
+    itemIds: [...itemIds],
+    confirmation: "REMOVE_SELECTED_INVALID_CONFIG_ITEMS",
+  };
+  return apiFetch<ConfigRecoveryActionResponse>("/api/config-recovery/remove-items", {
+    method: "POST",
+    headers: recoveryHeaders(grant),
+    body: body as unknown as Record<string, unknown>,
+    authFailure: "ignore",
+  });
+}
diff --git a/apps/web/src/api/runtime-data.test.ts b/apps/web/src/api/runtime-data.test.ts
new file mode 100644
index 00000000..35cc7a44
--- /dev/null
+++ b/apps/web/src/api/runtime-data.test.ts
@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import { deleteRuntimeData, inspectRuntimeData, retryRuntime } from "./runtime-data";
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("runtime data control-plane API", () => {
+  test("inspects Runtime data without a request body", async () => {
+    globalThis.fetch = mock(async () => Response.json({ projects: [] })) as unknown as typeof fetch;
+
+    await expect(inspectRuntimeData()).resolves.toEqual({ projects: [] });
+    expect(fetch).toHaveBeenCalledWith("/api/runtime-data", expect.objectContaining({
+      credentials: "same-origin",
+    }));
+  });
+
+  test("deletes only server-resolved project slugs", async () => {
+    globalThis.fetch = mock(async () => Response.json({
+      results: [{ projectSlug: "broken", status: "deleted" }],
+      runtime: { state: "ready" },
+    })) as unknown as typeof fetch;
+
+    await expect(deleteRuntimeData({ projectSlugs: ["broken"] })).resolves.toEqual({
+      results: [{ projectSlug: "broken", status: "deleted" }],
+      runtime: { state: "ready" },
+    });
+
+    expect(fetch).toHaveBeenCalledWith("/api/runtime-data", expect.objectContaining({
+      method: "DELETE",
+      body: JSON.stringify({ projectSlugs: ["broken"] }),
+      credentials: "same-origin",
+    }));
+  });
+
+  test("retries Runtime through the control plane", async () => {
+    globalThis.fetch = mock(async () => Response.json({})) as unknown as typeof fetch;
+
+    await retryRuntime();
+
+    expect(fetch).toHaveBeenCalledWith("/api/runtime/retry", expect.objectContaining({
+      method: "POST",
+      credentials: "same-origin",
+    }));
+  });
+});
diff --git a/apps/web/src/api/runtime-data.ts b/apps/web/src/api/runtime-data.ts
new file mode 100644
index 00000000..84d5598b
--- /dev/null
+++ b/apps/web/src/api/runtime-data.ts
@@ -0,0 +1,24 @@
+import type {
+  RuntimeDataDeleteRequest,
+  RuntimeDataDeleteResponse,
+  RuntimeDataInspectionResponse,
+  RuntimeStatus,
+} from "@archcode/protocol";
+import { apiFetch } from "./client";
+
+export function inspectRuntimeData(): Promise<RuntimeDataInspectionResponse> {
+  return apiFetch<RuntimeDataInspectionResponse>("/api/runtime-data");
+}
+
+export function deleteRuntimeData(
+  request: RuntimeDataDeleteRequest,
+): Promise<RuntimeDataDeleteResponse> {
+  return apiFetch<RuntimeDataDeleteResponse>("/api/runtime-data", {
+    method: "DELETE",
+    body: request as unknown as Record<string, unknown>,
+  });
+}
+
+export function retryRuntime(): Promise<RuntimeStatus> {
+  return apiFetch<RuntimeStatus>("/api/runtime/retry", { method: "POST" });
+}
diff --git a/apps/web/src/api/update.ts b/apps/web/src/api/update.ts
index 4b3e5f09..2394ec6f 100644
--- a/apps/web/src/api/update.ts
+++ b/apps/web/src/api/update.ts
@@ -1,18 +1,39 @@
 import type { UpdateStatus } from "@archcode/protocol";
 import { apiFetch } from "./client";
 
-export function getUpdateStatus(): Promise<UpdateStatus> {
-  return apiFetch<UpdateStatus>("/api/update");
+function updateHeaders(authorizationToken?: string): HeadersInit | undefined {
+  return authorizationToken === undefined
+    ? undefined
+    : { Authorization: `Bearer ${authorizationToken}` };
 }
 
-export function checkForUpdate(): Promise<UpdateStatus> {
-  return apiFetch<UpdateStatus>("/api/update/check", { method: "POST" });
+export function getUpdateStatus(authorizationToken?: string): Promise<UpdateStatus> {
+  return apiFetch<UpdateStatus>("/api/update", {
+    headers: updateHeaders(authorizationToken),
+    authFailure: authorizationToken === undefined ? "invalidate" : "ignore",
+  });
 }
 
-export function installUpdate(): Promise<UpdateStatus> {
-  return apiFetch<UpdateStatus>("/api/update/install", { method: "POST" });
+export function checkForUpdate(authorizationToken?: string): Promise<UpdateStatus> {
+  return apiFetch<UpdateStatus>("/api/update/check", {
+    method: "POST",
+    headers: updateHeaders(authorizationToken),
+    authFailure: authorizationToken === undefined ? "invalidate" : "ignore",
+  });
 }
 
-export function restartForUpdate(): Promise<UpdateStatus> {
-  return apiFetch<UpdateStatus>("/api/update/restart", { method: "POST" });
+export function installUpdate(authorizationToken?: string): Promise<UpdateStatus> {
+  return apiFetch<UpdateStatus>("/api/update/install", {
+    method: "POST",
+    headers: updateHeaders(authorizationToken),
+    authFailure: authorizationToken === undefined ? "invalidate" : "ignore",
+  });
+}
+
+export function restartForUpdate(authorizationToken?: string): Promise<UpdateStatus> {
+  return apiFetch<UpdateStatus>("/api/update/restart", {
+    method: "POST",
+    headers: updateHeaders(authorizationToken),
+    authFailure: authorizationToken === undefined ? "invalidate" : "ignore",
+  });
 }
diff --git a/apps/web/src/components/bootstrap/BootstrapGate.test.tsx b/apps/web/src/components/bootstrap/BootstrapGate.test.tsx
index 7444ddbf..dc6f1b5e 100644
--- a/apps/web/src/components/bootstrap/BootstrapGate.test.tsx
+++ b/apps/web/src/components/bootstrap/BootstrapGate.test.tsx
@@ -56,7 +56,7 @@ describe("BootstrapGate", () => {
   });
 
   test("does not mount workbench children until bootstrap authorizes ready mode", async () => {
-    globalThis.fetch = mock(async () => Response.json({ mode: "ready", authRequired: false, authenticated: false })) as unknown as typeof fetch;
+    globalThis.fetch = mock(async () => Response.json({ mode: "ready", authRequired: false, authenticated: false, runtime: { state: "ready" } })) as unknown as typeof fetch;
 
     await act(async () => { root.render(<BootstrapGate><p>Workbench mounted</p></BootstrapGate>); });
 
@@ -72,6 +72,7 @@ describe("BootstrapGate", () => {
       mode: "ready",
       authRequired: false,
       authenticated: true,
+      runtime: { state: "ready" },
     })) as unknown as typeof fetch;
 
     await act(async () => {
@@ -89,8 +90,8 @@ describe("BootstrapGate", () => {
     globalThis.fetch = mock(async () => {
       bootstrapCalls += 1;
       return Response.json(bootstrapCalls === 1
-        ? { mode: "ready", authRequired: false, authenticated: false }
-        : { mode: "ready", authRequired: true, authenticated: false });
+        ? { mode: "ready", authRequired: false, authenticated: false, runtime: { state: "ready" } }
+        : { mode: "ready", authRequired: true, authenticated: false, runtime: { state: "ready" } });
     }) as unknown as typeof fetch;
 
     await act(async () => { root.render(<BootstrapGate><p>Workbench mounted</p></BootstrapGate>); });
@@ -101,4 +102,75 @@ describe("BootstrapGate", () => {
     expect(document.body.textContent).not.toContain("Workbench mounted");
     expect(document.body.textContent).toContain("Sign in");
   });
+
+  test("opens the complete Settings workspace on Runtime error", async () => {
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      if (String(input) === "/api/bootstrap") return Response.json({
+        mode: "ready",
+        authRequired: false,
+        authenticated: true,
+        runtime: { state: "error", error: { message: "Session data could not be loaded.", recoveryAllowed: true } },
+      });
+      if (String(input) === "/api/runtime-data") return Response.json({ projects: [] });
+      throw new Error(`Unexpected request: ${String(input)}`);
+    }) as unknown as typeof fetch;
+
+    await act(async () => {
+      root.render(<BootstrapGate><p>Workbench mounted</p></BootstrapGate>);
+      await Promise.resolve();
+    });
+
+    expect(document.body.textContent).toContain("Runtime Data");
+    expect(document.body.textContent).toContain("Session data could not be loaded.");
+    expect(document.body.textContent).toContain("Models");
+    expect(document.body.textContent).toContain("About & Updates");
+    expect(document.body.textContent).not.toContain("Workbench mounted");
+    expect(document.body.textContent).not.toContain("ArchCode could not start");
+  });
+
+  test("requires the terminal Config Recovery link instead of exposing recovery actions", async () => {
+    globalThis.fetch = mock(async () => Response.json({
+      mode: "config_error",
+      message: "The global configuration is invalid. Open Config Recovery from the server terminal.",
+    })) as unknown as typeof fetch;
+
+    await act(async () => { root.render(<BootstrapGate><p>Workbench mounted</p></BootstrapGate>); });
+
+    expect(document.body.textContent).toContain("Open Config Recovery from your terminal");
+    expect(document.body.textContent).toContain("Repair the invalid global configuration at");
+    expect(document.body.textContent).not.toContain("Reset configuration");
+    expect(document.body.textContent).not.toContain("Workbench mounted");
+  });
+
+  test("opens Config Recovery inside the restricted Settings shell with a terminal grant", async () => {
+    dom.reconfigure({ url: "http://localhost/config-recovery#token=recovery-token" });
+    globalThis.fetch = mock(async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input) === "/api/bootstrap") return Response.json({
+        mode: "config_error",
+        message: "The global configuration is invalid. Open Config Recovery from the server terminal.",
+      });
+      if (String(input) === "/api/config-recovery") {
+        expect(new Headers(init?.headers).get("Authorization")).toBe("Bearer recovery-token");
+        return Response.json({
+          configPath: "/Users/test/.archcode/config.json",
+          issues: [{ path: "configuration", message: "This value does not match the current ArchCode configuration format." }],
+        });
+      }
+      throw new Error(`Unexpected request: ${String(input)}`);
+    }) as unknown as typeof fetch;
+
+    await act(async () => {
+      root.render(<BootstrapGate><p>Workbench mounted</p></BootstrapGate>);
+      await Promise.resolve();
+    });
+
+    expect(window.location.hash).toBe("");
+    expect(document.body.textContent).toContain("Config Recovery");
+    expect(document.body.textContent).toContain("/Users/test/.archcode/config.json");
+    expect(document.body.textContent).toContain("Retry configuration");
+    expect(document.body.textContent).toContain("Reset entire Config — last resort");
+    expect(document.body.textContent).toContain("About & Updates");
+    expect((document.querySelector("button[aria-label^='Models, unavailable']") as HTMLButtonElement).disabled).toBe(true);
+    expect(document.body.textContent).not.toContain("Workbench mounted");
+  });
 });
diff --git a/apps/web/src/components/bootstrap/BootstrapGate.tsx b/apps/web/src/components/bootstrap/BootstrapGate.tsx
index 5beeff45..afc54ddd 100644
--- a/apps/web/src/components/bootstrap/BootstrapGate.tsx
+++ b/apps/web/src/components/bootstrap/BootstrapGate.tsx
@@ -6,6 +6,8 @@ import { ApiError, subscribeAuthInvalidation } from "../../api/client";
 import { completeSetup, getBootstrapStatus, getSetupProviderAdapterCatalog } from "../../api/bootstrap";
 import { login } from "../../api/auth";
 import { SettingsModelsPanel, SettingsProfilesPanel } from "../features/settings-panels";
+import { RuntimeRecoverySettings } from "../features/SettingsDialog";
+import { ConfigRecoverySettings } from "../features/ConfigRecoverySettings";
 import { toFieldErrors, type FieldErrors } from "../features/settings-helpers";
 import { Field, TextInput } from "../features/settings-fields";
 
@@ -14,20 +16,18 @@ type GateState = { kind: "loading" } | { kind: "error"; message: string } | { ki
 const primaryButton = "inline-flex h-9 items-center justify-center gap-2 rounded-sm bg-brand px-4 text-[12px] font-semibold text-brand-ink transition-colors duration-[var(--motion-hover)] hover:bg-brand-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40";
 const secondaryButton = "inline-flex h-9 items-center justify-center gap-2 rounded-sm bg-bg-active px-4 text-[12px] font-semibold text-text-secondary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40";
 
-let inspectedSetupFragment = false;
-let setupGrantFromFragment: string | undefined;
+let terminalGrantFromFragment: string | undefined;
 
-function readSetupGrant(): string | undefined {
-  if (inspectedSetupFragment) return setupGrantFromFragment;
-  inspectedSetupFragment = true;
+function readTerminalGrant(): string | undefined {
+  if (terminalGrantFromFragment !== undefined) return terminalGrantFromFragment;
   if (typeof window === "undefined") return undefined;
   const params = new URLSearchParams(window.location.hash.slice(1));
   const token = params.get("token")?.trim();
   if (token) {
-    setupGrantFromFragment = token;
+    terminalGrantFromFragment = token;
     window.history.replaceState(null, "", `${window.location.pathname}${window.location.search}`);
   }
-  return setupGrantFromFragment;
+  return terminalGrantFromFragment;
 }
 
 function emptySetupConfig(): ServerConfigUpdate {
@@ -53,7 +53,7 @@ export function BootstrapGate({
     setState({ kind: "loading" });
     try {
       const status = await getBootstrapStatus();
-      normalizeCompletedSetupPath(status);
+      normalizeBootstrapPath(status);
       setState({ kind: "status", status });
     } catch (error) {
       setState({ kind: "error", message: error instanceof Error ? error.message : "Unable to reach ArchCode." });
@@ -69,7 +69,7 @@ export function BootstrapGate({
     [onAuthInvalidated, reload],
   );
   useEffect(() => {
-    if (state.kind !== "status" || state.status.mode !== "activating") return;
+    if (state.kind !== "status" || state.status.mode !== "ready" || state.status.runtime.state !== "activating") return;
     const timeout = window.setTimeout(() => { void reload(); }, 1_000);
     return () => window.clearTimeout(timeout);
   }, [reload, state]);
@@ -79,15 +79,24 @@ export function BootstrapGate({
 
   const { status } = state;
   if (status.mode === "setup") {
-    const grant = readSetupGrant();
+    const grant = readTerminalGrant();
     return grant
       ? <SetupPage grant={grant} onComplete={reload} />
       : <SetupLinkRequiredPage onRetry={reload} />;
   }
-  if (status.mode === "activating") return <BootstrapShell title="Finishing setup"><p className="text-sm text-text-tertiary">ArchCode is creating the runtime. This page will continue automatically.</p></BootstrapShell>;
-  if (status.mode === "config_error") return <BlockingPage icon={<ShieldAlert size={20} />} title="Configuration needs repair" message={status.message} onRetry={reload} />;
-  if (status.mode === "startup_error") return <BlockingPage icon={<TriangleAlert size={20} />} title="ArchCode could not start" message={status.message} onRetry={reload} />;
+  if (status.mode === "config_error") {
+    const grant = readTerminalGrant();
+    return grant
+      ? <ConfigRecoverySettings grant={grant} onTransition={(next) => {
+        if (next.mode === "ready") setTerminalGrantConsumed();
+        normalizeBootstrapPath(next);
+        setState({ kind: "status", status: next });
+      }} />
+      : <ConfigRecoveryLinkRequiredPage message={status.message} onRetry={reload} />;
+  }
   if (status.authRequired && !status.authenticated) return <LoginPage onLoggedIn={reload} />;
+  if (status.runtime.state === "activating") return <BootstrapShell title="Finishing setup"><p className="text-sm text-text-tertiary">ArchCode is creating the runtime. This page will continue automatically.</p></BootstrapShell>;
+  if (status.runtime.state === "error") return <RuntimeRecoverySettings runtime={status.runtime} onRefreshRuntime={reload} />;
   return <>{children}</>;
 }
 
@@ -126,6 +135,19 @@ function SetupLinkRequiredPage({ onRetry }: { onRetry: () => void }) {
   </BootstrapShell>;
 }
 
+function ConfigRecoveryLinkRequiredPage({ message, onRetry }: { message: string; onRetry: () => void }) {
+  return <BootstrapShell title="Open Config Recovery from your terminal">
+    <div className="flex gap-3">
+      <span className="mt-0.5 text-warning" aria-hidden="true"><ShieldAlert size={20} /></span>
+      <div className="space-y-2 text-sm leading-6 text-text-secondary">
+        <p role="alert">{message}</p>
+        <p>Return to the terminal where ArchCode is running and open the URL printed after <span className="font-medium text-text-primary">“Repair the invalid global configuration at”</span>. That URL contains the process-local token required to access recovery actions safely.</p>
+      </div>
+    </div>
+    <button type="button" className={`mt-6 ${secondaryButton}`} onClick={onRetry}><RefreshCw size={14} aria-hidden="true" />Check again</button>
+  </BootstrapShell>;
+}
+
 function LoginPage({ onLoggedIn }: { onLoggedIn: () => Promise<void> }) {
   const [password, setPassword] = useState("");
   const [submitting, setSubmitting] = useState(false);
@@ -206,7 +228,7 @@ function SetupPage({ grant, onComplete }: { grant: string; onComplete: () => Pro
         ? { config, requireLogin: true, password }
         : { config, requireLogin: false };
       await completeSetup(grant, request);
-      setSetupGrantConsumed();
+      setTerminalGrantConsumed();
       await onComplete();
     } catch (cause) {
       setFieldErrors(toFieldErrors(cause));
@@ -240,20 +262,24 @@ function SetupPage({ grant, onComplete }: { grant: string; onComplete: () => Pro
   </main>;
 }
 
-function setSetupGrantConsumed() {
-  setupGrantFromFragment = undefined;
+function setTerminalGrantConsumed() {
+  terminalGrantFromFragment = undefined;
 }
 
-function normalizeCompletedSetupPath(status: BootstrapStatus): void {
+function normalizeBootstrapPath(status: BootstrapStatus): void {
+  if (typeof window === "undefined") return;
+  const pathname = window.location.pathname;
+  let nextPath: string | undefined;
+  if (status.mode === "setup" && pathname === "/config-recovery") nextPath = "/setup";
+  if (status.mode === "config_error" && pathname === "/setup") nextPath = "/config-recovery";
   if (
-    typeof window !== "undefined"
-    && window.location.pathname === "/setup"
-    && status.mode === "ready"
+    status.mode === "ready"
+    && (pathname === "/setup" || pathname === "/config-recovery")
     && (!status.authRequired || status.authenticated)
-  ) {
-    window.history.replaceState(null, "", "/");
-    window.dispatchEvent(new window.PopStateEvent("popstate"));
-  }
+  ) nextPath = "/";
+  if (nextPath === undefined) return;
+  window.history.replaceState(null, "", nextPath);
+  window.dispatchEvent(new window.PopStateEvent("popstate"));
 }
 
 function validatePassword(password: string, confirmation: string, required: boolean): string | undefined {
diff --git a/apps/web/src/components/features/ConfigRecoverySettings.tsx b/apps/web/src/components/features/ConfigRecoverySettings.tsx
new file mode 100644
index 00000000..01f0c7ac
--- /dev/null
+++ b/apps/web/src/components/features/ConfigRecoverySettings.tsx
@@ -0,0 +1,28 @@
+import { useState } from "react";
+import type { BootstrapStatus } from "@archcode/protocol";
+import { SettingsSidebar } from "./SettingsDialog";
+import { SettingsConfigRecoveryPanel } from "./SettingsConfigRecoveryPanel";
+import { SettingsUpdatesPanel } from "./SettingsUpdatesPanel";
+import type { SettingsSection } from "./settings-helpers";
+
+export function ConfigRecoverySettings({
+  grant,
+  onTransition,
+}: {
+  grant: string;
+  onTransition: (status: BootstrapStatus) => void;
+}) {
+  const [section, setSection] = useState<SettingsSection>("config-recovery");
+  return <div className="min-h-dvh bg-bg-base p-0 text-text-primary sm:p-4">
+    <section aria-label="Configuration recovery settings" className="mx-auto h-dvh min-h-0 w-full overflow-hidden border-border-strong bg-bg-overlay sm:h-[calc(100dvh-32px)] sm:max-w-[1120px] sm:rounded-md sm:border sm:shadow-lg">
+      <div className="flex h-full min-h-0 flex-col sm:flex-row">
+        <SettingsSidebar section={section} onSelect={setSection} recoveryMode />
+        <main className="min-h-0 min-w-0 flex-1 overflow-y-auto bg-bg-base px-5 py-5 sm:px-6">
+          {section === "updates"
+            ? <SettingsUpdatesPanel authorizationToken={grant} />
+            : <SettingsConfigRecoveryPanel grant={grant} onTransition={onTransition} />}
+        </main>
+      </div>
+    </section>
+  </div>;
+}
diff --git a/apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx b/apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx
new file mode 100644
index 00000000..2d9a3c00
--- /dev/null
+++ b/apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx
@@ -0,0 +1,185 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { JSDOM } from "jsdom";
+
+let dom: JSDOM;
+let root: Root;
+let container: HTMLDivElement;
+
+beforeEach(() => {
+  dom = new JSDOM("<!doctype html><html><body></body></html>", {
+    url: "http://localhost",
+    pretendToBeVisual: true,
+  });
+  Object.defineProperties(dom.window.HTMLElement.prototype, {
+    attachEvent: { configurable: true, value: () => {} },
+    detachEvent: { configurable: true, value: () => {} },
+  });
+  for (const [name, value] of Object.entries({
+    window: dom.window,
+    document: dom.window.document,
+    navigator: dom.window.navigator,
+    Node: dom.window.Node,
+    NodeFilter: dom.window.NodeFilter,
+    Element: dom.window.Element,
+    HTMLElement: dom.window.HTMLElement,
+    HTMLButtonElement: dom.window.HTMLButtonElement,
+    HTMLInputElement: dom.window.HTMLInputElement,
+    DocumentFragment: dom.window.DocumentFragment,
+    Event: dom.window.Event,
+    CustomEvent: dom.window.CustomEvent,
+    MouseEvent: dom.window.MouseEvent,
+    PointerEvent: dom.window.PointerEvent ?? dom.window.MouseEvent,
+    MutationObserver: dom.window.MutationObserver,
+    getComputedStyle: dom.window.getComputedStyle.bind(dom.window),
+    IS_REACT_ACT_ENVIRONMENT: true,
+  })) Object.defineProperty(globalThis, name, { configurable: true, value });
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+});
+
+afterEach(() => {
+  act(() => root.unmount());
+  dom.window.close();
+});
+
+describe("Settings Config Recovery interactions", () => {
+  test("requires selection and confirmation before removing only invalid items", async () => {
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
+      requests.push({ url, init });
+      if (url === "/api/config-recovery") return Response.json({
+        configPath: "/Users/test/.archcode/config.json",
+        revision: "revision-sentinel-1234",
+        issues: [{ path: "configuration", message: "This value does not match the current ArchCode configuration format." }],
+        removableItems: [{
+          id: "abcdefghijklmnopqrstuv",
+          label: "Invalid configuration field",
+          path: "configuration",
+          impact: "Removes this invalid field only. Other valid settings remain configured.",
+        }],
+      });
+      if (url === "/api/config-recovery/remove-items") return Response.json({
+        status: { mode: "ready", authRequired: false, authenticated: true, runtime: { state: "activating" } },
+      });
+      throw new Error(`Unexpected request: ${url}`);
+    }) });
+    const onTransition = mock(() => undefined);
+    const { SettingsConfigRecoveryPanel } = await import("./SettingsConfigRecoveryPanel");
+
+    await act(async () => {
+      root.render(<SettingsConfigRecoveryPanel grant="recovery-token" onTransition={onTransition} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    await waitForText("Preserve valid settings", container);
+    const removeButton = findButton("Remove selected invalid items", container);
+    expect(removeButton.disabled).toBe(true);
+
+    const checkbox = container.querySelector<HTMLInputElement>('input[type="checkbox"]')!;
+    await act(async () => { checkbox.click(); });
+    expect(removeButton.disabled).toBe(false);
+    await click("Remove selected invalid items", container);
+    expect(document.body.textContent).toContain("only if the entire remaining Config is valid");
+    expect(document.body.textContent).toContain("Removing the selected entries is permanent");
+    await click("Cancel", document.body);
+    expect(requests.filter((request) => request.url === "/api/config-recovery/remove-items")).toHaveLength(0);
+
+    await click("Remove selected invalid items", container);
+    await click("Remove selected items", document.body);
+    const removal = requests.find((request) => request.url === "/api/config-recovery/remove-items");
+    expect(removal).toBeDefined();
+    expect(new Headers(removal!.init?.headers).get("Authorization")).toBe("Bearer recovery-token");
+    expect(removal!.init?.body).toBe(JSON.stringify({
+      expectedRevision: "revision-sentinel-1234",
+      itemIds: ["abcdefghijklmnopqrstuv"],
+      confirmation: "REMOVE_SELECTED_INVALID_CONFIG_ITEMS",
+    }));
+    expect(onTransition).toHaveBeenCalledWith(expect.objectContaining({ mode: "ready" }));
+  });
+
+  test("requires exact typed confirmation before resetting the entire Config", async () => {
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
+      requests.push({ url, init });
+      if (url === "/api/config-recovery") return Response.json({
+        configPath: "/Users/test/.archcode/config.json",
+        issues: [{ path: "configuration", message: "This value does not match the current ArchCode configuration format." }],
+        removableItems: [],
+      });
+      if (url === "/api/config-recovery/reset") return Response.json({ status: { mode: "setup" } });
+      throw new Error(`Unexpected request: ${url}`);
+    }) });
+    const onTransition = mock(() => undefined);
+    const { SettingsConfigRecoveryPanel } = await import("./SettingsConfigRecoveryPanel");
+
+    await act(async () => {
+      root.render(<SettingsConfigRecoveryPanel grant="recovery-token" onTransition={onTransition} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    await waitForText("Reset entire Config", container);
+
+    await click("Reset entire Config", container);
+    expect(document.body.textContent).toContain("Reset the entire Config?");
+    expect(document.body.textContent).toContain("All providers, models, profiles, MCP servers, memory, GitHub integration, and login/security settings will be lost");
+    const confirm = findButton("Delete entire Config and open Setup", document.body);
+    expect(confirm.disabled).toBe(true);
+    await inputText("RESE", document.body);
+    expect(confirm.disabled).toBe(true);
+    await click("Cancel", document.body);
+    expect(requests.filter((request) => request.url === "/api/config-recovery/reset")).toHaveLength(0);
+
+    await click("Reset entire Config", container);
+    await inputText("RESET", document.body);
+    await click("Delete entire Config and open Setup", document.body);
+    const reset = requests.find((request) => request.url === "/api/config-recovery/reset");
+    expect(reset).toBeDefined();
+    expect(new Headers(reset!.init?.headers).get("Authorization")).toBe("Bearer recovery-token");
+    expect(reset!.init?.body).toBe(JSON.stringify({ confirmation: "DELETE_INVALID_CONFIG" }));
+    expect(onTransition).toHaveBeenCalledWith({ mode: "setup" });
+  });
+});
+
+async function click(label: string, root: ParentNode): Promise<void> {
+  const button = findButton(label, root);
+  await act(async () => {
+    button.click();
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+function findButton(label: string, root: ParentNode): HTMLButtonElement {
+  const button = [...root.querySelectorAll<HTMLButtonElement>("button")]
+    .find((candidate) => candidate.textContent?.trim() === label);
+  if (!button) throw new Error(`Missing ${label}`);
+  return button;
+}
+
+async function inputText(value: string, root: ParentNode): Promise<void> {
+  const input = root.querySelector<HTMLInputElement>('input[type="text"]');
+  if (!input) throw new Error("Missing confirmation input");
+  await act(async () => {
+    const previous = input.value;
+    const setter = Object.getOwnPropertyDescriptor(dom.window.HTMLInputElement.prototype, "value")!.set!;
+    setter.call(input, value);
+    (input as unknown as { _valueTracker?: { setValue(value: string): void } })._valueTracker?.setValue(previous);
+    const propsKey = Object.keys(input).find((key) => key.startsWith("__reactProps$"));
+    const props = propsKey
+      ? (input as unknown as Record<string, { onChange?: (event: { target: HTMLInputElement }) => void }>)[propsKey]
+      : undefined;
+    if (!props?.onChange) throw new Error("Missing confirmation input change handler");
+    props.onChange({ target: input });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+async function waitForText(text: string, root: ParentNode): Promise<void> {
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    if (root.textContent?.includes(text)) return;
+    await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)); });
+  }
+  throw new Error(`Missing text: ${text}`);
+}
diff --git a/apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx b/apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx
new file mode 100644
index 00000000..4f7d7348
--- /dev/null
+++ b/apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx
@@ -0,0 +1,326 @@
+import { useEffect, useRef, useState } from "react";
+import { AlertTriangle, RefreshCw, RotateCcw, ShieldAlert, Trash2 } from "lucide-react";
+import type {
+  BootstrapStatus,
+  ConfigRecoveryRemovableItem,
+  ConfigRecoveryStatus,
+} from "@archcode/protocol";
+import {
+  getConfigRecoveryStatus,
+  removeInvalidConfigItems,
+  resetInvalidConfig,
+  retryConfigRecovery,
+} from "../../api/config-recovery";
+import {
+  DialogContent,
+  DialogDescription,
+  DialogRoot,
+  DialogTitle,
+} from "../ui/Dialog";
+
+const primaryButton = "inline-flex min-h-8 items-center justify-center gap-2 rounded-sm bg-brand px-3 text-[12px] font-medium text-bg-overlay transition-colors duration-[var(--motion-hover)] hover:bg-brand-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40 [@media(pointer:coarse)]:min-h-11";
+const dangerButton = "inline-flex min-h-8 items-center justify-center gap-2 rounded-sm bg-error px-3 text-[12px] font-medium text-bg-overlay transition-colors duration-[var(--motion-hover)] hover:opacity-90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40 [@media(pointer:coarse)]:min-h-11";
+const secondaryButton = "inline-flex min-h-8 items-center justify-center gap-2 rounded-sm bg-bg-active px-3 text-[12px] font-medium text-text-secondary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40 [@media(pointer:coarse)]:min-h-11";
+
+export function SettingsConfigRecoveryPanel({
+  grant,
+  onTransition,
+}: {
+  grant: string;
+  onTransition: (status: BootstrapStatus) => void;
+}) {
+  const [recovery, setRecovery] = useState<ConfigRecoveryStatus>();
+  const [loading, setLoading] = useState(true);
+  const [action, setAction] = useState<"retry" | "remove" | "reset">();
+  const [selectedIds, setSelectedIds] = useState<Set<string>>(() => new Set());
+  const [confirmRemove, setConfirmRemove] = useState(false);
+  const [confirmReset, setConfirmReset] = useState(false);
+  const [error, setError] = useState<string>();
+  const [notice, setNotice] = useState<string>();
+  const headingRef = useRef<HTMLHeadingElement>(null);
+
+  useEffect(() => {
+    let live = true;
+    setLoading(true);
+    void getConfigRecoveryStatus(grant).then(
+      (status) => { if (live) setRecovery(status); },
+      (cause) => { if (live) setError(errorMessage(cause, "Unable to load Config diagnostics.")); },
+    ).finally(() => { if (live) setLoading(false); });
+    return () => { live = false; };
+  }, [grant]);
+
+  useEffect(() => {
+    if (recovery === undefined) return;
+    const currentIds = new Set((recovery.removableItems ?? []).map((item) => item.id));
+    setSelectedIds((selected) => new Set([...selected].filter((id) => currentIds.has(id))));
+  }, [recovery]);
+
+  const focusStatus = () => headingRef.current?.focus();
+  const focusStatusAfterDialog = () => window.requestAnimationFrame(focusStatus);
+  const retry = async () => {
+    setAction("retry");
+    setError(undefined);
+    setNotice(undefined);
+    try {
+      const result = await retryConfigRecovery(grant);
+      if (result.status.mode !== "config_error") {
+        onTransition(result.status);
+        return;
+      }
+      if (result.recovery !== undefined) setRecovery(result.recovery);
+      setNotice("The file was checked again and is still invalid.");
+      focusStatus();
+    } catch (cause) {
+      setError(errorMessage(cause, "Unable to retry configuration."));
+      focusStatus();
+    } finally {
+      setAction(undefined);
+    }
+  };
+  const removeSelected = async () => {
+    if (recovery?.revision === undefined || selectedIds.size === 0) return;
+    setAction("remove");
+    setError(undefined);
+    setNotice(undefined);
+    try {
+      const result = await removeInvalidConfigItems(
+        grant,
+        recovery.revision,
+        [...selectedIds],
+      );
+      setConfirmRemove(false);
+      if (result.status.mode !== "config_error") {
+        onTransition(result.status);
+        return;
+      }
+      if (result.recovery !== undefined) setRecovery(result.recovery);
+      setNotice("The remaining Config is still invalid. Nothing else was removed.");
+      focusStatusAfterDialog();
+    } catch (cause) {
+      setConfirmRemove(false);
+      setError(errorMessage(cause, "Unable to remove the selected invalid items. Nothing was changed."));
+      focusStatusAfterDialog();
+    } finally {
+      setAction(undefined);
+    }
+  };
+  const reset = async () => {
+    setAction("reset");
+    setError(undefined);
+    setNotice(undefined);
+    try {
+      const result = await resetInvalidConfig(grant);
+      setConfirmReset(false);
+      onTransition(result.status);
+    } catch (cause) {
+      setError(errorMessage(cause, "Unable to reset configuration."));
+      setConfirmReset(false);
+      focusStatusAfterDialog();
+    } finally {
+      setAction(undefined);
+    }
+  };
+  const busy = action !== undefined;
+  const selectedItems = (recovery?.removableItems ?? []).filter((item) => selectedIds.has(item.id));
+
+  return <section data-settings-section="config-recovery" className="space-y-5 pb-1">
+    <header className="border-b border-border-subtle pb-4">
+      <p className="mb-1 text-[11px] font-semibold uppercase tracking-[0.12em] text-text-tertiary">Server recovery</p>
+      <h1 ref={headingRef} tabIndex={-1} className="text-[16px] font-semibold leading-[22px] text-text-primary">Config Recovery</h1>
+      <p className="mt-1 text-[13px] leading-5 text-text-tertiary">ArchCode is running, but the global configuration cannot be activated. Remove only confirmed invalid entries, repair the file externally, or use full reset as a last resort.</p>
+    </header>
+
+    <div className="flex gap-3 rounded-sm border border-error/30 bg-error-muted px-3 py-3 text-error">
+      <ShieldAlert className="mt-0.5 shrink-0" size={17} aria-hidden="true" />
+      <div className="min-w-0 text-[12px] leading-5">
+        <p className="font-semibold">The current Config does not match this ArchCode release.</p>
+        <p className="mt-1">Runtime and Config-dependent Settings remain unavailable until the file is valid.</p>
+      </div>
+    </div>
+
+    {error && <p role="alert" className="rounded-sm border border-error/30 bg-error-muted px-3 py-2 text-[12px] leading-5 text-error">{error}</p>}
+    {notice && <p role="status" aria-live="polite" className="rounded-sm border border-warning/30 bg-warning-muted px-3 py-2 text-[12px] leading-5 text-warning">{notice}</p>}
+
+    {loading
+      ? <p className="text-[13px] text-text-tertiary">Loading safe diagnostics…</p>
+      : recovery
+        ? <>
+          <div className="rounded-md border border-border-default bg-bg-surface">
+            <div className="border-b border-border-subtle px-4 py-3">
+              <p className="text-[11px] font-medium text-text-tertiary">Configuration file</p>
+              <code className="mt-1 block break-all font-mono text-[12px] leading-5 text-text-secondary">{recovery.configPath}</code>
+            </div>
+            <div className="px-4 py-3">
+              <p className="text-[11px] font-medium text-text-tertiary">Safe diagnostics</p>
+              {recovery.issues.length === 0
+                ? <p className="mt-2 text-[12px] leading-5 text-text-secondary">No structured issue was available. Check the server log, repair the file, then retry.</p>
+                : <ul className="mt-2 space-y-2" aria-label="Configuration issues">
+                  {recovery.issues.map((issue, index) => <li key={`${issue.path}-${index}`} className="rounded-sm border border-border-subtle bg-bg-elevated px-3 py-2">
+                    <code className="break-all font-mono text-[11px] text-text-secondary">{issue.path}</code>
+                    <p className="mt-1 text-[12px] leading-5 text-text-tertiary">{issue.message}</p>
+                  </li>)}
+                </ul>}
+            </div>
+          </div>
+
+          {recovery.revision !== undefined && (recovery.removableItems?.length ?? 0) > 0 && <div className="rounded-md border border-border-default bg-bg-surface px-4 py-4">
+            <h2 className="text-[13px] font-semibold text-text-primary">Preserve valid settings</h2>
+            <p className="mt-1 text-[12px] leading-5 text-text-tertiary">Select only entries you agree to remove. ArchCode validates the entire remaining Config before writing; if it is still invalid, the file is left unchanged.</p>
+            <fieldset className="mt-3 space-y-2">
+              <legend className="sr-only">Safely removable invalid Config items</legend>
+              {(recovery.removableItems ?? []).map((item) => <label key={item.id} className="flex min-h-11 cursor-pointer items-start gap-3 rounded-sm border border-border-subtle bg-bg-elevated px-3 py-2.5 hover:border-border-default">
+                <input
+                  type="checkbox"
+                  className="mt-0.5 size-4 shrink-0 accent-brand"
+                  checked={selectedIds.has(item.id)}
+                  disabled={busy}
+                  onChange={(event) => setSelectedIds((current) => {
+                    const next = new Set(current);
+                    if (event.target.checked) next.add(item.id);
+                    else next.delete(item.id);
+                    return next;
+                  })}
+                />
+                <span className="min-w-0">
+                  <span className="block text-[12px] font-medium text-text-primary">{item.label}</span>
+                  <code className="mt-0.5 block break-all font-mono text-[11px] text-text-secondary">{item.path}</code>
+                  <span className="mt-1 block text-[11px] leading-4 text-text-tertiary">{item.impact}</span>
+                </span>
+              </label>)}
+            </fieldset>
+            <div className="mt-3 flex flex-wrap items-center gap-3">
+              <button type="button" className={secondaryButton} disabled={busy || selectedIds.size === 0} onClick={() => setConfirmRemove(true)}>
+                <Trash2 size={13} aria-hidden="true" />Remove selected invalid items
+              </button>
+              <span className="text-[11px] text-text-tertiary">{selectedIds.size} selected</span>
+            </div>
+          </div>}
+
+          <div className="space-y-3">
+            <p className="text-[12px] leading-5 text-text-tertiary">After editing the file in your preferred editor, retry without restarting ArchCode.</p>
+            <button type="button" className={primaryButton} disabled={busy} onClick={() => { void retry(); }}>
+              <RefreshCw size={13} aria-hidden="true" />
+              {action === "retry" ? "Checking configuration…" : "Retry configuration"}
+            </button>
+          </div>
+
+          <details className="border-t border-border-subtle pt-5">
+            <summary className="inline-flex min-h-8 cursor-pointer items-center text-[12px] font-medium text-error focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand [@media(pointer:coarse)]:min-h-11">Reset entire Config — last resort</summary>
+            <div className="mt-3 rounded-sm border border-error/30 bg-error-muted px-3 py-3">
+              <p className="text-[12px] font-semibold text-error">This removes all global configuration, including valid settings.</p>
+              <p className="mt-1 max-w-2xl text-[12px] leading-5 text-text-secondary">Providers, models, profiles, MCP servers, memory, GitHub integration, and login/security configuration will be lost. Project source, Git data, and project Runtime data are not deleted.</p>
+              <button type="button" className={`mt-3 ${secondaryButton} text-error`} disabled={busy} onClick={() => setConfirmReset(true)}>
+                <RotateCcw size={13} aria-hidden="true" />Reset entire Config
+              </button>
+            </div>
+          </details>
+        </>
+        : null}
+
+    <RemoveInvalidConfigItemsDialog
+      open={confirmRemove}
+      items={selectedItems}
+      removing={action === "remove"}
+      onCancel={() => setConfirmRemove(false)}
+      onConfirm={() => { void removeSelected(); }}
+    />
+    <ResetInvalidConfigDialog
+      open={confirmReset}
+      configPath={recovery?.configPath}
+      resetting={action === "reset"}
+      onCancel={() => setConfirmReset(false)}
+      onConfirm={() => { void reset(); }}
+    />
+  </section>;
+}
+
+export function RemoveInvalidConfigItemsDialog({
+  open,
+  items,
+  removing,
+  onCancel,
+  onConfirm,
+}: {
+  open: boolean;
+  items: readonly ConfigRecoveryRemovableItem[];
+  removing: boolean;
+  onCancel: () => void;
+  onConfirm: () => void;
+}) {
+  return <DialogRoot open={open} onOpenChange={(next) => { if (!next && !removing) onCancel(); }}>
+    <DialogContent
+      onEscapeKeyDown={(event) => { if (removing) event.preventDefault(); }}
+      onPointerDownOutside={(event) => { if (removing) event.preventDefault(); }}
+    >
+      <div className="p-5">
+        <DialogTitle className="text-[16px] font-semibold text-text-primary">Remove selected invalid Config items?</DialogTitle>
+        <DialogDescription className="mt-2 text-[13px] leading-5 text-text-secondary">Only the entries listed below will be removed. The operation proceeds only if the entire remaining Config is valid; otherwise nothing is changed.</DialogDescription>
+        <div className="mt-3 flex gap-2 rounded-sm border border-warning/30 bg-warning-muted px-3 py-2 text-warning">
+          <AlertTriangle className="mt-0.5 shrink-0" size={15} aria-hidden="true" />
+          <p className="text-[12px] leading-5">Removing the selected entries is permanent. Valid providers, models, profiles, MCP servers, and security settings remain untouched.</p>
+        </div>
+        <ul className="mt-3 max-h-56 space-y-2 overflow-y-auto" aria-label="Selected invalid Config items">
+          {items.map((item) => <li key={item.id} className="rounded-sm border border-border-subtle bg-bg-elevated px-3 py-2">
+            <p className="text-[12px] font-medium text-text-primary">{item.label}</p>
+            <p className="mt-1 text-[11px] leading-4 text-text-tertiary">{item.impact}</p>
+          </li>)}
+        </ul>
+        <div className="mt-5 flex flex-wrap justify-end gap-2">
+          <button type="button" className={secondaryButton} disabled={removing} onClick={onCancel}>Cancel</button>
+          <button type="button" className={dangerButton} disabled={removing || items.length === 0} onClick={onConfirm}>{removing ? "Validating and removing…" : "Remove selected items"}</button>
+        </div>
+      </div>
+    </DialogContent>
+  </DialogRoot>;
+}
+
+export function ResetInvalidConfigDialog({
+  open,
+  configPath,
+  resetting,
+  onCancel,
+  onConfirm,
+}: {
+  open: boolean;
+  configPath?: string;
+  resetting: boolean;
+  onCancel: () => void;
+  onConfirm: () => void;
+}) {
+  const [confirmation, setConfirmation] = useState("");
+  useEffect(() => { if (!open) setConfirmation(""); }, [open]);
+  const confirmed = confirmation === "RESET";
+  return <DialogRoot open={open} onOpenChange={(next) => { if (!next && !resetting) onCancel(); }}>
+      <DialogContent
+        onEscapeKeyDown={(event) => { if (resetting) event.preventDefault(); }}
+        onPointerDownOutside={(event) => { if (resetting) event.preventDefault(); }}
+      >
+        <div className="p-5">
+          <DialogTitle className="text-[16px] font-semibold text-error">Reset the entire Config?</DialogTitle>
+          <DialogDescription className="mt-2 text-[13px] leading-5 text-text-secondary">This permanently deletes the whole global Config and opens Setup. All providers, models, profiles, MCP servers, memory, GitHub integration, and login/security settings will be lost.</DialogDescription>
+          {configPath && <code className="mt-3 block break-all rounded-sm border border-border-subtle bg-bg-elevated px-3 py-2 font-mono text-[11px] leading-5 text-text-secondary">{configPath}</code>}
+          <p className="mt-3 text-[12px] leading-5 text-text-tertiary">Project source, Git data, and project Runtime data are not deleted.</p>
+          <label className="mt-4 block text-[12px] font-medium text-text-secondary">
+            Type <code className="font-mono text-error">RESET</code> to confirm
+            <input
+              type="text"
+              value={confirmation}
+              disabled={resetting}
+              autoComplete="off"
+              spellCheck={false}
+              onChange={(event) => setConfirmation(event.target.value)}
+              className="mt-2 min-h-9 w-full rounded-sm border border-border-default bg-bg-elevated px-3 font-mono text-[12px] text-text-primary outline-none focus:border-brand focus:ring-1 focus:ring-brand [@media(pointer:coarse)]:min-h-11"
+            />
+          </label>
+          <div className="mt-5 flex flex-wrap justify-end gap-2">
+            <button type="button" className={secondaryButton} disabled={resetting} onClick={onCancel}>Cancel</button>
+            <button type="button" className={dangerButton} disabled={resetting || !confirmed} onClick={onConfirm}>{resetting ? "Resetting…" : "Delete entire Config and open Setup"}</button>
+          </div>
+        </div>
+      </DialogContent>
+    </DialogRoot>;
+}
+
+function errorMessage(cause: unknown, fallback: string): string {
+  return cause instanceof Error ? cause.message : fallback;
+}
diff --git a/apps/web/src/components/features/SettingsDialog.interaction.tsx b/apps/web/src/components/features/SettingsDialog.interaction.tsx
index 5f741304..ecb4138c 100644
--- a/apps/web/src/components/features/SettingsDialog.interaction.tsx
+++ b/apps/web/src/components/features/SettingsDialog.interaction.tsx
@@ -2,10 +2,13 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 import { act, type ComponentProps } from "react";
 import { createRoot, type Root } from "react-dom/client";
 import { JSDOM } from "jsdom";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import type { ProviderAdapterCatalog } from "@archcode/protocol";
 import type { ServerConfigSnapshot } from "../../api/config";
 import { DialogRoot } from "../ui/Dialog";
-import { SettingsBody as SettingsBodyComponent, SettingsCloseButton } from "./SettingsDialog";
+import { RuntimeRecoverySettings, SettingsBody as SettingsBodyComponent, SettingsCloseButton } from "./SettingsDialog";
+import { SettingsRuntimeDataPanel } from "./SettingsRuntimeDataPanel";
+import { ConfigRecoverySettings } from "./ConfigRecoverySettings";
 
 let dom: JSDOM;
 let root: Root;
@@ -43,8 +46,8 @@ function SettingsBody(props: Omit<ComponentProps<typeof SettingsBodyComponent>,
 }
 
 function installDom() {
-  dom = new JSDOM("<!doctype html><html><body></body></html>", { url: "http://localhost" });
-  for (const [name, value] of Object.entries({ window: dom.window, document: dom.window.document, navigator: dom.window.navigator, Node: dom.window.Node, Element: dom.window.Element, HTMLElement: dom.window.HTMLElement, HTMLInputElement: dom.window.HTMLInputElement, Event: dom.window.Event, CustomEvent: dom.window.CustomEvent, MouseEvent: dom.window.MouseEvent, MutationObserver: dom.window.MutationObserver, getComputedStyle: dom.window.getComputedStyle.bind(dom.window), IS_REACT_ACT_ENVIRONMENT: true })) Object.defineProperty(globalThis, name, { configurable: true, value });
+  dom = new JSDOM("<!doctype html><html><body></body></html>", { url: "http://localhost", pretendToBeVisual: true });
+  for (const [name, value] of Object.entries({ window: dom.window, document: dom.window.document, navigator: dom.window.navigator, Node: dom.window.Node, NodeFilter: dom.window.NodeFilter, Element: dom.window.Element, HTMLElement: dom.window.HTMLElement, HTMLButtonElement: dom.window.HTMLButtonElement, HTMLInputElement: dom.window.HTMLInputElement, DocumentFragment: dom.window.DocumentFragment, Event: dom.window.Event, CustomEvent: dom.window.CustomEvent, MouseEvent: dom.window.MouseEvent, PointerEvent: dom.window.PointerEvent ?? dom.window.MouseEvent, MutationObserver: dom.window.MutationObserver, getComputedStyle: dom.window.getComputedStyle.bind(dom.window), IS_REACT_ACT_ENVIRONMENT: true })) Object.defineProperty(globalThis, name, { configurable: true, value });
   container = document.createElement("div"); document.body.append(container); root = createRoot(container);
 }
 function click(label: string) { const element = [...container.querySelectorAll("button")].find((button) => button.textContent === label); if (!element) throw new Error(`Missing ${label}`); act(() => element.click()); }
@@ -81,6 +84,13 @@ function blur(element: HTMLInputElement | HTMLTextAreaElement | HTMLSelectElemen
     else element.dispatchEvent(new dom.window.FocusEvent("focusout", { bubbles: true }));
   });
 }
+async function waitForText(expected: string) {
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    if (container.textContent?.includes(expected)) return;
+    await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)); });
+  }
+  throw new Error(`Timed out waiting for ${expected}`);
+}
 function successfulSaveResponse(restartRequiredSections: ServerConfigSnapshot["restartRequiredSections"] = []) {
   return {
     ...snapshot,
@@ -619,4 +629,254 @@ describe("SettingsDialog interactions", () => {
     expect((container.querySelector('input[type="checkbox"]') as HTMLInputElement).checked).toBe(true);
   });
 
+  test("keeps Runtime Data unselected by default and enables only an affected project", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async () => Response.json({
+      projects: [{
+        projectSlug: "healthy",
+        name: "Healthy",
+        workspace: "/work/healthy",
+        runtimePath: "/work/healthy/.archcode/runtime",
+        stats: { fileCount: 2, totalBytes: 512 },
+        issues: [],
+      }, {
+        projectSlug: "broken",
+        name: "Broken",
+        workspace: "/work/broken",
+        runtimePath: "/work/broken/.archcode/runtime",
+        stats: { fileCount: 4, totalBytes: 2048 },
+        issues: [{ relativePath: "sessions/root/session.json", reason: "invalid_current_schema", schemaIssues: [{ path: ["messages", 0], message: "Invalid message" }] }],
+      }],
+    })) });
+
+    await act(async () => {
+      root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Runtime failed safely", recoveryAllowed: true } }} onRefreshRuntime={async () => {}} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const checkboxes = [...container.querySelectorAll('input[type="checkbox"]')] as HTMLInputElement[];
+    expect(checkboxes).toHaveLength(2);
+    expect(checkboxes[0]?.disabled).toBe(true);
+    expect(checkboxes[1]?.disabled).toBe(false);
+    expect(checkboxes.every((checkbox) => !checkbox.checked)).toBe(true);
+    expect(container.textContent).toContain("Does not match the current ArchCode data format");
+    expect(container.textContent).toContain("Invalid message");
+    expect(([...container.querySelectorAll("button")].find((button) => button.textContent === "Delete runtime data") as HTMLButtonElement).disabled).toBe(true);
+  });
+
+  test("keeps inspection available but disables in-process recovery after incomplete cleanup", async () => {
+    const requests: Array<{ url: string; method?: string }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
+      requests.push({ url, method: init?.method });
+      return Response.json({
+        projects: [{
+          projectSlug: "broken",
+          name: "Broken",
+          workspace: "/work/broken",
+          runtimePath: "/work/broken/.archcode/runtime",
+          stats: { fileCount: 4, totalBytes: 2048 },
+          issues: [{ relativePath: "todos/state.json", reason: "invalid_json" }],
+        }],
+      });
+    }) });
+
+    await act(async () => {
+      root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Runtime cleanup did not finish", recoveryAllowed: false } }} onRefreshRuntime={async () => {}} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(container.textContent).toContain("todos/state.json");
+    expect(container.textContent).toContain("ArchCode must be restarted. Runtime cannot be retried and Runtime data cannot be deleted in this process.");
+    expect(container.textContent).toContain("Deletion is unavailable until ArchCode is restarted.");
+    expect((container.querySelector('input[type="checkbox"]') as HTMLInputElement).disabled).toBe(true);
+    const retryButton = [...container.querySelectorAll("button")].find((button) => button.textContent === "Retry Runtime") as HTMLButtonElement;
+    const deleteButton = [...container.querySelectorAll("button")].find((button) => button.textContent === "Delete runtime data") as HTMLButtonElement;
+    expect(retryButton.disabled).toBe(true);
+    expect(deleteButton.disabled).toBe(true);
+    act(() => {
+      retryButton.click();
+      deleteButton.click();
+    });
+    expect(requests).toEqual([{ url: "/api/runtime-data", method: undefined }]);
+  });
+
+  test("shows a Runtime retry failure returned by the control plane", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (_url: string, init?: RequestInit) => {
+      if (init?.method === "POST") return Response.json({ state: "error", error: { message: "Runtime still cannot load project data.", recoveryAllowed: true } });
+      return Response.json({ projects: [] });
+    }) });
+    const onRefreshRuntime = mock(async () => {});
+
+    await act(async () => {
+      root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Initial failure", recoveryAllowed: true } }} onRefreshRuntime={onRefreshRuntime} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    await act(async () => {
+      [...container.querySelectorAll("button")].find((button) => button.textContent === "Retry Runtime")!.click();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect([...container.querySelectorAll('[role="alert"]')].some((alert) => alert.textContent?.includes("Runtime still cannot load project data."))).toBe(true);
+    expect(onRefreshRuntime).toHaveBeenCalledTimes(1);
+    expect(document.activeElement?.textContent).toBe("Runtime Data");
+  });
+
+  test("shows Runtime inspection loading before an empty result", async () => {
+    let resolveInspection!: (response: Response) => void;
+    const pendingInspection = new Promise<Response>((resolve) => { resolveInspection = resolve; });
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async () => pendingInspection) });
+
+    await act(async () => {
+      root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Runtime failed", recoveryAllowed: true } }} onRefreshRuntime={async () => {}} />);
+      await Promise.resolve();
+    });
+    expect(container.textContent).toContain("Inspecting registered projects…");
+
+    await act(async () => {
+      resolveInspection(Response.json({ projects: [] }));
+      await pendingInspection;
+      await Promise.resolve();
+    });
+    expect(container.textContent).toContain("No registered project Runtime data was found.");
+  });
+
+  test("keeps an inspection failure inline with a retry action", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async () => Response.json({
+      error: { code: "RUNTIME_DATA_INSPECTION_FAILED", message: "Inspection service is unavailable." },
+    }, { status: 500 })) });
+
+    await act(async () => {
+      root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Runtime failed", recoveryAllowed: true } }} onRefreshRuntime={async () => {}} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect([...container.querySelectorAll('[role="alert"]')].some((alert) => alert.textContent?.includes("Inspection service is unavailable."))).toBe(true);
+    expect([...container.querySelectorAll("button")].some((button) => button.textContent === "Retry inspection")).toBe(true);
+  });
+
+  test("announces a successful Runtime retry", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (_url: string, init?: RequestInit) => {
+      if (init?.method === "POST") return Response.json({ state: "ready" });
+      return Response.json({ projects: [] });
+    }) });
+    const onRefreshRuntime = mock(async () => {});
+
+    await act(async () => {
+      root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Initial failure", recoveryAllowed: true } }} onRefreshRuntime={onRefreshRuntime} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    await act(async () => {
+      [...container.querySelectorAll("button")].find((button) => button.textContent === "Retry Runtime")!.click();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(container.textContent).toContain("Runtime is ready.");
+    expect(onRefreshRuntime).toHaveBeenCalledTimes(1);
+  });
+
+  test("keeps every Settings section reachable from Runtime recovery", async () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false }, mutations: { retry: false } } });
+    const updateStatus = {
+      currentVersion: "0.0.8",
+      phase: "idle",
+      managed: false,
+      restartSupported: true,
+      updateAvailable: false,
+      restartRequired: false,
+    } as const;
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string) => {
+      if (url === "/api/runtime-data") return Response.json({ projects: [] });
+      if (url === "/api/config") return Response.json(successfulSaveResponse());
+      if (url === "/api/config/provider-adapters") return Response.json(adapterCatalog);
+      if (url === "/api/auth/status") return Response.json({ required: false });
+      if (url === "/api/update") return Response.json(updateStatus);
+      throw new Error(`Unexpected request: ${url}`);
+    }) });
+
+    await act(async () => {
+      root.render(<QueryClientProvider client={queryClient}><RuntimeRecoverySettings runtime={{ state: "error", error: { message: "Runtime failed", recoveryAllowed: true } }} onRefreshRuntime={async () => {}} /></QueryClientProvider>);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    expect(container.querySelector('[data-settings-section="runtime-data"]')).not.toBeNull();
+
+    click("Models");
+    await waitForText("Providers and their model profiles");
+    const destinations: Array<[string, string]> = [
+      ["Profiles", "Principal, deep, and fast model bindings"],
+      ["Security", "Manage the one password"],
+      ["MCP", "MCP servers"],
+      ["Memory", "Configure extraction thresholds"],
+      ["GitHub", "Optional GitHub integration settings"],
+    ];
+    for (const [label, expected] of destinations) {
+      click(label);
+      await waitForText(expected);
+    }
+    click("About & Updates");
+    await waitForText("About & Updates");
+    expect(container.textContent).toContain("Install releases signed by the official ArchCode workflow, then restart when the Runtime is idle.");
+    expect(container.textContent).not.toContain("preserve Runtime data");
+    queryClient.clear();
+  });
+
+  test("retries Config while keeping Updates available through the recovery grant", async () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false }, mutations: { retry: false } } });
+    const onTransition = mock(() => undefined);
+    const requests: Array<{ url: string; method: string; authorization: string | null; body?: string }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
+      const headers = new Headers(init?.headers);
+      requests.push({
+        url,
+        method: init?.method ?? "GET",
+        authorization: headers.get("Authorization"),
+        ...(typeof init?.body === "string" ? { body: init.body } : {}),
+      });
+      if (url === "/api/config-recovery") return Response.json({
+        configPath: "/Users/test/.archcode/config.json",
+        issues: [{ path: "configuration", message: "This value does not match the current ArchCode configuration format." }],
+      });
+      if (url === "/api/config-recovery/retry") return Response.json({
+        status: { mode: "config_error", message: "Config remains invalid." },
+        recovery: {
+          configPath: "/Users/test/.archcode/config.json",
+          issues: [{ path: "profiles.fast.model", message: "This value does not match the current ArchCode configuration format." }],
+        },
+      });
+      if (url === "/api/update") return Response.json({
+        currentVersion: "0.0.8",
+        phase: "idle",
+        managed: false,
+        restartSupported: false,
+        updateAvailable: false,
+        restartRequired: false,
+      });
+      throw new Error(`Unexpected request: ${url}`);
+    }) });
+
+    await act(async () => {
+      root.render(<QueryClientProvider client={queryClient}><ConfigRecoverySettings grant="recovery-token" onTransition={onTransition} /></QueryClientProvider>);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    await waitForText("/Users/test/.archcode/config.json");
+    expect((container.querySelector("button[aria-label^='Models, unavailable']") as HTMLButtonElement).disabled).toBe(true);
+
+    await act(async () => { click("Retry configuration"); await Promise.resolve(); });
+    await waitForText("still invalid");
+    expect(container.textContent).toContain("profiles.fast.model");
+    expect(document.activeElement?.textContent).toBe("Config Recovery");
+
+    click("About & Updates");
+    await waitForText("About & Updates");
+    expect(requests.find((request) => request.url === "/api/update")?.authorization).toBe("Bearer recovery-token");
+    queryClient.clear();
+  });
+
 });
diff --git a/apps/web/src/components/features/SettingsDialog.test.tsx b/apps/web/src/components/features/SettingsDialog.test.tsx
index 13aaeed0..5354df75 100644
--- a/apps/web/src/components/features/SettingsDialog.test.tsx
+++ b/apps/web/src/components/features/SettingsDialog.test.tsx
@@ -82,7 +82,23 @@ describe("SettingsDialog", () => {
     const labels = findAll(tree, (element) => element.type === "button").map(textContent);
 
     expect(textContent(tree)).toContain("Server");
-    expect(labels).toEqual(["Models", "Profiles", "Security", "MCP", "Memory", "GitHub", "About & Updates"]);
+    expect(labels).toEqual(["Models", "Profiles", "Security", "Runtime Data", "MCP", "Memory", "GitHub", "About & Updates"]);
+  });
+
+  test("adds Config Recovery while disabling Config-dependent sections", () => {
+    const tree = SettingsNavigation({
+      activeSection: "config-recovery",
+      onSelect: () => {},
+      recoveryMode: true,
+    });
+    const buttons = findAll(tree, (element) => element.type === "button");
+    const labels = buttons.map(textContent);
+
+    expect(labels[0]).toBe("Config Recovery");
+    expect(buttons.find((button) => textContent(button) === "Config Recovery")?.props?.disabled).toBe(false);
+    expect(buttons.find((button) => textContent(button) === "About & Updates")?.props?.disabled).toBe(false);
+    expect(buttons.find((button) => textContent(button) === "Models")?.props?.disabled).toBe(true);
+    expect(buttons.find((button) => textContent(button) === "Runtime Data")?.props?.disabled).toBe(true);
   });
 
   test("keeps providers and models in one continuous Models surface", () => {
@@ -128,4 +144,24 @@ describe("SettingsDialog", () => {
     expect(notice).toContain("applied live");
     expect(notice).toContain("Restart required for: MCP, GitHub");
   });
+
+  test("does not claim live application while Runtime is unavailable", () => {
+    const notice = textContent(SettingsApplyNotice({
+      modelsAppliedLive: false,
+      restartRequiredSections: [],
+      savedWhileRuntimeUnavailable: true,
+    }));
+
+    expect(notice).toContain("Configuration saved");
+    expect(notice).toContain("Retry Runtime");
+    expect(notice).not.toContain("applied live");
+  });
+
+  test("keeps MCP configuration visible while live status is unavailable", () => {
+    const tree = SettingsMcpPanel({ config, servers: {}, onChange: () => {}, runtimeAvailable: false });
+
+    expect(textContent(tree)).toContain("Unavailable while Runtime is offline");
+    expect(textContent(tree)).toContain("Unavailable");
+    expect(textContent(tree)).not.toContain("Failed");
+  });
 });
diff --git a/apps/web/src/components/features/SettingsDialog.tsx b/apps/web/src/components/features/SettingsDialog.tsx
index 1ab28832..9bb4b747 100644
--- a/apps/web/src/components/features/SettingsDialog.tsx
+++ b/apps/web/src/components/features/SettingsDialog.tsx
@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import { X } from "lucide-react";
-import type { McpServerStatus, ProviderAdapterCatalog, ServerConfigSnapshot as ServerConfigSnapshotView } from "@archcode/protocol";
+import type { McpServerStatus, ProviderAdapterCatalog, RuntimeStatus, ServerConfigSnapshot as ServerConfigSnapshotView } from "@archcode/protocol";
 import { ApiError } from "../../api/client";
 import { getProviderAdapterCatalog, getServerConfig, saveServerConfig, toConfigDraft, type ServerConfigSnapshot } from "../../api/config";
 import { useMcpStatusStore } from "../../store/mcp-status-store";
@@ -8,6 +8,7 @@ import { DialogContent, DialogDescription, DialogRoot, DialogTitle } from "../ui
 import { cloneConfig, hasConfigChanges, missingProfileVariants, toFieldErrors, type SettingsSection } from "./settings-helpers";
 import { SettingsProfilesPanel, SettingsGithubPanel, SettingsMcpPanel, SettingsMemoryPanel, SettingsModelsPanel, SettingsNavigation } from "./settings-panels";
 import { SettingsSecurityPanel } from "./SettingsSecurityPanel";
+import { SettingsRuntimeDataPanel } from "./SettingsRuntimeDataPanel";
 import { SettingsUpdatesPanel } from "./SettingsUpdatesPanel";
 
 export { SettingsMcpPanel, SettingsModelsPanel, SettingsNavigation } from "./settings-panels";
@@ -20,7 +21,8 @@ const restartSectionLabels: Record<RestartRequiredSection, string> = {
   "integrations.github": "GitHub",
 };
 
-export function SettingsApplyNotice({ modelsAppliedLive, restartRequiredSections }: { modelsAppliedLive: boolean; restartRequiredSections: readonly RestartRequiredSection[] }) {
+export function SettingsApplyNotice({ modelsAppliedLive, restartRequiredSections, savedWhileRuntimeUnavailable = false }: { modelsAppliedLive: boolean; restartRequiredSections: readonly RestartRequiredSection[]; savedWhileRuntimeUnavailable?: boolean }) {
+  if (savedWhileRuntimeUnavailable) return <div role="status" className="shrink-0 border-b border-success/30 bg-success-muted px-5 py-2 text-sm text-success">Configuration saved. Retry Runtime to use the saved configuration.</div>;
   if (!modelsAppliedLive && restartRequiredSections.length === 0) return null;
   return <div role="status" className={`shrink-0 border-b px-5 py-2 text-sm ${restartRequiredSections.length > 0 ? "border-warning/30 bg-warning-muted text-warning" : "border-success/30 bg-success-muted text-success"}`}>
     {modelsAppliedLive && <span>Model and Profile changes applied live.</span>}
@@ -33,7 +35,7 @@ export function SettingsCloseButton({ onClose }: { onClose: () => void }) {
   return <button type="button" aria-label="Close settings" onClick={onClose} className="absolute right-3 top-3 z-10 flex h-7 w-7 items-center justify-center rounded-sm text-text-tertiary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand"><X size={14} aria-hidden="true" /></button>;
 }
 
-export function SettingsBody({ snapshot, adapterCatalog, servers, onReload, section: requestedSection = "models", onSectionChange, reloading = false, reloadError }: { snapshot: ServerConfigSnapshot; adapterCatalog: ProviderAdapterCatalog; servers: Record<string, McpServerStatus>; onReload: () => Promise<void>; section?: SettingsSection; onSectionChange?: (section: SettingsSection) => void; reloading?: boolean; reloadError?: string }) {
+export function SettingsBody({ snapshot, adapterCatalog, servers, onReload, runtime = { state: "ready" }, onRefreshRuntime = async () => {}, section: requestedSection = "models", onSectionChange, reloading = false, reloadError }: { snapshot: ServerConfigSnapshot; adapterCatalog: ProviderAdapterCatalog; servers: Record<string, McpServerStatus>; onReload: () => Promise<void>; runtime?: RuntimeStatus; onRefreshRuntime?: () => Promise<void>; section?: SettingsSection; onSectionChange?: (section: SettingsSection) => void; reloading?: boolean; reloadError?: string }) {
   const [section, setSection] = useState<SettingsSection>(requestedSection);
   const [draft, setDraft] = useState(() => cloneConfig(snapshot.config));
   const [errors, setErrors] = useState<Record<string, string>>({});
@@ -42,6 +44,7 @@ export function SettingsBody({ snapshot, adapterCatalog, servers, onReload, sect
   const [saving, setSaving] = useState(false);
   const [restartRequiredSections, setRestartRequiredSections] = useState(snapshot.restartRequiredSections);
   const [modelsAppliedLive, setModelsAppliedLive] = useState(false);
+  const [savedWhileRuntimeUnavailable, setSavedWhileRuntimeUnavailable] = useState(false);
   const [jsonResetVersion, setJsonResetVersion] = useState(0);
 
   useEffect(() => {
@@ -76,6 +79,7 @@ export function SettingsBody({ snapshot, adapterCatalog, servers, onReload, sect
     if (hasJsonErrors) return;
     setSaving(true);
     setModelsAppliedLive(false);
+    setSavedWhileRuntimeUnavailable(false);
     setErrors({});
     setSaveError(undefined);
     try {
@@ -88,7 +92,8 @@ export function SettingsBody({ snapshot, adapterCatalog, servers, onReload, sect
       setDraft(cloneConfig(next.config));
       setRestartRequiredSections(next.restartRequiredSections);
       await onReload();
-      setModelsAppliedLive(modelSettingsChanged);
+      setModelsAppliedLive(runtime.state === "ready" && modelSettingsChanged);
+      setSavedWhileRuntimeUnavailable(runtime.state !== "ready");
     } catch (error) {
       const nextErrors = toFieldErrors(error);
       setErrors(nextErrors);
@@ -109,26 +114,40 @@ export function SettingsBody({ snapshot, adapterCatalog, servers, onReload, sect
   };
 
   return <div data-settings-layout className="flex h-full min-h-0 flex-col">
-    {section !== "updates" && <SettingsApplyNotice modelsAppliedLive={modelsAppliedLive} restartRequiredSections={restartRequiredSections} />}
+    {section !== "updates" && section !== "runtime-data" && <SettingsApplyNotice modelsAppliedLive={modelsAppliedLive} restartRequiredSections={runtime.state === "ready" ? restartRequiredSections : []} savedWhileRuntimeUnavailable={savedWhileRuntimeUnavailable} />}
     <div data-settings-workspace className="flex min-h-0 flex-1 flex-col sm:flex-row">
       <SettingsSidebar section={section} onSelect={selectSection} invalidProfileCount={invalidProfileCount} />
       {section === "updates"
-        ? <main className="min-h-0 flex-1 overflow-y-auto bg-bg-base px-5 py-5 sm:px-6"><SettingsUpdatesPanel /></main>
+        ? <main className="min-h-0 min-w-0 flex-1 overflow-y-auto bg-bg-base px-5 py-5 sm:px-6"><SettingsUpdatesPanel /></main>
+        : section === "runtime-data"
+          ? <main className="min-h-0 min-w-0 flex-1 overflow-y-auto bg-bg-base px-5 py-5 sm:px-6"><SettingsRuntimeDataPanel runtime={runtime} onRefreshRuntime={onRefreshRuntime} /></main>
         : <fieldset data-settings-controls disabled={saving || reloading} className="contents">
           <div className="flex min-h-0 flex-1 flex-col"><main className="min-h-0 flex-1 overflow-y-auto bg-bg-base px-5 py-5 sm:px-6">
             <div hidden={section !== "models"}><SettingsModelsPanel config={draft} adapterCatalog={adapterCatalog} onChange={setDraft} errors={fieldErrors} onJsonValidationChange={onJsonValidationChange} jsonResetVersion={jsonResetVersion} /></div>
             <div hidden={section !== "profiles"}><SettingsProfilesPanel config={draft} onChange={setDraft} errors={fieldErrors} onJsonValidationChange={onJsonValidationChange} jsonResetVersion={jsonResetVersion} /></div>
             {section === "security" && <SettingsSecurityPanel onConfigChanged={onReload} />}
-            <div hidden={section !== "mcp"}><SettingsMcpPanel config={draft} servers={servers} onChange={setDraft} errors={errors} /></div>
+            <div hidden={section !== "mcp"}><SettingsMcpPanel config={draft} servers={servers} onChange={setDraft} errors={errors} runtimeAvailable={runtime.state === "ready"} /></div>
             <div hidden={section !== "memory"}><SettingsMemoryPanel config={draft} onChange={setDraft} errors={errors} /></div>
             <div hidden={section !== "github"}><SettingsGithubPanel config={draft} onChange={setDraft} errors={errors} /></div>
-          </main><footer className="flex shrink-0 flex-wrap items-center justify-between gap-3 border-t border-border-subtle bg-bg-surface px-5 py-3">{saveError || reloadError ? <div role="alert" className="text-[11px] leading-4 text-error">{saveError ?? reloadError}</div> : <span className={`text-[11px] leading-4 ${hasJsonErrors ? "text-error" : dirty ? "text-warning" : "text-text-tertiary"}`}>{hasJsonErrors ? "Fix invalid JSON before saving" : dirty ? "Unsaved changes" : "All changes saved"}</span>}<div className="flex gap-2"><button type="button" onClick={() => { setModelsAppliedLive(false); void onReload(); }} className="h-8 rounded-sm bg-bg-active px-4 text-[12px] font-medium text-text-secondary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand">{reloading ? "Reloading…" : "Reload"}</button><button type="button" disabled={!dirty || saving || reloading || hasJsonErrors} onClick={() => { void save(); }} className="h-8 rounded-sm bg-brand px-4 text-[12px] font-medium text-bg-overlay transition-colors duration-[var(--motion-hover)] hover:bg-brand-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40">{saving ? "Saving…" : "Save changes"}</button></div></footer></div>
+          </main><footer className="flex shrink-0 flex-wrap items-center justify-between gap-3 border-t border-border-subtle bg-bg-surface px-5 py-3">{saveError || reloadError ? <div role="alert" className="text-[11px] leading-4 text-error">{saveError ?? reloadError}</div> : <span className={`text-[11px] leading-4 ${hasJsonErrors ? "text-error" : dirty ? "text-warning" : "text-text-tertiary"}`}>{hasJsonErrors ? "Fix invalid JSON before saving" : dirty ? "Unsaved changes" : "All changes saved"}</span>}<div className="flex gap-2"><button type="button" onClick={() => { setModelsAppliedLive(false); setSavedWhileRuntimeUnavailable(false); void onReload(); }} className="h-8 rounded-sm bg-bg-active px-4 text-[12px] font-medium text-text-secondary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand">{reloading ? "Reloading…" : "Reload"}</button><button type="button" disabled={!dirty || saving || reloading || hasJsonErrors} onClick={() => { void save(); }} className="h-8 rounded-sm bg-brand px-4 text-[12px] font-medium text-bg-overlay transition-colors duration-[var(--motion-hover)] hover:bg-brand-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40">{saving ? "Saving…" : "Save changes"}</button></div></footer></div>
         </fieldset>}
     </div>
   </div>;
 }
 
 export function SettingsDialog({ open, section = "models", onClose }: { open: boolean; section?: SettingsSection; onClose: () => void }) {
+  return <DialogRoot open={open} onOpenChange={(next) => { if (!next) onClose(); }}><DialogContent size="x-large" className="overflow-hidden p-0"><DialogTitle className="sr-only">Settings</DialogTitle><DialogDescription className="sr-only">Configure ArchCode server settings, Runtime data, and application updates.</DialogDescription><SettingsCloseButton onClose={onClose} /><SettingsWorkspace active={open} section={section} runtime={{ state: "ready" }} onRefreshRuntime={async () => {}} /></DialogContent></DialogRoot>;
+}
+
+export function RuntimeRecoverySettings({ runtime, onRefreshRuntime }: { runtime: RuntimeStatus; onRefreshRuntime: () => Promise<void> }) {
+  return <main className="min-h-dvh bg-bg-base p-0 text-text-primary sm:p-4">
+    <section aria-label="Runtime recovery settings" className="mx-auto h-dvh min-h-0 w-full overflow-hidden border-border-strong bg-bg-overlay sm:h-[calc(100dvh-32px)] sm:max-w-[1120px] sm:rounded-md sm:border sm:shadow-lg">
+      <SettingsWorkspace active section="runtime-data" runtime={runtime} onRefreshRuntime={onRefreshRuntime} />
+    </section>
+  </main>;
+}
+
+function SettingsWorkspace({ active, section, runtime, onRefreshRuntime }: { active: boolean; section: SettingsSection; runtime: RuntimeStatus; onRefreshRuntime: () => Promise<void> }) {
   const servers = useMcpStatusStore((state) => state.servers);
   const [activeSection, setActiveSection] = useState<SettingsSection>(section);
   const [snapshot, setSnapshot] = useState<ServerConfigSnapshot>();
@@ -154,10 +173,10 @@ export function SettingsDialog({ open, section = "models", onClose }: { open: bo
     }
   };
   useEffect(() => {
-    if (open) setActiveSection(section);
-  }, [open, section]);
+    if (active) setActiveSection(section);
+  }, [active, section]);
   useEffect(() => {
-    if (!open) {
+    if (!active) {
       reloadRequest.current += 1;
       setSnapshot(undefined);
       setAdapterCatalog(undefined);
@@ -167,6 +186,7 @@ export function SettingsDialog({ open, section = "models", onClose }: { open: bo
     }
     if (
       activeSection !== "updates"
+      && activeSection !== "runtime-data"
       && snapshot === undefined
       && adapterCatalog === undefined
       && !loading
@@ -174,24 +194,24 @@ export function SettingsDialog({ open, section = "models", onClose }: { open: bo
     ) {
       void reload();
     }
-  }, [open, activeSection, snapshot, adapterCatalog, loading, error]);
+  }, [active, activeSection, snapshot, adapterCatalog, loading, error]);
 
   const hasConfigData = snapshot !== undefined && adapterCatalog !== undefined;
-  return <DialogRoot open={open} onOpenChange={(next) => { if (!next) onClose(); }}><DialogContent size="x-large" className="overflow-hidden p-0"><DialogTitle className="sr-only">Settings</DialogTitle><DialogDescription className="sr-only">Configure ArchCode server settings and application updates.</DialogDescription><SettingsCloseButton onClose={onClose} />{hasConfigData
-    ? <SettingsBody snapshot={snapshot} adapterCatalog={adapterCatalog} servers={servers} onReload={reload} section={activeSection} onSectionChange={setActiveSection} reloading={loading} reloadError={error} />
-    : activeSection === "updates"
-      ? <UpdatesOnlyWorkspace section={activeSection} onSelect={setActiveSection} />
+  return hasConfigData
+    ? <SettingsBody snapshot={snapshot} adapterCatalog={adapterCatalog} servers={servers} onReload={reload} runtime={runtime} onRefreshRuntime={onRefreshRuntime} section={activeSection} onSectionChange={setActiveSection} reloading={loading} reloadError={error} />
+    : activeSection === "updates" || activeSection === "runtime-data"
+      ? <IndependentSettingsWorkspace section={activeSection} onSelect={setActiveSection} runtime={runtime} onRefreshRuntime={onRefreshRuntime} />
       : <SettingsLoadState section={activeSection} onSelect={setActiveSection}>{error
         ? <><p role="alert" className="text-[13px] leading-5 text-error">{error}</p><button type="button" className="mt-3 h-8 rounded-sm bg-bg-active px-4 text-[12px] font-medium text-text-primary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand" onClick={() => { void reload(); }}>Retry</button></>
-        : "Loading settings…"}</SettingsLoadState>}</DialogContent></DialogRoot>;
+        : "Loading settings…"}</SettingsLoadState>;
 }
 
-function SettingsSidebar({ section, onSelect, invalidProfileCount = 0 }: { section: SettingsSection; onSelect: (section: SettingsSection) => void; invalidProfileCount?: number }) {
-  return <aside className="flex shrink-0 flex-col border-b border-border-subtle bg-bg-surface sm:w-52 sm:border-b-0 sm:border-r"><div className="border-b border-border-subtle px-4 py-4"><h2 className="text-[16px] font-semibold leading-[22px] text-text-primary">Settings</h2><p className="mt-1 text-[11px] leading-4 text-text-tertiary">Server and application</p></div><SettingsNavigation activeSection={section} onSelect={onSelect} invalidProfileCount={invalidProfileCount} /></aside>;
+export function SettingsSidebar({ section, onSelect, invalidProfileCount = 0, recoveryMode = false }: { section: SettingsSection; onSelect: (section: SettingsSection) => void; invalidProfileCount?: number; recoveryMode?: boolean }) {
+  return <aside className="flex shrink-0 flex-col border-b border-border-subtle bg-bg-surface sm:w-52 sm:border-b-0 sm:border-r"><div className="border-b border-border-subtle px-4 py-4"><h2 className="text-[16px] font-semibold leading-[22px] text-text-primary">Settings</h2><p className="mt-1 text-[11px] leading-4 text-text-tertiary">Server and application</p></div><SettingsNavigation activeSection={section} onSelect={onSelect} invalidProfileCount={invalidProfileCount} recoveryMode={recoveryMode} /></aside>;
 }
 
-function UpdatesOnlyWorkspace({ section, onSelect }: { section: SettingsSection; onSelect: (section: SettingsSection) => void }) {
-  return <div className="flex h-full min-h-0 flex-col sm:flex-row"><SettingsSidebar section={section} onSelect={onSelect} /><main className="min-h-0 flex-1 overflow-y-auto bg-bg-base px-5 py-5 sm:px-6"><SettingsUpdatesPanel /></main></div>;
+function IndependentSettingsWorkspace({ section, onSelect, runtime, onRefreshRuntime }: { section: SettingsSection; onSelect: (section: SettingsSection) => void; runtime: RuntimeStatus; onRefreshRuntime: () => Promise<void> }) {
+  return <div className="flex h-full min-h-0 flex-col sm:flex-row"><SettingsSidebar section={section} onSelect={onSelect} /><main className="min-h-0 min-w-0 flex-1 overflow-y-auto bg-bg-base px-5 py-5 sm:px-6">{section === "updates" ? <SettingsUpdatesPanel /> : <SettingsRuntimeDataPanel runtime={runtime} onRefreshRuntime={onRefreshRuntime} />}</main></div>;
 }
 
 function SettingsLoadState({ section, onSelect, children }: { section: SettingsSection; onSelect: (section: SettingsSection) => void; children: ReactNode }) {
diff --git a/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx b/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
new file mode 100644
index 00000000..7cedcf1e
--- /dev/null
+++ b/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
@@ -0,0 +1,178 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { JSDOM } from "jsdom";
+
+let dom: JSDOM;
+let root: Root;
+let container: HTMLDivElement;
+
+beforeEach(() => {
+  dom = new JSDOM("<!doctype html><html><body></body></html>", { url: "http://localhost", pretendToBeVisual: true });
+  for (const [name, value] of Object.entries({
+    window: dom.window,
+    document: dom.window.document,
+    navigator: dom.window.navigator,
+    Node: dom.window.Node,
+    NodeFilter: dom.window.NodeFilter,
+    Element: dom.window.Element,
+    HTMLElement: dom.window.HTMLElement,
+    HTMLButtonElement: dom.window.HTMLButtonElement,
+    HTMLInputElement: dom.window.HTMLInputElement,
+    DocumentFragment: dom.window.DocumentFragment,
+    Event: dom.window.Event,
+    CustomEvent: dom.window.CustomEvent,
+    MouseEvent: dom.window.MouseEvent,
+    PointerEvent: dom.window.PointerEvent ?? dom.window.MouseEvent,
+    MutationObserver: dom.window.MutationObserver,
+    getComputedStyle: dom.window.getComputedStyle.bind(dom.window),
+    IS_REACT_ACT_ENVIRONMENT: true,
+  })) Object.defineProperty(globalThis, name, { configurable: true, value });
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+});
+
+afterEach(() => {
+  act(() => root.unmount());
+  dom.window.close();
+});
+
+function inspectionResponse() {
+  return {
+    projects: [{
+      projectSlug: "broken",
+      name: "Broken",
+      workspace: "/work/broken",
+      runtimePath: "/work/broken/.archcode/runtime",
+      stats: { fileCount: 4, totalBytes: 2048 },
+      issues: [{ relativePath: "todos/state.json", reason: "invalid_json" }],
+    }],
+  };
+}
+
+async function renderPanel(onRefreshRuntime = async () => {}) {
+  const { SettingsRuntimeDataPanel } = await import("./SettingsRuntimeDataPanel");
+  await act(async () => {
+    root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Runtime failed safely", recoveryAllowed: true } }} onRefreshRuntime={onRefreshRuntime} />);
+    await Promise.resolve();
+    await Promise.resolve();
+  });
+  act(() => (container.querySelector('input[type="checkbox"]') as HTMLInputElement).click());
+  await act(async () => {
+    [...container.querySelectorAll("button")].find((button) => button.textContent === "Delete runtime data")!.click();
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+describe("Settings Runtime Data interactions", () => {
+  test("cancels the irreversible confirmation without deleting", async () => {
+    const requests: Array<{ url: string; method?: string }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
+      requests.push({ url, method: init?.method });
+      return Response.json(inspectionResponse());
+    }) });
+
+    await renderPanel();
+
+    expect(document.body.textContent).toContain("Permanently delete Runtime data?");
+    expect(document.body.textContent).toContain("Sessions, Todos, Automations, HITL requests, permissions, attachments, and project memory");
+    expect(document.body.textContent).toContain("~/.archcode/config.json");
+    act(() => [...document.body.querySelectorAll("button")].find((button) => button.textContent === "Cancel")!.click());
+
+    expect(requests.filter((request) => request.method === "DELETE")).toHaveLength(0);
+    expect(document.body.textContent).not.toContain("Permanently delete Runtime data?");
+  });
+
+  test("prevents duplicate deletion and announces a per-project failure", async () => {
+    let resolveDelete!: (response: Response) => void;
+    const pendingDelete = new Promise<Response>((resolve) => { resolveDelete = resolve; });
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
+      requests.push({ url, init });
+      if (init?.method === "DELETE") return pendingDelete;
+      return Response.json(inspectionResponse());
+    }) });
+    const onRefreshRuntime = mock(async () => {});
+
+    await renderPanel(onRefreshRuntime);
+    const confirm = [...document.body.querySelectorAll("button")].find((button) => button.textContent === "Delete permanently") as HTMLButtonElement;
+    act(() => confirm.click());
+    expect([...document.body.querySelectorAll("button")].find((button) => button.textContent === "Deleting…")?.hasAttribute("disabled")).toBe(true);
+    act(() => confirm.click());
+    expect(requests.filter((request) => request.init?.method === "DELETE")).toHaveLength(1);
+    expect(JSON.parse(String(requests.find((request) => request.init?.method === "DELETE")?.init?.body))).toEqual({ projectSlugs: ["broken"] });
+
+    await act(async () => {
+      resolveDelete(Response.json({
+        results: [{ projectSlug: "broken", status: "error", error: { code: "delete_failed", message: "Permission denied" } }],
+        runtime: { state: "error", error: { message: "Runtime still cannot start", recoveryAllowed: true } },
+      }));
+      await pendingDelete;
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect([...container.querySelectorAll('[role="alert"]')].some((alert) => alert.textContent?.includes("Permission denied"))).toBe(true);
+    expect(container.textContent).toContain("Runtime still cannot start");
+    expect(onRefreshRuntime).toHaveBeenCalledTimes(1);
+    expect(document.activeElement?.textContent).toBe("Runtime Data");
+  });
+
+  test("refetches inspection and Bootstrap state after a successful deletion", async () => {
+    let inspectionCalls = 0;
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
+      requests.push({ url, init });
+      if (init?.method === "DELETE") {
+        return Response.json({
+          results: [{ projectSlug: "broken", status: "deleted" }],
+          runtime: { state: "ready" },
+        });
+      }
+      inspectionCalls += 1;
+      return Response.json(inspectionCalls === 1 ? inspectionResponse() : { projects: [] });
+    }) });
+    const onRefreshRuntime = mock(async () => {});
+
+    await renderPanel(onRefreshRuntime);
+    const confirm = [...document.body.querySelectorAll("button")].find((button) => button.textContent === "Delete permanently") as HTMLButtonElement;
+    await act(async () => {
+      confirm.click();
+      await Promise.resolve();
+      await Promise.resolve();
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+
+    expect(requests.filter((request) => request.init?.method === "DELETE")).toHaveLength(1);
+    expect(inspectionCalls).toBe(2);
+    expect(onRefreshRuntime).toHaveBeenCalledTimes(1);
+    expect(container.textContent).toContain("Runtime data deleted for 1 project");
+    expect(container.textContent).toContain("Runtime is ready");
+    expect(container.textContent).toContain("No registered project Runtime data was found");
+  });
+
+  test("shows the final Runtime error returned by deletion without waiting for Bootstrap refresh", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (_url: string, init?: RequestInit) => {
+      if (init?.method === "DELETE") return Response.json({
+        results: [{ projectSlug: "broken", status: "deleted" }],
+        runtime: { state: "error", error: { message: "Final Runtime activation failed", recoveryAllowed: true } },
+      });
+      return Response.json(inspectionResponse());
+    }) });
+    const onRefreshRuntime = mock(async () => {});
+
+    await renderPanel(onRefreshRuntime);
+    const confirm = [...document.body.querySelectorAll("button")].find((button) => button.textContent === "Delete permanently") as HTMLButtonElement;
+    await act(async () => {
+      confirm.click();
+      await Promise.resolve();
+      await Promise.resolve();
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+
+    expect(container.textContent).toContain("Runtime could not start");
+    expect(container.textContent).toContain("Final Runtime activation failed");
+    expect(onRefreshRuntime).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx b/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
new file mode 100644
index 00000000..15d1ad13
--- /dev/null
+++ b/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
@@ -0,0 +1,298 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { AlertTriangle, CheckCircle2, Database, RefreshCw, Trash2 } from "lucide-react";
+import type {
+  RuntimeDataInspectionResponse,
+  RuntimeDataProjectDeleteResult,
+  RuntimeDataProjectInspection,
+  RuntimeStatus,
+} from "@archcode/protocol";
+import { deleteRuntimeData, inspectRuntimeData, retryRuntime } from "../../api/runtime-data";
+import { DialogContent, DialogDescription, DialogRoot, DialogTitle } from "../ui/Dialog";
+
+const secondaryButton = "inline-flex min-h-8 items-center justify-center gap-2 rounded-sm bg-bg-active px-3 text-[12px] font-medium text-text-secondary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40 [@media(pointer:coarse)]:min-h-11";
+const dangerButton = "inline-flex min-h-8 items-center justify-center gap-2 rounded-sm bg-error px-3 text-[12px] font-semibold text-bg-overlay transition-colors duration-[var(--motion-hover)] hover:opacity-90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40 [@media(pointer:coarse)]:min-h-11";
+
+interface SettingsRuntimeDataPanelProps {
+  runtime: RuntimeStatus;
+  onRefreshRuntime: () => Promise<void>;
+}
+
+export function SettingsRuntimeDataPanel({
+  runtime,
+  onRefreshRuntime,
+}: SettingsRuntimeDataPanelProps) {
+  const [displayedRuntime, setDisplayedRuntime] = useState(runtime);
+  const [inspection, setInspection] = useState<RuntimeDataInspectionResponse>();
+  const [inspectionError, setInspectionError] = useState<string>();
+  const [loading, setLoading] = useState(true);
+  const [selected, setSelected] = useState<Set<string>>(() => new Set());
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+  const [retrying, setRetrying] = useState(false);
+  const [deleteResults, setDeleteResults] = useState<RuntimeDataProjectDeleteResult[]>([]);
+  const [actionMessage, setActionMessage] = useState<string>();
+  const [actionError, setActionError] = useState<string>();
+  const statusHeadingRef = useRef<HTMLHeadingElement>(null);
+
+  const loadInspection = useCallback(async () => {
+    setLoading(true);
+    setInspectionError(undefined);
+    try {
+      const next = await inspectRuntimeData();
+      setInspection(next);
+      const eligible = new Set(next.projects.filter((project) => project.issues.length > 0).map((project) => project.projectSlug));
+      setSelected((current) => new Set([...current].filter((slug) => eligible.has(slug))));
+    } catch (cause) {
+      setInspectionError(cause instanceof Error ? cause.message : "Unable to inspect Runtime data.");
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void loadInspection();
+  }, [loadInspection]);
+
+  useEffect(() => {
+    setDisplayedRuntime(runtime);
+    if (runtime.state === "error" && !runtime.error.recoveryAllowed) {
+      setSelected(new Set());
+      setConfirmOpen(false);
+    }
+  }, [runtime]);
+
+  const selectedProjects = useMemo(() => inspection?.projects.filter((project) => selected.has(project.projectSlug)) ?? [], [inspection, selected]);
+  const busy = deleting || retrying;
+  const runtimeUnavailable = displayedRuntime.state !== "ready";
+  const recoveryAllowed = displayedRuntime.state !== "error" || displayedRuntime.error.recoveryAllowed;
+
+  const retry = async () => {
+    if (busy || !recoveryAllowed) return;
+    setRetrying(true);
+    setActionMessage(undefined);
+    setActionError(undefined);
+    setDeleteResults([]);
+    try {
+      const nextRuntime = await retryRuntime();
+      setDisplayedRuntime(nextRuntime);
+      if (nextRuntime.state === "error") {
+        setActionError(nextRuntime.error.message);
+      } else if (nextRuntime.state === "ready") {
+        setActionMessage("Runtime is ready.");
+      } else {
+        setActionMessage("Runtime activation is in progress.");
+      }
+      await onRefreshRuntime();
+    } catch (cause) {
+      setActionError(cause instanceof Error ? cause.message : "Unable to retry Runtime.");
+      await onRefreshRuntime();
+    } finally {
+      setRetrying(false);
+      queueMicrotask(() => statusHeadingRef.current?.focus());
+    }
+  };
+
+  const confirmDelete = async () => {
+    if (deleting || !recoveryAllowed || selectedProjects.length === 0) return;
+    setDeleting(true);
+    setActionMessage(undefined);
+    setActionError(undefined);
+    setDeleteResults([]);
+    try {
+      const response = await deleteRuntimeData({ projectSlugs: selectedProjects.map((project) => project.projectSlug) });
+      setDeleteResults(response.results);
+      setDisplayedRuntime(response.runtime);
+      if (response.runtime.state === "error" && !response.runtime.error.recoveryAllowed) {
+        setSelected(new Set());
+      }
+      const failures = response.results.filter((result) => result.status === "error");
+      if (failures.length > 0) {
+        setActionError(`Runtime data could not be deleted for ${failures.length} ${failures.length === 1 ? "project" : "projects"}.`);
+      } else {
+        setActionMessage(`Runtime data deleted for ${response.results.length} ${response.results.length === 1 ? "project" : "projects"}. Runtime activation was retried automatically.`);
+        setSelected(new Set());
+      }
+      setConfirmOpen(false);
+      await Promise.all([loadInspection(), onRefreshRuntime()]);
+    } catch (cause) {
+      setActionError(cause instanceof Error ? cause.message : "Unable to delete Runtime data.");
+    } finally {
+      setDeleting(false);
+      queueMicrotask(() => statusHeadingRef.current?.focus());
+    }
+  };
+
+  return <section data-settings-section="runtime-data" className="space-y-5 pb-1">
+    <header className="border-b border-border-subtle pb-4">
+      <p className="mb-1 text-[11px] font-semibold uppercase tracking-[0.12em] text-text-tertiary">Server settings</p>
+      <h1 ref={statusHeadingRef} tabIndex={-1} className="text-[16px] font-semibold leading-[22px] text-text-primary">Runtime Data</h1>
+      <p className="mt-1 max-w-[72ch] text-[13px] leading-5 text-text-tertiary">Inspect project Runtime data and recover the same server process. Detected data issues are not necessarily the cause of the startup error.</p>
+    </header>
+
+    <RuntimeStatusCard runtime={displayedRuntime} retrying={retrying} onRetry={() => { void retry(); }} />
+
+    <div className="flex flex-wrap items-end justify-between gap-3">
+      <div>
+        <h2 className="text-[13px] font-semibold text-text-primary">Project Runtime data</h2>
+        <p className="mt-1 text-[11px] leading-4 text-text-tertiary">Only projects with detected issues can be selected. Nothing is selected by default.</p>
+      </div>
+      <button type="button" className={secondaryButton} disabled={loading || busy} onClick={() => { void loadInspection(); }}>
+        <RefreshCw size={13} aria-hidden="true" />{loading ? "Inspecting…" : "Inspect again"}
+      </button>
+    </div>
+
+    {loading && inspection === undefined
+      ? <p role="status" className="text-[13px] text-text-tertiary">Inspecting registered projects…</p>
+      : inspectionError
+        ? <div role="alert" className="rounded-sm border border-error/30 bg-error-muted px-3 py-3 text-[12px] leading-5 text-error">
+          <p>{inspectionError}</p>
+          <button type="button" className={`mt-2 ${secondaryButton}`} onClick={() => { void loadInspection(); }}>Retry inspection</button>
+        </div>
+        : inspection && inspection.projects.length === 0
+          ? <p className="rounded-sm border border-border-default bg-bg-surface px-4 py-4 text-[13px] leading-5 text-text-secondary">No registered project Runtime data was found.</p>
+          : inspection && <ul aria-label="Project Runtime data" className="divide-y divide-border-subtle overflow-hidden rounded-md border border-border-default bg-bg-surface">
+            {inspection.projects.map((project) => {
+              const hasIssues = project.issues.length > 0;
+              const selectable = hasIssues && runtimeUnavailable && recoveryAllowed && !busy;
+              return <li key={project.projectSlug} className="min-w-0 px-4 py-4">
+                <label className={`flex min-w-0 items-start gap-3 ${selectable ? "cursor-pointer" : "cursor-not-allowed"}`}>
+                  <input
+                    type="checkbox"
+                    className="mt-1 h-4 w-4 shrink-0 accent-brand focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand [@media(pointer:coarse)]:h-5 [@media(pointer:coarse)]:w-5"
+                    checked={selected.has(project.projectSlug)}
+                    disabled={!selectable}
+                    onChange={(event) => setSelected((current) => {
+                      const next = new Set(current);
+                      if (event.target.checked) next.add(project.projectSlug);
+                      else next.delete(project.projectSlug);
+                      return next;
+                    })}
+                    aria-describedby={`runtime-data-${project.projectSlug}-detail`}
+                  />
+                  <ProjectInspection project={project} runtimeReady={!runtimeUnavailable} recoveryAllowed={recoveryAllowed} />
+                </label>
+              </li>;
+            })}
+          </ul>}
+
+    {(actionMessage || actionError || deleteResults.length > 0) && <div
+      role={actionError ? "alert" : "status"}
+      aria-live={actionError ? "assertive" : "polite"}
+      className={`rounded-sm border px-3 py-3 text-[12px] leading-5 ${actionError ? "border-error/30 bg-error-muted text-error" : "border-success/30 bg-success-muted text-success"}`}
+    >
+      {actionError ?? actionMessage}
+      {deleteResults.some((result) => result.status === "error") && <ul className="mt-2 list-disc space-y-1 pl-5">
+        {deleteResults.filter((result) => result.status === "error").map((result) => <li key={result.projectSlug}><span className="font-mono">{result.projectSlug}</span>: {result.error?.message ?? "Delete failed"}</li>)}
+      </ul>}
+    </div>}
+
+    <div className="flex flex-wrap items-center justify-between gap-3 border-t border-border-subtle pt-4">
+      <p className="text-[11px] leading-4 text-text-tertiary">{selected.size === 0 ? "Select a project with detected issues to continue." : `${selected.size} ${selected.size === 1 ? "project" : "projects"} selected.`}</p>
+      <button type="button" className={dangerButton} disabled={!runtimeUnavailable || !recoveryAllowed || busy || selectedProjects.length === 0} onClick={() => setConfirmOpen(true)}>
+        <Trash2 size={13} aria-hidden="true" />Delete runtime data
+      </button>
+    </div>
+
+    <DeleteRuntimeDataDialog
+      open={confirmOpen}
+      projects={selectedProjects}
+      deleting={deleting}
+      onCancel={() => setConfirmOpen(false)}
+      onConfirm={() => { void confirmDelete(); }}
+    />
+  </section>;
+}
+
+function RuntimeStatusCard({ runtime, retrying, onRetry }: { runtime: RuntimeStatus; retrying: boolean; onRetry: () => void }) {
+  const isError = runtime.state === "error";
+  const isReady = runtime.state === "ready";
+  const recoveryAllowed = runtime.state !== "error" || runtime.error.recoveryAllowed;
+  return <section aria-labelledby="runtime-current-status" className={`rounded-sm border px-4 py-4 ${isError ? "border-error/30 bg-error-muted" : isReady ? "border-success/30 bg-success-muted" : "border-warning/30 bg-warning-muted"}`}>
+    <div className="flex flex-wrap items-start justify-between gap-3">
+      <div className="flex min-w-0 gap-3">
+        <span className={isError ? "text-error" : isReady ? "text-success" : "text-warning"} aria-hidden="true">
+          {isError ? <AlertTriangle size={18} /> : isReady ? <CheckCircle2 size={18} /> : <Database size={18} />}
+        </span>
+        <div className="min-w-0">
+          <h2 id="runtime-current-status" className="text-[13px] font-semibold text-text-primary">Runtime {isError ? "could not start" : isReady ? "is ready" : "is activating"}</h2>
+          {isError && <p role="alert" className="mt-1 break-words text-[12px] leading-5 text-error">{runtime.error.message}</p>}
+          {isError && !recoveryAllowed && <p className="mt-2 text-[12px] font-medium leading-5 text-text-primary">ArchCode must be restarted. Runtime cannot be retried and Runtime data cannot be deleted in this process.</p>}
+          {!isError && <p className="mt-1 text-[12px] leading-5 text-text-secondary">{isReady ? "Project work APIs are available." : "ArchCode is starting project work services."}</p>}
+        </div>
+      </div>
+      {!isReady && <button type="button" disabled={!recoveryAllowed || retrying || runtime.state === "activating"} className={secondaryButton} onClick={onRetry}><RefreshCw size={13} aria-hidden="true" />{retrying ? "Retrying…" : "Retry Runtime"}</button>}
+    </div>
+  </section>;
+}
+
+function ProjectInspection({ project, runtimeReady, recoveryAllowed }: { project: RuntimeDataProjectInspection; runtimeReady: boolean; recoveryAllowed: boolean }) {
+  const hasIssues = project.issues.length > 0;
+  return <span id={`runtime-data-${project.projectSlug}-detail`} className="min-w-0 flex-1">
+    <span className="flex min-w-0 flex-wrap items-center justify-between gap-x-3 gap-y-1">
+      <span className="min-w-0 text-[13px] font-semibold text-text-primary">{project.name}</span>
+      <span className={`text-[11px] font-medium ${hasIssues ? "text-error" : "text-success"}`}>{hasIssues ? `${project.issues.length} detected ${project.issues.length === 1 ? "issue" : "issues"}` : "No detected issues"}</span>
+    </span>
+    <span className="mt-2 block break-all font-mono text-[11px] leading-4 text-text-secondary">{project.workspace}</span>
+    <span className="mt-1 block break-all font-mono text-[11px] leading-4 text-text-tertiary">Runtime: {project.runtimePath}</span>
+    <span className="mt-1 block text-[11px] leading-4 text-text-tertiary">{project.stats.fileCount.toLocaleString()} {project.stats.fileCount === 1 ? "file" : "files"} · {formatBytes(project.stats.totalBytes)}</span>
+    {!hasIssues && <span className="mt-2 block text-[11px] leading-4 text-text-tertiary">This project cannot be selected because no current data issue was detected.</span>}
+    {hasIssues && runtimeReady && <span className="mt-2 block text-[11px] leading-4 text-text-tertiary">Deletion is available only while Runtime is unavailable.</span>}
+    {hasIssues && !runtimeReady && !recoveryAllowed && <span className="mt-2 block text-[11px] leading-4 text-text-tertiary">Deletion is unavailable until ArchCode is restarted.</span>}
+    {hasIssues && <ul className="mt-3 space-y-2" aria-label={`Detected issues for ${project.name}`}>
+      {project.issues.map((issue, index) => <li key={`${issue.relativePath}-${index}`} className="rounded-sm border border-error/20 bg-error-muted px-3 py-2">
+        <span className="block break-all font-mono text-[11px] leading-4 text-text-primary">{issue.relativePath}</span>
+        <span className="mt-1 block text-[11px] leading-4 text-error">{issueReason(issue.reason)}</span>
+        {issue.schemaIssues?.map((schemaIssue, schemaIndex) => <span key={schemaIndex} className="mt-1 block break-words text-[11px] leading-4 text-text-secondary">{schemaIssue.path.length > 0 ? `${schemaIssue.path.join(".")}: ` : ""}{schemaIssue.message}</span>)}
+      </li>)}
+    </ul>}
+  </span>;
+}
+
+function DeleteRuntimeDataDialog({ open, projects, deleting, onCancel, onConfirm }: { open: boolean; projects: RuntimeDataProjectInspection[]; deleting: boolean; onCancel: () => void; onConfirm: () => void }) {
+  return <DialogRoot open={open} onOpenChange={(next) => { if (!next && !deleting) onCancel(); }}>
+    <DialogContent size="large" onEscapeKeyDown={(event) => { if (deleting) event.preventDefault(); }} className="max-h-[calc(100dvh-32px)] overflow-y-auto p-0">
+      <div className="border-b border-border-subtle px-5 py-4 sm:px-6">
+        <DialogTitle className="text-[16px] font-semibold text-text-primary">Permanently delete Runtime data?</DialogTitle>
+        <DialogDescription className="mt-2 text-[12px] leading-5 text-text-secondary">This action cannot be undone. The following project Runtime directories will be deleted:</DialogDescription>
+      </div>
+      <div className="space-y-4 px-5 py-4 sm:px-6">
+        <ul className="space-y-3" aria-label="Runtime directories to delete">
+          {projects.map((project) => <li key={project.projectSlug} className="rounded-sm border border-border-default bg-bg-surface px-3 py-3">
+            <p className="text-[12px] font-semibold text-text-primary">{project.name}</p>
+            <p className="mt-1 break-all font-mono text-[11px] leading-4 text-text-secondary">{project.runtimePath}</p>
+          </li>)}
+        </ul>
+        <div className="rounded-sm border border-error/30 bg-error-muted px-3 py-3 text-[12px] leading-5 text-error">
+          <p className="font-semibold">You will permanently lose:</p>
+          <p>Sessions, Todos, Automations, HITL requests, permissions, attachments, and project memory.</p>
+        </div>
+        <div className="rounded-sm border border-border-default bg-bg-surface px-3 py-3 text-[12px] leading-5 text-text-secondary">
+          <p className="font-semibold text-text-primary">These remain unchanged:</p>
+          <p>Source files, <span className="font-mono">.git</span>, <span className="font-mono">.archcode/plans</span>, <span className="font-mono">.archcode/skills</span>, project registration, and <span className="font-mono">~/.archcode/config.json</span>.</p>
+        </div>
+      </div>
+      <div className="flex flex-wrap justify-end gap-2 border-t border-border-subtle bg-bg-surface px-5 py-3 sm:px-6">
+        <button type="button" className={secondaryButton} disabled={deleting} onClick={onCancel}>Cancel</button>
+        <button type="button" className={dangerButton} disabled={deleting || projects.length === 0} onClick={onConfirm}>{deleting ? "Deleting…" : "Delete permanently"}</button>
+      </div>
+    </DialogContent>
+  </DialogRoot>;
+}
+
+function issueReason(reason: RuntimeDataProjectInspection["issues"][number]["reason"]): string {
+  if (reason === "invalid_json") return "Invalid JSON";
+  if (reason === "invalid_current_schema") return "Does not match the current ArchCode data format";
+  return "Unreadable or unsafe to inspect";
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`;
+  const units = ["KB", "MB", "GB", "TB"];
+  let value = bytes / 1024;
+  let unit = units[0];
+  for (let index = 1; index < units.length && value >= 1024; index += 1) {
+    value /= 1024;
+    unit = units[index];
+  }
+  return `${value >= 10 ? value.toFixed(0) : value.toFixed(1)} ${unit}`;
+}
diff --git a/apps/web/src/components/features/SettingsUpdatesPanel.tsx b/apps/web/src/components/features/SettingsUpdatesPanel.tsx
index b0792554..c0c5b527 100644
--- a/apps/web/src/components/features/SettingsUpdatesPanel.tsx
+++ b/apps/web/src/components/features/SettingsUpdatesPanel.tsx
@@ -13,25 +13,25 @@ import { queryKeys } from "../../api/queries";
 const secondaryButtonClass = "inline-flex h-8 items-center justify-center gap-2 rounded-sm bg-bg-active px-3 text-[12px] font-medium text-text-secondary transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40";
 const primaryButtonClass = "inline-flex h-8 items-center justify-center gap-2 rounded-sm bg-brand px-3 text-[12px] font-medium text-bg-overlay transition-colors duration-[var(--motion-hover)] hover:bg-brand-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand disabled:cursor-not-allowed disabled:opacity-40";
 
-export function SettingsUpdatesPanel() {
+export function SettingsUpdatesPanel({ authorizationToken }: { authorizationToken?: string } = {}) {
   const queryClient = useQueryClient();
   const statusQuery = useQuery({
     queryKey: queryKeys.update,
-    queryFn: getUpdateStatus,
+    queryFn: () => getUpdateStatus(authorizationToken),
   });
   const applyStatus = (status: UpdateStatus) => {
     queryClient.setQueryData(queryKeys.update, status);
   };
   const check = useMutation({
-    mutationFn: checkForUpdate,
+    mutationFn: () => checkForUpdate(authorizationToken),
     onSuccess: applyStatus,
   });
   const install = useMutation({
-    mutationFn: installUpdate,
+    mutationFn: () => installUpdate(authorizationToken),
     onSuccess: applyStatus,
   });
   const restart = useMutation({
-    mutationFn: restartForUpdate,
+    mutationFn: () => restartForUpdate(authorizationToken),
     onSuccess: applyStatus,
   });
   useEffect(() => {
diff --git a/apps/web/src/components/features/settings-helpers.ts b/apps/web/src/components/features/settings-helpers.ts
index cf5c46f8..3b2753dd 100644
--- a/apps/web/src/components/features/settings-helpers.ts
+++ b/apps/web/src/components/features/settings-helpers.ts
@@ -2,7 +2,7 @@ import { BUILTIN_MCP_SERVER_NAMES } from "@archcode/protocol";
 import type { ServerConfig } from "../../api/config";
 import { ApiError } from "../../api/client";
 
-export type SettingsSection = "models" | "profiles" | "mcp" | "memory" | "github" | "security" | "updates";
+export type SettingsSection = "config-recovery" | "models" | "profiles" | "security" | "runtime-data" | "mcp" | "memory" | "github" | "updates";
 export type FieldErrors = Record<string, string>;
 
 export const PROFILE_NAMES = [
diff --git a/apps/web/src/components/features/settings-panels.tsx b/apps/web/src/components/features/settings-panels.tsx
index 44c338b4..8e7d6c0d 100644
--- a/apps/web/src/components/features/settings-panels.tsx
+++ b/apps/web/src/components/features/settings-panels.tsx
@@ -181,15 +181,28 @@ export function SettingsNavigation({
   activeSection,
   onSelect,
   invalidProfileCount = 0,
+  recoveryMode = false,
 }: {
   activeSection: SettingsSection;
   onSelect: (section: SettingsSection) => void;
   invalidProfileCount?: number;
+  recoveryMode?: boolean;
 }) {
-  const entries: Array<[SettingsSection, string]> = [["models", "Models"], ["profiles", "Profiles"], ["security", "Security"], ["mcp", "MCP"], ["memory", "Memory"], ["github", "GitHub"], ["updates", "About & Updates"]];
+  const entries: Array<[SettingsSection, string]> = [
+    ...(recoveryMode ? [["config-recovery", "Config Recovery"]] as Array<[SettingsSection, string]> : []),
+    ["models", "Models"],
+    ["profiles", "Profiles"],
+    ["security", "Security"],
+    ["runtime-data", "Runtime Data"],
+    ["mcp", "MCP"],
+    ["memory", "Memory"],
+    ["github", "GitHub"],
+    ["updates", "About & Updates"],
+  ];
   return <nav aria-label="Settings sections" className="grid grid-cols-3 gap-1 px-3 py-3 sm:flex sm:flex-col sm:px-3">
     <p className="col-span-3 px-3 pb-2 pt-1 text-[11px] font-semibold uppercase tracking-[0.12em] text-text-tertiary">Server</p>
     {entries.map(([id, label]) => {
+      const disabled = recoveryMode && id !== "config-recovery" && id !== "updates";
       const showsInvalidProfiles = id === "profiles" && invalidProfileCount > 0;
       const attentionMessage = showsInvalidProfiles
         ? `${invalidProfileCount} variant ${invalidProfileCount === 1 ? "reference needs" : "references need"} attention`
@@ -198,11 +211,14 @@ export function SettingsNavigation({
         key={id}
         type="button"
         onClick={() => onSelect(id)}
+        disabled={disabled}
         aria-current={id === activeSection ? "page" : undefined}
-        aria-label={attentionMessage === undefined ? undefined : `${label}, ${attentionMessage}`}
-        title={attentionMessage}
+        aria-label={disabled
+          ? `${label}, unavailable until the global configuration is valid`
+          : attentionMessage === undefined ? undefined : `${label}, ${attentionMessage}`}
+        title={disabled ? "Unavailable until the global configuration is valid" : attentionMessage}
         data-invalid-count={showsInvalidProfiles ? invalidProfileCount : undefined}
-        className={`relative min-w-0 rounded-sm px-3 py-2 text-left text-[12px] font-medium transition-colors duration-[var(--motion-hover)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-brand ${id === activeSection ? "bg-brand-subtle text-brand before:absolute before:bottom-2 before:left-0 before:top-2 before:w-0.5 before:rounded-full before:bg-brand" : "text-text-secondary hover:bg-bg-hover hover:text-text-primary"}`}
+        className={`relative min-w-0 rounded-sm px-3 py-2 text-left text-[12px] font-medium transition-colors duration-[var(--motion-hover)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-brand disabled:cursor-not-allowed disabled:text-text-muted ${id === activeSection ? "bg-brand-subtle text-brand before:absolute before:bottom-2 before:left-0 before:top-2 before:w-0.5 before:rounded-full before:bg-brand" : disabled ? "" : "text-text-secondary hover:bg-bg-hover hover:text-text-primary"}`}
       >
         <span className="flex items-center justify-between gap-2">
           <span>{label}</span>
@@ -363,20 +379,24 @@ export function SettingsProfilesPanel({ config, onChange, errors, onJsonValidati
   </section>;
 }
 
-export function SettingsMcpPanel({ config, servers, onChange, errors = {} }: { config: ServerConfig; servers: Record<string, McpServerStatus>; onChange: (config: ServerConfig) => void; errors?: FieldErrors }) {
+export function SettingsMcpPanel({ config, servers, onChange, errors = {}, runtimeAvailable = true }: { config: ServerConfig; servers: Record<string, McpServerStatus>; onChange: (config: ServerConfig) => void; errors?: FieldErrors; runtimeAvailable?: boolean }) {
   const custom = Object.entries(config.mcp?.servers ?? {}).filter(([name]) => !BUILT_IN_MCP_NAMES.includes(name as typeof BUILT_IN_MCP_NAMES[number]));
   const all = [...BUILT_IN_MCP_NAMES.map((name) => [name, undefined] as const), ...custom];
   return <section className="space-y-5 pb-1"><PanelHeader title="MCP servers" description="Configuration and discovery status are shown together for built-in and custom servers." />
     <div className="overflow-hidden rounded-md border border-border-default bg-bg-surface divide-y divide-border-subtle">
     {all.map(([name, server]) => {
-      const status = servers[name];
+      const status = runtimeAvailable ? servers[name] : undefined;
       const builtIn = BUILT_IN_MCP_NAMES.includes(name as typeof BUILT_IN_MCP_NAMES[number]);
-      const statusMeta = MCP_STATUS_META[status?.state ?? "unreported"];
+      const statusMeta = runtimeAvailable ? MCP_STATUS_META[status?.state ?? "unreported"] : {
+        label: "Unavailable",
+        dotClass: "bg-text-muted",
+        badgeClass: "border-border-default bg-bg-elevated text-text-tertiary",
+      };
       return <article key={name} className="px-4 py-4 transition-colors duration-[var(--motion-hover)] hover:bg-bg-hover/40">
         <div className="flex items-start justify-between gap-3">
           <div className="min-w-0">
             <h2 className="truncate font-mono text-sm">{name}</h2>
-            <p className={`mt-1 text-xs ${status?.state === "failed" ? "text-error" : "text-text-tertiary"}`}>{describeStatus(status)}</p>
+            <p className={`mt-1 text-xs ${status?.state === "failed" ? "text-error" : "text-text-tertiary"}`}>{runtimeAvailable ? describeStatus(status) : "Unavailable while Runtime is offline"}</p>
           </div>
           <div className="flex shrink-0 flex-wrap items-center justify-end gap-2">
             {builtIn && <span className="rounded-sm bg-bg-active px-2 py-1 text-[11px] font-medium text-text-tertiary">Built-in</span>}
diff --git a/apps/web/src/main.tsx b/apps/web/src/main.tsx
index 75429db5..4debe686 100644
--- a/apps/web/src/main.tsx
+++ b/apps/web/src/main.tsx
@@ -44,31 +44,25 @@ function App() {
 
   setGlobalToastCallback(show);
 
-  return <BootstrapGate onAuthInvalidated={clearQueryCache}>
-    <WorkbenchProviders toasts={toasts} onDismiss={dismiss} />
-  </BootstrapGate>;
+  return <QueryClientProvider client={queryClient}>
+    <SettingsModalProvider>
+      <ErrorBoundary>
+        <BootstrapGate onAuthInvalidated={clearQueryCache}>
+          <WorkbenchProviders />
+        </BootstrapGate>
+      </ErrorBoundary>
+      <ToastContainer toasts={toasts} onDismiss={dismiss} />
+    </SettingsModalProvider>
+  </QueryClientProvider>;
 }
 
-function WorkbenchProviders({
-  toasts,
-  onDismiss,
-}: {
-  toasts: ReturnType<typeof useToast>["toasts"];
-  onDismiss: ReturnType<typeof useToast>["dismiss"];
-}) {
+function WorkbenchProviders() {
   return (
-    <QueryClientProvider client={queryClient}>
-      <GlobalSSEProvider>
-        <AddProjectModalProvider>
-          <SettingsModalProvider>
-            <ErrorBoundary>
-              <RouterProvider router={router} />
-            </ErrorBoundary>
-            <ToastContainer toasts={toasts} onDismiss={onDismiss} />
-          </SettingsModalProvider>
-        </AddProjectModalProvider>
-      </GlobalSSEProvider>
-    </QueryClientProvider>
+    <GlobalSSEProvider>
+      <AddProjectModalProvider>
+        <RouterProvider router={router} />
+      </AddProjectModalProvider>
+    </GlobalSSEProvider>
   );
 }
 
diff --git a/design-system/pages/settings.md b/design-system/pages/settings.md
new file mode 100644
index 00000000..80fa3315
--- /dev/null
+++ b/design-system/pages/settings.md
@@ -0,0 +1,117 @@
+# Settings Page Overrides
+
+This file defines Settings-only behavior. All visual language, semantic tokens,
+motion, typography, and accessibility rules continue to come from
+[`../MASTER.md`](../MASTER.md).
+
+## Product Role
+
+Settings is one shared workspace with three presentations:
+
+- while Runtime is ready, it opens in the existing bounded dialog;
+- while Runtime activation has failed, the same workspace fills the page and
+  opens on `Runtime Data` after authentication.
+- while the global Config is invalid, a terminal-grant-protected full-page
+  Settings shell opens on `Config Recovery`.
+
+The recovery presentation is not a separate error page. Its navigation keeps
+Models, Profiles, Security, Runtime Data, MCP, Memory, GitHub, and About &
+Updates reachable. About & Updates retains its existing panel, behavior, and
+copy and never suggests that updating preserves, repairs, or makes Runtime data
+compatible.
+
+## Config Recovery
+
+- An invalid global Config must not stop the HTTP server or Web shell. The
+  terminal prints a process-local `/config-recovery#token=...` URL; without
+  that grant, the Web UI explains how to reopen the terminal URL and exposes
+  no diagnostics or mutation.
+- The recovery shell uses the ordinary Settings sidebar. `Config Recovery` and
+  `About & Updates` are enabled; Models, Profiles, Security, Runtime Data, MCP,
+  Memory, and GitHub remain visible but disabled with the explanation
+  `Unavailable until the global configuration is valid`.
+- Show only the canonical Config path, server-produced safe structural
+  diagnostics, and server-offered bounded invalid-item choices. Choice IDs are
+  opaque; labels, structural paths, and impact text never expose Config record
+  keys, raw invalid values, credentials, or a browser Config editor.
+- `Preserve valid settings` is the primary destructive recovery path. Every
+  checkbox starts unselected. Its confirmation lists the selected invalid
+  entries, says their deletion is permanent, and explains that the server
+  writes only when the complete remaining Config passes current validation.
+  A failed candidate validation changes no bytes.
+- `Retry configuration` rereads the file in the same process. If valid, apply
+  authentication and continue to Runtime activation; if missing, continue to
+  Setup with the same terminal grant; if still invalid, retain the page and
+  refresh the safe diagnostics.
+- Put `Reset entire Config` in a visually separated, collapsed last-resort
+  region. Its dialog warns that valid Providers, Models, Profiles, MCP, Memory,
+  GitHub, and login/security settings will be lost, while project source, Git,
+  and project Runtime data remain. Confirmation requires typing exact `RESET`;
+  success opens the existing Setup UI with the same process-local grant.
+- Retry and Reset errors remain inline. Move focus to the `Config Recovery`
+  heading after a failed action; use a polite status for a completed invalid
+  retry and an alert for request failures.
+- Do not select entries automatically or guess replacements. Do not add
+  migration, backup, restore, legacy readers, an upgrade recommendation, or a
+  second Config format.
+
+## Runtime Data
+
+- Place `Runtime Data` in the existing `Server` navigation group.
+- Show the current Runtime state and its safe startup error summary in a
+  distinct status region. Data inspection results appear below it and must not
+  be described as the cause of the startup error.
+- Each project row shows project name, workspace, Runtime directory, file count,
+  byte size, and every detected relative file issue with a textual reason.
+- All project checkboxes start unselected. A project without a current detected
+  issue is disabled and cannot be selected.
+- `Retry Runtime` is a secondary action. `Delete runtime data` is the only
+  visually primary destructive action and remains disabled until at least one
+  eligible project is selected.
+- Inspection loading, empty, failed, delete-pending, per-project delete failure,
+  retry-pending, retry-success, and retry-failure states remain in context and
+  use text or an icon in addition to color.
+
+## Irreversible Delete Confirmation
+
+The confirmation dialog lists every selected project and exact Runtime
+directory. It states that deletion permanently removes Sessions, Todos,
+Automations, HITL requests, permissions, attachments, and project memory. It
+also states that source files, `.git`, `.archcode/plans`, `.archcode/skills`,
+project registration, and `~/.archcode/config.json` remain.
+
+Deletion is irreversible. Do not offer Undo, backup, migration, file-level
+repair, or arbitrary-path controls. Cancel sends no request. Confirm disables
+both actions while pending and prevents duplicate submission. On completion,
+move focus to the Runtime Data status heading and announce the result through a
+polite live region; destructive and request errors use an alert.
+
+## Runtime-Unavailable Section Behavior
+
+- Config-backed sections use the control-plane Config API. Saving while Runtime
+  is unavailable says only that the configuration was saved and directs the
+  user to `Retry Runtime`; it never says changes were applied live.
+- Runtime Data and About & Updates do not wait for Config or MCP data before
+  rendering.
+- MCP configuration remains editable from Config. Live discovery status shows
+  `Unavailable while Runtime is offline` instead of failing the Settings
+  workspace or implying that an MCP server itself failed.
+- Security and About & Updates preserve their existing independent behavior.
+
+## Layout And Accessibility
+
+- Desktop uses the existing 208px Settings navigation and scrolling content
+  column. The full-page recovery workspace is centered within the available
+  viewport but uses the full height required for safe action placement.
+- At narrow widths the navigation becomes the existing compact grid above the
+  content. Project identity, Runtime paths, issue text, and confirmation content
+  wrap; the document never scrolls horizontally.
+- Keep the action footer in normal flex layout with wrapping. It must remain
+  reachable at 390, 760, 1024, and 1440px and must not cover content.
+- Use semantic headings, lists, labels, native checkboxes and buttons. The
+  selected state is announced by the checkbox; disabled healthy projects expose
+  a textual explanation.
+- All controls retain visible focus rings and at least 44px hit areas on coarse
+  pointers. Dialog Escape and Cancel remain available until deletion begins.
+- Light and dark modes use existing semantic tokens. No page-local colors,
+  decorative animation, or new prototype are introduced.
diff --git a/docs/goals/runtime-control-plane-recovery-plan-goal.md b/docs/goals/runtime-control-plane-recovery-plan-goal.md
new file mode 100644
index 00000000..82e89049
--- /dev/null
+++ b/docs/goals/runtime-control-plane-recovery-plan-goal.md
@@ -0,0 +1,192 @@
+# Runtime Control Plane Recovery Plan Goal
+
+> 本文定义 Runtime 启动故障隔离、人工数据清理与无效全局 Config 恢复的实施、验收契约；实施状态与证据始终单独记录。
+
+## Objective
+
+将 Server 控制面与 `AgentRuntime` 生命周期彻底解耦：全局配置有效时，即使 Runtime 因项目持久化数据损坏、格式不符合当前严格 schema 或其他启动阶段错误而激活失败，HTTP、认证、完整 Settings、配置管理和现有升级功能仍然可用。已认证用户直接进入完整 Settings，并在新增的 `Runtime Data` 页面查看检测到的损坏或不符合当前格式的数据、手动选择项目并删除其整个 `.archcode/runtime/`，随后由同一进程重新激活 Runtime。
+
+经后续 review 批准，控制面还必须覆盖无效全局 Config：进程继续提供 Web 与 Updates，通过终端一次性凭证进入 Settings 的 `Config Recovery`。首选恢复方式是用户勾选服务端识别出的无效配置项；服务端删除所选项后必须对完整候选 Config 做当前严格校验，只有完全有效才原子写入，从而保留其余有效的模型、Profile、MCP 与安全配置。用户也可外部修复后同进程 Retry；删除整个 Config 仅作为要求输入 `RESET` 的最后手段并进入现有 Setup。
+
+升级只负责升级，保持现有 `About & Updates` 界面与文案；不得把升级与 Runtime 数据保留、检查或删除建立产品依赖。
+
+## Locked Architecture
+
+```text
+ServerHost control plane (always available after valid Config activation)
+  ├─ health / bootstrap / auth
+  ├─ config / updates
+  ├─ token-protected config recovery
+  ├─ runtime status + retry
+  ├─ runtime-data inspect + delete
+  └─ embedded Web assets
+
+AgentRuntime plane (only when activation succeeds)
+  └─ projects / sessions / todos / automations / HITL / tools / MCP / SSE
+```
+
+- `ServerHost` 分别拥有控制面状态与 Runtime 状态。有效配置先激活认证，再尝试 Runtime；Runtime 失败不能把控制面降级为不可用。
+- HTTP listener 必须在 Runtime 激活前完成绑定；`ServerHost.create()` 只构造控制面，`bootServer()` 先发布 health、bootstrap、auth、Settings 与静态资源，再异步启动 Runtime。Runtime 激活缓慢、挂起或失败都不得延迟控制面的首个可用响应。
+- `BootstrapStatus` 的 ready 状态显式携带 `runtime: activating | ready | error`。删除顶层 `startup_error` 模式及其只提供 `Retry` 的阻塞页面，不保留 alias、双协议或 fallback。
+- Config routes 从 `createRuntimeApp()` 移到 ServerHost 控制面；Update routes 去除 Runtime-ready 前置条件。Runtime-backed API 在 Runtime 不可用时继续明确返回 `503`。
+- Runtime 重试由 ServerHost 串行化；任一时刻最多一次激活。每次激活都通过 Config service 重新读取磁盘上的当前有效配置并取得新的 `ServerConfigActivation`，绝不缓存复用旧 activation；Config PUT、Runtime Data 删除和 Runtime 激活进入同一个 Host 串行 mutation boundary。失败的半成品 Runtime 必须完整 shutdown 后才能记录错误或再次重试，成功后再原子替换 Runtime app。
+- 首次 Setup 的 Config 一旦成功提交，Setup grant 即消费，认证立即生效；随后 Runtime 激活失败只产生 ready 控制面加 `runtime.error`，不能把已提交的 Setup 当作整体失败。需要认证时仍签发本次 Setup session，Web 直接进入完整 Settings 恢复界面。
+- `packages/agent-core/src/runtime-data/` 新增一个窄的 Runtime 数据服务，直接复用各领域的当前严格 schema，不复制 schema，不引入通用 validator registry、数据版本或 migration framework。
+- 首版只检查用户可以通过整项目 Runtime 删除处理的五类严格 JSON 权威文件：
+  - `sessions/*/session.json`
+  - `todos/state.json`
+  - `automations/state.json`
+  - `hitl-queue.json`
+  - `permissions.json`
+- 这些检查结果只表达“检测到损坏或不符合当前格式的数据”，与 Runtime 启动错误摘要分开展示；不得声称每条问题都是本次启动失败的直接原因。缺失文件按该领域当前的空状态语义处理；结果只区分 `invalid_json`、`invalid_current_schema` 和 `unreadable`。schema 不匹配不得猜测由哪个版本产生，也不展示原始持久化内容或 secret-bearing values。
+- 删除粒度固定为注册项目的整个 `<workspace>/.archcode/runtime/`。请求只接受 `projectSlug` 集合，路径由服务端通过 `projectRuntimePath()` 解析；客户端不得提交任意文件路径。
+- 检查和统计全程 no-follow；Runtime 树中任一被检查的文件、目录或统计遍历项是 symlink 时，记录脱敏的 `unreadable` 问题且绝不读取其目标。
+- Runtime Data 删除只在 Runtime 不可用且该项目当前存在检测问题时开放。删除前重新检查，并拒绝 workspace、`.archcode`、`runtime` 或 Runtime 后代中任一路径为 symlink、异常文件类型或解析后越界的目标。
+- 一次删除命令全部成功后重新检查并自动重试 Runtime 一次；任一项目删除失败则不重试，返回逐项目错误。重试成功进入工作台，失败继续停留在 Settings 并显示最新问题。
+
+## User Experience
+
+- Runtime 失败且认证完成后，页面直接显示完整 Settings workspace，默认选中 `Runtime Data`；不是只显示一个升级按钮或孤立错误页。
+- Settings 侧栏在现有 `Server` 分组中增加 `Runtime Data`，`About & Updates` 仍使用现有面板、行为和文案。其他 Settings 页面也保持可导航。
+- Runtime Data 顶部单独显示 Runtime 当前状态与安全的启动错误摘要；下方数据检查结果不标注为启动根因。项目列表显示项目名、workspace、Runtime 路径、数据大小/文件数，以及失败的相对文件和原因。
+- checkbox 默认全部未选中；只允许选择当前存在检测问题的项目。页面只有一个主要破坏性动作 `Delete runtime data`。
+- 确认对话框逐项列出将删除的项目与目录，并明确说明会丢失 Sessions、Todos、Automations、HITL、permissions、attachments 和 project memory；同时明确源码、`.git`、`.archcode/plans`、`.archcode/skills`、项目注册信息与 `~/.archcode/config.json` 不受影响。
+- 删除不可撤销，不伪装成可恢复操作，也不提供虚假的 Undo。加载、删除、重试和逐项目失败必须就地显示；状态不能只靠颜色表达。
+- Runtime Data 提供次要动作 `Retry Runtime`，用于无数据问题或用户保存 Settings 配置后的重新激活；配置保存成功时不得在 Runtime 不可用状态下宣称“applied live”。
+- 新增 `design-system/pages/settings.md` 记录上述 Settings 专属状态和布局规则；不改全局视觉语言，也不为这个方向明确的常规 Settings 扩展创建 HTML prototype。
+- Config Recovery 默认提供 `Preserve valid settings`：安全条目全部默认未选，逐项说明删除影响，确认后仅提交 revision 与不透明条目 ID；候选完整校验不通过时明确告知“未作修改”。整个 Config 重置折叠到最后手段，强提醒有效的 Providers、Models、Profiles、MCP、Memory、GitHub 与登录/安全配置均会丢失，并要求输入精确 `RESET`。
+
+## Implementation Plan
+
+1. **硬切 Bootstrap 与 ServerHost 状态模型**
+   - 把 Host 构造、HTTP listener 绑定和 Runtime 启动拆成明确阶段：先构造并监听控制面，再异步请求 Runtime 激活；不得在 `main.ts` 或 `ServerHost.create()` 中 await Runtime 后才监听。
+   - 将 ready 控制面状态与 Runtime 子状态分开；删掉旧 `startup_error` Protocol、Host 和 Web 分支。
+   - 认证在有效配置后、Runtime 创建前激活；Runtime 激活、清理与重试集中由 ServerHost 串行拥有。首次 Setup 提交成功后的 Runtime failure 返回 ready + `runtime.error` 和应有的登录 session，不回滚 Config、不恢复 grant、不留下 500 死路。
+   - 将 Config routes 移出 Runtime app；Update access 仅依赖控制面认证与 mutation admission。没有 Runtime 时，update restart 只需确认不存在控制面 mutation/update 冲突，不再返回 Runtime 503。
+   - Config save 和每次 Runtime activation 通过同一 Host mutation queue 排序；激活开始时调用 Config service 取得磁盘当前 revision 对应的新 activation，保存后的旧 activation 不得再次使用。
+   - Runtime-backed routes 继续通过一个明确 gate 分发，不把 Runtime nullable 判断散落进领域 routes。
+
+2. **建立窄的 Runtime 数据检查与删除服务**
+   - 为上述五类数据添加无副作用检查 adapter，直接调用当前领域 schema/codec；Session 目录结构、JSON parse 和 schema issue 都返回稳定、脱敏的相对路径诊断，不把检测问题冒充实际启动 cause。
+   - 按 Project Registry 枚举项目并隔离检查失败；一个项目不可读不得隐藏其他项目结果。以 no-follow 遍历统计整个 Runtime 目录的文件数与字节数，但不解析 attachments 或 memory 内容；后代 symlink 只报告，不跟随。
+   - 删除命令验证注册项目、当前检测问题、固定路径 containment 和 symlink 安全后，递归删除整个 Runtime 目录；不注销项目，不触碰 Runtime 外数据。
+   - 增加只依赖该服务的 Protocol DTO 和控制面 routes；严格拒绝空集合、重复 slug、未知字段、未注册项目、健康项目和客户端路径。
+
+3. **实现同进程恢复闭环**
+   - ServerHost 协调“删除全部成功 → 重新检查 → Runtime 激活一次”，并返回每个删除结果及最终 Runtime 状态。
+   - 重试期间拒绝第二次 retry/delete，并与 Config save 串行；失败的 Runtime 完成 cleanup 后才解除 admission。普通 Runtime API 始终只看到最后一个完整成功实例。
+   - Runtime 失败日志保留完整内部 cause；API/UI 只返回安全摘要和 Runtime Data 服务生成的结构化问题，不回显持久化原文。
+
+4. **重构 Web 启动壳与 Settings**
+   - 将 Query、Toast 和 Settings 所需 provider 移到 BootstrapGate 外；Global SSE、项目 modal 与工作台 Router 只在 Runtime ready 时挂载。
+   - Runtime error 时复用同一个 Settings workspace 作为全屏恢复界面；Runtime ready 时仍通过现有 Settings dialog 打开同一内容组件，不复制两套页面逻辑。
+   - 让 Settings 各 section 明确声明数据依赖：`Runtime Data` 与 `About & Updates` 不等待 Config/MCP；配置页面使用控制面 Config API；MCP 实时状态在 Runtime 不可用时明确显示 unavailable，而不是拖垮 Settings。
+   - 实现选择、确认、pending、逐项目错误、手动/自动重试结果、键盘/focus 和窄屏行为；Runtime 不可用时 Config save 只显示已保存，并引导使用 `Retry Runtime`，不声称 live apply。同步 Settings page spec。
+
+5. **删除旧耦合并完成验证**
+   - 删除 Config route 的 Runtime owner、Update 的 Runtime-ready gate、旧 Bootstrap startup-error blocking UI 及只服务这些旧路径的测试/helper。
+   - 不保留 feature flag、deprecated alias、双状态 reader 或墓碑测试；把仍有价值的行为覆盖迁移到新 owner。
+   - 通过 Agent Core、Server、Web interaction、真实浏览器和 production build 验收完整失败与恢复链。
+
+6. **补齐无效 Config 的最小恢复面**
+   - 将原 Setup 终端凭证重构为进程内 `TerminalGrant`，同一凭证可从 `Config Recovery` 延续到 Reset 后的 Setup；有效 Config 激活后立即消费，只出现在启动终端打印的 URL fragment 中，不写入 URL query、API DTO 或磁盘。
+   - `config_error` 保存服务端生成的脱敏结构诊断；Bootstrap 只返回通用提示。新增 token-protected GET/Retry/Reset，Retry 重读磁盘并切换到 ready、setup 或更新后的 config_error；整个 Config 的 Reset 只允许删除当前仍无效的 canonical Config，若文件已被并发修好则拒绝删除。
+   - Config Recovery 使用完整 Settings 壳；仅 `Config Recovery` 与原 `About & Updates` 可用，其余 Config/Runtime 依赖页面保留在导航中并明确 disabled。不得加入在线 JSON 编辑、自动修复、迁移、备份、fallback 或旧兼容层。
+
+7. **增加保留有效 Config 的人工选择恢复**
+   - Config service 从当前严格 schema/语义错误生成有限的删除目标；不允许删除必需的 `profiles`、`auth`，条目 ID 绑定文件 revision 且不包含原始 key/value。API/UI 只显示脱敏结构标签与精确影响范围。
+   - 用户提交非空、唯一的条目 ID 后，在同一 Config 写锁内重新读取并核对 revision，删除所选路径，执行完整 schema、语义交叉引用和 ModelRuntime prepare 校验。只有全部通过才以 `0600` 原子写入并同进程激活；任何 stale、未知、删除不足或仍无效结果均零写入。
+   - Web 默认不选任何条目，先展示保留有效设置的选择区，再保留外部修复 Retry。删除所选项有强提醒和二次确认；整个 Config Reset 被折叠并要求输入 `RESET`，不增加自动选择、自动修复、数据迁移或升级联动。
+
+## Non-goals
+
+- 不实现数据迁移、格式版本、legacy reader、双读双写、自动选择/自动修复、备份/恢复、Undo 或启动时自动删除；仅允许用户手动确认服务端给出的有限无效项。
+- 不实现文件级或数据类别级删除；不允许用户编辑 Runtime JSON，也不接收客户端任意路径。
+- 不隔离单个坏项目后让其他项目 Runtime 部分启动；首版仍是一个 AgentRuntime，失败时进入控制面恢复界面。
+- 不把 attachments、memory Markdown 或 cwd migration journal 建成通用健康检查系统；它们随项目 Runtime 整体删除，但不是首版启动前 schema 扫描对象。
+- 不改变 Project 关闭/注销语义，不删除 Project Registry，不触碰源码、Git、Plans、Skills 或全局配置。
+- 不改变现有 Updater 页面、升级文案、更新源、安装流程或版本选择逻辑，也不添加“想保留数据请先升级”。
+- 不提供在线 Config JSON 编辑器、自动 Config 修复、备份/恢复、迁移、legacy reader 或旧格式兼容；升级仍只负责升级。
+
+## Risks And Controls
+
+| 风险 | 控制方式 |
+|---|---|
+| 项目 Runtime 删除不可恢复 | 默认不选、逐项目确认、明确列出损失与保留范围；无自动删除、无假 Undo |
+| 路径穿越或 symlink 导致越界删除 | API 只收 slug；服务端固定解析、realpath/containment/lstat 校验，任何 symlink 或异常类型 fail closed |
+| 检查逻辑与生产 schema 漂移 | 直接复用领域当前 schema/codec，不复制字段，不建第二套兼容 schema |
+| Runtime retry 与删除/升级并发 | ServerHost 单一 admission 与串行激活；半成品先 shutdown，完成前不发布 Runtime app |
+| Config 保存后旧 activation 已失效 | Config save 与激活串行；每次激活从磁盘重新取得当前 revision 的新 activation，不缓存旧对象 |
+| 检测问题被误写成启动根因 | 启动错误与数据健康结果分区展示；DTO 和文案不声明因果，只允许用户显式选择 |
+| 诊断泄漏 Session 内容或密钥 | DTO 只含项目身份、相对路径、issue path/message 和统计；不返回原文或 raw invalid value |
+| 控制面解耦后误放开 Runtime API | Auth 与 origin checks 保持在控制面；Runtime route gate 独立测试 503/401/403 边界 |
+| 选择删除误伤有效 Config 或遇到并发外部修改 | 删除目标有边界且 ID 绑定 revision；服务端在同一写锁内重读、全量校验候选并仅在完全有效时原子写入，失败零修改 |
+
+## Acceptance Criteria
+
+以下 AC-01 至 AC-08 必须全部有代码、自动化测试或真实浏览器证据；任一缺失即为 `NOT_DONE`。
+
+### AC-01：控制面不再依赖 Runtime ready
+
+- 使用可控 deferred Runtime factory 阻塞激活：listener 已绑定期间 `/api/health`、embedded Web、Bootstrap 和认证必须可响应，Bootstrap 显示 `runtime.activating`；释放为失败后原地转为 `runtime.error`，不能要求进程重启。
+- 使用会在 `recoverSessionContinuations()` 或 `startAutomationSchedulers()` 失败的 Runtime fixture 启动 Host：`/api/health` 和 embedded Web 返回 200；有效凭据可登录；Bootstrap 返回 ready 控制面和 `runtime.error`，不返回旧 `startup_error`。
+- 在同一状态下，认证后的 Config GET/PUT、provider catalog、Security 与 Update GET/check/install 均到达各自服务，不能因 Runtime 缺失返回 `SERVER_NOT_READY`；未认证和跨 Origin mutation 仍按现有安全规则拒绝。
+- 首次 Setup 提交 Config 后让 Runtime fixture 失败：Config 逐字节保留、grant 已消费、Host 返回 ready + `runtime.error`；需要认证时响应签发有效 session，浏览器直接进入 Settings/Runtime Data，不出现 500 或要求重新 Setup。
+- 任一 Projects/Sessions/Todos/Automations/HITL/MCP/Runtime SSE API 在 Runtime 不可用时稳定返回 503；Runtime 成功后同一路由由唯一 Runtime app 处理。
+- production source 与 Protocol 中不存在旧 `startup_error` 分支、Config-in-Runtime route 或 Update 的 Runtime-ready 前置条件。
+
+### AC-02：检查结果准确、有限且脱敏
+
+- 自动化测试逐一覆盖五类被检查文件的合法、缺失、无效 JSON、当前 schema 不匹配和不可读状态；问题包含 projectSlug、workspace、Runtime path、相对文件、稳定分类与 schema issue，且不包含原始 JSON value、Session message 或 secret。
+- 多项目测试证明每个项目独立报告；一个项目读取失败时，其他项目的结果和统计仍完整返回。
+- Runtime 启动由项目 A 的 Session 失败触发、项目 B 仅有无效 Todo 时，UI/DTO 必须把启动错误与两个数据检查结果分开展示，不得把 B 标记为此次启动失败原因。
+- schema mismatch 文案只表达“不符合当前 ArchCode 数据格式”，不推断旧版、新版或具体产生版本。
+- Runtime 内 Session 目录 symlink、`session.json` symlink 和统计遍历 symlink fixture 均只产生脱敏问题；边界外 sentinel 不被读取、修改或删除。
+- 检查代码直接引用当前领域 schema/codec；代码审计不存在复制 schema、version field、migration registry 或 generic repair framework。
+
+### AC-03：删除边界与恢复结果确定
+
+- 删除 API 严格只接受非空、无重复的 `projectSlugs`；未知字段、未注册项目、健康项目、客户端 path 和 Runtime-ready 状态全部被拒绝且文件不变。
+- symlink、路径越界、非目录和权限失败 fixture 均 fail closed；不得删除 workspace、`.archcode` 或 Runtime 外任意文件。
+- 启用认证时，未登录 inspect/delete/retry 均返回 401；跨 Origin delete/retry 按现有 mutation-origin 规则拒绝。以上失败时目录内容、Runtime 状态和激活次数全部不变。
+- 成功删除后，所选项目 `.archcode/runtime/` 完全不存在；源码、`.git`、`.archcode/plans`、`.archcode/skills`、Project Registry、全局 Config 和未选项目逐字节不变。
+- 多项目命令全部删除成功时只自动激活 Runtime 一次；任一删除失败时激活次数为 0。激活成功返回 `runtime.ready`，激活失败完成 cleanup 并返回新的 `runtime.error`，不存在半发布 Runtime。
+- Runtime error 状态下先保存 Models/Profiles，再手动 retry 或成功删除：新 Runtime 使用磁盘最新 revision 对应的 Config，旧 activation 从未复用，且激活次数为 1；并发 Config save/delete/retry 按 Host mutation queue 确定排序。
+
+### AC-04：Settings 提供完整可操作的恢复界面
+
+- Runtime failure 且认证完成后，首屏是完整 Settings workspace并默认选中 `Runtime Data`；侧栏可进入 Models、Profiles、Security、MCP、Memory、GitHub 和现有 `About & Updates`，不出现只有 Retry/Upgrade 的阻塞页。
+- Runtime Data 覆盖 loading、无问题、多个问题、检查失败、删除 pending、部分删除失败、retry 成功和 retry 失败状态；checkbox 默认全不选，健康项目不可选，未选择时删除按钮 disabled。
+- 确认 dialog 精确列出所选项目、Runtime 目录、会丢失与会保留的数据；Cancel 不发请求，Confirm 在 pending 时防重复，完成后焦点与状态反馈可由键盘和 screen reader 感知。
+- `About & Updates` 继续渲染现有 `SettingsUpdatesPanel`，产品文案中不存在数据保留、Runtime 兼容或“先升级”提示。
+- light/dark 及 390、760、1024、1440px 下 Settings 无 document 水平滚动、主要操作不被遮挡；错误/选择/状态均不只靠颜色表达。
+
+### AC-05：严格重构且无过度设计
+
+- Runtime app 只组合 Runtime-backed routes；ServerHost 控制面集中拥有 auth/config/update/runtime-data/runtime lifecycle，Web 与 Protocol 仍不依赖 Server 或 Agent Core。
+- 生产代码中不存在旧启动错误 UI、旧状态兼容 reader、fallback route、feature flag、自动 migration/backup/restore、任意路径删除或文件级修复入口。
+- 不新增通用 Repository、validator registry、storage framework、项目级 Runtime 容错层或只被一个调用点包装的公共 manager。
+- 测试只证明新契约与关键安全边界，不增加只断言旧字段、旧页面或旧 endpoint 已死亡的墓碑测试。
+
+### AC-06：端到端验收与交付证据完整
+
+- 集成测试使用两个注册项目：一个写入当前 schema 不接受的 Session fixture、一个保持健康；验证 Host 仍可登录并打开 Settings、只删除坏项目 Runtime、保留两项目注册、同进程恢复为 Runtime ready，坏项目以空 Runtime 状态重新使用，健康项目数据不变。
+- 真实浏览器使用非 mock Server 完成：进入 Runtime Data、查看问题、默认未选、取消确认、确认删除、自动恢复并进入工作台；另验证 Update 页面在 Runtime error 状态可打开且界面无新增联动文案。
+- `bun run typecheck`、`bun run test`、`bun run build`、`git diff --check` 全部退出码为 0；浏览器 console error 为 0。
+- Reviewer 按 AC-01 至 AC-08 逐项给出文件、测试、命令和浏览器证据；不能以“测试通过”替代逐项验收，未执行项不得写成完成。
+
+### AC-07：无效 Config 可安全自助恢复
+
+- 无效 JSON、严格 schema 不匹配和不可读 Config 均不阻止 listener、Web、health 与 Bootstrap；终端打印 `/config-recovery#token=...`，无 grant 的 diagnostics、Retry、Reset 和 Updates 均为 401，跨 Origin mutation 为 403。
+- 恢复 API/UI 只显示 canonical Config path、脱敏结构 path 与通用原因；包含 unknown key、provider/model/server ID 或 secret sentinel 的原始内容不得出现在 Bootstrap、recovery DTO 或 DOM。
+- 用户外部修复文件后点击 Retry：同一进程激活认证并进入 ready + Runtime activating，grant 失效；文件被外部删除时，同一 grant 直接进入 Setup。
+- 整个 Config Reset 必须要求输入精确 `RESET`，并明确有效 Providers、Models、Profiles、MCP、Memory、GitHub 与登录/安全配置都会丢失；Cancel 零请求，Config 已并发修好时返回冲突且逐字节保留；成功后同一 grant 可使用 Setup，项目源码、Git 和 Runtime 数据不变。
+- Config Recovery 首屏使用完整 Settings shell，默认选中自身；仅自身与原 About & Updates 可操作，其他页面显示为带原因的 disabled。无在线编辑、自动修复、migration、backup、fallback 或 upgrade 联动。
+
+### AC-08：只删除人工确认的无效 Config 项并保留有效配置
+
+- 对可安全界定的 unknown field、Provider、Model、Variant、Provider option、MCP server、Memory 或 GitHub integration 错误，GET 返回 revision 及默认未选中的脱敏条目；ID 不含原始 key/value，DTO 与 DOM 不泄漏 provider/model/server ID 或 secret sentinel。可精确删除 `profiles`/`auth` 内的 unknown extra field，但必需 Profile/Auth 记录、无效必需值、无效 JSON 和不可读文件不得伪造可删除条目。
+- 删除请求严格只接受当前 revision、非空无重复的不透明 item ID 与固定 confirmation。无 grant 返回 401，跨 Origin 返回 403，未知字段/格式返回 400，stale 或未知 ID 返回 409；所有拒绝路径 Config 逐字节不变。
+- 服务端在单一写锁内重读同一 revision、仅删除所选路径，并对完整候选执行当前 strict schema、语义交叉引用和 ModelRuntime prepare。删除后仍存在任一错误时返回 422 且文件逐字节不变；完全有效时才以 `0600` 原子写入、保留所有未选配置并同进程进入 ready/Runtime activation。
+- Web 的选择项默认全不选，未选时操作 disabled；确认 dialog 列出所选项及影响，明确删除永久且“剩余 Config 完整有效才写入”。Cancel 零请求，pending 防重复。整个 Config Reset 位于分离的最后手段区域并要求输入 `RESET`。
+- 自动化测试至少证明：单个 invalid field 删除后 Provider secret、Models 与 Profiles 保留；只选多项错误的一部分返回 422 且 bytes unchanged；revision 并发变化、重复/未知 ID、不可删除 Profile 错误 fail closed。真实浏览器完成选择、取消、确认、恢复及 390/1440px、console error 0 验收。
diff --git a/docs/goals/runtime-control-plane-recovery-progress.md b/docs/goals/runtime-control-plane-recovery-progress.md
new file mode 100644
index 00000000..abb82f61
--- /dev/null
+++ b/docs/goals/runtime-control-plane-recovery-progress.md
@@ -0,0 +1,92 @@
+# Runtime Control Plane Recovery Progress
+
+> 本文只记录实施进度和验收证据；目标、架构与完成标准以 `runtime-control-plane-recovery-plan-goal.md` 为准。
+
+## Status
+
+- Goal: complete; AC-01 through AC-08 independently approved
+- Branch: `codex/runtime-control-plane-recovery`
+- Baseline: `f8ab13e6`
+- Started: 2026-08-04
+- Unrelated local files preserved: `.DS_Store`, `output/`
+
+## First-principles Corrections
+
+- 已补齐 listener-first 约束：控制面的成立条件是 HTTP 已经监听，而不只是 Host 内部保留 nullable Runtime。Host 构造与 listener 绑定不得等待 Runtime recovery 或 scheduler 启动。
+- Runtime Data 检测只描述当前数据健康，不推断启动因果或历史版本；升级功能保持独立。
+
+## Workstreams
+
+| Workstream | State | Evidence |
+|---|---|---|
+| Protocol and Runtime Data service | complete | Current-domain schemas reused directly; focused Runtime Data and architecture suites pass |
+| ServerHost control-plane split | complete | Listener-first activation, one Host mutation queue, control-plane routes and Runtime gate covered by Server integration tests |
+| Settings Runtime Data UI | complete | Shared recovery/dialog workspace, Runtime Data states, destructive confirmation and accessibility covered by Web unit/interaction tests |
+| Cross-layer integration | complete | Two registered projects, failed activation, selective deletion and same-process recovery covered in the real Host suite |
+| Invalid Config recovery | complete | Selective invalid-item removal, full-candidate validation, zero-mutation rejection and last-resort typed Reset pass Server/Web tests and real-browser recovery |
+| Automated validation | complete | `bun run typecheck`, full `bun run test`, production build, binary version and `git diff --check` pass after AC-08 changes |
+| Real-browser validation | complete | Prior Release Runtime Data QA remains valid; current non-mock dev Host completes selective Config recovery, typed Reset guard, responsive and console checks |
+| Independent final review | approved | AC-01 through AC-08 approved after the AC-08 fix-review loop; final review found no P0, P1 or P2 |
+
+## Acceptance Evidence
+
+| Criterion | State | Evidence |
+|---|---|---|
+| AC-01 Control plane availability | approved | ServerHost tests cover listener-first activating/error states, Setup/auth, Config/Update access, seven Runtime API families returning 503, and recovery to the sole Runtime app |
+| AC-02 Accurate bounded inspection | approved | Workspace/`.archcode`/Runtime components are checked no-follow before traversal; persisted schema keys are replaced by a bounded `$field` path and duplicate diagnostics are collapsed |
+| AC-03 Safe deletion and recovery | approved | Runtime cleanup failure blocks retry/delete; the per-step shutdown state machine lets graceful restart retry only failed cleanup without repeating completed resources or creating a second Runtime |
+| AC-04 Complete Settings recovery UI | approved | Unit/interaction plus real-browser checks cover all recovery states, default-empty selection, disabled healthy rows, confirmation/cancel, update independence, focus/ARIA, light/dark and 390/760/1024/1440 px |
+| AC-05 Strict architecture | approved | Config/Update/Runtime Data live in Host control plane; Runtime app contains only Runtime routes; required shared ProjectRegistry injection and architecture tests enforce boundaries; no fallback/migration/tombstone path added |
+| AC-06 End-to-end delivery | approved | Final full gates pass and the authenticated production Host test includes cleanup-incomplete through successful graceful shutdown |
+| AC-07 Invalid Config self-recovery | approved | Invalid Config keeps the control plane available; grant-protected Settings recovery, redaction, same-process Retry, strict Reset and Setup handoff pass automated and real-browser checks; Round 3 approved every race and security boundary |
+| AC-08 Preserve valid Config | approved | Core and Host tests cover opaque IDs, dotted dynamic identifiers, revision conflicts including concurrent external repair, full-candidate validation, selective success and byte-identical rejection; Web interaction and real browser cover default-empty selection, cancel/confirm, typed full Reset, same-process recovery and valid-setting preservation |
+
+## Validation Record
+
+- `bun run typecheck`: 5/5 workspaces passed.
+- `bun run test`: final post-review-fix run passed 8/8 tasks; Server 291 tests / 934 assertions; Web interaction 113 tests / 606 assertions; Agent Core unit, 140 integration and 81 architecture tests passed.
+- `bun run build`: Web production assets and compiled `dist/archcode` completed; `./dist/archcode --version` reported `archcode 0.0.8`.
+- `git diff --check`: passed.
+- Real browser fixture: incompatible Session in the isolated broken project and healthy Todo in a second project. The final rebuilt recovery UI exposed no persisted secret value, rendered one collapsed `$field` diagnostic instead of repeated or raw keys, Confirm consumed the final delete Runtime status, removed the incompatible Session, transitioned to the workbench, preserved both registry slugs, and left healthy Todo bytes at `{"todos":[],"runNowReceipts":[]}`.
+- Responsive browser checks at 390, 760, 1024 and 1440 px reported no document horizontal overflow. Runtime Data rendered in both light and dark themes; browser console errors: 0.
+- Config Recovery browser fixture: an unknown top-level Config key and secret sentinel produced only the canonical Config path plus one generic `configuration` issue. Without the terminal grant the page stayed blocked; with the grant it opened the full Settings shell, kept About & Updates enabled, disabled Config-dependent sections with a reason, and exposed neither the unknown key nor the secret.
+- Config Recovery browser actions: invalid Retry stayed in recovery with an announced result; canceling Reset left the fixture file intact; confirming Reset removed only that file and entered the existing Setup with the same grant. In a fresh fixture, removing the invalid key externally and clicking Retry recovered the same process to the workbench. The 390 px and 1440 px layouts had no horizontal overflow; browser console errors: 0.
+- Selective Config browser fixture: one unknown top-level field produced one default-unselected opaque recovery item while the provider/model/profile identifiers and secret remained absent from the DOM. Cancel sent no mutation and left the invalid field present. The confirmation warned that selected deletion is permanent and only commits a fully valid remainder. After confirmation, the same process reached Home with `runtime.ready`; the invalid field was absent, `qa-model`, principal/deep/fast Profiles and API key remained, file mode was `0600`, and Bootstrap was ready. Full Reset stayed separated under `last resort`, listed all valid settings that would be lost, and remained disabled for `RESE` but enabled for exact `RESET`. At 390 and 1440 px, document width equaled viewport width; browser errors and warnings: 0.
+
+## Closed Review Findings
+
+- P1 closed: Runtime inspection rejects workspace/`.archcode` ancestor symlinks without reading their targets.
+- P1 closed: schema issue paths no longer expose dynamic persisted record keys.
+- P1 closed: every Runtime resource cleanup is attempted; failed candidate cleanup blocks retry/delete and is presented as restart-required.
+- P2 closed: delete response carries the final automatic Runtime activation status.
+- P2 closed: server logs retain safely normalized internal startup/cleanup diagnostics while API/UI remain redacted.
+- P2 closed: automated recovery uses production `createRuntime`, shared ProjectRegistry, real incompatible Session data and authentication.
+
+## Closed Round 2 Finding
+
+- P1 closed: `AgentRuntime.shutdown()` shares an in-flight attempt, remembers completed steps, and lets a later graceful shutdown retry only failed cleanup steps. A production Runtime Host test proves successful cleanup without a second Runtime factory call.
+
+## Closed Config Recovery Review Findings
+
+- P1 closed: Reset now atomically claims the current canonical pathname and fully revalidates that exact captured Config before deletion; a valid external replacement written inside the former validation-to-unlink window is preserved byte-for-byte and returns conflict.
+- P1 closed: restoration has no check-then-rename path. It uses no-replace hard-linking, with atomic `wx` recreation only when hard links are unavailable, and never overwrites an external replacement.
+- P2 closed: the reviewer contract explicitly covers AC-01 through AC-07.
+
+## Closed AC-08 Round 1 Findings
+
+- P1 closed: `resolveMcpConfig` failures now map only to the exact failing MCP server when the error owner is provable; unowned top-level MCP errors offer no removal. A two-server test proves the healthy server URL, headers, and secret survive selective recovery.
+- P2 closed: removable item identities now use a process-local keyed HMAC over revision and internal path, so client-visible revisions cannot be used to enumerate hidden provider/model/server IDs; identical Configs in separate service processes produce different IDs.
+- P2 closed: the no-replace candidate installation is the explicit commit point. Captured-file cleanup after that point is best-effort and cannot turn a committed recovery into a reported failure.
+- P2 closed: the collapsed full-Reset summary has a 44px coarse-pointer interaction target, and dialog failure focus is scheduled after close so Radix focus restoration does not overwrite the recovery status focus.
+
+## Closed AC-08 Round 2 Finding
+
+- P2 closed: semantic recovery targets are created as structured path arrays at the validation source instead of being reconstructed from human-readable dotted issue paths. Tests prove `foo.bar` remains one MCP server ID segment and `broken.provider` remains one Provider ID segment while only its invalid `queryParams` is removed; healthy neighbors, models and secrets remain intact.
+
+## Final AC-08 Review
+
+- Round 3 approved with no P0, P1 or P2. The reviewer independently rechecked dotted MCP and Provider identifiers, exact selective deletion, full candidate validation, opaque HMAC item IDs, safe DTOs, atomic no-replace commit, conflict protection and `0600` permissions.
+
+## Remaining Gate
+
+- None.
diff --git a/packages/agent-core/src/__arch__/automation-boundaries.test.ts b/packages/agent-core/src/__arch__/automation-boundaries.test.ts
index a1be486d..d8f472a7 100644
--- a/packages/agent-core/src/__arch__/automation-boundaries.test.ts
+++ b/packages/agent-core/src/__arch__/automation-boundaries.test.ts
@@ -53,12 +53,17 @@ describe("Automation architecture boundaries", () => {
       serverHost.indexOf("runtime.startAutomationSchedulers"),
     );
     expect(serverHost.indexOf("runtime.startAutomationSchedulers")).toBeLessThan(
-      serverHost.indexOf("this.runtimeApp = createRuntimeApp(runtime"),
+      serverHost.indexOf("const runtimeApp = createRuntimeApp(runtime"),
+    );
+    expect(serverHost.indexOf("const runtimeApp = createRuntimeApp(runtime")).toBeLessThan(
+      serverHost.indexOf("this.runtimeApp = runtimeApp"),
     );
     expect(serverMain.indexOf("await ArchCodeServerHost.create")).toBeLessThan(
       serverMain.indexOf("await bootServer(host"),
     );
-    expect(boot).toContain("startServer(host.app");
+    expect(boot.indexOf("startServer(host.app")).toBeLessThan(
+      boot.indexOf("host.startRuntimeActivation()"),
+    );
     expect(sessionRecovery).toContain("reconcileAnsweredHitl");
     expect(sessionRecovery).toContain("continueRunnableToolBatches");
     expect(runtime).toContain("reconcileAllActiveGoals");
diff --git a/packages/agent-core/src/__arch__/runtime-data-boundaries.test.ts b/packages/agent-core/src/__arch__/runtime-data-boundaries.test.ts
new file mode 100644
index 00000000..b1069bfb
--- /dev/null
+++ b/packages/agent-core/src/__arch__/runtime-data-boundaries.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const srcRoot = resolve(import.meta.dir, "..");
+
+function source(relativePath: string): string {
+  return readFileSync(resolve(srcRoot, relativePath), "utf8");
+}
+
+describe("Runtime data ownership boundaries", () => {
+  test("inspection is an adapter over the five current domain schema owners", () => {
+    const service = source("runtime-data/service.ts");
+    const ownerImports = [
+      ["SessionFileSchema", "../store/helpers"],
+      ["ProjectTodoStateFileSchema", "../todos/schema"],
+      ["AutomationStateFileSchema", "../automations/schema"],
+      ["HitlBoundaryCodec", "../hitl/boundary-codec"],
+      ["PermissionApprovalFileSchema", "../tools/permission/project-approvals"],
+    ] as const;
+
+    for (const [owner, importPath] of ownerImports) {
+      expect(service).toContain(owner);
+      expect(service).toContain(`from "${importPath}"`);
+    }
+    expect(service).not.toMatch(/from\s+["']zod(?:\/v\d+)?["']/);
+    expect(service).not.toMatch(/\b(?:version|migration)\b/i);
+    expect(service).not.toMatch(/\b(?:Schema|Validator|Repair|Migration)Registry\b/);
+  });
+
+  test("AgentRuntime consumes the process-owned ProjectRegistry", () => {
+    const runtime = source("runtime.ts");
+
+    expect(runtime).toMatch(/projectRegistry:\s*ProjectRegistry;/);
+    expect(runtime).toContain("const projectRegistry = options.projectRegistry;");
+  });
+});
diff --git a/packages/agent-core/src/config/index.ts b/packages/agent-core/src/config/index.ts
index 081fa25d..0aede3ce 100644
--- a/packages/agent-core/src/config/index.ts
+++ b/packages/agent-core/src/config/index.ts
@@ -29,7 +29,9 @@ export {
 export {
   BuiltinMcpConfigNameError,
   ConfigRevisionConflictError,
+  ConfigRecoveryConflictError,
   ConfigSemanticValidationError,
+  InvalidConfigRemovalError,
   ConfigInitializationConflictError,
   ServerConfigService,
   resolveServerConfigPath,
@@ -39,6 +41,10 @@ export {
   type ServerConfigInitialization,
   type ServerAuthCredential,
   type ServerAuthConfigUpdate,
+  type InvalidConfigRemovalItem,
+  type InvalidConfigRemovalPlan,
+  type InvalidConfigRemovalTarget,
+  type InvalidConfigRecoveryContext,
 } from "./server-config-service";
 export {
   type ModelCallOptions,
diff --git a/packages/agent-core/src/config/server-config-service.test.ts b/packages/agent-core/src/config/server-config-service.test.ts
index 1e23aea8..0621add6 100644
--- a/packages/agent-core/src/config/server-config-service.test.ts
+++ b/packages/agent-core/src/config/server-config-service.test.ts
@@ -1,4 +1,5 @@
 import { afterAll, describe, expect, test } from "bun:test";
+import { writeFileSync } from "node:fs";
 import { mkdtemp, mkdir, readFile, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -6,12 +7,15 @@ import type { ServerConfigEditableView, ServerConfigUpdate } from "@archcode/pro
 import {
   BuiltinMcpConfigNameError,
   ConfigInitializationConflictError,
+  ConfigRecoveryConflictError,
   ConfigRevisionConflictError,
   ConfigSemanticValidationError,
+  InvalidConfigRemovalError,
   ServerConfigService,
   resolveServerConfigPath,
 } from "./server-config-service";
 import { providerAdapterCatalog, type ProviderAdapter } from "./provider-adapter-catalog";
+import { ModelRuntime } from "../models";
 
 const roots: string[] = [];
 const PASSWORD_HASH = "$argon2id$v=19$m=65536,t=3,p=1$c2FsdA$aGFzaA";
@@ -639,18 +643,345 @@ describe("ServerConfigService", () => {
     const invalidJson = await createUnloadedService();
     await mkdir(join(invalidJson.homeDir, ".archcode"), { recursive: true });
     await writeFile(invalidJson.configPath, "{");
-    expect(await invalidJson.activateForStartup()).toMatchObject({
+    const invalidJsonResult = await invalidJson.activateForStartup();
+    expect(invalidJsonResult).toMatchObject({
       status: "config_error",
       error: { message: expect.stringContaining(invalidJson.configPath) },
     });
+    if (invalidJsonResult.status !== "config_error") throw new Error("Expected invalid JSON");
+    expect(invalidJson.invalidConfigRemovalPlan(invalidJsonResult.error)).toEqual({ items: [] });
 
     const invalidSchema = await createUnloadedService();
     await mkdir(join(invalidSchema.homeDir, ".archcode"), { recursive: true });
     await writeFile(invalidSchema.configPath, JSON.stringify({ provider: {} }));
-    expect(await invalidSchema.activateForStartup()).toMatchObject({
+    const invalidSchemaResult = await invalidSchema.activateForStartup();
+    expect(invalidSchemaResult).toMatchObject({
       status: "config_error",
       error: { message: expect.stringContaining(invalidSchema.configPath) },
     });
+    if (invalidSchemaResult.status !== "config_error") throw new Error("Expected invalid schema");
+    expect(invalidSchema.invalidConfigRemovalPlan(invalidSchemaResult.error).items).toEqual([]);
+  });
+
+  test("discards only an invalid canonical Config and refuses a valid one", async () => {
+    const invalid = await createUnloadedService();
+    await mkdir(join(invalid.homeDir, ".archcode"), { recursive: true });
+    await writeFile(invalid.configPath, "{", { mode: 0o600 });
+
+    await invalid.discardInvalidConfig();
+    expect(await invalid.activateForStartup()).toEqual({ status: "setup" });
+    await expect(invalid.discardInvalidConfig()).resolves.toBeUndefined();
+
+    const valid = await createService();
+    const before = await readFile(valid.configPath, "utf8");
+    await expect(valid.discardInvalidConfig()).rejects.toBeInstanceOf(
+      ConfigRecoveryConflictError,
+    );
+    expect(await readFile(valid.configPath, "utf8")).toBe(before);
+  });
+
+  test("removes only selected invalid fields after validating the complete remaining Config", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, unknown>;
+    invalid.unsupportedLegacyConfig = { secretSentinel: "must-stay-private" };
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    await writeFile(service.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    expect(startup.status).toBe("config_error");
+    if (startup.status !== "config_error") throw new Error("Expected invalid Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    expect(plan.revision).toBeString();
+    expect(plan.items).toHaveLength(1);
+    expect(plan.items[0]!.id).not.toContain("unsupportedLegacyConfig");
+    expect(plan.items[0]!.id).not.toContain("must-stay-private");
+
+    const secondService = await createUnloadedService();
+    await mkdir(join(secondService.homeDir, ".archcode"), { recursive: true });
+    await writeFile(secondService.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+    const secondStartup = await secondService.activateForStartup();
+    if (secondStartup.status !== "config_error") throw new Error("Expected second invalid Config");
+    expect(secondService.invalidConfigRemovalPlan(secondStartup.error).items[0]!.id)
+      .not.toBe(plan.items[0]!.id);
+
+    const result = await service.removeInvalidConfigItems(
+      plan.revision!,
+      [plan.items[0]!.id],
+    );
+
+    expect(result.status).toBe("ready");
+    expect(JSON.parse(await readFile(service.configPath, "utf8"))).toEqual(config());
+    expect((await stat(service.configPath)).mode & 0o777).toBe(0o600);
+  });
+
+  test("leaves the invalid Config byte-for-byte unchanged when selected removals are insufficient", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, unknown>;
+    invalid.firstLegacyField = true;
+    invalid.secondLegacyField = true;
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    const before = `${JSON.stringify(invalid, null, 2)}\n`;
+    await writeFile(service.configPath, before, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected invalid Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    expect(plan.items).toHaveLength(2);
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      [plan.items[0]!.id],
+    )).rejects.toBeInstanceOf(InvalidConfigRemovalError);
+    expect(await readFile(service.configPath, "utf8")).toBe(before);
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      plan.items.map((item) => item.id),
+    )).resolves.toMatchObject({ status: "ready" });
+  });
+
+  test("removes only the failing MCP server and preserves healthy MCP secrets", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, any>;
+    invalid.mcp.servers.broken = {
+      url: "file:///must-not-be-accepted",
+      headers: { Authorization: "broken-server-secret" },
+    };
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    await writeFile(service.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected invalid MCP Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    expect(plan.items).toHaveLength(1);
+    expect(plan.items[0]!.path).toEqual(["mcp", "servers", "broken"]);
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      [plan.items[0]!.id],
+    )).resolves.toMatchObject({ status: "ready" });
+    const saved = JSON.parse(await readFile(service.configPath, "utf8"));
+    expect(saved.mcp.servers).toEqual({
+      custom: {
+        url: "https://mcp.example.test",
+        headers: { Authorization: "mcp-secret" },
+      },
+    });
+  });
+
+  test("preserves dotted MCP server identifiers as one selective-removal path segment", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, any>;
+    invalid.mcp.servers.foo = {
+      url: "https://healthy.example.test",
+      headers: { Authorization: "healthy-dotted-neighbor-secret" },
+    };
+    invalid.mcp.servers["foo.bar"] = {
+      url: "file:///must-not-be-accepted",
+    };
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    await writeFile(service.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected invalid dotted MCP Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    expect(plan.items).toHaveLength(1);
+    expect(plan.items[0]!.path).toEqual(["mcp", "servers", "foo.bar"]);
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      [plan.items[0]!.id],
+    )).resolves.toMatchObject({ status: "ready" });
+    const saved = JSON.parse(await readFile(service.configPath, "utf8"));
+    expect(saved.mcp.servers.foo).toEqual({
+      url: "https://healthy.example.test",
+      headers: { Authorization: "healthy-dotted-neighbor-secret" },
+    });
+    expect(saved.mcp.servers["foo.bar"]).toBeUndefined();
+  });
+
+  test("preserves dotted Provider identifiers as one selective-removal path segment", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, any>;
+    invalid.provider["broken.provider"] = {
+      npm: "@ai-sdk/openai",
+      name: "Broken dotted provider",
+      options: {
+        apiKey: "dotted-provider-secret",
+        queryParams: { unsupported: "true" },
+      },
+      models: structuredClone(invalid.provider.local.models),
+    };
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    await writeFile(service.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected invalid dotted Provider Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    expect(plan.items).toHaveLength(1);
+    expect(plan.items[0]!.path).toEqual([
+      "provider",
+      "broken.provider",
+      "options",
+      "queryParams",
+    ]);
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      [plan.items[0]!.id],
+    )).resolves.toMatchObject({ status: "ready" });
+    const saved = JSON.parse(await readFile(service.configPath, "utf8"));
+    expect(saved.provider.local).toEqual((config() as any).provider.local);
+    expect(saved.provider["broken.provider"]).toEqual({
+      npm: "@ai-sdk/openai",
+      name: "Broken dotted provider",
+      options: { apiKey: "dotted-provider-secret" },
+      models: structuredClone((config() as any).provider.local.models),
+    });
+  });
+
+  test("rejects stale, duplicate, and non-removable invalid Config selections without mutation", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, any>;
+    invalid.unsupportedLegacyConfig = true;
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    await writeFile(service.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected invalid Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    const itemId = plan.items[0]!.id;
+    const before = await readFile(service.configPath, "utf8");
+    await expect(service.removeInvalidConfigItems(plan.revision!, [itemId, itemId]))
+      .rejects.toBeInstanceOf(InvalidConfigRemovalError);
+    expect(await readFile(service.configPath, "utf8")).toBe(before);
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      ["abcdefghijklmnopqrstuv"],
+    )).rejects.toBeInstanceOf(ConfigRevisionConflictError);
+    expect(await readFile(service.configPath, "utf8")).toBe(before);
+
+    invalid.anotherLegacyField = true;
+    const changed = `${JSON.stringify(invalid, null, 2)}\n`;
+    await writeFile(service.configPath, changed, { mode: 0o600 });
+    await expect(service.removeInvalidConfigItems(plan.revision!, [itemId]))
+      .rejects.toBeInstanceOf(ConfigRevisionConflictError);
+    expect(await readFile(service.configPath, "utf8")).toBe(changed);
+
+    delete invalid.unsupportedLegacyConfig;
+    delete invalid.anotherLegacyField;
+    invalid.profiles.principal.model = "missing:model";
+    const profileError = `${JSON.stringify(invalid, null, 2)}\n`;
+    await writeFile(service.configPath, profileError, { mode: 0o600 });
+    const profileStartup = await service.activateForStartup();
+    if (profileStartup.status !== "config_error") throw new Error("Expected invalid Profile");
+    expect(service.invalidConfigRemovalPlan(profileStartup.error).items).toEqual([]);
+    expect(await readFile(service.configPath, "utf8")).toBe(profileError);
+  });
+
+  test("never overwrites an external Config created during selective recovery validation", async () => {
+    const homeDir = await mkdtemp(join(tmpdir(), "archcode-server-config-"));
+    roots.push(homeDir);
+    const configPath = resolveServerConfigPath(homeDir);
+    await mkdir(join(homeDir, ".archcode"), { recursive: true });
+    const invalid = config() as Record<string, unknown>;
+    invalid.unsupportedLegacyConfig = true;
+    await writeFile(configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+    const external = config() as Record<string, any>;
+    external.provider.local.name = "Externally repaired Config";
+    const externalBytes = `${JSON.stringify(external, null, 2)}\n`;
+    class RacingModelRuntime extends ModelRuntime {
+      override prepare(...args: Parameters<ModelRuntime["prepare"]>) {
+        writeFileSync(configPath, externalBytes, { mode: 0o600 });
+        return super.prepare(...args);
+      }
+    }
+    const service = new ServerConfigService({
+      homeDir,
+      modelRuntime: new RacingModelRuntime(),
+    });
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected invalid Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      [plan.items[0]!.id],
+    )).rejects.toBeInstanceOf(ConfigRevisionConflictError);
+    expect(await readFile(configPath, "utf8")).toBe(externalBytes);
+  });
+
+  test("preserves a valid Config replaced during Reset validation", async () => {
+    const homeDir = await mkdtemp(join(tmpdir(), "archcode-server-config-"));
+    roots.push(homeDir);
+    await mkdir(join(homeDir, ".archcode"), { recursive: true });
+    const configPath = resolveServerConfigPath(homeDir);
+    const repaired = config() as Record<string, any>;
+    repaired.provider.local.name = "Externally repaired";
+    const repairedBytes = `${JSON.stringify(repaired, null, 2)}\n`;
+    await writeFile(configPath, `${JSON.stringify(config(), null, 2)}\n`, { mode: 0o600 });
+
+    class RacingModelRuntime extends ModelRuntime {
+      private preparations = 0;
+
+      override prepare(
+        candidate: Parameters<ModelRuntime["prepare"]>[0],
+        revision: string,
+      ): ReturnType<ModelRuntime["prepare"]> {
+        this.preparations += 1;
+        if (this.preparations === 2) {
+          writeFileSync(configPath, repairedBytes, { mode: 0o600 });
+        }
+        if (this.preparations <= 2) throw new Error("provider preparation sentinel");
+        return super.prepare(candidate, revision);
+      }
+    }
+    const service = new ServerConfigService({
+      homeDir,
+      modelRuntime: new RacingModelRuntime(),
+    });
+
+    expect(await service.activateForStartup()).toMatchObject({ status: "config_error" });
+    await expect(service.discardInvalidConfig()).rejects.toBeInstanceOf(
+      ConfigRecoveryConflictError,
+    );
+    expect(await readFile(configPath, "utf8")).toBe(repairedBytes);
+    expect(await service.activateForStartup()).toMatchObject({ status: "ready" });
+  });
+
+  test("unlinks an invalid Config symlink without touching its target", async () => {
+    const service = await createUnloadedService();
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    const target = join(service.homeDir, "invalid-target.json");
+    await writeFile(target, "{secret-sentinel", { mode: 0o600 });
+    await symlink(target, service.configPath);
+
+    await service.discardInvalidConfig();
+
+    expect(await readFile(target, "utf8")).toBe("{secret-sentinel");
+    expect(await service.activateForStartup()).toEqual({ status: "setup" });
+  });
+
+  test("discards a Config that fails model runtime preparation", async () => {
+    const homeDir = await mkdtemp(join(tmpdir(), "archcode-server-config-"));
+    roots.push(homeDir);
+    await mkdir(join(homeDir, ".archcode"), { recursive: true });
+    await writeFile(resolveServerConfigPath(homeDir), `${JSON.stringify(config())}\n`, { mode: 0o600 });
+    class FailingModelRuntime extends ModelRuntime {
+      override prepare(): never {
+        throw new Error("provider preparation sentinel");
+      }
+    }
+    const service = new ServerConfigService({
+      homeDir,
+      modelRuntime: new FailingModelRuntime(),
+    });
+
+    expect(await service.activateForStartup()).toMatchObject({
+      status: "config_error",
+    });
+    await service.discardInvalidConfig();
+    expect(await service.activateForStartup()).toEqual({ status: "setup" });
   });
 
   test("rejects singular and plural undeclared credential options during startup and GET", async () => {
diff --git a/packages/agent-core/src/config/server-config-service.ts b/packages/agent-core/src/config/server-config-service.ts
index eb9fd8a1..6acb6f76 100644
--- a/packages/agent-core/src/config/server-config-service.ts
+++ b/packages/agent-core/src/config/server-config-service.ts
@@ -1,4 +1,5 @@
-import { chmod, link, lstat, mkdir, open, readFile, unlink } from "node:fs/promises";
+import { chmod, link, lstat, mkdir, open, readFile, rename, unlink } from "node:fs/promises";
+import { createHmac, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import {
@@ -17,7 +18,7 @@ import { sortJsonValue } from "@archcode/utils";
 import { ModelRuntime, type ModelRuntimeSnapshot } from "../models";
 import { SensitiveValueRedactor } from "../provider/sensitive-value-redactor";
 import { atomicWrite } from "../utils/safe-file";
-import { resolveMcpConfig } from "./mcp";
+import { McpConfigEnvError, McpConfigError, resolveMcpConfig } from "./mcp";
 import {
   MissingProviderOptionError,
   UnsupportedProviderOptionError,
@@ -86,12 +87,46 @@ export class ConfigSemanticValidationError extends Error {
   constructor(
     public readonly issues: readonly ServerConfigValidationIssue[],
     message: string = "Configuration validation failed",
+    public readonly recovery?: InvalidConfigRecoveryContext,
   ) {
     super(message);
     this.name = "ConfigSemanticValidationError";
   }
 }
 
+export interface InvalidConfigRemovalTarget {
+  readonly path: readonly string[];
+}
+
+export interface InvalidConfigRecoveryContext {
+  readonly revision?: string;
+  readonly removalTargets: readonly InvalidConfigRemovalTarget[];
+}
+
+export interface InvalidConfigRemovalItem {
+  readonly id: string;
+  readonly path: readonly string[];
+}
+
+export interface InvalidConfigRemovalPlan {
+  readonly revision?: string;
+  readonly items: readonly InvalidConfigRemovalItem[];
+}
+
+interface RecoverableConfigValidationIssue extends ServerConfigValidationIssue {
+  readonly removalTarget?: InvalidConfigRemovalTarget;
+}
+
+export class InvalidConfigRemovalError extends Error {
+  constructor(
+    message: string,
+    public readonly issues: readonly ServerConfigValidationIssue[] = [],
+  ) {
+    super(message);
+    this.name = "InvalidConfigRemovalError";
+  }
+}
+
 export class ConfigInitializationConflictError extends Error {
   constructor(public readonly configPath: string) {
     super(`Global configuration already exists at ${configPath}`);
@@ -99,12 +134,23 @@ export class ConfigInitializationConflictError extends Error {
   }
 }
 
+export class ConfigRecoveryConflictError extends Error {
+  constructor(public readonly configPath: string) {
+    super(`Global configuration at ${configPath} is valid and was not deleted`);
+    this.name = "ConfigRecoveryConflictError";
+  }
+}
+
 class MissingServerConfigError extends Error {}
 class ExistingServerConfigError extends Error {}
 
 export class BuiltinMcpConfigNameError extends ConfigSemanticValidationError {
   constructor(name: string) {
-    super([{ path: `mcp.servers.${name}`, message: `MCP server name "${name}" is reserved for a built-in server` }]);
+    super(
+      [{ path: `mcp.servers.${name}`, message: `MCP server name "${name}" is reserved for a built-in server` }],
+      undefined,
+      { removalTargets: [{ path: ["mcp", "servers", name] }] },
+    );
     this.name = "BuiltinMcpConfigNameError";
   }
 }
@@ -122,6 +168,7 @@ export class ServerConfigService {
   readonly homeDir: string;
   readonly configPath: string;
   readonly modelRuntime: ModelRuntime;
+  private readonly invalidConfigRemovalSecret = randomBytes(32);
   private startupConfig: ArchCodeConfig | undefined;
   private writeTail: Promise<void> = Promise.resolve();
 
@@ -133,9 +180,15 @@ export class ServerConfigService {
 
   async activateForStartup(): Promise<ServerConfigActivationResult> {
     try {
-      const loaded = await this.readDiskConfig();
-      const runtimeRevision = await runtimeRevisionForConfig(loaded.config);
-      return { status: "ready", ...this.activate(loaded.config, runtimeRevision) };
+      const prepared = await this.prepareDiskConfig();
+      return {
+        status: "ready",
+        ...this.activate(
+          prepared.config,
+          prepared.runtimeRevision,
+          prepared.modelRuntime,
+        ),
+      };
     } catch (error) {
       if (error instanceof MissingServerConfigError) return { status: "setup" };
       if (error instanceof ConfigSemanticValidationError) {
@@ -144,6 +197,7 @@ export class ServerConfigService {
           error: new ConfigSemanticValidationError(
             error.issues,
             `Invalid global configuration at ${this.configPath}: ${error.message}`,
+            error.recovery,
           ),
         };
       }
@@ -175,6 +229,141 @@ export class ServerConfigService {
     });
   }
 
+  /** Deletes only the canonical global Config, and only while it is invalid. */
+  async discardInvalidConfig(): Promise<void> {
+    return this.withWriteLock(async () => {
+      try {
+        await this.prepareDiskConfig();
+      } catch (error) {
+        if (error instanceof MissingServerConfigError) return;
+        if (!(error instanceof ConfigSemanticValidationError)) throw error;
+        return this.claimAndDiscardInvalidConfig();
+      }
+      throw new ConfigRecoveryConflictError(this.configPath);
+    });
+  }
+
+  invalidConfigRemovalPlan(
+    error: ConfigSemanticValidationError,
+  ): InvalidConfigRemovalPlan {
+    const recovery = error.recovery;
+    if (recovery === undefined) return { items: [] };
+    if (recovery.revision === undefined) return { items: [] };
+    const revision = recovery.revision;
+    return {
+      revision,
+      items: recovery.removalTargets.map((target) => ({
+        id: invalidConfigRemovalId(
+          this.invalidConfigRemovalSecret,
+          revision,
+          target.path,
+        ),
+        path: target.path,
+      })),
+    };
+  }
+
+  async removeInvalidConfigItems(
+    expectedRevision: string,
+    itemIds: readonly string[],
+  ): Promise<ServerConfigActivationResult> {
+    return this.withWriteLock(async () => {
+      let currentError: ConfigSemanticValidationError;
+      try {
+        await this.prepareDiskConfig();
+        throw new ConfigRecoveryConflictError(this.configPath);
+      } catch (cause) {
+        if (cause instanceof MissingServerConfigError) {
+          throw new ConfigRecoveryConflictError(this.configPath);
+        }
+        if (!(cause instanceof ConfigSemanticValidationError)) throw cause;
+        currentError = cause;
+      }
+
+      const plan = this.invalidConfigRemovalPlan(currentError);
+      if (plan.revision === undefined || plan.revision !== expectedRevision) {
+        throw new ConfigRevisionConflictError(
+          expectedRevision,
+          plan.revision ?? "unavailable",
+        );
+      }
+      if (itemIds.length === 0 || new Set(itemIds).size !== itemIds.length) {
+        throw new InvalidConfigRemovalError("Select at least one unique invalid Config item.");
+      }
+      const byId = new Map(plan.items.map((item) => [item.id, item]));
+      const selected = itemIds.map((id) => byId.get(id));
+      if (selected.some((item) => item === undefined)) {
+        throw new ConfigRevisionConflictError(expectedRevision, plan.revision);
+      }
+
+      const claimedPath = join(
+        dirname(this.configPath),
+        `.config-selective-recovery-${crypto.randomUUID()}`,
+      );
+      try {
+        await rename(this.configPath, claimedPath);
+      } catch (cause) {
+        throw new ConfigRevisionConflictError(expectedRevision, "changed");
+      }
+
+      let claimActive = true;
+      try {
+        const raw = await readFile(claimedPath, "utf8");
+        const claimedRevision = await revisionForText(raw);
+        if (claimedRevision !== expectedRevision) {
+          throw new ConfigRevisionConflictError(expectedRevision, claimedRevision);
+        }
+
+        let candidate: unknown;
+        try {
+          candidate = JSON.parse(raw);
+        } catch {
+          throw new InvalidConfigRemovalError(
+            "This Config is not valid JSON and has no safely removable structured items.",
+          );
+        }
+        for (const item of selected as InvalidConfigRemovalItem[]) {
+          deleteConfigPath(candidate, item.path);
+        }
+
+        let validated: ArchCodeConfig;
+        try {
+          validated = validateConfig(candidate);
+          const runtimeRevision = await runtimeRevisionForConfig(validated);
+          this.prepareModelRuntime(omitAuth(validated), runtimeRevision);
+        } catch (cause) {
+          if (cause instanceof ConfigSemanticValidationError) {
+            throw new InvalidConfigRemovalError(
+              "The selected removals would not produce a valid Config. Select the other related invalid items or repair the file externally.",
+              cause.issues,
+            );
+          }
+          throw cause;
+        }
+
+        try {
+          await createConfigFile(this.configPath, stableJson(validated));
+        } catch (cause) {
+          if (cause instanceof ExistingServerConfigError) {
+            throw new ConfigRevisionConflictError(expectedRevision, "changed");
+          }
+          throw cause;
+        }
+        // The no-replace install is the commit point. Cleanup must never turn a
+        // committed user operation into a reported failure.
+        claimActive = false;
+        await unlink(claimedPath).catch(() => undefined);
+      } catch (cause) {
+        if (claimActive) {
+          await restoreClaimedConfig(claimedPath, this.configPath);
+          claimActive = false;
+        }
+        throw cause;
+      }
+      return this.activateForStartup();
+    });
+  }
+
   resolveRuntimeConfig(activation: ServerConfigActivation): Omit<ArchCodeConfig, "auth"> {
     if (activation[ACTIVATION_OWNER] !== this) {
       throw new TypeError("ServerConfigActivation belongs to a different ServerConfigService");
@@ -311,11 +500,22 @@ export class ServerConfigService {
   }
 
   private async readDiskConfig(): Promise<{ config: ArchCodeConfig; revision: string }> {
+    return this.readConfigFile(this.configPath, true);
+  }
+
+  private async readConfigFile(
+    sourcePath: string,
+    missingMeansSetup: boolean,
+  ): Promise<{ config: ArchCodeConfig; revision: string }> {
     let raw: string;
     try {
-      raw = await readFile(this.configPath, "utf8");
+      raw = await readFile(sourcePath, "utf8");
     } catch (cause) {
-      if (isNodeError(cause, "ENOENT") && await pathIsAbsent(this.configPath)) {
+      if (
+        missingMeansSetup
+        && isNodeError(cause, "ENOENT")
+        && await pathIsAbsent(sourcePath)
+      ) {
         throw new MissingServerConfigError();
       }
       throw new ConfigSemanticValidationError([{
@@ -334,7 +534,96 @@ export class ServerConfigService {
       }]);
     }
 
-    return { config: validateConfig(json), revision: await revisionForText(raw) };
+    const revision = await revisionForText(raw);
+    try {
+      return { config: validateConfig(json), revision };
+    } catch (cause) {
+      if (cause instanceof ConfigSemanticValidationError) {
+        throw new ConfigSemanticValidationError(
+          cause.issues,
+          cause.message,
+          {
+            revision,
+            removalTargets: cause.recovery?.removalTargets ?? [],
+          },
+        );
+      }
+      throw cause;
+    }
+  }
+
+  private async prepareDiskConfig(): Promise<{
+    config: ArchCodeConfig;
+    runtimeRevision: string;
+    modelRuntime: ModelRuntimeSnapshot;
+  }> {
+    return this.prepareConfigFile(this.configPath, true);
+  }
+
+  private async prepareConfigFile(
+    sourcePath: string,
+    missingMeansSetup: boolean,
+  ): Promise<{
+    config: ArchCodeConfig;
+    runtimeRevision: string;
+    modelRuntime: ModelRuntimeSnapshot;
+  }> {
+    const loaded = await this.readConfigFile(sourcePath, missingMeansSetup);
+    const runtimeRevision = await runtimeRevisionForConfig(loaded.config);
+    try {
+      return {
+        config: loaded.config,
+        runtimeRevision,
+        modelRuntime: this.prepareModelRuntime(omitAuth(loaded.config), runtimeRevision),
+      };
+    } catch (cause) {
+      if (cause instanceof ConfigSemanticValidationError) {
+        throw new ConfigSemanticValidationError(
+          cause.issues,
+          cause.message,
+          {
+            revision: loaded.revision,
+            removalTargets: cause.recovery?.removalTargets ?? [],
+          },
+        );
+      }
+      throw cause;
+    }
+  }
+
+  private async claimAndDiscardInvalidConfig(): Promise<void> {
+    const claimedPath = join(
+      dirname(this.configPath),
+      `.config-reset-${crypto.randomUUID()}`,
+    );
+    try {
+      await rename(this.configPath, claimedPath);
+    } catch (cause) {
+      if (isNodeError(cause, "ENOENT") && await pathIsAbsent(this.configPath)) return;
+      throw configDiscardError(this.configPath, cause);
+    }
+
+    try {
+      await this.prepareConfigFile(claimedPath, false);
+    } catch (cause) {
+      if (!(cause instanceof ConfigSemanticValidationError)) {
+        await restoreClaimedConfig(claimedPath, this.configPath);
+        throw cause;
+      }
+      try {
+        await unlink(claimedPath);
+      } catch (deleteCause) {
+        await restoreClaimedConfig(claimedPath, this.configPath);
+        throw configDiscardError(this.configPath, deleteCause);
+      }
+      if (!(await pathIsAbsent(this.configPath))) {
+        throw new ConfigRecoveryConflictError(this.configPath);
+      }
+      return;
+    }
+
+    await restoreClaimedConfig(claimedPath, this.configPath);
+    throw new ConfigRecoveryConflictError(this.configPath);
   }
 
   private async withWriteLock<T>(operation: () => Promise<T>): Promise<T> {
@@ -364,13 +653,21 @@ function providerConfigSecretRedactor(config: ArchCodeConfig): SensitiveValueRed
 function validateConfig(value: unknown): ArchCodeConfig {
   const schema = archcodeConfigSchema.safeParse(value);
   if (!schema.success) {
-    throw new ConfigSemanticValidationError(schema.error.issues.map((issue) => ({
-      path: issue.path.join("."),
-      message: issue.message,
-    })));
+    throw new ConfigSemanticValidationError(
+      schema.error.issues.map((issue) => ({
+        path: issue.path.join("."),
+        message: issue.message,
+      })),
+      undefined,
+      {
+        removalTargets: dedupeRemovalTargets(
+          schema.error.issues.flatMap((issue) => schemaIssueRemovalTargets(issue)),
+        ),
+      },
+    );
   }
   const config = schema.data;
-  const issues: ServerConfigValidationIssue[] = [];
+  const issues: RecoverableConfigValidationIssue[] = [];
 
   for (const [providerId, provider] of Object.entries(config.provider)) {
     const adapter = providerAdapterCatalog.get(provider.npm);
@@ -378,6 +675,7 @@ function validateConfig(value: unknown): ArchCodeConfig {
       issues.push({
         path: `provider.${providerId}.npm`,
         message: `Unsupported provider package "${provider.npm}"`,
+        removalTarget: { path: ["provider", providerId] },
       });
       continue;
     }
@@ -389,6 +687,11 @@ function validateConfig(value: unknown): ArchCodeConfig {
           ? `provider.${providerId}.options.${cause.optionPath}`
           : `provider.${providerId}.options`,
         message: errorMessage(cause),
+        removalTarget: {
+          path: cause instanceof MissingProviderOptionError || cause instanceof UnsupportedProviderOptionError
+            ? ["provider", providerId, "options", ...cause.optionPath.split(".")]
+            : ["provider", providerId],
+        },
       });
     }
     validateAllowedProviderSecretPaths(
@@ -396,12 +699,14 @@ function validateConfig(value: unknown): ArchCodeConfig {
       adapter,
       `provider.${providerId}.options`,
       issues,
+      ["provider", providerId, "options"],
     );
     validateCredentialBearingProviderUrls(
       provider.options,
       adapter,
       `provider.${providerId}.options`,
       issues,
+      ["provider", providerId, "options"],
     );
   }
   validateSecretValuePlacement(config, issues);
@@ -425,10 +730,27 @@ function validateConfig(value: unknown): ArchCodeConfig {
   try {
     resolveMcpConfig(config.mcp);
   } catch (cause) {
-    issues.push({ path: "mcp", message: errorMessage(cause) });
+    const serverName = mcpErrorServerName(cause, config);
+    issues.push({
+      path: serverName === undefined ? "mcp" : `mcp.servers.${serverName}`,
+      message: errorMessage(cause),
+      removalTarget: serverName === undefined
+        ? undefined
+        : { path: ["mcp", "servers", serverName] },
+    });
   }
 
-  if (issues.length > 0) throw new ConfigSemanticValidationError(issues);
+  if (issues.length > 0) {
+    throw new ConfigSemanticValidationError(
+      issues,
+      undefined,
+      {
+        removalTargets: dedupeRemovalTargets(
+          issues.flatMap((issue) => issue.removalTarget === undefined ? [] : [issue.removalTarget]),
+        ),
+      },
+    );
+  }
   return config;
 }
 
@@ -758,7 +1080,8 @@ function validateAllowedProviderSecretPaths(
   options: Record<string, unknown>,
   adapter: ProviderAdapter,
   basePath: string,
-  issues: ServerConfigValidationIssue[],
+  issues: RecoverableConfigValidationIssue[],
+  removalBasePath?: readonly string[],
 ): void {
   for (const secretPath of findSecretBearingProviderOptionPaths(options, "")) {
     const normalizedPath = secretPath.replace(/^\./, "");
@@ -766,6 +1089,9 @@ function validateAllowedProviderSecretPaths(
       issues.push({
         path: `${basePath}.${normalizedPath}`,
         message: "Secret-bearing provider option is not declared by this adapter",
+        removalTarget: removalBasePath === undefined
+          ? undefined
+          : { path: [...removalBasePath, ...normalizedPath.split(".")] },
       });
     }
   }
@@ -789,7 +1115,7 @@ function matchesSecretPath(
 
 function validateSecretValuePlacement(
   config: ArchCodeConfig,
-  issues: ServerConfigValidationIssue[],
+  issues: RecoverableConfigValidationIssue[],
 ): void {
   const secretValues = new Set<string>();
   for (const provider of Object.values(config.provider)) {
@@ -834,6 +1160,9 @@ function validateSecretValuePlacement(
         issues.push({
           path: segments.join("."),
           message: "Credential values may appear only in declared secret fields",
+          removalTarget: boundedRemovalTarget(segments) === undefined
+            ? undefined
+            : { path: boundedRemovalTarget(segments)! },
         });
       }
       return;
@@ -855,7 +1184,8 @@ function validateCredentialBearingProviderUrls(
   options: Record<string, unknown>,
   adapter: ProviderAdapter,
   basePath: string,
-  issues: ServerConfigValidationIssue[],
+  issues: RecoverableConfigValidationIssue[],
+  removalBasePath?: readonly string[],
 ): void {
   const knownUrlPaths = new Set(
     adapter.optionFields.filter((field) => field.kind === "url").map((field) => field.path),
@@ -868,6 +1198,9 @@ function validateCredentialBearingProviderUrls(
         issues.push({
           path: `${basePath}.${path}`,
           message: "Provider URL credentials, query parameters, and fragments are allowed only in declared secret fields",
+          removalTarget: removalBasePath === undefined
+            ? undefined
+            : { path: [...removalBasePath, ...path.split(".")] },
         });
       }
       return;
@@ -941,6 +1274,105 @@ function isNodeError(error: unknown, code: string): error is NodeJS.ErrnoExcepti
   return error instanceof Error && "code" in error && error.code === code;
 }
 
+function schemaIssueRemovalTargets(issue: {
+  readonly code: string;
+  readonly path: readonly PropertyKey[];
+  readonly keys?: readonly string[];
+}): InvalidConfigRemovalTarget[] {
+  const path = issue.path.filter(
+    (segment): segment is string => typeof segment === "string",
+  );
+  if (issue.code === "unrecognized_keys" && issue.keys !== undefined) {
+    return issue.keys.map((key) => ({ path: [...path, key] }));
+  }
+  const target = boundedRemovalTarget(path);
+  return target === undefined ? [] : [{ path: target }];
+}
+
+function boundedRemovalTarget(path: readonly string[]): readonly string[] | undefined {
+  const [root] = path;
+  if (root === undefined || root === "auth" || root === "profiles") return undefined;
+  if (root === "provider") {
+    const providerId = path[1];
+    if (providerId === undefined) return undefined;
+    if (path[2] === "models" && path[3] !== undefined) {
+      if (path[4] === "variants" && path[5] !== undefined) {
+        return path.slice(0, 6);
+      }
+      return path.slice(0, 4);
+    }
+    if (path[2] === "options" && path.length >= 4) return path;
+    return path.slice(0, 2);
+  }
+  if (root === "mcp") {
+    if (path[1] === "servers" && path[2] !== undefined) {
+      return path.slice(0, 3);
+    }
+    return undefined;
+  }
+  if (root === "memory") return ["memory"];
+  if (root === "integrations" && path[1] === "github") {
+    return ["integrations", "github"];
+  }
+  return path.length === 1 ? path : undefined;
+}
+
+function dedupeRemovalTargets(
+  targets: readonly InvalidConfigRemovalTarget[],
+): InvalidConfigRemovalTarget[] {
+  const byPath = new Map<string, InvalidConfigRemovalTarget>();
+  for (const target of targets) {
+    byPath.set(JSON.stringify(target.path), target);
+  }
+  return [...byPath.values()];
+}
+
+function invalidConfigRemovalId(
+  secret: Uint8Array,
+  revision: string,
+  path: readonly string[],
+): string {
+  return createHmac("sha256", secret)
+    .update(revision)
+    .update("\0")
+    .update(JSON.stringify(path))
+    .digest("base64url")
+    .slice(0, 22);
+}
+
+function mcpErrorServerName(
+  error: unknown,
+  config: ArchCodeConfig,
+): string | undefined {
+  if (error instanceof McpConfigError) return error.serverName;
+  if (!(error instanceof McpConfigEnvError)) return undefined;
+  return Object.keys(config.mcp?.servers ?? {})
+    .sort((left, right) => right.length - left.length)
+    .find((serverName) => {
+      const prefix = `mcp.servers.${serverName}`;
+      return error.configPath === prefix || error.configPath.startsWith(`${prefix}.`);
+    });
+}
+
+function deleteConfigPath(candidate: unknown, path: readonly string[]): void {
+  if (!isRecord(candidate) || path.length === 0) {
+    throw new InvalidConfigRemovalError("The selected invalid Config item is no longer removable.");
+  }
+  let current: Record<string, unknown> = candidate;
+  for (const segment of path.slice(0, -1)) {
+    const next = current[segment];
+    if (!isRecord(next)) {
+      throw new InvalidConfigRemovalError("The selected invalid Config item is no longer removable.");
+    }
+    current = next;
+  }
+  const final = path[path.length - 1]!;
+  if (!Object.hasOwn(current, final)) {
+    throw new InvalidConfigRemovalError("The selected invalid Config item is no longer removable.");
+  }
+  delete current[final];
+}
+
 async function pathIsAbsent(path: string): Promise<boolean> {
   try {
     await lstat(path);
@@ -950,6 +1382,52 @@ async function pathIsAbsent(path: string): Promise<boolean> {
   }
 }
 
+async function restoreClaimedConfig(
+  claimedPath: string,
+  configPath: string,
+): Promise<void> {
+  try {
+    await link(claimedPath, configPath);
+  } catch (cause) {
+    if (isNodeError(cause, "EEXIST")) {
+      await unlink(claimedPath);
+      return;
+    }
+    const claimedBytes = await readFile(claimedPath);
+    let handle;
+    try {
+      handle = await open(configPath, "wx", 0o600);
+    } catch (createCause) {
+      if (isNodeError(createCause, "EEXIST")) {
+        await unlink(claimedPath);
+        return;
+      }
+      throw configDiscardError(configPath, createCause);
+    }
+    try {
+      await handle.writeFile(claimedBytes);
+      await handle.sync();
+    } catch (writeCause) {
+      throw configDiscardError(configPath, writeCause);
+    } finally {
+      await handle.close();
+    }
+    await unlink(claimedPath);
+    return;
+  }
+  await unlink(claimedPath);
+}
+
+function configDiscardError(
+  configPath: string,
+  cause: unknown,
+): ConfigSemanticValidationError {
+  return new ConfigSemanticValidationError([{
+    path: configPath,
+    message: `Failed to delete invalid global configuration at ${configPath}: ${errorMessage(cause)}`,
+  }]);
+}
+
 function redactProviderOptions(
   options: Record<string, unknown>,
   adapter: ProviderAdapter,
diff --git a/packages/agent-core/src/index.ts b/packages/agent-core/src/index.ts
index 301e71e7..c9df446f 100644
--- a/packages/agent-core/src/index.ts
+++ b/packages/agent-core/src/index.ts
@@ -7,12 +7,15 @@ export {
 } from "./runtime";
 export type { AcceptSessionMessageInput, AgentRuntime, AgentRuntimeOptions, CreateRuntimeSessionOptions, ProjectControlPlaneSnapshot, ProjectRemovalResult, SessionMessageAcceptance } from "./runtime";
 export * from "./attachments";
+export * from "./runtime-data";
 export * from "./automations";
 export type { CompressionOriginalRangeResult } from "./compression";
 export {
   BuiltinMcpConfigNameError,
   ConfigRevisionConflictError,
   ConfigSemanticValidationError,
+  ConfigRecoveryConflictError,
+  InvalidConfigRemovalError,
   ConfigInitializationConflictError,
   ServerConfigService,
   resolveServerConfigPath,
@@ -24,6 +27,10 @@ export type {
   ServerConfigActivationResult,
   ServerConfigInitialization,
   ServerConfigServiceOptions,
+  InvalidConfigRemovalItem,
+  InvalidConfigRemovalPlan,
+  InvalidConfigRemovalTarget,
+  InvalidConfigRecoveryContext,
 } from "./config";
 
 export { createProcessRunner } from "./process/runner";
diff --git a/packages/agent-core/src/lead-architecture-flows.integration.test.ts b/packages/agent-core/src/lead-architecture-flows.integration.test.ts
index 254ce7fb..8e6be2e6 100644
--- a/packages/agent-core/src/lead-architecture-flows.integration.test.ts
+++ b/packages/agent-core/src/lead-architecture-flows.integration.test.ts
@@ -618,7 +618,8 @@ async function runtimeFixture(projectName: string): Promise<{
     logger: silentLogger,
     configService,
     activation: activationResult.activation,
-    projectRegistryHomeDir: root,
+    projectRegistry: registry,
+    runtimeStorageHomeDir: root,
     mcpManagerFactory: () => mcpManager(),
   });
   activeRuntime = runtime;
diff --git a/packages/agent-core/src/main.test.ts b/packages/agent-core/src/main.test.ts
index fa633431..bd38ae8a 100644
--- a/packages/agent-core/src/main.test.ts
+++ b/packages/agent-core/src/main.test.ts
@@ -29,6 +29,7 @@ import type { SessionToolBatch } from "./store/types";
 import { createTestProjectContext } from "./tools/test-project-context";
 import { createInMemoryLogger, silentLogger } from "./logger";
 import { ServerConfigService, resolveServerConfigPath } from "./config";
+import { ProjectRegistry } from "./projects/registry";
 import { setLlmAdapterForTest } from "./llm";
 import { getLspClientPool } from "./lsp/client-pool";
 import { SessionGoalService } from "./session-goal";
@@ -59,14 +60,19 @@ function makeFakeMcpManager(result: McpDiscoveryResult | Error, secrets: readonl
   return { discover: mock(async () => { if (result instanceof Error) throw result; return result; }), closeAll: mock(async () => []), getStatus: mock(() => new Map()), onStatusChange: mock(() => () => {}), startBackgroundDiscovery: mock((onDescriptors: (d: AnyToolDescriptor[]) => void, onWarning: (w: McpWarning) => void) => { if (result instanceof Error) { onWarning({ message: policy.redactString(`Failed to discover MCP tools during startup: ${result.message}`) }); return; } for (const warning of result.warnings) onWarning(warning); if (result.descriptors.length) onDescriptors(result.descriptors); }) } as unknown as McpManager;
 }
 function makeContext(toolName: string, input: unknown): ToolExecutionContext { const workspaceRoot = import.meta.dir; return { store: storeManager.create(`main-test-${crypto.randomUUID()}`, workspaceRoot, { agentName: "lead", source: { kind: "direct" } }), storeManager, toolName, toolCallId: `${toolName}-call`, input, step: 0, executionId: crypto.randomUUID(), runOrdinal: 0, toolBatchId: crypto.randomUUID(), abort: new AbortController().signal, startedAt: 0, allowedTools: new Set([toolName]), cwd: workspaceRoot, projectContext: createTestProjectContext(workspaceRoot) }; }
-type RuntimeTestOptions = Omit<AgentRuntimeOptions, "activation">;
+type RuntimeTestOptions = Omit<AgentRuntimeOptions, "activation" | "projectRegistry"> & {
+  projectRegistry?: ProjectRegistry;
+};
 async function createRuntime(options: RuntimeTestOptions) {
   const result = await options.configService.activateForStartup();
   if (result.status !== "ready") throw new Error(`Expected ready config, received ${result.status}`);
+  const runtimeStorageHomeDir = options.runtimeStorageHomeDir ?? await makeTempRoot();
   return createProductionRuntime({
     ...options,
     activation: result.activation,
-    projectRegistryHomeDir: options.projectRegistryHomeDir ?? await makeTempRoot(),
+    projectRegistry: options.projectRegistry
+      ?? new ProjectRegistry({ homeDir: runtimeStorageHomeDir, logger: silentLogger }),
+    runtimeStorageHomeDir,
   });
 }
 function nextSessionEvent(
@@ -222,10 +228,12 @@ describe("createRuntime", () => {
     if (result.status !== "ready") throw new Error(`Expected ready config, received ${result.status}`);
     await rm(configService.configPath);
     let policy: SecretRedactionPolicy | undefined;
+    const runtimeStorageHomeDir = await makeTempRoot();
     const runtime = await createProductionRuntime({
       configService,
       activation: result.activation,
-      projectRegistryHomeDir: await makeTempRoot(),
+      projectRegistry: new ProjectRegistry({ homeDir: runtimeStorageHomeDir, logger: silentLogger }),
+      runtimeStorageHomeDir,
       mcpManagerFactory: (_config, runtimePolicy) => {
         policy = runtimePolicy;
         return makeFakeMcpManager({ descriptors: [], warnings: [] });
@@ -917,7 +925,7 @@ describe("createRuntime", () => {
     const configService = await writeConfig(makeConfig());
     const runtime1 = await createRuntime({
       configService,
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     await runtime1.projectRegistry.add({ workspaceRoot, name: "Stable recency" });
@@ -946,7 +954,7 @@ describe("createRuntime", () => {
 
     const runtime2 = await createRuntime({
       configService,
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     await runtime2.recoverSessionContinuations();
@@ -1116,7 +1124,7 @@ describe("createRuntime", () => {
     const failedWorkspaceRoot = await makeTempRoot();
     const runtime = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: await makeTempRoot(),
+      runtimeStorageHomeDir: await makeTempRoot(),
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     await runtime.projectRegistry.add({ workspaceRoot: healthyWorkspaceRoot, name: "Healthy project" });
@@ -1181,7 +1189,7 @@ describe("createRuntime", () => {
     });
     const runtime1 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const project = await runtime1.projectRegistry.add({ workspaceRoot, name: "Goal restart" });
@@ -1231,7 +1239,7 @@ describe("createRuntime", () => {
     });
     const runtime2 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
 
@@ -1285,7 +1293,7 @@ describe("createRuntime", () => {
 
     const runtime1 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: await makeTempRoot(),
+      runtimeStorageHomeDir: await makeTempRoot(),
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     await expect(runtime1.updateSessionGoalControl({
@@ -1302,7 +1310,7 @@ describe("createRuntime", () => {
     });
     const runtime2 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: await makeTempRoot(),
+      runtimeStorageHomeDir: await makeTempRoot(),
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const cleared = await runtime2.updateSessionGoalControl({
@@ -1334,7 +1342,7 @@ describe("createRuntime", () => {
     });
     const runtime = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const project = await runtime.projectRegistry.add({ workspaceRoot, name: "Goal continuation" });
@@ -1377,7 +1385,7 @@ describe("createRuntime", () => {
     });
     const runtime = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const project = await runtime.projectRegistry.add({ workspaceRoot, name: "Goal failure" });
@@ -1418,7 +1426,7 @@ describe("createRuntime", () => {
     const registryHome = await makeTempRoot();
     const runtime1 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const project = await runtime1.projectRegistry.add({ workspaceRoot, name: "Repair answered HITL" });
@@ -1512,7 +1520,7 @@ describe("createRuntime", () => {
 
     const runtime2 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     installTestLlmAdapter();
@@ -1567,7 +1575,7 @@ describe("createRuntime", () => {
     const registryHome = await makeTempRoot();
     const runtime1 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const project = await runtime1.projectRegistry.add({ workspaceRoot, name: "HITL restart" });
@@ -1663,7 +1671,7 @@ describe("createRuntime", () => {
 
     const runtime2 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     expect((await runtime2.getSessionFile(workspaceRoot, session.sessionId)).toolBatches[0]?.calls[0]?.state).toBe("blocked");
@@ -1723,7 +1731,7 @@ describe("createRuntime", () => {
     const registryHome = await makeTempRoot();
     const runtime1 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const project = await runtime1.projectRegistry.add({ workspaceRoot, name: "HITL answer and Stop" });
@@ -1811,7 +1819,7 @@ describe("createRuntime", () => {
 
     const runtime2 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const context2 = await runtime2.contextResolver.resolve(workspaceRoot);
@@ -1868,7 +1876,7 @@ describe("createRuntime", () => {
     const registryHome = await makeTempRoot();
     const runtime1 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     const project = await runtime1.projectRegistry.add({ workspaceRoot, name: "Concurrent HITL" });
@@ -1942,7 +1950,7 @@ describe("createRuntime", () => {
 
     const runtime2 = await createRuntime({
       configService: await writeConfig(makeConfig()),
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     });
     installTestLlmAdapter();
@@ -2212,7 +2220,7 @@ describe("createRuntime", () => {
     await mkdir(join(configHome, ".archcode"), { recursive: true });
     await Bun.write(resolveServerConfigPath(configHome), JSON.stringify(makeConfig({ servers: {} })));
     const runtimeOptions = {
-      projectRegistryHomeDir: registryHome,
+      runtimeStorageHomeDir: registryHome,
       mcpManagerFactory: () => makeFakeMcpManager({ descriptors: [], warnings: [] }),
     } as const;
     const runtime1 = await createRuntime({
diff --git a/packages/agent-core/src/runtime-automations.integration.test.ts b/packages/agent-core/src/runtime-automations.integration.test.ts
index 5b7e21d6..7010229e 100644
--- a/packages/agent-core/src/runtime-automations.integration.test.ts
+++ b/packages/agent-core/src/runtime-automations.integration.test.ts
@@ -93,7 +93,8 @@ async function runtimeFixture(): Promise<{
     logger: silentLogger,
     configService,
     activation: activationResult.activation,
-    projectRegistryHomeDir: root,
+    projectRegistry: registry,
+    runtimeStorageHomeDir: root,
     mcpManagerFactory: () => mcpManager(),
     automationSchedulerClock: clock,
     automationSchedulerTimer: new FakeTimer(clock),
diff --git a/packages/agent-core/src/runtime-automations.test.ts b/packages/agent-core/src/runtime-automations.test.ts
index f0d6957f..6668e60b 100644
--- a/packages/agent-core/src/runtime-automations.test.ts
+++ b/packages/agent-core/src/runtime-automations.test.ts
@@ -559,7 +559,8 @@ async function runtimeFixture(options: {
   const runtime = await createRuntime({
     configService,
     activation: activationResult.activation,
-    projectRegistryHomeDir: root,
+    projectRegistry: registry,
+    runtimeStorageHomeDir: root,
     mcpManagerFactory: () => mcpManager(),
     automationSchedulerClock: clock,
     automationSchedulerTimer: timer,
diff --git a/packages/agent-core/src/runtime-data/index.ts b/packages/agent-core/src/runtime-data/index.ts
new file mode 100644
index 00000000..50c15125
--- /dev/null
+++ b/packages/agent-core/src/runtime-data/index.ts
@@ -0,0 +1,9 @@
+export {
+  RuntimeDataRequestError,
+  RuntimeDataService,
+} from "./service";
+export type {
+  RuntimeDataProjectRegistry,
+  RuntimeDataRequestErrorCode,
+  RuntimeDataServiceOptions,
+} from "./service";
diff --git a/packages/agent-core/src/runtime-data/service.test.ts b/packages/agent-core/src/runtime-data/service.test.ts
new file mode 100644
index 00000000..259f9c13
--- /dev/null
+++ b/packages/agent-core/src/runtime-data/service.test.ts
@@ -0,0 +1,543 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { silentLogger } from "../logger";
+import { ServerConfigService, resolveServerConfigPath } from "../config";
+import type { McpManager } from "../mcp";
+import { ProjectRegistry } from "../projects/registry";
+import { projectRuntimePath } from "../projects/runtime-path";
+import type { ProjectInfo } from "../projects/types";
+import { createRuntime } from "../runtime";
+import { SessionStoreManager } from "../store/session-store-manager";
+import {
+  RuntimeDataRequestError,
+  RuntimeDataService,
+  type RuntimeDataProjectRegistry,
+} from "./service";
+
+const TMP_ROOT = join(tmpdir(), "archcode-runtime-data", crypto.randomUUID());
+const SESSION_ID = "11111111-1111-4111-8111-111111111111";
+const SECRET = "persisted-secret-value";
+
+class TestProjectRegistry implements RuntimeDataProjectRegistry {
+  projects: ProjectInfo[] = [];
+
+  async list(): Promise<ProjectInfo[]> {
+    return this.projects.map((project) => ({ ...project }));
+  }
+}
+
+const registry = new TestProjectRegistry();
+const service = new RuntimeDataService({ projectRegistry: registry });
+
+beforeEach(async () => {
+  await rm(TMP_ROOT, { recursive: true, force: true });
+  await mkdir(TMP_ROOT, { recursive: true });
+  registry.projects = [];
+});
+
+afterAll(async () => {
+  await rm(TMP_ROOT, { recursive: true, force: true });
+});
+
+describe("RuntimeDataService inspection", () => {
+  test("uses every current domain schema for valid, missing, invalid JSON, schema mismatch, and unreadable files", async () => {
+    const targets = [
+      { name: "session", relativePath: `sessions/${SESSION_ID}/session.json` },
+      { name: "todo", relativePath: "todos/state.json" },
+      { name: "automation", relativePath: "automations/state.json" },
+      { name: "hitl", relativePath: "hitl-queue.json" },
+      { name: "permissions", relativePath: "permissions.json" },
+    ] as const;
+    const cases = ["valid", "missing", "invalid_json", "invalid_current_schema", "unreadable"] as const;
+
+    for (const target of targets) {
+      for (const fixtureCase of cases) {
+        const project = await createProject(`${target.name}-${fixtureCase}`);
+        const targetPath = join(projectRuntimePath(project.workspaceRoot), target.relativePath);
+        const sentinelPath = join(TMP_ROOT, `${target.name}-${fixtureCase}-sentinel.json`);
+
+        switch (fixtureCase) {
+          case "valid":
+            break;
+          case "missing":
+            await rm(
+              target.name === "session" ? join(targetPath, "..") : targetPath,
+              { recursive: target.name === "session" },
+            );
+            break;
+          case "invalid_json":
+            await writeFile(targetPath, `{${SECRET}`);
+            break;
+          case "invalid_current_schema":
+            await writeFile(targetPath, JSON.stringify({ unexpected: SECRET }));
+            break;
+          case "unreadable":
+            await writeFile(sentinelPath, `{${SECRET}`);
+            await rm(targetPath);
+            await symlink(sentinelPath, targetPath);
+            break;
+        }
+
+        registry.projects = [project];
+        const response = await service.inspect();
+        const inspected = response.projects[0]!;
+        const targetIssues = inspected.issues.filter((issue) => issue.relativePath === target.relativePath);
+
+        if (fixtureCase === "valid" || fixtureCase === "missing") {
+          expect(targetIssues).toEqual([]);
+        } else {
+          expect(targetIssues).toHaveLength(1);
+          expect(targetIssues[0]?.reason).toBe(fixtureCase);
+        }
+        if (fixtureCase === "invalid_current_schema") {
+          expect(targetIssues[0]?.schemaIssues?.length).toBeGreaterThan(0);
+          expect(targetIssues[0]?.schemaIssues?.[0]?.message).toBe(
+            "Does not match the current ArchCode data format.",
+          );
+        }
+        expect(JSON.stringify(response)).not.toContain(SECRET);
+      }
+    }
+  });
+
+  test("isolates unreadable projects and preserves complete reports and stats for others", async () => {
+    const unreadable = await createProject("unreadable-project");
+    const healthy = await createProject("healthy-project");
+    const outside = join(TMP_ROOT, "outside-runtime");
+    await mkdir(outside);
+    await writeFile(join(outside, "sentinel.txt"), SECRET);
+    await rm(projectRuntimePath(unreadable.workspaceRoot), { recursive: true });
+    await symlink(outside, projectRuntimePath(unreadable.workspaceRoot));
+
+    registry.projects = [unreadable, healthy];
+    const response = await service.inspect();
+
+    expect(response.projects).toHaveLength(2);
+    expect(response.projects[0]).toMatchObject({
+      projectSlug: unreadable.slug,
+      stats: { fileCount: 0, totalBytes: 0 },
+      issues: [{ relativePath: ".", reason: "unreadable" }],
+    });
+    expect(response.projects[1]?.projectSlug).toBe(healthy.slug);
+    expect(response.projects[1]?.issues).toEqual([]);
+    expect(response.projects[1]?.stats.fileCount).toBe(5);
+    expect(await readFile(join(outside, "sentinel.txt"), "utf8")).toBe(SECRET);
+    expect(JSON.stringify(response)).not.toContain(SECRET);
+  });
+
+  test("treats missing .archcode or Runtime directories as an empty healthy state", async () => {
+    const project = await createProject("missing-runtime-root");
+    const statePath = join(project.workspaceRoot, ".archcode");
+    registry.projects = [project];
+
+    await rm(statePath, { recursive: true });
+    expect((await service.inspect()).projects[0]).toMatchObject({
+      stats: { fileCount: 0, totalBytes: 0 },
+      issues: [],
+    });
+
+    await mkdir(statePath);
+    expect((await service.inspect()).projects[0]).toMatchObject({
+      stats: { fileCount: 0, totalBytes: 0 },
+      issues: [],
+    });
+  });
+
+  test("does not follow a .archcode ancestor symlink into an outside sentinel", async () => {
+    const project = await createProject("state-ancestor-symlink");
+    const statePath = join(project.workspaceRoot, ".archcode");
+    const outsideStatePath = join(TMP_ROOT, "outside-state-target");
+    await rename(statePath, outsideStatePath);
+    const sentinelPath = join(outsideStatePath, "runtime", "todos", "state.json");
+    await writeFile(sentinelPath, JSON.stringify({ [SECRET]: SECRET }));
+    const sentinelBefore = await readFile(sentinelPath, "utf8");
+    await symlink(outsideStatePath, statePath);
+    registry.projects = [project];
+
+    const response = await service.inspect();
+
+    expect(response.projects[0]).toMatchObject({
+      stats: { fileCount: 0, totalBytes: 0 },
+      issues: [{ relativePath: ".", reason: "unreadable" }],
+    });
+    expect(JSON.stringify(response)).not.toContain(SECRET);
+    expect(await readFile(sentinelPath, "utf8")).toBe(sentinelBefore);
+  });
+
+  test("redacts secret-bearing dynamic keys from schema issue paths", async () => {
+    const project = await createProject("secret-schema-key");
+    const sessionPath = join(
+      projectRuntimePath(project.workspaceRoot),
+      "sessions",
+      SESSION_ID,
+      "session.json",
+    );
+    const session = JSON.parse(await readFile(sessionPath, "utf8")) as {
+      compression: { refMap: { messageRefsById: Record<string, unknown> } };
+    };
+    const secretKey = `dynamic-${SECRET}-key`;
+    session.compression.refMap.messageRefsById = { [secretKey]: "not-a-message-ref" };
+    await writeFile(sessionPath, JSON.stringify(session));
+    registry.projects = [project];
+
+    const response = await service.inspect();
+    const issue = response.projects[0]?.issues.find(
+      (candidate) => candidate.relativePath === `sessions/${SESSION_ID}/session.json`,
+    );
+
+    expect(issue?.reason).toBe("invalid_current_schema");
+    expect(issue?.schemaIssues?.some((schemaIssue) => (
+      schemaIssue.path.includes("$field")
+    ))).toBe(true);
+    expect(JSON.stringify(response)).not.toContain(secretKey);
+    expect(JSON.stringify(response)).not.toContain(SECRET);
+  });
+
+  test("never follows Session directory, session.json, or traversal symlinks", async () => {
+    const project = await createProject("symlink-project");
+    const runtimePath = projectRuntimePath(project.workspaceRoot);
+    const outside = join(TMP_ROOT, "outside");
+    await mkdir(outside, { recursive: true });
+    const sentinel = join(outside, "sentinel.json");
+    await writeFile(sentinel, `{${SECRET}`);
+
+    const linkedSessionDirectory = join(runtimePath, "sessions", "linked-session");
+    await symlink(outside, linkedSessionDirectory);
+    const sessionFile = join(runtimePath, "sessions", SESSION_ID, "session.json");
+    await rm(sessionFile);
+    await symlink(sentinel, sessionFile);
+    await mkdir(join(runtimePath, "attachments"), { recursive: true });
+    await symlink(outside, join(runtimePath, "attachments", "linked-tree"));
+
+    registry.projects = [project];
+    const response = await service.inspect();
+    const issues = response.projects[0]!.issues;
+
+    expect(issues).toEqual(expect.arrayContaining([
+      { relativePath: "sessions/linked-session", reason: "unreadable" },
+      { relativePath: `sessions/${SESSION_ID}/session.json`, reason: "unreadable" },
+      { relativePath: "attachments/linked-tree", reason: "unreadable" },
+    ]));
+    expect(issues.some((issue) => issue.reason === "invalid_json")).toBe(false);
+    expect(await readFile(sentinel, "utf8")).toBe(`{${SECRET}`);
+  });
+
+  test("reports an orphan Session directory whose required session.json is missing", async () => {
+    const project = await createProject("orphan-session");
+    const orphanPath = join(projectRuntimePath(project.workspaceRoot), "sessions", "orphan");
+    await mkdir(orphanPath);
+    registry.projects = [project];
+
+    const response = await service.inspect();
+
+    expect(response.projects[0]?.issues).toContainEqual({
+      relativePath: "sessions/orphan/session.json",
+      reason: "unreadable",
+    });
+  });
+
+  test("keeps runtime activation errors outside the data inspection DTO", async () => {
+    const startupFailureProject = await createProject("startup-failure");
+    const unrelatedProject = await createProject("unrelated-invalid-todo");
+    await writeFile(
+      join(projectRuntimePath(startupFailureProject.workspaceRoot), "sessions", SESSION_ID, "session.json"),
+      JSON.stringify({ invalidSession: true }),
+    );
+    await writeFile(
+      join(projectRuntimePath(unrelatedProject.workspaceRoot), "todos", "state.json"),
+      JSON.stringify({ invalidTodo: true }),
+    );
+    registry.projects = [startupFailureProject, unrelatedProject];
+
+    const response = await service.inspect();
+
+    expect(response.projects[0]?.issues[0]).toMatchObject({
+      relativePath: `sessions/${SESSION_ID}/session.json`,
+      reason: "invalid_current_schema",
+    });
+    expect(response.projects[1]?.issues[0]).toMatchObject({
+      relativePath: "todos/state.json",
+      reason: "invalid_current_schema",
+    });
+    expect(response).not.toHaveProperty("runtimeError");
+    expect(JSON.stringify(response)).not.toMatch(/startupCause|old version|new version/i);
+  });
+});
+
+describe("RuntimeDataService deletion", () => {
+  test("rejects empty, duplicate, unknown, and healthy selections before mutation", async () => {
+    const invalid = await createProject("invalid");
+    const healthy = await createProject("healthy");
+    const marker = join(projectRuntimePath(invalid.workspaceRoot), "todos", "state.json");
+    await writeFile(marker, "{");
+    registry.projects = [invalid, healthy];
+
+    const requests: Array<{
+      slugs: string[];
+      code: RuntimeDataRequestError["code"];
+    }> = [
+      { slugs: [], code: "EMPTY_PROJECT_SLUGS" },
+      { slugs: [invalid.slug, invalid.slug], code: "DUPLICATE_PROJECT_SLUG" },
+      { slugs: ["not-registered"], code: "PROJECT_NOT_REGISTERED" },
+      { slugs: [invalid.slug, healthy.slug], code: "PROJECT_HAS_NO_ISSUES" },
+    ];
+    for (const request of requests) {
+      await expectRuntimeDataError(service.delete(request.slugs), request.code);
+      expect(await readFile(marker, "utf8")).toBe("{");
+      expect(await lstat(projectRuntimePath(healthy.workspaceRoot))).toBeDefined();
+    }
+  });
+
+  test("deletes only complete selected Runtime trees and preserves every outside boundary", async () => {
+    const selected = await createProject("selected");
+    const unselected = await createProject("unselected");
+    const selectedRuntime = projectRuntimePath(selected.workspaceRoot);
+    const unselectedRuntime = projectRuntimePath(unselected.workspaceRoot);
+    await writeFile(join(selectedRuntime, "todos", "state.json"), "{");
+    await mkdir(join(selectedRuntime, "attachments", "sessions"), { recursive: true });
+    await writeFile(join(selectedRuntime, "attachments", "sessions", "payload.bin"), "payload");
+
+    const preserved = [
+      join(selected.workspaceRoot, "source.ts"),
+      join(selected.workspaceRoot, ".git", "HEAD"),
+      join(selected.workspaceRoot, ".archcode", "plans", "plan.md"),
+      join(selected.workspaceRoot, ".archcode", "skills", "skill.md"),
+    ];
+    for (const path of preserved) {
+      await mkdir(join(path, ".."), { recursive: true });
+      await writeFile(path, `preserved:${path}`);
+    }
+    const unselectedBefore = await readFile(join(unselectedRuntime, "todos", "state.json"));
+    registry.projects = [selected, unselected];
+
+    const response = await service.delete([selected.slug]);
+
+    expect(response).toEqual({ results: [{ projectSlug: selected.slug, status: "deleted" }] });
+    await expect(lstat(selectedRuntime)).rejects.toMatchObject({ code: "ENOENT" });
+    for (const path of preserved) {
+      expect(await readFile(path, "utf8")).toBe(`preserved:${path}`);
+    }
+    expect(await readFile(join(unselectedRuntime, "todos", "state.json"))).toEqual(unselectedBefore);
+    expect((await registry.list()).map((project) => project.slug)).toEqual([selected.slug, unselected.slug]);
+  });
+
+  test("fails closed for workspace, state, Runtime, descendant symlinks, abnormal targets, and lexical escape", async () => {
+    const fixtures: Array<{
+      name: string;
+      arrange(project: ProjectInfo): Promise<ProjectInfo>;
+    }> = [
+      {
+        name: "workspace-symlink",
+        async arrange(project) {
+          await writeFile(join(projectRuntimePath(project.workspaceRoot), "todos", "state.json"), "{");
+          const link = join(TMP_ROOT, "workspace-link");
+          await symlink(project.workspaceRoot, link);
+          return { ...project, slug: "workspace-symlink", workspaceRoot: link };
+        },
+      },
+      {
+        name: "state-symlink",
+        async arrange(project) {
+          const state = join(project.workspaceRoot, ".archcode");
+          const moved = join(project.workspaceRoot, "state-target");
+          await rm(join(projectRuntimePath(project.workspaceRoot), "todos", "state.json"));
+          await writeFile(join(projectRuntimePath(project.workspaceRoot), "todos", "state.json"), "{");
+          await rename(state, moved);
+          await symlink(moved, state);
+          return project;
+        },
+      },
+      {
+        name: "runtime-symlink",
+        async arrange(project) {
+          const runtime = projectRuntimePath(project.workspaceRoot);
+          const moved = join(project.workspaceRoot, "runtime-target");
+          await rm(join(runtime, "todos", "state.json"));
+          await writeFile(join(runtime, "todos", "state.json"), "{");
+          await rename(runtime, moved);
+          await symlink(moved, runtime);
+          return project;
+        },
+      },
+      {
+        name: "descendant-symlink",
+        async arrange(project) {
+          const runtime = projectRuntimePath(project.workspaceRoot);
+          await writeFile(join(runtime, "todos", "state.json"), "{");
+          await symlink(TMP_ROOT, join(runtime, "linked"));
+          return project;
+        },
+      },
+      {
+        name: "runtime-file",
+        async arrange(project) {
+          const runtime = projectRuntimePath(project.workspaceRoot);
+          await rm(runtime, { recursive: true });
+          await writeFile(runtime, "{");
+          return project;
+        },
+      },
+      {
+        name: "lexical-escape",
+        async arrange(project) {
+          await writeFile(join(projectRuntimePath(project.workspaceRoot), "todos", "state.json"), "{");
+          return {
+            ...project,
+            slug: "lexical-escape",
+            workspaceRoot: `${project.workspaceRoot}/child/..`,
+          };
+        },
+      },
+    ];
+
+    for (const fixture of fixtures) {
+      const original = await createProject(fixture.name);
+      const project = await fixture.arrange(original);
+      registry.projects = [project];
+      const sentinel = join(original.workspaceRoot, "sentinel.txt");
+      await writeFile(sentinel, SECRET);
+
+      await expectRuntimeDataError(service.delete([project.slug]), "DELETE_TARGET_UNSAFE");
+
+      expect(await readFile(sentinel, "utf8")).toBe(SECRET);
+    }
+  });
+
+  test("returns per-project deletion errors and leaves retry admission to the Host", async () => {
+    const first = await createProject("first");
+    const second = await createProject("second");
+    await writeFile(join(projectRuntimePath(first.workspaceRoot), "todos", "state.json"), "{");
+    await writeFile(join(projectRuntimePath(second.workspaceRoot), "todos", "state.json"), "{");
+    registry.projects = [first, second];
+
+    const secondStatePath = join(second.workspaceRoot, ".archcode");
+    await chmod(secondStatePath, 0o500);
+    try {
+      const response = await service.delete([first.slug, second.slug]);
+      expect(response.results[0]).toEqual({ projectSlug: first.slug, status: "deleted" });
+      expect(response.results[1]).toEqual({
+        projectSlug: second.slug,
+        status: "error",
+        error: { code: "delete_failed", message: "Runtime data could not be deleted." },
+      });
+      await expect(lstat(projectRuntimePath(first.workspaceRoot))).rejects.toMatchObject({ code: "ENOENT" });
+      expect(await lstat(projectRuntimePath(second.workspaceRoot))).toBeDefined();
+    } finally {
+      await chmod(secondStatePath, 0o700);
+    }
+  });
+});
+
+describe("Runtime Project Registry ownership", () => {
+  test("createRuntime reuses the process-owned registry injected by the control plane", async () => {
+    const homeDir = join(TMP_ROOT, "shared-registry-home");
+    const configPath = resolveServerConfigPath(homeDir);
+    await mkdir(join(configPath, ".."), { recursive: true });
+    await writeFile(configPath, JSON.stringify({
+      provider: {
+        local: {
+          npm: "@ai-sdk/openai-compatible",
+          name: "Local",
+          options: { baseURL: "http://localhost:8090/v1", apiKey: "test-key" },
+          models: {
+            test: {
+              name: "Test",
+              limit: { context: 128_000, output: 8_192 },
+              modalities: { input: ["text"], output: ["text"] },
+            },
+          },
+        },
+      },
+      profiles: {
+        principal: { model: "local:test" },
+        deep: { model: "local:test" },
+        fast: { model: "local:test" },
+      },
+    }));
+    const configService = new ServerConfigService({ homeDir });
+    const activation = await configService.activateForStartup();
+    if (activation.status !== "ready") throw new Error("Expected a valid test Config");
+    const processRegistry = new ProjectRegistry({ homeDir, logger: silentLogger });
+    const fakeMcpManager = {
+      startBackgroundDiscovery: () => {},
+      closeAll: async () => [],
+      getStatus: () => new Map(),
+      onStatusChange: () => () => {},
+    } as unknown as McpManager;
+
+    const runtime = await createRuntime({
+      configService,
+      activation: activation.activation,
+      projectRegistry: processRegistry,
+      runtimeStorageHomeDir: join(TMP_ROOT, "runtime-storage"),
+      mcpManagerFactory: () => fakeMcpManager,
+    });
+    try {
+      expect(runtime.projectRegistry).toBe(processRegistry);
+    } finally {
+      await runtime.shutdown();
+    }
+  });
+});
+
+async function createProject(slug: string): Promise<ProjectInfo> {
+  const workspaceRoot = join(TMP_ROOT, slug);
+  await mkdir(workspaceRoot, { recursive: true });
+  const project: ProjectInfo = {
+    slug,
+    name: slug,
+    workspaceRoot,
+    addedAt: "2026-08-04T00:00:00.000Z",
+  };
+  await writeValidRuntime(project);
+  return project;
+}
+
+async function writeValidRuntime(project: ProjectInfo): Promise<void> {
+  const manager = new SessionStoreManager({ logger: silentLogger });
+  await manager.createSessionFile(project.workspaceRoot, {
+    agentName: "lead",
+    source: { kind: "direct" },
+  }, SESSION_ID);
+  const runtimePath = projectRuntimePath(project.workspaceRoot);
+  await mkdir(join(runtimePath, "todos"), { recursive: true });
+  await mkdir(join(runtimePath, "automations"), { recursive: true });
+  await writeFile(join(runtimePath, "todos", "state.json"), JSON.stringify({
+    todos: [],
+    runNowReceipts: [],
+  }));
+  await writeFile(join(runtimePath, "automations", "state.json"), JSON.stringify({
+    automations: [],
+    invocations: [],
+  }));
+  await writeFile(join(runtimePath, "hitl-queue.json"), JSON.stringify({
+    records: [],
+    updatedAt: "2026-08-04T00:00:00.000Z",
+  }));
+  await writeFile(join(runtimePath, "permissions.json"), JSON.stringify({ approvals: [] }));
+}
+
+async function expectRuntimeDataError(
+  operation: Promise<unknown>,
+  code: RuntimeDataRequestError["code"],
+): Promise<void> {
+  try {
+    await operation;
+    throw new Error(`Expected RuntimeDataRequestError ${code}`);
+  } catch (error) {
+    expect(error).toBeInstanceOf(RuntimeDataRequestError);
+    expect((error as RuntimeDataRequestError).code).toBe(code);
+  }
+}
diff --git a/packages/agent-core/src/runtime-data/service.ts b/packages/agent-core/src/runtime-data/service.ts
new file mode 100644
index 00000000..3061a704
--- /dev/null
+++ b/packages/agent-core/src/runtime-data/service.ts
@@ -0,0 +1,588 @@
+import {
+  constants,
+  type Stats,
+} from "node:fs";
+import {
+  lstat,
+  open,
+  readdir,
+  realpath,
+  rm,
+} from "node:fs/promises";
+import {
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+  sep,
+} from "node:path";
+import type {
+  RuntimeDataDeleteResult,
+  RuntimeDataInspectionResponse,
+  RuntimeDataIssue,
+  RuntimeDataProjectInspection,
+  RuntimeDataSchemaIssue,
+  RuntimeDataStats,
+} from "@archcode/protocol";
+
+import { AutomationStateFileSchema } from "../automations/schema";
+import { HitlBoundaryCodec } from "../hitl/boundary-codec";
+import type { ProjectInfo } from "../projects/types";
+import { projectRuntimePath } from "../projects/runtime-path";
+import { SecretRedactionPolicy } from "../security";
+import { SessionFileSchema } from "../store/helpers";
+import { ProjectTodoStateFileSchema } from "../todos/schema";
+import { PermissionApprovalFileSchema } from "../tools/permission/project-approvals";
+
+const SCHEMA_ISSUE_MESSAGE = "Does not match the current ArchCode data format.";
+const MAX_SCHEMA_ISSUES_PER_FILE = 20;
+const MAX_SCHEMA_ISSUE_PATH_SEGMENTS = 12;
+const SCHEMA_ISSUE_FIELD_SEGMENT = "$field";
+
+export type RuntimeDataRequestErrorCode =
+  | "EMPTY_PROJECT_SLUGS"
+  | "DUPLICATE_PROJECT_SLUG"
+  | "PROJECT_NOT_REGISTERED"
+  | "PROJECT_HAS_NO_ISSUES"
+  | "DELETE_TARGET_UNSAFE";
+
+export interface RuntimeDataProjectRegistry {
+  list(): Promise<ProjectInfo[]>;
+}
+
+export interface RuntimeDataServiceOptions {
+  readonly projectRegistry: RuntimeDataProjectRegistry;
+}
+
+export class RuntimeDataRequestError extends Error {
+  constructor(
+    public readonly code: RuntimeDataRequestErrorCode,
+    message: string,
+    public readonly projectSlug?: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+    this.name = "RuntimeDataRequestError";
+  }
+}
+
+/** Narrow current-schema inspection and whole-project Runtime deletion service. */
+export class RuntimeDataService {
+  readonly #projectRegistry: RuntimeDataProjectRegistry;
+  readonly #hitlCodec = new HitlBoundaryCodec(new SecretRedactionPolicy([]));
+
+  constructor(options: RuntimeDataServiceOptions) {
+    this.#projectRegistry = options.projectRegistry;
+  }
+
+  async inspect(): Promise<RuntimeDataInspectionResponse> {
+    const projects = await this.#projectRegistry.list();
+    return {
+      projects: await Promise.all(projects.map(async (project) => await this.#inspectProject(project))),
+    };
+  }
+
+  async delete(projectSlugs: readonly string[]): Promise<RuntimeDataDeleteResult> {
+    assertProjectSlugs(projectSlugs);
+
+    const registeredProjects = await this.#projectRegistry.list();
+    const projectsBySlug = new Map(registeredProjects.map((project) => [project.slug, project]));
+    const projects = projectSlugs.map((projectSlug) => {
+      const project = projectsBySlug.get(projectSlug);
+      if (project === undefined) {
+        throw new RuntimeDataRequestError(
+          "PROJECT_NOT_REGISTERED",
+          "Runtime data can only be deleted for a registered project.",
+          projectSlug,
+        );
+      }
+      return project;
+    });
+
+    // Complete every rejection and filesystem-safety check before deleting any
+    // selected project. A bad item therefore cannot partially authorize a batch.
+    for (const project of projects) {
+      const inspection = await this.#inspectProject(project);
+      if (inspection.issues.length === 0) {
+        throw new RuntimeDataRequestError(
+          "PROJECT_HAS_NO_ISSUES",
+          "Runtime data can only be deleted for a project with detected issues.",
+          project.slug,
+        );
+      }
+      if (inspection.issues.some((issue) => issue.reason === "unreadable")) {
+        throw new RuntimeDataRequestError(
+          "DELETE_TARGET_UNSAFE",
+          "The project Runtime tree is not safe to delete.",
+          project.slug,
+        );
+      }
+      await assertSafeDeletionTarget(project);
+    }
+
+    const results = [] as RuntimeDataDeleteResult["results"][number][];
+    for (const project of projects) {
+      try {
+        const currentInspection = await this.#inspectProject(project);
+        if (currentInspection.issues.length === 0
+          || currentInspection.issues.some((issue) => issue.reason === "unreadable")) {
+          throw unsafeDeletionTarget(project.slug);
+        }
+        await assertSafeDeletionTarget(project);
+        const runtimePath = projectRuntimePath(project.workspaceRoot);
+        await rm(runtimePath, { recursive: true, force: false, maxRetries: 0 });
+        if (await lstatIfPresent(runtimePath) !== undefined) {
+          throw new Error("Runtime path still exists after deletion");
+        }
+        results.push({ projectSlug: project.slug, status: "deleted" });
+      } catch {
+        results.push({
+          projectSlug: project.slug,
+          status: "error",
+          error: {
+            code: "delete_failed",
+            message: "Runtime data could not be deleted.",
+          },
+        });
+      }
+    }
+
+    return { results };
+  }
+
+  async #inspectProject(project: ProjectInfo): Promise<RuntimeDataProjectInspection> {
+    const runtimePath = projectRuntimePath(project.workspaceRoot);
+    const issues: RuntimeDataIssue[] = [];
+    const issueKeys = new Set<string>();
+    const addIssue = (issue: RuntimeDataIssue): void => {
+      const key = `${issue.reason}\0${issue.relativePath}`;
+      if (issueKeys.has(key)) return;
+      issueKeys.add(key);
+      issues.push(issue);
+    };
+
+    let stats: RuntimeDataStats = { fileCount: 0, totalBytes: 0 };
+    try {
+      if (!await isInspectableRuntimeRoot(project.workspaceRoot, runtimePath, addIssue)) {
+        return projectInspection(project, runtimePath, stats, issues);
+      }
+      stats = await scanRuntimeTree(runtimePath, addIssue);
+      await this.#inspectSessions(runtimePath, addIssue);
+      await inspectJsonFile(
+        runtimePath,
+        "todos/state.json",
+        (value) => ProjectTodoStateFileSchema.parse(value),
+        addIssue,
+      );
+      await inspectJsonFile(
+        runtimePath,
+        "automations/state.json",
+        (value) => AutomationStateFileSchema.parse(value),
+        addIssue,
+      );
+      await inspectJsonFile(
+        runtimePath,
+        "hitl-queue.json",
+        (value) => this.#hitlCodec.parseProjectFile(value),
+        addIssue,
+      );
+      await inspectJsonFile(
+        runtimePath,
+        "permissions.json",
+        (value) => PermissionApprovalFileSchema.parse(value),
+        addIssue,
+      );
+    } catch {
+      addIssue({ relativePath: ".", reason: "unreadable" });
+    }
+
+    return projectInspection(project, runtimePath, stats, issues);
+  }
+
+  async #inspectSessions(
+    runtimePath: string,
+    addIssue: (issue: RuntimeDataIssue) => void,
+  ): Promise<void> {
+    const sessionsPath = join(runtimePath, "sessions");
+    const sessionsStat = await inspectDirectory(sessionsPath, "sessions", addIssue);
+    if (sessionsStat === undefined) return;
+
+    let sessionNames: string[];
+    try {
+      sessionNames = await readdir(sessionsPath);
+    } catch {
+      addIssue({ relativePath: "sessions", reason: "unreadable" });
+      return;
+    }
+
+    for (const sessionName of sessionNames.sort()) {
+      const sessionRelativePath = joinRelative("sessions", sessionName);
+      const sessionPath = join(sessionsPath, sessionName);
+      const sessionStat = await lstatForInspection(sessionPath, sessionRelativePath, addIssue);
+      if (sessionStat === undefined) continue;
+      if (sessionStat.isSymbolicLink() || !sessionStat.isDirectory()) {
+        addIssue({ relativePath: sessionRelativePath, reason: "unreadable" });
+        continue;
+      }
+      await inspectJsonFile(
+        runtimePath,
+        joinRelative(sessionRelativePath, "session.json"),
+        (value) => SessionFileSchema.parse(value),
+        addIssue,
+        true,
+      );
+    }
+  }
+}
+
+function assertProjectSlugs(projectSlugs: readonly string[]): void {
+  if (projectSlugs.length === 0) {
+    throw new RuntimeDataRequestError(
+      "EMPTY_PROJECT_SLUGS",
+      "At least one project slug is required.",
+    );
+  }
+  const unique = new Set(projectSlugs);
+  if (unique.size !== projectSlugs.length) {
+    throw new RuntimeDataRequestError(
+      "DUPLICATE_PROJECT_SLUG",
+      "Project slugs must not contain duplicates.",
+    );
+  }
+}
+
+async function scanRuntimeTree(
+  runtimePath: string,
+  addIssue: (issue: RuntimeDataIssue) => void,
+): Promise<RuntimeDataStats> {
+  const stats = { fileCount: 0, totalBytes: 0 };
+  const rootStat = await lstatForInspection(runtimePath, ".", addIssue);
+  if (rootStat === undefined) return stats;
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    addIssue({ relativePath: ".", reason: "unreadable" });
+    return stats;
+  }
+
+  const directories = [runtimePath];
+  while (directories.length > 0) {
+    const directoryPath = directories.pop()!;
+    const directoryRelativePath = toRuntimeRelativePath(runtimePath, directoryPath);
+    let names: string[];
+    try {
+      names = await readdir(directoryPath);
+    } catch {
+      addIssue({ relativePath: directoryRelativePath, reason: "unreadable" });
+      continue;
+    }
+
+    for (const name of names.sort().reverse()) {
+      const entryPath = join(directoryPath, name);
+      const entryRelativePath = toRuntimeRelativePath(runtimePath, entryPath);
+      const entryStat = await lstatForInspection(entryPath, entryRelativePath, addIssue);
+      if (entryStat === undefined) continue;
+      if (entryStat.isSymbolicLink()) {
+        addIssue({ relativePath: entryRelativePath, reason: "unreadable" });
+      } else if (entryStat.isDirectory()) {
+        directories.push(entryPath);
+      } else if (entryStat.isFile()) {
+        stats.fileCount += 1;
+        stats.totalBytes += entryStat.size;
+      } else {
+        addIssue({ relativePath: entryRelativePath, reason: "unreadable" });
+      }
+    }
+  }
+  return stats;
+}
+
+async function inspectDirectory(
+  path: string,
+  relativePath: string,
+  addIssue: (issue: RuntimeDataIssue) => void,
+): Promise<Stats | undefined> {
+  const stat = await lstatForInspection(path, relativePath, addIssue);
+  if (stat === undefined) return undefined;
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    addIssue({ relativePath, reason: "unreadable" });
+    return undefined;
+  }
+  return stat;
+}
+
+async function lstatForInspection(
+  path: string,
+  relativePath: string,
+  addIssue: (issue: RuntimeDataIssue) => void,
+): Promise<Stats | undefined> {
+  try {
+    return await lstat(path);
+  } catch (error) {
+    if (isMissingPathError(error)) return undefined;
+    addIssue({ relativePath, reason: "unreadable" });
+    return undefined;
+  }
+}
+
+async function inspectJsonFile(
+  runtimePath: string,
+  relativePath: string,
+  parseCurrentSchema: (value: unknown) => unknown,
+  addIssue: (issue: RuntimeDataIssue) => void,
+  missingIsUnreadable = false,
+): Promise<void> {
+  const path = join(runtimePath, relativePath);
+  const stat = await lstatForInspection(path, relativePath, addIssue);
+  if (stat === undefined) {
+    if (missingIsUnreadable) addIssue({ relativePath, reason: "unreadable" });
+    return;
+  }
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    addIssue({ relativePath, reason: "unreadable" });
+    return;
+  }
+
+  let text: string;
+  try {
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+      const openedStat = await handle.stat();
+      if (!openedStat.isFile()) {
+        addIssue({ relativePath, reason: "unreadable" });
+        return;
+      }
+      text = await handle.readFile({ encoding: "utf8" });
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    addIssue({ relativePath, reason: "unreadable" });
+    return;
+  }
+
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    addIssue({ relativePath, reason: "invalid_json" });
+    return;
+  }
+
+  try {
+    parseCurrentSchema(value);
+  } catch (error) {
+    addIssue({
+      relativePath,
+      reason: "invalid_current_schema",
+      schemaIssues: sanitizeSchemaIssues(error),
+    });
+  }
+}
+
+function sanitizeSchemaIssues(error: unknown): RuntimeDataSchemaIssue[] {
+  const issues = isRecord(error) && Array.isArray(error.issues) ? error.issues : [];
+  const sanitized = new Map<string, RuntimeDataSchemaIssue>();
+  for (const issue of issues) {
+    const rawPath = isRecord(issue) && Array.isArray(issue.path) ? issue.path : [];
+    const next = {
+      path: rawPath
+        .slice(0, MAX_SCHEMA_ISSUE_PATH_SEGMENTS)
+        .map((part) => typeof part === "number" ? part : SCHEMA_ISSUE_FIELD_SEGMENT),
+      message: SCHEMA_ISSUE_MESSAGE,
+    };
+    sanitized.set(JSON.stringify(next.path), next);
+    if (sanitized.size >= MAX_SCHEMA_ISSUES_PER_FILE) break;
+  }
+  return sanitized.size > 0
+    ? [...sanitized.values()]
+    : [{ path: [], message: SCHEMA_ISSUE_MESSAGE }];
+}
+
+async function isInspectableRuntimeRoot(
+  workspacePath: string,
+  runtimePath: string,
+  addIssue: (issue: RuntimeDataIssue) => void,
+): Promise<boolean> {
+  const workspaceState = await inspectAncestorDirectory(workspacePath, false);
+  if (workspaceState !== "directory") {
+    addIssue({ relativePath: ".", reason: "unreadable" });
+    return false;
+  }
+
+  const statePath = dirname(runtimePath);
+  const stateState = await inspectAncestorDirectory(statePath, true);
+  if (stateState === "missing") return false;
+  if (stateState !== "directory") {
+    addIssue({ relativePath: ".", reason: "unreadable" });
+    return false;
+  }
+
+  const runtimeState = await inspectAncestorDirectory(runtimePath, true);
+  if (runtimeState === "missing") return false;
+  if (runtimeState !== "directory") {
+    addIssue({ relativePath: ".", reason: "unreadable" });
+    return false;
+  }
+  return true;
+}
+
+async function inspectAncestorDirectory(
+  path: string,
+  missingIsEmpty: boolean,
+): Promise<"directory" | "missing" | "unsafe"> {
+  try {
+    const stat = await lstat(path);
+    return !stat.isSymbolicLink() && stat.isDirectory() ? "directory" : "unsafe";
+  } catch (error) {
+    if (missingIsEmpty && isMissingPathError(error)) return "missing";
+    return "unsafe";
+  }
+}
+
+function projectInspection(
+  project: ProjectInfo,
+  runtimePath: string,
+  stats: RuntimeDataStats,
+  issues: RuntimeDataIssue[],
+): RuntimeDataProjectInspection {
+  return {
+    projectSlug: project.slug,
+    name: project.name,
+    workspace: project.workspaceRoot,
+    runtimePath,
+    stats,
+    issues: issues.sort(compareIssues),
+  };
+}
+
+async function assertSafeDeletionTarget(project: ProjectInfo): Promise<void> {
+  const workspacePath = project.workspaceRoot;
+  const normalizedWorkspacePath = resolve(workspacePath);
+  const runtimePath = projectRuntimePath(workspacePath);
+  const statePath = dirname(runtimePath);
+  const normalizedStatePath = join(normalizedWorkspacePath, ".archcode");
+  const normalizedRuntimePath = join(normalizedStatePath, "runtime");
+
+  if (!isAbsolute(workspacePath)
+    || normalizedWorkspacePath !== workspacePath
+    || resolve(statePath) !== normalizedStatePath
+    || resolve(runtimePath) !== normalizedRuntimePath
+    || !isPathWithin(normalizedWorkspacePath, normalizedStatePath)
+    || !isPathWithin(normalizedStatePath, normalizedRuntimePath)) {
+    throw unsafeDeletionTarget(project.slug);
+  }
+
+  const workspaceStat = await requirePlainDirectory(workspacePath, project.slug);
+  const stateStat = await requirePlainDirectory(statePath, project.slug);
+  const runtimeStat = await requirePlainDirectory(runtimePath, project.slug);
+  if (!workspaceStat.isDirectory() || !stateStat.isDirectory() || !runtimeStat.isDirectory()) {
+    throw unsafeDeletionTarget(project.slug);
+  }
+
+  let realWorkspace: string;
+  let realState: string;
+  let realRuntime: string;
+  try {
+    [realWorkspace, realState, realRuntime] = await Promise.all([
+      realpath(workspacePath),
+      realpath(statePath),
+      realpath(runtimePath),
+    ]);
+  } catch (error) {
+    throw unsafeDeletionTarget(project.slug, error);
+  }
+  if (realState !== join(realWorkspace, ".archcode")
+    || realRuntime !== join(realState, "runtime")
+    || !isPathWithin(realWorkspace, realState)
+    || !isPathWithin(realState, realRuntime)) {
+    throw unsafeDeletionTarget(project.slug);
+  }
+
+  await assertPlainRuntimeTree(runtimePath, project.slug);
+}
+
+async function assertPlainRuntimeTree(runtimePath: string, projectSlug: string): Promise<void> {
+  const directories = [runtimePath];
+  while (directories.length > 0) {
+    const directoryPath = directories.pop()!;
+    let names: string[];
+    try {
+      names = await readdir(directoryPath);
+    } catch (error) {
+      throw unsafeDeletionTarget(projectSlug, error);
+    }
+    for (const name of names) {
+      const entryPath = join(directoryPath, name);
+      let stat: Stats;
+      try {
+        stat = await lstat(entryPath);
+      } catch (error) {
+        throw unsafeDeletionTarget(projectSlug, error);
+      }
+      if (stat.isSymbolicLink()) throw unsafeDeletionTarget(projectSlug);
+      if (stat.isDirectory()) {
+        directories.push(entryPath);
+      } else if (!stat.isFile()) {
+        throw unsafeDeletionTarget(projectSlug);
+      }
+    }
+  }
+}
+
+async function requirePlainDirectory(path: string, projectSlug: string): Promise<Stats> {
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) throw unsafeDeletionTarget(projectSlug);
+    return stat;
+  } catch (error) {
+    if (error instanceof RuntimeDataRequestError) throw error;
+    throw unsafeDeletionTarget(projectSlug, error);
+  }
+}
+
+function unsafeDeletionTarget(projectSlug: string, cause?: unknown): RuntimeDataRequestError {
+  return new RuntimeDataRequestError(
+    "DELETE_TARGET_UNSAFE",
+    "The project Runtime tree is not safe to delete.",
+    projectSlug,
+    cause === undefined ? undefined : { cause },
+  );
+}
+
+async function lstatIfPresent(path: string): Promise<Stats | undefined> {
+  try {
+    return await lstat(path);
+  } catch (error) {
+    if (isMissingPathError(error)) return undefined;
+    throw error;
+  }
+}
+
+function isMissingPathError(error: unknown): boolean {
+  return isRecord(error) && error.code === "ENOENT";
+}
+
+function isPathWithin(parent: string, child: string): boolean {
+  const pathFromParent = relative(parent, child);
+  return pathFromParent !== ""
+    && pathFromParent !== ".."
+    && !pathFromParent.startsWith(`..${sep}`)
+    && !isAbsolute(pathFromParent);
+}
+
+function toRuntimeRelativePath(runtimePath: string, path: string): string {
+  const value = relative(runtimePath, path);
+  return value === "" ? "." : value.split(sep).join("/");
+}
+
+function joinRelative(...parts: string[]): string {
+  return parts.join("/");
+}
+
+function compareIssues(left: RuntimeDataIssue, right: RuntimeDataIssue): number {
+  return left.relativePath.localeCompare(right.relativePath) || left.reason.localeCompare(right.reason);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
diff --git a/packages/agent-core/src/runtime-mcp.test.ts b/packages/agent-core/src/runtime-mcp.test.ts
index fb312421..1d3c2fad 100644
--- a/packages/agent-core/src/runtime-mcp.test.ts
+++ b/packages/agent-core/src/runtime-mcp.test.ts
@@ -17,12 +17,17 @@ import {
   type AgentRuntimeOptions,
 } from "./runtime";
 import { ServerConfigService, resolveServerConfigPath } from "./config";
+import { silentLogger } from "./logger";
+import { ProjectRegistry } from "./projects/registry";
 import { ToolOutputArtifactStore } from "./tool-output/artifact-store";
 import { REDACTION_MARKER, type SecretRedactionPolicy } from "./security";
 import { createInMemoryLogger } from "./logger";
 
-type RuntimeTestOptions = Omit<AgentRuntimeOptions, "activation"> & {
+type RuntimeTestOptions = Omit<AgentRuntimeOptions, "activation" | "projectRegistry"> & {
+  projectRegistry?: ProjectRegistry;
   toolOutputStoreFactory?: (rootDir: string) => ToolOutputArtifactStore;
+  executionManagerShutdown?: () => Promise<void>;
+  sessionAgentManagerDisposeAll?: () => void;
 };
 
 const tmpRoots: string[] = [];
@@ -44,11 +49,13 @@ async function createRuntime(
 ): ReturnType<typeof createProductionRuntime> {
   const result = await options.configService.activateForStartup();
   if (result.status !== "ready") throw new Error(`Expected ready config, received ${result.status}`);
-  const projectRegistryHomeDir = options.projectRegistryHomeDir ?? await makeTempRoot();
+  const runtimeStorageHomeDir = options.runtimeStorageHomeDir ?? await makeTempRoot();
   return createProductionRuntime({
     ...options,
     activation: result.activation,
-    projectRegistryHomeDir,
+    projectRegistry: options.projectRegistry
+      ?? new ProjectRegistry({ homeDir: runtimeStorageHomeDir, logger: silentLogger }),
+    runtimeStorageHomeDir,
   });
 }
 
@@ -454,6 +461,57 @@ describe("createRuntime MCP background loading", () => {
 });
 
 describe("createRuntime tool output lifecycle", () => {
+  test("retries only failed shutdown steps after a best-effort round", async () => {
+    const configService = await writeConfig(makeConfig({ servers: {} }));
+    const { manager } = makeMockMcpManager();
+    const root = await makeTempRoot();
+    const cleanupCalls: string[] = [];
+    let executionShutdownAttempts = 0;
+
+    (manager as unknown as { closeAll: () => Promise<McpWarning[]> }).closeAll = mock(async () => {
+      cleanupCalls.push("mcp");
+      return [];
+    });
+    class TrackingStore extends ToolOutputArtifactStore {
+      override async dispose(): Promise<void> {
+        cleanupCalls.push("artifacts");
+        await super.dispose();
+      }
+    }
+
+    const runtime = await createRuntime({
+      configService,
+      mcpManagerFactory: () => manager,
+      toolOutputRootDir: root,
+      toolOutputStoreFactory: (rootDir) => new TrackingStore({ rootDir }),
+      executionManagerShutdown: async () => {
+        executionShutdownAttempts += 1;
+        cleanupCalls.push(`executions:${executionShutdownAttempts}`);
+        if (executionShutdownAttempts === 1) throw new Error("execution cleanup failed");
+      },
+      sessionAgentManagerDisposeAll: () => {
+        cleanupCalls.push("agents");
+      },
+    });
+
+    const firstShutdown = runtime.shutdown();
+    expect(runtime.shutdown()).toBe(firstShutdown);
+    await expect(firstShutdown).rejects.toMatchObject({
+      name: "AggregateError",
+      message: "AgentRuntime shutdown failed",
+    });
+    expect(cleanupCalls).toEqual(["executions:1", "artifacts", "mcp", "agents"]);
+
+    const retryShutdown = runtime.shutdown();
+    expect(retryShutdown).not.toBe(firstShutdown);
+    await retryShutdown;
+    expect(cleanupCalls).toEqual(["executions:1", "artifacts", "mcp", "agents", "executions:2"]);
+
+    expect(runtime.shutdown()).toBe(retryShutdown);
+    await runtime.shutdown();
+    expect(cleanupCalls).toEqual(["executions:1", "artifacts", "mcp", "agents", "executions:2"]);
+  });
+
   test("initializes the configured store and exposes awaited disposal", async () => {
     const configService = await writeConfig(makeConfig({ servers: {} }));
     const { manager } = makeMockMcpManager();
diff --git a/packages/agent-core/src/runtime.ts b/packages/agent-core/src/runtime.ts
index 18c9750d..3e88ed9e 100644
--- a/packages/agent-core/src/runtime.ts
+++ b/packages/agent-core/src/runtime.ts
@@ -1,4 +1,3 @@
-import { homedir } from "node:os";
 import { join } from "node:path";
 import { defaultAgentDefinitions, isUserFacingRootSession } from "./agents";
 import type { AgentName } from "./agents";
@@ -29,7 +28,7 @@ import {
 } from "./mcp/index";
 import { ModelSelectionResolver, type ModelRuntime } from "./models";
 import { ProjectContextResolver } from "./projects/context-resolver";
-import { ProjectRegistry } from "./projects/registry";
+import type { ProjectRegistry } from "./projects/registry";
 import type { ProjectInfo } from "./projects/types";
 import { SessionLifecycleService } from "./projects/session-lifecycle-service";
 import { SkillService } from "./skills";
@@ -240,7 +239,10 @@ export interface AgentRuntimeOptions {
   mcpManagerFactory?: (config: ResolvedMcpConfig, redactionPolicy: SecretRedactionPolicy) => McpManager;
   /** Already-resolved process-owned secret literals that are not part of global Config. */
   externalSecretLiterals?: readonly string[];
-  projectRegistryHomeDir?: string;
+  /** Process-owned registry shared with the control plane. Runtime never constructs one. */
+  projectRegistry: ProjectRegistry;
+  /** Test-only base directory for Runtime-owned process storage such as tool outputs. */
+  runtimeStorageHomeDir?: string;
   /** Internal storage location override for isolated tests. */
   toolOutputRootDir?: string;
   automationSchedulerTimer?: AutomationSchedulerTimer;
@@ -253,6 +255,9 @@ interface AgentRuntimeInternalOptions extends AgentRuntimeOptions {
   toolOutputStoreFactory?: (rootDir: string) => ToolOutputArtifactStore;
   /** Test-only seam for best-effort attachment cleanup failures. */
   attachmentRootRemover?: (path: string) => Promise<void>;
+  /** Test-only seams for proving Runtime shutdown cleanup ordering. */
+  executionManagerShutdown?: () => Promise<void>;
+  sessionAgentManagerDisposeAll?: () => void;
 }
 
 export interface CreateRuntimeSessionOptions {
@@ -527,7 +532,7 @@ export async function createRuntime(
   const runtimeLogger = createRuntimeLogSafetyBoundary(logger, redactionPolicy).child({ module: "runtime" });
 
   const toolOutputRootDir = options.toolOutputRootDir
-    ?? join(options.projectRegistryHomeDir ?? homedir(), USER_DATA_DIR_NAME, "tool-output");
+    ?? join(options.runtimeStorageHomeDir ?? options.configService.homeDir, USER_DATA_DIR_NAME, "tool-output");
   const toolOutputArtifactStore = internalOptions.toolOutputStoreFactory?.(toolOutputRootDir)
     ?? new ToolOutputArtifactStore({ rootDir: toolOutputRootDir });
   let mcpManager: McpManager | undefined;
@@ -591,7 +596,7 @@ export async function createRuntime(
       (warning) => recordWarning(warning),
     );
 
-    const projectRegistry = new ProjectRegistry({ homeDir: options.projectRegistryHomeDir, logger: runtimeLogger.child({ module: "projects.registry" }) });
+    const projectRegistry = options.projectRegistry;
     const projectSlugsByWorkspace = new Map(
       (await projectRegistry.list()).map((project) => [project.workspaceRoot, project.slug]),
     );
@@ -1892,11 +1897,27 @@ export async function createRuntime(
 
     async function stopAutomationSchedulers(): Promise<void> {
       automationSchedulersStarted = false;
-      const services = await Promise.allSettled([...automationRuntimeServices.values()]);
-      for (const result of services) {
-        if (result.status === "fulfilled") result.value.scheduler.dispose();
+      const entries = [...automationRuntimeServices.entries()];
+      const services = await Promise.allSettled(entries.map(([, service]) => service));
+      const errors: unknown[] = [];
+      for (const [index, result] of services.entries()) {
+        const [workspaceRoot, service] = entries[index]!;
+        if (result.status === "rejected") {
+          errors.push(result.reason);
+          continue;
+        }
+        try {
+          result.value.scheduler.dispose();
+          if (automationRuntimeServices.get(workspaceRoot) === service) {
+            automationRuntimeServices.delete(workspaceRoot);
+          }
+        } catch (error) {
+          errors.push(error);
+        }
+      }
+      if (errors.length > 0) {
+        throw new AggregateError(errors, "Automation scheduler shutdown failed");
       }
-      automationRuntimeServices.clear();
     }
 
     async function getToolOutputAccess(
@@ -2036,21 +2057,58 @@ export async function createRuntime(
       shutdownReconciliation();
       return executionManager.abortAll();
     };
+    type ShutdownStep = {
+      completed: boolean;
+      readonly operation: () => void | Promise<void>;
+    };
+    const shutdownSteps: ShutdownStep[] = [
+      { completed: false, operation: stopAutomationSchedulers },
+      { completed: false, operation: shutdownReconciliation },
+      {
+        completed: false,
+        operation: () => internalOptions.executionManagerShutdown !== undefined
+          ? internalOptions.executionManagerShutdown()
+          : executionManager.shutdown(),
+      },
+      { completed: false, operation: () => toolOutputArtifactStore.dispose() },
+      { completed: false, operation: () => closeMcpManager(activeMcpManager, warnings, runtimeLogger) },
+      {
+        completed: false,
+        operation: () => internalOptions.sessionAgentManagerDisposeAll !== undefined
+          ? internalOptions.sessionAgentManagerDisposeAll()
+          : sessionAgentManager.disposeAll(),
+      },
+    ];
     let shutdownPromise: Promise<void> | undefined;
     const shutdown = (): Promise<void> => {
       if (shutdownPromise !== undefined) return shutdownPromise;
 
-      shutdownPromise = (async () => {
-        await stopAutomationSchedulers();
-        shutdownReconciliation();
-        await executionManager.shutdown();
-        await Promise.all([
-          toolOutputArtifactStore.dispose(),
-          closeMcpManager(activeMcpManager, warnings, runtimeLogger),
-        ]);
-        sessionAgentManager.disposeAll();
+      const currentShutdown = (async () => {
+        const errors: unknown[] = [];
+        const attempt = async (step: ShutdownStep): Promise<void> => {
+          if (step.completed) return;
+          try {
+            await step.operation();
+            step.completed = true;
+          } catch (error) {
+            errors.push(error);
+          }
+        };
+
+        for (const step of shutdownSteps) await attempt(step);
+
+        if (errors.length > 0) {
+          throw new AggregateError(errors, "AgentRuntime shutdown failed");
+        }
       })();
-      return shutdownPromise;
+      shutdownPromise = currentShutdown;
+      void currentShutdown.then(
+        () => undefined,
+        () => {
+          if (shutdownPromise === currentShutdown) shutdownPromise = undefined;
+        },
+      );
+      return currentShutdown;
     };
 
     return {
diff --git a/packages/agent-core/src/tool-output/artifact-lifecycle.test.ts b/packages/agent-core/src/tool-output/artifact-lifecycle.test.ts
index a6a6c840..61a0fafc 100644
--- a/packages/agent-core/src/tool-output/artifact-lifecycle.test.ts
+++ b/packages/agent-core/src/tool-output/artifact-lifecycle.test.ts
@@ -7,6 +7,7 @@ import { join } from "node:path";
 import { ServerConfigService, resolveServerConfigPath } from "../config";
 import { silentLogger } from "../logger";
 import type { McpManager } from "../mcp";
+import { ProjectRegistry } from "../projects/registry";
 import { createRuntime as createProductionRuntime } from "../runtime";
 import { createTestArtifact } from "./artifact-store-fixture.test";
 import {
@@ -23,7 +24,11 @@ const CURSOR_KEY = new Uint8Array(32).fill(19);
 const roots = new Set<string>();
 const stores = new Set<ToolOutputArtifactStore>();
 
-type RuntimeTestOptions = Omit<NonNullable<Parameters<typeof createProductionRuntime>[0]>, "activation"> & {
+type RuntimeTestOptions = Omit<
+  NonNullable<Parameters<typeof createProductionRuntime>[0]>,
+  "activation" | "projectRegistry"
+> & {
+  projectRegistry?: ProjectRegistry;
   toolOutputStoreFactory?: (rootDir: string) => ToolOutputArtifactStore;
 };
 
@@ -134,9 +139,14 @@ function fakeMcpManager(): McpManager {
 async function createRuntime(options: RuntimeTestOptions) {
   const result = await options.configService.activateForStartup();
   if (result.status !== "ready") throw new Error(`Expected ready config, received ${result.status}`);
+  const runtimeStorageHomeDir = options.runtimeStorageHomeDir
+    ?? await makeRoot("archcode-output-runtime-home-");
   return createProductionRuntime({
     ...options,
     activation: result.activation,
+    projectRegistry: options.projectRegistry
+      ?? new ProjectRegistry({ homeDir: runtimeStorageHomeDir, logger: silentLogger }),
+    runtimeStorageHomeDir,
   } as Parameters<typeof createProductionRuntime>[0]);
 }
 
@@ -155,7 +165,7 @@ describe("Tool Output AC-05 lifecycle acceptance", () => {
     let artifactStore: ToolOutputArtifactStore | undefined;
     const runtime = await createRuntime({
       configService: await writeConfig(homeDir),
-      projectRegistryHomeDir: homeDir,
+      runtimeStorageHomeDir: homeDir,
       toolOutputRootDir: join(homeDir, "tool-output"),
       mcpManagerFactory: () => fakeMcpManager(),
       logger: silentLogger,
diff --git a/packages/protocol/src/bootstrap.ts b/packages/protocol/src/bootstrap.ts
index d80c3e0e..481b7a32 100644
--- a/packages/protocol/src/bootstrap.ts
+++ b/packages/protocol/src/bootstrap.ts
@@ -1,13 +1,61 @@
 import type { ProviderAdapterCatalog } from "./model-runtime";
-import type { ServerConfigUpdate } from "./types";
+import type { ServerConfigUpdate, ServerConfigValidationIssue } from "./types";
 
 /** Public, redacted server state used before the workbench is allowed to mount. */
+export type RuntimeStatus =
+  | { state: "activating" }
+  | { state: "ready" }
+  | {
+    state: "error";
+    error: {
+      message: string;
+      /** False when a failed Runtime candidate could not be fully shut down. */
+      recoveryAllowed: boolean;
+    };
+  };
+
 export type BootstrapStatus =
   | { mode: "setup" }
-  | { mode: "activating" }
-  | { mode: "ready"; authRequired: boolean; authenticated: boolean }
-  | { mode: "config_error"; message: string }
-  | { mode: "startup_error"; message: string };
+  | {
+    mode: "ready";
+    authRequired: boolean;
+    authenticated: boolean;
+    runtime: RuntimeStatus;
+  }
+  | { mode: "config_error"; message: string };
+
+/** Safe structural diagnostics and bounded manual recovery choices for an invalid global Config. */
+export interface ConfigRecoveryStatus {
+  configPath: string;
+  issues: ServerConfigValidationIssue[];
+  /** Current invalid-file revision used to reject stale selective removal. */
+  revision?: string;
+  removableItems: ConfigRecoveryRemovableItem[];
+}
+
+export interface ConfigRecoveryRemovableItem {
+  /** Opaque server-derived identity; never contains a Config key or value. */
+  id: string;
+  label: string;
+  path: string;
+  impact: string;
+}
+
+export interface ConfigRecoveryActionResponse {
+  status: BootstrapStatus;
+  /** Present only when the Config remains invalid after a retry. */
+  recovery?: ConfigRecoveryStatus;
+}
+
+export interface ResetInvalidConfigRequest {
+  confirmation: "DELETE_INVALID_CONFIG";
+}
+
+export interface RemoveInvalidConfigItemsRequest {
+  expectedRevision: string;
+  itemIds: string[];
+  confirmation: "REMOVE_SELECTED_INVALID_CONFIG_ITEMS";
+}
 
 /**
  * The setup grant is deliberately transported in an Authorization header, not
diff --git a/packages/protocol/src/index.ts b/packages/protocol/src/index.ts
index ad9bb8e3..fc70ef26 100644
--- a/packages/protocol/src/index.ts
+++ b/packages/protocol/src/index.ts
@@ -17,3 +17,4 @@ export * from "./auth";
 export * from "./update";
 export * from "./attachments";
 export * from "./session-messages";
+export * from "./runtime-data";
diff --git a/packages/protocol/src/runtime-data.ts b/packages/protocol/src/runtime-data.ts
new file mode 100644
index 00000000..c35d47d8
--- /dev/null
+++ b/packages/protocol/src/runtime-data.ts
@@ -0,0 +1,63 @@
+import type { RuntimeStatus } from "./bootstrap";
+
+export type RuntimeDataIssueReason =
+  | "invalid_json"
+  | "invalid_current_schema"
+  | "unreadable";
+
+export interface RuntimeDataSchemaIssue {
+  readonly path: Array<string | number>;
+  readonly message: string;
+}
+
+export interface RuntimeDataIssue {
+  readonly relativePath: string;
+  readonly reason: RuntimeDataIssueReason;
+  readonly schemaIssues?: RuntimeDataSchemaIssue[];
+}
+
+export interface RuntimeDataStats {
+  readonly fileCount: number;
+  readonly totalBytes: number;
+}
+
+export interface RuntimeDataProjectInspection {
+  readonly projectSlug: string;
+  readonly name: string;
+  readonly workspace: string;
+  readonly runtimePath: string;
+  readonly stats: RuntimeDataStats;
+  readonly issues: RuntimeDataIssue[];
+}
+
+export interface RuntimeDataInspectionResponse {
+  readonly projects: RuntimeDataProjectInspection[];
+}
+
+export interface RuntimeDataDeleteRequest {
+  readonly projectSlugs: string[];
+}
+
+export interface RuntimeDataDeleteError {
+  readonly code: "delete_failed";
+  readonly message: string;
+}
+
+export type RuntimeDataProjectDeleteResult =
+  | {
+    readonly projectSlug: string;
+    readonly status: "deleted";
+  }
+  | {
+    readonly projectSlug: string;
+    readonly status: "error";
+    readonly error: RuntimeDataDeleteError;
+  };
+
+export interface RuntimeDataDeleteResult {
+  readonly results: RuntimeDataProjectDeleteResult[];
+}
+
+export interface RuntimeDataDeleteResponse extends RuntimeDataDeleteResult {
+  readonly runtime: RuntimeStatus;
+}

From 624b37f8d9ff6108da77d4c7afae4962e7bb3304 Mon Sep 17 00:00:00 2001
From: bo <bohuang1994@gmail.com>
Date: Tue, 4 Aug 2026 17:28:13 +0800
Subject: [PATCH 2/3] fix(review): address recovery control plane feedback

---
 apps/server/src/server-host.test.ts           |  5 +-
 apps/server/src/server-host.ts                |  1 -
 ...p-grant.test.ts => terminal-grant.test.ts} |  4 +-
 .../bootstrap/BootstrapGate.test.tsx          |  1 +
 ...ettingsConfigRecoveryPanel.interaction.tsx | 27 +++++++++++
 .../features/SettingsConfigRecoveryPanel.tsx  | 26 +++++++----
 .../features/SettingsDialog.interaction.tsx   | 19 ++++++++
 .../components/features/SettingsDialog.tsx    |  1 +
 .../SettingsRuntimeDataPanel.interaction.tsx  | 23 ++++++++++
 .../features/SettingsRuntimeDataPanel.tsx     |  3 +-
 .../__arch__/automation-boundaries.test.ts    | 25 ++++++----
 .../src/config/server-config-service.test.ts  | 46 +++++++++++++++++++
 .../src/config/server-config-service.ts       | 39 ++++++++++++----
 .../src/runtime-data/service.test.ts          | 22 ++++++++-
 .../agent-core/src/runtime-data/service.ts    | 14 +++++-
 15 files changed, 219 insertions(+), 37 deletions(-)
 rename apps/server/src/{setup-grant.test.ts => terminal-grant.test.ts} (82%)

diff --git a/apps/server/src/server-host.test.ts b/apps/server/src/server-host.test.ts
index 6ba8183f..93f321c4 100644
--- a/apps/server/src/server-host.test.ts
+++ b/apps/server/src/server-host.test.ts
@@ -1372,7 +1372,7 @@ describe("ArchCodeServerHost", () => {
       expect((await recovering).status).toBe(200);
       expect(order).toEqual(recovery === "retry"
         ? ["save:start", "save:end", `activate:${changedName}`]
-        : ["save:start", "save:end", "delete", "inspect", `activate:${changedName}`]);
+        : ["save:start", "save:end", "delete", `activate:${changedName}`]);
       expect(host.getRuntimeStatus()).toEqual({ state: "ready" });
       await host.shutdown();
     }
@@ -1452,8 +1452,9 @@ describe("ArchCodeServerHost", () => {
         });
       expect(attempts).toBe(deletionSucceeded ? 2 : 1);
       expect(host.getRuntimeStatus().state).toBe(deletionSucceeded ? "ready" : "error");
+      expect(runtimeDataService.inspect).not.toHaveBeenCalled();
       expect(order).toEqual(deletionSucceeded
-        ? ["delete", "inspect", "activate"]
+        ? ["delete", "activate"]
         : ["delete"]);
     }
   });
diff --git a/apps/server/src/server-host.ts b/apps/server/src/server-host.ts
index 121845f0..fdb78dea 100644
--- a/apps/server/src/server-host.ts
+++ b/apps/server/src/server-host.ts
@@ -247,7 +247,6 @@ export class ArchCodeServerHost implements SetupCoordinatorPort, ConfigRecoveryC
           response.results.length > 0
           && response.results.every((result) => result.status === "deleted")
         ) {
-          await this.options.runtimeDataService.inspect();
           try {
             await this.activateRuntimeFromCurrentConfig();
           } catch {
diff --git a/apps/server/src/setup-grant.test.ts b/apps/server/src/terminal-grant.test.ts
similarity index 82%
rename from apps/server/src/setup-grant.test.ts
rename to apps/server/src/terminal-grant.test.ts
index c21b307c..92767c65 100644
--- a/apps/server/src/setup-grant.test.ts
+++ b/apps/server/src/terminal-grant.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { TerminalGrant } from "./terminal-grant";
 
 describe("TerminalGrant", () => {
-  test("authorizes only the random token embedded in the setup fragment", () => {
+  test("authorizes only the random token embedded in a terminal recovery fragment", () => {
     const grant = new TerminalGrant();
     const url = grant.url("http://localhost:4096", "/setup");
     const token = new URL(url).hash.slice("#token=".length);
@@ -13,7 +13,7 @@ describe("TerminalGrant", () => {
     expect(grant.authorize(`Basic ${token}`)).toBe(false);
   });
 
-  test("cannot be reused after setup commits", () => {
+  test("cannot be reused after a terminal recovery flow commits", () => {
     const grant = new TerminalGrant();
     const token = new URL(grant.url("http://localhost:4096", "/config-recovery")).hash.slice("#token=".length);
 
diff --git a/apps/web/src/components/bootstrap/BootstrapGate.test.tsx b/apps/web/src/components/bootstrap/BootstrapGate.test.tsx
index dc6f1b5e..942d4883 100644
--- a/apps/web/src/components/bootstrap/BootstrapGate.test.tsx
+++ b/apps/web/src/components/bootstrap/BootstrapGate.test.tsx
@@ -154,6 +154,7 @@ describe("BootstrapGate", () => {
         return Response.json({
           configPath: "/Users/test/.archcode/config.json",
           issues: [{ path: "configuration", message: "This value does not match the current ArchCode configuration format." }],
+          removableItems: [],
         });
       }
       throw new Error(`Unexpected request: ${String(input)}`);
diff --git a/apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx b/apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx
index 2d9a3c00..e3fcf135 100644
--- a/apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx
+++ b/apps/web/src/components/features/SettingsConfigRecoveryPanel.interaction.tsx
@@ -46,6 +46,33 @@ afterEach(() => {
 });
 
 describe("Settings Config Recovery interactions", () => {
+  test("keeps a diagnostics retry available after the initial status load fails", async () => {
+    let calls = 0;
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string) => {
+      if (url !== "/api/config-recovery") throw new Error(`Unexpected request: ${url}`);
+      calls += 1;
+      if (calls === 1) return Response.json({ error: { message: "Diagnostics unavailable" } }, { status: 500 });
+      return Response.json({
+        configPath: "/Users/test/.archcode/config.json",
+        issues: [],
+        removableItems: [],
+      });
+    }) });
+    const { SettingsConfigRecoveryPanel } = await import("./SettingsConfigRecoveryPanel");
+
+    await act(async () => {
+      root.render(<SettingsConfigRecoveryPanel grant="recovery-token" onTransition={() => undefined} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    await waitForText("Diagnostics unavailable", container);
+    await click("Retry diagnostics", container);
+
+    expect(calls).toBe(2);
+    expect(container.textContent).toContain("Safe diagnostics");
+    expect(container.textContent).toContain("Retry configuration");
+  });
+
   test("requires selection and confirmation before removing only invalid items", async () => {
     const requests: Array<{ url: string; init?: RequestInit }> = [];
     Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (url: string, init?: RequestInit) => {
diff --git a/apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx b/apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx
index 4f7d7348..329150a0 100644
--- a/apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx
+++ b/apps/web/src/components/features/SettingsConfigRecoveryPanel.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { AlertTriangle, RefreshCw, RotateCcw, ShieldAlert, Trash2 } from "lucide-react";
 import type {
   BootstrapStatus,
@@ -39,16 +39,22 @@ export function SettingsConfigRecoveryPanel({
   const [notice, setNotice] = useState<string>();
   const headingRef = useRef<HTMLHeadingElement>(null);
 
-  useEffect(() => {
-    let live = true;
+  const loadRecoveryStatus = useCallback(async () => {
     setLoading(true);
-    void getConfigRecoveryStatus(grant).then(
-      (status) => { if (live) setRecovery(status); },
-      (cause) => { if (live) setError(errorMessage(cause, "Unable to load Config diagnostics.")); },
-    ).finally(() => { if (live) setLoading(false); });
-    return () => { live = false; };
+    setError(undefined);
+    try {
+      setRecovery(await getConfigRecoveryStatus(grant));
+    } catch (cause) {
+      setError(errorMessage(cause, "Unable to load Config diagnostics."));
+    } finally {
+      setLoading(false);
+    }
   }, [grant]);
 
+  useEffect(() => {
+    void loadRecoveryStatus();
+  }, [loadRecoveryStatus]);
+
   useEffect(() => {
     if (recovery === undefined) return;
     const currentIds = new Set((recovery.removableItems ?? []).map((item) => item.id));
@@ -215,7 +221,9 @@ export function SettingsConfigRecoveryPanel({
             </div>
           </details>
         </>
-        : null}
+        : <button type="button" className={secondaryButton} onClick={() => { void loadRecoveryStatus(); }}>
+          <RefreshCw size={13} aria-hidden="true" />Retry diagnostics
+        </button>}
 
     <RemoveInvalidConfigItemsDialog
       open={confirmRemove}
diff --git a/apps/web/src/components/features/SettingsDialog.interaction.tsx b/apps/web/src/components/features/SettingsDialog.interaction.tsx
index ecb4138c..404245b6 100644
--- a/apps/web/src/components/features/SettingsDialog.interaction.tsx
+++ b/apps/web/src/components/features/SettingsDialog.interaction.tsx
@@ -346,6 +346,25 @@ describe("SettingsDialog interactions", () => {
     expect(container.textContent).not.toContain("applied live");
   });
 
+  test("clears the Runtime-unavailable save notice when a newer snapshot arrives", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async () => Response.json(
+      successfulSaveResponse(),
+    )) });
+    const runtime = { state: "error" as const, error: { message: "Runtime unavailable", recoveryAllowed: true } };
+    act(() => root.render(<DialogRoot open><SettingsBody snapshot={snapshot} servers={{}} runtime={runtime} onReload={async () => {}} /></DialogRoot>));
+
+    click("Add provider");
+    await act(async () => { click("Save changes"); await Promise.resolve(); });
+    expect(container.textContent).toContain("Configuration saved. Retry Runtime to use the saved configuration.");
+
+    const newerSnapshot = { ...snapshot, revision: "r2" };
+    await act(async () => {
+      root.render(<DialogRoot open><SettingsBody snapshot={newerSnapshot} servers={{}} runtime={runtime} onReload={async () => {}} /></DialogRoot>);
+      await Promise.resolve();
+    });
+    expect(container.textContent).not.toContain("Configuration saved. Retry Runtime to use the saved configuration.");
+  });
+
   test("names restart-only sections without claiming a model live-apply", async () => {
     Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async () => Response.json(
       successfulSaveResponse(["memory"]),
diff --git a/apps/web/src/components/features/SettingsDialog.tsx b/apps/web/src/components/features/SettingsDialog.tsx
index 9bb4b747..e20bc098 100644
--- a/apps/web/src/components/features/SettingsDialog.tsx
+++ b/apps/web/src/components/features/SettingsDialog.tsx
@@ -52,6 +52,7 @@ export function SettingsBody({ snapshot, adapterCatalog, servers, onReload, runt
     setErrors({});
     setJsonErrors({});
     setSaveError(undefined);
+    setSavedWhileRuntimeUnavailable(false);
     setRestartRequiredSections(snapshot.restartRequiredSections);
     setJsonResetVersion((current) => current + 1);
   }, [snapshot]);
diff --git a/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx b/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
index 7cedcf1e..d64bd1a5 100644
--- a/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
+++ b/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
@@ -111,6 +111,7 @@ describe("Settings Runtime Data interactions", () => {
       await pendingDelete;
       await Promise.resolve();
       await Promise.resolve();
+      await new Promise((resolve) => window.requestAnimationFrame(resolve));
     });
 
     expect([...container.querySelectorAll('[role="alert"]')].some((alert) => alert.textContent?.includes("Permission denied"))).toBe(true);
@@ -119,6 +120,28 @@ describe("Settings Runtime Data interactions", () => {
     expect(document.activeElement?.textContent).toBe("Runtime Data");
   });
 
+  test("closes the confirmation and exposes an error when the delete request rejects", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (_url: string, init?: RequestInit) => {
+      if (init?.method === "DELETE") {
+        return Response.json({ error: { message: "Deletion service unavailable" } }, { status: 500 });
+      }
+      return Response.json(inspectionResponse());
+    }) });
+
+    await renderPanel();
+    const confirm = [...document.body.querySelectorAll("button")].find((button) => button.textContent === "Delete permanently") as HTMLButtonElement;
+    await act(async () => {
+      confirm.click();
+      await Promise.resolve();
+      await Promise.resolve();
+      await new Promise((resolve) => window.requestAnimationFrame(resolve));
+    });
+
+    expect(document.body.textContent).not.toContain("Permanently delete Runtime data?");
+    expect(container.textContent).toContain("Deletion service unavailable");
+    expect(document.activeElement?.textContent).toBe("Runtime Data");
+  });
+
   test("refetches inspection and Bootstrap state after a successful deletion", async () => {
     let inspectionCalls = 0;
     const requests: Array<{ url: string; init?: RequestInit }> = [];
diff --git a/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx b/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
index 15d1ad13..0b4cb6b0 100644
--- a/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
+++ b/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
@@ -116,9 +116,10 @@ export function SettingsRuntimeDataPanel({
       await Promise.all([loadInspection(), onRefreshRuntime()]);
     } catch (cause) {
       setActionError(cause instanceof Error ? cause.message : "Unable to delete Runtime data.");
+      setConfirmOpen(false);
     } finally {
       setDeleting(false);
-      queueMicrotask(() => statusHeadingRef.current?.focus());
+      window.requestAnimationFrame(() => statusHeadingRef.current?.focus());
     }
   };
 
diff --git a/packages/agent-core/src/__arch__/automation-boundaries.test.ts b/packages/agent-core/src/__arch__/automation-boundaries.test.ts
index d8f472a7..f595eed6 100644
--- a/packages/agent-core/src/__arch__/automation-boundaries.test.ts
+++ b/packages/agent-core/src/__arch__/automation-boundaries.test.ts
@@ -49,20 +49,25 @@ describe("Automation architecture boundaries", () => {
     expect(state).not.toMatch(/from\s+["']\.\/(?:dispatcher|scheduler|runtime-session-gateway)["']/);
     expect(dispatcher).not.toMatch(/from\s+["']\.\/(?:scheduler|runtime-session-gateway)["']/);
     expect(scheduler).not.toContain("runtime-session-gateway");
-    expect(serverHost.indexOf("runtime.recoverSessionContinuations")).toBeLessThan(
-      serverHost.indexOf("runtime.startAutomationSchedulers"),
+    const indexOfRequired = (source: string, needle: string): number => {
+      const index = source.indexOf(needle);
+      expect(index).toBeGreaterThanOrEqual(0);
+      return index;
+    };
+    expect(indexOfRequired(serverHost, "runtime.recoverSessionContinuations")).toBeLessThan(
+      indexOfRequired(serverHost, "runtime.startAutomationSchedulers"),
     );
-    expect(serverHost.indexOf("runtime.startAutomationSchedulers")).toBeLessThan(
-      serverHost.indexOf("const runtimeApp = createRuntimeApp(runtime"),
+    expect(indexOfRequired(serverHost, "runtime.startAutomationSchedulers")).toBeLessThan(
+      indexOfRequired(serverHost, "const runtimeApp = createRuntimeApp(runtime"),
     );
-    expect(serverHost.indexOf("const runtimeApp = createRuntimeApp(runtime")).toBeLessThan(
-      serverHost.indexOf("this.runtimeApp = runtimeApp"),
+    expect(indexOfRequired(serverHost, "const runtimeApp = createRuntimeApp(runtime")).toBeLessThan(
+      indexOfRequired(serverHost, "this.runtimeApp = runtimeApp"),
     );
-    expect(serverMain.indexOf("await ArchCodeServerHost.create")).toBeLessThan(
-      serverMain.indexOf("await bootServer(host"),
+    expect(indexOfRequired(serverMain, "await ArchCodeServerHost.create")).toBeLessThan(
+      indexOfRequired(serverMain, "await bootServer(host"),
     );
-    expect(boot.indexOf("startServer(host.app")).toBeLessThan(
-      boot.indexOf("host.startRuntimeActivation()"),
+    expect(indexOfRequired(boot, "startServer(host.app")).toBeLessThan(
+      indexOfRequired(boot, "host.startRuntimeActivation()"),
     );
     expect(sessionRecovery).toContain("reconcileAnsweredHitl");
     expect(sessionRecovery).toContain("continueRunnableToolBatches");
diff --git a/packages/agent-core/src/config/server-config-service.test.ts b/packages/agent-core/src/config/server-config-service.test.ts
index 0621add6..72c6b243 100644
--- a/packages/agent-core/src/config/server-config-service.test.ts
+++ b/packages/agent-core/src/config/server-config-service.test.ts
@@ -740,6 +740,52 @@ describe("ServerConfigService", () => {
     )).resolves.toMatchObject({ status: "ready" });
   });
 
+  test("collapses selected descendant removals when their selected ancestor already removes them", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, any>;
+    invalid.provider.local.models.broken = structuredClone(invalid.provider.local.models["test-model"]);
+    invalid.provider.local.models.broken.name = 42;
+    invalid.provider.local.models.broken.variants.fast.temperature = 3;
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    await writeFile(service.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected nested invalid Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    expect(plan.items.map((item) => item.path)).toEqual([
+      ["provider", "local", "models", "broken"],
+      ["provider", "local", "models", "broken", "variants", "fast"],
+    ]);
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      plan.items.map((item) => item.id),
+    )).resolves.toMatchObject({ status: "ready" });
+    const saved = JSON.parse(await readFile(service.configPath, "utf8"));
+    expect(saved.provider.local.models.broken).toBeUndefined();
+    expect(saved.provider.local.models["test-model"]).toBeDefined();
+  });
+
+  test("rejects a selective removal plan after the Config was repaired externally", async () => {
+    const service = await createUnloadedService();
+    const invalid = config() as Record<string, unknown>;
+    invalid.unsupportedLegacyConfig = true;
+    await mkdir(join(service.homeDir, ".archcode"), { recursive: true });
+    await writeFile(service.configPath, `${JSON.stringify(invalid, null, 2)}\n`, { mode: 0o600 });
+
+    const startup = await service.activateForStartup();
+    if (startup.status !== "config_error") throw new Error("Expected invalid Config");
+    const plan = service.invalidConfigRemovalPlan(startup.error);
+    const repairedBytes = `${JSON.stringify(config(), null, 2)}\n`;
+    await writeFile(service.configPath, repairedBytes, { mode: 0o600 });
+
+    await expect(service.removeInvalidConfigItems(
+      plan.revision!,
+      [plan.items[0]!.id],
+    )).rejects.toBeInstanceOf(ConfigRecoveryConflictError);
+    expect(await readFile(service.configPath, "utf8")).toBe(repairedBytes);
+  });
+
   test("removes only the failing MCP server and preserves healthy MCP secrets", async () => {
     const service = await createUnloadedService();
     const invalid = config() as Record<string, any>;
diff --git a/packages/agent-core/src/config/server-config-service.ts b/packages/agent-core/src/config/server-config-service.ts
index 6acb6f76..b079690d 100644
--- a/packages/agent-core/src/config/server-config-service.ts
+++ b/packages/agent-core/src/config/server-config-service.ts
@@ -322,8 +322,15 @@ export class ServerConfigService {
             "This Config is not valid JSON and has no safely removable structured items.",
           );
         }
-        for (const item of selected as InvalidConfigRemovalItem[]) {
-          deleteConfigPath(candidate, item.path);
+        const selectedItems = selected as InvalidConfigRemovalItem[];
+        const removalPaths = selectedItems
+          .map((item) => item.path)
+          .filter((path, _index, paths) => !paths.some((candidateAncestor) =>
+            candidateAncestor.length < path.length
+            && candidateAncestor.every((segment, index) => path[index] === segment)
+          ));
+        for (const path of removalPaths) {
+          deleteConfigPath(candidate, path);
         }
 
         let validated: ArchCodeConfig;
@@ -1390,7 +1397,7 @@ async function restoreClaimedConfig(
     await link(claimedPath, configPath);
   } catch (cause) {
     if (isNodeError(cause, "EEXIST")) {
-      await unlink(claimedPath);
+      await unlink(claimedPath).catch(() => undefined);
       return;
     }
     const claimedBytes = await readFile(claimedPath);
@@ -1399,23 +1406,35 @@ async function restoreClaimedConfig(
       handle = await open(configPath, "wx", 0o600);
     } catch (createCause) {
       if (isNodeError(createCause, "EEXIST")) {
-        await unlink(claimedPath);
+        await unlink(claimedPath).catch(() => undefined);
         return;
       }
-      throw configDiscardError(configPath, createCause);
+      throw configRestoreError(configPath, claimedPath, createCause);
     }
     try {
       await handle.writeFile(claimedBytes);
       await handle.sync();
     } catch (writeCause) {
-      throw configDiscardError(configPath, writeCause);
-    } finally {
-      await handle.close();
+      await handle.close().catch(() => undefined);
+      await unlink(configPath).catch(() => undefined);
+      throw configRestoreError(configPath, claimedPath, writeCause);
     }
-    await unlink(claimedPath);
+    await handle.close().catch(() => undefined);
+    await unlink(claimedPath).catch(() => undefined);
     return;
   }
-  await unlink(claimedPath);
+  await unlink(claimedPath).catch(() => undefined);
+}
+
+function configRestoreError(
+  configPath: string,
+  claimedPath: string,
+  cause: unknown,
+): ConfigSemanticValidationError {
+  return new ConfigSemanticValidationError([{
+    path: configPath,
+    message: `Failed to restore the global configuration at ${configPath}: ${errorMessage(cause)}. The original file remains at ${claimedPath}.`,
+  }]);
 }
 
 function configDiscardError(
diff --git a/packages/agent-core/src/runtime-data/service.test.ts b/packages/agent-core/src/runtime-data/service.test.ts
index 259f9c13..69595175 100644
--- a/packages/agent-core/src/runtime-data/service.test.ts
+++ b/packages/agent-core/src/runtime-data/service.test.ts
@@ -7,6 +7,7 @@ import {
   rename,
   rm,
   symlink,
+  truncate,
   writeFile,
 } from "node:fs/promises";
 import { join } from "node:path";
@@ -274,6 +275,25 @@ describe("RuntimeDataService inspection", () => {
     expect(response).not.toHaveProperty("runtimeError");
     expect(JSON.stringify(response)).not.toMatch(/startupCause|old version|new version/i);
   });
+
+  test("bounds oversized JSON reads and the per-project issue response", async () => {
+    const project = await createProject("bounded-inspection");
+    const runtimePath = projectRuntimePath(project.workspaceRoot);
+    const sessionsPath = join(runtimePath, "sessions");
+    for (let index = 0; index < 105; index += 1) {
+      const sessionPath = join(sessionsPath, `broken-${String(index).padStart(3, "0")}`);
+      await mkdir(sessionPath);
+      await writeFile(join(sessionPath, "session.json"), "{");
+    }
+    await truncate(join(runtimePath, "todos", "state.json"), 64 * 1024 * 1024 + 1);
+    registry.projects = [project];
+
+    const response = await service.inspect();
+    const issues = response.projects[0]!.issues;
+
+    expect(issues).toHaveLength(100);
+    expect(issues).toContainEqual({ relativePath: "todos/state.json", reason: "unreadable" });
+  });
 });
 
 describe("RuntimeDataService deletion", () => {
@@ -415,7 +435,7 @@ describe("RuntimeDataService deletion", () => {
     }
   });
 
-  test("returns per-project deletion errors and leaves retry admission to the Host", async () => {
+  test.skipIf(typeof process.getuid === "function" && process.getuid() === 0)("returns per-project deletion errors and leaves retry admission to the Host", async () => {
     const first = await createProject("first");
     const second = await createProject("second");
     await writeFile(join(projectRuntimePath(first.workspaceRoot), "todos", "state.json"), "{");
diff --git a/packages/agent-core/src/runtime-data/service.ts b/packages/agent-core/src/runtime-data/service.ts
index 3061a704..47d668f9 100644
--- a/packages/agent-core/src/runtime-data/service.ts
+++ b/packages/agent-core/src/runtime-data/service.ts
@@ -38,6 +38,8 @@ import { PermissionApprovalFileSchema } from "../tools/permission/project-approv
 const SCHEMA_ISSUE_MESSAGE = "Does not match the current ArchCode data format.";
 const MAX_SCHEMA_ISSUES_PER_FILE = 20;
 const MAX_SCHEMA_ISSUE_PATH_SEGMENTS = 12;
+const MAX_RUNTIME_DATA_ISSUES_PER_PROJECT = 100;
+const MAX_INSPECTED_JSON_FILE_BYTES = 64 * 1024 * 1024;
 const SCHEMA_ISSUE_FIELD_SEGMENT = "$field";
 
 export type RuntimeDataRequestErrorCode =
@@ -158,6 +160,12 @@ export class RuntimeDataService {
     const addIssue = (issue: RuntimeDataIssue): void => {
       const key = `${issue.reason}\0${issue.relativePath}`;
       if (issueKeys.has(key)) return;
+      if (issues.length >= MAX_RUNTIME_DATA_ISSUES_PER_PROJECT) {
+        if (issue.reason === "unreadable" && !issues.some((current) => current.reason === "unreadable")) {
+          issues[issues.length - 1] = issue;
+        }
+        return;
+      }
       issueKeys.add(key);
       issues.push(issue);
     };
@@ -341,13 +349,17 @@ async function inspectJsonFile(
     addIssue({ relativePath, reason: "unreadable" });
     return;
   }
+  if (stat.size > MAX_INSPECTED_JSON_FILE_BYTES) {
+    addIssue({ relativePath, reason: "unreadable" });
+    return;
+  }
 
   let text: string;
   try {
     const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
       const openedStat = await handle.stat();
-      if (!openedStat.isFile()) {
+      if (!openedStat.isFile() || openedStat.size > MAX_INSPECTED_JSON_FILE_BYTES) {
         addIssue({ relativePath, reason: "unreadable" });
         return;
       }

From 5d0225d6e868339fe84d481b12f36b59091d7f14 Mon Sep 17 00:00:00 2001
From: bo <bohuang1994@gmail.com>
Date: Tue, 4 Aug 2026 17:57:53 +0800
Subject: [PATCH 3/3] fix(runtime): distinguish recovery follow-up failures

---
 .../SettingsRuntimeDataPanel.interaction.tsx  | 50 +++++++++++++++++++
 .../features/SettingsRuntimeDataPanel.tsx     | 20 +++++++-
 .../src/runtime-data/service.test.ts          | 18 ++++++-
 .../agent-core/src/runtime-data/service.ts    | 21 ++++++--
 packages/protocol/src/runtime-data.ts         |  1 +
 5 files changed, 103 insertions(+), 7 deletions(-)

diff --git a/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx b/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
index d64bd1a5..47a88060 100644
--- a/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
+++ b/apps/web/src/components/features/SettingsRuntimeDataPanel.interaction.tsx
@@ -175,6 +175,56 @@ describe("Settings Runtime Data interactions", () => {
     expect(container.textContent).toContain("No registered project Runtime data was found");
   });
 
+  test("preserves a successful deletion when the Runtime status refresh fails", async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (_url: string, init?: RequestInit) => {
+      if (init?.method === "DELETE") return Response.json({
+        results: [{ projectSlug: "broken", status: "deleted" }],
+        runtime: { state: "ready" },
+      });
+      return Response.json(inspectionResponse());
+    }) });
+    const onRefreshRuntime = mock(async () => { throw new Error("Runtime status refresh failed."); });
+
+    await renderPanel(onRefreshRuntime);
+    await act(async () => {
+      [...document.body.querySelectorAll("button")].find((button) => button.textContent === "Delete permanently")!.click();
+      await Promise.resolve();
+      await Promise.resolve();
+      await new Promise((resolve) => window.requestAnimationFrame(resolve));
+    });
+
+    expect(document.body.textContent).not.toContain("Permanently delete Runtime data?");
+    expect(container.textContent).toContain("Runtime data deleted for 1 project");
+    expect(container.textContent).toContain("Runtime status refresh failed.");
+    expect(onRefreshRuntime).toHaveBeenCalledTimes(1);
+  });
+
+  test("preserves a successful Runtime retry when the status refresh fails", async () => {
+    const requests: Array<{ method?: string }> = [];
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (_url: string, init?: RequestInit) => {
+      requests.push({ method: init?.method });
+      if (init?.method === "POST") return Response.json({ state: "ready" });
+      return Response.json(inspectionResponse());
+    }) });
+    const onRefreshRuntime = mock(async () => { throw new Error("Runtime status refresh failed."); });
+    const { SettingsRuntimeDataPanel } = await import("./SettingsRuntimeDataPanel");
+    await act(async () => {
+      root.render(<SettingsRuntimeDataPanel runtime={{ state: "error", error: { message: "Runtime failed", recoveryAllowed: true } }} onRefreshRuntime={onRefreshRuntime} />);
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    await act(async () => {
+      [...container.querySelectorAll("button")].find((button) => button.textContent === "Retry Runtime")!.click();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(requests.filter((request) => request.method === "POST")).toHaveLength(1);
+    expect(container.textContent).toContain("Runtime is ready.");
+    expect(container.textContent).toContain("Runtime status refresh failed.");
+    expect(onRefreshRuntime).toHaveBeenCalledTimes(1);
+  });
+
   test("shows the final Runtime error returned by deletion without waiting for Bootstrap refresh", async () => {
     Object.defineProperty(globalThis, "fetch", { configurable: true, value: mock(async (_url: string, init?: RequestInit) => {
       if (init?.method === "DELETE") return Response.json({
diff --git a/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx b/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
index 0b4cb6b0..b535a1c1 100644
--- a/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
+++ b/apps/web/src/components/features/SettingsRuntimeDataPanel.tsx
@@ -32,6 +32,7 @@ export function SettingsRuntimeDataPanel({
   const [deleteResults, setDeleteResults] = useState<RuntimeDataProjectDeleteResult[]>([]);
   const [actionMessage, setActionMessage] = useState<string>();
   const [actionError, setActionError] = useState<string>();
+  const [runtimeRefreshError, setRuntimeRefreshError] = useState<string>();
   const statusHeadingRef = useRef<HTMLHeadingElement>(null);
 
   const loadInspection = useCallback(async () => {
@@ -71,6 +72,7 @@ export function SettingsRuntimeDataPanel({
     setRetrying(true);
     setActionMessage(undefined);
     setActionError(undefined);
+    setRuntimeRefreshError(undefined);
     setDeleteResults([]);
     try {
       const nextRuntime = await retryRuntime();
@@ -82,10 +84,13 @@ export function SettingsRuntimeDataPanel({
       } else {
         setActionMessage("Runtime activation is in progress.");
       }
-      await onRefreshRuntime();
     } catch (cause) {
       setActionError(cause instanceof Error ? cause.message : "Unable to retry Runtime.");
+    }
+    try {
       await onRefreshRuntime();
+    } catch (cause) {
+      setRuntimeRefreshError(cause instanceof Error ? cause.message : "Runtime status could not be refreshed.");
     } finally {
       setRetrying(false);
       queueMicrotask(() => statusHeadingRef.current?.focus());
@@ -97,6 +102,7 @@ export function SettingsRuntimeDataPanel({
     setDeleting(true);
     setActionMessage(undefined);
     setActionError(undefined);
+    setRuntimeRefreshError(undefined);
     setDeleteResults([]);
     try {
       const response = await deleteRuntimeData({ projectSlugs: selectedProjects.map((project) => project.projectSlug) });
@@ -113,7 +119,12 @@ export function SettingsRuntimeDataPanel({
         setSelected(new Set());
       }
       setConfirmOpen(false);
-      await Promise.all([loadInspection(), onRefreshRuntime()]);
+      await loadInspection();
+      try {
+        await onRefreshRuntime();
+      } catch (cause) {
+        setRuntimeRefreshError(cause instanceof Error ? cause.message : "Runtime status could not be refreshed.");
+      }
     } catch (cause) {
       setActionError(cause instanceof Error ? cause.message : "Unable to delete Runtime data.");
       setConfirmOpen(false);
@@ -187,6 +198,10 @@ export function SettingsRuntimeDataPanel({
       </ul>}
     </div>}
 
+    {runtimeRefreshError && <div role="alert" className="rounded-sm border border-warning/30 bg-warning-muted px-3 py-3 text-[12px] leading-5 text-warning">
+      {runtimeRefreshError}
+    </div>}
+
     <div className="flex flex-wrap items-center justify-between gap-3 border-t border-border-subtle pt-4">
       <p className="text-[11px] leading-4 text-text-tertiary">{selected.size === 0 ? "Select a project with detected issues to continue." : `${selected.size} ${selected.size === 1 ? "project" : "projects"} selected.`}</p>
       <button type="button" className={dangerButton} disabled={!runtimeUnavailable || !recoveryAllowed || busy || selectedProjects.length === 0} onClick={() => setConfirmOpen(true)}>
@@ -283,6 +298,7 @@ function DeleteRuntimeDataDialog({ open, projects, deleting, onCancel, onConfirm
 function issueReason(reason: RuntimeDataProjectInspection["issues"][number]["reason"]): string {
   if (reason === "invalid_json") return "Invalid JSON";
   if (reason === "invalid_current_schema") return "Does not match the current ArchCode data format";
+  if (reason === "inspection_limit") return "Too large to inspect safely";
   return "Unreadable or unsafe to inspect";
 }
 
diff --git a/packages/agent-core/src/runtime-data/service.test.ts b/packages/agent-core/src/runtime-data/service.test.ts
index 69595175..2226c80c 100644
--- a/packages/agent-core/src/runtime-data/service.test.ts
+++ b/packages/agent-core/src/runtime-data/service.test.ts
@@ -292,11 +292,27 @@ describe("RuntimeDataService inspection", () => {
     const issues = response.projects[0]!.issues;
 
     expect(issues).toHaveLength(100);
-    expect(issues).toContainEqual({ relativePath: "todos/state.json", reason: "unreadable" });
+    expect(issues).toContainEqual({ relativePath: "todos/state.json", reason: "inspection_limit" });
   });
 });
 
 describe("RuntimeDataService deletion", () => {
+  test("allows a structurally safe Runtime tree whose JSON exceeds the inspection limit", async () => {
+    const project = await createProject("oversized-json");
+    const runtimePath = projectRuntimePath(project.workspaceRoot);
+    await truncate(join(runtimePath, "todos", "state.json"), 64 * 1024 * 1024 + 1);
+    registry.projects = [project];
+
+    expect((await service.inspect()).projects[0]?.issues).toContainEqual({
+      relativePath: "todos/state.json",
+      reason: "inspection_limit",
+    });
+    expect(await service.delete([project.slug])).toEqual({
+      results: [{ projectSlug: project.slug, status: "deleted" }],
+    });
+    await expect(lstat(runtimePath)).rejects.toMatchObject({ code: "ENOENT" });
+  });
+
   test("rejects empty, duplicate, unknown, and healthy selections before mutation", async () => {
     const invalid = await createProject("invalid");
     const healthy = await createProject("healthy");
diff --git a/packages/agent-core/src/runtime-data/service.ts b/packages/agent-core/src/runtime-data/service.ts
index 47d668f9..5d7b6b5c 100644
--- a/packages/agent-core/src/runtime-data/service.ts
+++ b/packages/agent-core/src/runtime-data/service.ts
@@ -161,8 +161,17 @@ export class RuntimeDataService {
       const key = `${issue.reason}\0${issue.relativePath}`;
       if (issueKeys.has(key)) return;
       if (issues.length >= MAX_RUNTIME_DATA_ISSUES_PER_PROJECT) {
-        if (issue.reason === "unreadable" && !issues.some((current) => current.reason === "unreadable")) {
-          issues[issues.length - 1] = issue;
+        const protectedReason = issue.reason === "unreadable" || issue.reason === "inspection_limit";
+        if (protectedReason && !issues.some((current) => current.reason === issue.reason)) {
+          let replaceIndex = -1;
+          for (let index = issues.length - 1; index >= 0; index -= 1) {
+            const current = issues[index]!;
+            if (current.reason !== "unreadable" && current.reason !== "inspection_limit") {
+              replaceIndex = index;
+              break;
+            }
+          }
+          if (replaceIndex >= 0) issues[replaceIndex] = issue;
         }
         return;
       }
@@ -350,7 +359,7 @@ async function inspectJsonFile(
     return;
   }
   if (stat.size > MAX_INSPECTED_JSON_FILE_BYTES) {
-    addIssue({ relativePath, reason: "unreadable" });
+    addIssue({ relativePath, reason: "inspection_limit" });
     return;
   }
 
@@ -359,10 +368,14 @@ async function inspectJsonFile(
     const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
       const openedStat = await handle.stat();
-      if (!openedStat.isFile() || openedStat.size > MAX_INSPECTED_JSON_FILE_BYTES) {
+      if (!openedStat.isFile()) {
         addIssue({ relativePath, reason: "unreadable" });
         return;
       }
+      if (openedStat.size > MAX_INSPECTED_JSON_FILE_BYTES) {
+        addIssue({ relativePath, reason: "inspection_limit" });
+        return;
+      }
       text = await handle.readFile({ encoding: "utf8" });
     } finally {
       await handle.close();
diff --git a/packages/protocol/src/runtime-data.ts b/packages/protocol/src/runtime-data.ts
index c35d47d8..043de2d1 100644
--- a/packages/protocol/src/runtime-data.ts
+++ b/packages/protocol/src/runtime-data.ts
@@ -3,6 +3,7 @@ import type { RuntimeStatus } from "./bootstrap";
 export type RuntimeDataIssueReason =
   | "invalid_json"
   | "invalid_current_schema"
+  | "inspection_limit"
   | "unreadable";
 
 export interface RuntimeDataSchemaIssue {