diff --git a/.dockerignore b/.dockerignore
index 218f5d29..e417facb 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -5,3 +5,4 @@ __pycache__
 *.pyo
 tests/
 .env*
+/AGENTS.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb7da4f1..bc7f455c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,14 @@
 
 ### Fixed
 
+- **A restart can no longer turn a suppressed `[SILENT]` control message into a phantom recovered turn on the `/goal` path.** The `/api/goal` endpoint now recognizes the exact reserved `[SILENT]` delivery-suppression sentinel and treats it as a successful no-op before any session lookup or goal-state mutation — matching the guard the chat-start endpoint already applies. Previously a wake relay that accidentally POSTed the sentinel to `/goal` could, after a restart, materialize it as a visible recovered user turn. Matching is exact and case-sensitive, so ordinary goals are unaffected. Thanks @webtecnica. (#7019)
+
+- **A busy subagent tree no longer promotes an active child to a misleading top-level sidebar row.** The session sidebar builds from a bounded oversampled candidate window; after the recency slice, subagent parents that were present in the candidate set could be dropped, leaving their still-running child leaves rendered as if they were their own top-level conversations. Those parents are now re-added after the slice (bounded, cycle-safe, subagent-scoped so WebUI ancestors stay excluded), so the delegated-session tree nests correctly. Thanks @carlotestor. (#7031)
+
+- **A shared conversation link can no longer fabricate appearance state that overrides an operator's deployment default.** The public share page (`share.html`) now applies the same first-visit appearance guard as the main app bootstrap (and picks up two skin IDs it was missing), so opening a shared link on a fresh browser no longer writes an explicit theme/skin into local storage that would then be treated as a deliberate user choice. Public-share rendering is unchanged. Thanks @webtecnica. (#7030)
+
+- **Docker: the repository's own agent-instructions file is no longer baked into the runtime image.** A root-anchored `/AGENTS.md` entry was added to `.dockerignore` so the repo-root `AGENTS.md` (maintainer/build guidance, not user content) doesn't get copied into the Docker runtime and injected into the agent's project context. Nested workspace `AGENTS.md` files remain available exactly as before. Thanks @rodboev. (#6853)
+
 - **Docker: the bundled SQLite is upgraded to 3.53.0 to fix a WAL-reset corruption bug (and still erases deleted rows).** The `python:3.12-slim` base image ships SQLite 3.46.1, which is vulnerable to the March 2026 WAL-reset corruption bug, and Debian hasn't backported the fix — so the image now compiles SQLite 3.53.0 from the official amalgamation (SHA-256 pinned and verified before extraction, FTS5/FTS4/R-Tree enabled, build tools purged afterward). The source build is also compiled with `SQLITE_SECURE_DELETE` and asserts `PRAGMA secure_delete = 1` at build time, so deleting a conversation still overwrites its content on disk exactly as the base image did (a from-source build without that flag would have left deleted transcript bytes recoverable in `state.db`). Only affects the Docker image. The source-built library is registered in `ld.so.conf.d` so it loads ahead of the base image's copy on every architecture (including arm64, where `/usr/local/lib` isn't on the default loader path). Thanks @qxxaa. (#6900, #7044)
 
 - **Foregrounding a long or busy conversation no longer risks running the browser out of memory.** Switching back to a tab with a very long active chat could make the browser re-materialize the entire transcript's structured data at once — on the largest sessions this ballooned memory usage into the multi-gigabyte range and could OOM-kill the tab or the whole machine. The catch-up load on tab focus is now coalesced, the render window growth is bounded, and full structured-value allocations for off-screen turns are dropped, so foregrounding a long chat stays lightweight. A session-updated notification that arrives while a refresh is already in flight is now latched and reconciled once the refresh finishes (instead of being dropped), and the render cache signature now distinguishes tool-argument order the way the rendered output does (so differently-ordered arguments can't reuse stale cached markup). Thanks @webtecnica. (#7006, #6999)
diff --git a/api/agent_sessions.py b/api/agent_sessions.py
index 447ea1ef..c0a5078f 100644
--- a/api/agent_sessions.py
+++ b/api/agent_sessions.py
@@ -517,6 +517,19 @@ def read_importable_agent_session_rows(
     ``exclude_sources=None``. ``include_sources`` is an additional narrowing
     filter; callers that want an include-only query should explicitly pass
     ``exclude_sources=None`` so the default exclusions do not also apply.
+
+    ``limit`` bounds the *recency slice*, not the returned row count. Subagent
+    rows only render as children when their parent row is in the same payload,
+    so subagent ancestors of selected rows are re-added afterwards and the
+    result can exceed ``limit`` by the number of such anchors. Callers must
+    therefore iterate the result rather than assume ``len(rows) <= limit``.
+
+    That recovery is deliberately bounded by the oversampled candidate set
+    (``limit * 8`` newest sessions): it re-uses rows the projection already
+    fetched and never issues an extra query, so an ancestor older than the
+    oversample stays unresolved and its children render top-level, exactly as
+    they did before. Widening that window is a ``candidate_limit`` change, not
+    a change to this walk.
     """
     db_path = Path(db_path)
     if not db_path.exists():
@@ -766,7 +779,43 @@ def read_importable_agent_session_rows(
         projected = [row for row in projected if is_cli_session_row_visible(row)]
         if limit is None:
             return projected
-        return projected[:max(0, int(limit))]
+        selected = projected[:max(0, int(limit))]
+
+        # The recency slice is per-row, but subagent rows are only renderable as
+        # children: the sidebar nests a child under its parent solely when that
+        # parent row is present in the same payload. A frozen orchestrator stops
+        # writing while its leaves keep streaming, so the leaves win the recency
+        # race and the parent falls outside the window — leaving the leaves to be
+        # promoted to top-level sidebar rows. Re-add subagent parents that the
+        # oversampled candidate set already projected (no extra query); webui
+        # ancestors are left out because that sidebar bucket already has them.
+        #
+        # Bounded by construction: ``by_id`` only holds the ``limit * 8``
+        # newest candidates, so an ancestor older than that oversample is not
+        # recovered and its children stay top-level — the pre-existing
+        # behaviour, narrowed rather than fixed. Resolving those would need an
+        # unbounded per-row ancestor query on the hot sidebar path; widen
+        # ``candidate_limit`` instead if the window proves too tight.
+        # NOTE: this can return more than ``limit`` rows (see docstring).
+        have = {row.get('id') for row in selected}
+        by_id = {row.get('id'): row for row in projected if row.get('id')}
+        pending = list(selected)
+        while pending:
+            row = pending.pop()
+            if str(row.get('raw_source') or row.get('source') or '').strip().lower() != 'subagent':
+                continue
+            parent_id = row.get('parent_session_id')
+            if not parent_id or parent_id in have:
+                continue
+            parent = by_id.get(parent_id)
+            if parent is None:
+                continue
+            if str(parent.get('raw_source') or parent.get('source') or '').strip().lower() != 'subagent':
+                continue
+            selected.append(parent)
+            have.add(parent_id)
+            pending.append(parent)
+        return selected
 
 
 
diff --git a/api/routes.py b/api/routes.py
index 842ad3ef..7b22a1ad 100644
--- a/api/routes.py
+++ b/api/routes.py
@@ -22537,6 +22537,12 @@ def _handle_goal_command(handler, body):
         require(body, "session_id")
     except ValueError as e:
         return bad(handler, str(e))
+    if _is_silent_control_message(body.get("args") or body.get("text")):
+        return j(
+            handler,
+            {"status": "suppressed", "reason": "silent_control_message"},
+            status=200,
+        )
     if _session_is_subagent_view_only(str(body.get("session_id") or "")):
         return bad(handler, "Subagent sessions are view-only and cannot run /goal from WebUI", 400)
     try:
diff --git a/static/share.html b/static/share.html
index e7dcf832..80be8315 100644
--- a/static/share.html
+++ b/static/share.html
@@ -6,7 +6,7 @@
   <title>Shared Conversation - Hermes</title>
   <meta name="robots" content="noindex,nofollow,noarchive">
   <meta name="referrer" content="same-origin">
-  <script>(function(){try{var themes={light:1,dark:1,system:1},skins={codex:1,terracotta:1,default:1,ares:1,mono:1,graphite:1,github:1,slate:1,poseidon:1,sisyphus:1,charizard:1,sienna:1,catppuccin:1,hepburn:1,nous:1,'geist-contrast':1,neon:1,zeus:1,'verdigris':1},legacy={slate:['dark','slate'],solarized:['dark','poseidon'],monokai:['dark','sisyphus'],nord:['dark','slate'],oled:['dark','default']},t=(localStorage.getItem('hermes-theme')||'dark').toLowerCase(),s=(localStorage.getItem('hermes-skin')||'').toLowerCase(),m=legacy[t],theme=m?m[0]:(themes[t]?t:'dark');var pendingExt=s&&s!=='default'&&!skins[s]&&!legacy[s];var skin=skins[s]?s:(pendingExt?s:(m?m[1]:'default'));localStorage.setItem('hermes-theme',theme);localStorage.setItem('hermes-skin',skin);if(theme==='system')theme=window.matchMedia('(prefers-color-scheme:dark)').matches?'dark':'light';if(theme==='dark')document.documentElement.classList.add('dark');if(skin!=='default')document.documentElement.dataset.skin=skin;}catch(e){document.documentElement.classList.add('dark');}})()</script>
+  <script>(function(){try{var themes={light:1,dark:1,system:1},skins={codex:1,terracotta:1,default:1,ares:1,mono:1,graphite:1,github:1,slate:1,poseidon:1,sisyphus:1,charizard:1,sienna:1,catppuccin:1,hepburn:1,nous:1,'geist-contrast':1,neon:1,'neon-soft':1,'neon-paint':1,zeus:1,'verdigris':1},legacy={slate:['dark','slate'],solarized:['dark','poseidon'],monokai:['dark','sisyphus'],nord:['dark','slate'],oled:['dark','default']},t=(localStorage.getItem('hermes-theme')||'dark').toLowerCase(),s=(localStorage.getItem('hermes-skin')||'').toLowerCase(),m=legacy[t],theme=m?m[0]:(themes[t]?t:'dark');var pendingExt=s&&s!=='default'&&!skins[s]&&!legacy[s];var skin=skins[s]?s:(pendingExt?s:(m?m[1]:'default'));var _hadAppearance=localStorage.getItem('hermes-theme')!==null||localStorage.getItem('hermes-skin')!==null;if(_hadAppearance){localStorage.setItem('hermes-theme',theme);localStorage.setItem('hermes-skin',skin);}if(theme==='system')theme=window.matchMedia('(prefers-color-scheme:dark)').matches?'dark':'light';if(theme==='dark')document.documentElement.classList.add('dark');if(skin!=='default')document.documentElement.dataset.skin=skin;}catch(e){document.documentElement.classList.add('dark');}})()</script>
   <link rel="stylesheet" href="/static/style.css">
   <style>
     html,body{height:auto;min-height:100%}
diff --git a/tests/test_compression_phantom_barrier.py b/tests/test_compression_phantom_barrier.py
index c1cf9038..4e86101a 100644
--- a/tests/test_compression_phantom_barrier.py
+++ b/tests/test_compression_phantom_barrier.py
@@ -12,7 +12,6 @@ import re
 from pathlib import Path
 
 import pytest
-from playwright.sync_api import sync_playwright
 
 ROOT = Path(__file__).resolve().parents[1]
 STATIC = ROOT / "static"
@@ -200,7 +199,8 @@ async ({kind, doneSid}) => {
 
 @pytest.fixture(scope="module")
 def browser():
-    with sync_playwright() as playwright:
+    playwright_api = pytest.importorskip("playwright.sync_api")
+    with playwright_api.sync_playwright() as playwright:
         instance = playwright.chromium.launch(
             headless=True,
             args=["--no-sandbox", "--disable-dev-shm-usage"],
diff --git a/tests/test_goal_silent_ingress_suppression.py b/tests/test_goal_silent_ingress_suppression.py
new file mode 100644
index 00000000..6eec73c3
--- /dev/null
+++ b/tests/test_goal_silent_ingress_suppression.py
@@ -0,0 +1,119 @@
+"""Reserved ``[SILENT]`` must never become a goal kickoff turn.
+
+Cron agents use the exact final response ``[SILENT]`` as a delivery-suppression
+sentinel. ``/api/goal`` accepts free text via ``args``/``text`` and, when it
+looks like a kickoff, persists it as ``pending_user_message`` through
+``_start_chat_stream_for_session``. If an external wake relay POSTs the
+sentinel and 8701 restarts while the turn is pending, session repair
+materializes it as ``{"role": "user", "_recovered": True}`` — the same
+phantom-recovered-turn exposure #7018 closed for ``/api/chat/start``.
+
+The goal ingress therefore treats the exact normalized sentinel as a
+successful no-op *before* session lookup or goal-state mutation (mirrors
+``tests/test_silent_control_suppression.py`` for the goal path).
+"""
+from __future__ import annotations
+
+import io
+import json
+
+from api import routes
+
+
+class _JSONHandler:
+    headers = {}
+
+    def __init__(self):
+        self.status = None
+        self.wfile = io.BytesIO()
+        self.headers_sent = {}
+
+    def send_response(self, status):
+        self.status = status
+
+    def send_header(self, key, value):
+        self.headers_sent[key] = value
+
+    def end_headers(self):
+        pass
+
+
+def _payload(handler):
+    raw = handler.wfile.getvalue().decode("utf-8")
+    return json.loads(raw) if raw else {}
+
+
+def test_goal_ingress_suppresses_silent_before_session_lookup(monkeypatch):
+    looked_up = []
+
+    def _unexpected_lookup(*args, **kwargs):
+        looked_up.append((args, kwargs))
+        raise AssertionError("[SILENT] must be suppressed before session lookup")
+
+    monkeypatch.setattr(routes, "get_session", _unexpected_lookup)
+    handler = _JSONHandler()
+
+    routes._handle_goal_command(
+        handler,
+        {"session_id": "does-not-need-to-exist", "args": "  [SILENT]\n"},
+    )
+
+    assert handler.status == 200
+    assert _payload(handler) == {
+        "status": "suppressed",
+        "reason": "silent_control_message",
+    }
+    assert looked_up == []
+
+
+def test_goal_ingress_suppresses_silent_via_text_field(monkeypatch):
+    looked_up = []
+
+    def _unexpected_lookup(*args, **kwargs):
+        looked_up.append((args, kwargs))
+        raise AssertionError("[SILENT] must be suppressed before session lookup")
+
+    monkeypatch.setattr(routes, "get_session", _unexpected_lookup)
+    handler = _JSONHandler()
+
+    routes._handle_goal_command(
+        handler,
+        {"session_id": "does-not-need-to-exist", "text": "\t[SILENT] "},
+    )
+
+    assert handler.status == 200
+    assert _payload(handler) == {
+        "status": "suppressed",
+        "reason": "silent_control_message",
+    }
+    assert looked_up == []
+
+
+def test_goal_ingress_does_not_suppress_ordinary_kickoff(monkeypatch):
+    looked_up = []
+
+    def _record_lookup(*args, **kwargs):
+        looked_up.append((args, kwargs))
+        raise KeyError("session")
+
+    monkeypatch.setattr(routes, "get_session", _record_lookup)
+    handler = _JSONHandler()
+
+    routes._handle_goal_command(
+        handler,
+        {"session_id": "does-not-need-to-exist", "args": "write a report"},
+    )
+
+    # Ordinary kickoff text must NOT be suppressed: the request proceeds to
+    # session lookup (which raises here) instead of returning the 200 no-op.
+    assert looked_up != []
+    assert handler.status != 200
+
+
+def test_goal_silent_suppression_is_exact_and_case_sensitive():
+    assert routes._is_silent_control_message("[SILENT]") is True
+    assert routes._is_silent_control_message("  [SILENT]\n") is True
+    assert routes._is_silent_control_message("[silent]") is False
+    assert routes._is_silent_control_message("prefix [SILENT]") is False
+    assert routes._is_silent_control_message("") is False
+    assert routes._is_silent_control_message(None) is False
diff --git a/tests/test_issue2513_custom_provider_remote_models.py b/tests/test_issue2513_custom_provider_remote_models.py
index d889f207..27aa008a 100644
--- a/tests/test_issue2513_custom_provider_remote_models.py
+++ b/tests/test_issue2513_custom_provider_remote_models.py
@@ -45,13 +45,22 @@ def test_custom_provider_model_field_does_not_block_remote_catalog(monkeypatch,
         raise AssertionError(f"unexpected urlopen: {url}")
 
     monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    # This file pins the custom-provider catalog contract, not the separate
+    # async provider-catalog budget fallback. Force the synchronous rebuild
+    # path so a slow/loaded CI shard cannot blow the global 4s budget and
+    # serve the degraded fallback catalog, which drops the live-fetched
+    # models under test and leaves only the config-declared sticky model.
+    monkeypatch.setattr(config, "_LIVE_REBUILD_BUDGET_SECONDS", 0.0, raising=False)
     monkeypatch.setattr(config, "_models_cache_path", tmp_path / "models_cache.json")
     monkeypatch.setattr(config, "_get_auth_store_path", lambda: tmp_path / "auth.json")
+    # Keep unrelated provider probes from replacing this complete catalog assertion with the bounded fallback.
+    monkeypatch.setattr(config, "_LIVE_REBUILD_BUDGET_SECONDS", 0)
 
     old_cfg = config.cfg
     old_mtime = config._cfg_mtime
     old_cache = config._available_models_cache
     old_cache_ts = config._available_models_cache_ts
+    old_live_rebuild_ts = config._available_models_live_rebuild_ts
     old_cache_fp = config._available_models_cache_source_fingerprint
     try:
         config.cfg = {
@@ -76,6 +85,7 @@ def test_custom_provider_model_field_does_not_block_remote_catalog(monkeypatch,
         config._cfg_mtime = 0.0
         config._available_models_cache = None
         config._available_models_cache_ts = 0.0
+        config._available_models_live_rebuild_ts = 0.0
         config._available_models_cache_source_fingerprint = None
 
         data = config.get_available_models()
@@ -84,6 +94,7 @@ def test_custom_provider_model_field_does_not_block_remote_catalog(monkeypatch,
         config._cfg_mtime = old_mtime
         config._available_models_cache = old_cache
         config._available_models_cache_ts = old_cache_ts
+        config._available_models_live_rebuild_ts = old_live_rebuild_ts
         config._available_models_cache_source_fingerprint = old_cache_fp
 
     groups = {group["provider_id"]: group for group in data["groups"]}
diff --git a/tests/test_issue6853_docker_agents_context.py b/tests/test_issue6853_docker_agents_context.py
new file mode 100644
index 00000000..76d882f9
--- /dev/null
+++ b/tests/test_issue6853_docker_agents_context.py
@@ -0,0 +1,114 @@
+"""Regression coverage for #6853: keep repository instructions out of the image."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import shutil
+import subprocess
+
+import pytest
+
+
+REPO = Path(__file__).resolve().parents[1]
+
+
+def _dockerignore_rules() -> set[str]:
+    return {
+        line.strip()
+        for line in (REPO / ".dockerignore").read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.lstrip().startswith("#")
+    }
+
+
+def _excluded_by_root_rule(path: str, rules: set[str]) -> bool:
+    """Model the exact root-only rule used for this context boundary."""
+    return "/AGENTS.md" in rules and path == "AGENTS.md"
+
+
+def test_repository_agents_file_is_excluded_from_docker_context():
+    """The repository instruction file must not enter the runtime image."""
+    assert _excluded_by_root_rule("AGENTS.md", _dockerignore_rules())
+
+
+def test_workspace_agents_file_is_not_recursively_excluded():
+    """A selected workspace may still provide its own Agent instructions."""
+    assert not _excluded_by_root_rule("workspace/AGENTS.md", _dockerignore_rules())
+
+
+def test_dockerfile_copies_context_to_apptoo_before_runtime_seed():
+    """The image source and runtime seed source must share the filtered tree."""
+    dockerfile = (REPO / "Dockerfile").read_text(encoding="utf-8")
+    copy_lines = {
+        line.strip()
+        for line in dockerfile.splitlines()
+        if line.lstrip().startswith("COPY ")
+    }
+
+    assert "COPY --chown=root:root . /apptoo" in copy_lines
+    assert "COPY --chown=root:root . /app" not in copy_lines
+
+
+def test_docker_init_has_both_filtered_context_seed_paths():
+    """Both startup modes must seed /app from the Dockerfile context copy."""
+    init = (REPO / "docker_init.bash").read_text(encoding="utf-8")
+
+    assert "rsync -av --chown=hermeswebui:hermeswebui /apptoo/ /app/" in init
+    assert "cp -a /apptoo/. /app/" in init
+    assert "HERMES_WEBUI_DEFAULT_WORKSPACE=\"/workspace\"" in init
+    assert "cd /app" in init
+
+
+def _docker_runtime_available() -> bool:
+    docker = shutil.which("docker")
+    if docker is None:
+        return False
+    result = subprocess.run(
+        [docker, "info"],
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=15,
+        creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
+    )
+    return result.returncode == 0
+
+
+@pytest.mark.skipif(
+    not os.environ.get("HERMES_RUN_DOCKER_RUNTIME_TESTS") or not _docker_runtime_available(),
+    reason="Docker runtime proof is opt-in for the CI integration job",
+)
+@pytest.mark.timeout(900)
+def test_docker_runtime_keeps_app_clean_in_both_seed_modes_and_workspace_intact(tmp_path):
+    """Build the image and exercise the exact normal/rootless seed destinations."""
+    docker = shutil.which("docker")
+    assert docker is not None
+    tag = f"hermes-webui-pr-6853-{os.getpid()}"
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    (workspace / "AGENTS.md").write_text("workspace instructions\n", encoding="utf-8")
+
+    try:
+        subprocess.run(
+            [docker, "build", "--progress=plain", "-t", tag, "."],
+            check=True,
+            timeout=900,
+        )
+        for user in (None, "1000:1000"):
+            command = (
+                "set -eu; rm -rf /app/* /app/.[!.]* /app/..?*; "
+                + (
+                    "rsync -a --chown=hermeswebui:hermeswebui /apptoo/ /app/"
+                    if user is None
+                    else "cp -a /apptoo/. /app/"
+                )
+                + "; test -f /app/server.py; test ! -e /app/AGENTS.md; "
+                "test -f /workspace/AGENTS.md"
+            )
+            args = [docker, "run", "--rm", "--mount", f"type=bind,source={workspace},target=/workspace"]
+            if user is not None:
+                args.extend(["--user", user])
+            args.extend(["--entrypoint", "bash", tag, "-c", command])
+            subprocess.run(args, check=True, timeout=60)
+    finally:
+        subprocess.run([docker, "rmi", "-f", tag], check=False, timeout=60)
diff --git a/tests/test_media_etag_revalidation.py b/tests/test_media_etag_revalidation.py
index 73f5a866..f235062b 100644
--- a/tests/test_media_etag_revalidation.py
+++ b/tests/test_media_etag_revalidation.py
@@ -49,6 +49,14 @@ def routes():
     return routes
 
 
+@pytest.fixture(autouse=True)
+def media_allowed_root(tmp_path, monkeypatch):
+    # tmp_path is under /tmp only on Linux; register it and make Path.home()
+    # resolve to the same fixture root on Windows so deny tests reach #3234.
+    monkeypatch.setenv("MEDIA_ALLOWED_ROOTS", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+
+
 # ── _serve_file_bytes ETag / 304 ──────────────────────────────────────────
 
 
diff --git a/tests/test_media_message_snapshots.py b/tests/test_media_message_snapshots.py
index 6a1d3146..2f4a4512 100644
--- a/tests/test_media_message_snapshots.py
+++ b/tests/test_media_message_snapshots.py
@@ -56,6 +56,14 @@ def routes():
     return routes
 
 
+@pytest.fixture(autouse=True)
+def media_allowed_root(tmp_path, monkeypatch):
+    # tmp_path is under /tmp only on Linux; register it and make Path.home()
+    # resolve to the same fixture root on Windows so deny tests reach #3234.
+    monkeypatch.setenv("MEDIA_ALLOWED_ROOTS", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+
+
 @pytest.fixture
 def snap_dir(tmp_path, monkeypatch):
     """Isolate the snapshot store per test and point it at tmp_path."""
@@ -694,4 +702,4 @@ def test_frontend_stamp_source_invariants():
     # transcript + transparent segments, which are the comparison surface).
     # Lazy loaders must read the stamped digest.
     assert "_mediaSnapQuery(el)" in src
-    assert "el.dataset.snap" in src
\ No newline at end of file
+    assert "el.dataset.snap" in src
diff --git a/tests/test_subagent_parent_in_import_window.py b/tests/test_subagent_parent_in_import_window.py
new file mode 100644
index 00000000..1df2d7f5
--- /dev/null
+++ b/tests/test_subagent_parent_in_import_window.py
@@ -0,0 +1,147 @@
+"""Regression tests: a recency-sliced subagent leaf must keep its parent row.
+
+`read_importable_agent_session_rows()` applied the visible-window limit as a
+flat per-row recency slice. Subagent rows only render as children when their
+parent row is in the same payload, so a frozen orchestrator (no longer writing)
+lost the recency race against its own still-streaming leaves and fell out of the
+window — promoting the leaves to top-level sidebar rows. The projection now
+re-adds subagent parents that the oversampled candidate set already projected.
+"""
+import sqlite3
+
+from api.agent_sessions import read_importable_agent_session_rows
+
+
+def _make_db(path, sessions, messages):
+    """sessions: (id, title, source, parent_session_id); messages: (session_id, role, ts)."""
+    conn = sqlite3.connect(str(path))
+    conn.execute(
+        "CREATE TABLE sessions (id TEXT PRIMARY KEY, title TEXT, model TEXT, "
+        "message_count INTEGER, started_at REAL, source TEXT, parent_session_id TEXT)"
+    )
+    conn.execute("CREATE TABLE messages (id INTEGER PRIMARY KEY, session_id TEXT, role TEXT, timestamp REAL)")
+    for sid, title, source, parent in sessions:
+        conn.execute(
+            "INSERT INTO sessions (id, title, model, message_count, started_at, source, parent_session_id) "
+            "VALUES (?,?,?,?,?,?,?)",
+            (sid, title, "gpt", 2, 1000.0, source, parent),
+        )
+    for sid, role, ts in messages:
+        conn.execute("INSERT INTO messages (session_id, role, timestamp) VALUES (?,?,?)", (sid, role, ts))
+    conn.commit()
+    conn.close()
+
+
+def _lineage_db(path, parent_source="subagent"):
+    """One quiet orchestrator + 3 hot leaves + an unrelated hot subagent row."""
+    sessions: list[tuple[str, str, str, str | None]] = [
+        ("orch", "Orchestrator", parent_source, None),
+        ("loner", "Unrelated", "subagent", None),
+    ]
+    messages = [("orch", "user", 100.0), ("orch", "assistant", 101.0)]  # went quiet early
+    for i in range(3):
+        sessions.append((f"leaf{i}", f"Leaf {i}", "subagent", "orch"))
+        messages += [(f"leaf{i}", "user", 900.0 + i), (f"leaf{i}", "assistant", 901.0 + i)]
+    messages += [("loner", "user", 800.0), ("loner", "assistant", 801.0)]
+    _make_db(path, sessions, messages)
+
+
+def test_evicted_subagent_parent_is_kept_in_window(tmp_path):
+    db = tmp_path / "state.db"
+    _lineage_db(db)
+
+    # limit=3 is exactly the three hot leaves; the quiet parent is sliced off.
+    rows = read_importable_agent_session_rows(db, limit=3, exclude_sources=None)
+    by_id = {r["id"]: r for r in rows}
+
+    assert "orch" in by_id, "quiet subagent parent must survive the recency slice"
+    for i in range(3):
+        leaf = by_id[f"leaf{i}"]
+        assert leaf["parent_session_id"] == "orch"
+        assert leaf["relationship_type"] == "child_session"
+
+
+def test_unrelated_older_subagent_row_stays_excluded(tmp_path):
+    db = tmp_path / "state.db"
+    _lineage_db(db)
+
+    rows = read_importable_agent_session_rows(db, limit=3, exclude_sources=None)
+
+    # Only ancestors are rescued — an unrelated quieter subagent row stays out.
+    assert "loner" not in {r["id"] for r in rows}
+
+
+def test_webui_parent_is_not_force_imported(tmp_path):
+    db = tmp_path / "state.db"
+    _lineage_db(db, parent_source="webui")
+
+    rows = read_importable_agent_session_rows(db, limit=3, exclude_sources=None)
+
+    # The webui sidebar bucket already owns its own rows; don't duplicate them.
+    assert "orch" not in {r["id"] for r in rows}
+    assert {f"leaf{i}" for i in range(3)} <= {r["id"] for r in rows}
+
+
+def test_recovered_parent_is_returned_beyond_limit(tmp_path):
+    """`limit` bounds the recency slice, not the row count (documented contract)."""
+    db = tmp_path / "state.db"
+    _lineage_db(db)
+
+    rows = read_importable_agent_session_rows(db, limit=3, exclude_sources=None)
+
+    # 3 sliced leaves + 1 re-added anchor: callers must iterate, not assume <= limit.
+    assert len(rows) == 4
+    assert {r["id"] for r in rows} == {"leaf0", "leaf1", "leaf2", "orch"}
+
+
+def _window_db(path, filler):
+    """Quiet parent, `filler` newer unrelated rows, one hot child of that parent."""
+    sessions: list[tuple[str, str, str, str | None]] = [("orch", "Orchestrator", "subagent", None)]
+    messages = [("orch", "user", 100.0), ("orch", "assistant", 100.5)]
+    for i in range(filler):
+        sessions.append((f"fill{i}", f"Filler {i}", "subagent", None))
+        messages += [(f"fill{i}", "user", 200.0 + i), (f"fill{i}", "assistant", 200.5 + i)]
+    sessions.append(("leaf", "Leaf", "subagent", "orch"))
+    messages += [("leaf", "user", 9000.0), ("leaf", "assistant", 9001.0)]
+    _make_db(path, sessions, messages)
+
+
+def test_parent_inside_candidate_oversample_is_recovered(tmp_path):
+    """The oversample is limit * 8, so a parent ranked within it is still restored."""
+    db = tmp_path / "state.db"
+    _window_db(db, filler=22)  # orch is candidate #24 of 24
+
+    rows = read_importable_agent_session_rows(db, limit=3, exclude_sources=None)
+
+    assert "orch" in {r["id"] for r in rows}
+
+
+def test_parent_beyond_candidate_oversample_stays_unresolved(tmp_path):
+    """Documented bound: recovery reuses the limit * 8 candidate set, never a new query.
+
+    A parent ranked below that oversample is not fetched, so its child renders
+    top-level — the pre-existing behaviour. This pins the boundary so widening
+    it becomes a deliberate `candidate_limit` change, not an accidental one.
+    """
+    db = tmp_path / "state.db"
+    _window_db(db, filler=23)  # orch is pushed to candidate #25 of 24
+
+    rows = read_importable_agent_session_rows(db, limit=3, exclude_sources=None)
+    ids = {r["id"] for r in rows}
+
+    assert "leaf" in ids
+    assert "orch" not in ids
+
+
+def test_parent_cycle_does_not_hang(tmp_path):
+    """A corrupt self/mutual parent link must not spin the ancestor walk."""
+    db = tmp_path / "state.db"
+    _make_db(
+        db,
+        [("a", "A", "subagent", "b"), ("b", "B", "subagent", "a")],
+        [("a", "user", 900.0), ("a", "assistant", 901.0), ("b", "user", 100.0), ("b", "assistant", 101.0)],
+    )
+
+    rows = read_importable_agent_session_rows(db, limit=1, exclude_sources=None)
+
+    assert {r["id"] for r in rows} == {"a", "b"}