diff --git a/docs/CHECKLISTS.md b/docs/CHECKLISTS.md
index 5d9afabc5..ab99b4a75 100644
--- a/docs/CHECKLISTS.md
+++ b/docs/CHECKLISTS.md
@@ -646,14 +646,14 @@ and do not return `PASS` for an item that also has a `FAIL` — the concrete
 | 6 | timeout_and_output_discipline | Is `timeout_sec` reasonable for the stated workload (default 60, hard cap 300)? Do scripts print to stdout in chunks that the runtime can cap, rather than streaming unbounded output? Unbounded loops without a `break`/timeout path are a concrete FAIL. | advisory |
 | 7 | extension_namespace_discipline | `type: extension` only: does the extension register its tool/route/ws-handler/ui-tab under the namespace derived from its `name` (e.g. provider-safe tool/ws names like `ext_<len>_<token>_<surface>`, route `/api/extensions/<name>/…`)? Tool and WS short names must be alphanumeric/underscore and at most 24 characters. Namespace collisions with built-in surfaces are a concrete FAIL. If the extension uses `api.send_ws_message`, are emitted event names short/provider-safe and paired with reviewed host-owned widget `subscription` components rather than arbitrary same-origin JavaScript? If the extension declares streaming UI, is it a reviewed extension route consumed by a host-owned `stream` component? A reviewed `module` widget may also consume the skill's own routes (including streaming responses) and the skill's namespaced WebSocket events through the host-mediated bridge (`OuroborosWidget.fetch` / `OuroborosWidget.onEvent`), which is not arbitrary same-origin JavaScript. If the extension owns background resources (threads, sockets, EventSource clients, subprocesses), does it register cleanup with `api.on_unload(callback)`? If the extension declares a widget render block, is it one of the host-owned schemas (`iframe`, `module`, or declarative v1: forms/actions, markdown/code, JSON/kv/table, tabs/chart, stream/subscription, progress/poll, file/gallery/media, map/calendar/kanban, group/metric/callout), with media sourced from extension routes or safe data URLs and no arbitrary same-origin JavaScript? Nested interactive group/tab children must use stable identity and one host-owned lifecycle, while `subscription.render` stays transitively passive. For non-extension skills, verdict PASS with reason "Not applicable — type != extension." | severity-driven for applicable extensions |
 | 8 | widget_module_safety | **v5.7.0+. ``kind: "module"`` widgets only.** The host fetches reviewed ``widget.js`` through ``GET /api/extensions/<skill>/module/<entry>``, embeds the source into a sandboxed opaque-origin ``<iframe srcdoc sandbox="allow-scripts allow-pointer-lock allow-downloads" allow="autoplay; fullscreen; clipboard-write">`` with no ``allow-same-origin`` — ``document.cookie``, ``localStorage``, and ``sessionStorage`` throw ``SecurityError`` there by construction and need no source review — and injects a parent-mediated ``fetch`` bridge that rejects paths outside the owning skill route prefix. Reviewers confirm at the source level what the sandbox cannot: (a) no ``fetch``/``XMLHttpRequest`` URL outside ``/api/extensions/<skill>/`` and no bespoke ``postMessage`` protocol to ``window.parent`` beyond the host bridge; (b) the declared launch policy ``render.start`` (SSOT ``ouroboros/extension_ui_validation.py::WIDGET_START_MODES``; see CREATING_SKILLS "Launch policy") fits the widget's weight — ``auto`` only for a cheap instrument, ``manual`` for a program that should not run all the time, ``retain`` only for a program that genuinely must keep running while the owner is elsewhere and stays cheap while hidden; (c) a widget with state worth keeping registers ``window.__ouroWidgetOnDispose(fn)`` (never assigns over it) and saves that state through the skill's own routes, because the frame is disposable; (d) a module that declares ``render.appearance: host`` uses the optional ``OuroborosWidget.onTheme(callback)`` bridge; a real consumer should prove both resolved palettes, while ``independent``/``fixed`` modules remain author-owned. The declaration is author/reviewer intent, not a source-level proof or runtime gate for legacy payloads; a source mismatch or missing browser evidence is advisory unless it exposes a concrete runtime failure. Acceptable interactions: ``fetch('/api/extensions/<skill>/...')`` (through the host bridge), ``window.OuroborosWidget.fetch('/api/extensions/<skill>/...')``, ``window.OuroborosWidget.onTheme(callback)``, and host-supplied data attributes. Mark non-module widgets and non-extension skills PASS with reason "Not applicable". | severity-driven when kind=module |
-| 9 | inject_chat_minimization | Does any use of the `inject_chat` permission have a narrow, user-facing transport purpose? The Host Service enforces token auth, skill-source attribution, rate limits, in-flight limits, fresh executable review, enablement, and explicit content-hash-bound grants. Reviewed chat transports may carry the same raw owner text as direct chat, including slash commands such as `/panic`, `/restart`, `/review`, `/evolve`, `/bg`, and `/status`; reviewers must evaluate whether the transport itself is authorized, attributable, bounded, and user-facing rather than treating slash-shaped text as automatically forbidden. A skill that accepts external inbound traffic must still show local defense-in-depth appropriate to its transport: owner/chat binding or an equivalent access rule, bounded polling/backpressure, and no unaudited broadcast to unrelated parties. Missing local defense-in-depth is a concrete FAIL for network transports. Mark PASS with reason "Not applicable" when `inject_chat` is not declared. | critical |
-| 10 | event_subscription_minimization | Are `subscribe_event` and `subscribe_events` limited to the minimum host event topics required by the skill? `chat.outbound`, `chat.typing`, `chat.photo`, `chat.video`, `chat.document`, `chat.links`, `chat.quiz` and `chat.quiz_state` expose owner/agent conversation data (including delivered file bytes, outbound link actions and the owner's verbatim quiz answers) and require explicit justification. Wildcards, undeclared topics, or forwarding subscribed chat content to unrelated external services are concrete FAILs. Mark PASS with reason "Not applicable" when `subscribe_event` is not declared. | critical |
+| 9 | inject_chat_minimization | Does any use of the `inject_chat` permission have a narrow, user-facing transport purpose? The Host Service enforces token auth, skill-source attribution, rate limits, in-flight limits, fresh executable review, enablement, and explicit content-hash-bound grants. Reviewed chat transports may carry the same raw owner text as direct chat, including slash commands such as `/panic`, `/restart`, `/review`, `/evolve`, `/bg`, and `/status`; reviewers must evaluate whether the transport itself is authorized, attributable, bounded, and user-facing rather than treating slash-shaped text as automatically forbidden. A skill that accepts external inbound traffic must still show local defense-in-depth appropriate to its transport: owner/chat binding or an equivalent access rule, bounded polling/backpressure, and no unaudited broadcast to unrelated parties. Missing local defense-in-depth is a concrete FAIL for network transports. The same criteria and severity govern `notify_owner` (`POST /notify`): one bounded, attributable, user-facing sentence the host shows in the owner's chat as a System row signed with the skill's name, never a way to inject conversation or wake the agent. Mark PASS with reason "Not applicable" when neither `inject_chat` nor `notify_owner` is declared. | critical |
+| 10 | event_subscription_minimization | Are `subscribe_event` and `subscribe_events` limited to the minimum host event topics required by the skill? `chat.outbound`, `chat.typing`, `chat.photo`, `chat.video`, `chat.document`, `chat.links`, `chat.quiz` and `chat.quiz_state` expose owner/agent conversation data (including delivered file bytes, outbound link actions and the owner's verbatim quiz answers) and require explicit justification. `chat.outbound` also carries the owner's notes and skill notices (`reminder`/`skill_notice` System rows), which may name a private event; their transport destination and handling need the same justification. Wildcards, undeclared topics, or forwarding subscribed chat content (notes and notices included) to unrelated external services are concrete FAILs. Mark PASS with reason "Not applicable" when `subscribe_event` is not declared. | critical |
 | 11 | companion_process_safety | For `companion_process` / `supervised_task` skills: is every command declared as an argument list (not shell string), using an allowlisted runtime, with no writes outside `skill_dir` / `state_dir`, no unbounded restart loop, and cleanup on unload/panic? Does the process avoid inheriting secrets except through reviewed `env_from_settings` grants? Mark PASS with reason "Not applicable" when no long-lived process/task is declared — a transient `subprocess.run`/`subprocess.Popen` invocation of a build tool like `ffmpeg`, `ImageMagick`, or `git` inside a normal request handler is NOT a long-lived companion process and does not trigger this item (its safety belongs under items 4 / 6 / 13). | severity-driven when applicable |
 | 12 | host_token_handling | If the skill calls the Host Service API, does it use the provided `SkillToken.use_in_request()` only at request construction sites, avoid logging/serializing tokens, and keep all host-service calls on the loopback endpoint? Printing, persisting, exfiltrating, or embedding the token into user-visible output is a concrete FAIL. Mark PASS with reason "Not applicable" when the skill does not access the Host Service API. | critical |
 | 13 | error_handling | Does the skill surface actionable errors instead of swallowing exceptions, returning success on partial failure, or leaving users to inspect raw logs manually? Are retry/backoff paths bounded and purpose-specific? | advisory |
 | 14 | integration_preflight | Does the skill include cheap local preflight checks for the APIs/files/runtimes it depends on before spending provider budget or starting long work? Missing preflight for fragile external integrations is an advisory FAIL. | advisory |
 | 15 | bug_hunting | Are there obvious runtime bugs in reviewed code: wrong filenames, mismatched manifest script names, missing imports, impossible arguments, JSON/schema mismatches, blocking calls in async handlers, or untested happy-path assumptions? For every FAIL, cite the concrete runtime bug and state how you propose to fix it (file/symbol/change), so the author can apply the correction instead of guessing. Concrete likely runtime breakage should use `severity=critical`; latent issues, provider fragility, minor cleanup, or dead-code concerns should use `severity=advisory`. | severity-driven |
-| 16 | completion_notification | For long-running or user-visible work, does the skill emit or document a completion/failure notification path (for example a host event, `events.jsonl` append, or clear stdout marker consumed by Ouroboros)? Mark PASS with reason "Not applicable" for tiny synchronous utilities. | advisory |
+| 16 | completion_notification | For long-running or user-visible work, does the skill emit or document a completion/failure notification path (for example a host event, `events.jsonl` append, or clear stdout marker consumed by Ouroboros)? A skill that must reach the owner directly (a reminder, a finished external job) declares `notify_owner` and hands the host one bounded sentence through `POST /notify`, shown as a signed System row in the owner's chat — judged as under item 9: attributable, bounded, user-facing, and never a way to inject conversation. Mark PASS with reason "Not applicable" for tiny synchronous utilities. | advisory |
 
 ### Severity rules
 
diff --git a/docs/CREATING_SKILLS.md b/docs/CREATING_SKILLS.md
index 7315e10c7..b72890f53 100644
--- a/docs/CREATING_SKILLS.md
+++ b/docs/CREATING_SKILLS.md
@@ -595,6 +595,7 @@ calls and runtime behaviours:
 | `subscribe_event` | The skill may subscribe to manifest-declared host event topics such as `chat.outbound` or `skill.lifecycle`. Chat topics require owner permission grants; `skill.lifecycle` does not. |
 | `inject_chat` | The skill may request Host Service chat injection after an explicit owner permission grant: `POST /chat/inject` carries text, an inline image, or `attachments` (`[{path, name?, mime?}]` — regular files under the skill's own state root, at most 25 per message, which the host copies without the former 50 MiB upload cap into the shared `data/uploads` chat-upload store and stages for the task; a file-only message needs no text). The same grant lets the skill relay the owner's decision-card answer through `POST /chat/decision` (`{request_id, decision_id, option_index?, comment?}`, the `POST /api/decisions` contract). A message that carries a `client_message_id` becomes an addressable operation: the host answers with its `operation_ref` (`<chat_id>:<client_message_id>`) on 202, 200 and 504; a repeated delivery of the same message rejoins it instead of enqueueing again (a different message under a reused id is refused with 409); `GET /chat/operations/{operation_ref}` reports the skill's own accepted message (`pending`, `running` with its task or turn, the durable answer, a terminal task status, or `lost` after a host restart); and `POST /chat/cancel` (`{operation_ref, reason?}`) runs the existing cancellation owner on work that message started, answering `cancelled`, `already_terminal`, `unresolved` or `cancel_unsupported` — never a cancellation that did not happen. |
 | `presence` | A reviewed transport skill may submit authenticated non-owner conversation events to the Host Service Presence boundary and poll only their correlated late work. Requires an explicit content-hash-bound owner grant. |
+| `notify_owner` | The skill may tell the owner one thing through `POST /notify` after an explicit owner permission grant (see "Telling the owner something" below): one bounded plain sentence the host shows in the owner's chat as a System row signed with the skill's name. It wakes no model; narrower than `inject_chat`. |
 
 A missing permission causes the matching `register_*` call to raise
 `ExtensionRegistrationError`, surfaced as a skill load error in the
@@ -608,8 +609,8 @@ Some settings keys are protected: `OPENROUTER_API_KEY`,
 `GITHUB_TOKEN`, `OUROBOROS_NETWORK_PASSWORD`. These keys are NEVER
 forwarded to a skill by default, even when listed in
 `env_from_settings`. Custom secret keys stored in Settings → Secrets
-are treated the same way. Host permissions such as `inject_chat`, `presence`, and
-chat event subscriptions also require explicit, content-hash-bound owner
+are treated the same way. Host permissions such as `inject_chat`, `presence`,
+`notify_owner` and chat event subscriptions also require explicit, content-hash-bound owner
 consent. The desktop launcher's owner-grant bridge records these grants.
 
 The Skills UI surfaces missing grants on the skill card. The agent
@@ -846,6 +847,39 @@ permission grant. Skills that perform multi-step external work should still
 print a concise success/failure marker or write structured state under
 `OUROBOROS_SKILL_STATE_DIR` so the agent can decide whether to fix or report.
 
+## Telling the owner something (`POST /notify`)
+
+A skill that must reach the owner with a finished sentence (a calendar's
+"meeting in 15 minutes", an external job that ended) declares `notify_owner`,
+waits for the owner's grant and posts it:
+
+```json
+{"text": "⏰ 14:45 · Meeting with Ivan (in 15 min)"}
+```
+
+The host writes one System row (`system_type: "skill_notice"`) in the owner's
+chat: the signature line `Notice · <your skill name>`, stamped by the host, then
+your sentence verbatim. Like any System row it stays in history, the Telegram
+skill mirrors it (in `telegram_only` mode too, to the pinned Chat ID), a running
+client with notifications on rings it under "Messages Ouroboros sends you while it
+works, its reminders, and skill notices" (titled `Notice from <skill>`, the
+sentence only with message text on), and
+Ouroboros reads it on its next turn as `📋 [skill_notice]`, so it
+knows what you told the owner. No model turn starts.
+
+`text` is required, plain, at most 400 characters. `200 {ok, ts, chat_id}`: the
+row is written. `400`: not one plain sentence. `403`: no live grant (a disabled
+skill, a stale review or a revoked grant included); nothing is written. `429`:
+the 60-per-minute lane. `503 {status: "not_confirmed"}`: the row is not
+confirmed, so check the chat before posting again (a notice is not
+server-idempotent); a host without a configured model provider has no chat
+writer yet and answers it too. `GET /identity` advertises `notify_version: 1`; on
+an older host it is absent, so degrade to your own widget. Timing is yours: post
+at the moment you chose (a calendar keeps its own clock).
+
+Prefer `inject_chat` when the event needs Ouroboros to think or act (it starts a
+turn); `notify_owner` is for facts the owner should simply see.
+
 ## Iterative skill development
 
 The recommended closed-loop workflow is:
diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index 2ec992017..77fcbf724 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -556,6 +556,17 @@ completion mirror). New host producers stamp both fields. Relays
 preserve them through live delivery, persistence and history. Model narration,
 proactive replies and questions remain model-authored even when typed.
 
+Authorship also has a time axis. Ouroboros's voice means *the model, now*. Words
+the mind wrote earlier for a later moment — a note left with
+`schedule_followup(notify=true)` — reach the owner at that moment as a System row
+(`system_type="reminder"`), never as a live reply: the host prepends one signature
+line, `Reminder · Ouroboros · written <when> · for <when>` (plus `· delivered
+<when>` when downtime held it back), and keeps the words verbatim. The host does
+not rewrite, summarize or re-time them; the next turn reads the row as a host fact
+(`📋 [reminder]`), so Ouroboros knows what the owner was shown. A skill holding the
+owner's `notify_owner` grant speaks the same way in its own name: a
+`skill_notice` System row signed `Notice · <skill>`.
+
 Formatting is asymmetric: assistant text always uses the sanitized chat markdown
 renderer regardless of `markdown`; ordinary System text is escaped unless
 `markdown: true`. The typed `skill_review` row keeps its dedicated renderer.
@@ -1416,6 +1427,8 @@ engineering rules; no second policy list may exist.
 never *look, I am still working*. It exists so the owner can leave the window
 and still be reached by a question or a finished task.
 
+**Startup & background.** Settings → Behavior owns host lifecycle choices, separate from the client-local Appearance controls. Sign-in startup is off until the owner opts in and always names the computer running Ouroboros, even in a remote client. OS registration is the truth: another copy, an OS-disabled entry and an unavailable app build remain visible rather than becoming a saved-settings guess. Automatic startup preserves Panic stops and saved pauses; an explicit owner start releases Panic. Closing the desktop window still exits; keeping it running after close has no control yet. Android deliberately keeps its existing automatic boot entry by default, with the same Panic-preservation contract.
+
 **When the client runs.** Notifications are a property of a running client. This
 version adds no tray agent, no background process and no push channel, so
 closing Ouroboros ends them. The existing Telegram bridge remains the separate
@@ -1436,6 +1449,7 @@ exceptions.
 | A question or decision is waiting | required | a confirmed lifecycle fact: the question carries a positive wait |
 | A task finished or stopped | required | a positive typed terminal fact on a ROOT task |
 | Messages Ouroboros sends while working | LLM-first | Ouroboros chose to speak outside the turn's answer (a proactive message in its room or as a Main notice, or an optional question) |
+| A note Ouroboros left for this moment, or a granted skill's notice (same toggle) | LLM-first; owner grant | when it wrote the note, Ouroboros chose to leave these words for this time; a skill speaks only under the owner's `notify_owner` grant; the host only shows the signed `reminder`/`skill_notice` row |
 | Ordinary replies in Main | separate toggle | an ordinary finished reply in the Main thread |
 
 *Required* means the application asks for delivery from its own state rather
diff --git a/docs/DOMAIN_MAP.md b/docs/DOMAIN_MAP.md
index dfa10f301..f588c5177 100644
--- a/docs/DOMAIN_MAP.md
+++ b/docs/DOMAIN_MAP.md
@@ -15,20 +15,20 @@ The manifest is the SSOT of the module→domain assignment (1:1, complete over t
 | D05 | Tool surfaces: files, code, shell, media, external | 29 | 0 |
 | D06 | Review stack | 72 | 0 |
 | D07 | Delegation, subagents & Claudexor | 59 | 0 |
-| D08 | Supervisor: queue, workers, events & runtime control | 55 | 0 |
+| D08 | Supervisor: queue, workers, events & runtime control | 56 | 0 |
 | D09 | Cancellation, owner control & process custody | 14 | 0 |
 | D10 | Git, update & release machinery | 29 | 0 |
-| D11 | Gateway, server & Web UI | 62 | 0 |
+| D11 | Gateway, server & Web UI | 64 | 0 |
 | D12 | Settings & configuration | 15 | 0 |
 | D13 | Safety, guards & runtime mode | 9 | 0 |
 | D14 | Skills & extensions | 56 | 0 |
 | D15 | Memory, knowledge, consciousness & self-evolution | 23 | 0 |
 | D16 | Observability, usage accounting & cost | 15 | 0 |
 | D17 | Projects, workspaces & task results | 27 | 0 |
-| D18 | Launcher, packaging, platform & shared substrate | 15 | 0 |
+| D18 | Launcher, packaging, platform & shared substrate | 17 | 0 |
 | D19 | Frozen contracts (ABI) | 10 | 0 |
 | D20 | Presence | 10 | 0 |
-| **total** | | **617** | **0** |
+| **total** | | **622** | **0** |
 
 ## Dependency direction matrix (strict, pinned)
 
@@ -525,6 +525,7 @@ No function body (≥ 10 normalized lines) is shared verbatim across domains. Ne
 - `supervisor/queue_transitions.py`
 - `supervisor/restart_retention.py`
 - `supervisor/schedule_lifecycle.py`
+- `supervisor/schedule_notes.py`
 - `supervisor/schedule_occurrence.py`
 - `supervisor/schedule_time.py`
 - `supervisor/sleep_wake.py`
@@ -604,6 +605,7 @@ No function body (≥ 10 normalized lines) is shared verbatim across domains. Ne
 - `ouroboros/gateway/control.py`
 - `ouroboros/gateway/cost_breakdown.py`
 - `ouroboros/gateway/decision_contracts.py`
+- `ouroboros/gateway/desktop_autostart.py`
 - `ouroboros/gateway/endpoint_index.py`
 - `ouroboros/gateway/extension_receipts.py`
 - `ouroboros/gateway/extensions.py`
@@ -611,6 +613,7 @@ No function body (≥ 10 normalized lines) is shared verbatim across domains. Ne
 - `ouroboros/gateway/history.py`
 - `ouroboros/gateway/history_contracts.py`
 - `ouroboros/gateway/history_paging.py`
+- `ouroboros/gateway/host_notify.py`
 - `ouroboros/gateway/host_service.py`
 - `ouroboros/gateway/logs.py`
 - `ouroboros/gateway/marketplace.py`
@@ -826,6 +829,7 @@ No function body (≥ 10 normalized lines) is shared verbatim across domains. Ne
 - `launcher.py`
 - `ouroboros/__init__.py`
 - `ouroboros/cli.py`
+- `ouroboros/desktop_autostart.py`
 - `ouroboros/jsonl_tail.py`
 - `ouroboros/launcher_bootstrap.py`
 - `ouroboros/launcher_server_reaper.py`
@@ -838,6 +842,7 @@ No function body (≥ 10 normalized lines) is shared verbatim across domains. Ne
 - `ouroboros/reference_books.py`
 - `ouroboros/utils.py`
 - `ouroboros/verified_download.py`
+- `ouroboros/windows_autostart.py`
 
 ### D19 — Frozen contracts (ABI)
 
diff --git a/docs/PERSISTENCE.md b/docs/PERSISTENCE.md
index 71f4f32fa..0502d4269 100644
--- a/docs/PERSISTENCE.md
+++ b/docs/PERSISTENCE.md
@@ -55,7 +55,7 @@ scanned data-relative path to be covered by a row here (count-anchored both ways
 | `state/queue_snapshot.json` | `supervisor/queue_snapshot.py` | `_schema_version: 1` (ABI-2) | atomic overwrite; ordinary unscoped pending rows expire at max_age 900 s; Project rows, exact pauses, acknowledged continuations and `owner_restart_hold` rows (`supervisor/restart_retention.py`) retain custody across age; carried admission/dispatch/hold facts are never backfilled | absent = no snapshot recovery; existing result/cancellation custodians remain; unknown handoff never authorizes replay; an unconsumed `owner_restart_no_resume.flag` makes every restored never-started row take the owner-Restart hold before the flag is consumed |
 | `state/direct_roots.json` | `supervisor/direct_roots.py` — the main loop's off-lock projection of live direct-chat turns, written beside the snapshot on every tick (`publish_direct_roots`, `server.py`); queue init hands the previous process's rows to snapshot restore, which fences them, and empties the file in the same step (`take_direct_roots`, `supervisor/queue.py`) so a dead process's turns never outlive it | none — not needed: the whole file is re-derived every tick, and an unreadable one reads as no direct roots | overwrite; the rows are whatever the actor registry holds this tick, and a turn mid-admission (its actor lock only ever TRIED) is skipped behind ONE aggregate `incomplete` fact rather than blocking the loop | absent/empty = no live direct-chat roots are known: a task's peer roster (`ouroboros/peer_roster.py`) lists only the pooled roots from `state/queue_snapshot.json` until the next tick rewrites it |
 | `state/advisory_review.json` | `ouroboros/review_state.py` (lock `locks/advisory_review.lock`) | own pre-ABI-2 spelling `state_version: 3` (+duplicate `schema_version`) — kept; `_schema_version` deliberately avoids this key | bounded on write: runs 10, attempts 50, debts 50; `open_obligations` coalesced | recreated empty; recorded blocking obligations forgiven, commit gate demands fresh review (fail-closed) |
-| `state/scheduled_tasks.json` | `supervisor/queue_schedules.py` (+ `schedule_occurrence.py`: host-owned row `occurrence`/`hold`/`continuation_of`/`delete_requested_at`; durable claim/receipt/dispatch recovery, §5) | `schema_version: 1` — authored at the write seam (`_write_scheduled_tasks`); legacy files gain it on their next write | unresolved occurrences and consumed rows whose tasks remain unsettled are retained; other consumed `once` receipts age out past GC retention on the scheduler tick (`prune_consumed_once_records`); 2 MB WARN = prune broken or live set huge | owner schedules, relationship/money binding, exact holds/releases and Restart control lost; skill-manifest schedules resync automatically |
+| `state/scheduled_tasks.json` | `supervisor/queue_schedules.py` (+ `schedule_occurrence.py`: host-owned row `occurrence`/`hold`/`continuation_of`/`delete_requested_at`; durable claim/receipt/dispatch recovery, §5; + `schedule_notes.py`: a `kind:"notify"` note row is consumed before it is shown) | `schema_version: 1` — authored at the write seam (`_write_scheduled_tasks`); legacy files gain it on their next write | unresolved occurrences and consumed rows whose tasks remain unsettled are retained; other consumed `once` receipts age out past GC retention on the scheduler tick (`prune_consumed_once_records`); 2 MB WARN = prune broken or live set huge | owner schedules, relationship/money binding, exact holds/releases and Restart control lost; skill-manifest schedules resync automatically |
 | `state/terminal_deliveries.json` | `supervisor/terminal_delivery.py` | own `schema_version: 2` | bounded: delivered 512, pending 64, replays 5 | dedupe + owed-outbox lost: possible double- or never-delivery of one buffered terminal answer |
 | `state/cancel_intents.json` | `ouroboros/cancel_intents.py` | own `schema_version: 1` | self-draining (accepted Stop transfers its future-control identity to the existing original result before settled rows leave) | in-flight cancels lost: cancelled-unsettled task revives as pending; forensics survive in supervisor.jsonl |
 | `state/update_letter.json` | `ouroboros/update_letter.py` (`refresh_after_check` — the ONE writer, synchronous inside a FETCHING update check: boot and the Updates panel's check button) | own record shape keyed by the update range (`base_sha`, `target_sha`, channel, target ref) — no `_schema_version` | overwrite per check; the letter is never deleted after the update lands (it outlives its range; `project_letter` reads `applied`/`other` by SHA equality + the recorded `target_in_head` fact) | absent = no letter: the Updates panel and the agent's Runtime context (`official_update_projection`) show the check's status alone; the next FETCHING check rewrites it |
diff --git a/docs/architecture/01-high-level-architecture.md b/docs/architecture/01-high-level-architecture.md
index 2de5e1280..9c2de8aba 100644
--- a/docs/architecture/01-high-level-architecture.md
+++ b/docs/architecture/01-high-level-architecture.md
@@ -28,7 +28,7 @@ server.py (Starlette+uvicorn) ← HTTP + WebSocket on configurable host:port (de
   │   ├── modules/task_checkpoints.js, cancel_presentation.js ← Typed task checkpoints and recorded cancellation-cause text shared by Chat and Logs (§3)
   │   ├── modules/dashboard.js, logs.js, costs.js, files.js ← Dashboard tab host; Logs (backfill plus live-stream duplicate guard); Costs (an open zero is never shown as free); Files browser over `/api/files/*` (§3 Dashboard, Files)
   │   ├── modules/skills.js, marketplace.js, skill_review_card.js, skill_publish_flow.js ← Installed-skills UI; the ClawHub marketplace inside Skills; Skill Review chat cards; publish-dialog detail rows (§3 Skills and Widgets)
-  │   ├── modules/settings_ui.js, settings_catalog.js, settings_controls.js, settings_secrets.js, settings_local_model.js, mcp_settings.js ← Settings page (Accounts → Secrets → Models → Agents); model-catalog refresh with a 25-second bound and a sequence guard; control binders; shared full-secret Show/Hide; the local-model form; MCP cards that keep masked tokens until edited (§3 Settings and onboarding)
+  │   ├── modules/settings_ui.js, settings_catalog.js, settings_controls.js, settings_secrets.js, settings_local_model.js, settings_autostart.js, mcp_settings.js ← Settings page (Accounts → Secrets → Models → Agents); model-catalog refresh with a 25-second bound and a sequence guard; control binders; shared full-secret Show/Hide; the local-model form; the host sign-in toggle; MCP cards that keep masked tokens until edited (§3 Settings and onboarding)
   │   ├── modules/model_roles.js, model_chooser.js ← The Models editor shared by Settings and onboarding; the editable chooser shared with the route editors — catalog arrival never assigns a value (§3 Navigation and shared UI contracts)
   │   ├── modules/subagents_settings.js, subagent_status_primitives.js, reviewer_slots.js, route_editor_primitives.js, harness_accounts.js, harness_login_cards.js, claudexor_status_store.js ← Agents surfaces: the Available-subagents editor; one card's pure status/meta projection; Review lanes rows; neutral route-editor primitives; Agent accounts; host-neutral login cards; the ONE client store over `GET /api/claudexor/status` (`facetReadState`) (§3 Agent accounts, Review lanes and Available subagents)
   │   ├── modules/onboarding_agents_step.js, onboarding_overlay.js, project_create.js, utils.js ← The first-run "Connect your accounts" step; the framed wizard's sandbox policy, kept in one place because it is a security boundary; the New Project dialog; shared escaping/formatting utilities (§2; §3 Project rooms)
@@ -60,6 +60,7 @@ server.py (Starlette+uvicorn) ← HTTP + WebSocket on configurable host:port (de
   │   ├── task_reaper.py       ← Single-owner off-loop reaper for timeout teardown and health-prepared terminal-file/crash jobs; an unconfirmed death keeps the slot reaping with `task_reaper_wedged`; mints no cancel intents (§5)
   │   ├── owner_stop.py        ← Owner graceful stop: the `finalize_then_cancel` policy axis on the SAME durable cancel intent (monotonic hardening), one typed `finalize_now` control (`owner_requested_finalization`), grace bounded by `OWNER_STOP_OUTER_CAP_SEC`; `running_owner_stop_tasks` bypasses only the idle/finalization-grace rails (§5)
   │   ├── schedule_time.py, schedule_occurrence.py ← Cron/timezone parsing; a due occurrence → ≤1 admitted root
+  │   ├── schedule_notes.py    ← A due `kind:"notify"` row: consumed in the tick's one write, then shown verbatim as a signed `reminder` System row; no model, never retried
   │   ├── evolution_lifecycle.py ← Evolution campaign state + transaction lifecycle: campaign file IO, start/pause, cycle outcomes, deterministic worktree cleanup, owner cycle reports, idle dispatch, auto-restart request (§6 Background consciousness and Evolution)
   │   ├── events.py            ← Worker→supervisor event dispatcher with exact attempt/execution/round/call correlation for the active main-LLM row; composes the frozen subagent task text (`_compose_subagent_text`: its `[WRITE SURFACE]` block states only the write-root boundary — actor identity comes from the immutable configured snapshot, startup/wake facts from bootstrap); an event type absent from `EVENT_HANDLERS` is DROPPED into a truncated `unknown_worker_event` row, so `tests/test_worker_event_registry.py` pins the registry by a shape-bounded AST scan — outside its reach the discipline is code review
   │   ├── subagent_task_truth.py ← Delegation-truth enrichment of the subagent `task_done` transport frame (`enrich_task_done_event`; §11.1)
@@ -310,6 +311,7 @@ server.py (Starlette+uvicorn) ← HTTP + WebSocket on configurable host:port (de
       ├── launcher_onboarding.py ← First-run onboarding as the desktop launcher presents it (serves the gateway /onboarding page; §2)
       ├── launcher_server_reaper.py ← POSIX same-install server discovery, pre-signal descendant capture, root-first termination, live identity revalidation; PID-lock-owning launcher only (Runtime topology below)
       ├── launcher_windows_runtime.py ← Windows-only pythonnet/pywebview runtime preparation
+      ├── desktop_autostart.py, windows_autostart.py ← Host sign-in adapter table; packaged-launcher gate, Windows registry, macOS LaunchAgent and Linux systemd/XDG state (Runtime topology below)
       ├── plan_review_facts.py ← Bounded plan-review facts for the learning surfaces: the reflection's plan-review slice and the late-settlement reflection row, with a source pointer and named omissions, never a score (§6 Post-task reflection)
       ├── provider_models.py   ← Model-ID helpers; the `ACTIVE_MODEL_SETTING_KEYS` vs `LEGACY_MODEL_SETTING_KEYS` split keeps Heavy out of startup/Provider Test/new consumers while migration/history still read it
       ├── runtime_mode_policy.py ← Protected-path policy (safety-critical files, frozen contracts, release/managed invariants) shared by the registry, git tools, and gateway guards (§6 Safety and runtime mode)
@@ -419,6 +421,7 @@ server.py (Starlette+uvicorn) ← HTTP + WebSocket on configurable host:port (de
       │   ├── settings_secrets.py ← Explicit single-secret Settings reads, sharing the effective loader and saved MCP identity rules; passive Settings responses stay masked (§3 Settings and onboarding)
       │   ├── settings.py      ← /api/settings + /api/owner/*; `GET /api/reviewer-slots` with row limits (triad 10 / scope 4 / advisory 1 / deep_review 1) and typed `config_error`, never a 500; the deep self-review singleton rides the response (saved, or labeled `synthesized_from`), beside a `config_error` only as a repair placeholder, never an effective row
       │   ├── presence_settings.py ← Owner-facing runtime overrides and working-folder selection for reviewed Presence behavior skills
+      │   ├── desktop_autostart.py ← GET/POST /api/desktop/autostart over `desktop_autostart.py`; OS calls off the event loop, outside the settings write seam, public `owner_audit`
       │   ├── control.py       ← /api/reset, /api/command, /api/git/*, /api/update/*, /api/evolution-data HTTP handlers
       │   ├── update_progress.py ← process-local stages owned by the synchronous update executor; status projection and WS invalidation, never recovery authority
       │   ├── schedules.py     ← Cron schedule HTTP surface
@@ -434,6 +437,7 @@ server.py (Starlette+uvicorn) ← HTTP + WebSocket on configurable host:port (de
       │   ├── claudexor_accounts.py ← Agent accounts HTTP surface: six thin proxies (by handler) over the owned daemon, with zero auth logic or vendor recipes and no browser exposure of its token. GET /api/claudexor/status[?include=models] stamps facet read states; `unified_accounts` follows the engine catalog's `get:account-pools` capability (unreadable catalog retains legacy rendering). POST /api/claudexor/wake and /api/claudexor/login, login-job actions, and /api/claudexor/credential-profiles preserve the opaque `{job, cursor, sequence, deviceCode?}` envelope. Complete routes: §4; Connect/install/retry/custody: §3 Agent accounts
       │   ├── claudexor_quota.py ← Explicit owner quota refresh: POST /api/claudexor/quota/refresh discovers the already-owned daemon, handshakes (60 s control-plane read bound) and delegates exactly once to the engine's quota POST (90 s foreground bound); no lifecycle start, retry, policy or daemon token crosses this boundary; GET /api/claudexor/status stays passive
       │   ├── host_service.py  ← Loopback-only Host Service API (§12)
+      │   ├── host_notify.py   ← POST /notify beside the Host Service: a granted skill's sentence → one signed `skill_notice` System row in the owner's chat (§12)
       │   ├── history.py       ← Shared Chat room/quiz/media/review/terminal projection + cost breakdown factories
       │   ├── history_contracts.py ← Descriptive paged Chat history response, re-exported by contracts.py
       │   ├── schedule_contracts.py ← Typed schedule list/upsert/lifecycle-action responses, re-exported by contracts.py
@@ -518,7 +522,7 @@ server.py (Starlette+uvicorn) ← HTTP + WebSocket on configurable host:port (de
       │   ├── project_journal.py ← journal_write/read, workpad_read/write, `update_focus`, journal_tail_digest (over-limit rejected); explicit foreign project reads honoured for roots, foreign writes refused; owns `mirror_tree_coordination_to_journal`
       │   ├── presence.py      ← configure_presence, initiate_presence, typed completion/cancel
       │   ├── task_tree.py     ← tree_note/tree_read (storage SSOT: task_tree_ledger.py)
-      │   ├── followup.py      ← The agent's two schedule tools over `state/scheduled_tasks.json`. `manage_schedules` lists every row with its lifecycle word and applies one audited disable/delete/restore to future dispatch (root-only to change, any task may list, Presence neither). `schedule_followup` writes one deferred follow-up: exactly one trigger (`once` ISO or 5-field cron+tz), cap 2 pending; keeps the SOURCE address (`project_id`, origin `chat_id`) and resource intent by value, with host `continuation_of`; a one-shot is consumed on the typed tombstoned-Project refusal, other refusals wait on the row
+      │   ├── followup.py      ← The agent's two schedule tools over `state/scheduled_tasks.json`. `manage_schedules` lists every row with its lifecycle word and applies one audited disable/delete/restore to future dispatch (root-only to change, any task may list, Presence neither). `schedule_followup` writes one deferred follow-up: exactly one trigger (`once` ISO or 5-field cron+tz), cap 2 pending; `notify=true` leaves a note instead (`kind:"notify"`, shown verbatim, no model); keeps the SOURCE address (`project_id`, origin `chat_id`) and resource intent by value, with host `continuation_of`; a one-shot is consumed on the typed tombstoned-Project refusal, other refusals wait on the row
       │   ├── join_ledger.py   ← Child-result absorption: validates lineage + exact hashes; dispositions integrated/irrelevant/deferred; `CHILD_RESULT_STALE`; keeps peek_task/discard_child_result
       │   ├── delegate.py      ← Delegation facade verbs `delegate_start` (with `retry_of`), `delegate_wait`, `delegate_cancel`, `delegate_answer`, `delegate_message`; the host pre-start rides the same wrapper and the shared `subagent_runtime.exact_start` (§6 Delegated subagents)
       │   ├── delegate_integration.py ← Delegated-patch integration: `_mutation_authority`, `_provision_snapshot`, retry-binding validation, `_capture_terminal_patch`; the skill-payload cluster (`_payload_mutation_authority`, `_write_payload_patch_artifacts`; reserved paths refuse the WHOLE apply as `blocked_reserved_paths`) and `integrate_payload_patch` (CAS, index-free git apply in NO-REPOSITORY mode under `GIT_CEILING_DIRECTORIES`, typed `INTEGRATE_APPLY_NO_OP`; a successful apply QUEUES the extension reconcile request via `request_extension_reconcile`) (§6 Delegated subagents)
@@ -582,6 +586,8 @@ System self-modification, external workspace, and genesis remain distinct task c
 
 ### Runtime topology
 
+Host sign-in startup is owner opt-in in Behavior (§3), with OS registration as the sole authority. `desktop_autostart.py` selects the platform adapter only for a packaged host whose launcher exports `OUROBOROS_APP_VERSION` ≥ 7.2.0, its bundle and presentation; source runs and older builds are unavailable. Windows retains HKCU `Run\Ouroboros`, the `StartupApproved` switch and other-copy detection. macOS writes `~/Library/LaunchAgents/com.ouroboros.agent.plist` with the app executable plus `--launch-intent automatic`, `RunAtLoad` and no `KeepAlive`; `launchctl print-disabled gui/<uid>` observes the OS override, and enabling clears that override without starting a second instance. DMG/AppTranslocation paths require moving to Applications. Linux native packages enable/disable the shipped `ouroboros.service`; the deb/rpm owns that unit and a managed update never replaces it, so an installed unit without automatic intent (older packages) stays unavailable until the package is updated, though an existing registration still turns off. AppImage/tar builds use `$XDG_CONFIG_HOME/autostart/ouroboros.desktop` (default `~/.config`), preserving the stable `$APPIMAGE` path and its extract-and-run mode, and observing `Hidden=true` or `X-GNOME-Autostart-enabled=false`. Switching copies removes the alternative registration; no `--now`, linger or restart policy is added. States are `unavailable`, `off`, `on`, `other_copy`, `disabled_by_os`; failed OS reads remain errors. The existing launcher Panic gate and saved-pause recovery retain authority. `context.py` captures `runtime_env.autostart` and `keep_running_after_close=false` at task start, with an unavailable reason when needed; these are host facts independent of the sending client. Window close still exits the desktop runtime.
+
 `launcher.py` owns PID lock, bundle bootstrap, server process, presentation, restart and cleanup; desktop launchers live outside the managed repo, Android source hosts keep an immutable seed. `server.py` is the self-editable inner runtime. Native packages' opt-in systemd unit uses `--launch-intent automatic` to preserve Panic; desktop launches resume. No systemd restart policy: launcher owns restarts and the crash fuse. `KillMode=control-group` includes its shared daemon ([limitations](../../packaging/systemd/README.md)).
 
 Spawn custody: POSIX children start in a new session/process group; Windows creates the server suspended, assigns a kill-on-close Job, then resumes — failure to establish Job custody refuses to run. The launcher Job permits explicit breakaway; only the shared daemon requests it, while ordinary generation children remain covered by Job close. Lazy worker and direct-server starts use the same platform helper. An old packaged or external Job that cannot confirm breakaway retains the earlier working spawn with a disclosed survive-close limitation; desktop managed source updates cannot replace their immutable launcher. The launcher records `data/state/server_process.json` (PID, pgid, server/repo paths, requested and actual ports, argv, creation time) and re-proves identity before cleanup. Forced tree/group cleanup excludes the shared daemon subtree; a graceful stop signals only the server PID (§9); sweeps keep scope.
@@ -672,7 +678,7 @@ Bundled resources use the CLI / Headless Boundary lookup order rather than assum
 │   │   ├── evolution_checkpoints.jsonl ← append-only per-cycle checkpoints
 │   │   ├── post_task_evolution_request.json ← worker-written one-shot promotion signal; consumed + deleted by the supervisor idle tick; dropped while evolution_owner_stopped
 │   │   ├── post_task_evolution_counter.json ← per-drive every_n counter
-│   │   ├── scheduled_tasks.json   ← cron (5-field + tz) and one-shot {type:"once", run_at} schedules; consumed one-shot receipts age out past the unified GC retention
+│   │   ├── scheduled_tasks.json   ← cron (5-field + tz) and one-shot {type:"once", run_at} schedules, each a task row or a `kind:"notify"` note; consumed one-shot receipts age out past the unified GC retention
 │   │   ├── claudexor_rotation_provisioning.json ← receipt of the last rotation-reconcile settings POST
 │   │   ├── subagent_last_delegation.json ← bounded dated helper observations owned by subagent_history.py, with the compatible latest receipt; never live health or dispatch authority
 │   │   ├── update_letter.json     ← the last update letter (key = base/target/channel/ref, state, text, `last_good`); kept after apply and projected against the live HEAD (update_letter.py)
diff --git a/docs/architecture/02-startup-onboarding-flow.md b/docs/architecture/02-startup-onboarding-flow.md
index f025767aa..ef84f23fd 100644
--- a/docs/architecture/02-startup-onboarding-flow.md
+++ b/docs/architecture/02-startup-onboarding-flow.md
@@ -2,7 +2,7 @@
 
 Startup orders launcher preconditions, live-gateway onboarding and atomic completion of settings, next-boot mode and install-time presets; premature `settings.json` creation invalidates fresh-install latches, while partial completion strands an install. Direct `server.py` entry opts into `launcher_bootstrap.automatic_launch_allowed` with `OUROBOROS_LAUNCH_INTENT=automatic`: Panic exits 0 before startup, marker intact; owner/default intent permits startup. Container policy: [DEPLOYMENT](../DEPLOYMENT.md#container-restart-policy-and-panic).
 
-The launcher prepares the platform UI runtime (or runs the Linux browser-mode probe), acquires the single-instance lock, verifies Git, and validates and bootstraps the embedded managed-repo seed — server preconditions, so they precede it. It then removes only identity-proven stale server state and ports, starts the lifecycle thread, and waits on `/api/health` at the authoritative port from `data/state/server_port`; only then is first-run onboarding presented against that live server, before the pywebview shell or browser presentation opens. The server starts the gateway first and the supervisor/worker pool only when provider configuration is structurally sufficient.
+The launcher prepares the platform UI runtime (or runs the Linux browser-mode probe), acquires the single-instance lock, verifies Git, and validates and bootstraps the embedded managed-repo seed — server preconditions, so they precede it. It then removes only identity-proven stale server state and ports, starts the lifecycle thread, and waits on `/api/health` at the authoritative port from `data/state/server_port`; only then is first-run onboarding presented against that live server, before the pywebview shell or browser presentation opens. The server starts the gateway first and the supervisor/worker pool only when provider configuration is structurally sufficient, and then only after the event bus and the extension reload: the first scheduler tick can show an overdue note, and an event-bus subscriber (Telegram) that attaches after that publish never sees it.
 
 Onboarding runs after the gateway because connecting an agent subscription is a live `/api/*` conversation, not a form field — and a gateway without a supervisor is exactly what the readiness predicate produces, so no second server, mode or onboarding state machine exists. `ouroboros/launcher_onboarding.py` owns the presentation; its setup bridge receives the same `launcher._open_external_url` callable as the main window, with no settings-write authority. When completion reports a boot-pinned value changed, the launcher recycles the managed server rather than counting the exit as a crash. Neither launcher nor server boot normalization may CREATE `settings.json`: the install-time latches below are gated on its absence.
 
diff --git a/docs/architecture/03-web-ui-pages-and-buttons.md b/docs/architecture/03-web-ui-pages-and-buttons.md
index f3d991d23..fdf8eb467 100644
--- a/docs/architecture/03-web-ui-pages-and-buttons.md
+++ b/docs/architecture/03-web-ui-pages-and-buttons.md
@@ -51,7 +51,7 @@ confirmed lifecycle facts (a question carrying a positive wait; a SETTLED
 finished — or the authored summary, which with the turn's ordinary reply share
 one key per task), lineage comes from the delegation facts frames carry (the
 terminal log frame has none), importance rides the existing `system_type`
-discriminator (`proactive_message`, `main_notice`) plus optional questions, and
+discriminator (`proactive_message`, `main_notice`; a `reminder` or `skill_notice` row is titled by its `source` author, body below the signature line) plus optional questions, and
 ordinary Main replies are a separate off-by-default toggle. Where the
 Notification API is missing or denied, delivery degrades to the in-app toast
 plus one tone; with the optional desktop bridge the shell also requests one
@@ -279,7 +279,7 @@ Logs merges live WebSocket log frames with bounded REST backfill from the events
 
 `project_admission_hold` carries host label/reason/detail, not a phase; root census/detail and queue-only task rows share it. Mounted unfinished children read `/api/tasks?queue_only=1` on chat refresh (one in-flight read per instance; disposal ignores late replies). Missing/unreadable queues never prove recovery; a held child leaving it opens one detail episode, retired on a current nonterminal answer; ordinary child reviews never poll detail or enter root counts. Root/child holds update the header on reply and share static amber cards (no typing, escaped cause); unknown dispatch says `Waiting: previous run unconfirmed`. Same-ID recovery clears it; parked phases, Stop and terminal outrank it. Main keeps the `Paused · …` prefix, Activity the cause/controls.
 
-Activity joins queue entries with the same refresh's `/api/state` census. Queue identity keeps title/runtime/budget controls; warm sleep says sleeping, unknown stays unconfirmed; census-only turns show kind/phase/elapsed time and shared controls. Partial census cannot prove idleness. Independent sections show the consciousness alarm (enabled/status/autonomy, next/last wake/outcome, rolling-24h allowance and running tasks) and schedules; a failed read keeps the other sections. Authoritative controls: cascade cancellation, consciousness start/stop and schedule enable/disable/delete/restore. Standing schedules stay listed (`waiting: <reason>` for held occurrences, `deletion pending` too); fired one-shots and suppressed skill rows share a `History & suppressed` disclosure whose open state survives refresh. Consumed rows cannot Enable; pending deletion may offer explicit Cancel deletion, which exact hold release keeps; Restore re-evaluates suppressed skills, never enabling them. Every schedule button, Delete included, sends action/reason to the agent tool's audited `POST /api/schedules/{id}/action`, not a stale record rewrite. One reply helper distinguishes unchanged, changed with lost audit outcome, and changed with admitted work still running or unobservable. An unavailable queue never renders empty.
+Activity joins queue entries with the same refresh's `/api/state` census. Queue identity keeps title/runtime/budget controls; warm sleep says sleeping, unknown stays unconfirmed; census-only turns show kind/phase/elapsed time and shared controls. Partial census cannot prove idleness. Independent sections show the consciousness alarm (enabled/status/autonomy, next/last wake/outcome, rolling-24h allowance and running tasks) and schedules; a failed read keeps the other sections. Authoritative controls: cascade cancellation, consciousness start/stop and schedule enable/disable/delete/restore. Standing schedules stay listed (`waiting: <reason>` for held occurrences, `deletion pending` too, any stored `last error`; a `kind:"notify"` note is named by its own words); fired one-shots and suppressed skill rows share a `History & suppressed` disclosure whose open state survives refresh. Consumed rows cannot Enable; pending deletion may offer explicit Cancel deletion, which exact hold release keeps; Restore re-evaluates suppressed skills, never enabling them. Every schedule button, Delete included, sends action/reason to the agent tool's audited `POST /api/schedules/{id}/action`, not a stale record rewrite. One reply helper distinguishes unchanged, changed with lost audit outcome, and changed with admitted work still running or unobservable. An unavailable queue never renders empty.
 
 Costs is a projection of the physical-attempt ledger distinguishing confirmed, reserved, unresolved upper-bound, unknown/unmetered usage, open rows and finality; unavailable data renders as unavailable, not `$0`. Breakdowns by model, key, model category and task category are views over the same ledger. Total budget can hot-apply; the per-task value is a hard cost cap over the whole root tree of the next task, not an own-task soft warning (§7 Default settings), and raising a cap does not resume work that already finalized or paused.
 
@@ -295,7 +295,9 @@ The synchronous lock-owning apply executor publishes process-local stage observa
 
 ### Settings and onboarding
 
-Settings has Accounts, Secrets, Models, Agents, Behavior, Appearance, Advanced and About tabs — a sequence from connections to runtime detail. Accounts: managed subscriptions and their shared service banner, API providers, custom compatible endpoints, local runtime entry points, and the optional non-loopback network gate. Secrets: known provider/integration secrets, skill-requested keys and owner-defined custom keys, masked until explicit Show (DESIGN "Controls and editable choices"). Models: compact source/model/account role rows, ordered fallbacks, context assertions and effort lanes. Agents: task actors and review lanes, with delegation permissions, per-root and depth limits and subagent path roots; their accounts are managed in Accounts. Behavior: context, safety-supervisor coverage, task acceptance, self-evolution, prompt-cache posture. Appearance: the client-local theme choice described above, never a runtime-settings value. Advanced: process, timeout, local-model, integration, source-control and cleanup controls (worker count is process capacity, so it lives here). About reports application/runtime identity. Keys, defaults and per-key semantics are the §7 Default settings table, not this chapter. Models, Available subagents and Review lanes share ONE grouped source select owned by `web/modules/route_editor_primitives.js` (`routeChoiceGroups`, `configuredApiProviders`): the owner picks a source and the editor composes the stored id, so the provider prefixes (`provider::model`, `claudexor::source=model`, `harness=model`) are serialization only, never owner input.
+Settings has Accounts, Secrets, Models, Agents, Behavior, Appearance, Advanced and About tabs — a sequence from connections to runtime detail. Accounts: managed subscriptions and their shared service banner, API providers, custom compatible endpoints, local runtime entry points, and the optional non-loopback network gate. Secrets: known provider/integration secrets, skill-requested keys and owner-defined custom keys, masked until explicit Show (DESIGN "Controls and editable choices"). Models: compact source/model/account role rows, ordered fallbacks, context assertions and effort lanes. Agents: task actors and review lanes, with delegation permissions, per-root and depth limits and subagent path roots; their accounts are managed in Accounts. Behavior: context, safety-supervisor coverage, task acceptance, self-evolution, prompt-cache posture, and Startup & background. Appearance: client-local theme and notifications, never host lifecycle controls. Advanced: process, timeout, local-model, integration, source-control and cleanup controls (worker count is process capacity, so it lives here). About reports application/runtime identity. Keys, defaults and per-key semantics are the §7 Default settings table, not this chapter. Models, Available subagents and Review lanes share ONE grouped source select owned by `web/modules/route_editor_primitives.js` (`routeChoiceGroups`, `configuredApiProviders`): the owner picks a source and the editor composes the stored id, so the provider prefixes (`provider::model`, `claudexor::source=model`, `harness=model`) are serialization only, never owner input.
+
+Startup & background offers one immediate host sign-in checkbox (`settings_autostart.js` → `GET/POST /api/desktop/autostart`), outside the Settings draft and Save button. Its label explicitly names the host computer for remote browsers and phone clients. The block refreshes from OS truth whenever Settings opens; unavailable hosts retain a disabled control with the reason (including an older app build or unstable macOS bundle), other-copy and OS-disabled registrations have explanatory notes, a failed read shows its error, and failed writes re-read the actual state. The section reserves the independent keep-running-after-close control without exposing it yet; closing the desktop window still exits (§1 Runtime topology; DESIGN §9).
 
 `settings_catalog.js` owns model-catalog reads and the Accounts subscription: a changed confirmed account or recovery from a failed read refreshes discovery; identical settled status stays quiet, and `settings.js` arms/disposes the subscription with the page. Catalog updates preserve drafts. Per-button ownership releases busy state independently of data freshness: background reads cannot strand a manual button.
 
diff --git a/docs/architecture/04-server-api-endpoints.md b/docs/architecture/04-server-api-endpoints.md
index 7c56a00a8..8b01709c1 100644
--- a/docs/architecture/04-server-api-endpoints.md
+++ b/docs/architecture/04-server-api-endpoints.md
@@ -78,6 +78,8 @@ Every `/api/files/*` operation resolves its requested path and refuses the opera
 | POST | `/api/owner/capability-ack` | `gateway.settings.api_acknowledge_capability` |
 | GET | `/api/ui/preferences` | `gateway.ui_preferences.api_ui_preferences_get` |
 | POST | `/api/ui/preferences` | `gateway.ui_preferences.api_ui_preferences_post` |
+| GET | `/api/desktop/autostart` | `gateway.desktop_autostart.api_desktop_autostart_get`: host OS `{state}`, plus `reason` when unavailable |
+| POST | `/api/desktop/autostart` | `gateway.desktop_autostart.api_desktop_autostart_post`: exactly `{enabled: boolean}`, returns observed `{state}`; 400 invalid body, 409 unavailable, 500 OS failure; public `owner_audit`, no settings mirror |
 | GET | `/api/model-catalog` | `gateway.models.api_model_catalog` |
 | POST | `/api/openai-compatible/models` | `gateway.models.api_openai_compatible_models` |
 | POST | `/api/providers/test` | `gateway.models.api_provider_test` |
@@ -139,6 +141,7 @@ Every `/api/files/*` operation resolves its requested path and refuses the opera
 | POST | `127.0.0.1:${OUROBOROS_HOST_SERVICE_PORT:-8767}/presence/delivery` | `gateway.host_service._api_presence_delivery` |
 | GET | `127.0.0.1:${OUROBOROS_HOST_SERVICE_PORT:-8767}/presence/work/{work_ref}` | `gateway.host_service._api_presence_work` |
 | POST | `127.0.0.1:${OUROBOROS_HOST_SERVICE_PORT:-8767}/ui/ws-message` | `gateway.host_service._api_ws_message` |
+| POST | `127.0.0.1:${OUROBOROS_HOST_SERVICE_PORT:-8767}/notify` | `gateway.host_notify._api_notify` (`notify_owner` grant: one signed `skill_notice` System row in the owner's chat; no model turn) |
 | WS | `127.0.0.1:${OUROBOROS_HOST_SERVICE_PORT:-8767}/events` | `gateway.host_service._ws_events` |
 
 Rationale: `server.py` owns process startup/lifespan/static mounting, while `gateway/*` owns browser-facing HTTP/WS contracts; this keeps UI and runtime coupling explicit and testable.
diff --git a/docs/architecture/05-supervisor-loop.md b/docs/architecture/05-supervisor-loop.md
index b71a04cd1..adafe7bb9 100644
--- a/docs/architecture/05-supervisor-loop.md
+++ b/docs/architecture/05-supervisor-loop.md
@@ -20,7 +20,7 @@ Terminal rows stay terminal; custody cancels accepted/sealed roots' descendants
 
 `supervisor/queue_schedules.py` alone writes `state/scheduled_tasks.json`. All mutations (tick, skill resync, gateway, followup cap/write, `manage_schedules`) enter `schedule_transaction`: Q then sidecar lock, reentrant per resolved table path. Strict `load_schedule_store` treats only absence as empty; non-regular files, invalid JSON or non-object rows raise `ScheduleStoreUnreadable`. Unreadable tables refuse mutation and read as unknown.
 
-`schedule_occurrence.py` admits one root per due occurrence: claim, typed `hold` (no failed root/counter/message), off-lock preparation via `workers.REPO_DIR`, recheck, enqueue, frozen receipt, snapshot. Under the Q/table transaction a claimed row with absent result and no dispatch mark re-prepares the SAME token/id after restart; enqueue alone cannot execute, restore/dispatch need the receipt. No refusal witnesses. Unreadable/foreign results or receipt-less admissions stay unknown. Edits/disable govern unstarted work. Exact-root receipt reads let deletion drop unaccepted work; owed or unknown work returns `delete_deferred`. Accepted bytes stay frozen. Cron keeps one overdue occurrence then advances; Runtime shows original `due_at`/`claimed_at`. Older admissions never consume later firing points; same-instant text edits cannot re-arm once. Custody same-ID retries survive row retirement/successors; snapshot replay stays fenced.
+`schedule_occurrence.py` admits one root per due occurrence: claim, typed `hold` (no failed root/counter/message), off-lock preparation via `workers.REPO_DIR`, recheck, enqueue, frozen receipt, snapshot. Under the Q/table transaction a claimed row with absent result and no dispatch mark re-prepares the SAME token/id after restart; enqueue alone cannot execute, restore/dispatch need the receipt. No refusal witnesses. Unreadable/foreign results or receipt-less admissions stay unknown. Edits/disable govern unstarted work. Exact-root receipt reads let deletion drop unaccepted work; owed or unknown work returns `delete_deferred`. Accepted bytes stay frozen. Cron keeps one overdue occurrence then advances; Runtime shows original `due_at`/`claimed_at`. Older admissions never consume later firing points; same-instant text edits cannot re-arm once. Custody same-ID retries survive row retirement/successors; snapshot replay stays fenced. A `kind:"notify"` row is a note, never an occurrence or task: the tick consumes it in its one table write (cron skips past any gap), then `schedule_notes.py` shows the mind's words as one signed `reminder` System row; an unconfirmed show is recorded as the row's `last_error` (Activity and `manage_schedules` show it), never retried.
 
 `followup_policy.py` binds explicit related/independent relationships. Unrecorded rows keep published launch and own-root money (relation unknown; source-less owner rows: independent) until an origin Stop/manual Restart. Host origin and `continuation_of` provenance/cap exemption establish neither relationship nor billing authority. Creation resolves money via `usage_admission` and origin results off-lock; normalized templates cannot forge host facts. Live/frozen/canonical related work keeps original group cap/source/revision and deadline. The ledger checks root/group/global; root cap changes widen neither group nor permission. Own-root initial billing publishes atomically with the receipt.
 
diff --git a/docs/architecture/11-frozen-contracts-v1.md b/docs/architecture/11-frozen-contracts-v1.md
index d67d4bb1d..cd66aa6e3 100644
--- a/docs/architecture/11-frozen-contracts-v1.md
+++ b/docs/architecture/11-frozen-contracts-v1.md
@@ -35,7 +35,7 @@ ABI promise: frozen shapes/helpers, extension rules, exclusions and retirements
 | Skill preflight statuses — `preflight_failed` is fresh-only; a stale failure surfaces as `preflight_failed_stale`; absence means the caller could not know | `ouroboros/skill_review_status.py` | `tests/test_skill_preflight_repair.py`, `web/tests/skill_preflight_repair.test.js` |
 | `chat_id_policy` — the SSOT for human-visible vs synthetic chat ids across message bus, history, memory, and consolidation (§12) | `ouroboros/contracts/chat_id_policy.py` | `tests/test_chat_id_policy.py` |
 | `task_contract` — normalization + `effective_acceptance_claims(task, closed_plan_wave)`, a pure read-time binder where ingress wins over a closed plan wave (acceptance reads fresh claims without mutating the live contract); an open wave binds nothing and is disclosed as a non-binding exhibit instead; pacing interprets the budget profile via typed `task_pacing.CostCeiling`; Presence promotion and follow-ups copy the ceiling by value (§12); additive `input_sources` selects `shared` (default) or `declared`, with unsupported execution shapes refused at admission (§6 Selected first-input sources) | `ouroboros/contracts/task_contract.py` | `tests/test_contracts.py` |
-| `PluginAPI` 2.0 — the full 16-method extension surface, negotiated against the manifest (major strict, minor minimum, closed-set capabilities, typed educational refusals) BEFORE plugin import or out-of-process cataloging; an absent manifest field means legacy `1.3` by construction, `ExtensionRegistrationError`, `FORBIDDEN_SKILL_SETTINGS`, `VALID_EXTENSION_PERMISSIONS`, `VALID_EXTENSION_ROUTE_METHODS` (route methods mirrored against server dispatch by `test_extension_route_methods_contract_matches_server_dispatch`); `skill_job_dir(job_id)` creates `jobs/<sanitized>-<hash>/{assets,output,tmp}`; host-mediated permissions (`companion_process`, `supervised_task`, `subscribe_event`, `inject_chat`, `presence`) require review/owner grants; the `ExecutionMode` capability matrix is the SSOT for what a per-call child can proxy | `ouroboros/contracts/plugin_api.py` | `tests/test_contracts.py`, `tests/test_extension_loader.py` |
+| `PluginAPI` 2.0 — the full 16-method extension surface, negotiated against the manifest (major strict, minor minimum, closed-set capabilities, typed educational refusals) BEFORE plugin import or out-of-process cataloging; an absent manifest field means legacy `1.3` by construction, `ExtensionRegistrationError`, `FORBIDDEN_SKILL_SETTINGS`, `VALID_EXTENSION_PERMISSIONS`, `VALID_EXTENSION_ROUTE_METHODS` (route methods mirrored against server dispatch by `test_extension_route_methods_contract_matches_server_dispatch`); `skill_job_dir(job_id)` creates `jobs/<sanitized>-<hash>/{assets,output,tmp}`; host-mediated permissions (`companion_process`, `supervised_task`, `subscribe_event`, `inject_chat`, `presence`, `notify_owner`) require review/owner grants; the `ExecutionMode` capability matrix is the SSOT for what a per-call child can proxy | `ouroboros/contracts/plugin_api.py` | `tests/test_contracts.py`, `tests/test_extension_loader.py` |
 | `SkillManifest` — unified frontmatter (instruction/script/extension), reviewed `scheduled_tasks` cron metadata, bounded canonical `conflicts`, `presence:` block parsed by `presence_profile.py`; `parse_skill_manifest_text()` tolerates missing optional fields and `validate()` returns warnings without raising | `ouroboros/contracts/skill_manifest.py` | `tests/test_contracts.py` |
 | `schema_versions` — opt-in `_schema_version` stamping (`with_schema_version`/`read_schema_version`); wired by extension `health.json`, the projects registry/bindings, and presence bindings | `ouroboros/contracts/schema_versions.py` | `tests/test_contracts.py` |
 
diff --git a/docs/architecture/12-host-service-companions-and-chat-ids.md b/docs/architecture/12-host-service-companions-and-chat-ids.md
index e4dd26505..6817a2f54 100644
--- a/docs/architecture/12-host-service-companions-and-chat-ids.md
+++ b/docs/architecture/12-host-service-companions-and-chat-ids.md
@@ -6,7 +6,7 @@ Chat uploads have one storage owner, `gateway.files`, for Host-confined paths an
 
 Telegram document mirroring resolves the captured `file_ref` and streams an owned file handle through its multipart client (legacy inline bytes still accepted). Its outgoing 50 MiB boundary is separate from the integration's inbound 10 MiB download limit. Oversized files stay saved in the application: a ready, already-running owner-authenticated Mini App can be opened through its entry button; otherwise the message says it cannot mirror the file and directs the owner to the app. Delivery never starts a tunnel or publishes a new public or token-bearing artifact URL, and the notice never claims the bytes were uploaded to Telegram.
 
-The Host Service (`ouroboros/gateway/host_service.py`, `127.0.0.1:${OUROBOROS_HOST_SERVICE_PORT:-8767}`) authenticates every request with opaque `x-skill-token`, bound to payload hash, executable review, enablement and grants. Tokens contain no secrets, stale on payload edit and refuse stringification (`skill_token.py`). The frozen routes are `/identity`, `/tools/schemas`, `/chat/allocate-internal`, `/chat/inject`, `/chat/operations/{operation_ref}`, `/chat/cancel`, `/chat/decision`, `/presence/turn`, `/presence/work/{work_ref}`, `/presence/delivery`, `/ui/ws-message`, WS `/events`; permissions govern access. Transport review covers identity/attribution, bounded polling, panic cleanup, token confinement and exfiltration. An owner-bound reviewed transport can control; external slash commands bind a separate positive-identity owner slot (`supervisor/state.py`), so unidentified transports cannot bind and web identity cannot lock out the remote owner. `wait_for_response` is A2A-only; only legacy unnamed operations subscribe chat-wide.
+The Host Service (`ouroboros/gateway/host_service.py`, `127.0.0.1:${OUROBOROS_HOST_SERVICE_PORT:-8767}`) authenticates every request with opaque `x-skill-token`, bound to payload hash, executable review, enablement and grants. Tokens contain no secrets, stale on payload edit and refuse stringification (`skill_token.py`). The frozen routes are `/identity`, `/tools/schemas`, `/chat/allocate-internal`, `/chat/inject`, `/chat/operations/{operation_ref}`, `/chat/cancel`, `/chat/decision`, `/presence/turn`, `/presence/work/{work_ref}`, `/presence/delivery`, `/ui/ws-message`, `/notify`, WS `/events`; permissions govern access. `POST /notify` (`host_notify.py`, grant `notify_owner`, `notify_version` on `/identity`) writes one sentence (≤400 chars) as a `skill_notice` System row in the owner's chat signed `Notice · <skill>`, waking no model; 503 = row not confirmed. Transport review covers identity/attribution, bounded polling, panic cleanup, token confinement and exfiltration. An owner-bound reviewed transport can control; external slash commands bind a separate positive-identity owner slot (`supervisor/state.py`), so unidentified transports cannot bind and web identity cannot lock out the remote owner. `wait_for_response` is A2A-only; only legacy unnamed operations subscribe chat-wide.
 
 `/chat/decision` and Web share `task_decision.answer_decision`. Review-operation
 waits reach their exact live controller after author completion via canonical
diff --git a/docs/development/10-platform-abstraction-rule.md b/docs/development/10-platform-abstraction-rule.md
index 47a0faaad..9b3a91c5e 100644
--- a/docs/development/10-platform-abstraction-rule.md
+++ b/docs/development/10-platform-abstraction-rule.md
@@ -1,10 +1,10 @@
 # Platform Abstraction Rule
 
-This chapter owns the platform seam: which modules, calls and signals must go through `platform_layer.py`, the one documented function-local exception, and the shared atomic state-file helpers whose byte-exactness keeps a manifest or a hashed receipt identical across operating systems. It exists because the alternative is platform-conditional code scattered through the runtime, where an AST guard cannot see it.
+This chapter owns the platform seam: which modules, calls and signals must go through `platform_layer.py`, the one documented function-local exception, and the shared atomic state-file helpers whose byte-exactness keeps a manifest or a hashed receipt identical across operating systems. It exists because the alternative is platform-conditional code scattered where an AST guard cannot see it.
 
-Platform-specific code goes through `ouroboros/platform_layer.py`: platform modules (`fcntl`, `resource`, `grp`, `pwd`, `msvcrt`, `winreg`, `ctypes.windll`), direct `os.kill`/`os.killpg`/`os.setsid`/`os.getpgid`, `signal.SIGKILL`/`signal.SIGTERM`, and platform-conditional subprocess flags (`subprocess_new_group_kwargs()` / `subprocess_hidden_kwargs()`). Use `pathlib.Path` for filesystem paths, never string concatenation with hardcoded separators. One documented exception: a function-local import of a platform module under an explicit `sys.platform` guard is allowed outside the layer (the guarded `resource` import in `ouroboros/extension_process_runner.py`) — the AST guard inspects only top-level imports, so review must see function-local ones.
+Platform-specific code goes through `ouroboros/platform_layer.py`: platform modules (`fcntl`, `resource`, `grp`, `pwd`, `msvcrt`, `winreg`, `ctypes.windll`), direct `os.kill`/`os.killpg`/`os.setsid`/`os.getpgid`, `signal.SIGKILL`/`signal.SIGTERM`, and platform-conditional subprocess flags (`subprocess_new_group_kwargs()` / `subprocess_hidden_kwargs()`). Use `pathlib.Path` for paths, never string concatenation with hardcoded separators. One documented exception: a function-local import of a platform module under an explicit `sys.platform` guard is allowed outside the layer (the guarded `resource` import in `ouroboros/extension_process_runner.py`, the guarded `winreg` accessor in `ouroboros/windows_autostart.py`) — the AST guard inspects only top-level imports, so review must see function-local ones.
 
-Enforcement: `tests/test_platform_guard.py` scans `ouroboros/`, `supervisor/` and `server.py` for top-level platform imports, the four `os` calls and the two signals; `launcher.py` and subprocess flag patterns are deliberately not scanned — code review and the `cross_platform` checklist item cover them — and the CI matrix runs tests on Ubuntu, Windows and macOS. New platform behavior: add the cross-platform wrapper to `platform_layer.py`, use it in callers, and add platform-conditional tests when behavior differs across OSes.
+Enforcement: `tests/test_platform_guard.py` scans `ouroboros/`, `supervisor/` and `server.py` for top-level platform imports, the four `os` calls and the two signals; `launcher.py` and subprocess flag patterns are deliberately not scanned — code review and the `cross_platform` checklist item cover them — and CI tests run on Ubuntu, Windows and macOS. New platform behavior: add the wrapper to `platform_layer.py`, use it in callers, and add platform-conditional tests where behavior differs.
 
 ### Shared state-file helpers
 
diff --git a/docs/inventories/DATA_LAYOUT_INVENTORY.md b/docs/inventories/DATA_LAYOUT_INVENTORY.md
index db149e50e..93c949d53 100644
--- a/docs/inventories/DATA_LAYOUT_INVENTORY.md
+++ b/docs/inventories/DATA_LAYOUT_INVENTORY.md
@@ -2,7 +2,7 @@
 
 Machine extraction of the `docs/ARCHITECTURE.md` "Data layout (`~/Ouroboros/`)" tree — the durable-file orientation carrier (this tree's counterpart of the reference PERSISTENCE_OWNERS derivation checklist) — regenerated by `python scripts/regenerate_inventories.py`. Do not edit. Every entry is probed against reality: repo entries must exist as tracked paths; data-plane entries must appear as a literal in the runtime sources that construct them. A durable file renamed or removed in code while its tree row survives = red (`tests/test_generated_inventories.py`).
 
-Source: `docs/architecture/01-high-level-architecture.md`, physical LF lines 635-728; UTF-8 SHA-256 `bbb3069ee8863824349e40cd6e213243b9cd1ddadeaf395560d57ee25072e3f4`.
+Source: `docs/architecture/01-high-level-architecture.md`, physical LF lines 641-734; UTF-8 SHA-256 `50632a1512c5e7ba8ee334216d3fe41b16eb5898dd413e93c6ce3ba977aef214`.
 
 - entries: **83** (code-ref: 76, repo-dir: 6, repo-path: 1)
 
diff --git a/docs/inventories/FROZEN_CONTRACTS_INVENTORY.md b/docs/inventories/FROZEN_CONTRACTS_INVENTORY.md
index 0e6db22ad..452d5b113 100644
--- a/docs/inventories/FROZEN_CONTRACTS_INVENTORY.md
+++ b/docs/inventories/FROZEN_CONTRACTS_INVENTORY.md
@@ -2,7 +2,7 @@
 
 Machine extraction of `docs/ARCHITECTURE.md` §11.1 (the frozen-ABI SSOT), regenerated by `python scripts/regenerate_inventories.py`. Do not edit — edit the owning chapter named in the Source line and regenerate; `tests/test_generated_inventories.py` pins byte-identity and the resolution invariants (a §11.1 row whose owner or anchor file disappeared from the tree = red).
 
-Source: `docs/architecture/11-frozen-contracts-v1.md`, physical LF lines 7-41; UTF-8 SHA-256 `c1fe4c725f4e79c4f9f207ca175462dbce2d73336616e4410e20054b72c06d71`.
+Source: `docs/architecture/11-frozen-contracts-v1.md`, physical LF lines 7-41; UTF-8 SHA-256 `79fd5d85f22196e0175dbb2ea2aafdd55b8af69c067e322593cc850af6cef143`.
 
 - table rows: **30**
 - browser-envelope prose owners: 
diff --git a/ouroboros/consolidator.py b/ouroboros/consolidator.py
index eae68e065..7c96745bf 100644
--- a/ouroboros/consolidator.py
+++ b/ouroboros/consolidator.py
@@ -1203,7 +1203,7 @@ def _format_entries_for_block(
             author = "Ouroboros"
         elif dir_raw == "system":
             direction_prefix = "[system] "
-            author = "Ouroboros"
+            author = "System"  # host-written, as dialogue_evidence attributes it; never the mind's voice
         else:
             direction_prefix = ""
             author = dialogue_author(e)
diff --git a/ouroboros/context.py b/ouroboros/context.py
index 9fb6bf07b..6f52dd2a5 100644
--- a/ouroboros/context.py
+++ b/ouroboros/context.py
@@ -12,6 +12,7 @@ from types import SimpleNamespace
 from typing import Any, Dict, List, Optional, Tuple
 
 from ouroboros.config import get_context_mode
+from ouroboros.desktop_autostart import runtime_facts as desktop_runtime_facts
 from ouroboros.context_budget import (
     LARGE_CONTEXT_SECTION_CHARS,
     MAX_RECENT_CHAT_TAIL,
@@ -358,14 +359,12 @@ def build_runtime_section(env: Any, task: Dict[str, Any], *, ctx: Any = None, sc
             "allowed_resources": task.get("allowed_resources"),
             "context": task.get("context"),
         },
-        # Server-process presentation posture (launcher-exported; absent = a
-        # web/headless serving process). This is the PROCESS's shell, NOT the
-        # surface the owner's current message came from — that per-message fact
-        # is `owner_client` below. (The former `is_desktop` flag read
-        # OUROBOROS_DESKTOP_MODE, which no producer ever set — retired.)
+        # Host shell/lifecycle, not the sender's per-message `owner_client`.
+        # Launcher-exported presentation is absent on web/headless processes.
         "runtime_env": {
             "presentation": os.environ.get("OUROBOROS_PRESENTATION", "").strip() or "web",
             "platform": sys.platform,
+            **desktop_runtime_facts(),
         },
     }
     runtime_data.update(_task_authority_projection(env, task))
diff --git a/ouroboros/contracts/skill_manifest.py b/ouroboros/contracts/skill_manifest.py
index 8a5efdf8d..eb5cf0466 100644
--- a/ouroboros/contracts/skill_manifest.py
+++ b/ouroboros/contracts/skill_manifest.py
@@ -42,6 +42,10 @@ VALID_SKILL_PERMISSIONS = frozenset(
         "subscribe_event",
         "inject_chat",
         "presence",
+        # Owner notices through the Host Service (`POST /notify`): one bounded
+        # sentence shown in the owner's chat as a System row signed with the
+        # skill's name; never a model turn. Narrower than inject_chat, granted separately.
+        "notify_owner",
     }
 )
 _EVENT_TOPIC_RE = re.compile(r"^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$")
diff --git a/ouroboros/desktop_autostart.py b/ouroboros/desktop_autostart.py
new file mode 100644
index 000000000..93ef4e0c3
--- /dev/null
+++ b/ouroboros/desktop_autostart.py
@@ -0,0 +1,220 @@
+"""Host sign-in registration, read from the OS rather than settings.json.
+
+Only packaged launchers with automatic-intent support may register. Adapters
+change the NEXT sign-in, never start/stop the current runtime or release a saved
+pause. launchd has no KeepAlive; systemd uses the shipped, non-restarting unit.
+Linux selects one registration: native packages use systemd, portable builds XDG.
+The native unit is the one the deb/rpm installed, which a managed update never
+replaces: an older package's unit starts the launcher with owner intent, which
+lifts a Panic stop, so it is never enabled (an existing registration still turns off).
+"""
+from __future__ import annotations
+
+import configparser
+import logging
+import os
+from pathlib import Path
+import plistlib
+import re
+import shlex
+import subprocess
+import sys
+from xml.parsers.expat import ExpatError
+
+from ouroboros import windows_autostart
+from ouroboros.launcher_bootstrap import appimage_extracts_and_runs
+from ouroboros.platform_layer import BUNDLE_DIR_ENV, is_unstable_macos_app_path
+from ouroboros.utils import write_bytes_atomic, write_text_atomic
+
+LABEL = "com.ouroboros.agent"
+UNIT = "ouroboros.service"
+NATIVE_LAUNCHER = Path("/opt/ouroboros/Ouroboros")
+NATIVE_UNIT = Path("/usr/lib/systemd/user/ouroboros.service")
+AUTOMATIC_ARGS = ["--launch-intent", "automatic"]
+UPDATE_PACKAGE = "Update the Ouroboros deb/rpm package to use sign-in startup."
+
+
+def launcher_target() -> tuple[Path | None, str]:
+    """The launcher's immutable build facts, not the managed repo's version."""
+    presentation = os.environ.get("OUROBOROS_PRESENTATION")
+    allowed = ("desktop_window", "browser_fallback") if sys.platform == "linux" else ("desktop_window",)
+    bundle_text = os.environ.get(BUNDLE_DIR_ENV, "")
+    if (sys.platform not in ADAPTERS or presentation not in allowed or not bundle_text
+            or os.environ.get("OUROBOROS_MANAGED_BY_LAUNCHER") != "1"):
+        return None, "Available only when the host runs the packaged desktop app."
+    bundle = Path(bundle_text)
+    if sys.platform == "win32":
+        exe = windows_autostart.launcher_path()
+    elif sys.platform == "darwin":
+        app = next((p for p in bundle.parents if p.suffix == ".app"), None)
+        if app and is_unstable_macos_app_path(app):
+            return None, "Move Ouroboros to Applications before enabling sign-in startup."
+        exe = app / "Contents/MacOS/Ouroboros" if app else None
+    else:
+        exe = bundle.parent / "Ouroboros" if bundle.name == "_internal" else None
+        appimage = os.environ.get("APPIMAGE", "")
+        if appimage:
+            exe = Path(appimage)
+        elif os.environ.get("APPDIR"):
+            return None, "Open Ouroboros from its stable AppImage file first."
+    if exe is None or not exe.is_absolute() or not exe.is_file():
+        return None, "Available only when the host runs the packaged desktop app."
+    # The release triple decides; a pre-release suffix (`7.6.0-rc.1`) does not make a build old.
+    release = re.match(r"v?(\d+)\.(\d+)\.(\d+)", os.environ.get("OUROBOROS_APP_VERSION", "").strip())
+    if release is None:
+        return None, "This app build's version could not be confirmed; sign-in startup needs 7.2.0 or later."
+    if tuple(map(int, release.groups())) < (7, 2, 0):
+        return None, "Sign-in startup needs a newer app build (7.2.0 or later)."
+    return exe, ""
+
+
+def _run(argv: list[str], *, codes: tuple[int, ...] = (0,)) -> str:
+    try:
+        result = subprocess.run(argv, capture_output=True, text=True, timeout=5)
+    except subprocess.TimeoutExpired as exc:
+        raise OSError(f"{argv[0]} did not answer within 5 seconds") from exc
+    if result.returncode not in codes:
+        raise OSError(result.stderr.strip() or f"{argv[0]} exited {result.returncode}")
+    return result.stdout.strip()
+
+
+def _windows(_exe: Path, enabled: bool | None) -> str:
+    return windows_autostart.autostart_state() if enabled is None else windows_autostart.set_autostart(enabled)
+
+
+def _macos(exe: Path, enabled: bool | None) -> str:
+    path = Path.home() / "Library/LaunchAgents" / f"{LABEL}.plist"
+    if enabled is False:
+        path.unlink(missing_ok=True)
+    elif enabled is True:
+        write_bytes_atomic(path, plistlib.dumps({
+            "Label": LABEL, "ProgramArguments": [str(exe), *AUTOMATIC_ARGS], "RunAtLoad": True,
+        }))
+        # Clear a launchctl override only on an explicit owner enable. Do not
+        # bootstrap: RunAtLoad would launch another instance in this session.
+        _run(["launchctl", "enable", f"gui/{os.getuid()}/{LABEL}"])
+    try:
+        entry = plistlib.loads(path.read_bytes())
+    except FileNotFoundError:
+        return "off"
+    except (plistlib.InvalidFileException, ValueError, ExpatError):
+        return "other_copy"
+    if (not isinstance(entry, dict) or entry.get("Label") != LABEL
+            or entry.get("ProgramArguments") != [str(exe), *AUTOMATIC_ARGS]
+            or entry.get("RunAtLoad") is not True or entry.get("KeepAlive", False) is not False):
+        return "other_copy"
+    # Current macOS prints `=> disabled`/`=> enabled`; older releases printed `=> true`/`=> false`.
+    overrides = _run(["launchctl", "print-disabled", f"gui/{os.getuid()}"])
+    return "disabled_by_os" if re.search(rf'"{re.escape(LABEL)}"\s*=>\s*(?:disabled|true)\b', overrides) else "on"
+
+
+def _desktop_path() -> Path:
+    config_home = Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config")
+    return config_home / "autostart/ouroboros.desktop"
+
+
+def _desktop_command(exe: Path) -> str:
+    # Desktop Entry's two escaping layers: argv quoting, then string escaping.
+    quoted = "".join("\\" + c if c in '\\"`$' else c for c in str(exe)).replace("%", "%%")
+    quoted = quoted.replace("\\", "\\\\").replace("\n", "\\n").replace("\r", "\\r").replace("\t", "\\t")
+    # A FUSE-less AppImage (README: APPIMAGE_EXTRACT_AND_RUN=1) must stay so in a fresh sign-in
+    # session. The pinned type-2 runtime reads only the FIRST long option, then strips its own.
+    appimage = os.environ.get("APPIMAGE")
+    mode = " --appimage-extract-and-run" if appimage and Path(appimage) == exe and appimage_extracts_and_runs() else ""
+    return f'"{quoted}"{mode} --launch-intent automatic'
+
+
+def _desktop_state(path: Path, exe: Path) -> str:
+    """This copy's XDG entry. An entry turned off starts nothing, whoever wrote it: XDG Hidden=true,
+    or X-GNOME-Autostart-enabled=false from the Startup Applications of GNOME-family sessions."""
+    parser = configparser.ConfigParser(interpolation=None)
+    try:
+        parser.read_string(path.read_text(encoding="utf-8"))
+        entry = parser["Desktop Entry"]
+    except FileNotFoundError:
+        return "off"
+    except (configparser.Error, KeyError, UnicodeError):
+        return "other_copy"
+    off = (entry.get("Hidden", "false").lower() == "true"
+           or entry.get("X-GNOME-Autostart-enabled", "true").lower() == "false")
+    if entry.get("Exec") != _desktop_command(exe) or entry.get("Type") != "Application":
+        return "off" if off else "other_copy"
+    return "disabled_by_os" if off else "on"
+
+
+def _systemd_state() -> str:
+    value = _run(["systemctl", "--user", "is-enabled", UNIT], codes=(0, 1, 4))
+    states = {"enabled": "on", "enabled-runtime": "on", "disabled": "off",
+              "masked": "disabled_by_os", "masked-runtime": "disabled_by_os", "not-found": "unavailable"}
+    if value not in states:
+        raise OSError(f"Could not determine systemd sign-in startup: {value or 'no answer'}")
+    return states[value]
+
+
+def _unit_starts_automatic() -> bool:
+    """Whether the installed unit's ExecStart passes automatic intent to the launcher."""
+    try:
+        text = NATIVE_UNIT.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return False
+    commands = [value.strip() for key, sep, value in (line.partition("=") for line in text.splitlines())
+                if sep and key.strip() == "ExecStart"]
+    try:
+        argv = shlex.split(commands[-1]) if commands else []
+    except ValueError:
+        return False
+    return any(argv[i:i + 2] == AUTOMATIC_ARGS for i in range(1, len(argv) - 1))
+
+
+def _linux(exe: Path, enabled: bool | None) -> str:
+    path = _desktop_path()
+    native = exe == NATIVE_LAUNCHER
+    unit_state = _systemd_state() if native or NATIVE_UNIT.is_file() else "off"
+    if native and (enabled or (enabled is None and unit_state != "on")) and not _unit_starts_automatic():
+        return "unavailable"
+    if enabled is not None:
+        if native:
+            path.unlink(missing_ok=True)
+            _run(["systemctl", "--user", "enable" if enabled else "disable", UNIT])
+            return _systemd_state()
+        if unit_state == "on":
+            _run(["systemctl", "--user", "disable", UNIT])
+            if _systemd_state() == "on":
+                raise OSError("Disable the host's Ouroboros user service before switching to this copy.")
+        if enabled:
+            write_text_atomic(path, "[Desktop Entry]\nType=Application\nName=Ouroboros\n"
+                              f"Exec={_desktop_command(exe)}\nTerminal=false\n")
+        else:
+            path.unlink(missing_ok=True)
+        unit_state = "off"
+    if native:  # an entry that starts nothing (absent or turned off) leaves the unit's state standing
+        if unit_state == "on" and not _unit_starts_automatic():
+            return "on"  # an older unit enabled by hand is shown as it is, so the owner can still turn it off
+        return unit_state if _desktop_state(path, exe) in ("off", "disabled_by_os") else "other_copy"
+    return "other_copy" if unit_state == "on" else _desktop_state(path, exe)
+
+
+ADAPTERS = {"win32": _windows, "darwin": _macos, "linux": _linux}
+
+
+def autostart_status(enabled: bool | None = None) -> dict[str, str]:
+    """Read OS state; a boolean additionally requests an owner registration edit."""
+    exe, reason = launcher_target()
+    if exe is None:
+        return {"state": "unavailable", "reason": reason}
+    state = ADAPTERS[sys.platform](exe, enabled)
+    if state != "unavailable":
+        return {"state": state}
+    # Natively the deb/rpm owns the sign-in unit: a missing or older one is fixed by updating it.
+    return {"state": state, "reason": UPDATE_PACKAGE if exe == NATIVE_LAUNCHER else "The packaged sign-in service is unavailable."}
+
+
+def runtime_facts() -> dict:
+    """One task-start observation; OS read failures do not break model context."""
+    try:
+        status = autostart_status()
+    except OSError as exc:
+        logging.getLogger(__name__).warning("Autostart state unavailable: %s", exc)
+        status = {"state": "unavailable", "reason": str(exc)}
+    return {"autostart": status["state"], "keep_running_after_close": False,
+            **({"autostart_reason": status["reason"]} if status.get("reason") else {})}
diff --git a/ouroboros/domains.toml b/ouroboros/domains.toml
index 0625a8643..03d2546f0 100644
--- a/ouroboros/domains.toml
+++ b/ouroboros/domains.toml
@@ -70,6 +70,8 @@ D20 = "Presence"
 "ouroboros/owner_continue.py" = "D01"
 "ouroboros/model_sleep.py" = "D01"
 "ouroboros/launcher_windows_runtime.py" = "D18"
+"ouroboros/desktop_autostart.py" = "D18"
+"ouroboros/windows_autostart.py" = "D18"
 "ouroboros/__init__.py" = "D18"
 "ouroboros/_outcome_receipts.py" = "D01"
 "ouroboros/_outcome_tool_errors.py" = "D01"
@@ -208,6 +210,7 @@ D20 = "Presence"
 "ouroboros/gateway/history_paging.py" = "D11"
 "ouroboros/gateway/history_contracts.py" = "D11"
 "ouroboros/gateway/host_service.py" = "D11"
+"ouroboros/gateway/host_notify.py" = "D11"
 "ouroboros/gateway/logs.py" = "D11"
 "ouroboros/gateway/marketplace.py" = "D11"
 "ouroboros/gateway/mcp.py" = "D11"
@@ -216,6 +219,7 @@ D20 = "Presence"
 "ouroboros/gateway/onboarding_host.py" = "D11"
 "ouroboros/gateway/owner_settings.py" = "D11"
 "ouroboros/gateway/presence_settings.py" = "D11"
+"ouroboros/gateway/desktop_autostart.py" = "D11"
 "ouroboros/gateway/projects.py" = "D11"
 "ouroboros/gateway/router.py" = "D11"
 "ouroboros/gateway/schema.py" = "D11"
@@ -639,6 +643,7 @@ D20 = "Presence"
 "supervisor/schedule_lifecycle.py" = "D08"
 "supervisor/followup_policy.py" = "D08"
 "supervisor/schedule_occurrence.py" = "D08"
+"supervisor/schedule_notes.py" = "D08"
 "supervisor/queue_transitions.py" = "D08"
 "supervisor/schedule_time.py" = "D08"
 "supervisor/state.py" = "D08"
diff --git a/ouroboros/gateway/contracts.py b/ouroboros/gateway/contracts.py
index 4acde2a66..8b76f36d5 100644
--- a/ouroboros/gateway/contracts.py
+++ b/ouroboros/gateway/contracts.py
@@ -257,6 +257,9 @@ class ChatOutbound(TypedDict):
     handoff_id: NotRequired[str]  # immutable origin/destination receipt identity
     terminal_time: NotRequired[Dict[str, Any]]  # host-owned occurrence, separate from publication ts
     completion_answer: NotRequired[str]  # a Project root's model-authored final answer, mirrored into Main (DESIGN)
+    set_at: NotRequired[str]  # a `reminder` row's provenance, live frame only (its text carries the signature): when written
+    scheduled_for: NotRequired[str]  # the due point it was written for
+    delivered_at: NotRequired[str]  # when the host showed it (later than due after downtime)
     chat_id: NotRequired[int]  # present on some transport re-broadcast paths
     # Server-stamped when chat_id is a reserved Project thread: Main never
     # adopts it, even before the browser has learned the project.
@@ -910,6 +913,11 @@ class UiPreferencesResponse(TypedDict):
     welcome: dict[str, str]  # install-wide empty-Main UI copy: mode default|hidden|custom and plain text
 
 
+class DesktopAutostartResponse(TypedDict):  # GET/POST /api/desktop/autostart: the host's sign-in registration as its OS reports it
+    state: Literal["unavailable", "off", "on", "other_copy", "disabled_by_os"]
+    reason: NotRequired[str]  # present only when unavailable
+
+
 class GitLogResponse(TypedDict):
     commits: list[Dict[str, Any]]
     # Tag rows: {tag, date, sha (peeled commit), message} — the mirror said ``list[str]`` while ``list_versions``
@@ -1540,7 +1548,7 @@ __all__ = [
     "SettingsPostCommitFailureResponse",
     "SkillGrantResponse",
     "SkillDeleteResponse",
-    "UiPreferencesResponse",
+    "UiPreferencesResponse", "DesktopAutostartResponse",
     "GitLogResponse",
     "EvolutionDataResponse",
     "ScheduledTasksResponse",
diff --git a/ouroboros/gateway/desktop_autostart.py b/ouroboros/gateway/desktop_autostart.py
new file mode 100644
index 000000000..a4a38195e
--- /dev/null
+++ b/ouroboros/gateway/desktop_autostart.py
@@ -0,0 +1,42 @@
+"""Desktop autostart endpoints: read and set the host's sign-in registration.
+
+Transport only; the entry, its states and its target live in
+``ouroboros.desktop_autostart``. OS registration is not settings.json, so these
+routes stay outside the owner settings write seam; a change is still audited.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from starlette.requests import Request
+from starlette.responses import JSONResponse
+
+from ouroboros import desktop_autostart
+from ouroboros.gateway._helpers import json_error, request_json_or, run_sync_to_completion
+from ouroboros.gateway.owner_settings import owner_audit
+
+log = logging.getLogger(__name__)
+
+
+async def api_desktop_autostart_get(request: Request) -> JSONResponse:
+    try:
+        return JSONResponse(await run_sync_to_completion(desktop_autostart.autostart_status))
+    except OSError as exc:
+        log.warning("Host sign-in entry could not be read: %s", exc)
+        return json_error("Host startup entry could not be read", 500)
+
+
+async def api_desktop_autostart_post(request: Request) -> JSONResponse:
+    body = await request_json_or(request, None)
+    if not isinstance(body, dict) or set(body) != {"enabled"} or not isinstance(body["enabled"], bool):
+        return json_error('request body must be {"enabled": true} or {"enabled": false}', 400)
+    try:
+        status = await run_sync_to_completion(desktop_autostart.autostart_status, body["enabled"])
+    except OSError as exc:
+        log.warning("Host sign-in entry could not be changed: %s", exc)
+        return json_error("Host startup entry could not be changed", 500)
+    if status["state"] == "unavailable":
+        return json_error(status["reason"], 409)
+    owner_audit(request, "desktop_autostart", {"enabled": body["enabled"], "state": status["state"]})
+    return JSONResponse(status)
diff --git a/ouroboros/gateway/endpoint_index.py b/ouroboros/gateway/endpoint_index.py
index 7af72b11f..f838eb725 100644
--- a/ouroboros/gateway/endpoint_index.py
+++ b/ouroboros/gateway/endpoint_index.py
@@ -16,6 +16,8 @@ HTTP_ENDPOINTS: tuple[str, ...] = (
     "POST /api/settings/secret",
     "GET /api/ui/preferences",
     "POST /api/ui/preferences",
+    "GET /api/desktop/autostart",
+    "POST /api/desktop/autostart",
     "POST /api/owner/runtime-mode",
     "POST /api/owner/auto-grant",
     "POST /api/owner/context-mode",
diff --git a/ouroboros/gateway/host_notify.py b/ouroboros/gateway/host_notify.py
new file mode 100644
index 000000000..d5c02bd97
--- /dev/null
+++ b/ouroboros/gateway/host_notify.py
@@ -0,0 +1,88 @@
+"""``POST /notify``: a reviewed skill tells the owner one thing, now.
+
+A skill holding the owner's ``notify_owner`` grant hands the host one short plain
+sentence; the host puts it in the owner's chat as one System row
+(``system_type="skill_notice"``) that opens with the signature line
+``Notice · <skill>``, through the same ``send_with_budget`` seam every host row
+uses. Like any System row it reaches every UI surface, the Telegram mirror and
+the next turn's context (``📋 [skill_notice]``); no model turn starts. A disabled
+skill, a stale review or a revoked grant is refused before anything is written
+(``_authenticated``). Timing stays with the skill: a calendar keeps its own clock
+and posts at the moment it chose. Beside ``host_service.py`` on the same loopback
+trust boundary; ``create_host_service_app`` mounts it.
+"""
+
+from __future__ import annotations
+
+import logging
+import pathlib
+from typing import Any, Dict
+
+from starlette.requests import Request
+from starlette.responses import JSONResponse
+
+from ouroboros.gateway._helpers import run_sync_to_completion
+from ouroboros.gateway.host_service import HostServiceAuthError, HostServiceContext, _authenticated, _json_error
+from ouroboros.utils import utc_now_iso
+
+log = logging.getLogger(__name__)
+
+NOTIFY_TEXT_MAX_CHARS = 400
+
+
+class _ChatUnavailable(RuntimeError):
+    """No chat writer serves this data root (no running supervisor): nothing was written."""
+
+
+def _show_notice(data_dir: pathlib.Path, skill_name: str, text: str) -> Dict[str, Any]:
+    from supervisor import message_bus
+    from supervisor.schedule_notes import owner_chat_id
+
+    root = message_bus.DATA_DIR
+    if root is None or pathlib.Path(root).resolve() != pathlib.Path(data_dir).resolve():
+        raise _ChatUnavailable("no chat writer serves this data root")
+    if message_bus.try_get_bridge() is None:
+        raise _ChatUnavailable("the chat bridge is not running")
+    chat_id, ts = owner_chat_id(data_dir), utc_now_iso()
+    message_bus.send_with_budget(
+        chat_id, f"Notice · {skill_name}\n{text}", ts=ts, role="system", system_type="skill_notice",
+        require_write=True, ensure_record_boundary=True, progress_meta={"source": skill_name},
+    )
+    return {"ts": ts, "chat_id": chat_id}
+
+
+def _not_confirmed(error: str) -> JSONResponse:
+    return JSONResponse({"ok": False, "status": "not_confirmed", "error": error}, status_code=503)
+
+
+async def _api_notify(request: Request) -> JSONResponse:
+    """``{"text": ...}`` → ``200 {ok, ts, chat_id}`` once the owner's chat row is written.
+
+    ``400`` a body that is not one plain sentence, ``403`` no live grant, ``429``
+    the per-skill lane, ``503`` the row is not confirmed: check the chat before
+    sending it again (an immediate notice is not server-idempotent)."""
+    ctx: HostServiceContext = request.app.state.host_service_context
+    try:
+        skill_name, _ = await _authenticated(ctx, request.headers.get("x-skill-token", ""), "notify_owner")
+    except HostServiceAuthError as exc:
+        return _json_error(str(exc), 403)
+    if not ctx.rate_limiter.allow(f"{skill_name}:notify"):
+        return _json_error("rate limit exceeded", 429)
+    try:
+        payload = await request.json()
+    except Exception:
+        return _json_error("invalid json", 400)
+    text = payload.get("text") if isinstance(payload, dict) else None
+    if not isinstance(text, str) or not text.strip():
+        return _json_error("text is required: one plain sentence for the owner", 400)
+    text = text.strip()
+    if len(text) > NOTIFY_TEXT_MAX_CHARS:
+        return _json_error(f"text must be at most {NOTIFY_TEXT_MAX_CHARS} characters", 400)
+    try:
+        shown = await run_sync_to_completion(_show_notice, ctx.data_dir, skill_name, text)
+    except _ChatUnavailable as exc:
+        return _not_confirmed(f"the owner's chat is not available ({exc}); nothing was written")
+    except Exception:
+        log.warning("Notice from skill %s was not confirmed in the owner's chat", skill_name, exc_info=True)
+        return _not_confirmed("write not confirmed; check the owner's chat before sending it again")
+    return JSONResponse({"ok": True, **shown})
diff --git a/ouroboros/gateway/host_service.py b/ouroboros/gateway/host_service.py
index 972ba1f9e..f51abe26b 100644
--- a/ouroboros/gateway/host_service.py
+++ b/ouroboros/gateway/host_service.py
@@ -45,6 +45,9 @@ _json_error = lambda message, status=500: JSONResponse({"ok": False, "error": me
 DEFAULT_HOST_SERVICE_HOST = "127.0.0.1"
 DEFAULT_HOST_SERVICE_PORT = 8767
 AUTH_TOKEN_FILENAME = "auth_token.json"
+# ``/identity`` advertises the owner-notice route (``POST /notify``, host_notify.py)
+# so a skill degrades on an older host without a side-effecting probe.
+NOTIFY_VERSION = 1
 
 # The out-of-process WS progress relay (``POST /ui/ws-message``) is the one
 # token-bucket lane: a 60-message burst reserve that refills one message per
@@ -430,7 +433,8 @@ async def _api_identity(request: Request) -> JSONResponse:
         return _json_error(str(exc), 403)
     name, description = await asyncio.to_thread(_identity_facts, ctx)
     return JSONResponse({"ok": True, "name": name, "description": description,
-                         "presence_delivery_version": DELIVERY_VERSION})
+                         "presence_delivery_version": DELIVERY_VERSION,
+                         "notify_version": NOTIFY_VERSION})
 
 
 async def _api_tool_schemas(request: Request) -> JSONResponse:
@@ -1397,6 +1401,9 @@ def create_host_service_app(
     ws_broadcaster_getter: Optional[Callable[[], Callable[[dict], None]]] = None,
     presence_runner: Optional[Callable[..., Any]] = None,
 ) -> Starlette:
+    # host_notify imports this module's helpers; mounted here, imported lazily.
+    from ouroboros.gateway.host_notify import _api_notify
+
     app = Starlette(
         routes=[
             Route("/identity", _api_identity, methods=["GET"]),
@@ -1410,6 +1417,7 @@ def create_host_service_app(
             Route("/presence/delivery", _api_presence_delivery, methods=["POST"]),
             Route("/presence/work/{work_ref}", _api_presence_work, methods=["GET"]),
             Route("/ui/ws-message", _api_ws_message, methods=["POST"]),
+            Route("/notify", _api_notify, methods=["POST"]),
             WebSocketRoute("/events", _ws_events),
         ]
     )
diff --git a/ouroboros/gateway/owner_settings.py b/ouroboros/gateway/owner_settings.py
index 8fc8f22c6..ce278f617 100644
--- a/ouroboros/gateway/owner_settings.py
+++ b/ouroboros/gateway/owner_settings.py
@@ -183,7 +183,8 @@ def owner_write_guard(endpoint: Callable) -> Callable:
     return _guarded
 
 
-def _owner_audit(request: Request, action: str, payload: Dict[str, Any]) -> None:
+def owner_audit(request: Request, action: str, payload: Dict[str, Any]) -> None:
+    """Record an owner action, including OS controls outside settings.json."""
     try:
         drive_root = request_drive_root(request)
     except Exception:
@@ -208,6 +209,9 @@ def _owner_audit(request: Request, action: str, payload: Dict[str, Any]) -> None
         log.debug("Failed to write owner API audit event", exc_info=True)
 
 
+_owner_audit = owner_audit  # Existing settings writers retain their import surface.
+
+
 def settings_document_digest() -> str:
     """What the settings document looked like at a given instant.
 
@@ -380,6 +384,7 @@ __all__ = [
     "settings_document_mutation",
     "_CONTEXT_MODE_KEYS",
     "_owner_audit",
+    "owner_audit",
     "_owner_read_settings_raw",
     "_owner_update_settings",
     "_owner_write_settings",
diff --git a/ouroboros/gateway/router.py b/ouroboros/gateway/router.py
index 74de2df04..a199f60be 100644
--- a/ouroboros/gateway/router.py
+++ b/ouroboros/gateway/router.py
@@ -125,10 +125,8 @@ def collect_routes(
         api_tasks_create,
         api_tasks_list,
     )
-    from ouroboros.gateway.ui_preferences import (
-        api_ui_preferences_get,
-        api_ui_preferences_post,
-    )
+    from ouroboros.gateway.ui_preferences import api_ui_preferences_get, api_ui_preferences_post
+    from ouroboros.gateway.desktop_autostart import api_desktop_autostart_get, api_desktop_autostart_post
     from ouroboros.gateway.onboarding_host import onboarding_page
     from ouroboros.gateway.settings import (
         api_acknowledge_capability,
@@ -220,6 +218,8 @@ def collect_routes(
         Route("/api/settings/secret", endpoint=api_settings_secret, methods=["POST"]),
         Route("/api/ui/preferences", endpoint=api_ui_preferences_get, methods=["GET"]),
         Route("/api/ui/preferences", endpoint=api_ui_preferences_post, methods=["POST"]),
+        Route("/api/desktop/autostart", endpoint=api_desktop_autostart_get, methods=["GET"]),
+        Route("/api/desktop/autostart", endpoint=api_desktop_autostart_post, methods=["POST"]),
         Route("/api/owner/runtime-mode", endpoint=api_owner_runtime_mode, methods=["POST"]),
         Route("/api/owner/auto-grant", endpoint=api_owner_auto_grant, methods=["POST"]),
         Route("/api/owner/context-mode", endpoint=api_owner_context_mode, methods=["POST"]),
diff --git a/ouroboros/launcher_bootstrap.py b/ouroboros/launcher_bootstrap.py
index c8c222c61..fe928f839 100644
--- a/ouroboros/launcher_bootstrap.py
+++ b/ouroboros/launcher_bootstrap.py
@@ -1115,6 +1115,17 @@ def update_external_host(hook: pathlib.Path | None, python: str, log: Any, abort
     return {"status": "failed"}
 
 
+def appimage_extracts_and_runs() -> bool:
+    """Whether this AppImage process runs from an extracted tree instead of a FUSE mount."""
+    if "APPIMAGE_EXTRACT_AND_RUN" in os.environ:
+        return True
+    # The type-2 runtime removes the explicit --appimage-extract-and-run
+    # argument before execing AppRun. Its APPDIR is then a regular directory;
+    # a normal FUSE-backed APPDIR is a mount point.
+    appdir = os.environ.get("APPDIR", "").strip()
+    return bool(appdir) and not os.path.ismount(appdir)
+
+
 def parse_launch_options(argv):
     """Parse presentation/seed inputs while tolerating ordinary platform launch arguments."""
     parser = argparse.ArgumentParser(description=__doc__)
diff --git a/ouroboros/packaged_cli.py b/ouroboros/packaged_cli.py
index 071706a2f..7b18dc84b 100644
--- a/ouroboros/packaged_cli.py
+++ b/ouroboros/packaged_cli.py
@@ -28,7 +28,9 @@ from typing import Iterable, Sequence
 sys.dont_write_bytecode = True
 os.environ.setdefault("PYTHONDONTWRITEBYTECODE", "1")
 
-from ouroboros.launcher_bootstrap import BootstrapContext, bootstrap_repo, check_git, embedded_python_env
+from ouroboros.launcher_bootstrap import (
+    BootstrapContext, appimage_extracts_and_runs, bootstrap_repo, check_git, embedded_python_env,
+)
 from ouroboros.platform_layer import (
     BUNDLE_DIR_ENV,
     IS_MACOS,
@@ -435,14 +437,7 @@ def _linux_appimage_relaunch_env(app: pathlib.Path) -> dict[str, str] | None:
     appimage = os.environ.get("APPIMAGE", "").strip()
     if not appimage or pathlib.Path(appimage) != app:
         return None
-    appdir = os.environ.get("APPDIR", "").strip()
-    extract_and_run = "APPIMAGE_EXTRACT_AND_RUN" in os.environ
-    if not extract_and_run and appdir:
-        # The type-2 runtime removes the explicit --appimage-extract-and-run
-        # argument before execing AppRun. Its APPDIR is then a regular directory;
-        # a normal FUSE-backed APPDIR is a mount point.
-        extract_and_run = not os.path.ismount(appdir)
-    if not extract_and_run:
+    if not appimage_extracts_and_runs():
         return None
 
     env = os.environ.copy()
diff --git a/ouroboros/skill_loader.py b/ouroboros/skill_loader.py
index deb49f97e..01112222a 100644
--- a/ouroboros/skill_loader.py
+++ b/ouroboros/skill_loader.py
@@ -702,6 +702,7 @@ def requested_core_setting_keys(env_keys: List[str]) -> List[str]:
 _GRANTABLE_SKILL_PERMISSIONS = frozenset({
     "inject_chat",
     "presence",
+    "notify_owner",
     "subscribe_event:chat.outbound",
     "subscribe_event:chat.typing",
     "subscribe_event:chat.photo",
@@ -716,10 +717,9 @@ def requested_skill_permissions(
     """Return manifest-requested privileged permissions needing owner grants."""
     requested: List[str] = []
     permission_set = {str(item or "").strip() for item in (permissions or [])}
-    if "inject_chat" in permission_set:
-        requested.append("inject_chat")
-    if "presence" in permission_set:
-        requested.append("presence")
+    for permission in ("inject_chat", "presence", "notify_owner"):
+        if permission in permission_set:
+            requested.append(permission)
     if "subscribe_event" in permission_set:
         for raw_topic in subscribe_events or []:
             topic = str(raw_topic or "").strip()
diff --git a/ouroboros/tools/control_runtime.py b/ouroboros/tools/control_runtime.py
index 0ecb25454..cc20e2d82 100644
--- a/ouroboros/tools/control_runtime.py
+++ b/ouroboros/tools/control_runtime.py
@@ -225,15 +225,17 @@ def _update_scratchpad(ctx: ToolContext, content: str) -> str:
     return f"OK: scratchpad block appended ({len(content)} chars, ts={block.get('ts', '?')[:16]})"
 
 
-def _main_notice_refusal(ctx: ToolContext, chat_id: object) -> str:
-    """Why this caller may not address Main, or "" when it may.
+def owner_contact_refusal(ctx: ToolContext, chat_id: object) -> str:
+    """Why this caller may not speak to the owner directly, or "" when it may.
 
-    Main is the owner's own conversation. A delegated child answers its parent,
-    and a Presence or agent-to-agent turn speaks for an external conversation;
-    none of them gains a Main voice through this argument.
+    A delegated child answers its parent, and a Presence or agent-to-agent turn
+    speaks for an external conversation; none of them reaches the owner through a
+    Main notice or a note scheduled for later. Shared by both doors; the Main
+    notice adds its room check, a note does not (one started by consciousness is
+    a legitimate contact, BIBLE P0).
     """
-    from ouroboros.contracts.chat_id_policy import HIDDEN_CHAT_ID, is_a2a_chat_id
-    from ouroboros.dialogue_provenance import presence_caller_binding, run_origin
+    from ouroboros.contracts.chat_id_policy import is_a2a_chat_id
+    from ouroboros.dialogue_provenance import presence_caller_binding
 
     for attr in ("task_metadata", "task_contract"):
         data = getattr(ctx, attr, None)
@@ -245,10 +247,25 @@ def _main_notice_refusal(ctx: ToolContext, chat_id: object) -> str:
             return "a delegated task reports to its parent (final result, tree_note or escalate), which decides what reaches the owner"
     if presence_caller_binding(ctx) is not None:
         return "a Presence turn speaks for its external conversation, not in the owner's main chat"
-    if str(chat_id) == str(HIDDEN_CHAT_ID):
-        return "a hidden/headless conversation is not an owner-visible root room"
     if is_a2a_chat_id(chat_id):
         return "an agent-to-agent conversation has no main-chat voice"
+    return ""
+
+
+def _main_notice_refusal(ctx: ToolContext, chat_id: object) -> str:
+    """Why this caller may not address Main, or "" when it may.
+
+    Main is the owner's own conversation: beyond ``owner_contact_refusal``, only
+    an owner-visible root room (a Project or an owner-started root) gains a Main
+    voice through this argument.
+    """
+    from ouroboros.contracts.chat_id_policy import HIDDEN_CHAT_ID
+    from ouroboros.dialogue_provenance import run_origin
+
+    if refusal := owner_contact_refusal(ctx, chat_id):
+        return refusal
+    if str(chat_id) == str(HIDDEN_CHAT_ID):
+        return "a hidden/headless conversation is not an owner-visible root room"
     # Positive external transport ids can share the Project range; neither a
     # number (Main's own id included: a wake or scheduled root runs there too)
     # nor an agent-supplied destination proves an owner-visible room.
diff --git a/ouroboros/tools/followup.py b/ouroboros/tools/followup.py
index 0d9b4edb8..4fd97a448 100644
--- a/ouroboros/tools/followup.py
+++ b/ouroboros/tools/followup.py
@@ -17,6 +17,14 @@ scheduler tick enqueues either form as an ordinary ROOT task (normal admission,
 normal budget). No second scheduler exists: this module only reaches the table the
 supervisor already consumes.
 
+``notify=true`` leaves a NOTE instead of a wake-up: a ``kind: "notify"`` row holding
+the agent's own words and when they were written, which the tick shows to the owner
+verbatim at the trigger as a System row, with no model call
+(``supervisor/schedule_notes.py``). Whether the words will still be true by then is
+the agent's choice at scheduling time; the host never classifies the text. A note
+reaches the owner directly, so Presence, agent-to-agent and delegated callers are
+refused (``control_runtime.owner_contact_refusal``).
+
 Authority is narrower than the parent's, not wider: a delegated subagent may not
 mint future root tasks (typed refusal), the objective is the agent's own plain
 text (no host template), and a task may hold at most ``_MAX_PENDING_FOLLOWUPS``
@@ -159,7 +167,11 @@ def get_tools() -> List[ToolEntry]:
                 "name": "schedule_followup",
                 "description": (
                     "Register a deferred follow-up task that the supervisor scheduler "
-                    "enqueues as an ordinary root task. Explicitly choose related work (original "
+                    "enqueues as an ordinary root task, or with notify=true a note: nothing wakes, and at "
+                    "the trigger the host shows objective verbatim to the owner as a System row signed with "
+                    "when you wrote it and when it was due. A note is right when its text will still be true "
+                    "at that time; if the words depend on what happens by then, schedule a wake-up instead. "
+                    "Explicitly choose related work (original "
                     "verified money/deadline and Stop controls) or independent work. Root tasks only; subagents report "
                     "the proposed follow-up to their parent. Supply exactly one trigger: run_at "
                     "for a one-shot ISO 8601 instant (naive = UTC), or cron for a recurring "
@@ -173,7 +185,7 @@ def get_tools() -> List[ToolEntry]:
                     "type": "object",
                     "properties": {
                         "relation": {"type": "string", "enum": ["related", "independent"],
-                                     "description": "Explicit relationship to this work. Related preserves its original money and hard deadline; independent is separate work. Author/cron/text do not decide this."},
+                                     "description": "Explicit relationship to this work. Related preserves its original money and hard deadline; independent is separate work. Author/cron/text do not decide this. A note is always independent."},
                         "run_at": {
                             "type": "string",
                             "description": "One-shot ISO 8601 instant to fire at/after (naive = UTC).",
@@ -189,10 +201,14 @@ def get_tools() -> List[ToolEntry]:
                         "objective": {
                             "type": "string",
                             "description": (
-                                "Plain-language objective for the future task, in your own words "
+                                "Plain-language objective for the future task (or the note's exact text), in your own words "
                                 f"(max {_MAX_OBJECTIVE_CHARS} chars; longer is a typed refusal, never truncated)."
                             ),
                         },
+                        "notify": {
+                            "type": "boolean",
+                            "description": "true = a note shown to the owner at the trigger without a model call (objective only, no context). Default false = a wake-up task.",
+                        },
                         "context": {
                             "type": "string",
                             "description": (
@@ -309,6 +325,16 @@ def _handle_schedule_followup(ctx: ToolContext, **params) -> str:
     task_id = str(getattr(ctx, "task_id", "") or "").strip()
     if not task_id:
         return publish_no_effect(ctx, ToolResult(status="unavailable", code="CAPABILITY_UNAVAILABLE", text=("ERROR: FOLLOWUP_TASK_ID_REQUIRED: a durable follow-up must belong to a real task.")))
+    notify = False if params.get("notify") is None else params.get("notify")  # models may send null
+    if not isinstance(notify, bool):
+        return publish_no_effect(ctx, ToolResult(status="error", code="TOOL_ARG_ERROR", text=(
+            "ERROR: FOLLOWUP_NOTIFY_INVALID: notify must be true (a note) or false (a wake-up task). Nothing was scheduled.")))
+    if notify:
+        from ouroboros.tools.control_runtime import owner_contact_refusal
+
+        if refusal := owner_contact_refusal(ctx, getattr(ctx, "current_chat_id", None)):
+            return publish_no_effect(ctx, ToolResult(status="blocked", code="ACCESS_BLOCKED", text=(
+                f"ERROR: FOLLOWUP_NOTIFY_REFUSED: {refusal}. No note was scheduled.")))
     run_at_raw = str(params.get("run_at") or "").strip()
     cron = str(params.get("cron") or "").strip()
     if bool(run_at_raw) == bool(cron):
@@ -357,6 +383,10 @@ def _handle_schedule_followup(ctx: ToolContext, **params) -> str:
             f"{_MAX_OBJECTIVE_CHARS}. Shorten it — nothing was truncated and nothing was scheduled.")))
         )
     context = str(params.get("context") or "").strip()
+    if notify and context:
+        return publish_no_effect(ctx, ToolResult(status="error", code="TOOL_ARG_ERROR", text=(
+            "ERROR: FOLLOWUP_NOTIFY_CONTEXT: a note is shown exactly as its objective; put what the owner "
+            "should read there and omit context. Nothing was scheduled.")))
     if len(context) > _MAX_CONTEXT_CHARS:
         return (
             publish_no_effect(ctx, ToolResult(status="error", code="TOOL_ARG_ERROR", text=(f"ERROR: FOLLOWUP_TEXT_TOO_LONG: context is {len(context)} chars; the limit is "
@@ -372,8 +402,12 @@ def _handle_schedule_followup(ctx: ToolContext, **params) -> str:
     from supervisor.followup_policy import resolve_relation
     origin = {"task_id": task_id, "root_task_id": str(getattr(ctx, "root_task_id", "") or
               (getattr(ctx, "task_metadata", None) or {}).get("root_task_id") or task_id)}
+    if notify and str(params.get("relation") or "") == "related":
+        timezone_note += " " + ignored_argument_note(
+            "relation", "related", "a note carries no money or deadline, so it is recorded as independent") + "."
     try:
-        relation = resolve_relation(drive_root, origin, params.get("relation"), declared_by=task_id)
+        relation = resolve_relation(drive_root, origin, "independent" if notify else params.get("relation"),
+                                    declared_by=task_id)
     except ValueError as exc:
         return publish_no_effect(ctx, ToolResult(status="unavailable", code="CAPABILITY_UNAVAILABLE",
                                     text=f"FOLLOWUP_REFUSED: {exc}"))
@@ -384,6 +418,9 @@ def _handle_schedule_followup(ctx: ToolContext, **params) -> str:
 
     try:
         with schedule_transaction(drive_root):
+            if notify:
+                return _register_note(ctx, task_id, drive_root, objective, trigger, cron, timezone,
+                                      timezone_note, origin, relation)
             return _register_followup(ctx, task_id, drive_root, objective, context,
                                       trigger, cron, timezone, timezone_note, origin, relation)
     except ScheduleStoreUnreadable as exc:
@@ -407,30 +444,88 @@ def followup_resource_intent(ctx: Any, metadata: Any, project_id: str) -> Dict[s
     return {"kind": "room_default", "project_id": project_id} if project_id else {"kind": "system_repo"}
 
 
+def _pending_or_cap_refusal(ctx: ToolContext, task_id: str, drive_root: Any) -> tuple[list, str]:
+    """This task's pending follow-ups (notes included), or the typed cap refusal."""
+    from supervisor.queue import list_scheduled_tasks
+
+    records = [r for r in (list_scheduled_tasks(drive_root).get("tasks") or []) if isinstance(r, dict)]
+    pending = _pending_followups(records, task_id)
+    if len(pending) < _MAX_PENDING_FOLLOWUPS:
+        return pending, ""
+
+    def _trigger_label(record: Dict[str, Any]) -> str:
+        item = record.get("trigger") if isinstance(record.get("trigger"), dict) else {}
+        if str(item.get("type") or "") == "cron":
+            zone = str(record.get("timezone") or "").strip() or "system local time"
+            return f"cron {item.get('expr')} ({zone})"
+        return f"fires at/after {item.get('run_at')}"
+
+    listing = "; ".join(
+        f"{record.get('id')} ({_trigger_label(record)})" for record in pending
+    )
+    return pending, (
+        _publish_tool_result(ctx, ToolResult(status="blocked", code="RESOURCE_CONSTRAINT_BLOCKED", text=(f"ERROR: FOLLOWUP_CAP_REACHED: this task already holds {len(pending)} pending "
+        f"follow-up(s) of the {_MAX_PENDING_FOLLOWUPS} allowed: {listing}. Wait for a "
+        "one-shot to fire, or the owner can disable/delete records from the Schedules surface.")))
+    )
+
+
+def _register_note(ctx: ToolContext, task_id: str, drive_root: Any, objective: str,
+                   trigger: Dict[str, Any], cron: str, timezone: str, notes: str,
+                   origin: dict, relation: dict) -> str:
+    """A note: the same table, cap and lifecycle as a follow-up, but no task template.
+
+    The row keeps the words and when they were written; the scheduler tick shows
+    them at the trigger (``supervisor/schedule_notes.py``)."""
+    from ouroboros.utils import utc_now_iso
+    from supervisor.queue import ScheduleRefused, ScheduleStoreUnreadable, upsert_scheduled_task
+
+    pending, refusal = _pending_or_cap_refusal(ctx, task_id, drive_root)
+    if refusal:
+        return refusal
+    record = {
+        "id": f"followup-{task_id}-{uuid.uuid4().hex[:6]}", "name": f"Reminder of task {task_id}",
+        "description": objective, "kind": "notify", "source": FOLLOWUP_SOURCE, "enabled": True,
+        "timezone": timezone, "trigger": trigger,
+        "notification": {"text": objective, "set_at": utc_now_iso()},
+    }
+    try:
+        stored = upsert_scheduled_task(
+            record, drive_root=drive_root, actor="agent:schedule_followup", task_id=task_id,
+            reason=f"note registered by task {task_id}",
+            host_followup={"followup_origin": origin, "followup_relation": relation})
+    except ScheduleRefused as exc:
+        return _publish_tool_result(ctx, ToolResult(
+            status="unavailable", code="CAPABILITY_UNAVAILABLE",
+            text=f"⚠️ CAPABILITY_UNAVAILABLE: FOLLOWUP_REFUSED: {exc.status}: {exc}"))
+    except ScheduleStoreUnreadable:
+        raise  # the caller's typed FOLLOWUP_STORE_UNAVAILABLE refusal owns this
+    except Exception as exc:
+        return _publish_tool_result(ctx, ToolResult(status="error", code="TOOL_ERROR", text=(
+            f"ERROR: FOLLOWUP_PERSIST_FAILED: {type(exc).__name__}: {exc}; inspect schedule {record['id']} before retrying")))
+    timing = (f"once at/after {trigger['run_at']}" if trigger["type"] == "once"
+              else f"recurring cron {cron} ({timezone or 'system local time'})")
+    audit = str(stored.get("audit") or "")
+    audit_note = "" if audit == "recorded" else (
+        f" AUDIT_INCOMPLETE: the row is durable, but its audit outcome fact could not be written (audit={audit or 'unknown'}).")
+    return (
+        f"FOLLOWUP_SCHEDULED: note {stored.get('id')} registered {timing}. Nothing wakes then: the host shows "
+        "your objective verbatim in the owner's chat as a System row signed with when you wrote it and when "
+        "it was due (after downtime, at the next start with both times). Pending follow-ups for this task: "
+        f"{len(pending) + 1}/{_MAX_PENDING_FOLLOWUPS}; the owner can disable or delete it from the Schedules "
+        f"surface.{audit_note}{notes}"
+    )
+
+
 def _register_followup(ctx: ToolContext, task_id: str, drive_root: Any,
                        objective: str, context: str, trigger: Dict[str, Any], cron: str,
                        timezone: str, timezone_note: str, origin: dict, relation: dict) -> str:
     """The cap read, the record build and the write — all under the schedule lock."""
-    from supervisor.queue import list_scheduled_tasks, upsert_scheduled_task
+    from supervisor.queue import upsert_scheduled_task
 
-    records = [r for r in (list_scheduled_tasks(drive_root).get("tasks") or []) if isinstance(r, dict)]
-    pending = _pending_followups(records, task_id)
-    if len(pending) >= _MAX_PENDING_FOLLOWUPS:
-        def _trigger_label(record: Dict[str, Any]) -> str:
-            item = record.get("trigger") if isinstance(record.get("trigger"), dict) else {}
-            if str(item.get("type") or "") == "cron":
-                zone = str(record.get("timezone") or "").strip() or "system local time"
-                return f"cron {item.get('expr')} ({zone})"
-            return f"fires at/after {item.get('run_at')}"
-
-        listing = "; ".join(
-            f"{record.get('id')} ({_trigger_label(record)})" for record in pending
-        )
-        return (
-            _publish_tool_result(ctx, ToolResult(status="blocked", code="RESOURCE_CONSTRAINT_BLOCKED", text=(f"ERROR: FOLLOWUP_CAP_REACHED: this task already holds {len(pending)} pending "
-            f"follow-up(s) of the {_MAX_PENDING_FOLLOWUPS} allowed: {listing}. Wait for a "
-            "one-shot to fire, or the owner can disable/delete records from the Schedules surface.")))
-        )
+    pending, refusal = _pending_or_cap_refusal(ctx, task_id, drive_root)
+    if refusal:
+        return refusal
     metadata_src = getattr(ctx, "task_metadata", None)
     root_task_id = metadata_src.get("root_task_id") if isinstance(metadata_src, dict) else None
     project_id = str(
diff --git a/ouroboros/windows_autostart.py b/ouroboros/windows_autostart.py
new file mode 100644
index 000000000..4a0e3814d
--- /dev/null
+++ b/ouroboros/windows_autostart.py
@@ -0,0 +1,115 @@
+"""Start the packaged Windows desktop app when the owner signs in.
+
+The per-user ``Run`` value named ``Ouroboros`` is the only state — no settings.json
+mirror, because Windows' own Startup apps page edits the same entry between reads.
+That page keeps its switch in ``StartupApproved\\Run`` (odd first byte = switched
+off); turning autostart on or off clears the switch, so Windows follows the new
+entry. The value name is the app's own: turning on retargets an entry left by
+another copy of Ouroboros, turning off removes it.
+
+The entry passes the launcher's existing ``--launch-intent automatic``, so a
+sign-in never starts a copy the owner stopped with Panic
+(``launcher_bootstrap.automatic_launch_allowed``); an owner start still resumes.
+The target is ``Ouroboros.exe`` beside the PyInstaller ``_internal`` bundle that
+the launcher exports to its managed server (``OUROBOROS_BUNDLE_DIR``); source,
+headless and non-Windows runs report ``unavailable`` and never touch the registry.
+"""
+
+from __future__ import annotations
+
+import ntpath
+import os
+import pathlib
+from typing import Any, Literal, Optional
+
+from ouroboros.platform_layer import BUNDLE_DIR_ENV, IS_WINDOWS
+
+AutostartState = Literal["unavailable", "off", "on", "other_copy", "disabled_by_os"]
+
+RUN_KEY = r"Software\Microsoft\Windows\CurrentVersion\Run"
+APPROVED_KEY = r"Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run"
+VALUE_NAME = "Ouroboros"
+LAUNCHER_EXE = "Ouroboros.exe"  # the EXE name in Ouroboros.spec
+SIGN_IN_ARGS = "--launch-intent automatic"
+
+
+def _winreg() -> Any:
+    """The guarded function-local platform import (platform abstraction rule)."""
+    if not IS_WINDOWS:
+        raise OSError("the Windows registry exists only on Windows")
+    import winreg  # type: ignore[import-not-found]
+
+    return winreg
+
+
+def launcher_path() -> Optional[pathlib.Path]:
+    """The packaged desktop launcher that started this server, or None."""
+    if not IS_WINDOWS or os.environ.get("OUROBOROS_PRESENTATION") != "desktop_window":
+        return None
+    bundle = str(os.environ.get(BUNDLE_DIR_ENV) or "").strip()
+    if not bundle or pathlib.Path(bundle).name.lower() != "_internal":
+        return None
+    exe = pathlib.Path(bundle).parent / LAUNCHER_EXE
+    return exe if exe.is_file() else None
+
+
+def sign_in_command(exe: pathlib.Path) -> str:
+    """The exact Run command this copy writes and recognises as its own."""
+    return f'"{exe}" {SIGN_IN_ARGS}'
+
+
+def _is_own_command(command: object, exe: pathlib.Path) -> bool:
+    """Windows paths compare without case; the launcher's arguments do not."""
+    if not isinstance(command, str):
+        return False
+    target, _, args = command.strip().partition('" ')
+    return ntpath.normcase(target + '"') == ntpath.normcase(f'"{exe}"') and args == SIGN_IN_ARGS
+
+
+def _read_value(key_path: str) -> object:
+    winreg = _winreg()
+    try:
+        with winreg.OpenKey(winreg.HKEY_CURRENT_USER, key_path) as key:
+            return winreg.QueryValueEx(key, VALUE_NAME)[0]
+    except FileNotFoundError:
+        return None
+
+
+def _delete_value(key_path: str) -> None:
+    winreg = _winreg()
+    try:
+        with winreg.OpenKey(winreg.HKEY_CURRENT_USER, key_path, 0, winreg.KEY_SET_VALUE) as key:
+            winreg.DeleteValue(key, VALUE_NAME)
+    except FileNotFoundError:
+        pass
+
+
+def autostart_state() -> AutostartState:
+    """What Windows will do at the next sign-in for THIS copy of the app."""
+    exe = launcher_path()
+    if exe is None:
+        return "unavailable"
+    command = _read_value(RUN_KEY)
+    if command is None:
+        return "off"
+    if not _is_own_command(command, exe):
+        return "other_copy"
+    switch = _read_value(APPROVED_KEY)
+    if isinstance(switch, bytes) and switch[:1] and switch[0] & 1:
+        return "disabled_by_os"
+    return "on"
+
+
+def set_autostart(enabled: bool) -> AutostartState:
+    """Write or remove the entry; raises OSError when the registry refuses."""
+    exe = launcher_path()
+    if exe is None:
+        return "unavailable"
+    if enabled:
+        winreg = _winreg()
+        with winreg.CreateKeyEx(winreg.HKEY_CURRENT_USER, RUN_KEY, 0, winreg.KEY_SET_VALUE) as key:
+            winreg.SetValueEx(key, VALUE_NAME, 0, winreg.REG_SZ, sign_in_command(exe))
+    else:
+        _delete_value(RUN_KEY)
+    _delete_value(APPROVED_KEY)
+    return autostart_state()
diff --git a/server.py b/server.py
index 0b0b41770..ca48314e5 100644
--- a/server.py
+++ b/server.py
@@ -1321,9 +1321,9 @@ async def lifespan(app):
 
     if not _exit_signalled.is_set():
         _supervisor_stop.clear()  # a fresh lifespan owns a fresh generation (symmetric with the teardown set)
-    if has_startup_ready_provider(settings):
-        _start_supervisor_if_needed(settings)
-    else:
+    # A provider-ready boot starts the supervisor after the extension reload below.
+    startup_provider_ready = has_startup_ready_provider(settings)
+    if not startup_provider_ready:
         _supervisor_ready.set()
         _supervisor_init_done.set()
         log.info("No supported provider or local routing configured. Supervisor not started.")
@@ -1402,7 +1402,7 @@ async def lifespan(app):
     # Startup-only: after the prior process generation is gone, finalize orphaned
     # RUNNING results and resolve an indeterminate post-task synthesis phase.
     # The periodic zombie sweep intentionally does not perform this recovery.
-    if not has_startup_ready_provider(settings):
+    if not startup_provider_ready:
         _run_startup_task_recovery(
             lifespan_drive_root, REPO_DIR, skip_live_data=pytest_default_real_data_dir,
             prior_worker_pids=None if pytest_default_real_data_dir else _startup_worker_pids(lifespan_drive_root),
@@ -1424,6 +1424,9 @@ async def lifespan(app):
             _reload_extensions(lifespan_drive_root, _load_settings, repo_path=repo_path or None)
     except Exception:
         log.error("Extension reload_all at startup failed", exc_info=True)
+    # Only now: the first tick may consume an overdue note; a bus subscriber attached later never sees it.
+    if startup_provider_ready:
+        _start_supervisor_if_needed(settings)
 
     try:
         from ouroboros.mcp_client import (
diff --git a/skills/telegram/SKILL.md b/skills/telegram/SKILL.md
index 3eb7c5d76..baab01284 100644
--- a/skills/telegram/SKILL.md
+++ b/skills/telegram/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: telegram
 description: Owner-only Telegram text bridge and Mini App gateway for the existing Ouroboros interface.
-version: 1.2.9
+version: 1.2.10
 type: extension
 entry: plugin.py
 plugin_api: "2.0"
@@ -68,6 +68,10 @@ Version 1.2.9 routes every Telegram API call through the optional skill-local
 and the companion's menu button lifecycle. The Settings form masks the proxy
 and never reads its stored credentials back into the browser.
 
+Version 1.2.10 also forwards the owner's notes and skill notices (`reminder` and
+`skill_notice` System rows, written for the owner) to the pinned chat when the
+mirror mode is `telegram_only`; mode `all` already mirrored them.
+
 The Mini App exposes the unchanged Ouroboros SPA through the established
 owner-authenticated sidecar and a pinned Cloudflare Quick Tunnel. It is enabled
 by default after owner binding and can be turned off independently without
diff --git a/skills/telegram/plugin.py b/skills/telegram/plugin.py
index a5e28e93e..e820fd0e3 100644
--- a/skills/telegram/plugin.py
+++ b/skills/telegram/plugin.py
@@ -362,6 +362,10 @@ def _target_chat(settings: Dict[str, Any], event: Dict[str, Any]) -> int:
         transport = event.get("transport") if isinstance(event.get("transport"), dict) else {}
         if transport.get("kind") == "telegram":
             return chat_id
+        # ...and the owner's notes and skill notices: System rows written for the
+        # owner, which an owner who left the web should still get on the phone.
+        if event.get("role") == "system" and event.get("system_type") in {"reminder", "skill_notice"}:
+            return chat_id
         return 0
     # No pinned chat configured — only forward events that originate from
     # a Telegram transport conversation so local UI events are never leaked.
@@ -1352,7 +1356,8 @@ def register(api):
                         "**Command mode**: controls which slash commands can be sent from Telegram. "
                         "Use `/menu` in Telegram to see available commands as inline buttons.\n\n"
                         "**Mirror mode**: *all* mirrors every chat message (including web UI) to Telegram — requires Chat ID. "
-                        "*Telegram only* mirrors only Telegram-originated conversations.\n\n"
+                        "*Telegram only* mirrors Telegram-originated conversations, plus Ouroboros's reminders and skill notices "
+                        "when a Chat ID is set.\n\n"
                         "**Mini App Beta** uses a best-effort Cloudflare Quick Tunnel with no SLA and no SSE support. "
                         "It targets native Telegram clients; Telegram WebA/WebK are not supported."
                     ),
@@ -1388,7 +1393,7 @@ def register(api):
                         {"name": "TELEGRAM_MIRROR_MODE", "label": "Mirror mode", "type": "select",
                          "options": [
                              {"value": "all", "label": "Mirror all messages (web + Telegram)"},
-                             {"value": "telegram_only", "label": "Telegram conversations only"},
+                             {"value": "telegram_only", "label": "Telegram conversations, plus reminders and skill notices"},
                          ],
                          "placeholder": "all"},
                         {"name": "TELEGRAM_CHAT_ID", "label": "Telegram Chat ID", "type": "text", "placeholder": "required for 'all' mode"},
diff --git a/supervisor/queue_schedules.py b/supervisor/queue_schedules.py
index 9630001dd..7c6010a2b 100644
--- a/supervisor/queue_schedules.py
+++ b/supervisor/queue_schedules.py
@@ -305,9 +305,11 @@ def _schedule_projection_row(raw: Dict[str, Any]) -> Dict[str, Any]:
     row: Dict[str, Any] = {}
     # Keep only lifecycle facts useful to a model.  In particular, the durable
     # task template (including context/attachments) never crosses this seam.
+    # ``last_error`` says why a row did not do its job (a note whose chat write
+    # was not confirmed reads "consumed" otherwise); it is bounded like any text.
     projection_keys = (
         "id", "name", "enabled", "source", "skill", "trigger",
-        "created_at", "last_run_at", "last_task_id", "completed_at", "next_run_at",
+        "created_at", "last_run_at", "last_task_id", "last_error", "completed_at", "next_run_at",
     )
     for key in projection_keys:
         value = raw.get(key)
@@ -699,6 +701,9 @@ def _schedule_running_or_queued(schedule_id: str, drive_root: pathlib.Path | Non
 
 def _task_from_schedule(record: Dict[str, Any], *, task_id: str = "") -> Dict[str, Any]:
     from supervisor.followup_policy import normalize_template, bind_task
+    from supervisor.schedule_notes import is_note
+    if is_note(record):  # a note is shown as written, never re-read as a model task's objective
+        raise ValueError("a kind=notify row is a note, not a task template")
     template = normalize_template(record)
     task_id = task_id or uuid.uuid4().hex[:8]
     # Membership, not truthiness: a template's explicit chat 0 is its hidden partition.
@@ -766,11 +771,14 @@ def check_scheduled_tasks() -> None:
     Claims and reconciliation run under the queue+table locks; every expensive
     step (resource intent, folder checks, memory fork, the allowance read) runs
     without them; admission rechecks and commits under them again
-    (``supervisor/schedule_occurrence.py``)."""
+    (``supervisor/schedule_occurrence.py``). A due ``kind: "notify"`` row is a
+    note: consumed in this pass's one table write, shown after the locks are
+    released (``supervisor/schedule_notes.py``), never a task."""
     global _last_skill_schedule_sync
-    from supervisor import schedule_occurrence as occurrences
+    from supervisor import schedule_notes as notes, schedule_occurrence as occurrences
 
     claims: List[Dict[str, Any]] = []
+    due_notes: List[Dict[str, Any]] = []
     with schedule_transaction(_queue().DRIVE_ROOT):
         now_monotonic = time.monotonic()
         if now_monotonic - _last_skill_schedule_sync >= _SKILL_SCHEDULE_SYNC_INTERVAL_SEC:
@@ -880,6 +888,11 @@ def check_scheduled_tasks() -> None:
                     continue
             if view.get("hold") or view["wait"] or record.get("followup_hold"):
                 continue
+            if notes.is_note(record):
+                note, note_changed = notes.consume(record, due_at, now)
+                due_notes.extend([note] if note else [])
+                changed = changed or note_changed
+                continue
             claims.append(occurrences.claim(record, due_at))
             changed = True
         # Consumed one-shot receipts age out past the unified GC retention (DEVELOPMENT
@@ -894,5 +907,6 @@ def check_scheduled_tasks() -> None:
             if _write_scheduled_tasks(data) is False:
                 return
             _queue().persist_queue_snapshot(reason="scheduled_tasks")
+    notes.deliver(due_notes, _queue().DRIVE_ROOT)
     if claims:
         occurrences.admit([occurrences.prepare(claimed) for claimed in claims])
diff --git a/supervisor/schedule_notes.py b/supervisor/schedule_notes.py
new file mode 100644
index 000000000..c59f8f131
--- /dev/null
+++ b/supervisor/schedule_notes.py
@@ -0,0 +1,150 @@
+"""Notes: the mind's own words, shown to the owner at the time it chose.
+
+``schedule_followup(notify=true)`` stores a ``kind: "notify"`` row in the ONE
+schedule table (``queue_schedules.py``) holding the text the mind wrote and when
+it wrote it. When the row is due, the scheduler tick consumes that occurrence in
+the table — a one-shot is spent, a cron row moves to its next future point, so
+any downtime gap collapses into one note — and, after the table lock is released,
+this module puts the exact text in the owner's chat as one System row
+(``system_type="reminder"``) signed with when it was written and when it was due.
+No model call and no task: the next turn reads the row like any System row.
+
+Consumed before shown: a failed table write shows nothing and the row stays due;
+a show whose outcome is unknown is recorded on the row and never retried, so a
+note can be lost once but is never shown twice.
+"""
+
+from __future__ import annotations
+
+import datetime
+import logging
+import pathlib
+from typing import Any, Dict, List, Optional, Tuple
+
+log = logging.getLogger(__name__)
+
+NOTE_KIND = "notify"
+_MONTHS = ("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec")
+
+
+def is_note(record: Dict[str, Any]) -> bool:
+    return str(record.get("kind") or "") == NOTE_KIND
+
+
+def owner_chat_id(drive_root: Any) -> int:
+    """The owner's primary chat (bound by the first owner message), else Main."""
+    from ouroboros.contracts.chat_id_policy import WEB_UI_CHAT_ID
+    from supervisor.state import control_in_copy
+
+    known, value = control_in_copy(pathlib.Path(drive_root) / "state" / "state.json", "owner_chat_id")
+    try:
+        chat_id = int(value) if known and value not in (None, "") else 0
+    except (TypeError, ValueError):
+        chat_id = 0
+    return chat_id if chat_id > 0 else WEB_UI_CHAT_ID
+
+
+def consume(record: Dict[str, Any], due_at: str, now: datetime.datetime) -> Tuple[Optional[Dict[str, Any]], bool]:
+    """Under the table lock: retire this occurrence; return ``(note, changed)``.
+
+    The note is ``None`` when the row cannot be shown or cannot advance; its
+    ``last_error`` says why, and an unchanged error does not rewrite the table.
+    """
+    from supervisor.schedule_time import next_cron_time, record_last_error
+
+    notification = record.get("notification") if isinstance(record.get("notification"), dict) else {}
+    text = str(notification.get("text") or "").strip()
+    if not text:
+        return None, record_last_error(record, "note has no text")
+    trigger = record.get("trigger") if isinstance(record.get("trigger"), dict) else {}
+    if str(trigger.get("type") or "cron") == "once":
+        record.update(enabled=False, completed_at=now.isoformat(), next_run_at="")
+    else:
+        try:  # the successor first: a row that cannot advance would show again every pass
+            successor = next_cron_time(str(trigger.get("expr") or record.get("cron") or ""), now)
+        except Exception as exc:
+            return None, record_last_error(record, f"{type(exc).__name__}: {exc}")
+        record["next_run_at"] = successor.isoformat()
+    record.update(last_run_at=now.isoformat(), last_error="")
+    # The signature names who wrote the words: the mind's own follow-up is Ouroboros;
+    # a row from any other source keeps that source rather than borrowing the voice.
+    source = str(record.get("source") or "")
+    return {"id": str(record.get("id") or ""), "text": text, "set_at": str(notification.get("set_at") or ""),
+            "author": "Ouroboros" if source == "task_followup" else (source or "unknown source"),
+            "scheduled_for": str(due_at or ""), "timezone": str(record.get("timezone") or "")}, True
+
+
+def _clock(moment: datetime.datetime) -> str:
+    return f"{_MONTHS[moment.month - 1]} {moment.day} {moment:%H:%M}"
+
+
+def _zone(moment: datetime.datetime) -> str:
+    offset = moment.utcoffset()
+    minutes = int(offset.total_seconds() // 60) if offset is not None else 0
+    return "UTC" if not minutes else f"UTC{'+' if minutes > 0 else '-'}{abs(minutes) // 60}" + (
+        f":{abs(minutes) % 60:02d}" if minutes % 60 else "")
+
+
+def note_text(note: Dict[str, Any], delivered_at: str) -> str:
+    """The row: a host-composed signature line, then the mind's words verbatim.
+
+    Times are the schedule's zone (the server's when none is stored), named once
+    as a UTC offset, or each with its own offset when a DST change lies between
+    them. ``delivered`` appears whenever its minute is not the due minute (real
+    instants, never wall-clock text), so a note held back by downtime shows both.
+    """
+    from supervisor.schedule_time import parse_schedule_time, timezone_for_schedule
+
+    tz = timezone_for_schedule({"timezone": note.get("timezone")})
+    written, due, delivered = (parse_schedule_time(raw, tz) for raw in (
+        note.get("set_at", ""), note.get("scheduled_for", ""), delivered_at))
+    if delivered and due and int(delivered.timestamp() // 60) == int(due.timestamp() // 60):
+        delivered = None
+    shown = [(label, moment) for label, moment in (("written", written), ("for", due), ("delivered", delivered))
+             if moment]
+    zones = {_zone(moment) for _label, moment in shown} or {_zone(datetime.datetime.now(tz))}
+    each = len(zones) > 1
+    parts = ["Reminder", str(note.get("author") or "Ouroboros"), *(
+        f"{label} {_clock(moment)}" + (f" ({_zone(moment)})" if each else "") for label, moment in shown)]
+    return f"{' · '.join(parts)}{'' if each else f' ({zones.pop()})'}\n{note['text']}"
+
+
+def deliver(notes: List[Dict[str, Any]], drive_root: Any) -> None:
+    """After the table lock: show each consumed note once; an unknown outcome is recorded, never retried."""
+    if not notes:
+        return
+    from ouroboros.utils import utc_now_iso
+    from supervisor.message_bus import send_with_budget
+
+    chat_id, unconfirmed = owner_chat_id(drive_root), []
+    for note in notes:
+        delivered_at = utc_now_iso()
+        try:
+            send_with_budget(
+                chat_id, note_text(note, delivered_at), role="system", system_type="reminder",
+                require_write=True, ensure_record_boundary=True,
+                progress_meta={"source": note["author"], "set_at": note["set_at"],
+                               "scheduled_for": note["scheduled_for"], "delivered_at": delivered_at},
+            )
+        except Exception:
+            log.warning("Note %s was consumed but its delivery is not confirmed; not retried", note["id"], exc_info=True)
+            unconfirmed.append(note["id"])
+    if unconfirmed:
+        _record_unconfirmed(set(unconfirmed), drive_root)
+
+
+def _record_unconfirmed(ids: set, drive_root: Any) -> None:
+    from supervisor.queue_schedules import _write_scheduled_tasks, load_schedule_store, schedule_transaction
+    from supervisor.schedule_time import record_last_error
+
+    try:
+        with schedule_transaction(drive_root):
+            data = load_schedule_store(drive_root)
+            changed = False
+            for row in data.get("tasks") or []:
+                if str(row.get("id") or "") in ids:
+                    changed = record_last_error(row, "delivery not confirmed") or changed
+            if changed:
+                _write_scheduled_tasks(data, drive_root)
+    except Exception:
+        log.warning("Unconfirmed note delivery %s could not be recorded on its row", sorted(ids), exc_info=True)
diff --git a/tests/fixtures/chat_logs_ui_static_checks.json b/tests/fixtures/chat_logs_ui_static_checks.json
index 309099ebb..178def2f5 100644
--- a/tests/fixtures/chat_logs_ui_static_checks.json
+++ b/tests/fixtures/chat_logs_ui_static_checks.json
@@ -1131,7 +1131,7 @@
     "id": "test_inflight_bare_final_never_ledgers",
     "path": "web/modules/chat.js",
     "kind": "regex",
-    "value": "} else if \\(msg\\.system_type !== 'terminal_incident'\\) \\{[^{}]*?activeDirectActivities\\.clear\\(\\);\\s*pendingSubmissions\\.clear\\(\\);"
+    "value": "} else if \\(unkeyedFrameEndsTurn\\(msg\\)\\) \\{[^{}]*?activeDirectActivities\\.clear\\(\\);\\s*pendingSubmissions\\.clear\\(\\);"
   },
   {
     "id": "test_inflight_reconnect_user_row_retires_pending",
diff --git a/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-host-autostart.grant b/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-host-autostart.grant
new file mode 100644
index 000000000..0117661a6
--- /dev/null
+++ b/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-host-autostart.grant
@@ -0,0 +1,2 @@
+1808
+Document host autostart adapters, their OS authority and availability, the Behavior control and lifecycle facts, and the existing endpoint contract.
diff --git a/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-owner-notes.grant b/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-owner-notes.grant
new file mode 100644
index 000000000..fdc0932b0
--- /dev/null
+++ b/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-owner-notes.grant
@@ -0,0 +1,2 @@
+483
+The module map names the note path: schedule_notes.py (a due kind:"notify" row consumed then shown as a signed reminder System row), the notify argument of schedule_followup, the note rows of scheduled_tasks.json, and host_notify.py, where a granted skill writes one signed skill_notice System row.
diff --git a/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-pr1405-windows-autostart.grant b/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-pr1405-windows-autostart.grant
new file mode 100644
index 000000000..404d6f3a6
--- /dev/null
+++ b/tests/reference_book_grants/architecture/01-high-level-architecture/2026-10-03-pr1405-windows-autostart.grant
@@ -0,0 +1,2 @@
+431
+Retain PR #1405 Windows autostart module, Settings and endpoint descriptions when merging current development.
diff --git a/tests/reference_book_grants/architecture/02-startup-onboarding-flow/2026-10-03-owner-notes-boot-order.grant b/tests/reference_book_grants/architecture/02-startup-onboarding-flow/2026-10-03-owner-notes-boot-order.grant
new file mode 100644
index 000000000..90aa02903
--- /dev/null
+++ b/tests/reference_book_grants/architecture/02-startup-onboarding-flow/2026-10-03-owner-notes-boot-order.grant
@@ -0,0 +1,2 @@
+198
+A provider boot starts the supervisor after the event bus and the extension reload: its first scheduler tick can show an overdue note, and the event bus keeps no history for a subscriber that attaches later. The chapter records that order in the existing gateway/supervisor sentence; no older text describes it.
diff --git a/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-host-autostart.grant b/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-host-autostart.grant
new file mode 100644
index 000000000..c44478784
--- /dev/null
+++ b/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-host-autostart.grant
@@ -0,0 +1,2 @@
+680
+Document host autostart adapters, their OS authority and availability, the Behavior control and lifecycle facts, and the existing endpoint contract.
diff --git a/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-owner-notes.grant b/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-owner-notes.grant
new file mode 100644
index 000000000..6c3ca8900
--- /dev/null
+++ b/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-owner-notes.grant
@@ -0,0 +1,2 @@
+175
+Notification classification names the reminder and skill_notice System rows (titled by their source author, banner body below the signature line), and Activity names a kind:"notify" note by its own words and shows any stored last error on a schedule row.
diff --git a/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-pr1405-windows-autostart.grant b/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-pr1405-windows-autostart.grant
new file mode 100644
index 000000000..0cda9910e
--- /dev/null
+++ b/tests/reference_book_grants/architecture/03-web-ui-pages-and-buttons/2026-10-03-pr1405-windows-autostart.grant
@@ -0,0 +1,2 @@
+80
+Retain PR #1405 Windows autostart module, Settings and endpoint descriptions when merging current development.
diff --git a/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-host-autostart.grant b/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-host-autostart.grant
new file mode 100644
index 000000000..f95ac8260
--- /dev/null
+++ b/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-host-autostart.grant
@@ -0,0 +1,2 @@
+202
+Document host autostart adapters, their OS authority and availability, the Behavior control and lifecycle facts, and the existing endpoint contract.
diff --git a/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-owner-notes.grant b/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-owner-notes.grant
new file mode 100644
index 000000000..7f51e2b3a
--- /dev/null
+++ b/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-owner-notes.grant
@@ -0,0 +1,2 @@
+199
+The Host Service endpoint table lists POST /notify: one signed skill_notice System row in the owner chat under the notify_owner grant.
diff --git a/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-pr1405-windows-autostart.grant b/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-pr1405-windows-autostart.grant
new file mode 100644
index 000000000..5d55802ec
--- /dev/null
+++ b/tests/reference_book_grants/architecture/04-server-api-endpoints/2026-10-03-pr1405-windows-autostart.grant
@@ -0,0 +1,2 @@
+184
+Retain PR #1405 Windows autostart module, Settings and endpoint descriptions when merging current development.
diff --git a/tests/reference_book_grants/architecture/05-supervisor-loop/2026-10-03-owner-notes.grant b/tests/reference_book_grants/architecture/05-supervisor-loop/2026-10-03-owner-notes.grant
new file mode 100644
index 000000000..4022b4770
--- /dev/null
+++ b/tests/reference_book_grants/architecture/05-supervisor-loop/2026-10-03-owner-notes.grant
@@ -0,0 +1,2 @@
+334
+The scheduler paragraph states that a kind:"notify" row is a note, never an occurrence or task: consumed in the tick write, then shown by schedule_notes.py, an unconfirmed show recorded as the row's last_error (shown in Activity and manage_schedules) and never retried.
diff --git a/tests/reference_book_grants/architecture/11-frozen-contracts-v1/2026-10-03-owner-notes.grant b/tests/reference_book_grants/architecture/11-frozen-contracts-v1/2026-10-03-owner-notes.grant
new file mode 100644
index 000000000..57eefb11c
--- /dev/null
+++ b/tests/reference_book_grants/architecture/11-frozen-contracts-v1/2026-10-03-owner-notes.grant
@@ -0,0 +1,2 @@
+16
+The frozen PluginAPI row names notify_owner among the host-mediated permissions (owner decision A4=A).
diff --git a/tests/reference_book_grants/architecture/12-host-service-companions-and-chat-ids/2026-10-03-owner-notes.grant b/tests/reference_book_grants/architecture/12-host-service-companions-and-chat-ids/2026-10-03-owner-notes.grant
new file mode 100644
index 000000000..ea1c5679a
--- /dev/null
+++ b/tests/reference_book_grants/architecture/12-host-service-companions-and-chat-ids/2026-10-03-owner-notes.grant
@@ -0,0 +1,2 @@
+256
+The frozen Host Service routes include /notify, with one sentence on its grant, identity version, bound, System-row carrier and the single 503.
diff --git a/tests/test_chat_provenance.py b/tests/test_chat_provenance.py
index 90e68dfb5..b8eef8763 100644
--- a/tests/test_chat_provenance.py
+++ b/tests/test_chat_provenance.py
@@ -53,4 +53,4 @@ def test_consolidator_preserves_system_direction():
         }
     ])
 
-    assert "[2026-03-19 16:53] [system] Ouroboros: Detailed task summary." in formatted
+    assert "[2026-03-19 16:53] [system] System: Detailed task summary." in formatted
diff --git a/tests/test_checklist_permission_coverage.py b/tests/test_checklist_permission_coverage.py
index 0940e55d7..b5657a5f7 100644
--- a/tests/test_checklist_permission_coverage.py
+++ b/tests/test_checklist_permission_coverage.py
@@ -6,6 +6,7 @@ def test_privileged_extension_permissions_have_skill_review_items() -> None:
 
     required_mentions = {
         "inject_chat": "inject_chat_minimization",
+        "notify_owner": "inject_chat_minimization",
         "presence": "`presence` permission",
         "subscribe_event": "event_subscription_minimization",
         "companion_process": "companion_process_safety",
diff --git a/tests/test_contracts.py b/tests/test_contracts.py
index e2f54bf1a..a86039c2b 100644
--- a/tests/test_contracts.py
+++ b/tests/test_contracts.py
@@ -1312,6 +1312,8 @@ def test_plugin_api_version_matches_documented_surface():
 
     assert PLUGIN_API_VERSION == "2.0"
     assert "presence" in VALID_EXTENSION_PERMISSIONS
+    # Additive (owner A4=A, 2026-10-03): a granted skill may leave the owner a signed System row.
+    assert "notify_owner" in VALID_EXTENSION_PERMISSIONS
     # ABI-1: absent manifest field binds the LEGACY generation by construction
     # (owner-ratified: 1.3, deliberately NOT 1.4), and the version's surface
     # fingerprint is recorded (fail-closed in both directions).
diff --git a/tests/test_desktop_autostart.py b/tests/test_desktop_autostart.py
new file mode 100644
index 000000000..5fa53c332
--- /dev/null
+++ b/tests/test_desktop_autostart.py
@@ -0,0 +1,351 @@
+"""Sign-in contract across packaged hosts; OS commands never reach the real host."""
+from __future__ import annotations
+
+import configparser
+import json
+import logging
+import os
+from pathlib import Path
+import plistlib
+import re
+import shlex
+from types import SimpleNamespace
+
+import pytest
+
+from ouroboros import desktop_autostart as startup
+from ouroboros.launcher_bootstrap import automatic_launch_allowed, parse_launch_options
+
+SHIPPED_UNIT = (Path(__file__).resolve().parents[1] / "packaging/systemd/ouroboros.service").read_text(encoding="utf-8")
+# The unit exactly as the 7.2.0 through 7.5.1 deb/rpm packages installed it; a managed update never replaces it.
+HISTORICAL_UNIT = """[Unit]
+Description=Ouroboros agent runtime
+Documentation=https://github.com/razzant/ouroboros
+
+[Service]
+Type=simple
+# Native packages install the release-reviewed launcher at this fixed path.
+# The launcher remains the sole owner of bootstrap, restart, panic, and cleanup.
+ExecStart=/opt/ouroboros/Ouroboros
+
+# Stop the complete launcher/server/worker tree started by this unit.
+KillMode=control-group
+KillSignal=SIGTERM
+# SIGTERM is sent immediately. This is only the upper bound systemd waits for
+# remaining cgroup processes before escalating to SIGKILL.
+TimeoutStopSec=120
+
+# Deliberately no systemd restart policy: the launcher owns its crash fuse and
+# treats a panic exit as a complete stop until the owner starts Ouroboros again.
+
+[Install]
+WantedBy=default.target
+"""
+
+
+@pytest.fixture
+def host(tmp_path, monkeypatch):
+    monkeypatch.setenv("OUROBOROS_MANAGED_BY_LAUNCHER", "1")
+    monkeypatch.setenv("OUROBOROS_PRESENTATION", "desktop_window")
+    monkeypatch.setenv("OUROBOROS_APP_VERSION", "7.2.0")
+    monkeypatch.delenv("APPIMAGE", raising=False)
+    monkeypatch.delenv("APPDIR", raising=False)
+    monkeypatch.delenv("APPIMAGE_EXTRACT_AND_RUN", raising=False)
+    monkeypatch.setattr(startup.Path, "home", lambda: tmp_path)
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / ".config"))
+    monkeypatch.setattr(startup, "NATIVE_UNIT", tmp_path / "ouroboros.service")
+    monkeypatch.setattr(startup.os, "getuid", lambda: 501, raising=False)
+    state = SimpleNamespace(calls=[], override=None, unit="disabled")
+
+    def run(argv, **kwargs):
+        state.calls.append(argv)
+        if argv[0] == "launchctl":
+            if argv[1] == "enable":
+                state.override = "enabled"
+                return ""
+            assert argv == ["launchctl", "print-disabled", "gui/501"]
+            # Live shape (darwin 25): `=> disabled` / `=> enabled`.
+            rows = ['"com.apple.Siri.agent" => disabled']  # a neighbour's override is not ours
+            rows += [f'"{startup.LABEL}" => {state.override}'] if state.override else []
+            return "disabled services = {\n" + "".join(f"\t\t{row}\n" for row in rows) + "\t}"
+        assert argv[0:2] == ["systemctl", "--user"] and argv[-1] == "ouroboros.service"
+        if argv[2] == "is-enabled":
+            return state.unit
+        assert argv[2] in {"enable", "disable"}  # never --now, start, stop or linger
+        state.unit = "enabled" if argv[2] == "enable" else "disabled"
+        return ""
+
+    monkeypatch.setattr(startup, "_run", run)
+
+    def package(platform, *, native=False, appimage=False):
+        monkeypatch.setattr(startup, "sys", SimpleNamespace(platform=platform))
+        bundle = (tmp_path / "Ouroboros.app/Contents/Resources" if platform == "darwin"
+                  else tmp_path / "Ouroboros/_internal")
+        exe = (bundle.parent / "MacOS/Ouroboros" if platform == "darwin"
+               else bundle.parent / "Ouroboros")
+        bundle.mkdir(parents=True, exist_ok=True)
+        exe.parent.mkdir(parents=True, exist_ok=True)
+        exe.touch()
+        monkeypatch.setenv("OUROBOROS_BUNDLE_DIR", str(bundle))
+        if native:
+            monkeypatch.setattr(startup, "NATIVE_LAUNCHER", exe)
+            startup.NATIVE_UNIT.write_text(SHIPPED_UNIT, encoding="utf-8")
+        if appimage:
+            exe = tmp_path / "My Ouroboros.AppImage"
+            exe.touch()
+            monkeypatch.setenv("APPIMAGE", str(exe))
+            monkeypatch.setenv("APPDIR", str(bundle.parent))
+            monkeypatch.setattr(os.path, "ismount", lambda path: str(path) == str(bundle.parent))  # FUSE-mounted
+        return exe
+
+    return package, state
+
+
+def _exec_argv(path: Path) -> list[str]:
+    """Exec= as a sign-in session runs it: Desktop Entry string unescaping, then argument quoting."""
+    parser = configparser.ConfigParser(interpolation=None)
+    parser.read_string(path.read_text(encoding="utf-8"))
+    escapes = {"s": " ", "n": "\n", "t": "\t", "r": "\r", "\\": "\\"}
+    value = re.sub(r"\\(.)", lambda m: escapes.get(m.group(1), m.group(0)), parser["Desktop Entry"]["Exec"])
+    return [arg.replace("%%", "%") for arg in shlex.split(value)]
+
+
+def test_macos_writes_one_launchagent_and_respects_os_override(host, tmp_path):
+    package, os_state = host
+    exe = package("darwin")
+    path = tmp_path / "Library/LaunchAgents/com.ouroboros.agent.plist"
+    assert startup.autostart_status() == {"state": "off"}
+    assert not path.exists() and os_state.calls == []  # GET writes nothing
+    assert startup.autostart_status(True) == {"state": "on"}
+    entry = plistlib.loads(path.read_bytes())
+    assert entry == {"Label": "com.ouroboros.agent", "ProgramArguments": [str(exe), "--launch-intent", "automatic"], "RunAtLoad": True}
+    assert not (tmp_path / ".config").exists()
+    assert os_state.calls[0] == ["launchctl", "enable", "gui/501/com.ouroboros.agent"]
+    os_state.override = "disabled"  # System Settings or `launchctl disable`, as current macOS prints it
+    assert startup.autostart_status()["state"] == "disabled_by_os"
+    assert startup.autostart_status(True)["state"] == "on"
+    for printed, expected in (("true", "disabled_by_os"), ("false", "on"), (None, "on")):  # older spelling; no row
+        os_state.override = printed
+        assert startup.autostart_status()["state"] == expected
+    entry["ProgramArguments"] = ["/Applications/Other.app/Contents/MacOS/Ouroboros"]
+    path.write_bytes(plistlib.dumps(entry))
+    assert startup.autostart_status()["state"] == "other_copy"
+    assert startup.autostart_status(False) == {"state": "off"}
+    assert not path.exists()
+
+
+@pytest.mark.parametrize("appimage", [False, True])
+def test_linux_portable_registers_only_its_stable_target(host, tmp_path, appimage):
+    package, os_state = host
+    exe = package("linux", appimage=appimage)
+    path = tmp_path / ".config/autostart/ouroboros.desktop"
+    assert startup.autostart_status()["state"] == "off"
+    assert startup.autostart_status(True)["state"] == "on"
+    text = path.read_text(encoding="utf-8")
+    command = startup._desktop_command(exe)  # escaped: a raw Windows path never equals the written line
+    assert text == f"[Desktop Entry]\nType=Application\nName=Ouroboros\nExec={command}\nTerminal=false\n"
+    assert _exec_argv(path) == [str(exe), "--launch-intent", "automatic"]
+    assert os_state.calls == [] and not (tmp_path / "Library").exists()
+    path.write_text(text + "Hidden=true\n", encoding="utf-8")
+    assert startup.autostart_status()["state"] == "disabled_by_os"
+    assert startup.autostart_status(True)["state"] == "on"
+    path.write_text(text + "X-GNOME-Autostart-enabled=true\n", encoding="utf-8")
+    assert startup.autostart_status()["state"] == "on"
+    path.write_text(text + "X-GNOME-Autostart-enabled=false\n", encoding="utf-8")  # Cinnamon Startup Applications
+    assert startup.autostart_status()["state"] == "disabled_by_os"
+    assert startup.autostart_status(True)["state"] == "on"
+    assert "X-GNOME-Autostart-enabled" not in path.read_text(encoding="utf-8")
+    foreign = text.replace(command, '"/other/Ouroboros" --launch-intent automatic')
+    path.write_text(foreign + "Hidden=true\n", encoding="utf-8")
+    assert startup.autostart_status()["state"] == "off"  # a hidden entry starts no copy at all
+    path.write_text(foreign, encoding="utf-8")
+    assert startup.autostart_status()["state"] == "other_copy"
+    assert startup.autostart_status(False)["state"] == "off"
+    assert not path.exists()
+
+
+@pytest.mark.parametrize("fuse_less", [None, "APPIMAGE_EXTRACT_AND_RUN", "--appimage-extract-and-run"])
+def test_appimage_entry_starts_a_fresh_sign_in_session_in_the_same_mode(host, tmp_path, monkeypatch, fuse_less):
+    package, _ = host
+    exe = package("linux", appimage=True)
+    if fuse_less == "APPIMAGE_EXTRACT_AND_RUN":
+        monkeypatch.setenv("APPIMAGE_EXTRACT_AND_RUN", "1")  # README's FUSE-less command
+    elif fuse_less:
+        monkeypatch.setattr(os.path, "ismount", lambda path: False)  # runtime flag: APPDIR is a plain extracted tree
+    assert startup.autostart_status(True)["state"] == "on"
+    argv = _exec_argv(tmp_path / ".config/autostart/ouroboros.desktop")
+    assert argv[0] == str(exe) and argv[-2:] == ["--launch-intent", "automatic"]
+    # The pinned type-2 runtime at sign-in, with none of this process's environment: the FIRST long
+    # option selects extract-and-run, and the runtime strips that flag before execing AppRun.
+    session_env: dict[str, str] = {}
+    first = next((arg[2:] for arg in argv[1:] if arg.startswith("--")), None)
+    assert ("APPIMAGE_EXTRACT_AND_RUN" in session_env or first == "appimage-extract-and-run") is bool(fuse_less)
+    apprun_argv = [arg for arg in argv[1:] if arg != "--appimage-extract-and-run"]
+    assert parse_launch_options(apprun_argv).launch_intent == "automatic"
+    assert startup.autostart_status()["state"] == "on"  # read back as this copy's own entry
+
+
+def test_linux_native_uses_shipped_unit_and_replaces_xdg_registration(host, tmp_path):
+    package, os_state = host
+    package("linux", native=True)
+    path = tmp_path / ".config/autostart/ouroboros.desktop"
+    path.parent.mkdir(parents=True)
+    path.write_text("[Desktop Entry]\nExec=/old/Ouroboros\n", encoding="utf-8")
+    assert startup.autostart_status()["state"] == "other_copy"
+    assert startup.autostart_status(True)["state"] == "on"
+    assert not path.exists()
+    assert ["systemctl", "--user", "enable", "ouroboros.service"] in os_state.calls
+    os_state.unit = "masked"
+    assert startup.autostart_status()["state"] == "disabled_by_os"
+    os_state.unit = "enabled"
+    assert startup.autostart_status(False)["state"] == "off"
+    assert ["systemctl", "--user", "disable", "ouroboros.service"] in os_state.calls
+
+
+@pytest.mark.parametrize("turned_off", ["Hidden=true", "X-GNOME-Autostart-enabled=false"])
+def test_linux_native_unit_is_not_masked_by_a_turned_off_leftover_entry(host, tmp_path, turned_off):
+    package, os_state = host
+    package("linux", native=True)
+    path = tmp_path / ".config/autostart/ouroboros.desktop"
+    path.parent.mkdir(parents=True)
+    leftover = '[Desktop Entry]\nType=Application\nExec="/home/me/Ouroboros.AppImage" --launch-intent automatic\n'
+    path.write_text(leftover + turned_off + "\n", encoding="utf-8")  # turned off in the desktop's startup settings
+    assert startup.autostart_status()["state"] == "off"
+    os_state.unit = "enabled"
+    assert startup.autostart_status()["state"] == "on"
+    path.write_text(leftover, encoding="utf-8")  # a live leftover still starts the other copy
+    assert startup.autostart_status()["state"] == "other_copy"
+
+
+def test_an_older_installed_unit_is_never_enabled_but_still_turns_off(host, tmp_path):
+    package, os_state = host
+    package("linux", native=True)
+    startup.NATIVE_UNIT.write_text(HISTORICAL_UNIT, encoding="utf-8")  # old deb/rpm, current managed code
+    command = next(line.partition("=")[2] for line in HISTORICAL_UNIT.splitlines() if line.startswith("ExecStart="))
+    assert parse_launch_options(shlex.split(command)[1:]).launch_intent == "owner"  # Panic would not hold it
+    for enable in (None, True):
+        status = startup.autostart_status(enable)
+        assert status["state"] == "unavailable" and status["reason"] == startup.UPDATE_PACKAGE
+    assert [call[2] for call in os_state.calls] == ["is-enabled", "is-enabled"]  # read, never enabled
+    os_state.unit = "enabled"  # registered earlier by hand: shown as it is, so the owner can turn it off
+    assert startup.autostart_status() == {"state": "on"}
+    path = tmp_path / ".config/autostart/ouroboros.desktop"  # a live entry of another copy beside it
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text('[Desktop Entry]\nType=Application\nExec="/home/me/Ouroboros.AppImage" --launch-intent automatic\n', encoding="utf-8")
+    assert startup.autostart_status() == {"state": "on"}  # not masked as other_copy: enabling is refused, so off must stay reachable
+    assert startup.autostart_status(False) == {"state": "off"}
+    assert not path.exists()
+    assert ["systemctl", "--user", "disable", "ouroboros.service"] in os_state.calls
+
+
+def test_linux_portable_disables_existing_native_registration_before_writing(host, tmp_path):
+    package, os_state = host
+    package("linux", appimage=True)
+    startup.NATIVE_UNIT.touch()
+    os_state.unit = "enabled"
+    assert startup.autostart_status()["state"] == "other_copy"
+    assert startup.autostart_status(True)["state"] == "on"
+    assert os_state.unit == "disabled"
+    assert (tmp_path / ".config/autostart/ouroboros.desktop").exists()
+
+
+@pytest.mark.parametrize("native", [False, True])
+def test_linux_refuses_a_second_registration_when_the_first_cannot_be_removed(host, tmp_path, monkeypatch, native):
+    package, os_state = host
+    package("linux", native=native, appimage=not native)
+    startup.NATIVE_UNIT.touch()
+    path = tmp_path / ".config/autostart/ouroboros.desktop"
+    if native:
+        path.parent.mkdir(parents=True)
+        path.mkdir()  # unlink must fail before systemctl enable can run
+    else:
+        os_state.unit = "enabled"
+        monkeypatch.setattr(startup, "_run", lambda argv, **kwargs: "enabled")
+    with pytest.raises(OSError):
+        startup.autostart_status(True)
+    assert ["systemctl", "--user", "enable", "ouroboros.service"] not in os_state.calls
+    assert not path.is_file()
+
+
+def test_linux_browser_fallback_still_configures_the_packaged_host(host, monkeypatch):
+    package, _ = host
+    package("linux")
+    monkeypatch.setenv("OUROBOROS_PRESENTATION", "browser_fallback")
+    assert startup.autostart_status(True)["state"] == "on"
+
+
+@pytest.mark.parametrize(("version", "reason"), [
+    ("7.1.9", "newer app build"), ("v7.1.12-rc.3", "newer app build"),
+    ("", "could not be confirmed"), ("unknown", "could not be confirmed"), ("7.2", "could not be confirmed"),
+])
+def test_old_or_unproven_launcher_cannot_register(host, monkeypatch, version, reason):
+    package, os_state = host
+    package("darwin")
+    monkeypatch.setenv("OUROBOROS_APP_VERSION", version)
+    for enable in (None, True, False):
+        status = startup.autostart_status(enable)
+        assert status["state"] == "unavailable" and reason in status["reason"]
+    assert os_state.calls == []
+
+
+@pytest.mark.parametrize("version", ["7.2.0", "7.2.0-rc.1", "v7.10.0-rc.2"])
+def test_a_prerelease_suffix_does_not_make_a_new_launcher_old(host, monkeypatch, version):
+    package, _ = host
+    package("darwin")
+    monkeypatch.setenv("OUROBOROS_APP_VERSION", version)
+    assert startup.autostart_status() == {"state": "off"}
+
+
+@pytest.mark.parametrize("kind", ["source_launcher", "source_server", "unstable_macos", "missing_appimage"])
+def test_unavailable_hosts_never_register(host, tmp_path, monkeypatch, kind):
+    package, os_state = host
+    exe = package("linux" if kind == "missing_appimage" else "darwin", appimage=kind == "missing_appimage")
+    if kind == "source_launcher":
+        monkeypatch.setenv("OUROBOROS_BUNDLE_DIR", str(tmp_path / "source"))
+    elif kind == "source_server":
+        monkeypatch.delenv("OUROBOROS_MANAGED_BY_LAUNCHER")
+    elif kind == "unstable_macos":
+        monkeypatch.setattr(startup, "is_unstable_macos_app_path", lambda path: True)
+    else:
+        exe.unlink()
+    result = startup.autostart_status(True)
+    assert result["state"] == "unavailable" and os_state.calls == []
+    if kind == "unstable_macos":
+        assert "Move Ouroboros to Applications" in result["reason"]
+
+
+def test_runtime_context_reports_host_lifecycle_even_for_a_remote_sender(host, tmp_path, monkeypatch):
+    from ouroboros import context
+
+    package, _ = host
+    package("linux")
+    startup.autostart_status(True)
+    env = SimpleNamespace(repo_dir=tmp_path, drive_root=tmp_path, drive_path=lambda name: tmp_path / name)
+    monkeypatch.setattr(context, "_runtime_budget_info", lambda *args: {})
+    rendered = context.build_runtime_section(env, {"metadata": {"client_surface": {"channel": "web"}}})
+    data = json.JSONDecoder().raw_decode(rendered.split("\n\n", 1)[1])[0]
+    assert data["runtime_env"]["autostart"] == "on"
+    assert data["runtime_env"]["keep_running_after_close"] is False
+
+
+def test_a_sign_in_start_keeps_a_saved_pause(tmp_path, monkeypatch):
+    from ouroboros import budget_pause
+    from supervisor import worker_chat_lane
+    from tests._budget_pause_exact_helpers import _install_queue, _parked
+
+    queue, _state, workers = _install_queue(tmp_path, monkeypatch)
+    _parked(tmp_path, monkeypatch)
+    assert queue.persist_queue_snapshot(reason="sign_out")
+    workers.PENDING.clear()
+    intent = parse_launch_options(["--launch-intent", "automatic"]).launch_intent
+    assert automatic_launch_allowed(intent, tmp_path, logging.getLogger(__name__))
+    assert queue.restore_pending_from_snapshot() == 1
+    monkeypatch.setattr(worker_chat_lane, "_pool", lambda: workers)
+    worker_chat_lane.auto_resume_after_restart()
+    assert workers.PENDING[0]["_budget_pause"]["exact_continuation"]
+    assert budget_pause.budget_pause_row(tmp_path, "pause-task")["state"] == budget_pause.STATE_PAUSED
+
+
+def test_native_unit_uses_automatic_intent():
+    """The unit new deb/rpm packages ship; the adapter enables it only once installed."""
+    assert "ExecStart=/opt/ouroboros/Ouroboros --launch-intent automatic" in SHIPPED_UNIT
diff --git a/tests/test_gateway_parity.py b/tests/test_gateway_parity.py
index 53db7bf5f..72b0f137d 100644
--- a/tests/test_gateway_parity.py
+++ b/tests/test_gateway_parity.py
@@ -33,6 +33,7 @@ from ouroboros.gateway.contracts import (
     QuizOption,
     DecisionRequest,
     DecisionResponse,
+    DesktopAutostartResponse,
     QuizOutbound,
     QuizStateOutbound,
     LogOutbound,
@@ -190,6 +191,7 @@ def test_gateway_contract_endpoint_index_matches_router_and_types(tmp_path):
         "ProviderTestRequest",
         "ProviderTestResponse",
         "UiPreferencesResponse",
+        "DesktopAutostartResponse",
         "ChatInbound",
         "ChatOutbound",
         "PhotoOutbound",
@@ -254,7 +256,7 @@ def test_gateway_contract_endpoint_index_matches_router_and_types(tmp_path):
                 UploadResponse, TaskCreateResponse, AttachmentManifestEntry,
                 DecisionRequest, DecisionResponse, LinkAction, LinksOutbound, QuizOption, QuizOutbound, QuizStateOutbound,
                 # widgets-lifecycle W1b: the owner's per-card start-mode override is checked field by field.
-                UiPreferencesResponse,
+                UiPreferencesResponse, DesktopAutostartResponse,
                 ActiveDirectTurn, ActiveChatActivity, TypingOutbound,
                 StateResponse, UpdateMergePlan,
                 UpdatePreflightRequest, UpdatePreflightResponse, UpdateApplyRequest,
diff --git a/tests/test_host_service_api.py b/tests/test_host_service_api.py
index 5be3d734d..b743c9f53 100644
--- a/tests/test_host_service_api.py
+++ b/tests/test_host_service_api.py
@@ -131,7 +131,7 @@ subscribe_events: [{", ".join(topics)}]
         requested_keys=[],
         granted_permissions=list(permissions or []),
         requested_permissions=[
-            *(permission for permission in ("inject_chat", "presence") if permission in manifest_perms),
+            *(permission for permission in ("inject_chat", "presence", "notify_owner") if permission in manifest_perms),
             *(
                 f"subscribe_event:{topic}"
                 for topic in topics
diff --git a/tests/test_host_service_notify.py b/tests/test_host_service_notify.py
new file mode 100644
index 000000000..da0a59e84
--- /dev/null
+++ b/tests/test_host_service_notify.py
@@ -0,0 +1,192 @@
+"""The owner-notice route of the Host Service (``POST /notify``, ``gateway/host_notify.py``).
+
+A skill holding the owner's ``notify_owner`` grant tells the owner one thing, now:
+one System row in the owner's chat (``system_type="skill_notice"``) signed
+``Notice · <skill>``, written through the seam every host row uses, so it reaches
+history, transports and the next turn like any System row and wakes no model. A
+missing grant, a disabled skill, a bad body or the rate lane refuse before anything
+is written; a write that cannot be confirmed answers one 503.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import pathlib
+import threading
+import types
+
+import pytest
+from starlette.testclient import TestClient
+
+from ouroboros.gateway.host_service import create_host_service_app
+from tests.test_host_service_api import _seed_token
+
+HEADERS = {"X-Skill-Token": "tok"}
+
+
+@pytest.fixture
+def chat(tmp_path, monkeypatch):
+    """The real message bus bound to this data root, as the running server holds it."""
+    from supervisor import message_bus
+
+    frames, published = [], []
+    bridge = message_bus.LocalChatBridge({})
+    bridge._broadcast_fn = frames.append
+    monkeypatch.setattr(message_bus, "DATA_DIR", tmp_path)
+    monkeypatch.setattr(message_bus, "_BRIDGE", bridge)
+    monkeypatch.setattr(message_bus, "load_state", lambda: {"owner_id": 7})
+    monkeypatch.setattr(message_bus, "publish_event", lambda topic, data: published.append((topic, data)))
+    return types.SimpleNamespace(frames=frames, published=published)
+
+
+def _client(tmp_path: pathlib.Path, *, granted: bool = True):
+    _seed_token(tmp_path, skill="cal", token="tok", permissions=["notify_owner"] if granted else [],
+                manifest_permissions=["notify_owner"])
+    app = create_host_service_app(tmp_path)
+    return TestClient(app), app
+
+
+def _rows(tmp_path: pathlib.Path) -> list[dict]:
+    path = tmp_path / "logs" / "chat.jsonl"
+    if not path.exists():
+        return []
+    return [json.loads(line) for line in path.read_text(encoding="utf-8").splitlines() if line.strip()]
+
+
+def test_identity_advertises_the_notify_route(tmp_path: pathlib.Path) -> None:
+    client, _app = _client(tmp_path)
+    response = client.get("/identity", headers=HEADERS)
+    assert response.status_code == 200 and response.json()["notify_version"] == 1
+
+
+def test_a_notice_is_one_signed_system_row_in_the_owners_chat(tmp_path: pathlib.Path, chat) -> None:
+    client, _app = _client(tmp_path)
+    response = client.post("/notify", headers=HEADERS,
+                           json={"text": "  ⏰ Meeting with Ivan in 15 min ", "source": "Ouroboros"})
+    assert response.status_code == 200, response.text
+    body = response.json()
+    assert body["ok"] is True and body["chat_id"] == 1 and body["ts"]
+    [row] = _rows(tmp_path)
+    assert (row["direction"], row["type"], row["chat_id"], row["task_id"]) == ("system", "skill_notice", 1, "")
+    assert row["text"] == "Notice · cal\n⏰ Meeting with Ivan in 15 min", "the host signs with the skill's own name"
+    assert row["ts"] == body["ts"]
+    [frame] = [f for f in chat.frames if f.get("type") == "chat"]
+    assert (frame["role"], frame["system_type"], frame["source"]) == ("system", "skill_notice", "cal")
+    assert [topic for topic, _ in chat.published] == ["chat.outbound"]
+
+
+def test_a_notice_goes_to_the_bound_owner_chat(tmp_path: pathlib.Path, chat, monkeypatch) -> None:
+    from supervisor import state
+
+    monkeypatch.setattr(state, "control_in_copy", lambda _path, _key: (True, 5_000_000_001))
+    client, _app = _client(tmp_path)
+    assert client.post("/notify", headers=HEADERS, json={"text": "Backup finished"}).json()["chat_id"] == 5_000_000_001
+    assert _rows(tmp_path)[0]["chat_id"] == 5_000_000_001
+
+
+def test_notices_are_refused_before_anything_is_written(tmp_path: pathlib.Path, chat) -> None:
+    from ouroboros.skill_loader import GRANTS_FILENAME, load_skill_grants, save_enabled, skill_state_dir
+
+    client, _app = _client(tmp_path, granted=False)
+    refused = client.post("/notify", headers=HEADERS, json={"text": "hi"})
+    assert refused.status_code == 403 and "notify_owner" in refused.json()["error"]
+    assert client.post("/notify", json={"text": "hi"}).status_code == 403, "no token"
+    client, _app = _client(tmp_path)
+    assert client.post("/notify", headers=HEADERS, json={"text": "granted"}).status_code == 200
+    grant_file = skill_state_dir(tmp_path, "cal") / GRANTS_FILENAME
+    revoked = {**json.loads(grant_file.read_text(encoding="utf-8")), "granted_permissions": []}
+    grant_file.write_text(json.dumps(revoked), encoding="utf-8")  # the owner's grant no longer holds
+    assert load_skill_grants(tmp_path, "cal")["granted_permissions"] == []
+    assert client.post("/notify", headers=HEADERS, json={"text": "revoked"}).status_code == 403
+    _client(tmp_path)  # granted again
+    save_enabled(tmp_path, "cal", False)
+    disabled = client.post("/notify", headers=HEADERS, json={"text": "disabled"})
+    assert disabled.status_code == 403 and "disabled" in disabled.json()["error"]
+    assert [row["text"] for row in _rows(tmp_path)] == ["Notice · cal\ngranted"]
+
+
+def test_bad_bodies_and_the_rate_lane_write_nothing(tmp_path: pathlib.Path, chat) -> None:
+    client, app = _client(tmp_path)
+    for request in ({"content": b"not json"}, {"json": ["x"]}, {"json": {"text": "   "}}, {"json": {"text": 5}},
+                    {"json": {}}, {"json": {"text": "x" * 401}}):
+        assert client.post("/notify", headers=HEADERS, **request).status_code == 400, request
+    assert _rows(tmp_path) == []
+    assert client.post("/notify", headers=HEADERS, json={"text": "x" * 400}).status_code == 200
+    app.state.host_service_context.rate_limiter.allow = lambda key: key != "cal:notify"
+    assert client.post("/notify", headers=HEADERS, json={"text": "again"}).status_code == 429
+    assert len(_rows(tmp_path)) == 1
+
+
+def test_without_a_chat_writer_the_notice_is_one_503_and_nothing_is_written(tmp_path, monkeypatch) -> None:
+    """A provider-less install never starts the supervisor, so no chat writer exists (disclosed)."""
+    from supervisor import message_bus
+
+    client, _app = _client(tmp_path)
+    monkeypatch.setattr(message_bus, "DATA_DIR", None)
+    response = client.post("/notify", headers=HEADERS, json={"text": "hi"})
+    assert response.status_code == 503
+    assert response.json()["status"] == "not_confirmed" and "nothing was written" in response.json()["error"]
+    monkeypatch.setattr(message_bus, "DATA_DIR", tmp_path / "another-install")
+    assert client.post("/notify", headers=HEADERS, json={"text": "hi"}).status_code == 503
+    assert _rows(tmp_path) == []
+
+
+def test_an_unconfirmed_write_is_the_same_503(tmp_path: pathlib.Path, chat, monkeypatch) -> None:
+    from supervisor import message_bus
+
+    def failing_send(*_args, **_kwargs):
+        raise RuntimeError("canonical message acceptance could not be persisted")
+
+    monkeypatch.setattr(message_bus, "send_with_budget", failing_send)
+    client, _app = _client(tmp_path)
+    response = client.post("/notify", headers=HEADERS, json={"text": "hi"})
+    assert response.status_code == 503
+    assert response.json() == {"ok": False, "status": "not_confirmed",
+                               "error": "write not confirmed; check the owner's chat before sending it again"}
+
+
+def test_the_next_turn_reads_a_notice_as_a_host_fact(tmp_path: pathlib.Path, chat) -> None:
+    from ouroboros.memory import Memory
+
+    client, _app = _client(tmp_path)
+    assert client.post("/notify", headers=HEADERS, json={"text": "Meeting in 15 min"}).status_code == 200
+    memory = Memory(drive_root=tmp_path)
+    entries, _coverage = memory.read_unconsolidated_chat(memory.load_dialogue_meta(), 50)
+    assert "[skill_notice] Notice · cal" in memory.summarize_chat(entries)
+
+
+def test_notify_token_discovery_does_not_hold_the_asgi_loop(tmp_path: pathlib.Path, chat, monkeypatch) -> None:
+    import httpx
+
+    _client_unused, app = _client(tmp_path)
+    ctx = app.state.host_service_context
+    authenticate = ctx.authenticate_token_payload
+    started, release = threading.Event(), threading.Event()
+
+    def slow_auth(token):
+        started.set()
+        assert release.wait(5), "test must release the simulated disk read"
+        return authenticate(token)
+
+    monkeypatch.setattr(ctx, "authenticate_token_payload", slow_auth)
+
+    async def exercise():
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://test") as client:
+            notice = asyncio.create_task(client.post("/notify", headers=HEADERS, json={"text": "test"}))
+            try:
+                assert await asyncio.to_thread(started.wait, 3)
+                # If auth runs inline, this coroutine cannot resume until release.
+                assert not release.is_set()
+            finally:
+                release.set()
+            assert (await notice).status_code == 200
+
+    timer = threading.Timer(2, release.set)
+    timer.start()  # fail boundedly instead of deadlocking if auth regresses to inline I/O
+    try:
+        asyncio.run(exercise())
+    finally:
+        release.set()
+        timer.cancel()
+        timer.join()
diff --git a/tests/test_notifications_static.py b/tests/test_notifications_static.py
index f61497354..2ea0d1642 100644
--- a/tests/test_notifications_static.py
+++ b/tests/test_notifications_static.py
@@ -53,6 +53,15 @@ def test_notification_controls_are_client_local():
         )
 
 
+def test_the_important_toggle_names_everything_it_silences():
+    """Reminders and skill notices ring under ``important`` (no category of their own),
+    so the one checkbox that silences their banners says so; the chat rows stay."""
+    assert "systemType === 'reminder' || systemType === 'skill_notice'" in _read("web/modules/notifications.js")
+    panel = _appearance_panel(_read("web/modules/settings_ui.js"))
+    label = re.search(r'data-notify-pref="important">\s*([^<]+?)\s*</label>', panel).group(1)
+    assert "while it works" in label and "reminders" in label and "skill notices" in label, label
+
+
 def test_settings_mounts_the_notifier_like_the_theme():
     source = _read("web/modules/settings.js")
     assert "getNotifier().mountSettings(page)" in source
diff --git a/tests/test_per_skill_version_resync.py b/tests/test_per_skill_version_resync.py
index 4de51e5da..72b1e3dca 100644
--- a/tests/test_per_skill_version_resync.py
+++ b/tests/test_per_skill_version_resync.py
@@ -374,14 +374,14 @@ def test_telegram_owner_wait_upgrade_reseeds_current_version(tmp_path, fake_log)
     )
 
     assert upgraded == 1
-    assert "version: 1.2.9" in (installed / "SKILL.md").read_text(encoding="utf-8")
+    assert "version: 1.2.10" in (installed / "SKILL.md").read_text(encoding="utf-8")
     for path in ("plugin.py", "lib/telegram_quiz.py", "lib/telegram_state.py"):
         assert (installed / path).read_bytes() == (seed_dir / "telegram" / path).read_bytes()
 
 
 @pytest.mark.serial
 @pytest.mark.parametrize("name,source,old_version,new_version", [
-    ("telegram", "d918b6973235013e5d7b9d78fe98701979396d4f", "1.2.6", "1.2.9"),
+    ("telegram", "d918b6973235013e5d7b9d78fe98701979396d4f", "1.2.6", "1.2.10"),
     ("unix_computer_use", "162ad3fe6791fcaf6cf625e6b0c50d3a2a27e7f8", "0.4.1", "0.4.2"),
 ])
 def test_resync_delivers_payload_from_real_previous_seed(
diff --git a/tests/test_room_provenance_delta.py b/tests/test_room_provenance_delta.py
index e079d94cd..4f345b3e1 100644
--- a/tests/test_room_provenance_delta.py
+++ b/tests/test_room_provenance_delta.py
@@ -154,7 +154,10 @@ def test_block_format_retains_author_direction_transport_and_body(direction):
     assert new.replace("[room=Project Alpha [chat_id=1500]] ", "", 1).encode() == old.encode()
     assert new.endswith(row["text"])
     assert "provider=mail; account=acct; conversation=conv; thread=thread; delivery=accepted" in new
-    assert ("Ouroboros" if direction in {"out", "outgoing", "system"} else "Alex") in new
+    # A host-written System row is attributed to the host, as dialogue_evidence does; only
+    # outgoing speech is Ouroboros's.
+    author = {"out": "Ouroboros", "outgoing": "Ouroboros", "system": "System"}.get(direction, "Alex")
+    assert f"{author} [provider=mail" in new
 
 
 @pytest.mark.parametrize("rooms", [(1, 1, 1, 1), (1, 1500, 987654, None)])
diff --git a/tests/test_schedule_followup.py b/tests/test_schedule_followup.py
index 0f1bd5f38..ad75ae5ba 100644
--- a/tests/test_schedule_followup.py
+++ b/tests/test_schedule_followup.py
@@ -11,6 +11,8 @@ re-fired).
 
 from __future__ import annotations
 
+import pytest
+
 import datetime
 import pathlib
 
@@ -224,6 +226,67 @@ def test_schedule_followup_registers_a_one_shot_entry(tmp_path):
     assert record["task"]["context"] == "plan review for root-1 was quorum-unreachable"
 
 
+def test_schedule_followup_notify_leaves_a_note_in_the_one_table(tmp_path):
+    """notify=true writes a ``kind: "notify"`` row: the agent's words and when they were
+    written, independent work, counted in the same cap; no future task text is stored."""
+    from supervisor import queue
+
+    ctx = _ctx(tmp_path)
+    out = _followup(ctx, notify=True, relation="related", objective="Call mother")
+    assert out.startswith("FOLLOWUP_SCHEDULED: note "), out
+    assert "relation='related' ignored" in out, "a note carries no money or deadline"
+    [record] = queue.list_scheduled_tasks(tmp_path / "data")["tasks"]
+    assert record["kind"] == "notify" and record["source"] == "task_followup"
+    assert record["notification"]["text"] == "Call mother" and record["notification"]["set_at"]
+    assert record["followup_relation"]["kind"] == "independent"
+    assert record["followup_origin"]["task_id"] == "root-1"
+    assert "text" not in record["task"], "a note has no future task objective"
+    assert _followup(ctx, notify=True, objective="Second").startswith("FOLLOWUP_SCHEDULED")
+    assert "FOLLOWUP_CAP_REACHED" in _followup(ctx, objective="Third"), "notes and wake-ups share the cap"
+
+
+@pytest.mark.parametrize(("metadata", "contract", "chat_id"), [
+    ({"presence": {"binding_id": "b" * 32}}, None, 1),
+    ({"presence_binding_authority": {"binding_id": "mail-room"}}, None, 1),
+    ({}, {"capability_ceiling": {"tools": ["schedule_followup"]}}, 1),  # a lost carrier under a ceiling
+    ({}, None, -1001),  # agent-to-agent
+], ids=["presence-speaker", "presence-work", "lost-carrier", "a2a"])
+def test_notes_are_refused_to_callers_that_do_not_speak_for_the_owner(tmp_path, metadata, contract, chat_id):
+    from supervisor.queue import list_scheduled_tasks
+
+    ctx = _ctx(tmp_path)
+    ctx.task_metadata.update(metadata)
+    if contract is not None:
+        ctx.task_contract.update(contract)
+    ctx.current_chat_id = chat_id
+    assert "FOLLOWUP_NOTIFY_REFUSED" in _followup(ctx, notify=True, objective="Wake owner")
+    assert list_scheduled_tasks(ctx.drive_root)["tasks"] == []
+
+
+def test_a_note_from_a_consciousness_root_in_main_is_a_legitimate_contact(tmp_path):
+    """No room check: a root consciousness started (neither a Project nor owner ingress) may leave one."""
+    ctx = _ctx(tmp_path)
+    ctx.current_chat_id = 1
+    ctx.task_metadata["initiator"] = "consciousness"
+    assert _followup(ctx, notify=True, objective="The kettle is on.").startswith("FOLLOWUP_SCHEDULED: note ")
+
+
+def test_a_delegated_subagent_cannot_leave_a_note(tmp_path):
+    ctx = _ctx(tmp_path, role="subagent")
+    assert "FOLLOWUP_SUBAGENT_REFUSED" in _followup(ctx, notify=True, objective="Wake owner")
+
+
+def test_schedule_followup_notify_refuses_context_and_non_boolean_mode(tmp_path):
+    ctx = _ctx(tmp_path)
+    assert "FOLLOWUP_NOTIFY_CONTEXT" in _followup(ctx, notify=True, context="hidden")
+    assert "FOLLOWUP_NOTIFY_INVALID" in _followup(ctx, notify="yes")
+    assert "FOLLOWUP_TEXT_TOO_LONG" in _followup(ctx, notify=True, objective="x" * 4001)
+    from supervisor import queue
+
+    assert queue.list_scheduled_tasks(tmp_path / "data")["tasks"] == []
+    assert _followup(ctx, notify=None).startswith("FOLLOWUP_SCHEDULED: follow-up "), "null is the default wake-up"
+
+
 def test_a_timer_follow_up_is_framed_as_task_authored_and_its_note_never_enters_the_owner_corpus(tmp_path):
     """TZ-2 B3: the successor of a timer follow-up reads the same ``objective_author``
     stamp a promote / route_to_project carries, so its first turn is framed as drafted
diff --git a/tests/test_schedule_notes.py b/tests/test_schedule_notes.py
new file mode 100644
index 000000000..e5f7ca6ce
--- /dev/null
+++ b/tests/test_schedule_notes.py
@@ -0,0 +1,311 @@
+"""Notes (``kind: "notify"`` rows): the mind's own words, shown to the owner at their time.
+
+The scheduler tick consumes a due note in its one table write and, after the lock,
+``supervisor/schedule_notes.py`` puts the words in the owner's chat as one signed
+``reminder`` System row through the existing ``send_with_budget`` seam: no model
+call, no task. These tests pin the accepted contract (DESIGN "Chat authorship and
+System rows"): consumed before shown, shown once, visible in history and in the next
+turn's context, both times after downtime, and never a model task.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import types
+
+import pytest
+
+ONCE_PAST = {"type": "once", "run_at": "2000-01-01T00:00:00+00:00"}
+
+
+@pytest.fixture
+def host(tmp_path, monkeypatch):
+    """The real scheduler tick, message bus and durable chat log on a temp root."""
+    from supervisor import message_bus, queue
+
+    frames, published = [], []
+    bridge = message_bus.LocalChatBridge({})
+    bridge._broadcast_fn = frames.append
+    monkeypatch.setattr(message_bus, "DATA_DIR", tmp_path)
+    monkeypatch.setattr(message_bus, "get_bridge", lambda: bridge)
+    monkeypatch.setattr(message_bus, "load_state", lambda: {"owner_id": 7})
+    monkeypatch.setattr(message_bus, "publish_event", lambda topic, data: published.append((topic, data)))
+    queue.init(tmp_path)
+    pending: list = []
+    queue.init_queue_refs(pending, {}, {"value": 0})
+    return types.SimpleNamespace(root=tmp_path, queue=queue, pending=pending, frames=frames, published=published)
+
+
+def _note(queue, schedule_id="note-1", *, text="Call mother", trigger=None, source="task_followup", **extra):
+    record = {"id": schedule_id, "name": "Reminder of task t1", "description": text, "kind": "notify",
+              "source": source, "enabled": True, "timezone": "", "trigger": trigger or dict(ONCE_PAST),
+              "notification": {"text": text, "set_at": "1999-12-31T22:00:00+00:00"}, **extra}
+    relation = {"kind": "independent", "declared_by": "t1", "revision": "r1"}
+    return queue.upsert_scheduled_task(
+        record, host_followup={"followup_origin": {"task_id": "t1", "root_task_id": "t1"}, "followup_relation": relation})
+
+
+def _chat_rows(root):
+    path = root / "logs" / "chat.jsonl"
+    if not path.exists():
+        return []
+    return [json.loads(line) for line in path.read_text(encoding="utf-8").splitlines() if line.strip()]
+
+
+def _row(queue, root, schedule_id="note-1"):
+    return next(r for r in queue.list_scheduled_tasks(root)["tasks"] if r["id"] == schedule_id)
+
+
+def test_a_due_note_is_one_signed_system_row_and_never_a_task(host):
+    _note(host.queue)
+    host.queue.check_scheduled_tasks()
+    host.queue.check_scheduled_tasks()  # a consumed note is history: a repeated tick shows nothing new
+    assert host.pending == [], "no task is admitted and so no model call is made"
+    [row] = _chat_rows(host.root)
+    assert (row["direction"], row["type"], row["chat_id"], row["task_id"]) == ("system", "reminder", 1, "")
+    signature, body = row["text"].split("\n", 1)
+    assert signature.startswith("Reminder · Ouroboros · written ") and " · for " in signature
+    assert body == "Call mother", "the mind's words ride verbatim"
+    [frame] = [f for f in host.frames if f.get("type") == "chat"]
+    assert (frame["role"], frame["system_type"], frame["source"]) == ("system", "reminder", "Ouroboros")
+    assert frame["set_at"] == "1999-12-31T22:00:00+00:00"
+    assert frame["scheduled_for"] == ONCE_PAST["run_at"] and frame["delivered_at"]
+    assert [topic for topic, _ in host.published] == ["chat.outbound"], "transports see it like any System row"
+    done = _row(host.queue, host.root)
+    assert done["enabled"] is False and done["completed_at"] and done["next_run_at"] == ""
+    assert done["last_error"] == "" and not done.get("last_task_id") and "occurrence" not in done
+
+
+def test_an_overdue_note_still_arrives_and_shows_both_times(host):
+    _note(host.queue)  # due in 2000: the process was "off" for decades
+    host.queue.check_scheduled_tasks()
+    signature = _chat_rows(host.root)[0]["text"].split("\n", 1)[0]
+    assert " · for Jan 1 " in signature and " · delivered " in signature, signature
+
+
+def test_an_overdue_note_reaches_extension_subscribers_on_a_provider_boot(host, monkeypatch):
+    """The first scheduler tick may consume an overdue note and the event bus keeps no
+    history, so a provider boot attaches the extensions' subscriptions (Telegram's
+    ``chat.outbound``) before it starts the supervisor. Real lifespan, scheduler tick,
+    message bus and global event bus; the supervisor start runs that first tick to its
+    end, the race's worst case (extension loading slower than supervisor init)."""
+    import threading
+
+    from starlette.testclient import TestClient
+
+    import server as srv
+    from ouroboros import event_bus, extension_loader
+    from supervisor import message_bus
+    from tests._shared import clean_extension_runtime_state
+    from tests.test_extensions_api import _patch_lifespan_for_drive_root_test
+
+    monkeypatch.setattr(message_bus, "publish_event", event_bus.publish_event)  # the real bus, not the capture
+    _note(host.queue)
+    monkeypatch.setattr(srv.app.app.state, "drive_root", host.root, raising=False)
+    monkeypatch.setattr(srv.app.app.state, "repo_dir", host.root / "repo", raising=False)
+    _patch_lifespan_for_drive_root_test(monkeypatch, srv, {})
+    monkeypatch.setattr(srv, "has_startup_ready_provider", lambda _settings: True)
+    monkeypatch.setattr(srv, "_boot_managed_update_tasks", lambda: None)
+    delivered = []
+
+    def reload_extensions(_root, _reader, *, repo_path=None):
+        event_bus.get_global_event_bus().subscribe("telegram", event_bus.CHAT_OUTBOUND, delivered.append)
+        return {}
+
+    def start_supervisor(_settings):
+        first_tick = threading.Thread(target=host.queue.check_scheduled_tasks)
+        first_tick.start()
+        first_tick.join(timeout=30)
+        return True
+
+    monkeypatch.setattr(extension_loader, "reload_all", reload_extensions)
+    monkeypatch.setattr(srv, "_start_supervisor_if_needed", start_supervisor)
+    try:
+        with TestClient(srv.app):
+            pass
+    finally:
+        event_bus.init_global_event_bus()
+        clean_extension_runtime_state()
+    assert len(_chat_rows(host.root)) == 1 and _row(host.queue, host.root)["completed_at"]
+    assert [event.get("system_type") for event in delivered] == ["reminder"], "the late subscriber missed the note"
+
+
+def test_the_note_is_consumed_on_disk_before_it_is_shown_and_never_retried(host, monkeypatch):
+    """A crash or an unknown write after consumption may lose one note; it can never show twice."""
+    from supervisor import message_bus
+
+    _note(host.queue)
+    seen = []
+
+    def crashing_send(*_args, **_kwargs):
+        seen.append(_row(host.queue, host.root))  # what a restart would read at this instant
+        raise RuntimeError("canonical message acceptance could not be persisted")
+
+    monkeypatch.setattr(message_bus, "send_with_budget", crashing_send)
+    host.queue.check_scheduled_tasks()
+    host.queue.check_scheduled_tasks()
+    assert len(seen) == 1 and seen[0]["completed_at"] and seen[0]["enabled"] is False
+    assert _row(host.queue, host.root)["last_error"] == "delivery not confirmed"
+    assert _chat_rows(host.root) == []
+
+
+def test_an_unconfirmed_note_says_so_to_the_model_and_in_activity(host, monkeypatch):
+    """The stored delivery error is on both schedule surfaces: the model's bounded
+    ``manage_schedules`` list and the owner's Activity rows. Still never retried."""
+    from ouroboros.tools.followup import _manage_schedules
+    from supervisor import message_bus, queue_schedules
+
+    def unconfirmed(*_args, **_kwargs):
+        raise RuntimeError("canonical message acceptance could not be persisted")
+
+    _note(host.queue)
+    _note(host.queue, "note-2", trigger={"type": "once", "run_at": "2999-01-01T00:00:00+00:00"})
+    monkeypatch.setattr(message_bus, "send_with_budget", unconfirmed)
+    host.queue.check_scheduled_tasks()
+    ctx = types.SimpleNamespace(task_metadata={}, drive_root=host.root, budget_drive_root=host.root, task_id="t")
+    listed = {row["id"]: row for row in json.loads(_manage_schedules(ctx, action="list"))["tasks"]}
+    assert (listed["note-1"]["status"], listed["note-1"]["last_error"]) == ("consumed", "delivery not confirmed")
+    assert not listed["note-2"]["last_error"], "a row with no stored error says none"
+    activity = queue_schedules.schedule_activity_projection(host.queue.list_scheduled_tasks(host.root))["tasks"]
+    assert {row["id"]: row.get("last_error") for row in activity}["note-1"] == "delivery not confirmed"
+    long_error = {"id": "x", "trigger": {"type": "cron", "expr": "0 9 * * *"}, "last_error": "E" * 500}
+    assert len(queue_schedules.schedule_tool_projection({"tasks": [long_error]})["tasks"][0]["last_error"]) <= 96
+
+
+def test_a_failed_table_write_shows_nothing_and_the_note_stays_due(host, monkeypatch):
+    from supervisor import queue_schedules
+
+    _note(host.queue)
+    real_write = queue_schedules._write_scheduled_tasks
+
+    def refuse(*_args, **_kwargs):
+        raise OSError("scheduled task store write returned False")
+
+    monkeypatch.setattr(queue_schedules, "_write_scheduled_tasks", refuse)
+    with pytest.raises(OSError):
+        host.queue.check_scheduled_tasks()
+    assert _chat_rows(host.root) == [] and _row(host.queue, host.root)["enabled"] is True
+    monkeypatch.setattr(queue_schedules, "_write_scheduled_tasks", real_write)
+    host.queue.check_scheduled_tasks()
+    assert len(_chat_rows(host.root)) == 1
+
+
+def test_a_cron_note_collapses_missed_points_into_one_and_moves_on(host):
+    from supervisor import queue_schedules
+
+    _note(host.queue, trigger={"type": "cron", "expr": "0 9 * * *"})
+    store = host.queue.load_schedule_store(host.root)
+    store["tasks"][0]["next_run_at"] = "2000-01-01T09:00:00+00:00"  # every morning since 2000 was missed
+    queue_schedules._write_scheduled_tasks(store, host.root)
+    host.queue.check_scheduled_tasks()
+    host.queue.check_scheduled_tasks()
+    assert len(_chat_rows(host.root)) == 1
+    row = _row(host.queue, host.root)
+    assert row["enabled"] is True and not row.get("completed_at") and row["next_run_at"] > "2026"
+
+
+def test_a_cron_note_that_cannot_advance_is_never_shown(host):
+    from supervisor import queue_schedules
+
+    _note(host.queue, trigger={"type": "cron", "expr": "0 9 * * *"})
+    store = host.queue.load_schedule_store(host.root)
+    store["tasks"][0].update(next_run_at="2000-01-01T09:00:00+00:00", trigger={"type": "cron", "expr": "not a cron"})
+    queue_schedules._write_scheduled_tasks(store, host.root)
+    host.queue.check_scheduled_tasks()
+    host.queue.check_scheduled_tasks()
+    assert _chat_rows(host.root) == []
+    assert _row(host.queue, host.root)["last_error"]
+
+
+def test_the_owner_governs_a_note_like_any_schedule(host):
+    _note(host.queue)
+    common = {"reason": "owner chose it in Activity", "actor": "owner:gateway", "drive_root": host.root}
+    assert host.queue.mutate_scheduled_task("disable", "note-1", **common)["status"] == "updated"
+    host.queue.check_scheduled_tasks()
+    assert _chat_rows(host.root) == []
+    assert host.queue.mutate_scheduled_task("restore", "note-1", **common)["status"] == "updated"
+    host.queue.check_scheduled_tasks()
+    assert len(_chat_rows(host.root)) == 1
+    _note(host.queue, "note-2", trigger={"type": "once", "run_at": "2999-01-01T00:00:00+00:00"})
+    outcome = host.queue.mutate_scheduled_task("delete", "note-2", **common)
+    assert outcome["status"] == "deleted" and outcome["changed"] is True, "a note owes no task: removed outright"
+
+
+def test_history_shows_the_row_and_only_live_frames_ring(host):
+    """Reopening the chat replays the row through history, which never reaches the notifier
+    (DEVELOPMENT "notifications ring for live events only"); the row itself stays visible."""
+    from ouroboros.gateway.history import make_chat_history_endpoint
+
+    _note(host.queue)
+    host.queue.check_scheduled_tasks()
+    endpoint = make_chat_history_endpoint(host.root)
+    response = asyncio.run(endpoint(types.SimpleNamespace(query_params={"chat_id": "1"})))
+    messages = json.loads(response.body)["messages"]
+    [replayed] = [m for m in messages if m.get("system_type") == "reminder"]
+    assert replayed["role"] == "system" and replayed["text"].endswith("\nCall mother")
+
+
+def test_the_next_turn_reads_the_note_as_a_host_fact(host):
+    from ouroboros.memory import Memory
+
+    _note(host.queue)
+    host.queue.check_scheduled_tasks()
+    memory = Memory(drive_root=host.root)
+    entries, _coverage = memory.read_unconsolidated_chat(memory.load_dialogue_meta(), 50)
+    rendered = memory.summarize_chat(entries)
+    assert "📋 " in rendered and "[reminder] Reminder · Ouroboros · written " in rendered, rendered
+
+
+def test_a_note_never_becomes_a_model_task(host):
+    stored = _note(host.queue)
+    with pytest.raises(ValueError, match="note"):
+        host.queue._task_from_schedule(stored)
+
+
+def test_a_note_from_another_source_keeps_its_own_author(host):
+    """The voice follows authorship: only the mind's own follow-up is signed Ouroboros."""
+    _note(host.queue, source="owner")
+    host.queue.check_scheduled_tasks()
+    assert _chat_rows(host.root)[0]["text"].startswith("Reminder · owner · written ")
+
+
+def test_note_label_reads_both_times_in_the_schedule_zone():
+    from supervisor.schedule_notes import note_text
+
+    note = {"text": "Call mother", "set_at": "2026-10-03T11:05:00+00:00",
+            "scheduled_for": "2026-10-03T12:00:00+00:00", "timezone": "Europe/Moscow", "author": "Ouroboros"}
+    assert note_text(note, "2026-10-03T12:00:20+00:00") == (
+        "Reminder · Ouroboros · written Oct 3 14:05 · for Oct 3 15:00 (UTC+3)\nCall mother")
+    assert note_text(note, "2026-10-04T06:12:00+00:00") == (
+        "Reminder · Ouroboros · written Oct 3 14:05 · for Oct 3 15:00 · delivered Oct 4 09:12 (UTC+3)\nCall mother")
+    assert note_text({**note, "set_at": "", "timezone": "UTC"}, "2026-10-03T12:00:00+00:00") == (
+        "Reminder · Ouroboros · for Oct 3 12:00 (UTC)\nCall mother")
+
+
+@pytest.mark.parametrize(("zone", "set_at", "due", "delivered", "label"), [
+    # Clocks go back at 01:00Z: due 02:30 summer time, shown an hour later at 02:30 winter time.
+    ("Europe/Berlin", "2026-10-24T10:00:00Z", "2026-10-25T00:30:00Z", "2026-10-25T01:30:00Z",
+     "written Oct 24 12:00 (UTC+2) · for Oct 25 02:30 (UTC+2) · delivered Oct 25 02:30 (UTC+1)"),
+    ("America/New_York", "2026-10-31T12:00:00-04:00", "2026-11-01T01:30:00-04:00", "2026-11-01T01:30:00-05:00",
+     "written Oct 31 12:00 (UTC-4) · for Nov 1 01:30 (UTC-4) · delivered Nov 1 01:30 (UTC-5)"),
+    # On time, but written before the change: each time keeps its own offset.
+    ("Europe/Berlin", "2026-10-24T10:00:00Z", "2026-10-25T02:00:00Z", "2026-10-25T02:00:10Z",
+     "written Oct 24 12:00 (UTC+2) · for Oct 25 03:00 (UTC+1)"),
+])
+def test_note_label_across_a_dst_change_compares_instants_and_names_each_offset(zone, set_at, due, delivered, label):
+    from supervisor.schedule_notes import note_text
+
+    note = {"text": "Call mother", "set_at": set_at, "scheduled_for": due, "timezone": zone, "author": "Ouroboros"}
+    assert note_text(note, delivered) == f"Reminder · Ouroboros · {label}\nCall mother"
+
+
+@pytest.mark.parametrize(("stored", "expected"), [
+    ((True, 5_000_000_001), 5_000_000_001),  # a headless install's first owner transport
+    ((True, None), 1), ((False, 77), 1), ((True, 0), 1), ((True, -1001), 1), ((True, "x"), 1),
+])
+def test_notes_go_to_the_owner_chat_else_main(tmp_path, monkeypatch, stored, expected):
+    from supervisor import schedule_notes, state
+
+    monkeypatch.setattr(state, "control_in_copy", lambda _path, _key: stored)
+    assert schedule_notes.owner_chat_id(tmp_path) == expected
diff --git a/tests/test_schedule_occurrence.py b/tests/test_schedule_occurrence.py
index 3cbf51a4b..54b05ab57 100644
--- a/tests/test_schedule_occurrence.py
+++ b/tests/test_schedule_occurrence.py
@@ -337,6 +337,68 @@ def test_dispatch_barrier_restore_and_settlement(q, monkeypatch):
     assert occurrences.restore_allowed(task) is False  # unreadable is unknown, never revived
 
 
+def test_running_cron_task_blocks_a_second_due_occurrence(q):
+    """Retire the dispatched token while live, but never claim the next point
+    until that scheduled root leaves the queue."""
+    from supervisor import schedule_occurrence as occurrences
+
+    _row(q, intent={"kind": "system_repo"}, cron=True)
+    q.queue.check_scheduled_tasks()
+    [task] = q.pending
+    assert occurrences.record_dispatch_possible(task) is True
+    q.pending.clear()
+    q.queue.RUNNING[task["id"]] = {"task": task}
+    try:
+        record = _rows(q)["s1"]
+        record["next_run_at"] = "2000-01-02T00:00:00+00:00"
+        from supervisor import queue_schedules
+
+        store = q.queue.load_schedule_store(q.root)
+        store["tasks"][0] = record
+        queue_schedules._write_scheduled_tasks(store, q.root)
+        q.queue.check_scheduled_tasks()
+        assert q.pending == []
+        settled = _rows(q)["s1"]
+        assert "occurrence" not in settled
+        assert settled["last_task_id"] == task["id"]
+        assert settled["next_run_at"] == "2000-01-02T00:00:00+00:00"
+    finally:
+        q.queue.RUNNING.pop(task["id"], None)
+
+
+def test_recreated_cron_row_without_last_task_id_still_waits_for_live_root(q):
+    """A skill can recreate a due row while its earlier task is still live.
+
+    The new row has no history fields, but the running root retains schedule_id.
+    It must not admit a second root merely because last_task_id disappeared.
+    """
+    _row(q, intent={"kind": "system_repo"}, cron=True)
+    q.queue.check_scheduled_tasks()
+    [task] = q.pending
+    from supervisor import schedule_occurrence as occurrences
+
+    assert occurrences.record_dispatch_possible(task) is True
+    q.pending.clear()
+    q.queue.RUNNING[task["id"]] = {"task": task}
+    try:
+        from supervisor import queue_schedules
+
+        removed = q.queue.mutate_scheduled_task(
+            "delete", "s1", reason="owner removed reminder", actor="owner:gateway", drive_root=q.root,
+        )
+        assert removed["changed"] is True
+        assert "s1" not in _rows(q)
+        _row(q, intent={"kind": "system_repo"}, cron=True)
+        assert not _rows(q)["s1"].get("last_task_id")
+        assert queue_schedules._schedule_running_or_queued("s1", q.root) is True
+        q.queue.check_scheduled_tasks()
+        assert q.pending == []
+        assert "occurrence" not in _rows(q)["s1"]
+        assert _rows(q)["s1"]["next_run_at"] == "2000-01-01T00:00:00+00:00"
+    finally:
+        q.queue.RUNNING.pop(task["id"], None)
+
+
 def test_an_unreadable_or_missing_receipt_holds_instead_of_replaying(q):
     _row(q, intent={"kind": "system_repo"}, cron=True)
     q.queue.check_scheduled_tasks()
diff --git a/tests/test_startup_terminal_files.py b/tests/test_startup_terminal_files.py
index 3139df484..9d47c1063 100644
--- a/tests/test_startup_terminal_files.py
+++ b/tests/test_startup_terminal_files.py
@@ -513,12 +513,17 @@ def test_lifespan_does_not_race_recovery_against_provider_supervisor():
     import server
 
     tree = ast.parse(textwrap.dedent(inspect.getsource(server.lifespan)))
+    gate = [node for node in ast.walk(tree) if isinstance(node, ast.Assign)
+            and ast.unparse(node.value) == "has_startup_ready_provider(settings)"
+            and any(isinstance(target, ast.Name) and target.id == "startup_provider_ready"
+                    for target in node.targets)]
+    assert len(gate) == 1
     branches = [node for node in ast.walk(tree) if isinstance(node, ast.If)
-                and ast.unparse(node.test) == "not has_startup_ready_provider(settings)"]
-    assert len(branches) == 1
+                and ast.unparse(node.test) == "not startup_provider_ready"]
+    assert len(branches) == 2
     recovery = [node for node in ast.walk(tree) if isinstance(node, ast.Call)
                 and isinstance(node.func, ast.Name) and node.func.id == "_run_startup_task_recovery"]
-    assert len(recovery) == 1 and recovery[0] in list(ast.walk(branches[0]))
+    assert len(recovery) == 1 and sum(recovery[0] in list(ast.walk(branch)) for branch in branches) == 1
     assert "skip_live_data=pytest_default_real_data_dir" in ast.unparse(recovery[0])
 
 
diff --git a/tests/test_telegram_owner_notes.py b/tests/test_telegram_owner_notes.py
new file mode 100644
index 000000000..22b00e854
--- /dev/null
+++ b/tests/test_telegram_owner_notes.py
@@ -0,0 +1,107 @@
+"""The Telegram mirror carries the owner's notes and skill notices in every mirror mode.
+
+``telegram_only`` forwards only conversations that came from Telegram; a
+``reminder`` (a note Ouroboros left) or a ``skill_notice`` (a granted skill's word)
+is written for the owner, so it is forwarded to the pinned chat too, as its own
+plain message. Everything else keeps the mode's filter.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import importlib.util
+import json
+import sys
+import types
+from pathlib import Path
+
+import pytest
+
+
+def _load_plugin():
+    root = Path(__file__).resolve().parents[1] / "skills" / "telegram"
+    package = types.ModuleType("tg_owner_notes_test")
+    package.__path__ = [str(root)]
+    sys.modules["tg_owner_notes_test"] = package
+    spec = importlib.util.spec_from_file_location("tg_owner_notes_test.plugin", root / "plugin.py")
+    plugin = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = plugin
+    spec.loader.exec_module(plugin)
+    return plugin
+
+
+class _Api:
+    def __init__(self, state_dir: Path):
+        self.state_dir = state_dir
+
+    def get_state_dir(self):
+        return str(self.state_dir)
+
+    def get_settings(self, _keys):
+        return {"TELEGRAM_BOT_TOKEN": "token"}
+
+    def log(self, *_args, **_kwargs):
+        pass
+
+
+class _Client:
+    sent: list = []
+
+    def __init__(self, _token, **_kwargs):
+        pass
+
+    async def send_message(self, chat_id, text, parse_mode="HTML"):
+        _Client.sent.append((chat_id, text, parse_mode))
+        return len(_Client.sent)
+
+    async def send_chat_action(self, chat_id, action="typing"):
+        pass
+
+
+@pytest.mark.parametrize("mode", ["telegram_only", "all"])
+def test_notes_and_skill_notices_reach_the_pinned_chat(tmp_path, monkeypatch, mode):
+    plugin = _load_plugin()
+    (tmp_path / "settings.json").write_text(
+        json.dumps({"TELEGRAM_CHAT_ID": "42", "TELEGRAM_MIRROR_MODE": mode}), encoding="utf-8")
+    monkeypatch.setattr(plugin, "TelegramClient", _Client)
+    _Client.sent = []
+    handle = plugin._make_outbound(_Api(tmp_path))
+    web = {"kind": "web"}
+    note = {"chat_id": 1, "role": "system", "system_type": "reminder", "markdown": False, "transport": web,
+            "text": "Reminder · Ouroboros · written Oct 3 14:05 · for Oct 3 15:00 (UTC+3)\nCall mother"}
+    notice = {**note, "system_type": "skill_notice", "text": "Notice · calendar\nMeeting in 15 min"}
+    other = {**note, "system_type": "command_reply", "text": "Restarting."}
+    reply = {"chat_id": 1, "role": "assistant", "markdown": False, "transport": web, "text": "Hello"}
+    for event in (note, notice, other, reply):
+        asyncio.run(handle(event))
+    forwarded = [text for _chat, text, _mode in _Client.sent]
+    assert forwarded[:2] == [note["text"], notice["text"]]
+    assert all(chat == 42 and parse_mode == "" for chat, _text, parse_mode in _Client.sent), "plain, to the pinned chat"
+    if mode == "telegram_only":
+        assert forwarded == [note["text"], notice["text"]], "the mode's filter still holds for everything else"
+    else:
+        assert forwarded == [note["text"], notice["text"], "Restarting.", "Hello"]
+
+
+def test_the_settings_say_telegram_only_also_carries_reminders_and_skill_notices(tmp_path, monkeypatch):
+    """The mode's explanation and its option name the exception the mirror makes above."""
+    plugin = _load_plugin()
+    monkeypatch.setattr(plugin, "register_miniapp", lambda _api: None)  # its own runtime, not this text
+    sections = []
+
+    class _Registrar(_Api):
+        def __getattr__(self, _name):  # every other registration is irrelevant here
+            return lambda *_args, **_kwargs: None
+
+        def register_settings_section(self, _section_id, title, schema):
+            sections.append(schema)
+
+    plugin.register(_Registrar(tmp_path))
+    [schema] = sections
+    explanation = " ".join(c.get("text", "") for c in schema["components"] if c.get("type") == "markdown")
+    fields = [f for c in schema["components"] if c.get("type") == "form" for f in c.get("fields", [])]
+    [mode] = [field for field in fields if field.get("name") == "TELEGRAM_MIRROR_MODE"]
+    option = {row["value"]: row["label"] for row in mode["options"]}["telegram_only"]
+    told = explanation[explanation.index("*Telegram only*"):].split("\n", 1)[0]
+    for words in (told, option):
+        assert "Telegram" in words and "reminders" in words and "skill notices" in words, words
diff --git a/tests/test_telegram_proxy.py b/tests/test_telegram_proxy.py
index 9fd08f47b..7bded880c 100644
--- a/tests/test_telegram_proxy.py
+++ b/tests/test_telegram_proxy.py
@@ -319,7 +319,7 @@ def test_upgrade_keeps_token_grant_and_local_proxy(
     installed = native / "telegram"
     shutil.copytree(_ROOT, installed)
     manifest = (installed / "SKILL.md").read_text(encoding="utf-8")
-    manifest = manifest.replace("version: 1.2.9", "version: 1.2.8")
+    manifest = manifest.replace("version: 1.2.10", "version: 1.2.9")
     (installed / "SKILL.md").write_text(manifest, encoding="utf-8")
     (installed / ".seed-origin").write_text("seeded_from=test\n", encoding="utf-8")
     settings = {"TELEGRAM_BOT_TOKEN": _TOKEN, **({"TELEGRAM_PROXY": _PROXY} if owner_set_proxy else {})}
@@ -341,7 +341,7 @@ def test_upgrade_keeps_token_grant_and_local_proxy(
     assert _per_skill_version_resync(_ROOT.parent, native, log, drive_root=drive) == 1
     new = load_skill(installed, drive)
     grants = load_skill_grants(drive, "telegram")
-    assert new.manifest.version == "1.2.9" and new.content_hash != old.content_hash
+    assert new.manifest.version == "1.2.10" and new.content_hash != old.content_hash
     assert grants["content_hash"] == new.content_hash
     assert local_settings.read_bytes() == settings_before
     assert grants["granted_keys"] == ["TELEGRAM_BOT_TOKEN"]
diff --git a/tests/test_test_environment.py b/tests/test_test_environment.py
index 6a83b46df..533816efd 100644
--- a/tests/test_test_environment.py
+++ b/tests/test_test_environment.py
@@ -304,7 +304,11 @@ def pytest_sessionstart(session):
 def _nested_env(**overrides):
     import os
 
-    env = {key: value for key, value in os.environ.items() if key != "OUROBOROS_TEST_TEMP_ROOT"}
+    # The nested run is its own session: when THIS test runs inside an xdist
+    # worker, the inherited worker id would make the nested controller write
+    # its probe as that worker and the record set would never show "controller".
+    dropped = {"OUROBOROS_TEST_TEMP_ROOT", "PYTEST_XDIST_WORKER", "PYTEST_XDIST_TESTRUNUID"}
+    env = {key: value for key, value in os.environ.items() if key not in dropped}
     env.update(overrides)
     return env
 
diff --git a/tests/test_ui_owner_notes_browser.py b/tests/test_ui_owner_notes_browser.py
new file mode 100644
index 000000000..08767e6b1
--- /dev/null
+++ b/tests/test_ui_owner_notes_browser.py
@@ -0,0 +1,127 @@
+"""Notes through the real server, its scheduler tick and the browser (ui_browser lane).
+
+A running supervisor shows a due note in Main as one System row whose host signature
+stands on its own line above the mind's words; reopening replays it from history
+without a banner; Activity names a waiting note by its words; and with notifications
+on, a note that fires while the page is open rings once in the existing messages
+category, titled by its author. No model is called for any of it.
+"""
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+
+import pytest
+
+from tests.test_ui_smoke_playwright import direct_server_with_data  # noqa: F401 - pytest fixture
+
+pytestmark = [pytest.mark.ui_browser, pytest.mark.serial]
+
+# Midday UTC instants keep "Dec 31" / "Jan 1" stable in any server zone from UTC-11 to UTC+11.
+DUE = "Call mother about Sunday."
+LATER = "Water the plants."
+LIVE = "The kettle is on."
+BUBBLE = '.chat-bubble[data-system-type="reminder"]'
+# Narrow captures wait for the drawer to slide out and every CSS transition to end.
+SETTLED = """() => Promise.all(document.getAnimations()
+    .filter(animation => typeof CSSTransition === 'function' && animation instanceof CSSTransition)
+    .map(animation => animation.finished.catch(() => null)))
+    .then(() => new Promise(r => requestAnimationFrame(() => requestAnimationFrame(r))))"""
+PREFS = {"enabled": True, "needs_answer": True, "task_done": True, "important": True,
+         "main_reply": False, "sound": False, "show_text": True}
+
+
+def _note(root: Path, schedule_id: str, text: str, run_at: str) -> None:
+    from supervisor.queue import upsert_scheduled_task
+
+    record = {"id": schedule_id, "name": "Reminder of task t-ui", "description": text, "kind": "notify",
+              "source": "task_followup", "enabled": True, "timezone": "",
+              "trigger": {"type": "once", "run_at": run_at},
+              "notification": {"text": text, "set_at": "1999-12-31T12:00:00+00:00"}}
+    upsert_scheduled_task(record, drive_root=root, host_followup={
+        "followup_origin": {"task_id": "t-ui", "root_task_id": "t-ui"},
+        "followup_relation": {"kind": "independent", "declared_by": "t-ui", "revision": "r"}})
+
+
+def _wait_for_row(request, url: str, text: str) -> None:
+    """The tick runs on the supervisor's own cadence; wait for its durable row, bounded."""
+    deadline = time.monotonic() + 90
+    while time.monotonic() < deadline:
+        messages = request.get(url + "/api/chat/history").json().get("messages") or []
+        if any(m.get("system_type") == "reminder" and m.get("text", "").endswith(text) for m in messages):
+            return
+        time.sleep(0.5)
+    raise AssertionError(f"no reminder row for {text!r} within 90 s")
+
+
+@pytest.mark.parametrize("engine", ["chromium", "webkit"])
+def test_notes_reach_main_activity_and_the_live_banner(direct_server_with_data, engine):  # noqa: F811 - pytest fixture
+    from playwright.sync_api import sync_playwright
+
+    server = direct_server_with_data
+    root, url = server["data_dir"], server["url"]
+    evidence = Path(os.environ.get("OUROBOROS_UI_EVIDENCE_DIR") or root / "ui-evidence") / f"owner-notes-{engine}"
+    evidence.mkdir(parents=True, exist_ok=True)
+    server["stop_server"]()
+    _note(root, "note-due", DUE, "2000-01-01T12:00:00+00:00")  # due for decades: the first tick shows it
+    _note(root, "note-later", LATER, "2999-01-01T09:00:00+00:00")
+    server["start_server"]()
+
+    with sync_playwright() as pw:
+        browser = getattr(pw, engine).launch()
+        try:
+            page = browser.new_page(viewport={"width": 1280, "height": 860})
+            _wait_for_row(page.request, url, DUE)  # shown before the page exists: history only
+            page.add_init_script(f"localStorage.setItem('ouroboros.notifications', {json.dumps(json.dumps(PREFS))})")
+            page.goto(url, wait_until="domcontentloaded", timeout=30_000)
+            page.locator('[data-nav-page="chat"]').click()
+            page.wait_for_selector('#chat-messages[data-history-hydrated="true"]', state="attached", timeout=30_000)
+            bubble = page.locator(f"#chat-messages {BUBBLE}").filter(has_text=DUE)
+            bubble.wait_for(state="visible", timeout=30_000)
+            assert bubble.locator(".sender").inner_text().strip() == "📋 System"
+            message = bubble.locator(".message")
+            signature, words = message.inner_text().split("\n", 1)
+            assert signature.startswith("Reminder · Ouroboros · written Dec 31 ") and " · for Jan 1 " in signature
+            assert " · delivered " in signature and signature.endswith(")"), signature
+            assert words.strip() == DUE
+            assert message.evaluate("node => getComputedStyle(node).whiteSpace") == "pre-wrap"
+            assert page.locator("#toast-stack .toast").count() == 0, "history replay never rings"
+            page.screenshot(path=str(evidence / "main-history-desktop.png"))
+            page.set_viewport_size({"width": 390, "height": 844})
+            page.evaluate(SETTLED)
+            box = bubble.bounding_box()
+            assert box and box["x"] >= 0 and box["x"] + box["width"] <= 390
+            page.screenshot(path=str(evidence / "main-history-narrow.png"))
+            page.set_viewport_size({"width": 1280, "height": 860})
+
+            # A note due while the page is open arrives live: one row, one banner in the
+            # existing messages category, titled by its author, the words below the signature.
+            _note(root, "note-live", LIVE, "2000-01-02T00:00:00+00:00")
+            page.locator(f"#chat-messages {BUBBLE}").filter(has_text=LIVE).wait_for(state="visible", timeout=90_000)
+            toast = page.locator("#toast-stack .toast").filter(has_text="Reminder from Ouroboros")
+            toast.wait_for(state="visible", timeout=10_000)
+            assert toast.inner_text().strip().endswith(LIVE)
+            assert page.locator("#toast-stack .toast").filter(has_text="Reminder").count() == 1
+            page.screenshot(path=str(evidence / "main-live-banner.png"))
+
+            page.click('[data-nav-page="dashboard"]')
+            page.click('[data-dashboard-tab="activity"]')
+            schedules = page.locator('[data-activity-section="schedules"]')
+            waiting = schedules.locator(".activity-row").filter(has_text=LATER)
+            waiting.wait_for(state="visible", timeout=30_000)
+            assert waiting.locator(".activity-name").inner_text() == LATER
+            assert waiting.locator(".activity-sub").inner_text().startswith("reminder · one-shot · at/after ")
+            schedules.scroll_into_view_if_needed()
+            page.screenshot(path=str(evidence / "activity-desktop.png"), full_page=True)
+            page.set_viewport_size({"width": 390, "height": 844})
+            page.wait_for_function("() => document.querySelector('#primary-sidebar').getBoundingClientRect().right <= 1")
+            page.evaluate(SETTLED)
+            assert waiting.locator(".activity-sub").evaluate("node => node.scrollWidth <= node.clientWidth + 1")
+            page.screenshot(path=str(evidence / "activity-narrow.png"), full_page=True)
+        finally:
+            browser.close()
+    rows = [json.loads(line) for line in (root / "logs" / "chat.jsonl").read_text(encoding="utf-8").splitlines()
+            if line.strip()]
+    assert [r["text"].split("\n", 1)[1] for r in rows if r.get("type") == "reminder"] == [DUE, LIVE]
diff --git a/tests/test_windows_autostart.py b/tests/test_windows_autostart.py
new file mode 100644
index 000000000..8a5e2cd0c
--- /dev/null
+++ b/tests/test_windows_autostart.py
@@ -0,0 +1,232 @@
+"""Windows sign-in autostart: the registry entry, its states and its endpoints.
+
+A dict-backed ``winreg`` double stands in for HKCU on every OS, so the state
+machine and the transport run in the ordinary CI matrix.
+"""
+
+from __future__ import annotations
+
+import json
+import pathlib
+import sys
+from contextlib import nullcontext
+from types import SimpleNamespace
+
+import pytest
+from starlette.applications import Starlette
+
+from ouroboros import desktop_autostart, windows_autostart as autostart
+from ouroboros.gateway.router import collect_routes
+
+
+class _FakeWinreg:
+    HKEY_CURRENT_USER = "HKCU"
+    KEY_SET_VALUE = 0x0002
+    REG_SZ = 1
+    REG_BINARY = 3
+
+    def __init__(self):
+        self.keys: dict[str, dict[str, tuple[object, int]]] = {}
+
+    def OpenKey(self, root, path, reserved=0, access=0):
+        assert root == self.HKEY_CURRENT_USER
+        if path not in self.keys:
+            raise FileNotFoundError(path)
+        return nullcontext(path)
+
+    def CreateKeyEx(self, root, path, reserved=0, access=0):
+        assert root == self.HKEY_CURRENT_USER
+        self.keys.setdefault(path, {})
+        return nullcontext(path)
+
+    def QueryValueEx(self, key, name):
+        values = self.keys[key]
+        if name not in values:
+            raise FileNotFoundError(name)
+        return values[name]
+
+    def SetValueEx(self, key, name, reserved, kind, value):
+        self.keys[key][name] = (value, kind)
+
+    def DeleteValue(self, key, name):
+        values = self.keys[key]
+        if name not in values:
+            raise FileNotFoundError(name)
+        del values[name]
+
+    def value(self, key_path):
+        return self.keys.get(key_path, {}).get(autostart.VALUE_NAME)
+
+
+@pytest.fixture
+def registry(monkeypatch):
+    fake = _FakeWinreg()
+    monkeypatch.setitem(sys.modules, "winreg", fake)
+    monkeypatch.setattr(autostart, "IS_WINDOWS", True)
+    monkeypatch.setattr(desktop_autostart, "sys", SimpleNamespace(platform="win32"))
+    monkeypatch.setenv("OUROBOROS_MANAGED_BY_LAUNCHER", "1")
+    monkeypatch.setenv("OUROBOROS_APP_VERSION", "7.2.0")
+    monkeypatch.delenv("OUROBOROS_PRESENTATION", raising=False)
+    monkeypatch.delenv("OUROBOROS_BUNDLE_DIR", raising=False)
+    return fake
+
+
+@pytest.fixture
+def packaged(registry, tmp_path, monkeypatch):
+    """A PyInstaller onedir copy: Ouroboros.exe beside its _internal bundle."""
+    app = tmp_path / "Ouroboros"
+    (app / "_internal").mkdir(parents=True)
+    exe = app / "Ouroboros.exe"
+    exe.write_bytes(b"MZ")
+    monkeypatch.setenv("OUROBOROS_PRESENTATION", "desktop_window")
+    monkeypatch.setenv("OUROBOROS_BUNDLE_DIR", str(app / "_internal"))
+    return exe
+
+
+def _approved(first_byte: int) -> tuple[bytes, int]:
+    return bytes([first_byte]) + bytes(11), _FakeWinreg.REG_BINARY
+
+
+def test_packaged_copy_is_the_only_target(packaged):
+    assert autostart.launcher_path() == packaged
+    assert autostart.autostart_state() == "off"
+
+
+@pytest.mark.parametrize("case", ["not_windows", "browser_fallback", "source_bundle", "missing_exe"])
+def test_every_other_run_is_unavailable_and_never_touches_the_registry(packaged, registry, monkeypatch, case):
+    if case == "not_windows":
+        monkeypatch.setattr(autostart, "IS_WINDOWS", False)
+    elif case == "browser_fallback":
+        monkeypatch.setenv("OUROBOROS_PRESENTATION", "browser_fallback")
+    elif case == "source_bundle":
+        monkeypatch.setenv("OUROBOROS_BUNDLE_DIR", str(packaged.parent))
+    else:
+        packaged.unlink()
+    assert autostart.launcher_path() is None
+    assert autostart.autostart_state() == "unavailable"
+    assert autostart.set_autostart(True) == "unavailable"
+    assert registry.keys == {}
+
+
+def test_turning_on_writes_the_quoted_launcher_and_off_removes_it(packaged, registry):
+    assert autostart.set_autostart(True) == "on"
+    assert registry.value(autostart.RUN_KEY) == (f'"{packaged}" --launch-intent automatic', _FakeWinreg.REG_SZ)
+    assert autostart.set_autostart(False) == "off"
+    assert registry.value(autostart.RUN_KEY) is None
+    assert autostart.set_autostart(False) == "off"  # idempotent over an absent value
+
+
+def test_windows_startup_apps_switch_is_reported_and_cleared(packaged, registry):
+    autostart.set_autostart(True)
+    registry.keys.setdefault(autostart.APPROVED_KEY, {})[autostart.VALUE_NAME] = _approved(0x03)
+    assert autostart.autostart_state() == "disabled_by_os"
+    registry.keys[autostart.APPROVED_KEY][autostart.VALUE_NAME] = _approved(0x02)
+    assert autostart.autostart_state() == "on"
+    registry.keys[autostart.APPROVED_KEY][autostart.VALUE_NAME] = _approved(0x07)
+    assert autostart.set_autostart(True) == "on"  # turning on follows the owner, not the old switch
+    assert registry.value(autostart.APPROVED_KEY) is None
+    registry.keys[autostart.APPROVED_KEY][autostart.VALUE_NAME] = _approved(0x03)
+    assert autostart.set_autostart(False) == "off"
+    assert registry.value(autostart.APPROVED_KEY) is None
+
+
+def test_an_entry_for_another_copy_is_reported_and_retargeted(packaged, registry):
+    registry.keys[autostart.RUN_KEY] = {
+        autostart.VALUE_NAME: ('"C:\\Old\\Ouroboros\\Ouroboros.exe" --launch-intent automatic', 1),
+    }
+    assert autostart.autostart_state() == "other_copy"
+    registry.keys[autostart.RUN_KEY][autostart.VALUE_NAME] = (f'"{str(packaged).upper()}" --launch-intent automatic', 1)
+    assert autostart.autostart_state() == "on"  # Windows paths compare without case
+    registry.keys[autostart.RUN_KEY][autostart.VALUE_NAME] = (f'"{packaged}"', 1)
+    assert autostart.autostart_state() == "other_copy"  # an owner-intent start would lift a Panic stop
+    registry.keys[autostart.RUN_KEY][autostart.VALUE_NAME] = (f'"{packaged}" --LAUNCH-INTENT AUTOMATIC', 1)
+    assert autostart.autostart_state() == "other_copy"  # the launcher's parser is case-sensitive
+    assert autostart.set_autostart(True) == "on"
+    assert registry.value(autostart.RUN_KEY) == (autostart.sign_in_command(packaged), _FakeWinreg.REG_SZ)
+
+
+def test_a_sign_in_start_keeps_a_panic_stop(packaged, tmp_path):
+    """The Run command carries the launcher's automatic intent; an owner start still resumes."""
+    import logging
+
+    from ouroboros.launcher_bootstrap import automatic_launch_allowed, parse_launch_options
+
+    command = autostart.sign_in_command(packaged)
+    assert command.startswith(f'"{packaged}" ')
+    intent = parse_launch_options(command[len(f'"{packaged}" '):].split()).launch_intent
+    assert intent == "automatic"
+    data_dir = tmp_path / "data"
+    (data_dir / "state").mkdir(parents=True)
+    log = logging.getLogger("test_windows_autostart")
+    assert automatic_launch_allowed(intent, data_dir, log) is True
+    (data_dir / "state" / "panic_stop.flag").write_text("panic", encoding="utf-8")
+    assert automatic_launch_allowed(intent, data_dir, log) is False
+    assert automatic_launch_allowed(parse_launch_options([]).launch_intent, data_dir, log) is True
+
+
+def test_the_toggle_never_enters_the_settings_draft():
+    """Like the notification block: no `s-` field, and edits never mark the server draft dirty."""
+    root = pathlib.Path(__file__).resolve().parents[1]
+    markup = (root / "web" / "modules" / "settings_ui.js").read_text(encoding="utf-8")
+    panel = markup[markup.index('data-settings-panel="behavior"'):]
+    panel = panel[:panel.index("</section>")]
+    assert "data-autostart-settings" in panel, "the block lives on the Behavior tab"
+    block = panel[panel.index("data-autostart-settings"):panel.index("<h3>Reasoning Effort</h3>")]
+    assert "host computer" in block
+    assert "Startup &amp; background" in block
+    assert "data-autostart-settings" not in markup.split('data-settings-panel="appearance"')[1]
+    for attribute in ('id="s-', 'name="s-'):
+        assert attribute not in block
+    settings = (root / "web" / "modules" / "settings.js").read_text(encoding="utf-8")
+    assert "closest?.('[data-notify-settings], [data-autostart-settings]')" in settings
+
+
+@pytest.fixture
+def client(tmp_path):
+    from starlette.testclient import TestClient
+
+    app = Starlette(routes=collect_routes(data_dir=tmp_path))
+    app.state.drive_root = tmp_path
+    with TestClient(app) as test_client:
+        yield test_client
+
+
+def test_endpoints_report_unavailable_outside_the_packaged_desktop(registry, client):
+    assert client.get("/api/desktop/autostart").json()["state"] == "unavailable"
+    response = client.post("/api/desktop/autostart", json={"enabled": True})
+    assert response.status_code == 409
+    assert registry.keys == {}
+
+
+@pytest.mark.parametrize("body", ["not json", [], {}, {"enabled": "yes"}, {"enabled": 1}, {"enabled": True, "extra": 1}])
+def test_post_accepts_only_one_boolean(packaged, registry, client, body):
+    if isinstance(body, str):
+        response = client.post("/api/desktop/autostart", content=body)
+    else:
+        response = client.post("/api/desktop/autostart", json=body)
+    assert response.status_code == 400
+    assert registry.keys == {}
+
+
+def test_post_changes_the_entry_and_audits_the_owner_action(packaged, registry, client, tmp_path):
+    response = client.post("/api/desktop/autostart", json={"enabled": True})
+    assert response.status_code == 200
+    assert response.json() == {"state": "on"}
+    assert client.get("/api/desktop/autostart").json() == {"state": "on"}
+    events = [json.loads(line) for line in (tmp_path / "logs" / "events.jsonl").read_text(encoding="utf-8").splitlines()]
+    audit = [event for event in events if event.get("action") == "desktop_autostart"]
+    assert audit and audit[-1]["enabled"] is True and audit[-1]["state"] == "on"
+
+
+def test_registry_refusals_are_reported_not_hidden(packaged, client, monkeypatch):
+    def refuse(*_args):
+        raise PermissionError("access denied")
+
+    monkeypatch.setattr(autostart, "set_autostart", refuse)
+    response = client.post("/api/desktop/autostart", json={"enabled": True})
+    assert response.status_code == 500
+    assert "could not be changed" in response.json()["error"]
+    monkeypatch.setattr(autostart, "autostart_state", refuse)
+    response = client.get("/api/desktop/autostart")
+    assert response.status_code == 500
+    assert "could not be read" in response.json()["error"]
diff --git a/web/modules/activity.js b/web/modules/activity.js
index a299d3e37..60be0d82f 100644
--- a/web/modules/activity.js
+++ b/web/modules/activity.js
@@ -94,6 +94,10 @@ export function scheduleRowHtml(s) {
     const timing = once
         ? `one-shot · at/after ${scheduleInstantHtml(trigger.run_at)}`
         : `${esc(trigger.expr || s.cron || '')} (${s.timezone ? esc(s.timezone) : 'server time zone'})`;
+    // A note (kind "notify") is shown to the owner as written, with no task: its
+    // row names it by its own words rather than by a schedule label.
+    const note = String(s.kind || '') === 'notify';
+    const noteText = note ? String(s.notification?.text || '') : '';
     const next = s.next_run_at ? scheduleInstantHtml(s.next_run_at) : '';
     const status = scheduleStatus(s);
     const enabled = status === 'active';
@@ -104,6 +108,9 @@ export function scheduleRowHtml(s) {
     // A due occurrence that waits (capacity, a missing folder, an unknown fact) says why.
     const waiting = s.hold && s.hold.reason
         ? ` · <span class="activity-tag" title="${esc(s.hold.detail || '')}">waiting: ${esc(s.hold.reason)}</span>` : '';
+    // Why the row did not do its job, as stored (a note whose chat write was not
+    // confirmed is consumed and never retried, so this is the only place it says so).
+    const failed = s.last_error ? ` · <span class="activity-tag">last error: ${esc(s.last_error)}</span>` : '';
     const relation = String(s.relation || 'unknown');
     const hold = s.followup_hold || {};
     const work = s.billing_group || {};
@@ -118,7 +125,7 @@ export function scheduleRowHtml(s) {
     const pendingDetail = pendingDelete ? ` · deletion waits for ${relation === 'independent'
         ? 'its accepted run to start' : 'its task to finish'}` : '';
     const statusLabel = pendingDelete ? 'deletion pending' : status;
-    const sub = `${timing}${next && !consumed && !pendingDelete ? ` · next ${next}` : ''} · ${esc(statusLabel)}${pendingDetail} · ${esc(relation)}${binding}${s.deadline_at ? ` · deadline ${scheduleInstantHtml(s.deadline_at, { includeYear: true })}` : ''}${hold.reason ? ` · ${esc(explanations[hold.reason] || hold.reason)}` : ''}${s.followup_wait ? ` · ${esc(explanations[s.followup_wait] || s.followup_wait)}` : ''}${s.completed_at ? ' · already fired' : ''}${managed && s.skill ? ` · ${esc(s.skill)}` : ''}${waiting}`;
+    const sub = `${note ? 'reminder · ' : ''}${timing}${next && !consumed && !pendingDelete ? ` · next ${next}` : ''} · ${esc(statusLabel)}${pendingDetail} · ${esc(relation)}${binding}${s.deadline_at ? ` · deadline ${scheduleInstantHtml(s.deadline_at, { includeYear: true })}` : ''}${hold.reason ? ` · ${esc(explanations[hold.reason] || hold.reason)}` : ''}${s.followup_wait ? ` · ${esc(explanations[s.followup_wait] || s.followup_wait)}` : ''}${s.completed_at ? ' · already fired' : ''}${managed && s.skill ? ` · ${esc(s.skill)}` : ''}${waiting}${failed}`;
     // The exact hold release stays available wherever a hold exists, including on a
     // deleted row whose accepted task still needs it; it never re-enables the row.
     const holdControl = !hold.hold_id ? ''
@@ -150,11 +157,11 @@ export function scheduleRowHtml(s) {
                         : `<button type="button" class="btn btn-xs btn-default" data-act="schedule-toggle" data-id="${id}" data-action="${suppressed || !enabled ? 'restore' : 'disable'}">${enabled ? 'Disable' : (suppressed ? 'Restore' : 'Enable')}</button>`;
     return `<div class="activity-row activity-schedule${enabled || hold.hold_id || s.followup_wait ? '' : ' off'}">
         <div class="activity-row-main">
-            <span class="activity-name">${esc(s.name || s.id || 'schedule')}</span>
+            <span class="activity-name"${noteText ? ` title="${esc(noteText)}"` : ''}>${esc(noteText || s.name || s.id || 'schedule')}</span>
             <span class="activity-sub">${sub}</span>
         </div>
         <div class="activity-row-actions">${lifecycle}
-           <button type="button" class="btn btn-xs btn-danger" data-act="schedule-delete" data-id="${id}" data-managed="${managed ? '1' : ''}">Delete</button></div>
+           <button type="button" class="btn btn-xs btn-danger" data-act="schedule-delete" data-id="${id}" data-managed="${managed ? '1' : ''}" data-note="${note ? '1' : ''}">Delete</button></div>
     </div>`;
 }
 
@@ -490,11 +497,12 @@ export function initActivity({ mount, ws } = {}) {
                 // would recreate it. Delete SUPPRESSES it durably, and the dialog
                 // says so before anything is sent.
                 const managedRow = btn.dataset.managed === '1';
+                const noun = btn.dataset.note === '1' ? 'reminder' : 'schedule';
                 const confirmedDelete = await openConfirmDialog({
-                    title: managedRow ? 'Suppress skill schedule' : 'Delete schedule',
+                    title: managedRow ? 'Suppress skill schedule' : `Delete ${noun}`,
                     body: managedRow
                         ? 'This schedule is declared by an installed skill and cannot be removed; Delete keeps it suppressed until you Restore it. Suppress it?'
-                        : 'Delete this schedule?',
+                        : `Delete this ${noun}?`,
                     confirmLabel: managedRow ? 'Suppress' : 'Delete',
                     danger: true,
                 });
diff --git a/web/modules/api_client.js b/web/modules/api_client.js
index c6450143e..6c4614f78 100644
--- a/web/modules/api_client.js
+++ b/web/modules/api_client.js
@@ -278,6 +278,10 @@ export const apiClient = {
     /** @returns {Promise<import('./api_types.js').UiPreferencesResponse>} */
     uiPreferences: (init = {}) => fetchJson('/api/ui/preferences', { cache: 'no-store', ...init }),
     saveUiPreferences: (payload) => jsonPost('/api/ui/preferences', payload),
+    /** @returns {Promise<import('./api_types.js').DesktopAutostartResponse>} */
+    desktopAutostart: () => fetchJson('/api/desktop/autostart', { cache: 'no-store' }),
+    /** @returns {Promise<import('./api_types.js').DesktopAutostartResponse>} */
+    setDesktopAutostart: (enabled) => jsonPost('/api/desktop/autostart', { enabled: Boolean(enabled) }),
     saveSettings: (payload) => fetchJson('/api/settings', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
diff --git a/web/modules/api_types.js b/web/modules/api_types.js
index 6ff28f042..fb97a867b 100644
--- a/web/modules/api_types.js
+++ b/web/modules/api_types.js
@@ -457,10 +457,7 @@
  * @property {Object=} transport
  * @property {string=} system_type
  * @property {"timeline"|"reviews"=} card_row
- *   A host-stamped placement fact for a task-keyed System row: "timeline" = a
- *   timeline item of the task's card, "reviews" = the card's Reviews group
- *   carries the fact (the row is still attached to the card); absent = an
- *   ordinary row.
+ *   A host-stamped placement fact for a task-keyed System row: "timeline" = a timeline item of the task's card, "reviews" = the card's Reviews group carries the fact (the row is still attached to the card); absent = an ordinary row.
  * @property {string=} card_row_id  // the row's stable identity across live delivery, outbox replay and history
  * @property {number=} card_row_revision  // canonical source order, independent of delivery timestamp
  * @property {Object=} late_evidence
@@ -472,6 +469,9 @@
  * @property {string=} handoff_id  // immutable origin/destination receipt identity
  * @property {Object=} terminal_time  // host-owned occurrence; ts remains publication time
  * @property {string=} completion_answer  // a Project root's model-authored final answer, mirrored into Main
+ * @property {string=} set_at  // a `reminder` row: when its words were written (live frame only; the text carries the signature)
+ * @property {string=} scheduled_for  // a `reminder` row: the due point it was written for
+ * @property {string=} delivered_at  // a `reminder` row: when the host showed it (later than due after downtime)
  * @property {number=} chat_id
  * @property {boolean=} project_thread  // server-stamped: chat_id is a reserved Project thread; Main never adopts it even before projectChatIds learns the project
  */
@@ -1282,7 +1282,6 @@
  * @property {string=} cleanupWarning
  * @property {ClaudexorVendorCredentialDisposition=} vendorCredentialDisposition
  */
-
 /**
  * Mirrors `gateway/schedule_contracts.py`, which states what each field means.
  * @typedef {Object} ScheduledTasksResponse
@@ -1315,7 +1314,6 @@
  * @typedef {Object} ScheduleDeleteResponse
  * @property {boolean} ok
  */
-
 /**
  * @typedef {Object} TaskPauseRequest
  * @property {string} request_id
@@ -1419,13 +1417,11 @@
  * @property {boolean=} duplicate
  * @property {string=} error
  */
-
 /**
  * @typedef {Object} LogTailResponse
  * @property {string} name
  * @property {Object[]} entries
  */
-
 /**
  * @typedef {Object} SkillDeleteResponse
  * @property {boolean} ok
@@ -1437,7 +1433,6 @@
  * @property {string} extension_reason
  * @property {string=} error
  */
-
 /**
  * @typedef {Object} UiPreferencesResponse
  * @property {string[]} widget_order
@@ -1450,7 +1445,12 @@
  * @property {{mode:'default'|'hidden'|'custom',text:string}} welcome  // install-wide empty-Main UI copy, not chat history
  * @property {boolean=} ok
  */
-
+/**
+ * Host sign-in registration as its OS reports it; `reason` only when unavailable.
+ * @typedef {Object} DesktopAutostartResponse
+ * @property {'unavailable'|'off'|'on'|'other_copy'|'disabled_by_os'} state
+ * @property {string=} reason
+ */
 /**
  * @typedef {Object} UpdateMergePlan
  * @property {boolean=} available
diff --git a/web/modules/chat.js b/web/modules/chat.js
index 134fda009..80b137677 100644
--- a/web/modules/chat.js
+++ b/web/modules/chat.js
@@ -126,6 +126,7 @@ import {
     partitionLocalEchoJournal,
     projectCollapsedActivity,
     positiveTaskTerminalFact,
+    unkeyedFrameEndsTurn,
     projectIdFromTask,
     rawTimestampEpoch,
     stampNodeTimestamp,
@@ -3714,8 +3715,8 @@ export function createChatInstance({
                     if (finished?.clientMessageId) {
                         pendingSubmissions.delete(finished.clientMessageId);
                     }
-                } else if (msg.system_type !== 'terminal_incident') {
-                    // Unkeyed finals clear unscoped state; incidents are informational.
+                } else if (unkeyedFrameEndsTurn(msg)) {
+                    // Unkeyed finals clear unscoped state; incidents, notes and skill notices do not.
                     activeDirectActivities.clear();
                     pendingSubmissions.clear();
                 }
diff --git a/web/modules/chat_activity.js b/web/modules/chat_activity.js
index 9c82e5677..cbb70809b 100644
--- a/web/modules/chat_activity.js
+++ b/web/modules/chat_activity.js
@@ -1056,6 +1056,15 @@ export function positiveTaskTerminalFact(row) {
         && TERMINAL_SUBAGENT_EVENTS.has(String(row.subagent_event || '').toLowerCase());
 }
 
+/**
+ * Whether an unkeyed live row ends the unscoped Main turn, by its typed kind. An
+ * incident report, a note Ouroboros left for this moment and a skill's notice arrive
+ * in the middle of a conversation and conclude nothing.
+ */
+export function unkeyedFrameEndsTurn(row) {
+    return !['terminal_incident', 'reminder', 'skill_notice'].includes(String(row?.system_type || ''));
+}
+
 /**
  * Single status reducer for the chat header (owner decisions 2A/5A; managed
  * activities added by the project-continuity contract). Priority: disconnected
diff --git a/web/modules/notifications.js b/web/modules/notifications.js
index 590de0530..059448975 100644
--- a/web/modules/notifications.js
+++ b/web/modules/notifications.js
@@ -116,6 +116,22 @@ function trimBody(value) {
     return `${body.slice(0, BODY_CHARS - 1)}…`;
 }
 
+/* A reminder (a note Ouroboros wrote earlier, shown now by the host) and a
+   granted skill's notice are System rows whose first line is the host's
+   signature; the banner names the author from `source` and shows only the words
+   after that line. Never the row's sentence in the title (§9: private by default). */
+export function noticeTitle(systemType, source) {
+    const author = text(source).trim();
+    if (systemType === 'skill_notice') return author ? `Notice from ${author}` : 'Notice from a skill';
+    return `Reminder from ${author || 'Ouroboros'}`;
+}
+
+function noticeBody(content) {
+    const raw = text(content);
+    const cut = raw.indexOf('\n');
+    return cut >= 0 ? raw.slice(cut + 1) : raw;
+}
+
 /**
  * Classify ONE live frame into a notification candidate, or null.
  *
@@ -219,6 +235,18 @@ export function classifyLiveFrame(frame, { kind = 'chat', isMain = false, isRoot
         };
     }
 
+    // A message for the owner that nobody speaks NOW: no new category, the same
+    // `important` toggle (DESIGN §9).
+    if (systemType === 'reminder' || systemType === 'skill_notice') {
+        return {
+            category: 'important',
+            key: `important:${rowKey}`,
+            title: noticeTitle(systemType, frame.source),
+            body: trimBody(noticeBody(frame.content)),
+            target: { chatId: frame.chat_id, taskId },
+        };
+    }
+
     // A child's row never reaches the owner, whatever else it carries.
     if (text(frame.delegation_role).toLowerCase() === 'subagent') return null;
     // Only the AUTHORED summary is a task's ending in chat form. A bare
diff --git a/web/modules/settings.js b/web/modules/settings.js
index 25b4bcdb0..33b2c87c2 100644
--- a/web/modules/settings.js
+++ b/web/modules/settings.js
@@ -3,6 +3,7 @@ export { accountCatalogRefreshKey } from './settings_catalog.js';
 import { getNotifier } from './notifications.js';
 import { bindEffortSegments, syncEffortSegments, readCustomSecretDraft, collectCustomSecretDraft, paintSettingsFieldErrors, settingsWriteFailure } from './settings_controls.js';
 import { bindLocalModelControls } from './settings_local_model.js';
+import { bindAutostartControl } from './settings_autostart.js';
 import { applyMcpSettings, collectMcpSettings, initMcpSettings, validateMcpSettings } from './mcp_settings.js';
 import { adoptSubagentRoster, collectReviewerSlots, initReviewerSlots, reloadReviewerSlots, validateReviewerSlots, noteReviewerSlotsSaveAttempt, discardReviewerSlotsDraft, setReviewerProcessingPreference, setReviewerSourceContext } from './reviewer_slots.js';
 import {
@@ -470,6 +471,7 @@ export function initSettings({ state, setBeforePageLeave, ws } = {}) {
     // Notification preferences are client-local for the same reason; the module
     // owns delegated handlers, so mounting only paints current state.
     getNotifier().mountSettings(page);
+    bindAutostartControl(page); // host OS entry applied on click, never in the draft; self-disposing
     const disposeLocalModel = bindLocalModelControls({ state,
         onApplication: (local) => syncRestartState({ ...restartState, local_model: local }) });
     // Best-effort About version from /api/health.
@@ -1127,12 +1129,12 @@ export function initSettings({ state, setBeforePageLeave, ws } = {}) {
         });
     }
 
-    // Client-local blocks (appearance, notifications) live on the Appearance
-    // tab but never enter the /api/settings payload, so their controls must not
-    // make the server draft dirty — otherwise toggling one would ask the owner
-    // to discard "unsaved settings" that do not exist.
+    // Blocks outside the server draft (theme, notifications on Appearance; host
+    // sign-in startup on Behavior) never enter the /api/settings payload, so their
+    // controls must not make the server draft dirty — otherwise toggling one would
+    // ask the owner to discard "unsaved settings" that do not exist.
     const onServerSettingEdited = (event) => {
-        if (event?.target?.closest?.('[data-notify-settings]')) return;
+        if (event?.target?.closest?.('[data-notify-settings], [data-autostart-settings]')) return;
         onSettingsEdited();
     };
     page.addEventListener('input', onServerSettingEdited);
diff --git a/web/modules/settings_autostart.js b/web/modules/settings_autostart.js
new file mode 100644
index 000000000..086303606
--- /dev/null
+++ b/web/modules/settings_autostart.js
@@ -0,0 +1,94 @@
+import { apiClient } from './api_client.js';
+import { setInlineStatus } from './ui_primitives.js';
+
+/* Host startup is an immediate OS edit, separate from the /api/settings draft.
+   Re-read when Settings opens: the OS can change the same registration. */
+
+const NOTES = {
+    unavailable: 'Sign-in startup is unavailable on this host.',
+    on: '',
+    off: '',
+    other_copy: 'This host starts Ouroboros at sign-in from a different entry (another copy, or one set up by hand). Turn this on to start this copy instead.',
+    disabled_by_os: 'Turned off in the host operating system. Turn this on to enable it, or check the host’s startup settings if it stays disabled.',
+};
+
+export function bindAutostartControl(page) {
+    const section = page.querySelector('[data-autostart-settings]');
+    const box = section?.querySelector('[data-autostart-toggle]');
+    const status = section?.querySelector('[data-autostart-status]');
+    if (!section || !box) return () => {};
+    let destroyed = false;
+    let busy = false;
+    let generation = 0;
+
+    const paint = ({ state, reason }) => {
+        const known = Object.hasOwn(NOTES, state);
+        section.hidden = !known;
+        box.checked = state === 'on';
+        box.disabled = state === 'unavailable';
+        const note = known ? (reason || NOTES[state]) : '';
+        setInlineStatus(status, note, note ? 'warn' : 'muted');
+    };
+
+    const refresh = async () => {
+        if (busy || destroyed) return;
+        const current = ++generation;
+        try {
+            const snapshot = await apiClient.desktopAutostart();
+            if (!destroyed && !busy && current === generation) paint(snapshot);
+        } catch (error) {
+            // Shown even before any state is known: a lasting read failure stays explained.
+            if (destroyed || busy || current !== generation) return;
+            section.hidden = false;
+            box.disabled = true;
+            setInlineStatus(status, `Could not read the host startup entry: ${error.message}`, 'danger');
+        }
+    };
+
+    const onChange = async () => {
+        if (busy || destroyed) return;
+        const wanted = box.checked;
+        busy = true;
+        generation += 1; // a read that started before the click must not repaint over it
+        box.disabled = true;
+        setInlineStatus(status, '', 'muted');
+        try {
+            const snapshot = await apiClient.setDesktopAutostart(wanted);
+            busy = false;
+            if (!destroyed) paint(snapshot);
+        } catch (error) {
+            // A refusal may land between the two OS registration writes: show what the OS now holds.
+            let snapshot;
+            try { snapshot = await apiClient.desktopAutostart(); } catch { /* current state is unknown */ }
+            busy = false;
+            if (destroyed) return;
+            if (snapshot === undefined) {
+                box.checked = !wanted; // last observed value, not a claim about the current OS registration
+                box.disabled = true;
+                setInlineStatus(status, `Could not change the host startup entry: ${error.message}. Current host state could not be read; reopen Settings to retry.`, 'danger');
+            } else {
+                paint(snapshot);
+                setInlineStatus(status, `Could not change the host startup entry: ${error.message}`, 'danger');
+            }
+        }
+    };
+
+    const onPageShown = (event) => {
+        if (event.detail?.page === 'settings') void refresh();
+    };
+    const dispose = () => {
+        destroyed = true;
+        box.removeEventListener('change', onChange);
+        window.removeEventListener('ouro:page-shown', onPageShown);
+        window.removeEventListener('pagehide', onPageHide);
+    };
+    const onPageHide = (event) => {
+        if (!event.persisted) dispose();
+    };
+
+    box.addEventListener('change', onChange);
+    window.addEventListener('ouro:page-shown', onPageShown);
+    window.addEventListener('pagehide', onPageHide);
+    void refresh();
+    return dispose;
+}
diff --git a/web/modules/settings_ui.js b/web/modules/settings_ui.js
index f1ad8548c..3b5790e0f 100644
--- a/web/modules/settings_ui.js
+++ b/web/modules/settings_ui.js
@@ -409,6 +409,23 @@ export function renderSettingsPage() {
                 </section>
 
                 <section class="settings-panel" data-settings-panel="behavior">
+                    <div class="form-section" data-autostart-settings hidden>
+                        <!-- Future keep-running-after-close control shares this section. -->
+                        <h3>Startup &amp; background</h3>
+                        <div class="settings-section-copy">
+                            Applies immediately to the host computer running Ouroboros, including when you
+                            connect from another device. Signing in preserves Panic stops and saved pauses.
+                            Closing the desktop window still exits Ouroboros.
+                        </div>
+                        <div class="settings-effort-card">
+                            <label class="local-toggle ui-field ui-field-inline">
+                                <input type="checkbox" class="ui-checkbox" data-autostart-toggle>
+                                Start Ouroboros on the host computer when you sign in
+                            </label>
+                            <div class="settings-inline-status" data-autostart-status role="status" aria-live="polite"></div>
+                        </div>
+                    </div>
+
                     <div class="form-section">
                         <h3>Reasoning Effort</h3>
                         <div class="settings-section-copy">Preferred reasoning effort per task type. Unsupported levels adapt to the route; native mappings, required minimums or provider defaults may apply. Requested, sent and reported effort are recorded in Logs.</div>
@@ -780,7 +797,7 @@ export function renderSettingsPage() {
                             </label>
                             <label class="local-toggle ui-field ui-field-inline">
                                 <input type="checkbox" class="ui-checkbox" data-notify-pref="important">
-                                Messages Ouroboros sends you while it works
+                                Messages Ouroboros sends you while it works, its reminders, and skill notices
                             </label>
                             <label class="local-toggle ui-field ui-field-inline">
                                 <input type="checkbox" class="ui-checkbox" data-notify-pref="main_reply">
diff --git a/web/settings.css b/web/settings.css
index ed3665cdf..55635edb1 100644
--- a/web/settings.css
+++ b/web/settings.css
@@ -790,6 +790,11 @@
     cursor: pointer;
 }
 
+[data-autostart-settings] .local-toggle {
+    white-space: normal;
+    flex-wrap: nowrap;
+}
+
 .local-toggle[data-warning="1"] {
     color: var(--status-warn-fg);
 }
diff --git a/web/tests/activity_schedule_delete.test.js b/web/tests/activity_schedule_delete.test.js
index ad9a7bd87..13d43d1b1 100644
--- a/web/tests/activity_schedule_delete.test.js
+++ b/web/tests/activity_schedule_delete.test.js
@@ -59,3 +59,34 @@ test('the exact hold release stays reachable on a pending-delete continuation',
     assert.match(unknown, /resolve relationship in conversation/);
     assert.doesNotMatch(unknown, /data-act="schedule-toggle"/);
 });
+
+test('a note row is named by its own words and offers the same lifecycle', () => {
+    const note = {
+        id: 'followup-t1-abc123', name: 'Reminder of task t1', kind: 'notify', status: 'active', enabled: true,
+        relation: 'independent', trigger: { type: 'once', run_at: '2027-01-15T09:00:00Z' },
+        notification: { text: 'Call <mother>', set_at: '2027-01-15T08:00:00Z' },
+    };
+    const html = scheduleRowHtml(note);
+    assert.match(html, /<span class="activity-name" title="Call &lt;mother&gt;">Call &lt;mother&gt;<\/span>/);
+    assert.match(html, /<span class="activity-sub">reminder · one-shot · at\/after /);
+    assert.match(html, /data-act="schedule-toggle" data-id="followup-t1-abc123" data-action="disable">Disable</);
+    assert.match(html, /data-act="schedule-delete" data-id="followup-t1-abc123" data-managed="" data-note="1">Delete</);
+    const task = scheduleRowHtml({ ...note, kind: undefined });
+    assert.match(task, /<span class="activity-name">Reminder of task t1<\/span>/, 'a task row keeps its schedule name');
+    assert.match(task, /data-note="">Delete</);
+});
+
+test('a row shows its stored error: a consumed note whose chat write was not confirmed says so', () => {
+    const note = {
+        id: 'followup-t1-abc123', name: 'Reminder of task t1', kind: 'notify', status: 'consumed', enabled: false,
+        relation: 'independent', trigger: { type: 'once', run_at: '2027-01-15T09:00:00Z' },
+        completed_at: '2027-01-15T09:00:05Z', notification: { text: 'Call mother' },
+    };
+    const failed = scheduleRowHtml({ ...note, last_error: 'delivery <not> confirmed' });
+    assert.match(failed, / · already fired · <span class="activity-tag">last error: delivery &lt;not&gt; confirmed<\/span>/);
+    assert.match(failed, /consumed once · history/, 'still history: no retry control appears');
+    assert.doesNotMatch(failed, /data-act="schedule-toggle"/);
+    for (const quiet of [note, { ...note, last_error: '' }]) {
+        assert.doesNotMatch(scheduleRowHtml(quiet), /last error/, 'a row with no stored error says none');
+    }
+});
diff --git a/web/tests/chat_inflight_indicator.test.js b/web/tests/chat_inflight_indicator.test.js
index 210f776d6..e0b88c28c 100644
--- a/web/tests/chat_inflight_indicator.test.js
+++ b/web/tests/chat_inflight_indicator.test.js
@@ -11,6 +11,7 @@ import {
     createStateSnapshotSequencer,
     isForegroundLiveCard,
     routingAnnotationText,
+    unkeyedFrameEndsTurn,
 } from '../modules/chat_activity.js';
 
 const chatSource = readFileSync(new URL('../modules/chat.js', import.meta.url), 'utf8');
@@ -26,7 +27,7 @@ test('review-only owner anchors do not advertise foreground task activity', () =
 test('unkeyed terminal incidents do not clear unrelated live turns', () => {
     // The cleanup guard also requires positive terminal evidence. Keep this
     // source contract resilient to the guard's explicit conjunction while
-    // still checking the incident carve-out below it.
+    // still checking the carve-out below it (the typed kinds that end nothing).
     const cleanupStart = chatSource.indexOf('if (!finalizing && (!explicitTaskId || typedTerminal))');
     const finalCleanup = chatSource.slice(
         cleanupStart,
@@ -34,13 +35,27 @@ test('unkeyed terminal incidents do not clear unrelated live turns', () => {
     );
     assert.match(
         finalCleanup,
-        /} else if \(msg\.system_type !== 'terminal_incident'\) \{[^}]*?activeDirectActivities\.clear\(\);[^}]*?pendingSubmissions\.clear\(\);\s*}\s*}/,
+        /} else if \(unkeyedFrameEndsTurn\(msg\)\) \{[^}]*?activeDirectActivities\.clear\(\);[^}]*?pendingSubmissions\.clear\(\);\s*}\s*}/,
     );
     // Ordinary unkeyed finals retain their existing global cleanup semantics.
     assert.match(finalCleanup, /activeDirectActivities\.clear\(\);/);
     assert.match(finalCleanup, /pendingSubmissions\.clear\(\);/);
 });
 
+test('a note or skill notice arriving mid-turn keeps Thinking/Sending; an ordinary unkeyed final still ends it', () => {
+    // What the live handler does with the unscoped turn for each frame (the branch pinned above).
+    const turn = { isConnected: true, hasActiveLiveCard: false, activeDirectCount: 1, pendingSubmissionsCount: 1 };
+    const after = (frame) => computeDerivedChatStatus(unkeyedFrameEndsTurn(frame)
+        ? { ...turn, activeDirectCount: 0, pendingSubmissionsCount: 0 } : turn).text;
+    for (const kind of ['reminder', 'skill_notice', 'terminal_incident']) {
+        assert.equal(after({ role: 'system', system_type: kind, task_id: '', content: 'Call mother' }), 'Thinking...', kind);
+    }
+    assert.equal(after({ role: 'assistant', task_id: '', content: 'Done.' }), 'Online');
+    assert.equal(after({ role: 'system', system_type: 'startup_notice', task_id: '' }), 'Online');
+    // The kind decides, never the words: a reply that quotes a reminder still ends the turn.
+    assert.equal(after({ role: 'assistant', task_id: '', content: 'Reminder · Ouroboros · written Oct 3 14:05' }), 'Online');
+});
+
 test('routing receipts display the event-time label while keeping raw target metadata', () => {
     const annotation = {
         action: 'steer_task',
diff --git a/web/tests/notifications.test.js b/web/tests/notifications.test.js
index 4f37ab014..d4d689f26 100644
--- a/web/tests/notifications.test.js
+++ b/web/tests/notifications.test.js
@@ -8,6 +8,7 @@ import {
     createNotifier,
     decideNotification,
     attentionStatusText,
+    noticeTitle,
     normalizeNotifyPrefs,
     notifyStatusText,
     readNotifyPrefs,
@@ -469,3 +470,26 @@ test('settings controls paint current state and gate on the master switch', asyn
     await notifier.setPref('nope', true);
     assert.equal('nope' in notifier.prefs, false);
 });
+
+test('a reminder and a skill notice ring under the messages toggle, titled by their author', () => {
+    const reminder = {
+        type: 'chat', role: 'system', system_type: 'reminder', chat_id: 1, task_id: '', source: 'Ouroboros',
+        ts: '2026-10-03T12:00:01.000001+00:00',
+        content: 'Reminder · Ouroboros · written Oct 3 14:05 · for Oct 3 15:00 (UTC+3)\nCall mother',
+    };
+    const hit = classifyLiveFrame(reminder, { kind: 'chat', isMain: true });
+    assert.equal(hit.category, 'important', 'no new category and no new toggle');
+    assert.equal(hit.title, 'Reminder from Ouroboros');
+    assert.equal(hit.body, 'Call mother', 'the host signature line stays out of the banner body');
+    assert.equal(hit.key, 'important::2026-10-03T12:00:01.000001+00:00');
+    const seen = new Set();
+    assert.equal(decideNotification(hit, ON, seen).body, '', 'the words stay private until text is on');
+    assert.equal(decideNotification(hit, { ...ON, show_text: true }, seen).body, 'Call mother');
+    assert.equal(decideNotification(hit, { ...ON, important: false }, seen).reason, 'category_off');
+    const notice = classifyLiveFrame({ ...reminder, system_type: 'skill_notice', source: 'calendar',
+        content: 'Notice · calendar\nMeeting with Ivan in 15 min' }, { kind: 'chat', isMain: true });
+    assert.equal(notice.title, 'Notice from calendar');
+    assert.equal(notice.body, 'Meeting with Ivan in 15 min');
+    assert.equal(noticeTitle('skill_notice', ''), 'Notice from a skill');
+    assert.equal(noticeTitle('reminder', 'owner'), 'Reminder from owner', 'a row the owner set is signed by the owner');
+});
diff --git a/web/tests/notifications_attach.test.js b/web/tests/notifications_attach.test.js
index 13a88bcd1..2d533d624 100644
--- a/web/tests/notifications_attach.test.js
+++ b/web/tests/notifications_attach.test.js
@@ -232,3 +232,13 @@ test('attach without a socket is a no-op disposer, never a throw', () => {
     assert.equal(typeof release, 'function');
     release();
 });
+
+test('a reminder rings once from its live frame; history replay never reaches the notifier', () => {
+    const fx = fixture();
+    const frame = { role: 'system', system_type: 'reminder', chat_id: 1, source: 'Ouroboros',
+        ts: '2026-10-03T12:00:01+00:00', content: 'Reminder · Ouroboros · for Oct 3 15:00 (UTC+3)\nCall mother' };
+    fx.send('chat', frame);
+    fx.send('chat', frame);
+    assert.deepEqual(fx.titles(), ['Reminder from Ouroboros'], 'one row, one banner');
+    assert.equal(fx.handlers.has('history'), false, 'the notifier subscribes to live frames only');
+});
diff --git a/web/tests/settings_autostart.test.js b/web/tests/settings_autostart.test.js
new file mode 100644
index 000000000..9e9daba78
--- /dev/null
+++ b/web/tests/settings_autostart.test.js
@@ -0,0 +1,217 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { apiClient } from '../modules/api_client.js';
+import { bindAutostartControl } from '../modules/settings_autostart.js';
+
+function fakeWindow() {
+    const listeners = new Map();
+    return {
+        addEventListener: (type, fn) => listeners.set(type, fn),
+        removeEventListener: (type, fn) => { if (listeners.get(type) === fn) listeners.delete(type); },
+        fire: (type, event) => listeners.get(type)?.(event),
+        has: (type) => listeners.has(type),
+    };
+}
+
+function fakeBlock() {
+    let onChange = null;
+    const box = {
+        checked: false,
+        disabled: false,
+        addEventListener: (type, fn) => { if (type === 'change') onChange = fn; },
+        removeEventListener: (type, fn) => { if (onChange === fn) onChange = null; },
+    };
+    const status = { textContent: '', dataset: {} };
+    const section = {
+        hidden: true,
+        querySelector: (selector) => ({ '[data-autostart-toggle]': box, '[data-autostart-status]': status })[selector] || null,
+    };
+    const page = { querySelector: (selector) => (selector === '[data-autostart-settings]' ? section : null) };
+    const click = (checked) => { box.checked = checked; return onChange?.(); };
+    return { page, section, box, status, click, bound: () => onChange !== null };
+}
+
+function deferred() {
+    let resolve;
+    let reject;
+    const promise = new Promise((ok, fail) => { resolve = ok; reject = fail; });
+    return { promise, resolve, reject };
+}
+
+const settle = () => new Promise((resolve) => setImmediate(resolve));
+
+function withApi(t, { read, write }) {
+    const original = { read: apiClient.desktopAutostart, write: apiClient.setDesktopAutostart };
+    apiClient.desktopAutostart = read;
+    apiClient.setDesktopAutostart = write || (async () => { throw new Error('unexpected write'); });
+    const win = fakeWindow();
+    const previousWindow = globalThis.window;
+    globalThis.window = win;
+    t.after(() => {
+        apiClient.desktopAutostart = original.read;
+        apiClient.setDesktopAutostart = original.write;
+        globalThis.window = previousWindow;
+    });
+    return win;
+}
+
+test('unknown states stay hidden; unavailable hosts show a disabled explanation', async (t) => {
+    for (const state of ['something_newer', undefined]) {
+        withApi(t, { read: async () => ({ state }) });
+        const block = fakeBlock();
+        bindAutostartControl(block.page);
+        await settle();
+        assert.equal(block.section.hidden, true, `state ${state} keeps the block hidden`);
+        assert.equal(block.box.checked, false);
+    }
+});
+
+test('the OS state paints the toggle and explains entries it does not own', async (t) => {
+    let state = 'on';
+    const win = withApi(t, { read: async () => ({ state }) });
+    const block = fakeBlock();
+    bindAutostartControl(block.page);
+    await settle();
+    assert.equal(block.section.hidden, false);
+    assert.equal(block.box.checked, true);
+    assert.equal(block.status.textContent, '');
+
+    state = 'disabled_by_os'; // switched off in Windows Startup apps meanwhile
+    win.fire('ouro:page-shown', { detail: { page: 'settings' } });
+    await settle();
+    assert.equal(block.box.checked, false);
+    assert.match(block.status.textContent, /Turned off in the host operating system/);
+    assert.equal(block.status.dataset.tone, 'warn');
+
+    state = 'other_copy';
+    win.fire('ouro:page-shown', { detail: { page: 'chat' } });
+    await settle();
+    assert.match(block.status.textContent, /host operating system/, 'another page does not trigger a read');
+    win.fire('ouro:page-shown', { detail: { page: 'settings' } });
+    await settle();
+    assert.match(block.status.textContent, /from a different entry \(another copy/);
+});
+
+test('a click applies at once and a refused change shows what the OS now holds', async (t) => {
+    const writes = [];
+    let server = 'off';
+    let refuse = false;
+    let partial = false;
+    withApi(t, {
+        read: async () => ({ state: server }),
+        write: async (enabled) => {
+            writes.push(enabled);
+            if (partial) server = enabled ? 'on' : 'off'; // the Run value landed, the switch clear did not
+            if (refuse || partial) throw new Error('access denied');
+            server = enabled ? 'on' : 'off';
+            return { state: server };
+        },
+    });
+    const block = fakeBlock();
+    bindAutostartControl(block.page);
+    await settle();
+    await block.click(true);
+    assert.deepEqual(writes, [true]);
+    assert.equal(block.box.checked, true);
+    assert.equal(block.box.disabled, false);
+
+    refuse = true;
+    await block.click(false);
+    assert.deepEqual(writes, [true, false]);
+    assert.equal(block.box.checked, true, 'the entry is still there, so the toggle says so');
+    assert.match(block.status.textContent, /Could not change the host startup entry: access denied/);
+    assert.equal(block.status.dataset.tone, 'danger');
+
+    refuse = false;
+    partial = true;
+    await block.click(false);
+    assert.equal(block.box.checked, false, 'a refusal after the first write is read back, not guessed');
+    assert.equal(block.box.disabled, false);
+    assert.equal(block.status.dataset.tone, 'danger');
+});
+
+test('a read that started before a click cannot repaint over the owner choice', async (t) => {
+    const slowRead = deferred();
+    withApi(t, {
+        read: () => slowRead.promise,
+        write: async () => ({ state: 'on' }),
+    });
+    const block = fakeBlock();
+    block.section.hidden = false;
+    bindAutostartControl(block.page);
+    await block.click(true);
+    slowRead.resolve({ state: 'off' });
+    await settle();
+    assert.equal(block.box.checked, true);
+});
+
+test('a failed write and failed read never assert a guessed host state', async (t) => {
+    let unreadable = false;
+    const win = withApi(t, {
+        read: async () => {
+            if (unreadable) throw new Error('read failed');
+            return { state: 'off' };
+        },
+        write: async () => { unreadable = true; throw new Error('write failed'); },
+    });
+    const block = fakeBlock();
+    bindAutostartControl(block.page);
+    await settle();
+    await block.click(true);
+    assert.equal(block.box.disabled, true);
+    assert.match(block.status.textContent, /Current host state could not be read/);
+    assert.equal(block.status.dataset.tone, 'danger');
+    unreadable = false;
+    win.fire('ouro:page-shown', { detail: { page: 'settings' } });
+    await settle();
+    assert.equal(block.box.checked, false);
+    assert.equal(block.box.disabled, false);
+});
+
+test('a failed first read shows the block with the error and retries when Settings opens', async (t) => {
+    let failing = true;
+    const win = withApi(t, {
+        read: async () => {
+            if (failing) throw new Error('systemctl did not answer');
+            return { state: 'off' };
+        },
+    });
+    const block = fakeBlock();
+    bindAutostartControl(block.page);
+    await settle();
+    assert.equal(block.section.hidden, false, 'a lasting read error is explained, not hidden');
+    assert.equal(block.box.disabled, true);
+    assert.equal(block.status.textContent, 'Could not read the host startup entry: systemctl did not answer');
+    assert.equal(block.status.dataset.tone, 'danger');
+    failing = false;
+    win.fire('ouro:page-shown', { detail: { page: 'settings' } });
+    await settle();
+    assert.equal(block.box.disabled, false);
+    assert.equal(block.status.textContent, '');
+});
+
+test('pagehide releases every listener the block took', async (t) => {
+    const win = withApi(t, { read: async () => ({ state: 'off' }) });
+    const block = fakeBlock();
+    bindAutostartControl(block.page);
+    await settle();
+    win.fire('pagehide', { persisted: true });
+    assert.equal(block.bound(), true, 'a bfcache hide keeps the page alive');
+    win.fire('pagehide', { persisted: false });
+    assert.equal(block.bound(), false);
+    assert.equal(win.has('ouro:page-shown'), false);
+    assert.equal(win.has('pagehide'), false);
+});
+
+for (const reason of ['Sign-in startup needs a newer app build (7.2.0 or later).', 'Move Ouroboros to Applications before enabling sign-in startup.']) {
+    test(reason, async (t) => {
+        withApi(t, { read: async () => ({ state: 'unavailable', reason }) });
+        const block = fakeBlock();
+        bindAutostartControl(block.page);
+        await settle();
+        assert.equal(block.section.hidden, false);
+        assert.equal(block.box.disabled, true);
+        assert.equal(block.status.textContent, reason);
+    });
+}