diff --git a/packages/core/src/session/execution/worktree.ts b/packages/core/src/session/execution/worktree.ts
index 9d3532d95b8d..ab43b0547994 100644
--- a/packages/core/src/session/execution/worktree.ts
+++ b/packages/core/src/session/execution/worktree.ts
@@ -12,7 +12,7 @@ export * as WorktreeMaterializer from "./worktree"
 // hosts still cannot see each other's writes, because those are not captured until the step is
 // sealed. One worker per worktree is what makes a step's tools share a tree.
 
-import { rm, writeFile } from "node:fs/promises"
+import { readdir, rm, writeFile } from "node:fs/promises"
 import path from "path"
 import { Cause, Context, Effect, Layer } from "effect"
 import { ChildProcess } from "effect/unstable/process"
@@ -45,6 +45,15 @@ export class Service extends Context.Service<Service, Interface>()(
 // HEAD of a rebuilt tree, which doubles as the mark that says the tree is ours to move.
 const RESTORED = "refs/heads/opencode-restore"
 
+// Nothing in it at all, so there is no work to protect and nothing to lose by checking a tree out
+// over it. Unreadable counts as not empty: a directory we cannot look into is not one to overwrite.
+const isEmptyDir = (dir: string) =>
+  Effect.promise(() =>
+    readdir(dir)
+      .then((entries) => entries.length === 0)
+      .catch(() => false),
+  )
+
 const layer = Layer.effect(
   Service,
   Effect.gen(function* () {
@@ -167,7 +176,12 @@ const layer = Layer.effect(
         .get()
         .pipe(Effect.orDie)
       if (!tip) return
-      const present = yield* fs.existsSafe(tip.worktree)
+      // An empty directory is not somebody's working copy, so the rule that protects one does not
+      // apply to it. Treating it as present is what stops a fresh host from ever building the tree:
+      // it has no tip note, so `behind` says no, and the tools then run against nothing. A mounted
+      // path that exists but holds nothing is the ordinary shape of a host that has never seen this
+      // project, which is exactly the case the packs are for.
+      const present = (yield* fs.existsSafe(tip.worktree)) && !(yield* isEmptyDir(tip.worktree))
       if (present) {
         if (!(yield* behind(tip))) return
         if (!(yield* rebuilt(tip.worktree))) {
@@ -180,8 +194,12 @@ const layer = Layer.effect(
       }
       yield* locks.withLock(tip.worktree)(
         Effect.gen(function* () {
-          // Re-check inside the lock: a concurrent drain may have done this already.
-          if ((yield* fs.existsSafe(tip.worktree)) && !(yield* behind(tip))) return
+          // Re-check inside the lock: a concurrent drain may have done this already. Same notion of
+          // present as above, or an empty directory bails out here instead and the tree that the
+          // outer check just decided to build never gets built.
+          const here =
+            (yield* fs.existsSafe(tip.worktree)) && !(yield* isEmptyDir(tip.worktree))
+          if (here && !(yield* behind(tip))) return
           yield* materialize(tip).pipe(
             Effect.catchCauseIf(
               (cause) => !Cause.hasInterrupts(cause),
diff --git a/packages/core/test/worktree-materialize.test.ts b/packages/core/test/worktree-materialize.test.ts
index beb0eba19186..c9c83557dc93 100644
--- a/packages/core/test/worktree-materialize.test.ts
+++ b/packages/core/test/worktree-materialize.test.ts
@@ -109,6 +109,46 @@ describe("WorktreeMaterializer", () => {
     }),
   )
 
+  it.live("rebuilds into a directory that exists but is empty", () =>
+    Effect.gen(function* () {
+      const tmp = yield* Effect.promise(() => tmpdir())
+      const root = realpathSync(tmp.path)
+      const worktree = path.join(root, "project")
+      const file = path.join(root, "shared.db")
+      yield* Effect.promise(async () => {
+        await mkdir(worktree, { recursive: true })
+        await $`git init -q ${worktree}`.quiet()
+        await $`git -C ${worktree} config user.email t@t`.quiet()
+        await $`git -C ${worktree} config user.name t`.quiet()
+        await writeFile(path.join(worktree, "note.txt"), "travelled\n")
+        await $`git -C ${worktree} add .`.quiet()
+        await $`git -C ${worktree} commit -qm seed`.quiet()
+      })
+
+      const A = yield* Layer.build(captureStack(file, worktree, path.join(root, "host-a-data")))
+      const captured = yield* Snapshot.Service.use((s) => s.capture()).pipe(Effect.provide(A))
+      if (!captured) throw new Error("expected a capture")
+      yield* SnapshotSync.Service.use((s) => s.push(captured)).pipe(Effect.provide(A))
+
+      // The shape a container gives a fresh host: the path is there because something mounted it,
+      // and there is nothing in it. Deleting the directory instead is the case already covered,
+      // and it is the easy one: an absent tree is obviously safe to build.
+      yield* Effect.promise(async () => {
+        await rm(worktree, { recursive: true, force: true })
+        await mkdir(worktree, { recursive: true })
+      })
+
+      const B = yield* Layer.build(materializeStack(file, path.join(root, "host-b-data")))
+      yield* WorktreeMaterializer.Service.use((w) => w.ensure(worktree)).pipe(Effect.provide(B))
+
+      expect(yield* Effect.promise(() => readFile(path.join(worktree, "note.txt"), "utf8"))).toBe(
+        "travelled\n",
+      )
+
+      yield* Effect.promise(() => tmp[Symbol.asyncDispose]())
+    }),
+  )
+
   it.live("moves a rebuilt tree forward, and leaves a tree it did not build alone", () =>
     Effect.gen(function* () {
       const tmp = yield* Effect.promise(() => tmpdir())
diff --git a/packages/opencode/src/cli/cmd/detached.ts b/packages/opencode/src/cli/cmd/detached.ts
new file mode 100644
index 000000000000..b5882af5e4ac
--- /dev/null
+++ b/packages/opencode/src/cli/cmd/detached.ts
@@ -0,0 +1,214 @@
+// Commands for a session nobody is sitting in front of: start one and walk away, ask the
+// deployment what it is still running, and follow one from a machine that never had it.
+//
+// These are thin HTTP clients on purpose. In a durable deployment the serve processes are
+// interchangeable (any of them reads the shared store and signals the same workflows), so a client
+// needs an endpoint and a session id, never a particular host. That is the whole reason a session
+// can outlive the process that started it, and it is why nothing here imports Temporal.
+
+import type { Argv } from "yargs"
+import { cmd } from "./cmd"
+import { UI } from "../ui"
+import { ServerAuth } from "@/server/auth"
+
+const DEFAULT_URL = "http://127.0.0.1:4096"
+
+type Remote = { readonly url: string; readonly headers: Record<string, string> }
+
+function remote(args: { attach?: string; password?: string; username?: string }): Remote {
+  const url = (args.attach ?? process.env["OPENCODE_SERVER"] ?? DEFAULT_URL).replace(/\/+$/, "")
+  // No password configured is a valid deployment, so absent auth is absent headers, not an error.
+  return { url, headers: ServerAuth.headers({ password: args.password, username: args.username }) ?? {} }
+}
+
+async function call<T>(r: Remote, path: string, init?: RequestInit): Promise<T> {
+  const response = await fetch(`${r.url}/api${path}`, {
+    ...init,
+    headers: { ...r.headers, ...(init?.body ? { "content-type": "application/json" } : {}), ...init?.headers },
+  })
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "")
+    throw new Error(`${init?.method ?? "GET"} /api${path} failed: ${response.status} ${detail.slice(0, 200)}`)
+  }
+  if (response.status === 204) return undefined as T
+  const body = (await response.json()) as { data: T }
+  return body.data
+}
+
+// The remote-facing options every command here shares. Kept in one builder so a second endpoint
+// flag can never drift between them.
+function remoteOptions(yargs: Argv) {
+  return yargs
+    .option("attach", {
+      type: "string",
+      describe: `server to talk to (default ${DEFAULT_URL}, or $OPENCODE_SERVER)`,
+    })
+    .option("password", { alias: "p", type: "string", describe: "basic auth password" })
+    .option("username", { alias: "u", type: "string", describe: "basic auth username" })
+    .option("json", { type: "boolean", describe: "print machine-readable output", default: false })
+}
+
+interface SessionInfo {
+  id: string
+  title?: string
+  time?: { created?: number; updated?: number }
+  location?: { directory?: string }
+}
+
+const stamp = (ms?: number) => (ms ? new Date(ms).toISOString().replace("T", " ").slice(0, 19) : "")
+
+// UI.println writes to stderr, which is right for a person and wrong for a pipe. Anything a script
+// is meant to read goes to stdout instead.
+const emit = (line: string) => process.stdout.write(line + "\n")
+
+export const SessionStartCommand = cmd({
+  command: "start <prompt>",
+  describe: "start a session, hand it a prompt, and return without waiting for it",
+  builder: (yargs: Argv) =>
+    remoteOptions(yargs)
+      .positional("prompt", { type: "string", describe: "what the agent should do", demandOption: true })
+      .option("dir", { type: "string", describe: "session working directory (default: this one)" })
+      .option("model", { type: "string", describe: "provider/model, e.g. openai/gpt-5-mini" }),
+  handler: async (args) => {
+    const r = remote(args)
+    try {
+      const directory = args.dir ?? process.cwd()
+      const session = await call<SessionInfo>(r, "/session", {
+        method: "POST",
+        body: JSON.stringify({ directory }),
+      })
+      if (args.model) {
+        const slash = args.model.indexOf("/")
+        if (slash < 1) throw new Error(`--model wants provider/model, got ${args.model}`)
+        const model = { providerID: args.model.slice(0, slash), id: args.model.slice(slash + 1) }
+        await call(r, `/session/${session.id}/model`, { method: "POST", body: JSON.stringify({ model }) })
+      }
+      // The prompt is admitted, not awaited. Whoever is polling the task queue runs the turn, and
+      // this process has nothing left to do with it.
+      await call(r, `/session/${session.id}/prompt`, {
+        method: "POST",
+        body: JSON.stringify({ prompt: { text: args.prompt } }),
+      })
+      if (args.json) {
+        emit(JSON.stringify({ id: session.id, directory, url: r.url }))
+        return
+      }
+      emit(session.id)
+      UI.println(`  follow it with: opencode session watch ${session.id}`)
+    } catch (error) {
+      UI.error(error instanceof Error ? error.message : String(error))
+      process.exitCode = 1
+    }
+  },
+})
+
+export const SessionRunningCommand = cmd({
+  command: "running",
+  describe: "list the sessions this deployment is executing right now",
+  builder: (yargs: Argv) => remoteOptions(yargs),
+  handler: async (args) => {
+    const r = remote(args)
+    try {
+      // Which sessions are running is the executor's answer, not a guess from the transcript: a
+      // durable deployment reads it from the running workflows, so it survives a restart of
+      // whichever process happens to be answering this call.
+      const active = await call<Record<string, { type: string }>>(r, "/session/active")
+      const ids = Object.keys(active)
+      if (args.json) {
+        emit(JSON.stringify(ids.map((id) => ({ id, status: active[id]?.type }))))
+        return
+      }
+      if (ids.length === 0) {
+        UI.println("nothing running")
+        return
+      }
+      const all = await call<SessionInfo[]>(r, "/session").catch(() => [] as SessionInfo[])
+      const byId = new Map(all.map((s) => [s.id, s]))
+      for (const id of ids) {
+        const session = byId.get(id)
+        const cells = [id, active[id]?.type ?? "?", stamp(session?.time?.updated), session?.title ?? ""]
+        emit(cells.join("  "))
+      }
+    } catch (error) {
+      UI.error(error instanceof Error ? error.message : String(error))
+      process.exitCode = 1
+    }
+  },
+})
+
+// What a follower prints. The stream carries far more than a person watching wants to read, so this
+// keeps the events that say the work moved and drops the token-level ones.
+const INTERESTING: Record<string, (data: any) => string | undefined> = {
+  "session.next.prompted": () => "prompted",
+  "session.next.step.started": () => "step",
+  "session.next.tool.called": (d) => `tool ${d.tool}: ${JSON.stringify(d.input ?? {}).slice(0, 120)}`,
+  "session.next.tool.success": (d) => `tool ok  ${firstText(d.content).slice(0, 200)}`,
+  "session.next.tool.failed": (d) => `tool failed  ${firstText(d.content).slice(0, 200)}`,
+  "session.next.text.ended": (d) => (d.text ? `said: ${String(d.text).slice(0, 400)}` : undefined),
+  "session.next.step.failed": (d) => `step failed: ${d.error?.message ?? ""}`,
+}
+
+function firstText(content: unknown): string {
+  if (!Array.isArray(content)) return ""
+  const part = content.find((c) => c && typeof c === "object" && (c as any).type === "text") as any
+  return part?.text ? String(part.text).trim() : ""
+}
+
+export const SessionWatchCommand = cmd({
+  command: "watch <sessionID>",
+  describe: "follow a running session from anywhere, and exit when it goes idle",
+  builder: (yargs: Argv) =>
+    remoteOptions(yargs)
+      .positional("sessionID", { type: "string", describe: "session to follow", demandOption: true })
+      .option("wait", { type: "boolean", default: true, describe: "keep following until the session is idle" }),
+  handler: async (args) => {
+    const r = remote(args)
+    const sessionID = args.sessionID
+    try {
+      const response = await fetch(`${r.url}/api/session/${sessionID}/event`, { headers: r.headers })
+      if (!response.ok || !response.body) throw new Error(`cannot follow ${sessionID}: ${response.status}`)
+
+      // Where a turn ends, from the model's own finish reason: `tool-calls` is the one that means
+      // another step follows. The running-session set cannot answer this, because a session stays
+      // in it while its supervisor waits out the idle timeout with nothing left to do.
+      const turnOver = (event: { type?: string; data?: any }) =>
+        event.type === "session.next.step.failed" ||
+        (event.type === "session.next.step.ended" && event.data?.finish !== "tool-calls")
+
+      const reader = response.body.getReader()
+      const decoder = new TextDecoder()
+      let buffer = ""
+      for (;;) {
+        const { done, value } = await reader.read()
+        if (done) break
+        buffer += decoder.decode(value, { stream: true })
+        const lines = buffer.split("\n")
+        buffer = lines.pop() ?? ""
+        for (const raw of lines) {
+          const line = raw.startsWith("data:") ? raw.slice(5).trim() : raw.trim()
+          if (!line.startsWith("{")) continue
+          let event: { type?: string; data?: any }
+          try {
+            event = JSON.parse(line)
+          } catch {
+            continue
+          }
+          if (args.json) {
+            emit(line)
+          } else {
+            const render = event.type ? INTERESTING[event.type] : undefined
+            const text = render?.(event.data ?? {})
+            if (text) UI.println(`${stamp(event.data?.timestamp)}  ${text}`)
+          }
+          if (args.wait && turnOver(event)) {
+            await reader.cancel().catch(() => {})
+            return
+          }
+        }
+      }
+    } catch (error) {
+      UI.error(error instanceof Error ? error.message : String(error))
+      process.exitCode = 1
+    }
+  },
+})
diff --git a/packages/opencode/src/cli/cmd/session.ts b/packages/opencode/src/cli/cmd/session.ts
index 9e6ddda9d2d8..9dcaf2f56eba 100644
--- a/packages/opencode/src/cli/cmd/session.ts
+++ b/packages/opencode/src/cli/cmd/session.ts
@@ -1,6 +1,7 @@
 import type { Argv } from "yargs"
 import { Effect } from "effect"
 import { cmd } from "./cmd"
+import { SessionRunningCommand, SessionStartCommand, SessionWatchCommand } from "./detached"
 import { effectCmd, fail } from "../effect-cmd"
 import { Session } from "@/session/session"
 import { SessionID } from "../../session/schema"
@@ -44,7 +45,14 @@ function pagerCmd(): string[] {
 export const SessionCommand = cmd({
   command: "session",
   describe: "manage sessions",
-  builder: (yargs: Argv) => yargs.command(SessionListCommand).command(SessionDeleteCommand).demandCommand(),
+  builder: (yargs: Argv) =>
+    yargs
+      .command(SessionListCommand)
+      .command(SessionDeleteCommand)
+      .command(SessionStartCommand)
+      .command(SessionRunningCommand)
+      .command(SessionWatchCommand)
+      .demandCommand(),
   async handler() {},
 })
 
diff --git a/packages/temporal/README.md b/packages/temporal/README.md
index d2d8ac5a6f95..43eafc99dce9 100644
--- a/packages/temporal/README.md
+++ b/packages/temporal/README.md
@@ -588,6 +588,81 @@ Host-local state that does NOT ride the DB, so it is not reconstructed on a diff
   `${data}`
   (the XDG data dir) at shared storage to make them portable.
 
+## A session that outlives its client
+
+Everything above makes a session survive a worker. Together the same pieces make it survive the
+*client*, which is the part a user can feel: start something, close the laptop, and pick it up from
+a machine that has never seen it.
+
+Nothing new is needed underneath. A session is already a workflow rather than a process, the
+running set already comes from Temporal visibility, the store is already shared, and a live tail
+already re-reads so a subscriber sees work another process is doing. What was missing was a way to
+say so from a command line, which is these three:
+
+```bash
+# hand over a prompt and walk away; prints the session id and exits
+opencode session start "port the auth module to the new API" --attach http://gateway:4096
+
+# what is this deployment running right now, across every client that ever connected
+opencode session running --attach http://gateway:4096
+
+# follow one from anywhere, and stop when the turn stops
+opencode session watch ses_abc123 --attach http://gateway:4096
+```
+
+`--attach` takes any serve in the deployment, because they are interchangeable: each one reads the
+same store and signals the same workflows. There is no "the server that owns this session". That is
+the property, and it is why these commands are plain HTTP clients with no Temporal dependency.
+`$OPENCODE_SERVER` sets the endpoint once. For an interactive terminal instead of a follower,
+`opencode attach <url> --session <id>` already puts the TUI on a remote session.
+
+To run it as a deployment rather than a laptop:
+
+```bash
+export OPENCODE_SESSION_EXECUTION=temporal
+export OPENCODE_DB_URL=libsql://...     # one store, so any worker resumes any session
+export TEMPORAL_ADDRESS=...
+
+OPENCODE_TEMPORAL_ROLE=worker bun run packages/server/src/worker.ts   # as many as you want
+OPENCODE_TEMPORAL_ROLE=client opencode serve --port 4096             # as many as you want
+```
+
+### Verified
+
+`packages/temporal/scripts/detached-session-check.sh` runs the whole claim against real processes:
+serve A starts a turn and is killed with a tool still running, the turn finishes on a standalone
+worker, and serve B (which never saw the session) reports it running and replays the transcript.
+Then `session start` returns without waiting, `session running` lists it, and `session watch`
+follows it live from a cold client and exits when the turn ends.
+
+The shared store is load-bearing, and the check proves it rather than assuming it: give serve B its
+own `OPENCODE_DB` and the three cross-process assertions fail (`active` returns `{}`, the replay is
+empty, the follower hangs) while the serve-A-and-worker ones still pass.
+
+### Across two machines
+
+`packages/temporal/scripts/cross-host-check.sh` runs the claim against containers, where each worker
+has its own filesystem and hostname and the store is a real libSQL server. A session writes a file
+on worker A, worker A's host is killed, and worker B, whose project volume is empty, continues the
+same session and reads that file back.
+
+That check found a bug a single host cannot show. `WorktreeMaterializer.ensure` treated any existing
+directory as somebody's working copy, and a fresh host has no tip note, so `behind` said no and the
+tree was never built. The tools then ran against an empty directory and the model was told a wrong
+answer, which is worse than a failure. On one host the case never appears: worker B either has the
+project already or has no directory at all, and an absent directory materializes fine. A mounted
+empty directory is the shape of a machine that has never seen the session, and it now materializes
+too (`packages/core/test/worktree-materialize.test.ts` covers it).
+
+The compose file mounts the engine's source over the image, so a code change does not need a new
+image. One libSQL server, so this shows a shared store over a network rather than one that survives
+losing a node.
+
+Still to do. A turn started from a schedule or a webhook needs an entry point of its own;
+`session start` is a command, so something has to run it. And the deployment above is a set of
+environment variables rather than a supported mode, so defaults, migration-on-deploy, and
+credential distribution are still the operator's problem.
+
 ## Porting this pattern
 
 The shape transfers to any agent engine; Temporal is one executor behind a seam the engine owns.
diff --git a/packages/temporal/docker/Dockerfile b/packages/temporal/docker/Dockerfile
new file mode 100644
index 000000000000..48f699b5829f
--- /dev/null
+++ b/packages/temporal/docker/Dockerfile
@@ -0,0 +1,31 @@
+# A worker (or a serve) as its own machine. Running this in containers is what turns "any worker
+# resumes any session" from a claim about processes into a claim about hosts: each of these has its
+# own filesystem, its own hostname, and nothing of the session on disk. What they share is the
+# Temporal cluster and one libSQL store, which is exactly what the README asks an operator to set up.
+
+FROM oven/bun:1.3.14
+
+# python3 and a compiler are here for one dependency: a tree-sitter grammar builds from source at
+# install time. git is not incidental either: the snapshot packs a worker rebuilds a worktree from are git packs, so a
+# host that has never seen the project needs it to materialize the tree.
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends git ca-certificates procps curl \
+       python3 make g++ \
+  && rm -rf /var/lib/apt/lists/* \
+  && git config --system user.email opencode@example.com \
+  && git config --system user.name opencode \
+  && git config --system init.defaultBranch main \
+  && git config --system --add safe.directory '*'
+
+WORKDIR /app
+
+COPY package.json bun.lock bunfig.toml tsconfig.json* ./
+COPY patches ./patches
+COPY packages ./packages
+RUN bun install --frozen-lockfile
+
+ENV OPENCODE_SESSION_EXECUTION=temporal
+
+# The worker by default. The serve role overrides this in compose; both build the same application
+# context, so the only difference is whether an HTTP surface comes with it.
+CMD ["bun", "run", "packages/server/src/worker.ts"]
diff --git a/packages/temporal/docker/compose.yml b/packages/temporal/docker/compose.yml
new file mode 100644
index 000000000000..a063433fa795
--- /dev/null
+++ b/packages/temporal/docker/compose.yml
@@ -0,0 +1,103 @@
+# Two workers that are two machines, not two processes on one.
+#
+# What they share is what an operator is told to share: one Temporal cluster and one libSQL store.
+# What they do not share is the session's working tree. `worker-a` has the project, `worker-b` gets
+# an empty volume, so a session that moves between them has to rebuild the tree from the snapshot
+# packs in the store. That is the part a single host can never really test, because there the tree
+# is already sitting on the disk the other process is reading.
+#
+#   docker compose -f packages/temporal/docker/compose.yml up -d temporal sqld serve worker-a
+#
+# Not covered: one libSQL server, so this shows a shared store over a network rather than a store
+# that survives losing a node.
+
+name: opencode-l3
+
+# A mapping rather than a list, because a list cannot be merged: a service that adds one variable
+# would otherwise replace the whole set and silently lose the store.
+x-env: &env
+  OPENCODE_SESSION_EXECUTION: temporal
+  TEMPORAL_ADDRESS: temporal:7233
+  # One store for every host. Without it a session belongs to whichever machine holds its file.
+  OPENCODE_DB_URL: http://sqld:8080
+  OPENCODE_TEMPORAL_STEPPED: "1"
+  OPENCODE_SERVER_PASSWORD: ${OPENCODE_SERVER_PASSWORD:-l3-check}
+  OPENAI_API_KEY: ${OPENAI_API_KEY:?set OPENAI_API_KEY}
+
+x-app: &app
+  image: opencode-temporal:l3
+  # The engine's own source, over the copy baked into the image. bun runs TypeScript directly, so
+  # this is the same code the image would have had; mounting it keeps a one-file change from
+  # costing a full dependency install, which is most of the build.
+  volumes:
+    - ../../core/src:/app/packages/core/src:ro
+    - ../src:/app/packages/temporal/src:ro
+  depends_on:
+    temporal:
+      condition: service_healthy
+    sqld:
+      condition: service_started
+
+services:
+  temporal:
+    image: temporalio/admin-tools:1.29
+    # The image's own entrypoint is `sleep infinity`, so a command alone becomes arguments to sleep.
+    entrypoint: ["temporal"]
+    command: ["server", "start-dev", "--ip", "0.0.0.0", "--log-level", "warn"]
+    ports:
+      - "7243:7233"
+    healthcheck:
+      test: ["CMD", "temporal", "operator", "cluster", "health", "--address", "127.0.0.1:7233"]
+      interval: 5s
+      timeout: 5s
+      retries: 40
+
+  sqld:
+    image: ghcr.io/tursodatabase/libsql-server:latest
+    environment:
+      - SQLD_NODE=primary
+    ports:
+      - "8081:8080"
+
+  # Drives workflows, hosts no worker, and is the only thing with an HTTP surface.
+  serve:
+    <<: *app
+    environment:
+      <<: *env
+      OPENCODE_TEMPORAL_ROLE: client
+    # Absolute, because working_dir is the project rather than the checkout: a relative entry path
+    # would be looked for inside the session's tree.
+    command: ["bun", "run", "/app/packages/cli/src/index.ts", "serve", "--port", "4096", "--hostname", "0.0.0.0"]
+    working_dir: /project
+    ports:
+      - "4096:4096"
+    volumes:
+      - ../../core/src:/app/packages/core/src:ro
+      - ../src:/app/packages/temporal/src:ro
+      - project-a:/project
+
+  worker-a:
+    <<: *app
+    environment:
+      <<: *env
+      OPENCODE_TEMPORAL_ROLE: worker
+    volumes:
+      - ../../core/src:/app/packages/core/src:ro
+      - ../src:/app/packages/temporal/src:ro
+      - project-a:/project
+
+  # No project volume of its own that has ever seen this session: an empty tree, so the worktree has
+  # to come from the packs in the store.
+  worker-b:
+    <<: *app
+    environment:
+      <<: *env
+      OPENCODE_TEMPORAL_ROLE: worker
+    volumes:
+      - ../../core/src:/app/packages/core/src:ro
+      - ../src:/app/packages/temporal/src:ro
+      - project-b:/project
+
+volumes:
+  project-a:
+  project-b:
diff --git a/packages/temporal/scripts/cross-host-check.sh b/packages/temporal/scripts/cross-host-check.sh
new file mode 100755
index 000000000000..9670e5a4018d
--- /dev/null
+++ b/packages/temporal/scripts/cross-host-check.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# Any worker resumes any session, across machines rather than across processes.
+#
+# On one host the second worker already has the project on disk, so the interesting half of the
+# claim is never exercised: the tree is there whether or not anything shipped it. Here worker B is a
+# container with an empty project volume, so a session that moves to it has to bring its worktree
+# along, out of the snapshot packs in the shared store.
+#
+# Usage: OPENAI_API_KEY=... packages/temporal/scripts/cross-host-check.sh
+#
+# Not covered: one libSQL server, so this shows a shared store over a network rather than one that
+# survives losing a node.
+
+set -uo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/../../.."
+COMPOSE="docker compose -f packages/temporal/docker/compose.yml"
+MODEL_ID="${MODEL_ID:-gpt-5-mini}"
+
+fails=0
+ok()  { printf 'PASS %s\n' "$1"; }
+bad() { printf 'FAIL %s   (%s)\n' "$1" "${2:-}"; fails=$((fails + 1)); }
+
+# KEEP=1 leaves the stack up, which is the difference between reading a failure and guessing at it.
+cleanup() { [ -n "${KEEP:-}" ] || $COMPOSE down -v >/dev/null 2>&1; }
+trap cleanup EXIT
+
+[ -n "${OPENAI_API_KEY:-}" ] || { echo "set OPENAI_API_KEY"; exit 1; }
+
+$COMPOSE down -v >/dev/null 2>&1
+# Only when the image is missing. The compose file mounts the engine's source over the image, so a
+# code change does not need a new one, and the dependency install is most of the build.
+if ! docker image inspect opencode-temporal:l3 >/dev/null 2>&1; then
+  docker build -f packages/temporal/docker/Dockerfile -t opencode-temporal:l3 . >/dev/null \
+    || { echo "build failed"; exit 1; }
+fi
+$COMPOSE up -d temporal sqld serve worker-a >/dev/null 2>&1 || { echo "stack failed"; exit 1; }
+
+api() { curl -s -u "opencode:$PW" "$@"; }
+
+# The serve generates its own password on first boot and prefers it over the environment, so ask it
+# rather than tell it.
+PW=""
+for _ in $(seq 1 60); do
+  PW=$($COMPOSE exec -T serve sh -c 'cat /root/.local/state/opencode/password 2>/dev/null' 2>/dev/null | tr -d '\r\n')
+  [ -n "$PW" ] && break
+  sleep 3
+done
+[ -n "$PW" ] && ok "serve is up" || { bad "serve never came up"; exit 1; }
+
+hostA=$($COMPOSE exec -T worker-a hostname 2>/dev/null | tr -d '\r')
+[ -n "$hostA" ] && ok "worker A is a host of its own ($hostA)" || bad "worker A came up"
+
+# A project only worker A and serve can see.
+$COMPOSE exec -T serve sh -c \
+  'cd /project && git init -q 2>/dev/null; echo hello > README.md; git add -A; git commit -qm init' \
+  >/dev/null 2>&1
+
+new_session() {
+  api -X POST http://127.0.0.1:4096/api/session -H 'content-type: application/json' \
+    -d '{"directory":"/project"}' | sed -n 's/^{"data":{"id":"\([^"]*\)".*/\1/p'
+}
+prompt() {
+  api -o /dev/null -X POST "http://127.0.0.1:4096/api/session/$1/prompt" \
+    -H 'content-type: application/json' -d "{\"prompt\":{\"text\":$2}}"
+}
+# A turn is over when a step of it ends on "stop", which is not the same as the session leaving the
+# running set: the supervisor stays open for its idle timeout with nothing left to do. Counted
+# rather than matched, because the history of a second turn still contains the first one's ending,
+# and matching would call every later turn finished before it started.
+stops() {
+  local body
+  body=$(api "http://127.0.0.1:4096/api/session/$1/history?limit=100" 2>/dev/null)
+  case "$body" in *InvalidRequestError*) echo "  history rejected: $body" >&2; echo -1; return ;; esac
+  printf '%s' "$body" | grep -o '"finish":"stop"' | wc -l | tr -d ' '
+}
+await_turn() {
+  local before=$2
+  for _ in $(seq 1 90); do
+    [ "$(stops "$1")" -gt "$before" ] && return 0
+    sleep 4
+  done
+  return 1
+}
+
+sid=$(new_session)
+[ -n "$sid" ] && ok "a session was created ($sid)" || { bad "no session"; exit 1; }
+api -o /dev/null -X POST "http://127.0.0.1:4096/api/session/$sid/model" \
+  -H 'content-type: application/json' -d "{\"model\":{\"id\":\"$MODEL_ID\",\"providerID\":\"openai\"}}"
+
+# --- turn 1 on worker A: writes a file, so a snapshot of the tree is captured and shipped
+before=$(stops "$sid")
+prompt "$sid" '"Use the bash tool to run exactly: echo TRAVELLED > /project/note.txt && cat /project/note.txt. Report the output."'
+await_turn "$sid" "$before" && ok "turn 1 finished on worker A" || bad "turn 1 never finished"
+
+packs=$(curl -s http://127.0.0.1:8081/v2/pipeline -H 'content-type: application/json' \
+  -d '{"requests":[{"type":"execute","stmt":{"sql":"select count(*) from snapshot_pack"}},{"type":"close"}]}' \
+  2>/dev/null | grep -o '"value":"[0-9]*"' | head -1 | grep -o '[0-9]*')
+[ "${packs:-0}" -gt 0 ] && ok "the tree was shipped to the shared store ($packs packs)" \
+  || bad "no snapshot packs reached the store" "$packs"
+
+# --- worker A's host goes away, and a host that has never seen this project takes over
+docker kill "$($COMPOSE ps -q worker-a)" >/dev/null 2>&1
+sleep 2
+[ -z "$($COMPOSE ps -q --status running worker-a)" ] && ok "worker A's host is gone" || bad "worker A's host is gone"
+
+$COMPOSE up -d worker-b >/dev/null 2>&1
+sleep 8
+hostB=$($COMPOSE exec -T worker-b hostname 2>/dev/null | tr -d '\r')
+[ "$hostB" != "$hostA" ] && ok "worker B is a different host ($hostB)" || bad "worker B is a different host"
+empty=$($COMPOSE exec -T worker-b sh -c 'ls -A /project | wc -l' 2>/dev/null | tr -d '\r ')
+[ "${empty:-1}" = "0" ] && ok "worker B's project is empty before the turn" || bad "worker B's project was not empty" "$empty"
+
+# --- turn 2 on worker B: the file only exists there if the worktree travelled
+before=$(stops "$sid")
+prompt "$sid" '"Use the bash tool to run exactly: cat /project/note.txt. Report exactly what it printed."'
+await_turn "$sid" "$before" && ok "turn 2 finished on worker B" || bad "turn 2 never finished"
+
+# Asked of worker B's own disk rather than of the transcript. The transcript still holds turn 1,
+# where the file did exist, so anything matched across the whole of it proves nothing about B.
+landed=$($COMPOSE exec -T worker-b sh -c 'cat /project/note.txt 2>&1' 2>/dev/null | tr -d '\r')
+case "$landed" in
+  TRAVELLED*) ok "the worktree travelled to worker B" ;;
+  *) bad "the worktree travelled to worker B" "$landed" ;;
+esac
+
+echo
+[ "$fails" -eq 0 ] && echo "cross-host-check: OK" || echo "cross-host-check: $fails failed"
+exit $([ "$fails" -eq 0 ] && echo 0 || echo 1)
diff --git a/packages/temporal/scripts/detached-session-check.sh b/packages/temporal/scripts/detached-session-check.sh
new file mode 100755
index 000000000000..e83ebc11a7a3
--- /dev/null
+++ b/packages/temporal/scripts/detached-session-check.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Proves the claim a durable session is supposed to make: it belongs to the deployment, not to
+# whoever started it. One worker, two serve processes, one shared store, and a client that is only
+# ever a client.
+#
+#   1. serve A starts a turn, then A is killed while a tool is still running
+#   2. the turn finishes anyway, on a worker that is a separate process
+#   3. serve B, which never saw the session, reports it running and replays the whole transcript
+#   4. `session start` hands over a prompt and returns, holding no terminal
+#   5. `session watch` follows that turn live from a cold client and stops when the turn stops
+#
+# Needs: bun, the temporal CLI, and an OpenAI key. Nothing here is a unit test; it is the evidence
+# for a claim that only shows up across processes.
+#
+# Usage: OPENAI_API_KEY=... packages/temporal/scripts/detached-session-check.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+OC="$ROOT/packages/opencode/src/index.ts"
+RUN="${RUN_DIR:-/private/tmp/opencode-l3}"
+PORT_TEMPORAL="${PORT_TEMPORAL:-7240}"
+PORT_A="${PORT_A:-4610}"
+PORT_B="${PORT_B:-4611}"
+MODEL="${MODEL:-openai/gpt-5-mini}"
+
+fails=0
+ok()   { printf 'PASS %s\n' "$1"; }
+bad()  { printf 'FAIL %s   (%s)\n' "$1" "${2:-}"; fails=$((fails + 1)); }
+
+pids=()
+cleanup() {
+  for pid in "${pids[@]:-}"; do
+    [ -n "$pid" ] || continue
+    kill -9 $(pgrep -P "$pid" 2>/dev/null) "$pid" 2>/dev/null
+  done
+}
+trap cleanup EXIT
+
+[ -n "${OPENAI_API_KEY:-}" ] || { echo "set OPENAI_API_KEY"; exit 1; }
+
+rm -rf "$RUN"; mkdir -p "$RUN/proj" "$RUN/logs"
+git -C "$RUN/proj" init -q
+echo hello > "$RUN/proj/README.md"
+git -C "$RUN/proj" add -A
+git -C "$RUN/proj" -c user.email=a@b.c -c user.name=t commit -qm init
+
+export OPENCODE_SESSION_EXECUTION=temporal
+export TEMPORAL_ADDRESS="127.0.0.1:$PORT_TEMPORAL"
+# One store both serves and the worker read. This is what makes any process able to answer for any
+# session; without it a session belongs to the host holding its file.
+export OPENCODE_DB="$RUN/shared.db"
+export OPENCODE_TEMPORAL_STEPPED=1
+# A stored password wins over the environment for the v2 serve, so a script that invents one gets
+# 401 on every call. Take what the server will actually be asking for.
+STORED="${XDG_STATE_HOME:-$HOME/.local/state}/opencode/password"
+if [ -f "$STORED" ]; then
+  OPENCODE_SERVER_PASSWORD="$(cat "$STORED")"
+else
+  OPENCODE_SERVER_PASSWORD="${OPENCODE_SERVER_PASSWORD:-l3-check}"
+fi
+export OPENCODE_SERVER_PASSWORD
+
+temporal server start-dev --port "$PORT_TEMPORAL" --ui-port $((PORT_TEMPORAL + 1000)) --log-level warn \
+  > "$RUN/logs/temporal.log" 2>&1 &
+pids+=($!)
+sleep 6
+
+OPENCODE_TEMPORAL_ROLE=worker bun run "$ROOT/packages/server/src/worker.ts" > "$RUN/logs/worker.log" 2>&1 &
+worker=$!; pids+=($worker)
+
+cd "$RUN/proj"
+OPENCODE_TEMPORAL_ROLE=client bun run "$ROOT/packages/cli/src/index.ts" serve --port "$PORT_A" \
+  > "$RUN/logs/serveA.log" 2>&1 &
+serveA=$!; pids+=($serveA)
+OPENCODE_TEMPORAL_ROLE=client bun run "$ROOT/packages/cli/src/index.ts" serve --port "$PORT_B" \
+  > "$RUN/logs/serveB.log" 2>&1 &
+pids+=($!)
+
+A="http://127.0.0.1:$PORT_A"
+B="http://127.0.0.1:$PORT_B"
+AUTH="opencode:$OPENCODE_SERVER_PASSWORD"
+
+# Bounded, because a fixed sleep is either a slow script or a flaky one. Both serves boot a whole
+# application context, which on a cold module cache is not quick.
+# Answering at all is not enough: an unauthorized answer is still an answer, and treating it as
+# ready turns a credentials problem into a confusing timeout later.
+wait_for() {
+  for _ in $(seq 1 60); do
+    [ "$(curl -s -o /dev/null -w '%{http_code}' -u "$AUTH" "$1/api/session")" = "200" ] && return 0
+    sleep 2
+  done
+  return 1
+}
+wait_for "$A" && wait_for "$B" || { echo "serves never came up; see $RUN/logs"; exit 1; }
+
+# The id of the session, not of anything nested in it: the field is read off the first line of the
+# document, so a later `"id"` (a model, a message) cannot be picked up instead.
+session_id() { sed -n 's/^{"data":{"id":"\([^"]*\)".*/\1/p' | head -1; }
+
+# --- 1. a turn started on serve A, long enough to still be running when A dies
+created=$(curl -s -u "$AUTH" -X POST "$A/api/session" -H 'content-type: application/json' \
+  -d "{\"directory\":\"$RUN/proj\"}")
+sid=$(printf '%s' "$created" | session_id)
+[ -n "$sid" ] && ok "serve A created a session" || { bad "serve A created a session" "$created"; exit 1; }
+
+provider=${MODEL%%/*}; model=${MODEL#*/}
+curl -s -o /dev/null -u "$AUTH" -X POST "$A/api/session/$sid/model" -H 'content-type: application/json' \
+  -d "{\"model\":{\"id\":\"$model\",\"providerID\":\"$provider\"}}"
+curl -s -o /dev/null -u "$AUTH" -X POST "$A/api/session/$sid/prompt" -H 'content-type: application/json' \
+  -d '{"prompt":{"text":"Use the bash tool to run exactly: sleep 40 && echo SURVIVED. Then report the output."}}'
+sleep 18
+pgrep -f "sleep 40 && echo SURVIVED" > /dev/null && ok "the tool is running on the worker" \
+  || bad "the tool is running on the worker" "it never started"
+
+# --- 2. kill the process that started it, mid-tool
+kill -9 $(pgrep -P $serveA 2>/dev/null) $serveA 2>/dev/null
+sleep 3
+[ -z "$(lsof -nP -iTCP:$PORT_A -sTCP:LISTEN 2>/dev/null)" ] && ok "serve A is gone" || bad "serve A is gone"
+pgrep -f "sleep 40 && echo SURVIVED" > /dev/null && ok "the turn outlived the client that started it" \
+  || bad "the turn outlived the client that started it" "the tool died with serve A"
+
+# --- 3. serve B, which never saw this session, knows it and can replay it
+running=$(curl -s -u "$AUTH" "$B/api/session/active")
+case "$running" in *"$sid"*) ok "serve B reports it running" ;; *) bad "serve B reports it running" "$running" ;; esac
+
+sleep 35
+timeout 30 curl -s -N -u "$AUTH" "$B/api/session/$sid/event" > "$RUN/logs/replay.txt" 2>&1
+grep -q "SURVIVED" "$RUN/logs/replay.txt" && ok "serve B replays work done while no client existed" \
+  || bad "serve B replays work done while no client existed"
+
+# --- 4. start a turn and walk away
+started=$(timeout 90 bun run "$OC" session start \
+  "Use the bash tool to run exactly: sleep 20 && echo WATCHED. Then report the output." \
+  --attach "$B" --model "$MODEL" --dir "$RUN/proj" --json 2>/dev/null)
+sid2=$(printf '%s' "$started" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')
+[ -n "$sid2" ] && ok "session start returned an id without waiting" || bad "session start returned an id" "$started"
+
+listed=$(timeout 60 bun run "$OC" session running --attach "$B" --json 2>/dev/null)
+case "$listed" in *"$sid2"*) ok "session running lists it" ;; *) bad "session running lists it" "$listed" ;; esac
+
+# --- 5. follow it live from a client that has never seen it, and stop when the turn stops
+began=$(date +%s)
+timeout 120 bun run "$OC" session watch "$sid2" --attach "$B" > "$RUN/logs/watch.txt" 2>&1
+took=$(( $(date +%s) - began ))
+grep -q "WATCHED" "$RUN/logs/watch.txt" && ok "session watch followed the turn" \
+  || bad "session watch followed the turn" "$(tail -3 "$RUN/logs/watch.txt")"
+[ "$took" -lt 100 ] && ok "session watch stopped when the turn did (${took}s)" \
+  || bad "session watch stopped when the turn did" "${took}s, so it hung"
+
+echo
+[ "$fails" -eq 0 ] && echo "detached-session-check: OK" || echo "detached-session-check: $fails failed"
+exit $([ "$fails" -eq 0 ] && echo 0 || echo 1)