@@ -18,7 +18,8 @@ import {
   withClientLifecycle, withClientLifecycleSync,
   type ClientLifecycleHeld, type ClientLifecycleLockDeps,
 } from "./lifecycle-lock";
-import { invalidateCodexModelsCache } from "../codex/catalog/sync";
+import { invalidateCodexModelsCache, invalidateCodexModelsCacheWithPermit } from "../codex/catalog/sync";
+import { withCatalogWriteSerialization } from "../codex/catalog-write-serialization";
 import {
   injectCodexConfig,
   currentExternalCodexModelProvider,
@@ -30,7 +31,7 @@ import {
   journalOwner,
   restoreJournalState,
 } from "../codex/journal";
-import { DEFAULT_CATALOG_PATH } from "../codex/paths";
+import { DEFAULT_CATALOG_PATH, getCodexHome } from "../codex/paths";
 import {
   readServiceApiTokenState,
   readTokenBackupState,
@@ -95,6 +96,7 @@ import {
 import { hubStateCachePath } from "./hub-state";
 import { ClientLinkStateError, clearClientLinkState, readClientLinkState } from "./link-state";
 import { isLinkPort } from "../link/ports";
+import { clientSyncRuntimeGuard, ClientSyncRuntimeError } from "./sync-runtime";
 
 class RotationRecoveryRequiredError extends Error {
   constructor(message: string, options?: ErrorOptions) {
@@ -901,7 +903,15 @@ async function syncConnectedClientUnlocked(
     if (state.kind !== "connected" || state.value.pendingOperation) throw new Error("client_sync_unavailable");
     const token = readServiceApiTokenState();
     if (token.kind !== "present" || token.fingerprint !== state.value.tokenFingerprint) throw new Error("client_token_changed");
-    return { connection: state.value, token };
+    let assertRuntimeCurrent = () => {};
+    try { if (isLinkConnection(state.value)) assertRuntimeCurrent = clientSyncRuntimeGuard(); }
+    catch (error) {
+      if (options.expect && error instanceof ClientSyncRuntimeError && error.code === "client_runtime_stopping") {
+        throw new ClientSyncExpectationError(options.expect, "pending_operation");
+      }
+      throw error;
+    }
+    return { connection: state.value, token, assertRuntimeCurrent };
   }), deps.lifecycleLockDeps);
   let downloaded: Awaited<ReturnType<typeof downloadClientCatalog>> | undefined;
   let stale = false;
@@ -918,6 +928,7 @@ async function syncConnectedClientUnlocked(
   // they were, which is the known-good state.
   if (downloaded) assertClientCatalogCompatible(downloaded.body, deps.catalogCompatibility);
   const next = withClientLifecycleSync(() => withConfigMutationLockSync(() => {
+    initial.assertRuntimeCurrent();
     assertClientConnectionUnchanged(initial.connection);
     const token = readServiceApiTokenState();
     if (token.kind !== "present" || token.fingerprint !== initial.token.fingerprint) throw new Error("client_token_changed");
@@ -933,10 +944,12 @@ async function syncConnectedClientUnlocked(
   }), deps.lifecycleLockDeps);
   // Read-only: injection invokes this while N/C are held. Acquiring L here would invert C→L.
   const beforeClientWrite = () => {
+    initial.assertRuntimeCurrent();
     assertClientConnectionUnchanged(next);
     const token = readServiceApiTokenState();
     if (next.pendingOperation || token.kind !== "present" || token.fingerprint !== next.tokenFingerprint) throw new Error("client_token_changed");
   };
+  const withClientWrite = <T>(write: () => T): T => withConfigMutationLockSync(() => { beforeClientWrite(); return write(); });
   let injected = false;
   let homeSettings: HomeCodexSettingsSource | undefined;
   let appliedRecord: HomeCodexSettingsRecord | undefined;
@@ -945,12 +958,15 @@ async function syncConnectedClientUnlocked(
     let config = loadConfig();
     // #6957: a link Child applies the Home's OpenCodex-owned Codex settings with the catalog.
     if (isLinkConnection(next)) {
-      homeSettings = await resolveHomeCodexSettings(next, initial.token.token, deps.linkHome);
+      homeSettings = await resolveHomeCodexSettings(next, initial.token.token, { ...deps.linkHome, withWriteGuard: withClientWrite });
       if (homeSettings.source !== "local") config = overlayHomeCodexSettings(config, homeSettings.document.settings);
       // About to write different settings: until their record commits, report no applied digest
       // rather than the previous one (OCX-6). A failed injection then reads "unknown", never a
       // digest of values Codex no longer has or never got.
-      if (homeSettings.source === "home" && next.link) withdrawChangingHomeCodexSettingsRecord(next.link.linkId, homeSettings.document);
+      if (homeSettings.source === "home" && next.link) {
+        const { linkId } = next.link, { document } = homeSettings;
+        withClientWrite(() => withdrawChangingHomeCodexSettingsRecord(linkId, document));
+      }
     }
     const result = await injectCodexConfig(config.port, { ...config, syncResumeHistory: false }, {
       routingTarget: routingTarget(next.serverUrl, isLinkConnection(next) ? config.port : undefined, config), catalogPath: DEFAULT_CATALOG_PATH,
@@ -962,23 +978,24 @@ async function syncConnectedClientUnlocked(
       const linkId = next.link.linkId;
       const settings = homeSettings;
       try {
-        appliedRecord = withClientLifecycleSync(() => {
-          beforeClientWrite();
-          return recordHomeCodexSettings(linkId, settings, deps.now) ?? readHomeCodexSettingsRecord(linkId) ?? undefined;
-        }, deps.lifecycleLockDeps);
+        appliedRecord = withClientLifecycleSync(() => withClientWrite(() =>
+          recordHomeCodexSettings(linkId, settings, deps.now) ?? readHomeCodexSettingsRecord(linkId) ?? undefined), deps.lifecycleLockDeps);
       } catch (error) {
         // An ownership change is not a disk problem: report it as itself.
-        if (error instanceof Error && (error.message === "client_token_changed" || error.message === "client_connection_changed")) throw error;
+        if (error instanceof ClientSyncRuntimeError || (error instanceof Error && (error.message === "client_token_changed" || error.message === "client_connection_changed"))) throw error;
         // The injection committed, so the cache refresh below still runs; the caller reports this.
-        try { clearHomeCodexSettingsRecord(); } catch { /* status already reads no recorded apply or reports the write */ }
+        try { withClientWrite(clearHomeCodexSettingsRecord); } catch { /* status already reads no recorded apply or reports the write */ }
         applyRecordFailed = true;
       }
     }
   }
   const cacheSynced = withClientLifecycleSync(() => {
-    beforeClientWrite();
-    // Cache invalidation acquires K itself (N -> K -> C); never call it while C is held.
-    return invalidateCodexModelsCache({ allowWhenDesiredDisabled: true });
+    // Acquire K before the guarded C commit; never acquire K from inside C.
+    const owningHome = getCodexHome();
+    const result = withCatalogWriteSerialization(owningHome, permit => withClientWrite(() =>
+      invalidateCodexModelsCacheWithPermit(permit, owningHome, { allowWhenDesiredDisabled: true })),
+    { intent: "cache", writer: "cache-invalidate" });
+    return result.kind === "completed" && result.value;
   }, deps.lifecycleLockDeps);
   return {
     catalogWritten: downloaded !== undefined, cacheSynced, injected, stale,
 
@@ -299,7 +299,7 @@ export type HomeCodexSettingsSource =
 export async function resolveHomeCodexSettings(
   connection: LinkHomeConnection,
   admissionKey: string,
-  deps: LinkHomeDeps & { now?: () => Date } = {},
+  deps: LinkHomeDeps & { now?: () => Date; withWriteGuard?: <T>(write: () => T) => T } = {},
 ): Promise<HomeCodexSettingsSource> {
   const linkId = connection.link?.linkId;
   if (!linkId) return { source: "local", reason: "not a Remote Link Child" };
@@ -308,7 +308,8 @@ export async function resolveHomeCodexSettings(
     return { source: "home", document: fetched.document, fetchedAt: (deps.now ?? (() => new Date()))().toISOString() };
   }
   if (fetched.kind === "unsupported") {
-    clearHomeCodexSettingsRecord();
+    if (deps.withWriteGuard) deps.withWriteGuard(clearHomeCodexSettingsRecord);
+    else clearHomeCodexSettingsRecord();
     return { source: "local", reason: "the Home does not publish Codex settings; upgrade the Home" };
   }
   const cached = readHomeCodexSettingsRecord(linkId);
 
@@ -32,6 +32,7 @@ import { withClientLifecycleSync } from "./lifecycle-lock";
 import { clientRestartRollbackAction, clientRestartSupervisor, createClientRestartController, type ClientRestartController } from "./runtime-restart";
 import { createLinkParityReporter, type LinkParityReporter } from "./link-parity-reporter";
 import { restoreLinkClientRouting } from "./stop-routing";
+import { markClientRuntimeStopping } from "./sync-runtime";
 
 let activeServer: Server<unknown> | null = null;
 let activePort: number | null = null;
@@ -369,7 +370,7 @@ export async function startClientRuntime(
       supervisor?.start();
       credentialObservation ??= observeLocalCredentials();
       writePid(process.pid);
-      writeRuntimePort(clientRuntimeRecord(process.pid, boundPort, attestationSecret));
+      writeRuntimePort({ ...clientRuntimeRecord(process.pid, boundPort, attestationSecret), ...(clientStopping ? { clientStopping: true as const } : {}) });
       if (linkMode && state.value.link && linkKey) {
         activeReporter = createLinkParityReporter({ connection: state.value, linkKey, runtimeStartedAt: CLIENT_RUNTIME_STARTED_AT });
         activeReporter.start();
@@ -466,11 +467,19 @@ export async function startClientRuntime(
     shuttingDown = true;
     clientStopping = true;
     if (recycleTimer) { clearTimeout(recycleTimer); recycleTimer = undefined; }
+    const fenceSync = () => {
+      if (!linkMode) return true;
+      try { markClientRuntimeStopping({ pid: process.pid, port: servedPort, attestationSecret }); return true; }
+      catch { return false; }
+    };
+    let syncFenced = fenceSync();
     void (async () => {
       // An accepted restart owns its replacement and rollback. A successful handoff exits
       // inside that flight; a rollback finishes before this signal tears the runtime down.
       if (restartController.hasHandoff()) await restartController.settled().catch(() => {});
       if (recycleFlight) await recycleFlight.catch(() => {});
+      // A rollback may have republished its runtime record while shutdown joined it.
+      syncFenced = fenceSync();
       credentialObservation?.stop();
       credentialObservation = null;
       activeReporter?.stop();
@@ -481,15 +490,15 @@ export async function startClientRuntime(
         console.warn(`[client] link supervisor stop failed: ${error instanceof Error ? error.message : String(error)}`);
       }
       activeSupervisor = null;
-      const restored = linkMode ? restoreLinkClientRouting(state.value) : null;
+      const restored = linkMode ? restoreLinkClientRouting(state.value, { syncFenced }) : null;
       if (restored && !restored.success) console.error(`[client] ${restored.message}`);
       try {
         activeServer?.stop(true);
       } catch (error) {
         console.warn(`[client] listener stop failed: ${error instanceof Error ? error.message : String(error)}`);
       } finally {
-        cleanup();
-        await flushLinkDiagnostics();
+        // Keep stopping admission visible through the last await. Cleanup and exit are adjacent.
+        try { await flushLinkDiagnostics(); } finally { cleanup(); }
         // launchd relaunches only unsuccessful exits; an external signal must still count.
         if (restored?.success === false) process.exit(1);
         else process.exit(handledSignalExitCode(signal));
 
@@ -22,14 +22,15 @@ const refusal = (reason: string): LinkRoutingRestoreResult => ({
 });
 
 /** Unsupervised signal cleanup; explicit parent stop and restart retain their own restoration. */
-export function restoreLinkClientRouting(expected: OcxClientConnectionConfig): LinkRoutingRestoreResult {
+export function restoreLinkClientRouting(expected: OcxClientConnectionConfig, options: { syncFenced?: boolean } = {}): LinkRoutingRestoreResult {
   if (siblingOfLivePort() !== null) return { success: true, restored: false, message: siblingSkipMessage() };
   if (!isLinkConnection(expected)) {
     return { success: true, restored: false, message: "Hub connection-owned integrations preserved." };
   }
   const preserve = () => process.env.OCX_SERVICE === "1" || isDesktopSupervised()
     || pendingTeardownOutstanding();
   if (preserve()) return { success: true, restored: false, message: "Supervised restart or pending teardown owns the client integrations." };
+  if (options.syncFenced === false) return refusal("the runtime sync fence could not be verified");
   const guard = stopRestoreWriteGuard(expected);
   const withWriteGuard = <T>(write: () => T): T => guard.run(() => {
     if (preserve()) throw new Error("restart or teardown ownership changed");
 
@@ -0,0 +1,48 @@
+/** Cross-process admission for Link sync while its local runtime shuts down. */
+import { lstatSync } from "node:fs";
+import { withConfigMutationLockSync } from "../config";
+import { getRuntimePortPath, isValidRuntimePortState, writeRuntimePort, type RuntimePortState } from "../config/process-state";
+import { readBoundedRegularFileSync } from "../lib/bounded-file-read";
+
+export class ClientSyncRuntimeError extends Error {
+  constructor(readonly code: "client_runtime_stopping" | "client_runtime_changed" | "client_runtime_unverified") {
+    super(`${code}: retry sync after the Child has started; ocx start/stop can reconcile a stale runtime record`);
+  }
+}
+
+function readSyncRuntime(): RuntimePortState | null {
+  const path = getRuntimePortPath();
+  try { lstatSync(path); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw new ClientSyncRuntimeError("client_runtime_unverified");
+  }
+  try {
+    const value: unknown = JSON.parse(readBoundedRegularFileSync(path, 16 * 1024).toString("utf8"));
+    if (!isValidRuntimePortState(value)) throw new Error("invalid runtime record");
+    return value;
+  } catch { throw new ClientSyncRuntimeError("client_runtime_unverified"); }
+}
+
+/** Capture and recheck under C. Proven no-runtime sync keeps its existing offline behavior. */
+export function clientSyncRuntimeGuard(): () => void {
+  const expected = readSyncRuntime();
+  if (expected?.clientStopping) throw new ClientSyncRuntimeError("client_runtime_stopping");
+  return () => {
+    const current = readSyncRuntime();
+    if (current?.clientStopping) throw new ClientSyncRuntimeError("client_runtime_stopping");
+    if (!Bun.deepEquals(current, expected, true)) throw new ClientSyncRuntimeError("client_runtime_changed");
+  };
+}
+
+/** The same C transaction excludes every sync commit; never mark a replacement runtime. */
+export function markClientRuntimeStopping(expected: Required<Pick<RuntimePortState, "pid" | "port" | "attestationSecret">>): void {
+  withConfigMutationLockSync(() => {
+    const current = readSyncRuntime();
+    if (!current || current.pid !== expected.pid || current.port !== expected.port
+      || current.attestationSecret !== expected.attestationSecret) {
+      throw new ClientSyncRuntimeError("client_runtime_changed");
+    }
+    if (!current.clientStopping) writeRuntimePort({ ...current, clientStopping: true });
+  });
+}
@@ -37,6 +37,8 @@ export type RuntimePortState = {
   hostname?: string;
   /** Per-process proof key; protected by the config directory and never served. */
   attestationSecret?: string;
+  /** A Link runtime is draining; new and in-flight sync commits must stand down. */
+  clientStopping?: true;
   /**
    * The live proxy's port when this runtime is a sibling instance started beside it
    * (`src/codex/sibling-start.ts`). `ocx stop` reads it to leave shared client routing alone.
@@ -59,6 +61,7 @@ export function isValidRuntimePortState(value: unknown): value is RuntimePortSta
     && Number(state.port) <= 65535
     && hostnameOk
     && attestationOk
+    && (state.clientStopping === undefined || state.clientStopping === true)
     && siblingOk;
 }
 
 
@@ -1,5 +1,7 @@
 # Remote Link
 
+`src/client/sync-runtime.ts` fences Link sync against the local runtime record. Signal shutdown marks its own PID/port/attestation generation as `clientStopping` under C before restoration, and retains that mark through its last await. Sync captures the record at admission and rechecks it under C before catalog, injection, settings-record and cache commits. A stopping, replaced, removed or unreadable record refuses the write; a stale operation cannot reinject after the Child exits. Failure to mark the runtime refuses restoration without overriding service, Desktop, sibling or parent-receipt preservation. No-runtime sync remains an explicit offline operation; after a normal stop, start the Child before syncing its routing. A stale stopping record is reconciled by the existing start/stop recovery paths, not by guessing PID ownership. The separate-process catalog/settings-response holds in `tests/clients/client-link-stop.test.ts` cover late commits, fresh sync during shutdown and the completed-sync control.
+
 Orderly signals in an unsupervised Link Child call `src/client/stop-routing.ts` before releasing the listener. It reuses native Codex config/catalog/history restoration and managed Grok removal; the saved connection and credentials remain. `src/client/restore-ownership.ts` optionally binds each write under C to the immutable served connection, including selection and rotation state. Only `catalogFingerprint` and `catalogSyncedAt`, updated by normal catalog sync, are excluded from this restore-specific comparison; `priorCatalog` remains guarded and the shared full-snapshot CAS for asynchronous connection work is unchanged. A changed owner, pending transition or unverified journal refuses remaining writes. Service/desktop supervision, sibling ownership, accepted restart/recycle handoff and outstanding parent teardown receipts preserve integrations for their existing owners. Signal shutdown waits for an accepted restart to hand off or finish rolling back; a pending admission owns no routing. It refuses new or pending restart admission with `409 runtime_stopping`; normal bound restart remains unchanged. After an ordinary unsupervised stop, start and run `ocx sync --restart-codex`; start alone does not reapply routing. Coverage: `tests/clients/client-link-stop.test.ts`, `tests/clients/client-runtime-restart.test.ts`.
 
 `src/link/` owns the building blocks for linking OpenCodex machines over SSH. The pure modules start no process, open no socket and schedule no timer on import.