diff --git a/src-tauri/build.rs b/src-tauri/build.rs
index e0ce0d3ce2..57b15203de 100644
--- a/src-tauri/build.rs
+++ b/src-tauri/build.rs
@@ -155,6 +155,8 @@ fn main() {
             "jev_classifier_set_key",
             "jev_classifier_clear_key",
             "jev_classify",
+            "app_agent_state_load",
+            "app_agent_state_set",
             "title_bar_double_click",
             "notification_show",
             "notification_permission_state",
diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
index cba381a270..a15ba65747 100644
--- a/src-tauri/capabilities/default.json
+++ b/src-tauri/capabilities/default.json
@@ -117,6 +117,8 @@
     "allow-jev-classifier-set-key",
     "allow-jev-classifier-clear-key",
     "allow-jev-classify",
+    "allow-app-agent-state-load",
+    "allow-app-agent-state-set",
 
     "allow-title-bar-double-click",
     "allow-notification-show",
diff --git a/src-tauri/src/agent_state.rs b/src-tauri/src/agent_state.rs
new file mode 100644
index 0000000000..43b5e4927c
--- /dev/null
+++ b/src-tauri/src/agent_state.rs
@@ -0,0 +1,343 @@
+//! Agent state shared by every program that runs this machine's agents: each
+//! agent's settings, the owner's teams, unfinished setups, and the agent types'
+//! saved sessions. It lives in `agents/state/`, next to `identities.json`, so
+//! the app and the standalone `buzz-agent-host` read and write the same state.
+//!
+//! One file per key, each replaced whole through a rename, so a crash leaves
+//! the last complete copy, and two programs that write different keys never
+//! overwrite each other. The `hosts/` locks decide which program runs an agent.
+//!
+//! A file's name is its key, encoded. A key whose encoded name is too long for
+//! the file system gets a fixed-length name instead, `~` and the SHA-256 of the
+//! key, and its file holds `{"key": …, "value": …}` so `load` can recover it.
+use std::collections::HashMap;
+use std::fs;
+use std::io::ErrorKind;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+/// The largest value kept, as an upper bound on what `localStorage` held.
+const VALUE_LIMIT: usize = 4 * 1024 * 1024;
+/// The longest file name macOS, Linux and Windows all allow, in bytes.
+const NAME_LIMIT: usize = 255;
+const TEMPORARY: &str = ".tmp";
+/// Starts the name of a file that holds its key. `encode` never writes `~`.
+const HASHED: char = '~';
+
+/// The contents of a file whose name is a hash of its key.
+#[derive(Serialize, Deserialize)]
+struct Hashed<'a> {
+    key: std::borrow::Cow<'a, str>,
+    value: std::borrow::Cow<'a, str>,
+}
+
+pub(crate) struct AgentState {
+    dir: Result<PathBuf, String>,
+}
+
+impl AgentState {
+    /// `dir` is `agents/state`.
+    pub(crate) fn new(dir: Result<PathBuf, String>) -> Self {
+        Self { dir }
+    }
+
+    fn dir(&self) -> Result<&Path, String> {
+        self.dir.as_deref().map_err(Clone::clone)
+    }
+
+    /// Every key and its value. Unreadable or foreign files are skipped.
+    pub(crate) fn load(&self) -> Result<HashMap<String, String>, String> {
+        let dir = self.dir()?;
+        let entries = match fs::read_dir(dir) {
+            Ok(entries) => entries,
+            Err(error) if error.kind() == ErrorKind::NotFound => return Ok(HashMap::new()),
+            Err(_) => return Err("Could not read agent state".into()),
+        };
+        let mut items = HashMap::new();
+        for entry in entries.flatten() {
+            let name = entry.file_name();
+            let Some(name) = name.to_str() else { continue };
+            let key = decode(name);
+            if key.is_none() && !name.starts_with(HASHED) {
+                continue;
+            }
+            let Ok(text) = fs::read_to_string(entry.path()) else {
+                continue;
+            };
+            match key {
+                Some(key) => {
+                    items.insert(key, text);
+                }
+                None => {
+                    // Skip a file whose key does not give its name.
+                    if let Ok(saved) = serde_json::from_str::<Hashed>(&text) {
+                        if file_name(&saved.key) == name {
+                            items.insert(saved.key.into_owned(), saved.value.into_owned());
+                        }
+                    }
+                }
+            }
+        }
+        Ok(items)
+    }
+
+    /// Saves `value` under `key`, or removes the key when `value` is `None`.
+    pub(crate) fn set(&self, key: &str, value: Option<&str>) -> Result<(), String> {
+        self.write(key, value, false).map(|_| ())
+    }
+
+    /// Saves `value` under `key` only if no file holds the key, in one step, so
+    /// two programs that add the same key at once never replace each other's.
+    /// Returns what the file already held when it was there.
+    pub(crate) fn add(&self, key: &str, value: &str) -> Result<Option<String>, String> {
+        self.write(key, Some(value), true)
+    }
+
+    fn write(
+        &self,
+        key: &str,
+        value: Option<&str>,
+        absent: bool,
+    ) -> Result<Option<String>, String> {
+        if key.is_empty() {
+            return Err("Invalid agent state key".into());
+        }
+        let dir = self.dir()?;
+        let name = file_name(key);
+        let path = dir.join(&name);
+        let Some(value) = value else {
+            return match fs::remove_file(&path) {
+                Err(error) if error.kind() != ErrorKind::NotFound => {
+                    Err("Could not save agent state".into())
+                }
+                _ => Ok(None),
+            };
+        };
+        if value.len() > VALUE_LIMIT {
+            return Err("Agent state is too large".into());
+        }
+        let hashed;
+        let contents = if name.starts_with(HASHED) {
+            hashed = serde_json::to_string(&Hashed {
+                key: key.into(),
+                value: value.into(),
+            })
+            .map_err(|_| "Could not save agent state")?;
+            hashed.as_str()
+        } else {
+            value
+        };
+        let saved = (|| {
+            fs::create_dir_all(dir)?;
+            let mut file = tempfile::Builder::new()
+                .suffix(TEMPORARY)
+                .tempfile_in(dir)?;
+            std::io::Write::write_all(&mut file, contents.as_bytes())?;
+            file.as_file().sync_all()?;
+            if !absent {
+                file.persist(&path).map_err(|error| error.error)?;
+                return Ok(None);
+            }
+            match file.persist_noclobber(&path) {
+                Ok(_) => Ok(None),
+                Err(error) if error.error.kind() == ErrorKind::AlreadyExists => {
+                    let text = fs::read_to_string(&path)?;
+                    if !name.starts_with(HASHED) {
+                        return Ok(Some(text));
+                    }
+                    let saved = serde_json::from_str::<Hashed>(&text)
+                        .map_err(|error| std::io::Error::new(ErrorKind::InvalidData, error))?;
+                    Ok(Some(saved.value.into_owned()))
+                }
+                Err(error) => Err(error.error),
+            }
+        })();
+        saved.map_err(|_| "Could not save agent state".into())
+    }
+}
+
+/// The file `key` is saved in: its encoded name, or `~` and the key's SHA-256
+/// when that name is too long.
+pub(crate) fn file_name(key: &str) -> String {
+    let name = encode(key);
+    if name.len() <= NAME_LIMIT {
+        return name;
+    }
+    format!("{HASHED}{:x}", Sha256::digest(key.as_bytes()))
+}
+
+/// A file name for `key`: bytes other than `A-Z a-z 0-9 . _ -` become `%XX`.
+pub(crate) fn encode(key: &str) -> String {
+    let mut name = String::with_capacity(key.len());
+    for byte in key.bytes() {
+        if byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-') {
+            name.push(byte as char);
+        } else {
+            name.push_str(&format!("%{byte:02X}"));
+        }
+    }
+    name
+}
+
+/// The key a file name holds, or `None` for a file that is not one, such as a
+/// write in progress.
+pub(crate) fn decode(name: &str) -> Option<String> {
+    if name.is_empty() || name.ends_with(TEMPORARY) || name.starts_with('.') {
+        return None;
+    }
+    let bytes = name.as_bytes();
+    let mut key = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        match bytes[index] {
+            b'%' => {
+                let hex = name.get(index + 1..index + 3)?;
+                key.push(u8::from_str_radix(hex, 16).ok()?);
+                index += 3;
+            }
+            byte if byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-') => {
+                key.push(byte);
+                index += 1;
+            }
+            _ => return None,
+        }
+    }
+    String::from_utf8(key).ok()
+}
+
+#[tauri::command]
+pub(crate) async fn app_agent_state_load(
+    state: tauri::State<'_, AgentState>,
+) -> Result<HashMap<String, String>, String> {
+    state.load()
+}
+
+/// Saves or removes `value` under `key`. With `absent`, it saves only if no
+/// file holds the key, and returns what the file held when one did.
+#[tauri::command]
+pub(crate) async fn app_agent_state_set(
+    state: tauri::State<'_, AgentState>,
+    key: String,
+    value: Option<String>,
+    absent: Option<bool>,
+) -> Result<Option<String>, String> {
+    match (value, absent.unwrap_or(false)) {
+        (Some(value), true) => state.add(&key, &value),
+        (value, _) => state.set(&key, value.as_deref()).map(|_| None),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn names_round_trip() {
+        for key in [
+            "buzz.agents.v1",
+            "buzz.codex.sessions.v4:wss://relay.example/a:ab",
+            "a/b c%d",
+        ] {
+            let name = encode(key);
+            assert!(!name.contains('/') && !name.contains(':'), "{name}");
+            assert_eq!(decode(&name).as_deref(), Some(key));
+        }
+        assert_eq!(decode("x.tmp"), None);
+        assert_eq!(decode(".hidden"), None);
+        assert_eq!(decode("bad%Z"), None);
+        assert_eq!(decode("has space"), None);
+    }
+
+    #[test]
+    fn saves_loads_and_removes() {
+        let root = tempfile::tempdir().unwrap();
+        let state = AgentState::new(Ok(root.path().join("state")));
+        assert!(state.load().unwrap().is_empty());
+        state.set("one:a", Some("1")).unwrap();
+        state.set("two", Some("2")).unwrap();
+        state.set("two", Some("22")).unwrap();
+        fs::write(root.path().join("state").join("partial.tmp"), "x").unwrap();
+        let items = state.load().unwrap();
+        assert_eq!(items.len(), 2);
+        assert_eq!(items["one:a"], "1");
+        assert_eq!(items["two"], "22");
+        state.set("one:a", None).unwrap();
+        state.set("missing", None).unwrap();
+        assert_eq!(state.load().unwrap().keys().collect::<Vec<_>>(), ["two"]);
+        assert!(state.set("", Some("x")).is_err());
+        state.set(&"k".repeat(NAME_LIMIT), Some("x")).unwrap();
+        assert!(root
+            .path()
+            .join("state")
+            .join("k".repeat(NAME_LIMIT))
+            .exists());
+    }
+
+    #[test]
+    fn adds_a_key_only_where_none_is_saved() {
+        let root = tempfile::tempdir().unwrap();
+        let state = AgentState::new(Ok(root.path().join("state")));
+        assert_eq!(state.add("one", "first").unwrap(), None);
+        // Another program saved it first: it keeps that value, and gets it back.
+        assert_eq!(state.add("one", "stale").unwrap().as_deref(), Some("first"));
+        assert_eq!(state.load().unwrap()["one"], "first");
+        let long = "k".repeat(NAME_LIMIT + 1);
+        assert_eq!(state.add(&long, "first").unwrap(), None);
+        assert_eq!(state.add(&long, "stale").unwrap().as_deref(), Some("first"));
+        assert_eq!(state.load().unwrap()[&long], "first");
+        // No write in progress is left behind.
+        assert_eq!(fs::read_dir(root.path().join("state")).unwrap().count(), 2);
+    }
+
+    #[test]
+    fn saves_keys_whose_names_are_too_long_under_a_hash() {
+        let root = tempfile::tempdir().unwrap();
+        let dir = root.path().join("state");
+        let state = AgentState::new(Ok(dir.clone()));
+        // 251 bytes, as Codex names it for a community on a 95-character host;
+        // `encode` makes it 263.
+        let key = format!(
+            "buzz.codex.sessions.v4:https://agents.production.us-west-2.buzz-workspace.platform.engineering.internal.tools.example.com:{}:{}",
+            "a".repeat(64),
+            "b".repeat(64),
+        );
+        assert_eq!(key.len(), 251);
+        assert!(encode(&key).len() > NAME_LIMIT);
+        for key in [key.as_str(), &":".repeat(86), &"k".repeat(NAME_LIMIT + 1)] {
+            state.set(key, Some("{\"a\":1}")).unwrap();
+            let name = file_name(key);
+            assert!(name.starts_with(HASHED) && name.len() == 65, "{name}");
+            assert!(dir.join(&name).exists());
+            assert_eq!(state.load().unwrap()[key], "{\"a\":1}");
+            state.set(key, Some("2")).unwrap();
+            assert_eq!(state.load().unwrap()[key], "2");
+            state.set(key, None).unwrap();
+            assert!(!state.load().unwrap().contains_key(key));
+        }
+        // A hashed file whose key does not give its name is not loaded.
+        fs::write(
+            dir.join(format!("{HASHED}{}", "0".repeat(64))),
+            r#"{"key":"other","value":"x"}"#,
+        )
+        .unwrap();
+        fs::write(dir.join(format!("{HASHED}bad")), "not json").unwrap();
+        assert!(state.load().unwrap().is_empty());
+    }
+
+    #[test]
+    fn saves_codex_session_keys_of_long_community_hosts() {
+        let root = tempfile::tempdir().unwrap();
+        let state = AgentState::new(Ok(root.path().join("state")));
+        // 202 bytes, as Codex names it for a community on a 47-character host.
+        let key = format!(
+            "buzz.codex.sessions.v4:https://agents.production.engineering.example.com:{}:{}",
+            "a".repeat(64),
+            "b".repeat(64),
+        );
+        assert_eq!(key.len(), 202);
+        state.set(&key, Some("{}")).unwrap();
+        assert_eq!(state.load().unwrap()[&key], "{}");
+    }
+}
diff --git a/src-tauri/src/browser_permissions_tests.rs b/src-tauri/src/browser_permissions_tests.rs
index eacf115558..a808f99f36 100644
--- a/src-tauri/src/browser_permissions_tests.rs
+++ b/src-tauri/src/browser_permissions_tests.rs
@@ -157,6 +157,8 @@ fn native_command_permissions_isolate_webviews() {
         "jev_classifier_set_key",
         "jev_classifier_clear_key",
         "jev_classify",
+        "app_agent_state_load",
+        "app_agent_state_set",
         "title_bar_double_click",
         "notification_show",
         #[cfg(target_os = "macos")]
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index bafccceea3..d33a5c5679 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -14,6 +14,7 @@ use browser::{
     browser_action, browser_attach, browser_detach, browser_navigate, browser_set_bounds,
     browser_status,
 };
+mod agent_state;
 mod app_agents;
 mod deep_links;
 mod dock;
@@ -556,6 +557,8 @@ fn commands<R: tauri::Runtime>() -> impl Fn(tauri::ipc::Invoke<R>) -> bool + Sen
         jev::jev_classifier_set_key,
         jev::jev_classifier_clear_key,
         jev::jev_classify,
+        agent_state::app_agent_state_load,
+        agent_state::app_agent_state_set,
         title_bar_double_click,
         notification_show,
         #[cfg(target_os = "macos")]
@@ -685,6 +688,12 @@ pub fn run() {
                     .map_err(|_| "Could not resolve legacy library directory")?;
                 Ok((root, legacy))
             })();
+            app.manage(agent_state::AgentState::new(
+                paths
+                    .as_ref()
+                    .map(|(root, _)| root.with_file_name(sign_out::AGENTS).join("state"))
+                    .map_err(Clone::clone),
+            ));
             app.manage(app_agents::AppAgentHost::new(
                 paths
                     .as_ref()
diff --git a/src/bundled/agents/AgentsPage.test.tsx b/src/bundled/agents/AgentsPage.test.tsx
index 75d2ceea34..035260b3b0 100644
--- a/src/bundled/agents/AgentsPage.test.tsx
+++ b/src/bundled/agents/AgentsPage.test.tsx
@@ -32,6 +32,7 @@ import type {
   TeamPort,
 } from "../../features/agents/service";
 import type { OldTeam, PortableAgent } from "../../features/agents/native";
+import { localStore } from "../../features/agents/state";
 import type { RelayData } from "../../features/relay/service";
 import type { Navigation } from "../../features/navigation/controller";
 import type { PageNavigation } from "../../features/navigation/service";
@@ -347,6 +348,7 @@ function setup(
       };
       for (const listener of listeners) listener();
     }),
+    storage: localStore(),
   } satisfies Agents;
   const disconnected = { status: "disconnected", generation: 0 };
   const relay = {
diff --git a/src/bundled/claude-code/defaults.ts b/src/bundled/claude-code/defaults.ts
index 095e44698f..b0bea2945a 100644
--- a/src/bundled/claude-code/defaults.ts
+++ b/src/bundled/claude-code/defaults.ts
@@ -1,3 +1,4 @@
+import { localStore, type AgentStore } from "../../features/agents/store";
 import { config, type Config } from "./runtime";
 
 export type ClaudeProviderDefaults = Readonly<{
@@ -13,7 +14,7 @@ export class ClaudeDefaults {
   private state: ClaudeProviderDefaults;
   private readonly listeners = new Set<() => void>();
 
-  constructor(private readonly storage: Storage = localStorage) {
+  constructor(private readonly storage: AgentStore = localStore()) {
     this.state = this.read();
   }
 
@@ -34,9 +35,11 @@ export class ClaudeDefaults {
           : ""),
     };
   }
-  save(next: ClaudeProviderDefaults) {
+  /** Settles once the defaults are saved, and only then uses them; rejects,
+   * keeping the saved ones, when they could not be saved. */
+  async save(next: ClaudeProviderDefaults) {
     const { model, effort = "" } = next;
-    this.storage.setItem(
+    await this.storage.set(
       STORAGE_KEY,
       JSON.stringify({ version: 1, model, effort }),
     );
@@ -46,7 +49,7 @@ export class ClaudeDefaults {
   private read(): ClaudeProviderDefaults {
     try {
       const value: unknown = JSON.parse(
-        this.storage.getItem(STORAGE_KEY) ?? "null",
+        this.storage.get(STORAGE_KEY) ?? "null",
       );
       if (
         value &&
diff --git a/src/bundled/claude-code/index.ts b/src/bundled/claude-code/index.ts
index 0808755c0d..1850a6ff55 100644
--- a/src/bundled/claude-code/index.ts
+++ b/src/bundled/claude-code/index.ts
@@ -25,12 +25,12 @@ export const apply: PluginModule["apply"] = (ctx) => {
   const typeKey = `${ctx.pluginOwner?.id ?? "buzz.claude-code"}/${TYPE_ID}`;
   const spawn = host.spawn && withScript(host.spawn.bind(host));
   const setup = new ClaudeSetup(spawn, (input) => host.request(input));
-  const providerDefaults = new ClaudeDefaults();
+  const providerDefaults = new ClaudeDefaults(agents.storage);
   const runtime = new ClaudeRuntime(
     spawn ? { spawn } : {},
     (pubkey) => ownerReads(agents.relay(pubkey), pubkey),
     (pubkey, signal) => agents.core(pubkey, signal),
-    localStorage,
+    agents.storage,
     (raw) => providerDefaults.resolve(raw),
     () => agents.tools(),
   );
diff --git a/src/bundled/claude-code/runtime.test.ts b/src/bundled/claude-code/runtime.test.ts
index ba97188ac8..5a63ae1b6b 100644
--- a/src/bundled/claude-code/runtime.test.ts
+++ b/src/bundled/claude-code/runtime.test.ts
@@ -6,6 +6,7 @@ import type { BuzzClient } from "../../buzz-mcp/client";
 import { callTool } from "../../buzz-mcp/tools";
 import { createAgentMemories } from "../../features/agents/memory";
 import { ownerReads } from "../../features/agents/reads";
+import { localStore } from "../../features/agents/state";
 import type { Agent, Delivery } from "../../features/agents/service";
 import type { Host } from "../../features/host/service";
 import type { EventData, RelayEvent } from "../../features/relay/events";
@@ -129,10 +130,11 @@ function setup(
     snapshot: () => ({ status: "ready", session, viewer: alice }),
   } as unknown as RelayData;
   const data = new Map<string, string>();
-  const storage = {
+  const storage = localStore({
     getItem: (key: string) => data.get(key) ?? null,
     setItem: (key: string, value: string) => void data.set(key, value),
-  } as Storage;
+    removeItem: (key: string) => void data.delete(key),
+  } as Storage);
   // The host's copy of `core` memory, which needs no relay read.
   const core = vi.fn(
     async (
@@ -258,11 +260,11 @@ function setup(
 it("names each saved session's channel as the community lists it", () => {
   const { runtime, data } = setup();
   const saved = localSessions(
-    {
+    localStore({
       getItem: (key: string) => data.get(key) ?? null,
       setItem: (key: string, value: string) => void data.set(key, value),
       removeItem: (key: string) => void data.delete(key),
-    } as Storage,
+    } as Storage),
     self,
   );
   saved.set(channel, { id: "s1", seen: 100, at: 5 });
@@ -1043,7 +1045,7 @@ it("runs a timer as a one-off turn that is never saved", async () => {
   expect(prompt).toMatch(/<attention>\nHandle the work that caused this turn/);
   // Its process stops once the turn is done, and no session is kept for it.
   expect(claude?.killed).toBe(true);
-  expect(data.get("buzz.claude-code.sessions.v1") ?? "{}").toBe("{}");
+  expect(data.get(`buzz.claude-code.sessions.v1:${self}`) ?? "{}").toBe("{}");
   expect(runtime.sessions(self)).toEqual([]);
 });
 
diff --git a/src/bundled/claude-code/runtime.ts b/src/bundled/claude-code/runtime.ts
index 72c0e303c4..2059bdf676 100644
--- a/src/bundled/claude-code/runtime.ts
+++ b/src/bundled/claude-code/runtime.ts
@@ -14,6 +14,7 @@ import {
 } from "../../buzz-mcp/session-tools";
 import { fromOwner, workflowOf } from "../../features/agents/owner-attestation";
 import type { AgentReads } from "../../features/agents/reads";
+import { localStore, type AgentStore } from "../../features/agents/store";
 import type {
   Agent,
   AgentHandle,
@@ -151,7 +152,7 @@ export class ClaudeRuntime {
     private readonly reads: (pubkey: string) => AgentReads | undefined,
     /** The agent's `core` memory as the host keeps it (`Agents.core`). */
     private readonly core: Agents["core"],
-    private readonly storage: Storage = globalThis.localStorage,
+    private readonly storage: AgentStore = localStore(),
     private readonly resolveConfig: (raw: unknown) => Config = config,
     /** The tools plugins add to every session now. */
     private readonly added: () => readonly AddedTool[] = () => [],
diff --git a/src/bundled/claude-code/sessions.test.ts b/src/bundled/claude-code/sessions.test.ts
index 9d16e95dd4..322ea68e8f 100644
--- a/src/bundled/claude-code/sessions.test.ts
+++ b/src/bundled/claude-code/sessions.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, expect, it, vi } from "vitest";
+import { fileStore, localStore } from "../../features/agents/state";
 import {
   backgroundTasks,
   fakeSpawn,
@@ -598,12 +599,23 @@ it("starts no spare for a conversation that starts after its agents are gone", a
   expect(live()).toEqual([]);
 });
 
-it("keeps saved sessions per agent in storage", () => {
-  const data = new Map<string, string>();
-  const storage = {
+/** Agent storage over `data`, which saves as it is set. */
+const mapStore = (data: Map<string, string>) =>
+  localStore({
+    get length() {
+      return data.size;
+    },
+    key: (index: number) => [...data.keys()][index] ?? null,
     getItem: (key: string) => data.get(key) ?? null,
     setItem: (key: string, value: string) => void data.set(key, value),
-  } as Storage;
+    removeItem: (key: string) => void data.delete(key),
+  } as Storage);
+/** Waits for the saves already started. */
+const settled = () => new Promise((resolve) => setTimeout(resolve));
+
+it("keeps saved sessions per agent in storage", () => {
+  const data = new Map<string, string>();
+  const storage = mapStore(data);
   const one = localSessions(storage, "one");
   const two = localSessions(storage, "two");
   one.set("c/root", { id: "s1", seen: 3, at: 1 });
@@ -613,8 +625,62 @@ it("keeps saved sessions per agent in storage", () => {
   one.delete("c/root");
   expect(one.get("c/root")).toBeUndefined();
   expect(two.get("c/root")?.id).toBe("s2");
-  data.set("buzz.claude-code.sessions.v1", "not json");
+  expect([...data.keys()].sort()).toEqual([
+    "buzz.claude-code.sessions.v1:one",
+    "buzz.claude-code.sessions.v1:two",
+  ]);
+  data.set("buzz.claude-code.sessions.v1:one", "not json");
+  expect(one.get("c/root")).toBeUndefined();
+});
+
+it("reads an agent's sessions from the shared value until it saves its own", async () => {
+  const data = new Map<string, string>([
+    [
+      "buzz.claude-code.sessions.v1",
+      JSON.stringify({
+        one: { "c/root": { id: "s1", seen: 3, at: 1 } },
+        two: { "c/root": { id: "s2", seen: 4, at: 2 } },
+      }),
+    ],
+  ]);
+  const storage = mapStore(data);
+  const one = localSessions(storage, "one");
+  expect(one.get("c/root")?.id).toBe("s1");
+  one.delete("c/root");
   expect(one.get("c/root")).toBeUndefined();
+  expect(localSessions(storage, "two").get("c/root")?.id).toBe("s2");
+  localSessions(storage, "two").set("c/other", { id: "s3", seen: 1, at: 3 });
+  await settled();
+  expect(data.has("buzz.claude-code.sessions.v1")).toBe(false);
+  expect(localSessions(storage, "two").get("c/root")?.id).toBe("s2");
+});
+
+it("keeps an agent in the shared sessions value until its own is saved", async () => {
+  const name = "buzz.claude-code.sessions.v1";
+  const shared = JSON.stringify({
+    one: { "c/root": { id: "s1", seen: 3, at: 1 } },
+  });
+  const disk = new Map([[name, shared]]);
+  const save = vi.fn(async (key: string, value: string | null) => {
+    if (key !== name) throw new Error("disk full");
+    if (value === null) disk.delete(key);
+    else disk.set(key, value);
+  });
+  const storage = fileStore(new Map(disk), save);
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+  localSessions(storage, "one").set("c/other", { id: "s2", seen: 1, at: 2 });
+  await settled();
+  error.mockRestore();
+  expect(warn).toHaveBeenCalledWith(
+    "Claude sessions were not saved",
+    expect.objectContaining({ message: "disk full" }),
+  );
+  warn.mockRestore();
+  expect(disk.get(name)).toBe(shared);
+  // The next start still resumes the saved session.
+  const restarted = fileStore(new Map(disk), save);
+  expect(localSessions(restarted, "one").get("c/root")?.id).toBe("s1");
 });
 
 it("shares a temporary metadata lookup, releases its process, and refreshes after settings change", async () => {
diff --git a/src/bundled/claude-code/sessions.ts b/src/bundled/claude-code/sessions.ts
index f4f34c8353..ad8969536e 100644
--- a/src/bundled/claude-code/sessions.ts
+++ b/src/bundled/claude-code/sessions.ts
@@ -16,6 +16,7 @@ import {
   type TurnPick,
 } from "./claude";
 import { STANDALONE_DEADLINE_MS } from "../../features/agent-harness/standalone";
+import type { AgentStore } from "../../features/agents/store";
 
 /** A conversation's process stops after this long without a message or its
  * own activity, such as background work. */
@@ -517,53 +518,78 @@ export class Spare {
   }
 }
 
-/** Sessions saved in local storage, by agent and then conversation. */
+/** Where sessions were kept for every agent in one value, before each agent's
+ * had its own key. */
+export const LEGACY_SESSIONS = "buzz.claude-code.sessions.v1";
+
+/** Sessions saved in agent storage, one key per agent, by conversation. Each
+ * agent's own key lets programs that run different agents share the storage. */
 export function localSessions(
-  storage: Storage,
+  storage: AgentStore,
   agent: string,
-  name = "buzz.claude-code.sessions.v1",
+  name = LEGACY_SESSIONS,
 ): SessionStore & {
   /** Saved sessions, most recently used first. */
   list(): [string, SavedSession][];
 } {
-  const readAll = (): Record<string, Record<string, SavedSession>> => {
+  const key = `${name}:${agent}`;
+  const object = (text: string | null) => {
     try {
-      const value = JSON.parse(storage.getItem(name) ?? "{}");
+      const value = JSON.parse(text ?? "{}");
       return value && typeof value === "object" ? value : {};
     } catch {
       return {};
     }
   };
+  const read = (): Record<string, SavedSession> => {
+    const own = storage.get(key);
+    return own === null
+      ? (object(storage.get(name))[agent] ?? {})
+      : object(own);
+  };
   const update = (change: (sessions: Record<string, SavedSession>) => void) => {
-    const all = readAll();
-    const sessions = { ...(all[agent] ?? {}) };
+    const sessions = { ...read() };
     change(sessions);
     const kept = Object.entries(sessions)
       .sort(([, a], [, b]) => b.at - a.at)
       .slice(0, SAVED_LIMIT);
-    all[agent] = Object.fromEntries(kept);
-    try {
-      storage.setItem(name, JSON.stringify(all));
-    } catch (error) {
+    const warn = (error: unknown) =>
       console.warn("Claude sessions were not saved", error);
+    const own = storage.set(key, JSON.stringify(Object.fromEntries(kept)));
+    // The old shared value drops this agent once its own key is saved: until
+    // then it holds the only saved copy.
+    if (!(agent in object(storage.get(name)))) {
+      void own.catch(warn);
+      return;
     }
+    void own
+      .then(() => {
+        const legacy = object(storage.get(name));
+        if (!(agent in legacy)) return;
+        delete legacy[agent];
+        return storage.set(
+          name,
+          Object.keys(legacy).length ? JSON.stringify(legacy) : null,
+        );
+      })
+      .catch(warn);
   };
   return {
     list: () =>
-      Object.entries(readAll()[agent] ?? {})
+      Object.entries(read())
         .filter(([, saved]) => typeof saved?.id === "string")
         .sort(([, a], [, b]) => b.at - a.at),
-    get: (key) => {
-      const saved = readAll()[agent]?.[key];
+    get: (conversation) => {
+      const saved = read()[conversation];
       return saved && typeof saved.id === "string" ? saved : undefined;
     },
-    set: (key, session) =>
+    set: (conversation, session) =>
       update((sessions) => {
-        sessions[key] = session;
+        sessions[conversation] = session;
       }),
-    delete: (key) =>
+    delete: (conversation) =>
       update((sessions) => {
-        delete sessions[key];
+        delete sessions[conversation];
       }),
   };
 }
diff --git a/src/bundled/claude-code/tabs.test.tsx b/src/bundled/claude-code/tabs.test.tsx
index 07e22376fd..70e5d00a7a 100644
--- a/src/bundled/claude-code/tabs.test.tsx
+++ b/src/bundled/claude-code/tabs.test.tsx
@@ -18,6 +18,11 @@ import { StrictMode } from "react";
 import userEvent from "@testing-library/user-event";
 import { afterEach, beforeEach, expect, it, vi } from "vitest";
 import type { Agent, AgentType } from "../../features/agents/service";
+import {
+  fileStore,
+  localStore,
+  type AgentStore,
+} from "../../features/agents/state";
 import type { HostProcessOptions } from "../../features/host/service";
 import { ClaudeLogoIcon } from "../../shared/design-system/icons";
 import { apply, inject } from "./index";
@@ -108,7 +113,10 @@ function applied({
   latest = version,
   files = {},
   catalog = { listed: true },
+  storage,
 }: {
+  /** Agent storage; this page's localStorage without it. */
+  storage?: AgentStore;
   loggedIn?: boolean;
   available?: boolean;
   version?: string;
@@ -236,6 +244,7 @@ function applied({
       })),
     },
     agents: {
+      storage,
       register: (registered: AgentType<Config>) => {
         type = registered;
       },
@@ -511,11 +520,48 @@ it("edits the model through the Settings dropdown and preserves agent inheritanc
   expect(save).not.toHaveBeenCalled();
 });
 
-it("preserves native behavior for invalid defaults and keeps explicit agent models", () => {
+it("keeps the saved default and shows the error while a default could not be saved", async () => {
+  let failing = true;
+  const storage = fileStore(new Map(), async () => {
+    if (failing) throw new Error("disk full");
+  });
+  const Control = installed({ storage }).type.provider?.DefaultControl;
+  if (!Control) throw new Error("Missing default control");
+  render(<Control onConfigure={vi.fn()} />);
+  const control = await screen.findByRole("button", {
+    name: /^Claude default model:/,
+  });
+  await waitFor(() => expect(control).toHaveTextContent("Opus 5.5"));
+  const pick = async () => {
+    fireEvent.click(control);
+    fireEvent.click(await screen.findByRole("menuitem", { name: "Claude" }));
+    fireEvent.click(
+      await screen.findByRole("menuitemradio", { name: "Fable 5.1" }),
+    );
+  };
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  await pick();
+  expect(await screen.findByRole("alert")).toHaveTextContent("disk full");
+  error.mockRestore();
+  expect(control).toHaveTextContent("Opus 5.5");
+  expect(storage.get("buzz.claude-code.provider-defaults.v1")).toBeNull();
+  // The same choice can be saved again.
+  failing = false;
+  await pick();
+  await waitFor(() =>
+    expect(screen.queryByRole("alert")).not.toBeInTheDocument(),
+  );
+  expect(control).toHaveTextContent("Fable 5.1");
+  expect(storage.get("buzz.claude-code.provider-defaults.v1")).toContain(
+    "fable",
+  );
+});
+
+it("preserves native behavior for invalid defaults and keeps explicit agent models", async () => {
   localStorage.setItem("buzz.claude-code.provider-defaults.v1", "not json");
-  const defaults = new ClaudeDefaults(localStorage);
+  const defaults = new ClaudeDefaults(localStore());
   expect(defaults.resolve(DEFAULT_CONFIG)).toEqual(DEFAULT_CONFIG);
-  defaults.save({ model: "sonnet" });
+  await defaults.save({ model: "sonnet" });
   const inherited = { ...DEFAULT_CONFIG };
   expect(defaults.resolve(inherited).model).toBe("sonnet");
   expect(inherited).toEqual(DEFAULT_CONFIG);
@@ -1074,11 +1120,13 @@ it("saves model-specific default effort from the nested menu and inherits it", a
     await screen.findByRole("menuitemradio", { name: "Sonnet 5.5" }),
   );
   fireEvent.click(await screen.findByRole("menuitemradio", { name: "High" }));
-  expect(control).toHaveAccessibleName(
-    "Claude default model: Sonnet 5.5, High",
+  await waitFor(() =>
+    expect(control).toHaveAccessibleName(
+      "Claude default model: Sonnet 5.5, High",
+    ),
   );
 
-  const reopened = new ClaudeDefaults(localStorage);
+  const reopened = new ClaudeDefaults(localStore());
   expect(reopened.resolve(DEFAULT_CONFIG)).toMatchObject({
     model: "sonnet",
     effort: "high",
@@ -1093,7 +1141,7 @@ it("saves model-specific default effort from the nested menu and inherits it", a
   fireEvent.click(
     await screen.findByRole("menuitem", { name: "Use Claude default" }),
   );
-  expect(new ClaudeDefaults(localStorage).snapshot().model).toBe("");
+  expect(new ClaudeDefaults(localStore()).snapshot().model).toBe("");
 });
 
 it("retries failed model discovery from the defaults row", async () => {
@@ -1126,7 +1174,7 @@ it("keeps the model inherited when changing the default model's effort", async (
     await screen.findByRole("menuitemradio", { name: "Opus 5.5" }),
   );
   fireEvent.click(await screen.findByRole("menuitemradio", { name: "High" }));
-  expect(new ClaudeDefaults(localStorage).snapshot()).toMatchObject({
+  expect(new ClaudeDefaults(localStore()).snapshot()).toMatchObject({
     model: "",
     effort: "high",
   });
diff --git a/src/bundled/claude-code/tabs.tsx b/src/bundled/claude-code/tabs.tsx
index 1cdc34280e..d4d7d463da 100644
--- a/src/bundled/claude-code/tabs.tsx
+++ b/src/bundled/claude-code/tabs.tsx
@@ -435,12 +435,10 @@ export function createTabs({
             effort={saved.effort ?? ""}
             effortLabel={saved.effort ? effortLabel(saved.effort) : "Automatic"}
             onEffortChange={(model, effort) => {
-              try {
-                defaults.save({ model, effort });
-                setError("");
-              } catch (reason) {
-                setError(String(reason));
-              }
+              defaults.save({ model, effort }).then(
+                () => setError(""),
+                (reason) => setError(String(reason)),
+              );
             }}
             value={
               saved.model
@@ -452,12 +450,10 @@ export function createTabs({
             defaultLabel={providerDefaultLabel("", state.models)}
             onConfigure={onConfigure}
             onChange={(model) => {
-              try {
-                defaults.save({ model });
-                setError("");
-              } catch (reason) {
-                setError(String(reason));
-              }
+              defaults.save({ model }).then(
+                () => setError(""),
+                (reason) => setError(String(reason)),
+              );
             }}
           />
         </ModelDiscoveryRecovery>
diff --git a/src/bundled/codex/index.ts b/src/bundled/codex/index.ts
index d212c8b9e2..928d948ebe 100644
--- a/src/bundled/codex/index.ts
+++ b/src/bundled/codex/index.ts
@@ -22,12 +22,16 @@ export const apply: PluginModule["apply"] = (ctx) => {
     (async () => {
       throw new Error("Codex agents run only in the desktop app");
     });
-  const providerController = new CodexProvider(start, localStorage, setup);
+  const providerController = new CodexProvider(
+    start,
+    ctx.agents.storage,
+    setup,
+  );
   const runtime = new CodexRuntime(
     start,
     (pubkey) => ownerReads(ctx.agents.relay(pubkey), pubkey),
     (pubkey, signal) => ctx.agents.core(pubkey, signal),
-    localStorage,
+    ctx.agents.storage,
     (raw) => providerController.resolve(raw),
     () => ctx.agents.tools(),
   );
diff --git a/src/bundled/codex/live.mjs b/src/bundled/codex/live.mjs
index e62d366ad1..72e007720d 100644
--- a/src/bundled/codex/live.mjs
+++ b/src/bundled/codex/live.mjs
@@ -151,9 +151,21 @@ const events = [];
 const memories = [];
 const uploads = [];
 const storage = new Map();
+// Agent storage (features/agents/store.ts `AgentStore`): each write settles
+// once saved, as the app's file-backed store does.
 const store = {
-  getItem: (key) => storage.get(key) ?? null,
-  setItem: (key, value) => storage.set(key, value),
+  keys: () => [...storage.keys()],
+  get: (key) => storage.get(key) ?? null,
+  set: async (key, value) => {
+    if (value === null) storage.delete(key);
+    else storage.set(key, value);
+  },
+  add: async (key, value) => {
+    const held = storage.get(key);
+    if (held !== undefined) return held;
+    storage.set(key, value);
+    return value;
+  },
 };
 const scope = "local-acceptance";
 const relay = {
@@ -341,6 +353,7 @@ try {
     threadId: saved.threadId,
     includeTurns: true,
   });
+  // The title, then the conversation's tag (prompt.ts `sessionTag`).
   assert.match(
     result.thread.name,
     /^Buzz #codex-test · thread cccccccc · Codex · buzz:[0-9a-f]{16}$/,
diff --git a/src/bundled/codex/runtime.test.ts b/src/bundled/codex/runtime.test.ts
index fdbb1822a7..f61cd667f3 100644
--- a/src/bundled/codex/runtime.test.ts
+++ b/src/bundled/codex/runtime.test.ts
@@ -4,6 +4,7 @@ import { bytesToHex } from "nostr-tools/utils";
 import { apply } from "./index";
 import { describe, afterEach, expect, it, vi } from "vitest";
 import { ownerReads } from "../../features/agents/reads";
+import { localStore } from "../../features/agents/state";
 import type { Agent, Delivery } from "../../features/agents/service";
 import type { RelayData } from "../../features/relay/service";
 import type { EventData } from "../../features/relay/events";
@@ -285,12 +286,13 @@ function fixture(
     },
   };
   const relay = { snapshot: () => snapshot } as unknown as RelayData;
-  const store = {
+  const local = {
     getItem: (key: string) => storage.get(key) ?? null,
     setItem: (key: string, value: string) => {
       storage.set(key, value);
     },
   } as Storage;
+  const store = localStore(local);
   // The host's copy of `core` memory, which needs no relay read.
   const core = vi.fn(
     async (
@@ -422,7 +424,7 @@ function fixture(
     runtime.run(delivery);
   let pluginDispose = () => {};
   if (plugin) {
-    vi.stubGlobal("localStorage", store);
+    vi.stubGlobal("localStorage", local);
     vi.stubGlobal("navigator", { platform: "MacIntel" });
     apply({
       host: { spawn },
@@ -1694,7 +1696,10 @@ it("starts no work when the agent stops while its channel is read", async () =>
       );
     },
     async () => undefined,
-    { getItem: () => null, setItem: () => {} } as unknown as Storage,
+    localStore({
+      getItem: () => null,
+      setItem: () => {},
+    } as unknown as Storage),
   );
   runtimes.push(runtime);
   runtime.sync([{ pubkey } as Agent]);
diff --git a/src/bundled/codex/runtime.ts b/src/bundled/codex/runtime.ts
index c5d49f08b4..75862d9d10 100644
--- a/src/bundled/codex/runtime.ts
+++ b/src/bundled/codex/runtime.ts
@@ -1,6 +1,7 @@
 import type { WorkOutcome } from "../../features/agents/local-activity";
 import { fromOwner, workflowOf } from "../../features/agents/owner-attestation";
 import type { AgentReads } from "../../features/agents/reads";
+import { localStore, type AgentStore } from "../../features/agents/store";
 import type {
   Agent,
   AgentHandle,
@@ -185,7 +186,7 @@ export class CodexRuntime {
     private readonly reads: (pubkey: string) => AgentReads | undefined,
     /** The agent's `core` memory as the host keeps it (`Agents.core`). */
     private readonly core: Agents["core"],
-    private readonly storage: Storage = localStorage,
+    private readonly storage: AgentStore = localStore(),
     private readonly resolveConfig: (raw: unknown) => Config = config,
     /** The tools plugins add to every thread now. */
     private readonly added: () => readonly AddedTool[] = () => [],
@@ -385,9 +386,7 @@ export class CodexRuntime {
   }
   private load(storageKey: string) {
     try {
-      const stored: unknown = JSON.parse(
-        this.storage.getItem(storageKey) ?? "{}",
-      );
+      const stored: unknown = JSON.parse(this.storage.get(storageKey) ?? "{}");
       if (stored && typeof stored === "object" && !Array.isArray(stored))
         return Object.fromEntries(
           Object.entries(stored).filter(
@@ -471,16 +470,16 @@ export class CodexRuntime {
     entry.saved[key] = saved;
     // Retain a bounded set of bindings; this never deletes Codex's own history.
     entry.saved = Object.fromEntries(Object.entries(entry.saved).slice(-200));
-    try {
-      this.storage.setItem(entry.storageKey, JSON.stringify(entry.saved));
-    } catch (error) {
-      this.status(
-        request.agent.pubkey,
-        key,
-        "Session could not be saved",
-        message(error),
+    void this.storage
+      .set(entry.storageKey, JSON.stringify(entry.saved))
+      .catch((error: unknown) =>
+        this.status(
+          request.agent.pubkey,
+          key,
+          "Session could not be saved",
+          message(error),
+        ),
       );
-    }
   }
   /** Dates the binding now, when it takes in a message or ends a turn. */
   private touch(request: Request, entry: Entry, key: string) {
diff --git a/src/bundled/codex/tabs.test.tsx b/src/bundled/codex/tabs.test.tsx
index ada3eea018..7d7f23e00d 100644
--- a/src/bundled/codex/tabs.test.tsx
+++ b/src/bundled/codex/tabs.test.tsx
@@ -18,6 +18,11 @@ import { StrictMode } from "react";
 import userEvent from "@testing-library/user-event";
 import { afterEach, beforeEach, expect, it, vi } from "vitest";
 import { ownerReads } from "../../features/agents/reads";
+import {
+  fileStore,
+  localStore,
+  type AgentStore,
+} from "../../features/agents/state";
 import type { AgentViewProps } from "../../features/agents/service";
 import type { HostProcessOptions } from "../../features/host/service";
 import type { RelayData } from "../../features/relay/service";
@@ -58,7 +63,10 @@ function fixture({
   turns = () => ({ result: { data: [] } }),
   threads = [],
   configured = {},
+  storage = localStore(),
 }: {
+  /** Agent storage, which keeps the provider defaults. */
+  storage?: AgentStore;
   signedIn?: boolean;
   installed?: boolean;
   saved?: Record<string, unknown>;
@@ -165,7 +173,7 @@ function fixture({
     return process;
   });
   const setup = new CodexSetup(spawn);
-  const provider = new CodexProvider(spawn, localStorage, setup);
+  const provider = new CodexProvider(spawn, storage, setup);
   const relay = {
     snapshot: () => ({
       status: "ready",
@@ -176,10 +184,10 @@ function fixture({
       },
     }),
   } as unknown as RelayData;
-  const sessions = {
+  const sessions = localStore({
     getItem: () => JSON.stringify(saved),
     setItem: () => undefined,
-  } as unknown as Storage;
+  } as unknown as Storage);
   const runtime = new CodexRuntime(
     spawn,
     (pubkey) => ownerReads(relay, pubkey),
@@ -444,6 +452,7 @@ it("keeps provider readiness quiet and shows recovery when needed", async () =>
   await user.click(screen.getByLabelText("Default thinking"));
   await user.click(await screen.findByRole("option", { name: "High" }));
   fireEvent.click(screen.getByRole("button", { name: "Save defaults" }));
+  await waitFor(() => expect(onClose).toHaveBeenCalledOnce());
   expect(f.provider.resolve(defaults)).toMatchObject({
     model: "",
     effort: "high",
@@ -475,10 +484,63 @@ it("keeps provider readiness quiet and shows recovery when needed", async () =>
   expect(screen.getByRole("button", { name: "Sign in" })).toBeVisible();
   expect(screen.queryByText("Connection")).not.toBeInTheDocument();
 });
+it("keeps the provider dialog and its draft open while defaults could not be saved", async () => {
+  let failing = true;
+  const storage = fileStore(new Map(), async () => {
+    if (failing) throw new Error("disk full");
+  });
+  const f = fixture({ storage });
+  const onClose = vi.fn();
+  render(<f.tabs.ProviderDialogBody onClose={onClose} />);
+  await waitFor(() =>
+    expect(screen.getByLabelText("Default thinking")).toBeEnabled(),
+  );
+  const user = userEvent.setup();
+  await user.click(screen.getByLabelText("Default thinking"));
+  await user.click(await screen.findByRole("option", { name: "High" }));
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  fireEvent.click(screen.getByRole("button", { name: "Save defaults" }));
+  expect(await screen.findByRole("alert")).toHaveTextContent("disk full");
+  error.mockRestore();
+  expect(onClose).not.toHaveBeenCalled();
+  expect(screen.getByLabelText("Default thinking")).toHaveTextContent("High");
+  // Nothing inherits defaults that were not saved.
+  expect(f.provider.snapshot().defaults.effort).toBe("");
+  failing = false;
+  fireEvent.click(screen.getByRole("button", { name: "Save defaults" }));
+  await waitFor(() => expect(onClose).toHaveBeenCalledOnce());
+  expect(f.provider.resolve(defaults).effort).toBe("high");
+  expect(storage.get("buzz.codex.provider-defaults.v1")).toContain("high");
+});
+
+it("holds the default thinking while it saves, so the dialog closes on what was saved", async () => {
+  let release = () => {};
+  const storage = fileStore(
+    new Map(),
+    () => new Promise<void>((resolve) => (release = resolve)),
+  );
+  const f = fixture({ storage });
+  const onClose = vi.fn();
+  render(<f.tabs.ProviderDialogBody onClose={onClose} />);
+  await waitFor(() =>
+    expect(screen.getByLabelText("Default thinking")).toBeEnabled(),
+  );
+  const user = userEvent.setup();
+  await user.click(screen.getByLabelText("Default thinking"));
+  await user.click(await screen.findByRole("option", { name: "High" }));
+  fireEvent.click(screen.getByRole("button", { name: "Save defaults" }));
+  await waitFor(() =>
+    expect(screen.getByLabelText("Default thinking")).toBeDisabled(),
+  );
+  release();
+  await waitFor(() => expect(onClose).toHaveBeenCalledOnce());
+  expect(f.provider.resolve(defaults).effort).toBe("high");
+});
+
 it("applies provider precedence without rewriting records and falls back for incompatible thinking", async () => {
   const f = fixture();
   await f.provider.check();
-  f.provider.saveDefaults({ model: "model-a", effort: "high" });
+  await f.provider.saveDefaults({ model: "model-a", effort: "high" });
   const inherited = { ...defaults };
   expect(f.provider.resolve(inherited)).toMatchObject({
     model: "model-a",
@@ -493,7 +555,7 @@ it("applies provider precedence without rewriting records and falls back for inc
     f.provider.resolve({ ...defaults, model: "model-b", effort: "high" }),
   ).toMatchObject({ model: "model-b", effort: "high" });
 
-  f.provider.saveDefaults({ model: "model-b", effort: "medium" });
+  await f.provider.saveDefaults({ model: "model-b", effort: "medium" });
   render(<f.tabs.SettingsTab {...f.props()} />);
   await waitFor(() =>
     expect(screen.getByRole("combobox", { name: "Model" })).toHaveTextContent(
@@ -508,7 +570,7 @@ it("applies provider precedence without rewriting records and falls back for inc
   cleanup();
 
   localStorage.setItem("buzz.codex.provider-defaults.v1", "invalid");
-  const invalid = new CodexProvider(f.spawn, localStorage);
+  const invalid = new CodexProvider(f.spawn, localStore());
   expect(invalid.resolve(defaults)).toEqual(defaults);
 });
 it("selects a model in the Settings dropdown without changing local Codex preferences", async () => {
@@ -527,14 +589,14 @@ it("selects a model in the Settings dropdown without changing local Codex prefer
   );
   fireEvent.click(await screen.findByRole("menuitemradio", { name: "Medium" }));
   expect(
-    new CodexProvider(f.spawn, localStorage).resolve(defaults),
+    new CodexProvider(f.spawn, localStore()).resolve(defaults),
   ).toMatchObject({ model: "model-b", effort: "medium" });
-  expect(control).toHaveTextContent("Medium");
+  await waitFor(() => expect(control).toHaveTextContent("Medium"));
   fireEvent.click(control);
   fireEvent.click(
     await screen.findByRole("menuitem", { name: "Use Codex recommended" }),
   );
-  expect(f.provider.snapshot().defaults.model).toBe("");
+  await waitFor(() => expect(f.provider.snapshot().defaults.model).toBe(""));
 
   expect(configured).toEqual({
     model: "model-b",
@@ -633,7 +695,7 @@ it("shows a provider model recheck inside a focusable inactive picker", async ()
 it("keeps model-default provider thinking dynamic across save and reopen", async () => {
   const f = fixture();
   await f.provider.check();
-  f.provider.saveDefaults({ model: "", effort: "high" });
+  await f.provider.saveDefaults({ model: "", effort: "high" });
   const onClose = vi.fn();
   const view = render(<f.tabs.ProviderDialogBody onClose={onClose} />);
   const user = userEvent.setup();
@@ -1141,7 +1203,7 @@ it("moves the card from Install Codex to Sign in once the install succeeds", asy
 
 it("installs and signs in Buzz's copy of Codex from its provider settings", async () => {
   const f = fixture({ installed: false, signedIn: false });
-  const provider = new CodexProvider(f.spawn, localStorage, f.setup);
+  const provider = new CodexProvider(f.spawn, localStore(), f.setup);
   const { ProviderDialogBody } = createTabs(
     provider,
     f.runtime,
@@ -1304,8 +1366,10 @@ it("keeps the recommended model inherited when only effort changes", async () =>
     await screen.findByRole("menuitemradio", { name: "Model A" }),
   );
   fireEvent.click(await screen.findByRole("menuitemradio", { name: "High" }));
-  expect(f.provider.snapshot().defaults).toMatchObject({
-    model: "",
-    effort: "high",
-  });
+  await waitFor(() =>
+    expect(f.provider.snapshot().defaults).toMatchObject({
+      model: "",
+      effort: "high",
+    }),
+  );
 });
diff --git a/src/bundled/codex/tabs.tsx b/src/bundled/codex/tabs.tsx
index 0a87980c6f..15c1d71131 100644
--- a/src/bundled/codex/tabs.tsx
+++ b/src/bundled/codex/tabs.tsx
@@ -24,6 +24,7 @@ import type {
   AgentProviderSnapshot,
   AgentViewProps,
 } from "../../features/agents/service";
+import { localStore, type AgentStore } from "../../features/agents/store";
 import { PanelSubview } from "../../features/panels/PanelSubview";
 import { Button } from "../../shared/design-system/ui/Button";
 import { Field } from "../../shared/design-system/ui/Field";
@@ -102,7 +103,7 @@ export class CodexProvider {
 
   constructor(
     private readonly spawn: Spawn,
-    private readonly storage: Storage = localStorage,
+    private readonly storage: AgentStore = localStore(),
     private readonly setup?: CodexSetup,
   ) {
     this.state = Object.freeze({
@@ -187,7 +188,9 @@ export class CodexProvider {
       if (this.abort === abort) this.abort = undefined;
     }
   }
-  saveDefaults(next: ProviderDefaults) {
+  /** Settles once the defaults are saved, and only then uses them; rejects,
+   * keeping the saved ones, when they could not be saved. */
+  async saveDefaults(next: ProviderDefaults) {
     const selected = this.model(next.model);
     const effort =
       !next.effort ||
@@ -197,7 +200,10 @@ export class CodexProvider {
         ? next.effort
         : (selected?.defaultReasoningEffort ?? "");
     const defaults = Object.freeze({ model: next.model, effort });
-    this.writeDefaults(defaults);
+    await this.storage.set(
+      STORAGE_KEY,
+      JSON.stringify({ version: 1, ...defaults }),
+    );
     this.set({ defaults });
   }
   resolve(raw: unknown): Config {
@@ -230,16 +236,10 @@ export class CodexProvider {
   private model(model: string) {
     return catalogModel(model, this.state.data);
   }
-  private writeDefaults(defaults: ProviderDefaults) {
-    this.storage.setItem(
-      STORAGE_KEY,
-      JSON.stringify({ version: 1, ...defaults }),
-    );
-  }
   private readDefaults(): ProviderDefaults {
     try {
       const value: unknown = JSON.parse(
-        this.storage.getItem(STORAGE_KEY) ?? "null",
+        this.storage.get(STORAGE_KEY) ?? "null",
       );
       if (
         value &&
@@ -441,24 +441,20 @@ export function createTabs(
               : "Automatic"
           }
           onEffortChange={(model, effort) => {
-            try {
-              provider.saveDefaults({ model, effort });
-              setError("");
-            } catch (reason) {
-              setError(String(reason));
-            }
+            provider.saveDefaults({ model, effort }).then(
+              () => setError(""),
+              (reason) => setError(String(reason)),
+            );
           }}
           value={state.defaults.model}
           defaultModel={catalogModel("", state.data)?.model}
           defaultLabel={providerDefaultLabel("", state.data)}
           onConfigure={onConfigure}
           onChange={(model) => {
-            try {
-              provider.saveDefaults({ model, effort: "" });
-              setError("");
-            } catch (reason) {
-              setError(String(reason));
-            }
+            provider.saveDefaults({ model, effort: "" }).then(
+              () => setError(""),
+              (reason) => setError(String(reason)),
+            );
           }}
         />
         {error && <span role="alert">{error}</span>}
@@ -477,6 +473,7 @@ export function createTabs(
     );
     const [draft, setDraft] = useState(state.defaults);
     const [saveError, setSaveError] = useState("");
+    const [savingDefaults, setSavingDefaults] = useState(false);
     const action =
       error === NOT_INSTALLED
         ? ({ step: "install", label: "Install Codex" } as const)
@@ -555,14 +552,14 @@ export function createTabs(
           hidden={state.readiness !== "ready"}
           onSubmit={(event) => {
             event.preventDefault();
+            if (savingDefaults) return;
             setSaveError("");
-            try {
-              provider.saveDefaults(draft);
-            } catch (reason) {
-              setSaveError(message(reason));
-              return;
-            }
-            onClose();
+            setSavingDefaults(true);
+            // Closes only once saved; else the draft stays to try again.
+            provider
+              .saveDefaults(draft)
+              .then(onClose, (reason) => setSaveError(message(reason)))
+              .finally(() => setSavingDefaults(false));
           }}
         >
           <Select
@@ -574,7 +571,7 @@ export function createTabs(
             variant="preference"
             value={draft.effort}
             groups={[{ label: "", options: efforts }]}
-            disabled={checking || !selected}
+            disabled={checking || !selected || savingDefaults}
             onValueChange={(effort) => setDraft({ ...draft, effort })}
           />
           {saveError && (
@@ -596,6 +593,7 @@ export function createTabs(
               type="submit"
               form={defaultsForm}
               variant="prominent"
+              loading={savingDefaults}
               disabled={
                 JSON.stringify(draft) === JSON.stringify(state.defaults)
               }
diff --git a/src/features/agents/agent-config.ts b/src/features/agents/agent-config.ts
index caa7838279..7b0afbfb80 100644
--- a/src/features/agents/agent-config.ts
+++ b/src/features/agents/agent-config.ts
@@ -5,6 +5,7 @@
 // from storage. Dormant until config channels ship.
 import { verifyEvent } from "nostr-tools";
 import type { RelayEvent } from "../relay/events";
+import { localStore, type AgentStore } from "./store";
 import {
   artifactOp,
   artifactPrev,
@@ -55,7 +56,7 @@ const hadKey = (s: Subject) =>
 export class AgentConfigStore {
   private stored: Stored;
 
-  constructor(private readonly storage: Storage = localStorage) {
+  constructor(private readonly storage: AgentStore = localStore()) {
     this.stored = this.load();
   }
 
@@ -182,13 +183,18 @@ export class AgentConfigStore {
     this.save();
   }
   private save() {
-    this.storage.setItem(CONFIG_STORAGE_KEY, JSON.stringify(this.stored));
+    // Unsaved, the next start reads the last saved copy and syncs again.
+    void this.storage
+      .set(CONFIG_STORAGE_KEY, JSON.stringify(this.stored))
+      .catch((error: unknown) =>
+        console.warn("Agent synced settings were not saved", error),
+      );
   }
   private load(): Stored {
     const empty: Stored = { version: 1, entries: {}, hadVersion: {} };
     let value: Stored;
     try {
-      value = JSON.parse(this.storage.getItem(CONFIG_STORAGE_KEY) ?? "null");
+      value = JSON.parse(this.storage.get(CONFIG_STORAGE_KEY) ?? "null");
     } catch {
       return empty;
     }
diff --git a/src/features/agents/catch-up.test.ts b/src/features/agents/catch-up.test.ts
index d804ff8a86..1aa813cd93 100644
--- a/src/features/agents/catch-up.test.ts
+++ b/src/features/agents/catch-up.test.ts
@@ -1,14 +1,19 @@
-import { expect, it } from "vitest";
+import { expect, it, vi } from "vitest";
 import type { ReadFilter } from "../relay/events";
 import {
   CATCH_UP_KEY,
   CATCH_UP_PAGE,
   CATCH_UP_PAGES,
+  catchUpKey,
   readCheckpoints,
   readWindow,
+  splitLegacyCheckpoints,
+  streamKey,
+  writeCheckpoints,
   type Stream,
 } from "./catch-up";
-import { memoryStorage } from "./test-fakes";
+import { fileStore } from "./state";
+import { memoryStorage, sharedFiles } from "./test-fakes";
 
 type Stored = { id: string; created_at: number; content: string };
 const id = (i: number) => i.toString(16).padStart(64, "0");
@@ -119,12 +124,13 @@ it("goes on after the last event delivered when a window was cut short", async (
 
 it("keeps only valid live events heard past a saved checkpoint, and skips them", async () => {
   const storage = memoryStorage();
+  const k = streamKey(id(9), "watch/all");
   storage.setItem(
-    CATCH_UP_KEY,
+    catchUpKey(id(9)),
     JSON.stringify({
       version: 1,
       streams: {
-        k: {
+        [k]: {
           through: 10,
           heard: [
             { created_at: 11, id: id(1) },
@@ -137,7 +143,7 @@ it("keeps only valid live events heard past a saved checkpoint, and skips them",
       },
     }),
   );
-  const saved = readCheckpoints(storage).k;
+  const saved = readCheckpoints(storage)[k];
   expect(saved).toEqual({
     through: 10,
     heard: [{ created_at: 11, id: id(1) }],
@@ -149,3 +155,95 @@ it("keeps only valid live events heard past a saved checkpoint, and skips them",
   const window = await readWindow(all, saved, 20, read);
   expect(window?.events.map(({ content }) => content)).toEqual(["missed"]);
 });
+
+const a = streamKey(id(10), "watch/chat");
+const b = streamKey(id(11), "watch/chat");
+
+it("keeps the progress each program saves for its own agents", async () => {
+  const { disk, open } = sharedFiles();
+  const setup = open();
+  await writeCheckpoints(
+    setup,
+    { [a]: { through: 100 }, [b]: { through: 100 } },
+    {},
+  );
+  // Two programs start from the same files, each running one agent, and each
+  // keeps its own copy of every agent's progress.
+  const first = open();
+  const second = open();
+  const firstCopy = readCheckpoints(first);
+  const secondCopy = readCheckpoints(second);
+  await writeCheckpoints(
+    first,
+    { ...firstCopy, [a]: { through: 200 } },
+    firstCopy,
+  );
+  await writeCheckpoints(
+    second,
+    { ...secondCopy, [b]: { through: 300 } },
+    secondCopy,
+  );
+  // Neither wrote over the other's agent.
+  expect(readCheckpoints(open())).toEqual({
+    [a]: { through: 200 },
+    [b]: { through: 300 },
+  });
+  expect([...disk.keys()].sort()).toEqual(
+    [catchUpKey(id(10)), catchUpKey(id(11))].sort(),
+  );
+});
+
+it("moves the old shared progress into each agent's key, and a late move keeps newer progress", async () => {
+  const { disk, open } = sharedFiles({
+    [CATCH_UP_KEY]: JSON.stringify({
+      version: 1,
+      streams: { [a]: { through: 100 }, [b]: { through: 100 } },
+    }),
+  });
+  // Both programs start from the old value. The second's saves wait.
+  let release = () => {};
+  const first = open();
+  const second = open(new Promise((resolve) => (release = resolve)));
+  const moved = splitLegacyCheckpoints(first);
+  const firstCopy = readCheckpoints(first);
+  const late = splitLegacyCheckpoints(second);
+  const secondCopy = readCheckpoints(second);
+  await moved;
+  expect(disk.has(CATCH_UP_KEY)).toBe(false);
+  // The first runs its agent on before the second's move is saved.
+  await writeCheckpoints(
+    first,
+    { ...firstCopy, [a]: { through: 200 } },
+    firstCopy,
+  );
+  release();
+  await late;
+  // The late move kept the newer progress, and the second's copy has it too.
+  expect(readCheckpoints(open())[a]).toEqual({ through: 200 });
+  expect(readCheckpoints(second)[a]).toEqual({ through: 200 });
+  // The second saves only its own agent, from its older copy.
+  await writeCheckpoints(
+    second,
+    { ...secondCopy, [b]: { through: 300 } },
+    secondCopy,
+  );
+  expect(readCheckpoints(open())).toEqual({
+    [a]: { through: 200 },
+    [b]: { through: 300 },
+  });
+});
+
+it("keeps the old shared progress when the move cannot be saved", async () => {
+  const shared = JSON.stringify({
+    version: 1,
+    streams: { [a]: { through: 100 } },
+  });
+  const storage = fileStore(new Map([[CATCH_UP_KEY, shared]]), async () => {
+    throw new Error("disk full");
+  });
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  await splitLegacyCheckpoints(storage);
+  error.mockRestore();
+  expect(storage.get(CATCH_UP_KEY)).toBe(shared);
+  expect(readCheckpoints(storage)).toEqual({ [a]: { through: 100 } });
+});
diff --git a/src/features/agents/catch-up.ts b/src/features/agents/catch-up.ts
index 2d3470ec7b..a81dbc639a 100644
--- a/src/features/agents/catch-up.ts
+++ b/src/features/agents/catch-up.ts
@@ -4,6 +4,7 @@
 // Only the progress is saved, never an event.
 import type { Agent } from "./service";
 import type { EventData, ReadFilter } from "../relay/events";
+import type { AgentStore } from "./store";
 
 export const CATCH_UP_KEY = "buzz.agents.catch-up.v1";
 /** Events in one read, as Janet's catch-up pages are. */
@@ -56,10 +57,62 @@ export const undelivered = (checkpoint: Checkpoint, event: Position) =>
   (!checkpoint.after || oldestFirst(event, checkpoint.after) > 0) &&
   !checkpoint.heard?.some(({ id }) => id === event.id);
 
-export function readCheckpoints(storage: Storage): Checkpoints {
+/** Each agent's catch-up progress has its own key, so programs that run
+ * different agents and share this storage never write over each other's
+ * progress. */
+export const CATCH_UP_PREFIX = "buzz.agents.catch-up.v1:";
+export const catchUpKey = (pubkey: string) => `${CATCH_UP_PREFIX}${pubkey}`;
+
+/** The agent a stream key belongs to, or undefined for a malformed key. */
+function ownerOf(key: string): string | undefined {
+  try {
+    const [pubkey] = JSON.parse(key) as unknown[];
+    return typeof pubkey === "string" && ID.test(pubkey) ? pubkey : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** A valid checkpoint, with its fields in one order; undefined otherwise. */
+function checkpointOf(value: unknown): Checkpoint | undefined {
+  const { through, upper, after, heard } = (value ?? {}) as Checkpoint;
+  if (
+    !time(through) ||
+    (upper !== undefined && !(time(upper) && upper > through))
+  )
+    return undefined;
+  const valid =
+    after === undefined ||
+    (upper !== undefined &&
+      time(after.created_at) &&
+      after.created_at > through &&
+      after.created_at <= upper &&
+      ID.test(after.id));
+  if (!valid) return undefined;
+  const live = (Array.isArray(heard) ? heard : [])
+    .filter(
+      (event) =>
+        time(event?.created_at) &&
+        event.created_at > through &&
+        typeof event.id === "string" &&
+        ID.test(event.id),
+    )
+    .slice(-HEARD_LIMIT)
+    .map(({ created_at, id }) => ({ created_at, id }));
+  return {
+    through,
+    ...(upper !== undefined ? { upper } : {}),
+    ...(after ? { after: { created_at: after.created_at, id: after.id } } : {}),
+    ...(live.length ? { heard: live } : {}),
+  };
+}
+
+/** The valid checkpoints of one stored value, of `pubkey`'s streams only when
+ * it is given. */
+function parseStreams(text: string | null, pubkey?: string) {
   let stored: unknown;
   try {
-    stored = JSON.parse(storage.getItem(CATCH_UP_KEY) ?? "null");
+    stored = JSON.parse(text ?? "null");
   } catch {
     return {};
   }
@@ -70,49 +123,103 @@ export function readCheckpoints(storage: Storage): Checkpoints {
   if (!streams || typeof streams !== "object") return {};
   const checkpoints: Record<string, Checkpoint> = {};
   for (const [key, value] of Object.entries(streams)) {
-    const { through, upper, after, heard } = (value ?? {}) as Checkpoint;
-    if (
-      !time(through) ||
-      (upper !== undefined && !(time(upper) && upper > through))
-    )
-      continue;
-    const valid =
-      after === undefined ||
-      (upper !== undefined &&
-        time(after.created_at) &&
-        after.created_at > through &&
-        after.created_at <= upper &&
-        ID.test(after.id));
-    if (!valid) continue;
-    const live = (Array.isArray(heard) ? heard : [])
-      .filter(
-        (event) =>
-          time(event?.created_at) &&
-          event.created_at > through &&
-          typeof event.id === "string" &&
-          ID.test(event.id),
-      )
-      .slice(-HEARD_LIMIT)
-      .map(({ created_at, id }) => ({ created_at, id }));
-    checkpoints[key] = {
-      through,
-      ...(upper !== undefined ? { upper } : {}),
-      ...(after
-        ? { after: { created_at: after.created_at, id: after.id } }
-        : {}),
-      ...(live.length ? { heard: live } : {}),
-    };
+    if (pubkey !== undefined && ownerOf(key) !== pubkey) continue;
+    const checkpoint = checkpointOf(value);
+    if (checkpoint) checkpoints[key] = checkpoint;
   }
   return checkpoints;
 }
 
-export function writeCheckpoints(storage: Storage, checkpoints: Checkpoints) {
-  storage.setItem(
-    CATCH_UP_KEY,
-    JSON.stringify({ version: 1, streams: checkpoints }),
+/** One stored value, the same text for the same progress. */
+const serialize = (checkpoints: Checkpoints) =>
+  JSON.stringify({
+    version: 1,
+    streams: Object.fromEntries(
+      Object.entries(checkpoints).sort(([a], [b]) =>
+        a < b ? -1 : a > b ? 1 : 0,
+      ),
+    ),
+  });
+
+/** Every agent's progress: its own key's, or else the old shared value's. */
+export function readCheckpoints(storage: AgentStore): Checkpoints {
+  const legacy = parseStreams(storage.get(CATCH_UP_KEY));
+  const own: Record<string, Checkpoints> = {};
+  for (const key of storage.keys()) {
+    if (!key.startsWith(CATCH_UP_PREFIX)) continue;
+    const pubkey = key.slice(CATCH_UP_PREFIX.length);
+    own[pubkey] = parseStreams(storage.get(key), pubkey);
+  }
+  return Object.assign(
+    Object.fromEntries(
+      Object.entries(legacy).filter(([key]) => {
+        const pubkey = ownerOf(key);
+        return pubkey !== undefined && !own[pubkey];
+      }),
+    ),
+    ...Object.values(own),
   );
 }
 
+/** Valid checkpoints by agent. */
+function byAgent(checkpoints: Checkpoints) {
+  const agents = new Map<string, Record<string, Checkpoint>>();
+  for (const [key, value] of Object.entries(checkpoints)) {
+    const pubkey = ownerOf(key);
+    const checkpoint = checkpointOf(value);
+    if (pubkey === undefined || !checkpoint) continue;
+    const streams = agents.get(pubkey) ?? {};
+    streams[key] = checkpoint;
+    agents.set(pubkey, streams);
+  }
+  return agents;
+}
+
+/** Saves the progress of each agent whose progress changed since `saved`,
+ * this program's last save or read, in its own key, and removes the key of
+ * an agent with none left. An agent this program did not move is never
+ * written, so it keeps what the program that runs it saved, even when this
+ * program's copy of it is older. Settles once every write is saved. */
+export async function writeCheckpoints(
+  storage: AgentStore,
+  checkpoints: Checkpoints,
+  saved: Checkpoints,
+) {
+  const next = byAgent(checkpoints);
+  const last = byAgent(saved);
+  const writes: Promise<void>[] = [];
+  for (const pubkey of new Set([...next.keys(), ...last.keys()])) {
+    const streams = next.get(pubkey);
+    const before = last.get(pubkey);
+    const text = streams && serialize(streams);
+    if (text === (before && serialize(before))) continue;
+    writes.push(storage.set(catchUpKey(pubkey), text ?? null));
+  }
+  await Promise.all(writes);
+}
+
+/** Moves progress from the old value that held every agent's into one key
+ * per agent, then removes it, as `splitLegacyRecords` does records. A key
+ * is only added where none is saved: a program that starts from the old
+ * value after another moved it, and ran its agents on, keeps their newer
+ * progress. */
+export async function splitLegacyCheckpoints(storage: AgentStore) {
+  if (storage.get(CATCH_UP_KEY) === null) return;
+  const agents = byAgent(readCheckpoints(storage));
+  try {
+    await Promise.all(
+      [...agents].map(([pubkey, streams]) =>
+        storage.add(catchUpKey(pubkey), serialize(streams)),
+      ),
+    );
+    await storage.set(CATCH_UP_KEY, null);
+  } catch (error) {
+    // This must not stop startup. The shared value stays, so the progress is
+    // read from it and the move is tried again at the next start.
+    console.error("Agent catch-up progress was not split", error);
+  }
+}
+
 /** The agent's streams: one for each channel of each event watch whose kinds
  * are exactly [9], enabled or not. Other kinds have reconnect replay only, as
  * in Janet. */
diff --git a/src/features/agents/launch-boundary.test.ts b/src/features/agents/launch-boundary.test.ts
index bbfddddcb8..0be41017ee 100644
--- a/src/features/agents/launch-boundary.test.ts
+++ b/src/features/agents/launch-boundary.test.ts
@@ -27,6 +27,7 @@ import {
 } from "./service";
 import { fakeNative } from "./service-testing";
 import { memoryStorage } from "./test-fakes";
+import type { AgentStore } from "./store";
 import { claudeRun } from "../../bundled/claude-code/run";
 import { ClaudeRuntime } from "../../bundled/claude-code/runtime";
 import { fakeSpawn as fakeClaude } from "../../bundled/claude-code/claude-testing";
@@ -71,7 +72,7 @@ const revision = (body: object | null, op = "create") =>
   ) as RelayEvent;
 
 /** Confirmed copies in this device's storage, as a sync read installs them. */
-function seed(storage: Storage, heads: [Subject, RelayEvent][]) {
+function seed(storage: AgentStore, heads: [Subject, RelayEvent][]) {
   const store = new AgentConfigStore(storage);
   for (const [subject, head] of heads)
     store.applyRead(subject, store.capture(subject), {
diff --git a/src/features/agents/migrate-filter.test.ts b/src/features/agents/migrate-filter.test.ts
index 4cbb1e8040..20a7be7c65 100644
--- a/src/features/agents/migrate-filter.test.ts
+++ b/src/features/agents/migrate-filter.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import type { EventWatch } from "./attention";
 import { migrateWatchFilters, upgradeWatch } from "./migrate-filter";
-import { STORAGE_KEY, readRecords } from "./store";
+import { RECORD_PREFIX, STORAGE_KEY, readRecords } from "./store";
 import { memoryStorage } from "./test-fakes";
 
 const agent = "a".repeat(64);
@@ -98,7 +98,7 @@ describe("upgradeWatch", () => {
 });
 
 describe("migrateWatchFilters", () => {
-  it("converts stored filters once; one it cannot convert stays for repair", () => {
+  it("converts stored filters once; one it cannot convert stays for repair", async () => {
     vi.spyOn(console, "error").mockImplementation(() => {});
     const owner = "c".repeat(64);
     const stored = (slug: string, filter: string) => ({
@@ -126,7 +126,7 @@ describe("migrateWatchFilters", () => {
         },
       }),
     );
-    migrateWatchFilters(storage);
+    await migrateWatchFilters(storage);
     const once = storage.getItem(STORAGE_KEY);
     const upgraded = { ...watch, exclude_authors: [owner], is_reply: false };
     const read = readRecords(storage)[agent];
@@ -142,10 +142,10 @@ describe("migrateWatchFilters", () => {
     expect(console.error).toHaveBeenCalledWith(
       expect.stringMatching(/watch\/word: filter cannot be converted/),
     );
-    migrateWatchFilters(storage);
+    await migrateWatchFilters(storage);
     expect(storage.getItem(STORAGE_KEY)).toBe(once);
   });
-  it("keeps a filter whose conversion the reader would skip", () => {
+  it("keeps a filter whose conversion the reader would skip", async () => {
     vi.spyOn(console, "error").mockImplementation(() => {});
     const keys = Array.from({ length: 101 }, (_, i) =>
       i.toString(16).padStart(64, "0"),
@@ -168,7 +168,7 @@ describe("migrateWatchFilters", () => {
       },
     });
     storage.setItem(STORAGE_KEY, before);
-    migrateWatchFilters(storage);
+    await migrateWatchFilters(storage);
     expect(storage.getItem(STORAGE_KEY)).toBe(before);
     expect(readRecords(storage)[agent]?.skipped?.["watch/many"]).toMatchObject({
       value,
@@ -178,12 +178,39 @@ describe("migrateWatchFilters", () => {
       expect.stringMatching(/watch\/many: the converted watch is invalid/),
     );
   });
-  it("leaves missing or malformed storage alone", () => {
+  it("leaves missing or malformed storage alone", async () => {
     const storage = memoryStorage();
-    migrateWatchFilters(storage);
+    await migrateWatchFilters(storage);
     expect(storage.getItem(STORAGE_KEY)).toBeNull();
     storage.setItem(STORAGE_KEY, "{");
-    migrateWatchFilters(storage);
+    await migrateWatchFilters(storage);
     expect(storage.getItem(STORAGE_KEY)).toBe("{");
   });
+  it("converts the filters in each agent's own record", async () => {
+    const owner = "c".repeat(64);
+    const storage = memoryStorage();
+    const key = `${RECORD_PREFIX}${agent}`;
+    storage.setItem(
+      key,
+      JSON.stringify({
+        pubkey: agent,
+        config: null,
+        attention: {
+          "watch/top": {
+            slug: "watch/top",
+            value: { ...watch, filter: `!(author == "${owner}")` },
+            modifiedAt: 3,
+          },
+        },
+      }),
+    );
+    await migrateWatchFilters(storage);
+    expect(readRecords(storage)[agent]?.attention["watch/top"]?.value).toEqual({
+      ...watch,
+      exclude_authors: [owner],
+    });
+    const once = storage.getItem(key);
+    await migrateWatchFilters(storage);
+    expect(storage.getItem(key)).toBe(once);
+  });
 });
diff --git a/src/features/agents/migrate-filter.ts b/src/features/agents/migrate-filter.ts
index 38ab76c7a3..cf0fe5ac37 100644
--- a/src/features/agents/migrate-filter.ts
+++ b/src/features/agents/migrate-filter.ts
@@ -4,7 +4,8 @@
 // The spec replaced it with `authors`, `exclude_authors` and `is_reply`, so
 // startup converts each stored filter once, with the spec's export mapping.
 import { validateObject } from "./attention";
-import { STORAGE_KEY } from "./store";
+import type { AgentStore } from "./state";
+import { RECORD_PREFIX, STORAGE_KEY } from "./store";
 
 const fail = (message: string): never => {
   throw new Error(message);
@@ -168,43 +169,62 @@ export function upgradeWatch(value: unknown, agent: string): unknown {
   };
 }
 
-/** Converts every stored watch filter in place. A filter that cannot be
- * converted stays as it is: the reader then skips that watch and shows it for
- * repair. A failure must not stop startup. */
-export function migrateWatchFilters(storage: Storage) {
-  let stored: unknown;
+/** Converts every stored watch filter in place, in the legacy shared record
+ * and in each agent's own record. A filter that cannot be converted stays as
+ * it is: the reader then skips that watch and shows it for repair. A failure
+ * must not stop startup, so each failed save is only logged. */
+export async function migrateWatchFilters(storage: AgentStore) {
+  const saves: Promise<void>[] = [];
+  const legacy = parsed(storage.get(STORAGE_KEY));
+  const agents = isObject(legacy) ? legacy.agents : undefined;
+  if (isObject(agents)) {
+    let changed = false;
+    for (const [pubkey, record] of Object.entries(agents))
+      if (upgradeRecord(pubkey, record)) changed = true;
+    if (changed) saves.push(save(storage, STORAGE_KEY, legacy));
+  }
+  for (const key of storage.keys()) {
+    if (!key.startsWith(RECORD_PREFIX)) continue;
+    const record = parsed(storage.get(key));
+    if (upgradeRecord(key.slice(RECORD_PREFIX.length), record))
+      saves.push(save(storage, key, record));
+  }
+  await Promise.all(saves);
+}
+
+function parsed(text: string | null): unknown {
   try {
-    stored = JSON.parse(storage.getItem(STORAGE_KEY) ?? "null");
+    return JSON.parse(text ?? "null");
   } catch {
-    return;
+    return undefined;
   }
-  const agents = isObject(stored) ? stored.agents : undefined;
-  if (!isObject(agents)) return;
+}
+
+/** Converts the record's watches in place; true when any changed. */
+function upgradeRecord(pubkey: string, record: unknown) {
+  const attention = isObject(record) ? record.attention : undefined;
+  if (!isObject(attention)) return false;
   let changed = false;
-  for (const [pubkey, record] of Object.entries(agents)) {
-    const attention = isObject(record) ? record.attention : undefined;
-    if (!isObject(attention)) continue;
-    for (const [slug, object] of Object.entries(attention)) {
-      if (!isObject(object)) continue;
-      try {
-        const value = upgradeWatch(object.value, pubkey);
-        if (value === object.value) continue;
-        // Never replace a filter with a watch the reader would skip.
-        const problem = validateObject(slug, value);
-        if (problem) fail(`the converted watch is invalid: ${problem}`);
-        object.value = value;
-        changed = true;
-      } catch (error) {
-        console.error(
-          `Cannot convert the filter of ${slug}: ${(error as Error).message}`,
-        );
-      }
-    }
-  }
-  if (changed)
+  for (const [slug, object] of Object.entries(attention)) {
+    if (!isObject(object)) continue;
     try {
-      storage.setItem(STORAGE_KEY, JSON.stringify(stored));
+      const value = upgradeWatch(object.value, pubkey);
+      if (value === object.value) continue;
+      // Never replace a filter with a watch the reader would skip.
+      const problem = validateObject(slug, value);
+      if (problem) fail(`the converted watch is invalid: ${problem}`);
+      object.value = value;
+      changed = true;
     } catch (error) {
-      console.error("Cannot save the converted watch filters", error);
+      console.error(
+        `Cannot convert the filter of ${slug}: ${(error as Error).message}`,
+      );
     }
+  }
+  return changed;
 }
+
+const save = (storage: AgentStore, key: string, value: unknown) =>
+  storage.set(key, JSON.stringify(value)).catch((error: unknown) => {
+    console.error("Cannot save the converted watch filters", error);
+  });
diff --git a/src/features/agents/migrate-storage.test.ts b/src/features/agents/migrate-storage.test.ts
index c65cdb5eb3..6abad532f5 100644
--- a/src/features/agents/migrate-storage.test.ts
+++ b/src/features/agents/migrate-storage.test.ts
@@ -3,7 +3,7 @@ import { migrateAgentStorage } from "./migrate-storage";
 import { readRecords, readTeams, STORAGE_KEY, TEAMS_KEY } from "./store";
 import { memoryStorage } from "./test-fakes";
 
-it("moves settings and teams byte for byte, then restarts without resurrecting old data", () => {
+it("moves settings and teams byte for byte, then restarts without resurrecting old data", async () => {
   const storage = memoryStorage();
   const pubkey = "a".repeat(64);
   const record = { pubkey, attention: {}, config: { draft: "kept" } };
@@ -17,7 +17,7 @@ it("moves settings and teams byte for byte, then restarts without resurrecting o
   const teams = JSON.stringify({ version: 1, teams: [team] });
   storage.setItem("buzz.agents2.v1", records);
   storage.setItem("buzz.agents2.teams.v1", teams);
-  migrateAgentStorage(storage);
+  await migrateAgentStorage(storage);
   expect(storage.getItem(STORAGE_KEY)).toBe(records);
   expect(storage.getItem(TEAMS_KEY)).toBe(teams);
   expect(readRecords(storage)[pubkey]).toMatchObject(record);
@@ -25,17 +25,20 @@ it("moves settings and teams byte for byte, then restarts without resurrecting o
   expect(storage.getItem("buzz.agents2.v1")).toBeNull();
   expect(storage.getItem("buzz.agents2.teams.v1")).toBeNull();
   storage.setItem(STORAGE_KEY, "{}");
-  migrateAgentStorage(storage);
+  await migrateAgentStorage(storage);
   expect(storage.getItem(STORAGE_KEY)).toBe("{}");
 });
 
-it("preserves the source on write failure and resumes an interrupted copy", () => {
+it("preserves the source on write failure and resumes an interrupted copy", async () => {
   const error = vi.spyOn(console, "error").mockImplementation(() => {});
   const storage = memoryStorage();
   storage.setItem("buzz.agents2.v1", "exact bytes");
-  migrateAgentStorage({
+  await migrateAgentStorage({
     ...storage,
-    setItem: () => {
+    keys: storage.keys,
+    get: storage.get,
+    add: storage.add,
+    set: async () => {
       throw new Error("full");
     },
   });
@@ -47,18 +50,18 @@ it("preserves the source on write failure and resumes an interrupted copy", () =
   expect(storage.getItem(STORAGE_KEY)).toBeNull();
   error.mockRestore();
   storage.setItem(STORAGE_KEY, "exact bytes");
-  migrateAgentStorage(storage);
+  await migrateAgentStorage(storage);
   expect(storage.getItem("buzz.agents2.v1")).toBeNull();
   expect(storage.getItem(STORAGE_KEY)).toBe("exact bytes");
 });
 
-it("refuses to overwrite conflicting settings without stopping startup", () => {
+it("refuses to overwrite conflicting settings without stopping startup", async () => {
   const error = vi.spyOn(console, "error").mockImplementation(() => {});
   const storage = memoryStorage();
   storage.setItem("buzz.agents2.v1", "old");
   storage.setItem(STORAGE_KEY, "new");
   storage.setItem("buzz.agents2.teams.v1", "teams");
-  migrateAgentStorage(storage);
+  await migrateAgentStorage(storage);
   expect(error).toHaveBeenCalledWith(
     expect.stringContaining("already contains different data"),
   );
diff --git a/src/features/agents/migrate-storage.ts b/src/features/agents/migrate-storage.ts
index 056a1c7ccf..c4586fc461 100644
--- a/src/features/agents/migrate-storage.ts
+++ b/src/features/agents/migrate-storage.ts
@@ -1,15 +1,19 @@
 // TEMPORARY agents rename: remove this module and its startup call after
 // 2026-10-18, once the development users have upgraded. No runtime aliases.
+import type { AgentStore } from "./store";
 import { STORAGE_KEY, TEAMS_KEY } from "./store";
 
-export function migrateAgentStorage(storage: Storage) {
+/** Copies each old key into memory at once, so reads that follow see it;
+ * the promise settles once the copies are saved and their sources removed. */
+export function migrateAgentStorage(storage: AgentStore) {
+  const moves: Promise<void>[] = [];
   for (const [oldKey, key] of [
     ["buzz.agents2.v1", STORAGE_KEY],
     ["buzz.agents2.teams.v1", TEAMS_KEY],
   ] as const) {
-    const old = storage.getItem(oldKey);
+    const old = storage.get(oldKey);
     if (old === null) continue;
-    const current = storage.getItem(key);
+    const current = storage.get(key);
     // An interrupted copy can resume; conflicting data needs recovery, never
     // an implicit overwrite or merge of independently edited settings. Either
     // failure leaves the source for a later launch and must not stop startup:
@@ -20,11 +24,14 @@ export function migrateAgentStorage(storage: Storage) {
       );
       continue;
     }
-    try {
-      if (current === null) storage.setItem(key, old);
-      storage.removeItem(oldKey);
-    } catch (error) {
-      console.error(`Cannot migrate ${oldKey}`, error);
-    }
+    const copy = current === null ? storage.set(key, old) : Promise.resolve();
+    moves.push(
+      copy
+        // The source goes once the copy is saved; until then it is the only
+        // one.
+        .then(() => storage.set(oldKey, null))
+        .catch((error) => console.error(`Cannot migrate ${oldKey}`, error)),
+    );
   }
+  return Promise.all(moves).then(() => {});
 }
diff --git a/src/features/agents/runner.ts b/src/features/agents/runner.ts
index 13e30a869c..36118cc162 100644
--- a/src/features/agents/runner.ts
+++ b/src/features/agents/runner.ts
@@ -36,7 +36,6 @@ import {
   type TimerWatch,
 } from "./attention";
 import {
-  AttentionError,
   checkedWrite,
   interestIds,
   show,
@@ -55,7 +54,7 @@ import {
 } from "./classifier";
 import type { EventWatch } from "./attention";
 import type { AgentEventTemplate, AgentIdentity, AgentsNative } from "./native";
-import type { AgentRecord } from "./store";
+import type { AgentRecord, TimerProgress } from "./store";
 import { Runs, type Start } from "./agent-start";
 import { type Pulses, pulseTyping } from "./typing";
 import {
@@ -296,12 +295,6 @@ type Pass = {
   failedAt?: number;
 };
 
-const EMPTY = Object.freeze({});
-const blank = (pubkey: string): AgentRecord => ({
-  pubkey,
-  attention: EMPTY,
-  config: undefined,
-});
 const seconds = () => Math.floor(Date.now() / 1000);
 const message = (error: unknown) =>
   String(error instanceof Error ? error.message : error);
@@ -333,8 +326,21 @@ export type RunnerHost = {
   saved(pubkey: string): AgentRecord | undefined;
   /** Its record as its attention handle reads it; throws once it is gone. */
   record(pubkey: string): AgentRecord;
-  /** Saves one record; throws when storage refuses it. */
-  write(record: AgentRecord): void;
+  /** Changes its record after the changes sent before it, from the newest
+   * saved record; settles with the saved record once it is saved, and
+   * rejects when `apply` throws or the save fails. */
+  change(
+    pubkey: string,
+    apply: (record: AgentRecord) => AgentRecord | Promise<AgentRecord>,
+  ): Promise<AgentRecord>;
+  /** Whether a change other than timer progress is waiting or saving. Its
+   * timers wait for it, since it may rearm, restart or remove one. */
+  changing(pubkey: string): boolean;
+  /** Its timers' run state, with progress still being saved. */
+  timers(pubkey: string): Readonly<Record<string, TimerState>>;
+  /** Saves a timer pass's progress. Its timers see it at once, and it stays
+   * in memory even if the save fails, so a timer does not run again at once. */
+  progress(pubkey: string, progress: TimerProgress): void;
   /** The team sections of its prompt; empty without a team. */
   team(pubkey: string): string;
   /** What its next run starts with, from this device's storage only. */
@@ -460,10 +466,15 @@ export class AgentRunners {
   }
   /** Wakes each runner, which starts any timer that is due. */
   tick() {
-    for (const runner of this.runners.values()) {
-      this.admit(runner);
-      void this.drain(runner);
-    }
+    for (const pubkey of this.runners.keys()) this.wake(pubkey);
+  }
+  /** Wakes the agent's runner, as when the changes its timers wait for are
+   * saved: one due meanwhile starts now, not at the next tick. */
+  wake(pubkey: string) {
+    const runner = this.runners.get(pubkey);
+    if (!runner) return;
+    this.admit(runner);
+    void this.drain(runner);
   }
   /** Whether this copy runs the agent: its type can run it, and no other
    * copy of the app holds it. */
@@ -1557,10 +1568,12 @@ export class AgentRunners {
   ): Job | undefined {
     // Off, timers keep their saved state; one overdue runs once when back on.
     if (!agent.attentionEnabled) return undefined;
+    // A pending change may rearm, restart or remove a timer: a later tick
+    // runs from the record it saves.
+    if (this.host.changing(agent.pubkey)) return undefined;
     const now = seconds();
-    const record = this.host.saved(agent.pubkey) ?? blank(agent.pubkey);
-    const prior = record.timers ?? EMPTY;
-    let timers = prior;
+    const timers = this.host.timers(agent.pubkey);
+    let changed: TimerProgress = {};
     let next:
       | {
           slug: string;
@@ -1572,9 +1585,10 @@ export class AgentRunners {
     for (const object of Object.values(agent.attention)) {
       const timer = object.value;
       if (timer.type !== "timer" || !timer.enabled) continue;
-      const saved = agent.timers[object.slug];
+      const saved = timers[object.slug];
       const state = timerState(timer, saved, now);
-      if (state !== saved) timers = { ...timers, [object.slug]: state };
+      if (state !== saved)
+        changed = { ...changed, [object.slug]: { seen: saved, next: state } };
       if (now < state.nextDue || timerSpent(timer, state, now)) continue;
       // Its Interest's lane is busy: it goes once that lane is free.
       if (!idle(timer.interest_id)) continue;
@@ -1586,15 +1600,12 @@ export class AgentRunners {
       used: next.state.used + 1,
       nextDue: now + next.timer.interval_secs,
     };
-    if (next && ran) timers = { ...timers, [next.slug]: ran };
-    if (timers !== prior)
-      try {
-        this.host.write({ ...record, timers });
-      } catch (error) {
-        // Unsaved, it would run again at once; it waits for storage instead.
-        console.warn(`Agent ${agent.name} timer state was not saved`, error);
-        return undefined;
-      }
+    if (next && ran)
+      changed = {
+        ...changed,
+        [next.slug]: { seen: timers[next.slug], next: ran },
+      };
+    if (Object.keys(changed).length) this.host.progress(agent.pubkey, changed);
     if (!next || !ran) return undefined;
     const { slug, timer, object } = next;
     const interest = agent.attention[`interest/${timer.interest_id}`]?.value;
@@ -2040,27 +2051,12 @@ export class AgentRunners {
         value: AttentionValue | null,
         options: WriteOptions,
       ) => {
-        // The token is checked against the record as it is when the write
-        // lands: a write that raced this one makes it check again, a few times.
-        for (let attempt = 0; ; attempt++) {
-          const before = record();
-          const after = await checkedWrite(
-            before,
-            slug,
-            value,
-            options,
-            seconds(),
-          );
-          if (record() !== before) {
-            if (attempt < 3) continue;
-            throw new AttentionError(
-              "conflict",
-              `${slug} is changing; show it again`,
-            );
-          }
-          this.host.write(after);
-          return show(after, slug, seconds());
-        }
+        // The token is checked against the newest saved record, in turn
+        // with the other changes to it, so no change lands between.
+        const after = await this.host.change(pubkey, (before) =>
+          checkedWrite(before, slug, value, options, seconds()),
+        );
+        return show(after, slug, seconds());
       },
     });
   }
diff --git a/src/features/agents/service.test.ts b/src/features/agents/service.test.ts
index 8304afce1b..aeda6ddc78 100644
--- a/src/features/agents/service.test.ts
+++ b/src/features/agents/service.test.ts
@@ -25,7 +25,8 @@ import {
   teamPrompt,
 } from "./service";
 import type { ClassifierNative } from "./classifier";
-import { CATCH_UP_KEY, readCheckpoints } from "./catch-up";
+import { CATCH_UP_PREFIX, readCheckpoints } from "./catch-up";
+import { fileStore, type AgentStore } from "./state";
 import { memoryStorage } from "./test-fakes";
 import { STANDALONE_DEADLINE_MS } from "../agent-harness/standalone";
 import { readTeams, writeTeams } from "./store";
@@ -75,7 +76,7 @@ const UNFINISHED =
 
 type Config = { reply: string };
 async function setup({
-  storage = memoryStorage(),
+  storage = memoryStorage() as AgentStore,
   identities = [] as AgentIdentity[],
   listed = [] as RelayEvent[],
   history = [] as RelayEvent[],
@@ -457,10 +458,10 @@ it("imports a team with the members that came, names the rest, and leaves later
   expect(result.teamError).toBeUndefined();
   // Imported on its own afterwards, it never joins the team.
   native.port.mockImplementation(port);
-  const stored = storage.getItem("buzz.agents.teams.v1");
+  const stored = storage.get("buzz.agents.teams.v1");
   await importOld(service, birch);
   expect(service.find(birch)).toBeDefined();
-  expect(storage.getItem("buzz.agents.teams.v1")).toBe(stored);
+  expect(storage.get("buzz.agents.teams.v1")).toBe(stored);
   expect(service.snapshot().teams).toEqual([savedShift([alder, carrow])]);
 });
 
@@ -852,7 +853,7 @@ it("keeps a team's imported members when the team cannot be saved, and changes n
   expect(result.team).toBeUndefined();
   expect(service.find(carrow)).toBeDefined();
   expect(storage.getItem("buzz.agents.teams.v1")).toBe(stored);
-  expect(service.snapshot().teams).toBe(teams);
+  expect(service.snapshot().teams).toEqual(teams);
 });
 
 it("delivers mentions and matching watches once, and never the agent's own events", async () => {
@@ -928,7 +929,7 @@ it("gives each member its teams' roster and instructions, and drops a deleted ag
       [],
     ]),
   );
-  expect(storage.getItem("buzz.agents.teams.v1")).not.toContain(sibling);
+  expect(storage.get("buzz.agents.teams.v1")).not.toContain(sibling);
   await service.removeTeam(team.id);
   expect(service.snapshot().teams.map((saved) => saved.name)).toEqual(["Solo"]);
 });
@@ -1900,9 +1901,9 @@ it("changes an agent's type between turns, carrying what the new type adopts", a
   expect(native.setType).not.toHaveBeenCalled();
   finish();
   await settle();
-  vi.spyOn(storage, "setItem").mockImplementationOnce(() => {
-    throw new Error("QuotaExceededError");
-  });
+  vi.spyOn(storage, "set").mockRejectedValueOnce(
+    new Error("QuotaExceededError"),
+  );
   await expect(
     service.retype(bot, "other/relay", {
       config: { prompt: "Reviewed target", model: "large" },
@@ -2245,7 +2246,7 @@ it("shows an agent whose settings could not be saved with its type's defaults",
   const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
   await service.create({ type: "example/echo", name: "Echo" });
   warn.mockRestore();
-  expect(storage.getItem("buzz.agents.v1") ?? "").not.toContain(bot);
+  expect(storage.getItem(`buzz.agent.v1:${bot}`)).toBeNull();
   expect(service.find(bot)).toMatchObject({ config: { reply: "ok" } });
   expect(Object.keys(service.find(bot)?.attention ?? {})).toEqual([
     "interest/default",
@@ -2253,7 +2254,354 @@ it("shows an agent whose settings could not be saved with its type's defaults",
   ]);
   // The next save stores them.
   await service.save(bot, { config: { reply: "saved" } });
-  expect(storage.getItem("buzz.agents.v1")).toContain(bot);
+  expect(storage.getItem(`buzz.agent.v1:${bot}`)).toContain(bot);
+});
+
+it("rejects a save that agent storage could not write, and saves it on retry", async () => {
+  const disk = new Map<string, string>();
+  let failing = false;
+  const storage = fileStore(new Map(), async (key, value) => {
+    if (failing) throw new Error("disk full");
+    if (value === null) disk.delete(key);
+    else disk.set(key, value);
+  });
+  const { service } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  failing = true;
+  // Every config the owner sees. A form resets its draft when the shown
+  // config changes, so a change it never saved must not be shown at all.
+  const shown: unknown[] = [];
+  const stop = service.subscribe(() => shown.push(service.find(bot)?.config));
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  await expect(
+    service.save(bot, { config: { reply: "unsaved" } }),
+  ).rejects.toThrow("disk full");
+  error.mockRestore();
+  stop();
+  expect(shown).not.toContainEqual({ reply: "unsaved" });
+  expect(disk.get(`buzz.agent.v1:${bot}`)).not.toContain("unsaved");
+  // The agent shows what is saved, so a settings form's draft differs from it
+  // and its Save stays enabled.
+  expect(service.find(bot)?.config).toEqual({ reply: "ok" });
+  failing = false;
+  await service.save(bot, { config: { reply: "unsaved" } });
+  expect(disk.get(`buzz.agent.v1:${bot}`)).toContain("unsaved");
+  expect(service.find(bot)?.config).toEqual({ reply: "unsaved" });
+});
+
+const tick = {
+  "watch/tick": {
+    type: "timer",
+    interest_id: "default",
+    prompt: "check in",
+    enabled: true,
+    interval_secs: 60,
+    armed_at: 1_000,
+    max_occurrences: 10,
+    expires_at: null,
+  },
+} as const;
+
+it("keeps a settings change still being saved when a timer saves its progress", async () => {
+  vi.useFakeTimers({ now: 1_000_000 });
+  const disk = new Map<string, string>();
+  let hold: Promise<void> | undefined;
+  const storage = fileStore(new Map(), async (key, value) => {
+    await hold;
+    if (value === null) disk.delete(key);
+    else disk.set(key, value);
+  });
+  const { service, run } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  await service.save(bot, { attention: tick });
+  let release = () => {};
+  hold = new Promise((resolve) => (release = resolve));
+  const saving = service.save(bot, { config: { reply: "edited" } });
+  // The timer comes due while the edit is still being saved: it waits.
+  await vi.advanceTimersByTimeAsync(60_000);
+  expect(run).not.toHaveBeenCalled();
+  // A form still compares its draft against the saved settings.
+  expect(service.find(bot)?.config).toEqual({ reply: "ok" });
+  release();
+  await saving;
+  expect(service.find(bot)?.config).toEqual({ reply: "edited" });
+  await vi.advanceTimersByTimeAsync(5_000);
+  expect(run).toHaveBeenCalledTimes(1);
+  const saved = JSON.parse(disk.get(`buzz.agent.v1:${bot}`) ?? "{}");
+  expect(saved.config).toEqual({ reply: "edited" });
+  expect(saved.timers["watch/tick"]).toMatchObject({ used: 1 });
+});
+
+it("starts a timer due while a change was saving as soon as it is saved", async () => {
+  vi.useFakeTimers({ now: 1_000_000 });
+  let hold: Promise<void> | undefined;
+  const storage = fileStore(new Map(), async () => {
+    await hold;
+  });
+  const { service, run } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  await service.save(bot, {
+    attention: {
+      "watch/b": {
+        type: "timer",
+        interest_id: "default",
+        prompt: "b",
+        enabled: true,
+        interval_secs: 60,
+        armed_at: 1_001,
+        max_occurrences: 1,
+        expires_at: 1_063,
+      },
+    },
+  });
+  await vi.advanceTimersByTimeAsync(59_000);
+  let release = () => {};
+  hold = new Promise((resolve) => (release = resolve));
+  // Due at 1061 while the edit saves; it expires before the 1065 tick.
+  const saving = service.save(bot, { config: { reply: "edited" } });
+  await vi.advanceTimersByTimeAsync(3_000);
+  expect(run).not.toHaveBeenCalled();
+  release();
+  await saving;
+  await vi.advanceTimersByTimeAsync(100);
+  expect(run).toHaveBeenCalledTimes(1);
+});
+
+it("starts a due timer in a free Interest while another timer's progress saves", async () => {
+  vi.useFakeTimers({ now: 1_000_000 });
+  let hold: Promise<void> | undefined;
+  const storage = fileStore(new Map(), async () => {
+    await hold;
+  });
+  const { service, run } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  const timer = (interest: string, prompt: string, expires: number | null) =>
+    ({
+      type: "timer",
+      interest_id: interest,
+      prompt,
+      enabled: true,
+      interval_secs: 60,
+      armed_at: 1_000,
+      max_occurrences: 1,
+      expires_at: expires,
+    }) as const;
+  await service.save(bot, {
+    attention: {
+      "interest/other": { type: "interest", instructions: "Other." },
+      "watch/a": timer("default", "a", null),
+      "watch/b": timer("other", "b", 1_061),
+    },
+  });
+  // A's run stays active, and its progress is still saving.
+  run.mockImplementation(() => new Promise<void>(() => {}));
+  hold = new Promise(() => {});
+  await vi.advanceTimersByTimeAsync(60_000);
+  const slugs = run.mock.calls.map(([{ trigger }]) =>
+    trigger.type === "timer" ? trigger.slug : trigger.type,
+  );
+  expect(slugs.sort()).toEqual(["watch/a", "watch/b"]);
+});
+
+it("keeps a timer rearm still being saved when another timer saves its progress", async () => {
+  vi.useFakeTimers({ now: 1_000_000 });
+  const disk = new Map<string, string>();
+  let hold: Promise<void> | undefined;
+  const storage = fileStore(new Map(), async (key, value) => {
+    await hold;
+    if (value === null) disk.delete(key);
+    else disk.set(key, value);
+  });
+  const { service, run } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  const timer = (prompt: string, interval: number, armed: number) =>
+    ({
+      type: "timer",
+      interest_id: "default",
+      prompt,
+      enabled: true,
+      interval_secs: interval,
+      armed_at: armed,
+      max_occurrences: 10,
+      expires_at: null,
+    }) as const;
+  await service.save(bot, {
+    attention: {
+      "watch/a": timer("a", 60, 1_000),
+      "watch/b": timer("b", 90, 1_000),
+    },
+  });
+  // A runs once at 1060.
+  await vi.advanceTimersByTimeAsync(60_000);
+  expect(run).toHaveBeenCalledTimes(1);
+  let release = () => {};
+  hold = new Promise((resolve) => (release = resolve));
+  // A is rearmed, keeping its used count, while B comes due at 1090.
+  const saving = service.save(bot, {
+    attention: { "watch/a": timer("a", 60, 1_070) },
+  });
+  await vi.advanceTimersByTimeAsync(30_000);
+  expect(run).toHaveBeenCalledTimes(1);
+  release();
+  await saving;
+  await vi.advanceTimersByTimeAsync(5_000);
+  expect(run).toHaveBeenCalledTimes(2);
+  const saved = JSON.parse(disk.get(`buzz.agent.v1:${bot}`) ?? "{}");
+  expect(saved.timers["watch/a"]).toEqual({
+    armedAt: 1_070,
+    nextDue: 1_130,
+    used: 1,
+  });
+  expect(saved.timers["watch/b"]).toMatchObject({ armedAt: 1_000, used: 1 });
+  expect(service.find(bot)?.timers["watch/a"]).toEqual(saved.timers["watch/a"]);
+});
+
+it("runs no occurrence of a timer while its rearm is being saved, so the rearm keeps its budget", async () => {
+  vi.useFakeTimers({ now: 1_000_000 });
+  let hold: Promise<void> | undefined;
+  const storage = fileStore(new Map(), async () => {
+    await hold;
+  });
+  const { service, run } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  const timer = (armed: number) =>
+    ({
+      type: "timer",
+      interest_id: "default",
+      prompt: "a",
+      enabled: true,
+      interval_secs: 60,
+      armed_at: armed,
+      max_occurrences: 2,
+      expires_at: null,
+    }) as const;
+  await service.save(bot, { attention: { "watch/a": timer(1_000) } });
+  // It runs once at 1060; the next would be due at 1120.
+  await vi.advanceTimersByTimeAsync(60_000);
+  expect(run).toHaveBeenCalledTimes(1);
+  await vi.advanceTimersByTimeAsync(55_000);
+  let release = () => {};
+  hold = new Promise((resolve) => (release = resolve));
+  // Rearmed at 1115, which keeps its used count; still saving past 1120.
+  const saving = service.save(bot, { attention: { "watch/a": timer(1_115) } });
+  await vi.advanceTimersByTimeAsync(15_000);
+  expect(run).toHaveBeenCalledTimes(1);
+  release();
+  await saving;
+  expect(service.find(bot)?.timers["watch/a"]).toEqual({
+    armedAt: 1_115,
+    nextDue: 1_175,
+    used: 1,
+  });
+  // Its second and last occurrence comes from the rearm, and no third.
+  await vi.advanceTimersByTimeAsync(600_000);
+  expect(run).toHaveBeenCalledTimes(2);
+  expect(
+    JSON.parse(storage.get(`buzz.agent.v1:${bot}`) ?? "{}").timers["watch/a"],
+  ).toMatchObject({ armedAt: 1_115, used: 2 });
+});
+
+it("keeps the occurrence a timer used while its progress saves, when the owner rearms it", async () => {
+  vi.useFakeTimers({ now: 1_000_000 });
+  const disk = new Map<string, string>();
+  let hold: Promise<void> | undefined;
+  const storage = fileStore(new Map(), async (key, value) => {
+    await hold;
+    if (value === null) disk.delete(key);
+    else disk.set(key, value);
+  });
+  const { service, run } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  const timer = (armed: number) =>
+    ({
+      type: "timer",
+      interest_id: "default",
+      prompt: "a",
+      enabled: true,
+      interval_secs: 60,
+      armed_at: armed,
+      max_occurrences: 2,
+      expires_at: null,
+    }) as const;
+  await service.save(bot, { attention: { "watch/a": timer(1_000) } });
+  // It runs once at 1060.
+  await vi.advanceTimersByTimeAsync(60_000);
+  expect(run).toHaveBeenCalledTimes(1);
+  let release = () => {};
+  hold = new Promise((resolve) => (release = resolve));
+  // Its second and last occurrence runs at 1120; that progress is saving
+  // when the owner rearms it at 1121.
+  await vi.advanceTimersByTimeAsync(60_000);
+  expect(run).toHaveBeenCalledTimes(2);
+  await vi.advanceTimersByTimeAsync(1_000);
+  const saving = service.save(bot, { attention: { "watch/a": timer(1_121) } });
+  release();
+  await saving;
+  // The rearm applies after the progress: a new deadline, the used count kept.
+  const saved = JSON.parse(disk.get(`buzz.agent.v1:${bot}`) ?? "{}");
+  expect(saved.timers["watch/a"]).toEqual({
+    armedAt: 1_121,
+    nextDue: 1_181,
+    used: 2,
+  });
+  expect(service.find(bot)?.timers["watch/a"]).toEqual(saved.timers["watch/a"]);
+  // Its budget is spent: no third occurrence.
+  await vi.advanceTimersByTimeAsync(600_000);
+  expect(run).toHaveBeenCalledTimes(2);
+});
+
+it("runs a timer whose progress storage refuses only when due, and saves its count once it can", async () => {
+  vi.useFakeTimers({ now: 1_000_000 });
+  const storage = memoryStorage();
+  const { service, run } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  await service.save(bot, { attention: tick });
+  const setItem = storage.setItem.bind(storage);
+  let refusing = true;
+  vi.spyOn(storage, "setItem").mockImplementation((key, value) => {
+    if (refusing && key === `buzz.agent.v1:${bot}`)
+      throw new Error("QuotaExceededError");
+    setItem(key, value);
+  });
+  const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+  // Due at 1060, 1120 and 1180. Its unsaved progress stays in memory, so it
+  // runs once each time it is due, never again at once after a run.
+  await vi.advanceTimersByTimeAsync(180_000);
+  expect(run).toHaveBeenCalledTimes(3);
+  expect(warn).toHaveBeenCalledWith(
+    `Agent ${bot} timer state was not saved`,
+    expect.objectContaining({ message: "QuotaExceededError" }),
+  );
+  refusing = false;
+  await vi.advanceTimersByTimeAsync(60_000);
+  warn.mockRestore();
+  expect(run).toHaveBeenCalledTimes(4);
+  const saved = JSON.parse(storage.getItem(`buzz.agent.v1:${bot}`) ?? "{}");
+  expect(saved.timers["watch/tick"]).toMatchObject({ used: 4 });
+});
+
+it("shows the saved teams after a team save agent storage could not write", async () => {
+  let failing = false;
+  const storage = fileStore(new Map(), async () => {
+    if (failing) throw new Error("disk full");
+  });
+  const { service } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.saveTeam({ name: "Crew", instructions: "", members: [bot] });
+  failing = true;
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  await expect(
+    service.saveTeam({ name: "Solo", instructions: "", members: [bot] }),
+  ).rejects.toThrow("disk full");
+  error.mockRestore();
+  expect(service.snapshot().teams.map((team) => team.name)).toEqual(["Crew"]);
 });
 
 it("saves nothing when native create fails", async () => {
@@ -2295,7 +2643,7 @@ it("creates an agent with the config it was given, not its type's defaults, and
     "interest/default",
     "watch/channel",
   ]);
-  expect(storage.getItem("buzz.agents.v1")).toContain("chosen");
+  expect(storage.getItem(`buzz.agent.v1:${bot}`)).toContain("chosen");
 });
 
 it("keeps a new agent whose picture could not be set", async () => {
@@ -2382,7 +2730,83 @@ it("forgets records whose key is gone when identities load", async () => {
   expect(service.snapshot().agents.map((agent) => agent.name)).toEqual([
     "Echo",
   ]);
-  expect(storage.getItem("buzz.agents.v1")).not.toContain(sibling);
+  expect(storage.getItem("buzz.agents.v1")).toBeNull();
+  expect(storage.getItem(`buzz.agent.v1:${sibling}`)).toBeNull();
+  expect(storage.getItem(`buzz.agent.v1:${bot}`)).toContain(bot);
+});
+
+it("starts with the old shared records when a full store refuses their move", async () => {
+  const storage = memoryStorage();
+  const shared = JSON.stringify({
+    version: 1,
+    agents: { [bot]: { pubkey: bot, attention: {}, config: {} } },
+  });
+  storage.setItem("buzz.agents.v1", shared);
+  const setItem = storage.setItem;
+  storage.setItem = (key, value) => {
+    if (key.startsWith("buzz.agent.v1:"))
+      throw new DOMException(
+        "The quota has been exceeded.",
+        "QuotaExceededError",
+      );
+    setItem(key, value);
+  };
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  const { service } = await setup({
+    storage,
+    identities: [
+      {
+        pubkey: bot,
+        relay: "wss://relay.example.test",
+        owner: viewer,
+        type: "example/echo",
+        name: "Echo",
+        deleted: false,
+      },
+    ],
+  });
+  expect(error).toHaveBeenCalledWith(
+    "Agent records were not split",
+    expect.any(DOMException),
+  );
+  error.mockRestore();
+  expect(service.snapshot().agents.map((agent) => agent.name)).toEqual([
+    "Echo",
+  ]);
+  // The only saved copy stays for the next start to move.
+  expect(storage.getItem("buzz.agents.v1")).toBe(shared);
+});
+
+it("saving one agent leaves another program's changes to other agents", async () => {
+  const storage = memoryStorage();
+  for (const pubkey of [bot, sibling])
+    storage.setItem(
+      `buzz.agent.v1:${pubkey}`,
+      JSON.stringify({ pubkey, attention: {}, config: { reply: "start" } }),
+    );
+  const identity = (pubkey: string, name: string): AgentIdentity => ({
+    pubkey,
+    relay: "wss://relay.example.test",
+    owner: viewer,
+    type: "example/echo",
+    name,
+    deleted: false,
+  });
+  const { service } = await setup({
+    storage,
+    identities: [identity(bot, "Echo"), identity(sibling, "Other")],
+  });
+  await vi.waitFor(() => expect(service.find(sibling)).toBeDefined());
+  // The standalone host runs the sibling and saves its progress.
+  const hosted = JSON.stringify({
+    pubkey: sibling,
+    attention: {},
+    config: { reply: "from the host" },
+  });
+  storage.setItem(`buzz.agent.v1:${sibling}`, hosted);
+  await service.save(bot, { config: { reply: "edited" } });
+  expect(storage.getItem(`buzz.agent.v1:${bot}`)).toContain("edited");
+  expect(storage.getItem(`buzz.agent.v1:${sibling}`)).toBe(hosted);
 });
 
 it("keeps an agent created while identities are still loading", async () => {
@@ -2415,7 +2839,7 @@ it("keeps an agent created while identities are still loading", async () => {
   release([]);
   await vi.waitFor(() => expect(service.snapshot().status).toBe("ready"));
   expect(service.find(bot)?.name).toBe("Echo");
-  expect(storage.getItem("buzz.agents.v1")).toContain(bot);
+  expect(storage.getItem(`buzz.agent.v1:${bot}`)).toContain(bot);
 });
 
 it("reads the list again on refresh and clears the error a failed read left", async () => {
@@ -2519,8 +2943,7 @@ it("fires a due timer once, then again an interval after it ran", async () => {
   await vi.advanceTimersByTimeAsync(120_000);
   expect(run).toHaveBeenCalledTimes(2);
   // Its run state lives in the agent's record and goes when the timer does.
-  const stored = () =>
-    JSON.parse(storage.getItem("buzz.agents.v1") ?? "{}").agents[bot];
+  const stored = () => JSON.parse(storage.get(`buzz.agent.v1:${bot}`) ?? "{}");
   expect(stored().timers["watch/tick"]).toMatchObject({ used: 2 });
   expect(stored().timers["watch/stale"]).toMatchObject({ used: 16 });
   await service.save(bot, { attention: { "watch/tick": null } });
@@ -2744,7 +3167,7 @@ it("stops it first, and deletes its key only after it left its channels and was
     "forget",
   ]);
   expect(service.snapshot().agents).toEqual([]);
-  expect(storage.getItem("buzz.agents.v1")).not.toContain(bot);
+  expect(storage.get(`buzz.agent.v1:${bot}`)).toBeNull();
   expect(leaveChannels).toHaveBeenCalledWith(
     expect.objectContaining({ archives }),
     bot,
@@ -4010,7 +4433,11 @@ it("wakes nothing for what came before a watch was first caught up, as after an
     await settle();
     first.connect(false);
     // As a build from before catch-up leaves it: the watch, and no progress.
-    storage.removeItem(CATCH_UP_KEY);
+    const progress = Array.from({ length: storage.length }, (_, index) =>
+      storage.key(index),
+    ).filter((key) => key?.startsWith(CATCH_UP_PREFIX));
+    expect(progress).not.toHaveLength(0);
+    for (const key of progress) storage.removeItem(key as string);
     vi.setSystemTime((start + 60) * 1000);
     const second = await setup({
       storage,
@@ -4398,14 +4825,7 @@ it("waits for a confirmed roster before catching up, saving no progress past wha
     const reads = catchUpReads(session).length;
     expect(reads).toBe(20);
     expect(run).not.toHaveBeenCalled();
-    const saved = () =>
-      Object.values(
-        (
-          JSON.parse(storage.getItem(CATCH_UP_KEY) ?? "{}") as {
-            streams?: Record<string, { after?: unknown }>;
-          }
-        ).streams ?? {},
-      );
+    const saved = () => Object.values(readCheckpoints(storage));
     expect(saved().some((checkpoint) => checkpoint.after)).toBe(false);
     confirm("saved", [viewer, bot]);
     await vi.advanceTimersByTimeAsync(10 * 60_000);
@@ -4490,9 +4910,10 @@ it("wakes nothing from the time its watch was off, also when it is turned on aft
     await settle();
     first.connect(false);
     // Turned on again elsewhere while this copy was closed.
-    const saved = storage.getItem("buzz.agents.v1") ?? "";
+    const saved = storage.getItem(`buzz.agent.v1:${bot}`) ?? "";
+    expect(saved).toContain('"enabled":false');
     storage.setItem(
-      "buzz.agents.v1",
+      `buzz.agent.v1:${bot}`,
       saved.replace('"enabled":false', '"enabled":true'),
     );
     vi.setSystemTime((start + 60) * 1000);
@@ -4955,7 +5376,7 @@ it("creates a hosted agent through its provider, attesting the key it returns",
   expect(agent.unfinished).toBeUndefined();
   expect(native.create).not.toHaveBeenCalled();
   expect(native.claim).not.toHaveBeenCalledWith(hostedKey);
-  expect(storage.getItem("buzz.agents.unfinished.v1")).toContain('"agents":[]');
+  expect(storage.get("buzz.agents.unfinished.v1")).toContain('"agents":[]');
 });
 
 it("keeps a hosted agent whose setup failed, and finishes it without making another", async () => {
@@ -5232,6 +5653,29 @@ it("refuses to stop a hosted agent whose provider cannot", async () => {
   ).rejects.toThrow("This agent can't be stopped here");
 });
 
+it("keeps an unfinished hosted agent whose Delete agent storage could not save", async () => {
+  let failing = false;
+  const storage = fileStore(new Map(), async (key) => {
+    if (failing && key === "buzz.agents.unfinished.v1")
+      throw new Error("disk full");
+  });
+  const { service, plugin } = await setup({ storage });
+  const { type, remote } = cloud();
+  plugin.agents.register(type);
+  remote.activate.mockRejectedValueOnce(new Error("provider down"));
+  await expect(
+    service.create({ type: "example/cloud", name: "Sky" }),
+  ).rejects.toThrow();
+  failing = true;
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  await expect(service.remove(hostedKey)).rejects.toThrow("disk full");
+  error.mockRestore();
+  // Still listed with what is saved, so a restart shows no other state and
+  // Delete can be tried again.
+  expect(service.find(hostedKey)?.unfinished).toBe(true);
+  expect(storage.get("buzz.agents.unfinished.v1")).toContain(hostedKey);
+});
+
 it("refuses to finish a hosted agent's setup while it is being deleted", async () => {
   const { service, plugin } = await setup();
   const { type, remote } = cloud();
@@ -5799,6 +6243,40 @@ it("lets a run read and write its attention with expected-state tokens", async (
   ).rejects.toThrow(/^conflict:/);
 });
 
+it("fails an agent's attention write that agent storage could not save, and keeps the saved value", async () => {
+  let failing = false;
+  const storage = fileStore(new Map(), async () => {
+    if (failing) throw new Error("disk full");
+  });
+  const { service, run, emit } = await setup({ storage });
+  await service.create({ type: "example/echo", name: "Echo" });
+  await service.save(bot, { attentionEnabled: true });
+  const { attention } = await handleOf(run, emit);
+  const shown = await attention.show("interest/default");
+  failing = true;
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  await expect(
+    attention.write(
+      "interest/default",
+      { type: "interest", instructions: "Unsaved." },
+      { expected: shown.expected_state },
+    ),
+  ).rejects.toThrow("disk full");
+  error.mockRestore();
+  expect(await attention.show("interest/default")).toEqual(shown);
+  expect(service.find(bot)?.attention["interest/default"]?.value).toEqual({
+    type: "interest",
+    instructions: "Be brief.",
+  });
+  failing = false;
+  const written = await attention.write(
+    "interest/default",
+    { type: "interest", instructions: "Saved." },
+    { expected: shown.expected_state },
+  );
+  expect(written.object).toMatchObject({ instructions: "Saved." });
+});
+
 it("keeps attention off across a reload", async () => {
   const { service, storage, native } = await setup();
   await service.create({ type: "example/echo", name: "Echo" });
@@ -5857,10 +6335,12 @@ it("stops watches and timers while attention is off, keeps every object, and res
   expect(service.find(bot)?.attention).toEqual(before?.attention);
   emit({ events: [deploy("w2")] });
   await vi.advanceTimersByTimeAsync(5_000);
+  // The overdue timer starts once turning attention on is saved, before the
+  // next tick and so before the later event.
   expect(run.mock.calls.map(([{ trigger }]) => trigger.type)).toEqual([
     "mention",
-    "watch",
     "timer",
+    "watch",
   ]);
 });
 
diff --git a/src/features/agents/service.ts b/src/features/agents/service.ts
index b2791836d6..3eb49f9699 100644
--- a/src/features/agents/service.ts
+++ b/src/features/agents/service.ts
@@ -23,6 +23,7 @@ import { ownerReads } from "./reads";
 // can show it: as here, hosted, or on another device.
 import { migrateAgentStorage } from "./migrate-storage";
 import { migrateWatchFilters } from "./migrate-filter";
+import { agentStorage, type AgentStore } from "./state";
 import { Service, type Context } from "@deepseek-ai/cordis";
 import { npubEncode } from "nostr-tools/nip19";
 import { bytesToHex } from "nostr-tools/utils";
@@ -95,20 +96,30 @@ import {
 import {
   readArchiveUnchecked,
   readRecords,
+  recordKey,
   readTeams,
   readUnfinished,
   setAttention,
   writeArchiveUnchecked,
-  writeRecords,
+  removeRecord,
+  splitLegacyRecords,
+  writeRecord,
   writeTeams,
   writeUnfinished,
+  withProgress,
   type AgentRecord,
+  type TimerProgress,
   type SkippedObject,
   type Team,
   type Unfinished,
 } from "./store";
 import { soloChat } from "./solo-chat";
-import { readCheckpoints, writeCheckpoints } from "./catch-up";
+import {
+  readCheckpoints,
+  splitLegacyCheckpoints,
+  writeCheckpoints,
+  type Checkpoints,
+} from "./catch-up";
 import { type AddedTool, BUZZ_SESSION } from "../../buzz-mcp/session-tools";
 import { nameSoloChat } from "./solo-chat-name";
 
@@ -734,6 +745,11 @@ export type Agents = {
     pubkey: string,
     signal?: AbortSignal,
   ): Promise<string | null | undefined>;
+  /** Where agent types keep what they save for an agent, such as its
+   * sessions. Every program that runs this machine's agents shares it, so
+   * keep each agent's state under its own key. A write is saved only once
+   * its promise settles. */
+  readonly storage: AgentStore;
   /** Makes an agent of `type` in the selected community: here, or with a
    * hosted type at its provider. A hosted one whose setup then fails is kept
    * as `unfinished`. */
@@ -828,6 +844,39 @@ const blank = (pubkey: string): AgentRecord => ({
   attention: EMPTY,
   config: undefined,
 });
+/** `record` with the owner's `change` to its settings; throws when the
+ * change is not valid for it. */
+function changed(record: AgentRecord, change: AgentChange): AgentRecord {
+  let next = record;
+  if (change.config !== undefined) next = { ...next, config: change.config };
+  if (change.attentionEnabled !== undefined) {
+    const { attentionEnabled: _, ...rest } = next;
+    next = change.attentionEnabled ? { ...rest, attentionEnabled: true } : rest;
+  }
+  for (const [slug, value] of Object.entries(change.attention ?? {}))
+    next = setAttention(
+      next,
+      slug,
+      value,
+      undefined,
+      change.restart?.includes(slug) ? "restart" : undefined,
+    );
+  // As the spec's writer: an Interest stays while anything still uses it.
+  for (const [slug, value] of Object.entries(change.attention ?? {})) {
+    const id = parseSlug(slug)?.id;
+    if (value !== null || !slug.startsWith("interest/") || !id) continue;
+    if (
+      Object.values(next.attention).some(
+        (object) =>
+          object.value.type !== "interest" && object.value.interest_id === id,
+      )
+    )
+      throw new Error(
+        "Remove or move the watches and timers that use this Interest first",
+      );
+  }
+  return next;
+}
 /** A new agent's settings: its type's defaults. */
 function defaults(pubkey: string, type: RegisteredAgentType) {
   const { config, attention = {} } = type.defaults();
@@ -980,7 +1029,14 @@ export class AgentsService extends Service implements Agents {
   /** Every saved identity, deleted ones included: native's list is the agent
    * list, and `records` only adds settings to it. */
   private identities: readonly AgentIdentity[] = [];
+  /** Each agent's settings as saved, and as the owner and the agent see them. */
   private records: Record<string, AgentRecord>;
+  /** Each agent's last change in its queue, until it settles. */
+  private readonly changes = new Map<string, Promise<void>>();
+  /** How many changes other than timer progress each agent has queued. */
+  private readonly changing = new Map<string, number>();
+  /** Each agent's timer progress that is not saved yet. */
+  private readonly progressing = new Map<string, readonly TimerProgress[]>();
   private teamList: readonly Team[];
   private state: AgentsSnapshot;
   /** By origin, so each agent listens in its own community, selected or not. */
@@ -1038,7 +1094,7 @@ export class AgentsService extends Service implements Agents {
     ctx: Context,
     private readonly communities: AgentCommunities,
     private readonly native: AgentsNative | undefined = nativeAgents(),
-    private readonly storage: Storage = globalThis.localStorage,
+    readonly storage: AgentStore = agentStorage(),
     private readonly authorize: (
       pubkey: string,
       signal: AbortSignal,
@@ -1052,9 +1108,12 @@ export class AgentsService extends Service implements Agents {
     super(ctx, "agents");
     this.contributions = createContributions<AgentType>(ctx);
     this.addedTools = createContributions<AddedTool & { id: string }>(ctx);
-    migrateAgentStorage(storage);
-    migrateWatchFilters(storage);
+    // Each changes the copy at once and logs a failed save itself.
+    void migrateAgentStorage(storage);
+    void migrateWatchFilters(storage);
     this.records = readRecords(storage);
+    void splitLegacyRecords(storage, this.records);
+    void splitLegacyCheckpoints(storage);
     this.unfinished = Object.freeze(readUnfinished(storage));
     this.unarchiving = readArchiveUnchecked(storage);
     this.teamList = Object.freeze(readTeams(storage));
@@ -1070,6 +1129,8 @@ export class AgentsService extends Service implements Agents {
     this.coreMemory = new CoreMemoryCache((pubkey) =>
       ownerReads(this.relay(pubkey), pubkey),
     );
+    /** The catch-up progress this program last read or saved. */
+    let savedProgress: Checkpoints = {};
     this.runners = new AgentRunners({
       ready: (pubkey) => this.ready(pubkey),
       agent: (pubkey) => this.agent(pubkey),
@@ -1078,8 +1139,18 @@ export class AgentsService extends Service implements Agents {
       community: (agent) => this.bindingOf(agent),
       records: () => Object.values(this.records),
       checkpoints: {
-        read: () => readCheckpoints(this.storage),
-        write: (checkpoints) => writeCheckpoints(this.storage, checkpoints),
+        read: () => (savedProgress = readCheckpoints(this.storage)),
+        write: (checkpoints) => {
+          void writeCheckpoints(this.storage, checkpoints, savedProgress).catch(
+            (error) => {
+              console.warn("Agent catch-up progress was not saved", error);
+              // The copy went back to what is saved: the next save compares
+              // with that.
+              savedProgress = readCheckpoints(this.storage);
+            },
+          );
+          savedProgress = checkpoints;
+        },
       },
       scope: (agent) => this.bindingOf(agent)?.scope,
       saved: (pubkey) => this.records[pubkey],
@@ -1088,7 +1159,18 @@ export class AgentsService extends Service implements Agents {
         if (!identity) throw new Error("No such agent on this device");
         return this.recordOf(identity);
       },
-      write: (record) => this.write(record),
+      change: async (pubkey, apply) => {
+        const record = await this.change(pubkey, (saved) => {
+          const identity = this.live(pubkey);
+          if (!identity) throw new Error("No such agent on this device");
+          return apply(saved ?? this.recordOf(identity));
+        });
+        if (!record) throw new Error("No such agent on this device");
+        return record;
+      },
+      changing: (pubkey) => this.changing.has(pubkey),
+      timers: (pubkey) => this.timersOf(pubkey),
+      progress: (pubkey, ran) => this.progress(pubkey, ran),
       start: (agent) => {
         const { settings, instructions } = this.configBinding?.(agent) ?? {};
         const merge = this.types().find(
@@ -1476,7 +1558,7 @@ export class AgentsService extends Service implements Agents {
       [...this.bound.keys()].some((origin) => this.rowOf(origin, pubkey))
     )
       throw new Error("The provider returned a key that is already in use");
-    this.writeUnfinished([
+    await this.writeUnfinished([
       ...this.unfinished.filter((setup) => setup.pubkey !== pubkey),
       {
         pubkey,
@@ -1522,7 +1604,9 @@ export class AgentsService extends Service implements Agents {
       runtime: setup.type,
       prior: this.rowOf(origin, pubkey)?.prior,
     });
-    this.writeUnfinished(this.unfinished.filter((entry) => entry !== setup));
+    await this.writeUnfinished(
+      this.unfinished.filter((entry) => entry !== setup),
+    );
     const agent = this.find(pubkey);
     if (!agent) throw new Error("The agent was set up in another community");
     // Listed with its picture either way; its own profile is the provider's.
@@ -1719,7 +1803,7 @@ export class AgentsService extends Service implements Agents {
     // one is made only with members.
     if (!saved && !members.length) return result;
     try {
-      const team = this.writeImportedTeam(old, teamId, saved, [
+      const team = await this.writeImportedTeam(old, teamId, saved, [
         ...kept,
         ...members,
       ]);
@@ -1762,7 +1846,7 @@ export class AgentsService extends Service implements Agents {
         record = { ...record, config: made.config };
       if (carry && kind.adopt)
         record = { ...record, config: kind.adopt(carry, record.config) };
-      this.write(record);
+      await this.change(identity.pubkey, () => record);
     } catch (error) {
       // The agent exists either way; unsaved settings start from the defaults.
       console.warn(`Agent ${identity.name} settings were not saved`, error);
@@ -1806,43 +1890,14 @@ export class AgentsService extends Service implements Agents {
       throw new Error(`${identity.name}'s provider is already changing`);
     const name = change.name?.trim();
     if (name === "") throw new Error("Name the agent");
-    let record = this.recordOf(identity);
-    if (change.config !== undefined)
-      record = { ...record, config: change.config };
-    if (change.attentionEnabled !== undefined) {
-      const { attentionEnabled: _, ...rest } = record;
-      record = change.attentionEnabled
-        ? { ...rest, attentionEnabled: true }
-        : rest;
-    }
-    for (const [slug, value] of Object.entries(change.attention ?? {}))
-      record = setAttention(
-        record,
-        slug,
-        value,
-        undefined,
-        change.restart?.includes(slug) ? "restart" : undefined,
-      );
-    // As the spec's writer: an Interest stays while anything still uses it.
-    for (const [slug, value] of Object.entries(change.attention ?? {})) {
-      const id = parseSlug(slug)?.id;
-      if (value !== null || !slug.startsWith("interest/") || !id) continue;
-      if (
-        Object.values(record.attention).some(
-          (object) =>
-            object.value.type !== "interest" && object.value.interest_id === id,
-        )
-      )
-        throw new Error(
-          "Remove or move the watches and timers that use this Interest first",
-        );
-    }
     if (
       change.config !== undefined ||
       change.attention ||
       change.attentionEnabled !== undefined
     )
-      this.write(record);
+      await this.change(pubkey, (saved) =>
+        changed(saved ?? this.recordOf(identity), change),
+      );
     const picture =
       change.picture === undefined ? undefined : change.picture || null;
     const renamed = name !== undefined && name !== identity.name;
@@ -1953,18 +2008,19 @@ export class AgentsService extends Service implements Agents {
       );
       await native.setType(pubkey, type);
       try {
-        const nextRecord = {
-          ...this.recordOf(identity),
-          config: change ? change.config : adopted,
-        };
-        const records = { ...this.records, [pubkey]: nextRecord };
-        writeRecords(this.storage, records);
-        // Publish the in-memory pair only after its config is durable.
-        this.records = records;
-        this.identities = this.identities.map((saved) =>
-          saved.pubkey === pubkey ? { ...saved, type } : saved,
+        await this.change(
+          pubkey,
+          (saved) => ({
+            ...(saved ?? this.recordOf(identity)),
+            config: change ? change.config : adopted,
+          }),
+          // Shown with its new type, only once its config is saved.
+          () => {
+            this.identities = this.identities.map((saved) =>
+              saved.pubkey === pubkey ? { ...saved, type } : saved,
+            );
+          },
         );
-        this.update();
       } catch (error) {
         try {
           await native.setType(pubkey, identity.type);
@@ -2076,7 +2132,7 @@ export class AgentsService extends Service implements Agents {
       // An unfinished one may have published its profile before setup failed.
       await removeRelayAgent(binding.session, binding.viewer, pubkey, signal);
       this.unlist(origin, pubkey);
-      this.writeUnfinished(
+      await this.writeUnfinished(
         this.unfinished.filter((setup) => setup.pubkey !== pubkey),
       );
     });
@@ -2105,7 +2161,7 @@ export class AgentsService extends Service implements Agents {
       instructions,
       members: Object.freeze([...new Set(members)]),
     });
-    this.writeTeams(
+    await this.writeTeams(
       id
         ? this.teamList.map((saved) => (saved.id === id ? team : saved))
         : [...this.teamList, team],
@@ -2116,7 +2172,7 @@ export class AgentsService extends Service implements Agents {
   /** Puts `members` on an old Buzz team's copy `id`, made from `saved` or,
    * the first time, `team`. Its name and instructions here are never
    * replaced. */
-  private writeImportedTeam(
+  private async writeImportedTeam(
     team: OldTeam,
     id: string,
     saved: Team | undefined,
@@ -2128,7 +2184,7 @@ export class AgentsService extends Service implements Agents {
       instructions: saved?.instructions ?? team.instructions,
       members: Object.freeze([...new Set(members)]),
     });
-    this.writeTeams(
+    await this.writeTeams(
       saved
         ? this.teamList.map((entry) => (entry === saved ? joined : entry))
         : [...this.teamList, joined],
@@ -2137,15 +2193,25 @@ export class AgentsService extends Service implements Agents {
   }
 
   async removeTeam(id: string) {
-    this.writeTeams(this.teamList.filter((team) => team.id !== id));
+    await this.writeTeams(this.teamList.filter((team) => team.id !== id));
   }
 
-  /** Saves the teams; memory changes only once storage has taken them. */
+  /** Saves the teams; memory changes once storage has taken them, and the
+   * promise settles once they are saved. When the save fails, memory goes
+   * back to the teams storage still has. */
   private writeTeams(teams: readonly Team[]) {
-    writeTeams(this.storage, teams);
+    const saving = writeTeams(this.storage, teams);
+    const shown = this.showTeams(teams);
+    return saving.catch((error: unknown) => {
+      if (this.teamList === shown) this.showTeams(readTeams(this.storage));
+      throw error;
+    });
+  }
+  private showTeams(teams: readonly Team[]) {
     this.teamList = Object.freeze(teams);
     this.state = Object.freeze({ ...this.state, teams: this.teamList });
     this.notify();
+    return this.teamList;
   }
 
   /** Saves which imports need an archive check, then keeps it in memory. */
@@ -2154,14 +2220,29 @@ export class AgentsService extends Service implements Agents {
     const next = new Set(this.unarchiving);
     if (unchecked) next.add(pubkey);
     else next.delete(pubkey);
-    writeArchiveUnchecked(this.storage, next);
+    // Unsaved, the next start offers no Retry until a check fails again.
+    void writeArchiveUnchecked(this.storage, next).catch((error) =>
+      console.warn("Agent archive checks were not saved", error),
+    );
     this.unarchiving = next;
   }
-  /** Saves the unfinished setups; memory changes only once storage has them. */
+
+  /** Saves the unfinished setups; memory changes once storage has taken them,
+   * and the promise settles once they are saved. When the save fails, memory
+   * goes back to the setups storage still has. */
   private writeUnfinished(unfinished: readonly Unfinished[]) {
-    writeUnfinished(this.storage, unfinished);
+    const saving = writeUnfinished(this.storage, unfinished);
+    const shown = this.showUnfinished(unfinished);
+    return saving.catch((error: unknown) => {
+      if (this.unfinished === shown)
+        this.showUnfinished(readUnfinished(this.storage));
+      throw error;
+    });
+  }
+  private showUnfinished(unfinished: readonly Unfinished[]) {
     this.unfinished = Object.freeze(unfinished);
     this.update();
+    return this.unfinished;
   }
 
   /** Reads the viewer's agent records in the community, then lists each of
@@ -2371,12 +2452,109 @@ export class AgentsService extends Service implements Agents {
     return agent;
   }
 
-  /** Saves one record; memory changes only once storage has taken it. */
-  private write(record: AgentRecord) {
-    const records = { ...this.records, [record.pubkey]: record };
-    writeRecords(this.storage, records);
-    this.records = records;
-    this.update();
+  /** Changes one agent's record. This is the only way a record changes:
+   * owner settings, the agent's attention tools, timer progress, a provider
+   * change and removal all send a change here. One agent's changes run in
+   * the order they are sent, each after the one before it is saved or has
+   * failed, so each one applies to the newest saved record, never to a copy
+   * another change replaces. `apply` gets that record (or undefined) and
+   * returns the next one, or null to remove it; it may throw to change
+   * nothing. The owner and the agent see a change once it is saved, and the
+   * promise settles then. When the save fails, the promise rejects and they
+   * keep the saved record, so a form keeps its unsaved changes. `saved`
+   * runs as the change is shown, before anyone is told. */
+  private change(
+    pubkey: string,
+    apply: (
+      record: AgentRecord | undefined,
+    ) => AgentRecord | null | Promise<AgentRecord | null>,
+    saved?: (record: AgentRecord | null) => void,
+  ): Promise<AgentRecord | null> {
+    this.changing.set(pubkey, (this.changing.get(pubkey) ?? 0) + 1);
+    return this.queued(pubkey, async () => {
+      try {
+        const base = this.records[pubkey];
+        const next = await apply(base);
+        await this.commit(pubkey, base, next);
+        saved?.(next);
+        this.update();
+        return next;
+      } finally {
+        const left = (this.changing.get(pubkey) ?? 1) - 1;
+        if (left) this.changing.set(pubkey, left);
+        else {
+          this.changing.delete(pubkey);
+          // Its timers waited for this change, saved or failed.
+          this.runners.wake(pubkey);
+        }
+      }
+    });
+  }
+  /** Records that timers ran or started counting, as a change to their run
+   * state only. It applies to whatever the record is when its turn comes, so
+   * it never undoes a change sent before it: when a timer was rearmed or
+   * restarted meanwhile, its new deadline stays and only the occurrences it
+   * used are added. Timers see it at once (`timersOf`), and memory keeps it
+   * even when its save fails, so a timer does not run again at once. */
+  private progress(pubkey: string, ran: TimerProgress) {
+    const pending = this.progressing.get(pubkey) ?? [];
+    this.progressing.set(pubkey, [...pending, ran]);
+    void this.queued(pubkey, async () => {
+      try {
+        const base = this.records[pubkey];
+        const next = base && withProgress(base, ran);
+        if (!base || !next) return;
+        await this.commit(pubkey, base, next).catch((error) => {
+          console.warn(`Agent ${pubkey} timer state was not saved`, error);
+          this.records = { ...this.records, [pubkey]: next };
+        });
+        this.update();
+      } finally {
+        const left = (this.progressing.get(pubkey) ?? []).filter(
+          (entry) => entry !== ran,
+        );
+        if (left.length) this.progressing.set(pubkey, left);
+        else this.progressing.delete(pubkey);
+      }
+    });
+  }
+  /** Runs `step` after the agent's earlier changes have settled. */
+  private queued<T>(pubkey: string, step: () => Promise<T>) {
+    const run = (this.changes.get(pubkey) ?? Promise.resolve()).then(step);
+    const tail = run.then(
+      () => {},
+      () => {},
+    );
+    this.changes.set(pubkey, tail);
+    void tail.then(() => {
+      if (this.changes.get(pubkey) === tail) this.changes.delete(pubkey);
+    });
+    return run;
+  }
+  /** Saves `next` over `base` in the agent's own key, then keeps it. Only
+   * this agent's key: others may be another program's to change. */
+  private async commit(
+    pubkey: string,
+    base: AgentRecord | undefined,
+    next: AgentRecord | null,
+  ) {
+    if (next === base) return;
+    if (next) await writeRecord(this.storage, next);
+    else if (this.storage.get(recordKey(pubkey)) !== null)
+      await removeRecord(this.storage, pubkey);
+    const { [pubkey]: _, ...others } = this.records;
+    this.records = next ? { ...others, [pubkey]: next } : others;
+  }
+  /** The agent's timers' run state as its timers go by: saved, with the
+   * progress still being saved. */
+  private timersOf(pubkey: string) {
+    const record = this.records[pubkey];
+    const pending = this.progressing.get(pubkey);
+    if (!record || !pending) return record?.timers ?? EMPTY;
+    return (
+      pending.reduce((next, ran) => withProgress(next, ran) ?? next, record)
+        .timers ?? EMPTY
+    );
   }
   private live(pubkey: string) {
     return this.identities.find(
@@ -2513,24 +2691,25 @@ export class AgentsService extends Service implements Agents {
           .filter((saved) => !saved.deleted)
           .map((saved) => saved.pubkey),
       );
-      if (Object.keys(this.records).some((pubkey) => !live.has(pubkey))) {
-        this.records = Object.fromEntries(
-          Object.entries(this.records).filter(([pubkey]) => live.has(pubkey)),
+      const gone = Object.keys(this.records).filter(
+        (pubkey) => !live.has(pubkey),
+      );
+      for (const pubkey of gone)
+        void this.change(pubkey, () => null).catch((error) =>
+          console.warn(`Agent ${pubkey} settings were not removed`, error),
         );
-        writeRecords(this.storage, this.records);
-      }
       // A deleted agent leaves its teams; the teams stay.
       if (
         this.teamList.some((team) =>
           team.members.some((pubkey) => !live.has(pubkey)),
         )
       )
-        this.writeTeams(
+        void this.writeTeams(
           this.teamList.map((team) => ({
             ...team,
             members: team.members.filter((pubkey) => live.has(pubkey)),
           })),
-        );
+        ).catch((error) => console.warn("Agent teams were not saved", error));
     } catch (error) {
       if (turn !== this.listed) return;
       this.state = Object.freeze({
diff --git a/src/features/agents/state.test.ts b/src/features/agents/state.test.ts
new file mode 100644
index 0000000000..12747b7446
--- /dev/null
+++ b/src/features/agents/state.test.ts
@@ -0,0 +1,191 @@
+import { expect, it, vi } from "vitest";
+import { fileStore, loadAgentStorage, MOVED_KEY } from "./state";
+import { memoryStorage } from "./test-fakes";
+
+const files = (items: Record<string, string> = {}) => {
+  const saved = new Map(Object.entries(items));
+  return {
+    saved,
+    load: vi.fn(async () => Object.fromEntries(saved)),
+    set: vi.fn(async (key: string, value: string | null) => {
+      if (value === null) saved.delete(key);
+      else saved.set(key, value);
+    }),
+  };
+};
+
+it("moves agent state from localStorage, which replaces what agent storage has", async () => {
+  const local = memoryStorage();
+  local.setItem("buzz.agents.v1", "records");
+  local.setItem("buzz.agents.teams.v1", "new teams");
+  local.setItem("buzz.claude-code.sessions.v1", "sessions");
+  local.setItem("buzz.codex.sessions.v4:scope:ab", "codex");
+  local.setItem("buzz.codex.provider-defaults.v1", "codex defaults");
+  local.setItem("buzz.claude-code.provider-defaults.v1", "claude defaults");
+  local.setItem("buzz.agents.archive-unchecked.v1", "unchecked");
+  local.setItem("buzz.agents.catch-up.v1", "checkpoints");
+  local.setItem("buzz.agents.catch-up.v1:aa", "agent checkpoints");
+  local.setItem("buzz.theme", "dark");
+  const native = files({
+    "buzz.agents.teams.v1": "stale teams",
+    "buzz.agent.v1:aa": "kept",
+  });
+  const storage = await loadAgentStorage(local, native);
+  expect(Object.fromEntries(native.saved)).toEqual({
+    "buzz.agents.v1": "records",
+    "buzz.agents.teams.v1": "new teams",
+    "buzz.agent.v1:aa": "kept",
+    "buzz.claude-code.sessions.v1": "sessions",
+    "buzz.codex.sessions.v4:scope:ab": "codex",
+    "buzz.codex.provider-defaults.v1": "codex defaults",
+    "buzz.claude-code.provider-defaults.v1": "claude defaults",
+    "buzz.agents.archive-unchecked.v1": "unchecked",
+    "buzz.agents.catch-up.v1": "checkpoints",
+    "buzz.agents.catch-up.v1:aa": "agent checkpoints",
+    [MOVED_KEY]: "1",
+  });
+  expect(storage.get("buzz.agents.teams.v1")).toBe("new teams");
+  // Moved keys leave localStorage; other keys stay.
+  expect(local.length).toBe(1);
+  expect(local.getItem("buzz.theme")).toBe("dark");
+});
+
+it("uses localStorage for a start where a copy fails, and keeps its state through a later move", async () => {
+  const local = memoryStorage();
+  local.setItem("buzz.agents.v1", "records");
+  local.setItem("buzz.agents.teams.v1", "teams");
+  const native = files();
+  // The records copy is saved; the teams copy fails.
+  native.set.mockResolvedValueOnce(undefined);
+  native.set.mockRejectedValueOnce(new Error("disk full"));
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  const first = await loadAgentStorage(local, native);
+  error.mockRestore();
+  expect(first.get("buzz.agents.v1")).toBe("records");
+  expect(first.get("buzz.agents.teams.v1")).toBe("teams");
+  // The owner saves while the app uses localStorage.
+  await first.set("buzz.agents.v1", "saved records");
+  expect(local.getItem("buzz.agents.v1")).toBe("saved records");
+
+  // The disk recovers: the next start moves everything, the newer records too.
+  const second = await loadAgentStorage(local, native);
+  expect(local.getItem("buzz.agents.v1")).toBeNull();
+  await second.set("buzz.agent.v1:aa", "saved again");
+  expect(native.saved.get("buzz.agent.v1:aa")).toBe("saved again");
+  expect(local.getItem("buzz.agent.v1:aa")).toBeNull();
+
+  const third = await loadAgentStorage(local, native);
+  expect(third.get("buzz.agents.teams.v1")).toBe("teams");
+  expect(third.get("buzz.agents.v1")).toBe("saved records");
+  expect(third.get("buzz.agent.v1:aa")).toBe("saved again");
+});
+
+it("keeps the moved state when a later start without agent storage saves", async () => {
+  const local = memoryStorage();
+  local.setItem("buzz.agents.v1", "all records");
+  local.setItem("buzz.claude-code.sessions.v1", "all sessions");
+  const native = files();
+  await loadAgentStorage(local, native);
+  expect(local.length).toBe(0);
+
+  // A start that cannot read agent storage begins with no agent state.
+  native.load.mockRejectedValueOnce(new Error("denied"));
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  const fallback = await loadAgentStorage(local, native);
+  error.mockRestore();
+  await fallback.set("buzz.claude-code.sessions.v1", "one new session");
+  await fallback.set("buzz.agent.v1:bb", "new agent");
+  expect(local.getItem("buzz.agent.v1:bb")).toBe("new agent");
+
+  // The next start keeps the full copy, and adds only the new key.
+  const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+  const next = await loadAgentStorage(local, native);
+  warn.mockRestore();
+  expect(next.get("buzz.agents.v1")).toBe("all records");
+  expect(next.get("buzz.claude-code.sessions.v1")).toBe("all sessions");
+  expect(next.get("buzz.agent.v1:bb")).toBe("new agent");
+  expect(native.saved.get("buzz.claude-code.sessions.v1")).toBe("all sessions");
+  expect(local.length).toBe(0);
+});
+
+it("uses localStorage when agent storage cannot be read", async () => {
+  const local = memoryStorage();
+  const native = files();
+  native.load.mockRejectedValueOnce(new Error("denied"));
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  for (const storage of [
+    await loadAgentStorage(local, native),
+    await loadAgentStorage(local, undefined),
+  ]) {
+    await storage.set("buzz.agents.v1", "here");
+    expect(local.getItem("buzz.agents.v1")).toBe("here");
+  }
+  expect(native.set).not.toHaveBeenCalled();
+  error.mockRestore();
+});
+
+it("uses localStorage when agent storage does not answer, and leaves it as it was", async () => {
+  vi.useFakeTimers();
+  const local = memoryStorage();
+  local.setItem("buzz.agents.v1", "records");
+  const native = files();
+  let answer = () => {};
+  native.load.mockImplementationOnce(
+    () => new Promise((resolve) => (answer = () => resolve({}))),
+  );
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  const started = loadAgentStorage(local, native, 1_000);
+  await vi.advanceTimersByTimeAsync(1_000);
+  const storage = await started;
+  expect(storage.get("buzz.agents.v1")).toBe("records");
+  // A late answer moves nothing: the app is using localStorage.
+  answer();
+  await vi.runAllTimersAsync();
+  error.mockRestore();
+  vi.useRealTimers();
+  expect(local.getItem("buzz.agents.v1")).toBe("records");
+  expect(native.saved.has(MOVED_KEY)).toBe(false);
+});
+
+it("saves each write in order, and a failed write does not stop later ones", async () => {
+  const native = files();
+  const storage = fileStore(new Map(), native.set);
+  native.set.mockRejectedValueOnce(new Error("busy"));
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  const writes = [
+    storage.set("a", "1"),
+    storage.set("a", "2"),
+    storage.set("b", "3"),
+    storage.set("b", null),
+  ];
+  await expect(writes[0]).rejects.toThrow("busy");
+  await Promise.all(writes.slice(1));
+  error.mockRestore();
+  expect(native.set.mock.calls).toEqual([
+    ["a", "1"],
+    ["a", "2"],
+    ["b", "3"],
+    ["b", null],
+  ]);
+  expect(Object.fromEntries(native.saved)).toEqual({ a: "2" });
+  expect(storage.get("a")).toBe("2");
+  expect(storage.keys()).toEqual(["a"]);
+});
+
+it("puts back a key whose write failed, so it is not taken as saved and can be set again", async () => {
+  const native = files({ a: "old" });
+  const storage = fileStore(new Map([["a", "old"]]), native.set);
+  native.set.mockRejectedValueOnce(new Error("disk full"));
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  const a = storage.set("a", "new");
+  const b = storage.set("b", "kept");
+  expect(storage.get("a")).toBe("new");
+  await expect(a).rejects.toThrow("disk full");
+  await expect(b).resolves.toBeUndefined();
+  error.mockRestore();
+  expect(storage.get("a")).toBe("old");
+  // The same value again is a new write, not a no-op.
+  await storage.set("a", "new");
+  expect(native.saved.get("a")).toBe("new");
+  expect(storage.get("a")).toBe("new");
+});
diff --git a/src/features/agents/state.ts b/src/features/agents/state.ts
new file mode 100644
index 0000000000..d29b2fd870
--- /dev/null
+++ b/src/features/agents/state.ts
@@ -0,0 +1,213 @@
+// Agent storage: each agent's settings, the owner's teams, unfinished setups,
+// and the sessions agent types save. In the desktop app it lives in the
+// `agents/state` folder beside the agent identities, one file per key, so the
+// standalone agent host (`buzz-agent-host`) reads and writes the same state.
+// Elsewhere, as in a browser, it is this page's localStorage.
+//
+// Storage reads are synchronous, so the app reads every file once before it
+// starts, and then keeps a copy in memory. Each write changes the copy at once
+// and is then saved, in order, to its key's file. Another program's later
+// writes reach this copy only when the app starts again.
+import { invoke, isTauri } from "@tauri-apps/api/core";
+import { CONFIG_STORAGE_KEY } from "./agent-config";
+import { CATCH_UP_KEY, CATCH_UP_PREFIX } from "./catch-up";
+import {
+  localStore,
+  type AgentStore,
+  ARCHIVE_UNCHECKED_KEY,
+  RECORD_PREFIX,
+  STORAGE_KEY,
+  TEAMS_KEY,
+  UNFINISHED_KEY,
+} from "./store";
+
+export { localStore, type AgentStore } from "./store";
+
+/** The localStorage keys of agent state, moved into agent storage once. */
+export function isAgentKey(key: string) {
+  return (
+    key === STORAGE_KEY ||
+    key === TEAMS_KEY ||
+    key === UNFINISHED_KEY ||
+    key === ARCHIVE_UNCHECKED_KEY ||
+    key === CATCH_UP_KEY ||
+    key.startsWith(CATCH_UP_PREFIX) ||
+    key.startsWith(RECORD_PREFIX) ||
+    // The sessions the bundled agent types save.
+    key.startsWith("buzz.claude-code.sessions.") ||
+    key.startsWith("buzz.codex.sessions.") ||
+    // The relay-synced copies of agent settings that starts use.
+    key === CONFIG_STORAGE_KEY ||
+    // The device-wide defaults that blank agent settings inherit.
+    key === "buzz.claude-code.provider-defaults.v1" ||
+    key === "buzz.codex.provider-defaults.v1" ||
+    // TEMPORARY agents rename: see migrate-storage.ts.
+    key.startsWith("buzz.agents2.")
+  );
+}
+
+let loaded: AgentStore | undefined;
+
+/** Agent storage, once `loadAgentStorage` has read it; localStorage before
+ * that, and outside the desktop app. */
+export function agentStorage(): AgentStore {
+  return loaded ?? localStore();
+}
+
+type Native = Readonly<{
+  load(): Promise<Record<string, string>>;
+  set(key: string, value: string | null): Promise<void>;
+  /** Saves `value` only if no file holds `key`, in one step; resolves with
+   * what the file held when one did, else null. */
+  add?(key: string, value: string): Promise<string | null>;
+}>;
+
+const native: Native = {
+  load: () => invoke("app_agent_state_load"),
+  set: async (key, value) => {
+    await invoke("app_agent_state_set", { key, value });
+  },
+  add: (key, value) =>
+    invoke("app_agent_state_set", { key, value, absent: true }),
+};
+
+/** Agent storage holds this key once every agent key in localStorage was
+ * moved into it. */
+export const MOVED_KEY = "buzz.agents.state-moved.v1";
+
+/** Reads agent storage before the app starts. It moves agent state the app
+ * kept in localStorage into it. Before the first move finishes, agent keys in
+ * localStorage are the newer copy and replace what agent storage has. After
+ * it, agent storage is the full copy: agent keys in localStorage come from a
+ * start that could not use agent storage and began with none, so they fill
+ * in only keys agent storage does not have. Agent keys leave localStorage
+ * only once every one is saved; if agent storage cannot be read, a copy
+ * fails, or this takes longer than `timeoutMs`, the app uses localStorage
+ * until the next start. */
+export async function loadAgentStorage(
+  local: Storage = globalThis.localStorage,
+  files: Native | undefined = isTauri() ? native : undefined,
+  timeoutMs = 15_000,
+): Promise<AgentStore> {
+  if (!files) return localStore(local);
+  let late = false;
+  const move = async () => {
+    const storage = fileStore(
+      new Map(Object.entries(await files.load())),
+      files.set,
+      files.add,
+    );
+    const moved: string[] = [];
+    for (let index = 0; index < local.length; index++) {
+      const key = local.key(index);
+      if (key && isAgentKey(key)) moved.push(key);
+    }
+    const finished = storage.get(MOVED_KEY) !== null;
+    const copies: Promise<void>[] = [];
+    for (const key of moved) {
+      const value = local.getItem(key);
+      if (value === null || storage.get(key) === value) continue;
+      if (finished && storage.get(key) !== null) {
+        console.warn(
+          `Agent state ${key} from a start without agent storage was not kept`,
+        );
+        continue;
+      }
+      copies.push(storage.set(key, value));
+    }
+    await Promise.all(copies);
+    if (!finished) await storage.set(MOVED_KEY, "1");
+    // Too late: the app already started with localStorage, which keeps them.
+    // So this start's keys are again the newer copy.
+    if (late) {
+      if (!finished)
+        void storage.set(MOVED_KEY, null).catch(() => {
+          // Logged by the store; the next start copies the keys again.
+        });
+      throw new Error("Agent storage took too long");
+    }
+    for (const key of moved) local.removeItem(key);
+    loaded = storage;
+    return storage;
+  };
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => {
+      late = true;
+      reject(new Error("Agent storage took too long"));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([move(), timeout]);
+  } catch (error) {
+    console.error(
+      "Agent storage could not be used; using this window's",
+      error,
+    );
+    return localStore(local);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** Agent storage held in memory and saved through `save`, one write at a
+ * time, in order. A failed write puts back the key's saved value, so the
+ * copy never keeps what is not saved and the same value can be set again. */
+export function fileStore(
+  items: Map<string, string>,
+  save: Native["set"],
+  add: NonNullable<Native["add"]> = async (key, value) => {
+    await save(key, value);
+    return null;
+  },
+): AgentStore {
+  /** What each key's file holds, as far as this program saved it. */
+  const durable = new Map(items);
+  /** Each key's last write, until it is saved. */
+  const pending = new Map<string, Promise<unknown>>();
+  let queue: Promise<unknown> = Promise.resolve();
+  const write = (key: string, value: string | null, absent = false) => {
+    const next = queue.then(async () =>
+      absent && value !== null ? add(key, value) : save(key, value),
+    );
+    pending.set(key, next);
+    const done = next.then(
+      (held) => {
+        const kept = held ?? value;
+        if (kept === null) durable.delete(key);
+        else durable.set(key, kept);
+        if (pending.get(key) !== next) return kept;
+        pending.delete(key);
+        if (kept !== null) items.set(key, kept);
+        return kept;
+      },
+      (error: unknown) => {
+        console.error(`Agent state ${key} was not saved`, error);
+        if (pending.get(key) === next) {
+          pending.delete(key);
+          const kept = durable.get(key);
+          if (kept === undefined) items.delete(key);
+          else items.set(key, kept);
+        }
+        throw error;
+      },
+    );
+    queue = done.catch(() => {});
+    return done;
+  };
+  return Object.freeze({
+    keys: () => [...items.keys()],
+    get: (key: string) => items.get(key) ?? null,
+    set: async (key: string, value: string | null) => {
+      if (value === null) items.delete(key);
+      else items.set(key, value);
+      await write(key, value);
+    },
+    add: async (key: string, value: string) => {
+      const held = items.get(key);
+      if (held !== undefined) return held;
+      items.set(key, value);
+      return (await write(key, value, true)) ?? value;
+    },
+  });
+}
diff --git a/src/features/agents/store.test.ts b/src/features/agents/store.test.ts
index 334446ea45..c0760448d7 100644
--- a/src/features/agents/store.test.ts
+++ b/src/features/agents/store.test.ts
@@ -1,15 +1,19 @@
-import { expect, it } from "vitest";
+import { expect, it, vi } from "vitest";
+import { fileStore } from "./state";
 import {
   STORAGE_KEY,
   TEAMS_KEY,
   readRecords,
+  recordKey,
   readTeams,
   setAttention,
-  writeRecords,
+  removeRecord,
+  splitLegacyRecords,
+  writeRecord,
   writeTeams,
   type AgentRecord,
 } from "./store";
-import { memoryStorage } from "./test-fakes";
+import { memoryStorage, sharedFiles } from "./test-fakes";
 
 const pubkey = "a".repeat(64);
 const record: AgentRecord = {
@@ -18,7 +22,7 @@ const record: AgentRecord = {
   config: { word: "hi" },
 };
 
-it("round-trips records and drops attention objects a reader would ignore", () => {
+it("round-trips records and drops attention objects a reader would ignore", async () => {
   const storage = memoryStorage();
   const saved = setAttention(
     record,
@@ -26,16 +30,16 @@ it("round-trips records and drops attention objects a reader would ignore", () =
     { type: "interest", instructions: "Be brief." },
     7,
   );
-  writeRecords(storage, { [pubkey]: saved });
+  await writeRecord(storage, saved);
   expect(readRecords(storage)).toEqual({ [pubkey]: saved });
-  const stored = JSON.parse(storage.getItem(STORAGE_KEY) as string);
-  stored.agents[pubkey].attention["watch/bad"] = {
+  const stored = JSON.parse(storage.getItem(recordKey(pubkey)) as string);
+  stored.attention["watch/bad"] = {
     slug: "watch/bad",
     value: { type: "event" },
     modifiedAt: 1,
   };
-  stored.agents.nonsense = record;
-  storage.setItem(STORAGE_KEY, JSON.stringify(stored));
+  storage.setItem(recordKey(pubkey), JSON.stringify(stored));
+  storage.setItem(recordKey("nonsense"), JSON.stringify(record));
   const read = readRecords(storage);
   expect(read[pubkey]?.attention).toEqual(saved.attention);
   expect(read).not.toHaveProperty("nonsense");
@@ -44,9 +48,9 @@ it("round-trips records and drops attention objects a reader would ignore", () =
     value: { type: "event" },
     problem: expect.stringMatching(/Missing/),
   });
-  writeRecords(storage, read);
+  await writeRecord(storage, read[pubkey] as AgentRecord);
   expect(
-    JSON.parse(storage.getItem(STORAGE_KEY) as string).agents[pubkey].attention[
+    JSON.parse(storage.getItem(recordKey(pubkey)) as string).attention[
       "watch/bad"
     ],
   ).toEqual({ slug: "watch/bad", value: { type: "event" }, modifiedAt: 1 });
@@ -55,17 +59,54 @@ it("round-trips records and drops attention objects a reader would ignore", () =
   expect(fixed.skipped).toEqual({});
 });
 
-it("saves attention only as on; absent or anything else reads as off", () => {
+it("keeps each agent's record under its own key and moves the old shared value", async () => {
   const storage = memoryStorage();
-  writeRecords(storage, {
-    [pubkey]: { ...record, attentionEnabled: true },
-    ["b".repeat(64)]: { ...record, pubkey: "b".repeat(64) },
-    ["c".repeat(64)]: {
-      ...record,
-      pubkey: "c".repeat(64),
-      attentionEnabled: false,
+  const other = "b".repeat(64);
+  storage.setItem(
+    STORAGE_KEY,
+    JSON.stringify({
+      version: 1,
+      agents: { [pubkey]: record, [other]: { ...record, pubkey: other } },
+    }),
+  );
+  expect(Object.keys(readRecords(storage)).sort()).toEqual([pubkey, other]);
+  expect(readRecords(storage)[other]?.pubkey).toBe(other);
+  // Saved records win over the old shared value.
+  await writeRecord(storage, { ...record, config: { word: "new" } });
+  expect(readRecords(storage)[pubkey]?.config).toEqual({ word: "new" });
+  await splitLegacyRecords(storage, readRecords(storage));
+  expect(storage.getItem(STORAGE_KEY)).toBeNull();
+  expect(readRecords(storage)[other]?.pubkey).toBe(other);
+  // Writing one record leaves another program's record alone.
+  storage.setItem(recordKey(other), "sentinel");
+  await writeRecord(storage, { ...record, config: { word: "newer" } });
+  expect(storage.getItem(recordKey(other))).toBe("sentinel");
+  // A record that did not change is not written again.
+  const writes: string[] = [];
+  const watched = {
+    get: storage.get,
+    keys: storage.keys,
+    add: storage.add,
+    set: (key: string, value: string | null) => {
+      writes.push(key);
+      return storage.set(key, value);
     },
-  });
+  };
+  await writeRecord(watched, { ...record, config: { word: "newer" } });
+  expect(writes).toEqual([]);
+  // A removed record is gone.
+  await removeRecord(storage, other);
+  expect(storage.getItem(recordKey(other))).toBeNull();
+});
+
+it("saves attention only as on; absent or anything else reads as off", async () => {
+  const storage = memoryStorage();
+  for (const saved of [
+    { ...record, attentionEnabled: true },
+    { ...record, pubkey: "b".repeat(64) },
+    { ...record, pubkey: "c".repeat(64), attentionEnabled: false },
+  ] as AgentRecord[])
+    await writeRecord(storage, saved);
   const read = readRecords(storage);
   expect(read[pubkey]?.attentionEnabled).toBe(true);
   expect(read["b".repeat(64)]).not.toHaveProperty("attentionEnabled");
@@ -206,14 +247,15 @@ it("reads nothing from missing or malformed storage", () => {
   const storage = memoryStorage();
   expect(readRecords(storage)).toEqual({});
   storage.setItem(STORAGE_KEY, "{");
+  storage.setItem(recordKey(pubkey), "{");
   expect(readRecords(storage)).toEqual({});
 });
 
-it("round-trips teams and skips any that is not one", () => {
+it("round-trips teams and skips any that is not one", async () => {
   const storage = memoryStorage();
   expect(readTeams(storage)).toEqual([]);
   const team = { id: "t", name: "Crew", instructions: "Hi", members: [pubkey] };
-  writeTeams(storage, [team]);
+  await writeTeams(storage, [team]);
   expect(readTeams(storage)).toEqual([team]);
   storage.setItem(
     TEAMS_KEY,
@@ -226,3 +268,47 @@ it("round-trips teams and skips any that is not one", () => {
   storage.setItem(TEAMS_KEY, "{");
   expect(readTeams(storage)).toEqual([]);
 });
+
+it("keeps the old shared value until every record from it is saved", async () => {
+  const shared = JSON.stringify({ version: 1, agents: { [pubkey]: record } });
+  const disk = new Map([[STORAGE_KEY, shared]]);
+  const save = vi.fn(async (key: string, value: string | null) => {
+    if (key === recordKey(pubkey)) throw new Error("disk full");
+    if (value === null) disk.delete(key);
+    else disk.set(key, value);
+  });
+  const storage = fileStore(new Map(disk), save);
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  await splitLegacyRecords(storage, readRecords(storage));
+  error.mockRestore();
+  expect(save).not.toHaveBeenCalledWith(STORAGE_KEY, null);
+  // The next start still has the agent.
+  const restarted = fileStore(new Map(disk), save);
+  expect(readRecords(restarted)[pubkey]?.config).toEqual(record.config);
+  // Once its record saves, the split finishes.
+  save.mockImplementation(async (key, value) => {
+    if (value === null) disk.delete(key);
+    else disk.set(key, value);
+  });
+  await splitLegacyRecords(restarted, readRecords(restarted));
+  expect(disk.has(STORAGE_KEY)).toBe(false);
+  expect(readRecords(fileStore(new Map(disk), save))[pubkey]?.config).toEqual(
+    record.config,
+  );
+});
+
+it("keeps a record saved since, when a late move from the old shared value lands", async () => {
+  const { open } = sharedFiles({
+    [STORAGE_KEY]: JSON.stringify({ version: 1, agents: { [pubkey]: record } }),
+  });
+  let release = () => {};
+  const first = open();
+  const second = open(new Promise((resolve) => (release = resolve)));
+  await splitLegacyRecords(first, readRecords(first));
+  const late = splitLegacyRecords(second, readRecords(second));
+  await writeRecord(first, { ...record, config: { word: "newer" } });
+  release();
+  await late;
+  expect(readRecords(open())[pubkey]?.config).toEqual({ word: "newer" });
+  expect(readRecords(second)[pubkey]?.config).toEqual({ word: "newer" });
+});
diff --git a/src/features/agents/store.ts b/src/features/agents/store.ts
index 08d316270a..00dc5a706f 100644
--- a/src/features/agents/store.ts
+++ b/src/features/agents/store.ts
@@ -13,6 +13,45 @@ import {
   type TimerWatch,
 } from "./attention";
 
+/** Agent state as every program that runs this machine's agents shares it.
+ * Reads are synchronous, from this program's copy. Each write changes the
+ * copy at once and returns a promise that settles once the write is saved.
+ * It rejects when the write was not saved, and the copy then holds the saved
+ * value again. A caller that must know a value is saved awaits the write. */
+export type AgentStore = Readonly<{
+  keys(): readonly string[];
+  get(key: string): string | null;
+  /** Saves `value` under `key`; null removes the key. */
+  set(key: string, value: string | null): Promise<void>;
+  /** Saves `value` only if no program saved a value under `key`. Resolves
+   * with the value then kept: `value`, or what another program saved first. */
+  add(key: string, value: string): Promise<string>;
+}>;
+
+/** `storage` as agent storage. Its writes save as they are made, so each
+ * settles at once, or rejects when `storage` refused it. */
+export function localStore(
+  storage: Storage = globalThis.localStorage,
+): AgentStore {
+  return Object.freeze({
+    keys: () =>
+      Array.from({ length: storage.length }, (_, index) =>
+        storage.key(index),
+      ).filter((key): key is string => key !== null),
+    get: (key: string) => storage.getItem(key),
+    set: async (key: string, value: string | null) => {
+      if (value === null) storage.removeItem(key);
+      else storage.setItem(key, value);
+    },
+    add: async (key: string, value: string) => {
+      const held = storage.getItem(key);
+      if (held !== null) return held;
+      storage.setItem(key, value);
+      return value;
+    },
+  });
+}
+
 /** An object a reader cannot apply, kept as it was stored so it can be fixed. */
 export type SkippedObject = Readonly<{
   slug: string;
@@ -40,20 +79,43 @@ export type AgentRecord = Readonly<{
 }>;
 type Stored = { version: 1; agents: Record<string, AgentRecord> };
 
+/** Where records were kept, all in one value, before each had its own key. */
 export const STORAGE_KEY = "buzz.agents.v1";
+/** Each agent's record has its own key, so programs that run different
+ * agents and share this storage never write over each other's records. */
+export const RECORD_PREFIX = "buzz.agent.v1:";
+export const recordKey = (pubkey: string) => `${RECORD_PREFIX}${pubkey}`;
 const PUBKEY = /^[0-9a-f]{64}$/;
 const group = (value: AttentionValue) =>
   value.type === "interest" ? "Interests" : "watches and timers";
 
 /** Reads every record. An attention object a reader would not apply is skipped
  * and reported, never dropped. */
-export function readRecords(storage: Storage): Record<string, AgentRecord> {
-  let stored: unknown;
+export function readRecords(storage: AgentStore): Record<string, AgentRecord> {
+  const stored: Record<string, AgentRecord> = { ...legacyRecords(storage) };
+  for (const key of storage.keys()) {
+    if (!key.startsWith(RECORD_PREFIX)) continue;
+    const record = parsed(storage.get(key));
+    if (record) stored[key.slice(RECORD_PREFIX.length)] = record as AgentRecord;
+  }
+  const records: Record<string, AgentRecord> = {};
+  for (const [pubkey, record] of Object.entries(stored)) {
+    const read = readRecord(pubkey, record);
+    if (read) records[pubkey] = read;
+  }
+  return records;
+}
+
+function parsed(text: string | null): unknown {
   try {
-    stored = JSON.parse(storage.getItem(STORAGE_KEY) ?? "null");
+    return JSON.parse(text ?? "null");
   } catch {
-    return {};
+    return undefined;
   }
+}
+
+function legacyRecords(storage: AgentStore): Record<string, AgentRecord> {
+  const stored = parsed(storage.get(STORAGE_KEY));
   if (
     !stored ||
     typeof stored !== "object" ||
@@ -61,80 +123,111 @@ export function readRecords(storage: Storage): Record<string, AgentRecord> {
     typeof (stored as Stored).agents !== "object"
   )
     return {};
-  const records: Record<string, AgentRecord> = {};
-  for (const [pubkey, record] of Object.entries((stored as Stored).agents)) {
-    if (!PUBKEY.test(pubkey) || record?.pubkey !== pubkey) continue;
-    const attention: Record<string, AttentionObject> = {};
-    const skipped: Record<string, SkippedObject> = {};
-    const counts = { Interests: 0, "watches and timers": 0 };
-    const entries = Object.entries(record.attention ?? {}).sort(([a], [b]) =>
-      a < b ? -1 : a > b ? 1 : 0,
-    );
-    for (const [slug, object] of entries) {
-      const modifiedAt = Number.isSafeInteger(object?.modifiedAt)
-        ? object.modifiedAt
-        : 0;
-      let problem =
-        object?.slug === slug
-          ? validateObject(slug, object.value)
-          : "Stored under another slug";
-      if (!problem) {
-        const kind = group(object.value);
-        if (++counts[kind] > OBJECT_LIMIT)
-          problem = `Over the limit of ${OBJECT_LIMIT} ${kind}`;
-      }
-      if (problem)
-        skipped[slug] = { slug, value: object?.value, modifiedAt, problem };
-      else attention[slug] = { slug, value: object.value, modifiedAt };
+  return (stored as Stored).agents;
+}
+
+function readRecord(
+  pubkey: string,
+  record: AgentRecord | undefined,
+): AgentRecord | undefined {
+  if (!PUBKEY.test(pubkey) || record?.pubkey !== pubkey) return undefined;
+  const attention: Record<string, AttentionObject> = {};
+  const skipped: Record<string, SkippedObject> = {};
+  const counts = { Interests: 0, "watches and timers": 0 };
+  const entries = Object.entries(record.attention ?? {}).sort(([a], [b]) =>
+    a < b ? -1 : a > b ? 1 : 0,
+  );
+  for (const [slug, object] of entries) {
+    const modifiedAt = Number.isSafeInteger(object?.modifiedAt)
+      ? object.modifiedAt
+      : 0;
+    let problem =
+      object?.slug === slug
+        ? validateObject(slug, object.value)
+        : "Stored under another slug";
+    if (!problem) {
+      const kind = group(object.value);
+      if (++counts[kind] > OBJECT_LIMIT)
+        problem = `Over the limit of ${OBJECT_LIMIT} ${kind}`;
     }
-    const timers: Record<string, TimerState> = {};
-    for (const [slug, state] of Object.entries(record.timers ?? {}))
-      if (
-        attention[slug]?.value.type === "timer" &&
-        [state?.armedAt, state?.nextDue, state?.used].every(
-          Number.isSafeInteger,
-        )
-      )
-        timers[slug] = state;
-    records[pubkey] = {
-      pubkey,
-      attention,
-      skipped,
-      config: record.config,
-      timers,
-      ...(record.attentionEnabled === true ? { attentionEnabled: true } : {}),
-    };
+    if (problem)
+      skipped[slug] = { slug, value: object?.value, modifiedAt, problem };
+    else attention[slug] = { slug, value: object.value, modifiedAt };
   }
-  return records;
+  const timers: Record<string, TimerState> = {};
+  for (const [slug, state] of Object.entries(record.timers ?? {}))
+    if (
+      attention[slug]?.value.type === "timer" &&
+      [state?.armedAt, state?.nextDue, state?.used].every(Number.isSafeInteger)
+    )
+      timers[slug] = state;
+  return {
+    pubkey,
+    attention,
+    skipped,
+    config: record.config,
+    timers,
+    ...(record.attentionEnabled === true ? { attentionEnabled: true } : {}),
+  };
 }
 
-export function writeRecords(
-  storage: Storage,
+/** Moves records from the old value that held every agent into one key per
+ * agent, then removes it. Only that move writes many records at once: after
+ * it, each save writes only its own agent's key, so a program that runs
+ * other agents from the same storage keeps its changes. */
+export async function splitLegacyRecords(
+  storage: AgentStore,
   records: Readonly<Record<string, AgentRecord>>,
 ) {
+  if (storage.get(STORAGE_KEY) === null) return;
+  try {
+    // A key is only added where none is saved: a program that moves late
+    // never replaces what another saved since.
+    await Promise.all(
+      Object.values(records).map((record) =>
+        storage.add(recordKey(record.pubkey), recordText(record)),
+      ),
+    );
+    // The shared value goes only once every record is saved: until then it
+    // is the only saved copy, and a record of an agent's own wins when both
+    // are.
+    await storage.set(STORAGE_KEY, null);
+  } catch (error) {
+    // This must not stop startup: it runs before the app can show an error.
+    // The shared value stays, so the records are read from it and the move
+    // is tried again at the next start.
+    console.error("Agent records were not split", error);
+  }
+}
+
+/** Removes an agent's record. */
+export function removeRecord(storage: AgentStore, pubkey: string) {
+  return storage.set(recordKey(pubkey), null);
+}
+
+/** A record as it is saved. */
+function recordText({ skipped, ...record }: AgentRecord) {
   // Skipped objects go back where they were read from, so a later reader that
   // can apply them still finds them.
-  const agents = Object.fromEntries(
-    Object.entries(records).map(([pubkey, { skipped, ...record }]) => [
-      pubkey,
-      {
-        ...record,
-        attention: {
-          ...Object.fromEntries(
-            Object.values(skipped ?? {}).map(({ problem: _, ...object }) => [
-              object.slug,
-              object,
-            ]),
-          ),
-          ...record.attention,
-        },
-      },
-    ]),
-  );
-  storage.setItem(
-    STORAGE_KEY,
-    JSON.stringify({ version: 1, agents } as Stored),
-  );
+  return JSON.stringify({
+    ...record,
+    attention: {
+      ...Object.fromEntries(
+        Object.values(skipped ?? {}).map(({ problem: _, ...object }) => [
+          object.slug,
+          object,
+        ]),
+      ),
+      ...record.attention,
+    },
+  });
+}
+
+/** Saves one record, when it changed. */
+export async function writeRecord(storage: AgentStore, record: AgentRecord) {
+  const text = recordText(record);
+  const key = recordKey(record.pubkey);
+  if (storage.get(key) !== text) await storage.set(key, text);
 }
 
 /** Replaces or deletes (`value: null`) one attention object, after validating it
@@ -185,6 +278,44 @@ export function setAttention(
   };
 }
 
+/** What one timer pass saw and decided, by slug: `seen` is the run state it
+ * read, absent when the timer had none, and `next` the state it keeps. */
+export type TimerProgress = Readonly<
+  Record<string, Readonly<{ seen?: TimerState | undefined; next: TimerState }>>
+>;
+
+const sameState = (a: TimerState | undefined, b: TimerState | undefined) =>
+  a === b ||
+  (!!a &&
+    !!b &&
+    a.armedAt === b.armedAt &&
+    a.nextDue === b.nextDue &&
+    a.used === b.used);
+
+/** `record` with a timer pass's progress, or undefined when that changes
+ * nothing. A timer whose state is still what the pass saw takes the pass's
+ * state. One whose state changed since, as a rearm or restart changes it,
+ * keeps its new deadline, and the occurrences the pass used are added to it:
+ * they ran, so they count. A timer that is gone takes nothing. */
+export function withProgress(
+  record: AgentRecord,
+  progress: TimerProgress,
+): AgentRecord | undefined {
+  let timers = record.timers ?? {};
+  for (const [slug, { seen, next }] of Object.entries(progress)) {
+    if (record.attention[slug]?.value.type !== "timer") continue;
+    const state = timers[slug];
+    const kept =
+      !state || sameState(state, seen)
+        ? next
+        : seen
+          ? { ...state, used: state.used + next.used - seen.used }
+          : state;
+    if (!sameState(kept, state)) timers = { ...timers, [slug]: kept };
+  }
+  return timers === (record.timers ?? {}) ? undefined : { ...record, timers };
+}
+
 /** A group of the owner's agents and the text its members share. Membership
  * lives only here: an agent records nothing about its teams. */
 export type Team = Readonly<{
@@ -197,10 +328,10 @@ export type Team = Readonly<{
 export const TEAMS_KEY = "buzz.agents.teams.v1";
 
 /** Reads every team, skipping any that is not one. */
-export function readTeams(storage: Storage): readonly Team[] {
+export function readTeams(storage: AgentStore): readonly Team[] {
   let stored: unknown;
   try {
-    stored = JSON.parse(storage.getItem(TEAMS_KEY) ?? "null");
+    stored = JSON.parse(storage.get(TEAMS_KEY) ?? "null");
   } catch {
     return [];
   }
@@ -226,8 +357,8 @@ export function readTeams(storage: Storage): readonly Team[] {
   );
 }
 
-export function writeTeams(storage: Storage, teams: readonly Team[]) {
-  storage.setItem(TEAMS_KEY, JSON.stringify({ version: 1, teams }));
+export function writeTeams(storage: AgentStore, teams: readonly Team[]) {
+  return storage.set(TEAMS_KEY, JSON.stringify({ version: 1, teams }));
 }
 
 /** A hosted agent its provider made whose setup has not finished. Kept so
@@ -246,10 +377,10 @@ export type Unfinished = Readonly<{
 export const UNFINISHED_KEY = "buzz.agents.unfinished.v1";
 
 /** Reads every unfinished setup, skipping any that is not one. */
-export function readUnfinished(storage: Storage): readonly Unfinished[] {
+export function readUnfinished(storage: AgentStore): readonly Unfinished[] {
   let stored: unknown;
   try {
-    stored = JSON.parse(storage.getItem(UNFINISHED_KEY) ?? "null");
+    stored = JSON.parse(storage.get(UNFINISHED_KEY) ?? "null");
   } catch {
     return [];
   }
@@ -281,10 +412,10 @@ export function readUnfinished(storage: Storage): readonly Unfinished[] {
 }
 
 export function writeUnfinished(
-  storage: Storage,
+  storage: AgentStore,
   agents: readonly Unfinished[],
 ) {
-  storage.setItem(UNFINISHED_KEY, JSON.stringify({ version: 1, agents }));
+  return storage.set(UNFINISHED_KEY, JSON.stringify({ version: 1, agents }));
 }
 
 /** `state` for the edited `timer`: unchanged unless it was rearmed. */
@@ -305,10 +436,10 @@ function rearmed(
  * settings keep offering Retry across restarts until a check confirms it. */
 export const ARCHIVE_UNCHECKED_KEY = "buzz.agents.archive-unchecked.v1";
 
-export function readArchiveUnchecked(storage: Storage): Set<string> {
+export function readArchiveUnchecked(storage: AgentStore): Set<string> {
   let stored: unknown;
   try {
-    stored = JSON.parse(storage.getItem(ARCHIVE_UNCHECKED_KEY) ?? "null");
+    stored = JSON.parse(storage.get(ARCHIVE_UNCHECKED_KEY) ?? "null");
   } catch {
     return new Set();
   }
@@ -324,10 +455,10 @@ export function readArchiveUnchecked(storage: Storage): Set<string> {
 }
 
 export function writeArchiveUnchecked(
-  storage: Storage,
+  storage: AgentStore,
   agents: ReadonlySet<string>,
 ) {
-  storage.setItem(
+  return storage.set(
     ARCHIVE_UNCHECKED_KEY,
     JSON.stringify({ version: 1, agents: [...agents] }),
   );
diff --git a/src/features/agents/test-fakes.ts b/src/features/agents/test-fakes.ts
index 5035c194b2..d255c5cc37 100644
--- a/src/features/agents/test-fakes.ts
+++ b/src/features/agents/test-fakes.ts
@@ -1,6 +1,11 @@
-export function memoryStorage(): Storage {
+import { fileStore } from "./state";
+import { localStore, type AgentStore } from "./store";
+
+/** Storage held in memory. It is also agent storage over the same items,
+ * which saves as it is set, so a test can seed and read it either way. */
+export function memoryStorage(): Storage & AgentStore {
   const items = new Map<string, string>();
-  return {
+  const storage: Storage = {
     get length() {
       return items.size;
     },
@@ -10,4 +15,30 @@ export function memoryStorage(): Storage {
     removeItem: (key) => void items.delete(key),
     setItem: (key, value) => void items.set(key, String(value)),
   };
+  return Object.assign(storage, localStore(storage));
+}
+
+/** Agent storage files that programs share. Each program loads its own copy
+ * once, as the app does at start, and then saves into them, adding a key
+ * only where none is, as the native files do. A held program's saves wait
+ * until it is released. */
+export function sharedFiles(initial: Record<string, string> = {}) {
+  const disk = new Map(Object.entries(initial));
+  const open = (hold?: Promise<void>) =>
+    fileStore(
+      new Map(disk),
+      async (key, value) => {
+        await hold;
+        if (value === null) disk.delete(key);
+        else disk.set(key, value);
+      },
+      async (key, value) => {
+        await hold;
+        const held = disk.get(key);
+        if (held !== undefined) return held;
+        disk.set(key, value);
+        return null;
+      },
+    );
+  return { disk, open };
 }
diff --git a/src/main.tsx b/src/main.tsx
index 0b280b27a6..930b41ad1e 100644
--- a/src/main.tsx
+++ b/src/main.tsx
@@ -4,6 +4,7 @@ import "./shared/styles/globals.css";
 import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
 import { createServices } from "./app/services";
+import { loadAgentStorage } from "./features/agents/state";
 import { App } from "./app/App";
 import "@fontsource-variable/inter/wght.css";
 import "@fontsource-variable/inter/wght-italic.css";
@@ -17,22 +18,26 @@ if (!container) {
   throw new Error('Missing <div id="root"> in index.html');
 }
 
-const services = createServices();
-const root = createRoot(container);
-function HostApp() {
-  useKeyboardFocusVisibility();
-  useRejectUnclaimedDrops();
-  return <App services={services} />;
-}
-root.render(
-  <StrictMode>
-    <HostApp />
-  </StrictMode>,
-);
+// Agent storage is read before any service, since its reads are synchronous.
+// It settles, with localStorage at worst, so the window always starts.
+void loadAgentStorage().finally(() => {
+  const services = createServices();
+  const root = createRoot(container);
+  function HostApp() {
+    useKeyboardFocusVisibility();
+    useRejectUnclaimedDrops();
+    return <App services={services} />;
+  }
+  root.render(
+    <StrictMode>
+      <HostApp />
+    </StrictMode>,
+  );
 
-if (import.meta.hot) {
-  import.meta.hot.dispose(() => {
-    root.unmount();
-    void services.dispose().catch(console.error);
-  });
-}
+  if (import.meta.hot) {
+    import.meta.hot.dispose(() => {
+      root.unmount();
+      void services.dispose().catch(console.error);
+    });
+  }
+});
diff --git a/tests/browser/plugin-import.spec.mjs b/tests/browser/plugin-import.spec.mjs
index 0993be5466..0f78cce659 100644
--- a/tests/browser/plugin-import.spec.mjs
+++ b/tests/browser/plugin-import.spec.mjs
@@ -106,6 +106,9 @@ async function nativeImports(page, samples = [], previewOptions = {}) {
           return preview;
         }
         if (command === "plugin_import_discard") return;
+        // Agent storage starts empty; the app saves agent state there.
+        if (command === "app_agent_state_load") return {};
+        if (command === "app_agent_state_set") return;
         if (command === "plugin_import_install") {
           if (window.importInstallError) {
             await new Promise((resolve) => {
diff --git a/tests/browser/updates.spec.mjs b/tests/browser/updates.spec.mjs
index 1b13379e98..032093f5ee 100644
--- a/tests/browser/updates.spec.mjs
+++ b/tests/browser/updates.spec.mjs
@@ -54,6 +54,9 @@ async function nativeUpdater(
               },
             };
           if (command === "plugin_module") return "export function apply() {}";
+          // Agent storage starts empty; the app saves agent state there.
+          if (command === "app_agent_state_load") return {};
+          if (command === "app_agent_state_set") return;
           const plugin = /^plugin:(updater|resources)\|(\w+)$/.exec(command);
           if (!plugin && command !== "update_restart")
             throw new Error(`Unexpected command ${command}`);