@@ -15,6 +15,7 @@ import {
 import { manageTasksDefinition } from "./tasks.js";
 import { validateView } from "../tui/view/validate.js";
 import { SETTINGS_DIR_NAME } from "../branding.js";
+import { startBoundMcpHandshake } from "../exec/mcp-handshake.js";
 import {
   advertiseShellGuardTimeout,
   type ShellTimeoutConfig,
@@ -312,6 +313,10 @@ export interface MCPConnectCallbacks {
   // Headless hosts must not advertise an auth callback they cannot complete;
   // its presence marks the OAuth flow as interactive.
   interactiveAuth: boolean;
+  // The TUI sets this so a dial abort (the 15s handshake cap) is dropped once
+  // the browser auth URL is showing. The browser-auth budget and a real
+  // cancel still bound that wait. Headless leaves it unset.
+  browserAuthOutlivesDialAbort?: boolean;
   // Fired whenever a server's connection state changes.
   onStatus: (state: MCPServerState) => void;
   // Fired after a server connects and its tools register, with the full
@@ -1269,6 +1274,7 @@ export async function createAgentToolset(
           return;
         }
       }
+      startBoundMcpHandshake(signal);
       if (staleOrDisabled()) return;
       callbacks.onStatus({ name: config.name, state: "connecting" });
       let result: MCPConnectResult;
@@ -1279,6 +1285,12 @@ export async function createAgentToolset(
           ...(callbacks.interactiveAuth
             ? {
                 onAuthURL: (name: string, url: string) => {
+                  // The parent signal is the dial cap plus exit. Once the
+                  // operator has an auth URL, that cap must not close the
+                  // redirect or burn the single browser attempt. Dispose and
+                  // per-server cancel stay on connectionSignal.
+                  if (callbacks.browserAuthOutlivesDialAbort === true)
+                    forwarded?.disarm();
                   if (!disposed && !staleOrDisabled()) {
                     callbacks.onStatus({ name, state: "needs-auth", url });
                   }
 
@@ -25,26 +25,56 @@ export async function awaitExecMcpConnect(
   }
 }
 
+const deferredHandshakeStarts = new WeakMap<AbortSignal, () => void>();
+
+export function bindDeferredMcpHandshake(
+  signal: AbortSignal,
+  start: () => void,
+): void {
+  deferredHandshakeStarts.set(signal, start);
+}
+
+// First post-trust dial starts a deferred cap. Later servers in the same
+// batch share that window. Unbound signals (headless) are already armed.
+export function startBoundMcpHandshake(signal: AbortSignal | undefined): void {
+  if (signal === undefined) return;
+  const start = deferredHandshakeStarts.get(signal);
+  if (start === undefined) return;
+  deferredHandshakeStarts.delete(signal);
+  start();
+}
+
 // Connect-only abort. The MCP client ties `signal` to the transport lifecycle,
 // so AbortSignal.timeout would kill a handshake that already succeeded. The
 // toolset forwards this signal per server and detaches on settle, so abort
 // only reaches handshakes still in flight. Disarm only when the batch
 // fulfills — a rejected Promise.all still leaves sibling forwards armed.
-export function armExecMcpHandshakeAbort(timeoutMs: number): {
+// `when` "later" does not start the timer until `start` (TUI trust gate).
+export function armExecMcpHandshakeAbort(
+  timeoutMs: number,
+  when: "now" | "later" = "now",
+): {
   signal: AbortSignal;
   disarm: () => void;
+  start: () => void;
 } {
   const controller = new AbortController();
-  const timer = setTimeout(() => {
-    controller.abort();
-  }, timeoutMs);
+  let timer: ReturnType<typeof setTimeout> | undefined;
   let disarmed = false;
+  const start = (): void => {
+    if (disarmed || timer !== undefined) return;
+    timer = setTimeout(() => {
+      controller.abort();
+    }, timeoutMs);
+  };
+  if (when === "now") start();
   return {
     signal: controller.signal,
+    start,
     disarm: () => {
       if (disarmed) return;
       disarmed = true;
-      clearTimeout(timer);
+      if (timer !== undefined) clearTimeout(timer);
     },
   };
 }
 
@@ -13,7 +13,7 @@ import {
   TokenUsage,
   type ConversationTurn,
   type PendingOperation,
-} from "@intx/types/runtime";
+} from "@intx/types/runtime-core";
 import { getLogger } from "@intx/log";
 import {
   createSegmentedJSONLWriter,
 
@@ -3,7 +3,7 @@ import {
   ApprovalSnapshot,
   type PendingOperation,
   ToolCall,
-} from "@intx/types/runtime";
+} from "@intx/types/runtime-core";
 
 /**
  * A pending operation as it rests in session state (metadata.json, or a turn
 
@@ -1,34 +1,74 @@
-import { describe, expect, test } from "bun:test";
+// Loading the @intx/types/runtime barrel evaluates inference-events.ts and
+// builds the InferenceEvent union. Session modules that need runtime values
+// import @intx/types/runtime-core so that boot does not pay for the union.
+
+import { expect, test } from "bun:test";
 import { spawnSync } from "node:child_process";
+import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-const repoRoot = fileURLToPath(new URL("../..", import.meta.url));
-
-function probeImport(specifier: string): number | null {
-  const script = `
-    import { mock } from "bun:test";
-    mock.module("@intx/types/inference-events", () => {
-      throw new Error("evaluated-inference-events");
-    });
-    await import(${JSON.stringify(specifier)});
-  `;
-  const result = spawnSync("bun", ["-e", script], {
+const repoRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../..",
+);
+
+const probe = `
+import { mock } from "bun:test";
+mock.module("@intx/types/inference-events", () => {
+  throw new Error("evaluated-inference-events");
+});
+const specifier = process.env.PROBE_SPECIFIER;
+if (specifier === undefined || specifier.length === 0) {
+  throw new Error("missing PROBE_SPECIFIER");
+}
+for (const target of specifier.split(",")) {
+  await import(target);
+}
+`;
+
+function importUnderProbe(specifier: string): {
+  status: number | null;
+  stderr: string;
+} {
+  const result = spawnSync("bun", ["-e", probe], {
     cwd: repoRoot,
     encoding: "utf8",
+    env: { ...process.env, PROBE_SPECIFIER: specifier },
   });
-  if (
-    result.status !== 0 &&
-    !`${result.stderr}${result.stdout}`.includes("evaluated-inference-events")
-  ) {
-    throw new Error(
-      `probe of ${specifier} failed without evaluated-inference-events:\n${result.stderr}\n${result.stdout}`,
-    );
-  }
-  return result.status;
+  return {
+    status: result.status,
+    stderr: result.stderr,
+  };
 }
 
-describe("runtime-core import boundary", () => {
-  test("importing reactor-authorize does not evaluate inference-events", () => {
-    expect(probeImport("./src/permission/reactor-authorize.ts")).toBe(0);
-  });
+const sessionBootModules = [
+  "./src/session/optimized-context-store.ts",
+  "./src/session/pending-approval-record.ts",
+  "./src/session/summarizer.ts",
+].join(",");
+
+test("the runtime barrel evaluates the inference event union", () => {
+  const result = importUnderProbe("@intx/types/runtime");
+  expect(result.status).not.toBe(0);
+  expect(result.stderr).toContain("evaluated-inference-events");
 });
+
+test(
+  "session value imports do not evaluate the inference event union",
+  () => {
+    const result = importUnderProbe(sessionBootModules);
+    expect(result.stderr).not.toContain("evaluated-inference-events");
+    expect(result.status).toBe(0);
+  },
+  { timeout: 60_000 },
+);
+
+test(
+  "importing reactor-authorize does not evaluate inference-events",
+  () => {
+    const result = importUnderProbe("./src/permission/reactor-authorize.ts");
+    expect(result.stderr).not.toContain("evaluated-inference-events");
+    expect(result.status).toBe(0);
+  },
+  { timeout: 60_000 },
+);
@@ -14,7 +14,7 @@ import {
   type ConversationTurn,
   type InferenceSource,
   type RetryPolicy,
-} from "@intx/types/runtime";
+} from "@intx/types/runtime-core";
 import { LOG_NAMESPACE_ROOT } from "../branding.js";
 import { NOOP_TELEMETRY, type Telemetry } from "../telemetry/index.js";
 import {