diff --git a/docs/users/qwen-serve.md b/docs/users/qwen-serve.md
index d76a8253457..8f4b872f3fc 100644
--- a/docs/users/qwen-serve.md
+++ b/docs/users/qwen-serve.md
@@ -408,7 +408,7 @@ Notes:
 | `--http-bridge`                         | `true`             | Stage 1 mode: production attempts to preheat one primary `qwen --acp` child for compatibility and retries on first use after failure, while each trusted secondary can start one child on demand. Sessions targeting a runtime multiplex onto its child via ACP `newSession()`; untrusted secondaries cannot start ACP. Stage 2 native in-process becomes available later.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `--initialize-timeout-ms <n>`           | `10000`            | ACP child request timeout, including the `initialize` handshake (ms). Must be a positive integer up to `2147483647`. Values above the JS timer ceiling (`2^31-1`) are rejected at boot because Node silently compresses them to 1 ms. Cold-container deployments that need extra headroom for child startup can raise this; the same value governs `newSession`, workspace-status polls, and other ACP ext-method deadlines.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `--allow-origin <pat>`                  | —                  | T2.4 ([#4514](https://github.com/QwenLM/qwen-code/issues/4514)). Cross-origin allowlist for browser webui clients. Repeatable. Each value is `*` (any origin — boot refuses if no bearer token is configured; `--require-auth` on loopback is recommended so `/health` and `/demo` are also bearer-gated, since both are pre-auth on loopback by default) or a canonical URL origin (`<scheme>://<host>[:<port>]`, no trailing slash / path / userinfo / query). **Subdomain wildcards (`https://*.example.com`) are intentionally unsupported** — list each subdomain explicitly, or use `*` with a configured token (and `--require-auth` for full hardening). Matched origins receive CORS response headers (`Access-Control-Allow-Origin`, `Vary: Origin`, methods, headers, max-age, and exposed `Retry-After`); unmatched origins still get a 403 with the same envelope as today's wall. `Origin: null` (sandboxed iframes, file:// docs) is always rejected, even under `*`. Pre-flight via `caps.features.allow_origin`. Loopback self-origin hits are unaffected. |
-| `--web` / `--no-web`                    | `true`             | Serve the built Web Shell SPA at the daemon root (`GET /`, `/assets/*`, and SPA deep-link fallback). The static shell is registered **before** the bearer-auth gate — a browser can't attach a token to a `<script>` subresource or an address-bar navigation, the shell carries no secrets, and every API route stays token-gated regardless. On non-loopback binds a one-line stderr warning notes the UI is reachable without auth. Use `--no-web` for an API-only daemon. No effect when the build omits the Web Shell assets (the daemon logs a breadcrumb and runs API-only).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `--web` / `--no-web`                    | `true`             | Serve the built Web Shell SPA at the daemon root (`GET /`, `/assets/*`, and `GET /session/<id>` document navigations). These entry points are registered **before** the bearer-auth gate — a browser can't attach a token to a `<script>` subresource or an address-bar navigation, and the shell carries no secrets. Every API route stays token-gated regardless, and the SPA deep-link fallback for all other paths sits behind the bearer gate too. On non-loopback binds a one-line stderr warning notes the UI is reachable without auth. Use `--no-web` for an API-only daemon. No effect when the build omits the Web Shell assets (the daemon logs a breadcrumb and runs API-only).                                                                                                                                                                                                                                                                                                                                                                                |
 | `--open`                                | `false`            | After the listener is up, open the Web Shell in your default browser at the daemon URL (with `#token=` appended as a URL fragment when a token is configured — a fragment is never sent to the server, keeping the token out of access logs and Referer headers). No-op with `--no-web`, or in headless / CI / SSH environments where no browser is available.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 > **Memory project scope caveats.**
diff --git a/integration-tests/cli/qwen-serve-streaming.test.ts b/integration-tests/cli/qwen-serve-streaming.test.ts
index a9ab2b2ce8f..4592b0e6f59 100644
--- a/integration-tests/cli/qwen-serve-streaming.test.ts
+++ b/integration-tests/cli/qwen-serve-streaming.test.ts
@@ -49,7 +49,6 @@ const CLI_BIN =
   process.env['TEST_CLI_PATH'] ??
   path.resolve(__dirname, '../../packages/cli/dist/index.js');
 const TOKEN = 'streaming-integ-secret';
-const REPO_ROOT = path.resolve(__dirname, '../..');
 
 // Windows: this suite shells out to `pgrep` / `kill -KILL` to simulate
 // child-process crashes for the SIGKILL → `session_died` test, and those
@@ -78,6 +77,7 @@ let base = '';
 let client: DaemonClient;
 let fakeServer: FakeOpenAIServer;
 let homeDir = '';
+let workspaceDir = '';
 let pendingWritePath = '';
 
 beforeAll(async () => {
@@ -131,6 +131,7 @@ beforeAll(async () => {
       ui: { enableFollowupSuggestions: false },
     }),
   );
+  workspaceDir = mkdtempSync(path.join(tmpdir(), 'qwen-serve-streaming-ws-'));
   daemon = spawn(
     process.execPath,
     [
@@ -143,16 +144,19 @@ beforeAll(async () => {
       '--hostname',
       '127.0.0.1',
       // Per #3803 §02 (1 daemon = 1 workspace), pin the bound
-      // workspace so every `createOrAttachSession({ workspaceCwd:
-      // REPO_ROOT })` below matches. Without this the daemon inherits
-      // the test runner's cwd (CI / IDE-launcher / direct vitest
-      // invocations all differ) and every session create returns
-      // 400 workspace_mismatch — the SSE / permission / Last-Event-ID
-      // tests below would all silently 404. Same fix the sibling routes test
-      // received earlier in this PR — missed in this file in the original §02
-      // pass.
+      // workspace so every `createOrAttachSession({ workspaceCwd })`
+      // below matches. Without this the daemon inherits the test
+      // runner's cwd (CI / IDE-launcher / direct vitest invocations
+      // all differ) and every session create returns 400
+      // workspace_mismatch — the SSE / permission / Last-Event-ID
+      // tests below would all silently 404. A scratch workspace (not
+      // the checkout) also keeps sessions hermetic: the daemon merges
+      // the workspace's `.qwen/settings.json` into every session, and
+      // a stray one on a shared runner (e.g. a `tools.sandbox` mode or
+      // a `tools.core` allowlist missing `todo_write`) silently breaks
+      // the Stop Guard flow below.
       '--workspace',
-      REPO_ROOT,
+      workspaceDir,
     ],
     {
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -211,6 +215,9 @@ afterAll(async () => {
   if (homeDir) {
     rmSync(homeDir, { recursive: true, force: true });
   }
+  if (workspaceDir) {
+    rmSync(workspaceDir, { recursive: true, force: true });
+  }
 }, 15_000);
 
 /** Open an authenticated SSE stream and yield parsed frames. */
@@ -241,7 +248,7 @@ async function* sseFrames(
 describePOSIX('qwen serve — child-crash recovery (real SIGKILL)', () => {
   it('publishes session_died after the qwen --acp child is SIGKILL-ed', async () => {
     const session = await client.createOrAttachSession({
-      workspaceCwd: REPO_ROOT,
+      workspaceCwd: workspaceDir,
     });
 
     // Find the daemon's direct `--acp` child PID.
@@ -295,7 +302,7 @@ describePOSIX('qwen serve — child-crash recovery (real SIGKILL)', () => {
     );
 
     // Listing must NOT show the dead session.
-    const remaining = await client.listWorkspaceSessions(REPO_ROOT);
+    const remaining = await client.listWorkspaceSessions(workspaceDir);
     // Explicit `s` type for resilience against a stale dist .d.ts
     // in the reviewer's tsc env (see same note in routes.test.ts).
     expect(
@@ -306,7 +313,7 @@ describePOSIX('qwen serve — child-crash recovery (real SIGKILL)', () => {
 
     // Retry must spawn fresh, not reuse the corpse.
     const fresh = await client.createOrAttachSession({
-      workspaceCwd: REPO_ROOT,
+      workspaceCwd: workspaceDir,
     });
     expect(fresh.sessionId).not.toBe(session.sessionId);
     expect(fresh.attached).toBe(false);
@@ -316,7 +323,7 @@ describePOSIX('qwen serve — child-crash recovery (real SIGKILL)', () => {
 describePOSIX('qwen serve — multi-client first-responder permission', () => {
   it('fans out permission_request to both subscribers; only one vote wins', async () => {
     const session = await client.createOrAttachSession({
-      workspaceCwd: REPO_ROOT,
+      workspaceCwd: workspaceDir,
     });
 
     // Pin the session to `default` approval mode. The ACP child
@@ -448,7 +455,7 @@ describePOSIX('qwen serve — multi-client first-responder permission', () => {
 describePOSIX('qwen serve — Last-Event-ID resume', () => {
   it('reconnect with Last-Event-ID:N yields events with id > N', async () => {
     const session = await client.createOrAttachSession({
-      workspaceCwd: REPO_ROOT,
+      workspaceCwd: workspaceDir,
     });
 
     // Fire a short prompt to populate the bus.
@@ -494,7 +501,7 @@ describePOSIX('qwen serve — Last-Event-ID resume', () => {
 describePOSIX('qwen serve — daemon Todo Stop Guard replay', () => {
   it('continues after prompt admission without an SSE client and replays the bounded attempts', async () => {
     const session = await client.createOrAttachSession({
-      workspaceCwd: REPO_ROOT,
+      workspaceCwd: workspaceDir,
     });
     const requestStart = fakeServer.requests.length;
     const guardMarker = `todo-guard-e2e-${requestStart}`;
diff --git a/packages/cli/src/serve/run-qwen-serve.test.ts b/packages/cli/src/serve/run-qwen-serve.test.ts
index 54b32cc2ae6..bc1d761fbf7 100644
--- a/packages/cli/src/serve/run-qwen-serve.test.ts
+++ b/packages/cli/src/serve/run-qwen-serve.test.ts
@@ -38,6 +38,8 @@ import type {
 } from '@qwen-code/acp-bridge/bridgeTypes';
 import * as qwenCore from '@qwen-code/qwen-code-core';
 import * as serverModule from './server.js';
+import * as webShellResolver from './web-shell-resolver.js';
+import * as webShellStatic from './web-shell-static.js';
 import * as settingsRuntime from '../config/settings.js';
 import * as environmentRuntime from '../config/environment.js';
 import * as trustedFoldersRuntime from '../config/trustedFolders.js';
@@ -462,6 +464,51 @@ function makeRuntimeBridge(): HttpAcpBridge {
   } as unknown as HttpAcpBridge;
 }
 
+function writeWebShellFixture(workspaceDir: string): string {
+  const shellDir = path.join(workspaceDir, 'web-shell');
+  fs.mkdirSync(path.join(shellDir, 'assets'), { recursive: true });
+  fs.writeFileSync(
+    path.join(shellDir, 'index.html'),
+    '<!doctype html><body><div id="root"></div></body>',
+  );
+  vi.spyOn(webShellResolver, 'resolveWebShellDir').mockReturnValue(shellDir);
+  return shellDir;
+}
+
+async function startDeferredDaemon(
+  workspace: string,
+  overrides: {
+    serveOptions?: Partial<Parameters<typeof runQwenServe>[0]>;
+    createBridge?: () => HttpAcpBridge;
+  } = {},
+) {
+  const createBridge = vi
+    .spyOn(acpBridge, 'createAcpSessionBridge')
+    .mockImplementation(() => {
+      const bridge = overrides.createBridge
+        ? overrides.createBridge()
+        : makeRuntimeBridge();
+      return bridge as ReturnType<typeof acpBridge.createAcpSessionBridge>;
+    });
+  const handle = await runQwenServe(
+    {
+      port: 0,
+      hostname: '127.0.0.1',
+      mode: 'http-bridge',
+      workspace,
+      maxSessions: 1,
+      token: 'secret-token',
+      ...overrides.serveOptions,
+    },
+    {
+      resolveOnListen: true,
+      deferRuntimeUntilFirstHealth: true,
+      runtimeStartupTimeoutMs: 0,
+    },
+  );
+  return { handle, createBridge };
+}
+
 const mockCreateSpawnChannelFactoryOptions = vi.hoisted(
   () => [] as Array<Record<string, unknown>>,
 );
@@ -5019,6 +5066,306 @@ describe('runQwenServe runtime startup failures', () => {
     }
   });
 
+  it('serves Web Shell document navigations during the deferred runtime window', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-webshell-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      // HEAD goes first so the cold deferred gate's pre-auth exemption is
+      // exercised for both methods the warm app serves pre-auth.
+      const headRes = await fetch(`${handle.url}/session/abc`, {
+        method: 'HEAD',
+        headers: { accept: 'text/html' },
+      });
+      expect(headRes.status).toBe(200);
+      expect(headRes.headers.get('content-type')).toContain('text/html');
+
+      // A browser refresh of a session deep link carries no bearer header and
+      // must load the shell (and start the runtime) instead of 401ing in the
+      // deferred gate.
+      const navRes = await fetch(`${handle.url}/session/abc`, {
+        headers: { accept: 'text/html' },
+      });
+      expect(navRes.status).toBe(200);
+      expect(navRes.headers.get('content-type')).toContain('text/html');
+      expect(await navRes.text()).toContain('<div id="root">');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('serves the Web Shell root during the deferred runtime window', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-root-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      // First request to a cold daemon, so the `/` exemption is exercised at
+      // the deferred gate itself — there is no warm-app path it could take.
+      const rootRes = await fetch(`${handle.url}/`);
+      expect(rootRes.status).toBe(200);
+      expect(rootRes.headers.get('content-type')).toContain('text/html');
+      expect(await rootRes.text()).toContain('<div id="root">');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('serves the // root alias during the deferred window like the warm app', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-root-alias-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      // Express non-strict routing matches a raw `//` against `app.get('/')`,
+      // so the warm app serves it pre-auth; the cold gate must exempt it too
+      // instead of 401ing.
+      const aliasRes = await fetch(`${handle.url}//`);
+      expect(aliasRes.status).toBe(200);
+      expect(aliasRes.headers.get('content-type')).toContain('text/html');
+      expect(await aliasRes.text()).toContain('<div id="root">');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('degrades to the bearer gate when the pre-auth predicate rejects', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-predicate-fail-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+    const predicateSpy = vi
+      .spyOn(webShellStatic, 'isPreAuthWebShellRequest')
+      .mockImplementation(() => {
+        throw new Error('predicate module glitch');
+      });
+
+    try {
+      // Without the fail-closed guard, a rejecting predicate 500s the whole
+      // deferred branch. A tokenless navigation must hit the bearer gate...
+      const anonRes = await fetch(`${handle.url}/`, {
+        headers: { accept: 'text/html' },
+      });
+      expect(anonRes.status).toBe(401);
+
+      // ...and a correctly-tokened request must still get through.
+      const authedRes = await fetch(`${handle.url}/session/abc`, {
+        headers: {
+          accept: 'text/html',
+          authorization: 'Bearer secret-token',
+        },
+      });
+      expect(authedRes.status).toBe(200);
+      expect(authedRes.headers.get('content-type')).toContain('text/html');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      predicateSpy.mockRestore();
+      await handle.close();
+    }
+  });
+
+  it('serves Web Shell assets during the deferred runtime window', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-assets-')),
+    );
+    const shellDir = writeWebShellFixture(tmpDir);
+    fs.writeFileSync(
+      path.join(shellDir, 'assets', 'fixture.js'),
+      'console.log("fixture");',
+    );
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      // First request to a cold daemon, so only the predicate's `/assets/`
+      // branch can exempt this from the bearer gate.
+      const assetRes = await fetch(`${handle.url}/assets/fixture.js`);
+      expect(assetRes.status).toBe(200);
+      expect(await assetRes.text()).toContain('console.log("fixture");');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('answers bare /assets during the deferred window like the warm app', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-assets-bare-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      // First request to a cold daemon. Express 5's `app.use('/assets', ...)`
+      // also matches the bare mount path pre-auth — the warm app answers 301
+      // to `/assets/` (then 404) — so the deferred gate must exempt it too
+      // instead of 401ing.
+      const bareRes = await fetch(`${handle.url}/assets`, {
+        redirect: 'manual',
+      });
+      expect(bareRes.status).toBe(301);
+      expect(bareRes.headers.get('location')).toBe('/assets/');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('serves trailing-slash and case-variant session deep links during the deferred window', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-shapes-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      // The warm app serves this shape pre-auth (Express matches routes
+      // case-insensitively and non-strictly by default), so the cold gate
+      // must exempt it too instead of 401ing the refresh.
+      const navRes = await fetch(`${handle.url}/Session/abc/`, {
+        headers: { accept: 'text/html' },
+      });
+      expect(navRes.status).toBe(200);
+      expect(navRes.headers.get('content-type')).toContain('text/html');
+      expect(await navRes.text()).toContain('<div id="root">');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('serves query-carrying session deep links during the deferred window', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-query-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      // First request to a cold daemon, with a query string (a real
+      // deep-link refresh shape). The predicate matches on `req.path`, which
+      // strips the query — pinning the gate against a mutation to `req.url`
+      // that would 401 the refresh.
+      const queryRes = await fetch(`${handle.url}/session/abc/?ref=1`, {
+        headers: { accept: 'text/html' },
+      });
+      expect(queryRes.status).toBe(200);
+      expect(queryRes.headers.get('content-type')).toContain('text/html');
+      expect(await queryRes.text()).toContain('<div id="root">');
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).resolves.toBeUndefined();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('keeps JSON and API-subpath requests gated during the deferred runtime window', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-webshell-gate-')),
+    );
+    writeWebShellFixture(tmpDir);
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir);
+
+    try {
+      const jsonRes = await fetch(`${handle.url}/session/abc`, {
+        headers: { accept: 'application/json' },
+      });
+      expect(jsonRes.status).toBe(401);
+
+      const apiRes = await fetch(`${handle.url}/session/abc/status`, {
+        headers: { accept: 'text/html' },
+      });
+      expect(apiRes.status).toBe(401);
+
+      expect(createBridge).not.toHaveBeenCalled();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('keeps session document navigations gated during the deferred window with --no-web', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-noweb-')),
+    );
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir, {
+      serveOptions: { serveWebShell: false },
+    });
+
+    try {
+      const navRes = await fetch(`${handle.url}/session/abc`, {
+        headers: { accept: 'text/html' },
+      });
+      expect(navRes.status).toBe(401);
+      expect(createBridge).not.toHaveBeenCalled();
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('answers pre-auth Web Shell navigations with the failure envelope when the deferred runtime fails', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-deferred-webshell-fail-')),
+    );
+    writeWebShellFixture(tmpDir);
+    vi.spyOn(qwenCore, 'resolveTelemetrySettings').mockResolvedValue({
+      enabled: false,
+      sensitiveSpanAttributeMaxLength: 1024 * 1024,
+    });
+    const { handle, createBridge } = await startDeferredDaemon(tmpDir, {
+      createBridge: () => {
+        throw new Error('runtime boom');
+      },
+    });
+
+    try {
+      // These paths are declared pre-auth, so on a startup failure they must
+      // report the real fault instead of the bootstrap bearer gate's 401.
+      const navRes = await fetch(`${handle.url}/session/abc`, {
+        headers: { accept: 'text/html' },
+      });
+      expect(navRes.status).toBe(503);
+      expect(await navRes.json()).toEqual({
+        error: 'Daemon runtime failed to start',
+        code: 'daemon_runtime_failed',
+      });
+
+      const rootRes = await fetch(`${handle.url}/`);
+      expect(rootRes.status).toBe(503);
+      expect(await rootRes.json()).toEqual({
+        error: 'Daemon runtime failed to start',
+        code: 'daemon_runtime_failed',
+      });
+
+      // Non-exempted requests stay behind the bearer gate.
+      const jsonRes = await fetch(`${handle.url}/session/abc`, {
+        headers: { accept: 'application/json' },
+      });
+      expect(jsonRes.status).toBe(401);
+
+      expect(createBridge).toHaveBeenCalledTimes(1);
+      await expect(handle.runtimeReady).rejects.toThrow('runtime boom');
+    } finally {
+      await handle.close();
+    }
+  });
+
   it('starts deferred runtime for webhook routes without bearer auth', async () => {
     tmpDir = fs.realpathSync(
       fs.mkdtempSync(path.join(os.tmpdir(), 'qws-runtime-webhook-start-')),
diff --git a/packages/cli/src/serve/run-qwen-serve.ts b/packages/cli/src/serve/run-qwen-serve.ts
index f5435259e5c..275e58081ca 100644
--- a/packages/cli/src/serve/run-qwen-serve.ts
+++ b/packages/cli/src/serve/run-qwen-serve.ts
@@ -1430,6 +1430,21 @@ const BOOTSTRAP_SERVE_PATHS = new Set([
   BOOTSTRAP_DAEMON_STATUS_PATH,
 ]);
 
+const RUNTIME_STARTUP_FAILED_ENVELOPE = {
+  error: 'Daemon runtime failed to start',
+  code: 'daemon_runtime_failed',
+} as const;
+const RUNTIME_STARTUP_STARTING_ENVELOPE = {
+  error: 'Daemon runtime is still starting',
+  code: 'daemon_runtime_starting',
+} as const;
+
+function runtimeStartupEnvelope(runtimeError: string | undefined) {
+  return runtimeError
+    ? RUNTIME_STARTUP_FAILED_ENVELOPE
+    : RUNTIME_STARTUP_STARTING_ENVELOPE;
+}
+
 function createBootstrapServeApp(input: {
   opts: ServeOptions;
   getPort: () => number;
@@ -1512,14 +1527,7 @@ function createBootstrapServeApp(input: {
       if (runtimeError === undefined) {
         res.setHeader('Retry-After', '1');
       }
-      res.status(503).json({
-        error: runtimeError
-          ? 'Daemon runtime failed to start'
-          : 'Daemon runtime is still starting',
-        code: runtimeError
-          ? 'daemon_runtime_failed'
-          : 'daemon_runtime_starting',
-      });
+      res.status(503).json(runtimeStartupEnvelope(runtimeError));
       return;
     }
     res.status(200).json(
@@ -1698,13 +1706,7 @@ function createBootstrapServeApp(input: {
   });
 
   app.use((_req: Request, res: Response): void => {
-    const runtimeError = getRuntimeError();
-    res.status(503).json({
-      error: runtimeError
-        ? 'Daemon runtime failed to start'
-        : 'Daemon runtime is still starting',
-      code: runtimeError ? 'daemon_runtime_failed' : 'daemon_runtime_starting',
-    });
+    res.status(503).json(runtimeStartupEnvelope(getRuntimeError()));
   });
 
   return app;
@@ -1719,6 +1721,7 @@ function createDelegatingServeApp(
     runtimeReady?: Promise<void>;
     authenticateDeferredRuntimeRequest?: RequestHandler;
     authenticateDeferredChannelWebhookRequest?: RequestHandler;
+    isPreAuthRequest?: (req: Request) => boolean | Promise<boolean>;
   } = {},
 ): Application {
   const app = express();
@@ -1743,7 +1746,14 @@ function createDelegatingServeApp(
           ? (options.authenticateDeferredChannelWebhookRequest ??
             options.authenticateDeferredRuntimeRequest)
           : options.authenticateDeferredRuntimeRequest;
-        if (authGate) {
+        // A rejecting predicate must not 500 every deferred request —
+        // fail closed to the bearer gate instead.
+        const preAuthExempted =
+          authGate !== undefined &&
+          (await Promise.resolve(options.isPreAuthRequest?.(req)).catch(
+            () => false,
+          )) === true;
+        if (authGate && !preAuthExempted) {
           if (!runSynchronousRequestGate(authGate, req, res, next)) {
             return;
           }
@@ -1755,6 +1765,13 @@ function createDelegatingServeApp(
         try {
           await options.runtimeReady;
         } catch {
+          if (preAuthExempted) {
+            // The bootstrap app serves the failure envelope only behind its
+            // bearer gate, which a pre-auth navigation cannot pass — answer
+            // here so the browser sees the startup failure, not a 401.
+            res.status(503).json(RUNTIME_STARTUP_FAILED_ENVELOPE);
+            return;
+          }
           // Fall through to the bootstrap app so it can report the startup error.
         } finally {
           timing.waitMs =
@@ -5809,6 +5826,17 @@ async function runQwenServeImpl(
       runtimeReady,
       authenticateDeferredRuntimeRequest: bearerAuth(opts.token),
       authenticateDeferredChannelWebhookRequest: deferredChannelWebhookAuth,
+      // The runtime app serves these before bearerAuth; a browser navigation
+      // cannot attach the bearer header, so the cold gate must let them
+      // through (and start the runtime) exactly like the warm app would.
+      // Dynamic import keeps web-shell-static out of the serve fast-path
+      // static closure (see the import-boundary guards in fast-path.test.ts).
+      isPreAuthRequest: webShellMounted
+        ? (req) =>
+            import('./web-shell-static.js').then((webShellStatic) =>
+              webShellStatic.isPreAuthWebShellRequest(req),
+            )
+        : undefined,
     });
 
   // Node's `app.listen()` wants the unbracketed IPv6 literal (`::1`) but
diff --git a/packages/cli/src/serve/server.test.ts b/packages/cli/src/serve/server.test.ts
index f933a46aec7..ac168e15ac3 100644
--- a/packages/cli/src/serve/server.test.ts
+++ b/packages/cli/src/serve/server.test.ts
@@ -3114,6 +3114,17 @@ describe('createServeApp', () => {
       expect(res.headers['cache-control']).toContain('no-cache');
     });
 
+    it('serves the shell for a // root request pre-auth (non-strict routing)', async () => {
+      // Express non-strict routing matches a raw `//` against `app.get('/')`
+      // too; the deferred gate's isPreAuthWebShellRequest mirrors this shape.
+      const app = createServeApp({ ...baseOpts, token: 'secret' }, undefined, {
+        webShellDir,
+      });
+      const res = await request(app).get('//').set('Host', host);
+      expect(res.status).toBe(200);
+      expect(res.text).toContain('<div id="root">');
+    });
+
     it('allows configured extension origins to frame the shell without self-framing', async () => {
       const app = createServeApp(
         {
@@ -3151,7 +3162,7 @@ describe('createServeApp', () => {
       expect(res.text).not.toContain('<div id="root">');
     });
 
-    it('falls back to the shell for SPA deep-link navigations', async () => {
+    it('serves the shell for /session/:id document navigations (pre-auth route)', async () => {
       const app = createServeApp(baseOpts, undefined, { webShellDir });
       const res = await request(app)
         .get('/session/abc123')
@@ -3161,6 +3172,86 @@ describe('createServeApp', () => {
       expect(res.text).toContain('<div id="root">');
     });
 
+    it('serves the shell for GET and HEAD /session/:id document navigations', async () => {
+      const app = createServeApp({ ...baseOpts, token: 'secret' }, undefined, {
+        webShellDir,
+      });
+      const shell = await request(app)
+        .get('/session/abc123')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(shell.status).toBe(200);
+      expect(shell.text).toContain('<div id="root">');
+
+      const head = await request(app)
+        .head('/session/abc123')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(head.status).toBe(200);
+      expect(head.headers['content-type']).toContain('text/html');
+
+      // Express non-strict routing: a refresh URL with a trailing slash is a
+      // real client shape and must load the shell too.
+      const trailingSlash = await request(app)
+        .get('/session/abc123/')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(trailingSlash.status).toBe(200);
+      expect(trailingSlash.text).toContain('<div id="root">');
+    });
+
+    it('serves the shell for /session/:id on a sec-fetch-only navigation signal', async () => {
+      // A refresh navigates with `Sec-Fetch-Mode: navigate` and no HTML
+      // Accept prefix; the pre-auth route must honor the full
+      // isDocumentNavigation signal or this exact flow falls through to
+      // bearerAuth and 401s.
+      const app = createServeApp({ ...baseOpts, token: 'secret' }, undefined, {
+        webShellDir,
+      });
+      const res = await request(app)
+        .get('/session/abc123')
+        .set('Host', host)
+        .set('Accept', '*/*')
+        .set('Sec-Fetch-Mode', 'navigate');
+      expect(res.status).toBe(200);
+      expect(res.text).toContain('<div id="root">');
+    });
+
+    it('401s /session/:id for JSON requests', async () => {
+      const app = createServeApp({ ...baseOpts, token: 'secret' }, undefined, {
+        webShellDir,
+      });
+      const res = await request(app)
+        .get('/session/abc123')
+        .set('Host', host)
+        .set('Accept', 'application/json');
+      expect(res.status).toBe(401);
+    });
+
+    it('401s session API subpaths', async () => {
+      const app = createServeApp({ ...baseOpts, token: 'secret' }, undefined, {
+        webShellDir,
+      });
+      const res = await request(app)
+        .get('/session/abc123/status')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(res.status).toBe(401);
+    });
+
+    it('401s /session/:id document navigations when the shell is disabled', async () => {
+      const app = createServeApp(
+        { ...baseOpts, token: 'secret', serveWebShell: false },
+        undefined,
+        { webShellDir },
+      );
+      const res = await request(app)
+        .get('/session/abc123')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(res.status).toBe(401);
+    });
+
     it('leaves non-navigation API misses as JSON 404s', async () => {
       const app = createServeApp(baseOpts, undefined, { webShellDir });
       const res = await request(app)
@@ -3207,7 +3298,7 @@ describe('createServeApp', () => {
     it('falls back to the shell on a sec-fetch navigation signal', async () => {
       const app = createServeApp(baseOpts, undefined, { webShellDir });
       const res = await request(app)
-        .get('/session/deep')
+        .get('/deep/link')
         .set('Host', host)
         .set('Accept', '*/*')
         .set('Sec-Fetch-Mode', 'navigate');
@@ -3215,6 +3306,19 @@ describe('createServeApp', () => {
       expect(res.text).toContain('<div id="root">');
     });
 
+    it('falls back to the shell for non-session SPA deep-link navigations', async () => {
+      // The pre-auth `/session/:id` route claims the session deep-link shapes
+      // above, so these non-session navigations are the direct coverage of
+      // mountWebShellSpaFallback's shell branch.
+      const app = createServeApp(baseOpts, undefined, { webShellDir });
+      const res = await request(app)
+        .get('/deep/link')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(res.status).toBe(200);
+      expect(res.text).toContain('<div id="root">');
+    });
+
     it('does not shadow /health on a browser navigation (Critical #1)', async () => {
       // Non-loopback + requireAuth registers /health POST-auth. A browser
       // navigation (Accept text/html) must fall THROUGH the SPA fallback to
diff --git a/packages/cli/src/serve/server.ts b/packages/cli/src/serve/server.ts
index f06b738ff1e..8ea44491a7f 100644
--- a/packages/cli/src/serve/server.ts
+++ b/packages/cli/src/serve/server.ts
@@ -1568,7 +1568,9 @@ export function createServeApp(
   // API calls still carry the bearer (getDaemonAuthHeaders) and every API
   // route below stays token-gated. The SPA deep-link fallback is registered
   // LATER (after all API routes, see mountWebShellSpaFallback) so authed
-  // routes win over the shell. The assets dir is resolved by the caller
+  // routes win over the shell. Exact `/session/:id` document navigations are
+  // mounted here too because a browser refresh cannot attach the bearer header
+  // before the shell loads. The assets dir is resolved by the caller
   // (runQwenServe) and injected via deps.webShellDir; `--no-web` sets
   // opts.serveWebShell=false to opt out.
   const webShellDir =
diff --git a/packages/cli/src/serve/web-shell-static.ts b/packages/cli/src/serve/web-shell-static.ts
index df0b2b47aa7..f65ee9ddf73 100644
--- a/packages/cli/src/serve/web-shell-static.ts
+++ b/packages/cli/src/serve/web-shell-static.ts
@@ -77,6 +77,43 @@ export function isDocumentNavigation(req: Request): boolean {
   );
 }
 
+/**
+ * Exact session deep-link document navigations: `/session/<id>` with an
+ * optional trailing slash and no further segments. Expressed as a regex (not
+ * an Express route) so callers outside the runtime app — the deferred-runtime
+ * gate in `run-qwen-serve.ts` — can apply the same discriminator.
+ */
+const SESSION_DEEP_LINK_PATH = /^\/session\/[^/]+\/?$/u;
+
+/**
+ * True when the request matches a route `mountWebShellAssets` registers
+ * BEFORE `bearerAuth`. The deferred-runtime gate in `createDelegatingServeApp`
+ * exempts exactly these so a cold daemon answers the shell's entry points the
+ * same way the warm runtime app does, instead of 401ing browser navigations
+ * that cannot attach the bearer header. Percent-encoded single-segment deep
+ * links (e.g. `/session/<id>%2fstatus`) also match — Express does not decode
+ * `%2F` during route matching — but they cannot reach an API route or session
+ * data: pre-auth answers serve only the public shell HTML, identical to
+ * `GET /` (or the startup-failure envelope). Keep in sync with the routes
+ * registered in `mountWebShellAssets`.
+ */
+export function isPreAuthWebShellRequest(req: Request): boolean {
+  if (req.method !== 'GET' && req.method !== 'HEAD') return false;
+  // Express route matching is case-insensitive by default, so the warm app
+  // serves /Session/<id> and /Assets/* pre-auth too; mirror that exactly.
+  const reqPath = req.path.toLowerCase();
+  if (
+    reqPath === '/' ||
+    // Express non-strict routing compiles `/` to `/^(?:\/)(?:\/$)?$/i`, so
+    // a raw `//` also matches `app.get('/')` pre-auth (but `///` does not).
+    reqPath === '//' ||
+    reqPath === '/assets' ||
+    reqPath.startsWith('/assets/')
+  )
+    return true;
+  return SESSION_DEEP_LINK_PATH.test(reqPath) && isDocumentNavigation(req);
+}
+
 /**
  * Build the `index.html` responder for a Web Shell dir. Sets the security
  * headers + a no-cache policy (a redeploy changes the hashed asset names
@@ -149,6 +186,11 @@ function createSendIndex(
  *
  *  - `GET /assets/*` — hashed, immutable build chunks (long-cache).
  *  - `GET /` — the HTML shell, always (so `curl /` shows the UI too).
+ *  - `GET /session/:id` document navigations — the HTML shell, so a browser
+ *    refresh can load before the front-end adds its bearer header.
+ *
+ * `isPreAuthWebShellRequest` encodes this same surface for the
+ * deferred-runtime gate; keep the two in sync.
  *
  * Caller must have already verified `webShellDir` exists.
  */
@@ -183,10 +225,14 @@ export function mountWebShellAssets(
     res.status(404).type('text/plain').send('Not found');
   });
   app.get('/', (_req: Request, res: Response) => sendIndex(res));
+  app.get('/session/:id', (req: Request, res: Response, next: NextFunction) => {
+    if (!isDocumentNavigation(req)) return next();
+    sendIndex(res);
+  });
 }
 
 /**
- * Mount the SPA deep-link fallback (for navigations like `/session/<id>`).
+ * Mount the SPA deep-link fallback for routes not explicitly mounted above.
  * Registered AFTER all API routes — just before the error handler — so real
  * routes, INCLUDING their `bearerAuth` 401s, always win and only genuine 404
  * misses fall through to the shell.
@@ -195,7 +241,12 @@ export function mountWebShellAssets(
  * attacker-controlled `Accept: text/html` to an authed route (e.g.
  * `/capabilities`, `/health` on a non-loopback bind) hits that route's real
  * response / 401, not this shell. Because real routes run first, no per-path
- * denylist is needed.
+ * denylist is needed. The one exception is exact `/session/:id` document
+ * navigations, which `mountWebShellAssets` claims BEFORE auth so a browser
+ * refresh can load the shell. That stays safe because the route matches a
+ * single path segment only, serves only document navigations, and there is no
+ * `GET /session/:id` API route for it to shadow — API subpaths like
+ * `/session/:id/status` still hit `bearerAuth`.
  *
  * Only GET/HEAD document navigations are claimed; API fetches send
  * `Accept: application/json`, fail `isDocumentNavigation`, and fall through to