@@ -425,20 +425,37 @@ async function renewSession(endpoint) {
 	// Not applied: the stored session is no longer the one this request was about — a sign-in, a
 	// sign-out, another refresh that finished first, or another window. What the caller needs is
 	// whether a token is in place to retry with.
-	const token = await ctx.secrets.get(ACCOUNT_TOKEN_KEY);
+	const token = await storedToken();
 	dbg('cloud.refresh', { superseded: true, outcome, token: !!token });
-	if (!token && cloudSignedIn) {
-		// Gone, and not by this window's hand — a sign-out or an expiry HERE clears the flag before it
-		// deletes anything. Another window got there first, so this one catches up: the card if the
-		// session ended, and a popover and footer that stop claiming it is live either way.
-		cloudSignedIn = false;
-		if (sessionExpiredPending()) { postSessionExpired(); }
-		await postAccount(false);
-		sendConfigToWebview();
-	}
+	if (!!token !== cloudSignedIn) { await catchUpWithStoredSession(token); }
 	return !!token;
 }
 
+/**
+ * The stored access token, read between session changes rather than in the middle of one. Every
+ * change this window makes moves the token and `cloudSignedIn` together inside the lock, so a token
+ * read this way that disagrees with the flag was changed by ANOTHER window.
+ */
+function storedToken() {
+	return withSessionLock(() => ctx.secrets.get(ACCOUNT_TOKEN_KEY));
+}
+
+/**
+ * The stored session belongs to every window, and a window only hears about the changes it makes
+ * itself. When what is stored stops matching what this window is showing, another window has signed
+ * out, signed in, or found the expiry — and a chat that is already open sends no second `ready` to
+ * notice. Bring this window level: the flag, the popover and footer, and the card. An expiry that
+ * is now waiting gets its card; if none is (the other window signed in), the account message takes
+ * a card that is still up back down.
+ * @param {string|undefined} token what SecretStorage holds now
+ */
+async function catchUpWithStoredSession(token) {
+	cloudSignedIn = !!token;
+	if (!token && sessionExpiredPending()) { postSessionExpired(); }
+	await postAccount(false);
+	sendConfigToWebview();
+}
+
 /**
  * Every change to the stored session — a sign-in, a sign-out, a refresh's new tokens, an expiry —
  * runs through here, one at a time.
@@ -579,11 +596,21 @@ async function clearSessionExpired() {
  *     resumed session (both post `reset`, which empties the log) and a checkpoint restore (which
  *     drops every node after the restored turn). Each takes the card with it, and the next message
  *     would be stopped by an expiry nothing on screen mentions any more.
+ *
+ * Never rejects. It runs at the end of things that have already done their work — a resume, a
+ * restore — and a store that will not read is no reason to cut those short.
  */
 async function replaySessionExpired() {
-	if (!sessionExpiredPending() || await ctx.secrets.get(ACCOUNT_TOKEN_KEY)) { return; }
-	dbg('cloud.sessionExpired.replay', {});
-	postSessionExpired();
+	if (!sessionExpiredPending()) { return; }
+	try {
+		const token = await ctx.secrets.get(ACCOUNT_TOKEN_KEY);
+		// Asked AGAIN, because the answer can change while that read is out: "Use my own key instead"
+		// clears the marker, a Settings change takes the session out of play. Posting on the earlier
+		// answer would put back a card the user has just dismissed.
+		if (token || !sessionExpiredPending()) { return; }
+		dbg('cloud.sessionExpired.replay', {});
+		postSessionExpired();
+	} catch (e) { dbg('cloud.sessionExpired.replay', { error: String((e && e.message) || e) }); }
 }
 
 /**
@@ -592,19 +619,32 @@ async function replaySessionExpired() {
  *
  * Cheap by design: the access token's own `exp` is read locally and the network is only touched
  * when it is expired or about to be. A session with hours left costs nothing here. Called on the
- * webview's `ready` and again when the window regains focus after a while away.
+ * webview's `ready` and again every time the window regains focus.
+ *
+ * Two halves. Catching up with the other windows is one local read, so it happens on every call.
+ * The half that can cost a request is rationed on focus. Never rejects: `ready` awaits this before
+ * it restores the chat.
  */
+const SESSION_CHECK_EVERY_MS = 10 * 60 * 1000;
 let lastSessionCheck = 0;
 async function checkCloudSession(reason) {
 	if (!ctx || providerMode() !== 'gateway') { return; }
-	const token = await ctx.secrets.get(ACCOUNT_TOKEN_KEY);
-	// No token, so no session to check. One that already ENDED — found while no chat was open to hear
-	// about it — is not announced from here: `ready` replays it last, via replaySessionExpired().
-	if (!token) { return; }
-	lastSessionCheck = Date.now();
-	if (!session.accessNeedsRefresh(token)) { return; }
-	dbg('cloud.sessionCheck', { reason, expiresAt: session.jwtExpiresAt(token) });
-	await refreshCloudToken();   // an expired refresh token lands in sessionExpired() from inside
+	try {
+		const token = await storedToken();
+		// First, whether this window is still showing the session that is actually stored. On `ready`
+		// there is nothing to catch up on — the handler has just read the same token — and an expiry
+		// found while no chat was open is replayed LAST there, by replaySessionExpired(). On focus this
+		// is what tells an open chat that another window has ended, left or renewed the session.
+		if (!!token !== cloudSignedIn) { await catchUpWithStoredSession(token); }
+		if (!token) { return; }
+		// From here on it can cost a request, so focus gets a ration: a window clicked in and out of
+		// while offline must not retry the refresh on every click.
+		if (reason === 'focus' && Date.now() - lastSessionCheck <= SESSION_CHECK_EVERY_MS) { return; }
+		lastSessionCheck = Date.now();
+		if (!session.accessNeedsRefresh(token)) { return; }
+		dbg('cloud.sessionCheck', { reason, expiresAt: session.jwtExpiresAt(token) });
+		await refreshCloudToken();   // an expired refresh token lands in sessionExpired() from inside
+	} catch (e) { dbg('cloud.sessionCheck', { reason, error: String((e && e.message) || e) }); }
 }
 
 /** Gateway-mode token refresh (the streaming 401 retry path). Delegates to refreshCloudToken. */
@@ -1432,7 +1472,7 @@ function newChat() {
 	post({ type: 'reset' });
 	postContextFiles();
 	postMemoryDigest();                    // the fresh empty state shows the welcome-back strip
-	replaySessionExpired().catch(() => { });   // `reset` emptied the log, and an unanswered expiry's card with it
+	replaySessionExpired();                // `reset` emptied the log, and an unanswered expiry's card with it
 }
 
 /** The currently open file as a context block (capped), or null. */
@@ -3293,15 +3333,17 @@ function onConfigChanged(e) {
 	if (e.affectsConfiguration('levelcode.ai')) { sendConfigToWebview(); }
 	if (e.affectsConfiguration('levelcode.ai.providerMode') || e.affectsConfiguration('levelcode.cloud')) {
 		postAccount();
-		replaySessionExpired().catch(() => { });
+		replaySessionExpired();
 	}
 }
 
 function activate(context) {
-	// A window that comes back after a while away may have outlived its access token (8 h). Re-check
-	// on focus, throttled, so the expiry is found before the next message rather than by it.
+	// A window that comes back after a while away may have outlived its access token (8 h) — or
+	// another window may have ended, left or renewed the session they share. Re-check on every focus,
+	// so either is found before the next message rather than by it. The look is one local read;
+	// checkCloudSession rations the part that can cost a request.
 	context.subscriptions.push(vscode.window.onDidChangeWindowState((st) => {
-		if (st.focused && Date.now() - lastSessionCheck > 10 * 60 * 1000) { checkCloudSession('focus').catch(() => {}); }
+		if (st.focused) { checkCloudSession('focus'); }
 	}));
 	ctx = context;
 	// Constructed directly rather than by registerWebviewViewProvider: the chat is no longer a
 
@@ -22,6 +22,8 @@
  *    - the account message tells the webview whether an expiry is still waiting, so the card leaves
  *      when BYOK is chosen in Settings and comes back if gateway mode is
  *    - a 2xx refresh reply that cannot be stored changes nothing, and nothing escapes into `ready`
+ *    - the replay asks whether an expiry is waiting AFTER its read, not only before it
+ *    - a window catches up with a session another window ended, left or renewed — on every focus
  *
  *  The functions are sliced out of the shipped extension.js and run against stand-ins for what they
  *  touch (SecretStorage, globalState, fetch, the provider adapter), the way mcpManage.test.js does
@@ -92,7 +94,7 @@ function decl(name) {
 
 const FUNCTIONS = [
 	'post', 'providerMode', 'providerErrorMessage', 'isAuthError', 'cloudEndpoint', 'cloudApiUrl',
-	'refreshCloudToken', 'renewSession', 'withSessionLock', 'sameSession', 'sessionExpired', 'postSessionExpired',
+	'refreshCloudToken', 'renewSession', 'storedToken', 'catchUpWithStoredSession', 'withSessionLock', 'sameSession', 'sessionExpired', 'postSessionExpired',
 	'sessionExpiredPending', 'isEndedSessionError', 'clearSessionExpired', 'replaySessionExpired', 'checkCloudSession',
 	'refreshGatewayToken', 'prepProviderRequest', 'handleSend', 'currentAccount', 'postAccount', 'accountSignOut',
 	'storeSession', 'newChat', 'resumeSession', 'restoreCheckpoint', 'onConfigChanged'
@@ -109,7 +111,7 @@ const makeHost = new Function('env', [
 	'let activeWebview = env.webview, cloudSignedIn = env.signedIn, agentMode = false, conversation = [], pendingContext = null, conversationEpoch = 0, abort = null;',
 	'let agentMessages = [], currentCheckpoint = null, lastAgentGoal = null;',
 	decl('ACCOUNT_TOKEN_KEY'), decl('ACCOUNT_REFRESH_KEY'), decl('ACCOUNT_PROFILE_KEY'), decl('ACCOUNT_EXPIRED_KEY'),
-	decl('sessionQueue'), decl('sessionGeneration'), decl('lastSessionCheck'),
+	decl('sessionQueue'), decl('sessionGeneration'), decl('SESSION_CHECK_EVERY_MS'), decl('lastSessionCheck'),
 	...FUNCTIONS.map(extract),
 	'return { ' + FUNCTIONS.join(', ') + ',',
 	'  KEY: { token: ACCOUNT_TOKEN_KEY, refresh: ACCOUNT_REFRESH_KEY, profile: ACCOUNT_PROFILE_KEY, expired: ACCOUNT_EXPIRED_KEY },',
@@ -197,6 +199,10 @@ function boot(over) {
 		/** @type {Error|null} */ keyError: null,
 		/** Makes SecretStorage refuse every write — a locked keychain. */
 		/** @type {Error|null} */ storeError: null,
+		/** …and every read. */
+		/** @type {Error|null} */ readError: null,
+		/** While set, every SecretStorage read waits on it — a read that is slow to come back. */
+		/** @type {Promise<any>|null} */ readGate: null,
 		/** The account messages the popover (and the sign-in card) were sent. */
 		accounts: () => posted.filter((m) => m.type === 'account'),
 		types: () => posted.map((m) => m.type),
@@ -207,7 +213,12 @@ function boot(over) {
 		session: o.refreshTimeoutMs ? Object.assign({}, session, { REFRESH_TIMEOUT_MS: o.refreshTimeoutMs }) : session,
 		ctx: {
 			secrets: {
-				get: async (k) => { await tick(); return secrets.get(k); },
+				get: async (k) => {
+					await tick();
+					if (t.readGate) { await t.readGate; }
+					if (t.readError) { throw t.readError; }
+					return secrets.get(k);
+				},
 				store: async (k, v) => {
 					const op = 'store ' + k; ops.push(op); t.onOp(op); await tick();
 					if (t.storeError) { throw t.storeError; }
@@ -915,5 +926,110 @@ async function test(name, fn) { await fn(); n++; console.log('  ok - ' + name);
 		assert.strictEqual(t.state.get(t.K.expired), undefined);
 	});
 
+	// ── the replay asks again after its read ─────────────────────────────────────────────────────
+	for (const [how, answer] of [
+		['"Use my own key instead"', (t) => t.host.clearSessionExpired()],
+		['BYOK chosen in Settings', async (t) => { t.settings['levelcode.ai.providerMode'] = 'byok'; }]
+	]) {
+		await test('replay: an expiry answered by ' + how + ' WHILE the token read is out is not shown again', async () => {
+			const t = boot({ expired: true, profile: { name: 'Ada' } });
+			const read = deferred();
+			t.readGate = read.promise;                     // SecretStorage is slow to answer…
+			const replay = t.host.replaySessionExpired();
+			await settle();                                // …so the replay is parked on that read…
+			await answer(t);                               // …and the user answers the card meanwhile.
+			read.resolve();
+			await replay;
+			assert.deepStrictEqual(t.posted, [], 'no card for an expiry that is no longer waiting');
+		});
+	}
+
+	await test('replay: the same slow read with nothing answered still ends in the card', async () => {
+		const t = boot({ expired: true, profile: { name: 'Ada' } });
+		const read = deferred();
+		t.readGate = read.promise;
+		const replay = t.host.replaySessionExpired();
+		await settle();
+		read.resolve();
+		await replay;
+		assert.deepStrictEqual(t.types(), ['sessionExpired']);
+	});
+
+	await test('a store that will not READ: the check and the replay finish quietly — neither can break what awaits them', async () => {
+		const t = boot({ expired: true, access: deadAccess(), refresh: 'r1' });
+		t.readError = new Error('the keychain is locked');
+		await t.host.checkCloudSession('ready');
+		await t.host.replaySessionExpired();
+		assert.deepStrictEqual(t.posted, []);
+	});
+
+	// ── a window catches up with what another window did to the session they share ───────────────
+	await test('another window ENDED the session before this window\'s focus check: flag, popover and card catch up', async () => {
+		const t = boot({ access: liveAccess(), refresh: 'r1', profile: { name: 'Ada' } });
+		assert.strictEqual(t.host.signedIn(), true, 'this window is showing a live session');
+		t.secrets.delete(t.K.token); t.secrets.delete(t.K.refresh); t.state.set(t.K.expired, true);   // the other window's sessionExpired()
+		await t.host.checkCloudSession('focus');
+		assert.strictEqual(t.host.signedIn(), false);
+		assert.deepStrictEqual(t.posted.filter((m) => m.type === 'sessionExpired'), [{ type: 'sessionExpired', name: 'Ada', message: session.SESSION_EXPIRED_MESSAGE }]);
+		assert.deepStrictEqual(t.accounts().map(brief), [{ signedIn: false, mode: 'gateway', expired: true, status: 'signedout' }]);
+		assert.strictEqual(t.calls.refresh.length, 0, 'nothing to renew, nothing requested');
+		assert.deepStrictEqual(t.ops, [], 'and nothing written');
+		const before = t.posted.length;
+		await t.host.checkCloudSession('focus');   // clicking back in again
+		assert.strictEqual(t.posted.length, before, 'said once, not on every focus');
+	});
+
+	await test('another window SIGNED OUT: the popover catches up, and there is no card — nothing expired', async () => {
+		const t = boot({ access: liveAccess(), refresh: 'r1', profile: { name: 'Ada' } });
+		t.secrets.delete(t.K.token); t.secrets.delete(t.K.refresh); t.state.delete(t.K.profile);       // the other window's accountSignOut()
+		await t.host.checkCloudSession('focus');
+		assert.strictEqual(t.host.signedIn(), false);
+		assert.deepStrictEqual(t.accounts().map(brief), [{ signedIn: false, mode: 'gateway', expired: false, status: 'signedout' }]);
+		assert.ok(!t.types().includes('sessionExpired'));
+	});
+
+	await test('another window SIGNED IN while this one showed the card: the account message is its cue to go', async () => {
+		const t = boot({ expired: true, profile: { name: 'Ada' } });
+		assert.strictEqual(t.host.signedIn(), false);
+		t.secrets.set(t.K.token, liveAccess()); t.secrets.set(t.K.refresh, 'r2'); t.state.delete(t.K.expired);   // the other window's storeSession()
+		await t.host.checkCloudSession('focus');
+		assert.strictEqual(t.host.signedIn(), true);
+		assert.deepStrictEqual(t.accounts().map(brief), [{ signedIn: true, mode: 'gateway', expired: false, status: undefined }]);
+		assert.ok(!t.types().includes('sessionExpired'));
+	});
+
+	await test('a focus check that lands in the MIDDLE of this window\'s own sign-out does not take it for another window\'s', async () => {
+		// Mid-sign-out the flag already says "signed out" while the token is still stored. Read then,
+		// the two disagree, and the catch-up would announce a session this window is busy ending.
+		const t = boot({ access: liveAccess(), refresh: 'r1', profile: { name: 'Ada' } });
+		let check = null;
+		t.onOp = (op) => { if (!check && op === 'forget ' + t.K.token) { check = t.host.checkCloudSession('focus'); } };
+		await t.host.accountSignOut();
+		assert.ok(check, 'the focus check was started mid-sign-out');
+		await check;
+		assert.deepStrictEqual(t.accounts().map(brief), [{ signedIn: false, mode: 'gateway', expired: false, status: 'signedout' }], 'one resync: the sign-out\'s own');
+		assert.strictEqual(t.host.signedIn(), false);
+	});
+
+	await test('the ration is on the refresh, not on the look: a second focus skips the request but still catches up', async () => {
+		const t = boot({ access: deadAccess(), refresh: 'r1', profile: { name: 'Ada' } });
+		t.refreshReply = 'offline';
+		await t.host.checkCloudSession('focus');
+		await t.host.checkCloudSession('focus');
+		assert.strictEqual(t.calls.refresh.length, 1, 'offline: one attempt, not one per click');
+		t.secrets.delete(t.K.token); t.secrets.delete(t.K.refresh); t.state.set(t.K.expired, true);   // meanwhile, in another window
+		await t.host.checkCloudSession('focus');
+		assert.strictEqual(t.posted.filter((m) => m.type === 'sessionExpired').length, 1, 'found inside the ten minutes');
+		assert.strictEqual(t.calls.refresh.length, 1);
+	});
+
+	await test('`ready` does not say it twice: the handler has just read the same token, and the card is replayed last', async () => {
+		const t = boot({ expired: true, profile: { name: 'Ada' } });
+		await t.host.checkCloudSession('ready');
+		assert.deepStrictEqual(t.posted, [], 'the check is quiet');
+		await t.host.replaySessionExpired();
+		assert.deepStrictEqual(t.types(), ['sessionExpired'], 'the last step speaks');
+	});
+
 	console.log('\nsessionExpiredHost: ' + n + ' tests passed.');
 })().catch((e) => { console.error(e); process.exit(1); });
@@ -85,6 +85,17 @@ test('host: the webview ready handler checks the session before the first messag
 	assert.ok(/onDidChangeWindowState/.test(ext), 'focus re-check');
 });
 
+test('host: every focus runs the check — the ten-minute ration is on the refresh, inside it', () => {
+	// With the ration in the hook, a window that had checked a minute ago did not look again, and so
+	// did not notice another window ending the session they share until the next message failed.
+	assert.ok(/onDidChangeWindowState\(\(st\) => \{\s*if \(st\.focused\) \{ checkCloudSession\('focus'\); \}/.test(ext), 'no time condition in the hook');
+	const fn = ext.slice(ext.indexOf('async function checkCloudSession('), ext.indexOf('async function refreshGatewayToken('));
+	const catchUp = fn.indexOf('await catchUpWithStoredSession(token)');
+	const ration = fn.indexOf("reason === 'focus' && Date.now() - lastSessionCheck <= SESSION_CHECK_EVERY_MS");
+	assert.ok(catchUp > 0 && ration > 0, 'both halves present');
+	assert.ok(catchUp < ration, 'catching up comes before the ration');
+});
+
 test('host: ready replays an unanswered expiry LAST — after the check, and under a replayed transcript', () => {
 	// The focus check can end the session with no chat open; post() then has nowhere to send the card,
 	// and the next `ready` finds no token to check. The replay is what shows it — and it has to come