diff --git a/docs/CODING_WORKFLOW.md b/docs/CODING_WORKFLOW.md
index 5fe558be2..a1d6517d3 100644
--- a/docs/CODING_WORKFLOW.md
+++ b/docs/CODING_WORKFLOW.md
@@ -59,7 +59,7 @@ that the current model retained either material.
 
 When bootstrap or discovery returns `project_ref`, reuse it as the `project` selector on ordinary Project-scoped calls. The canonical `agent:<client_id>:<project_id>` identity remains visible for diagnostics and explicit addressing, but the model does not need to mechanically repeat it. A short ref is Server-owned, durable and principal-scoped, carries no authority, and is reauthorized against its pinned canonical Project/root identity on every call.
 
-When `work_on_project`, `start_session`, `session_summary`, or an explicit handoff returns `session_ref`, prefer that short selector for later business `session_id` inputs. The canonical `wc_sess_*` identity remains valid and authoritative. The ref is principal-scoped convenience only: every use resolves the pinned exact Session and reruns the normal Project/Session authorization, lifecycle and guard checks. It does not apply to `recording_session_id` and never creates sticky recorder context.
+When `work_on_project`, `start_session`, `session_summary`, or an explicit handoff returns `session_ref`, prefer that short selector for later explicit Session selection. Business `session_id` and wrapper `recording_session_id` remain separate contracts, but either may explicitly carry the already-issued ref: Runtime canonicalizes it to the pinned `wc_sess_*` before the role-specific authorization and lifecycle/guard logic runs. The canonical identity remains valid and authoritative. The ref is principal-scoped convenience only; omission never infers a recorder and no sticky recorder context is created.
 
 ## Tool strategy guidance
 
diff --git a/docs/CODING_WORKFLOW.zh-CN.md b/docs/CODING_WORKFLOW.zh-CN.md
index 391f2602d..7cd8bd73c 100644
--- a/docs/CODING_WORKFLOW.zh-CN.md
+++ b/docs/CODING_WORKFLOW.zh-CN.md
@@ -24,7 +24,7 @@ work_on_project
 它的 primary output 默认保持紧凑，不重复静态 instruction/workflow 正文；当前模型上下文缺少这些材料时，分别显式请求 `context_request=["project.instructions"]` 和/或 `context_request=["webcodex.workflow"]`。Workflow Session identity 不证明当前模型仍保留这些上下文。
 Bootstrap 或 discovery 返回 `project_ref` 后，普通 Project-scoped tool call 的 `project` 应优先复用这个短 selector。Canonical `agent:<client_id>:<project_id>` 仍保留用于 diagnostic 与显式 addressing，但模型无需机械重复。`project_ref` 由 Server 持久维护、按 principal 隔离，不携带 authority；每次调用都会根据其钉住的 canonical Project/root identity 重新授权。
 
-当 `work_on_project`、`start_session`、`session_summary` 或显式 handoff 返回 `session_ref` 时，后续 business `session_id` 优先复用这个短 selector。Canonical `wc_sess_*` 仍然有效，并继续作为持久化、审计、诊断和内部关联的权威身份。`session_ref` 只是按 principal 隔离的便利选择器：每次使用都会解析到钉住的 exact Session，并重新执行原有 Project/Session 授权、生命周期和 guard 检查。它不适用于 `recording_session_id`，也不会形成隐式或粘滞的 recorder context。
+当 `work_on_project`、`start_session`、`session_summary` 或显式 handoff 返回 `session_ref` 时，后续显式 Session 选择可优先复用这个短 selector。Business `session_id` 与 wrapper `recording_session_id` 仍是两套独立语义，但都可以显式携带已签发的 ref：Runtime 会先把它还原为钉住的 canonical `wc_sess_*`，再执行各自原有的授权、生命周期或 guard 逻辑。Canonical identity 仍是持久化、审计、诊断和内部关联的权威身份。`session_ref` 只是按 principal 隔离的便利选择器；省略 recorder 时不会自动推断，也不会形成隐式或粘滞的 recorder context。
 默认情况下，它还会返回一个很小且有界的 `extensions` selection catalog：Skill metadata 来自 canonical 的 project / Runner-configured `skills.roots` / Runner-managed Skill Store 三类来源；Plugin metadata 只包含 configured working directory 与当前 Project root 匹配、且已 ready/committed 的 provider。该 metadata 不授予任何 authority，也不会自动读取 Skill body 或创建 Plugin binding；模型选择后使用 `skill_read_file` 读取 Skill 文本，`run_skill_resource` 只执行可信 Runner-configured live `scripts/` resource（由 `expected_definition_revision` fence definition）或 Runner-installed managed resource（另由 `expected_package_revision` fence package），Plugin 则走 `plugin_tool describe -> call`。Configured resource bytes 会一直保持 live 到实际执行时，并不会预先被 package revision 固定。只有当前模型上下文仍明确保留这些 discovery metadata 时，才应设置 `include_extension_catalog=false`。
 
 ## 工具策略 guidance
diff --git a/docs/agent/session-model.md b/docs/agent/session-model.md
index 052b5f992..45731c4a0 100644
--- a/docs/agent/session-model.md
+++ b/docs/agent/session-model.md
@@ -73,13 +73,13 @@ Workflow Session lifecycle is independent from the durable `wc_goal_*` Goal doma
 | ID form | Canonical `wc_sess_*` (`SESSION_ID_PREFIX`); model-facing bootstrap/discovery/handoff may additionally issue principal-scoped `session_ref` values such as `~s1` |
 | Business field | `session_id` on tools that take a workflow session as input; model-facing business calls may pass either the canonical id or a Server-issued `session_ref` |
 | Coding resume field | `session_id` on canonical external `work_on_project`; the internal startup primitive's `resume_session_id` is not a wire/API field |
-| Recorder field | `recording_session_id` on generic wrappers, including the stateless MCP 2026 tool-argument projection (metadata only; canonical `wc_sess_*` only and stripped before concrete tool dispatch) |
+| Recorder field | `recording_session_id` on generic wrappers, including the stateless MCP 2026 tool-argument projection (metadata only; accepts canonical `wc_sess_*` or an explicitly supplied principal-scoped `session_ref`, then canonicalizes before recorder authorization and concrete dispatch) |
 
 ### Storage and ownership
 
 A `session_ref` is only a short model selector. The Server owns a durable mapping scoped to the authenticated principal and pins the ref to one exact canonical Workflow Session incarnation. Resolving it produces the canonical `wc_sess_*` before business authorization/dispatch; the ordinary Project visibility, Session authority, lifecycle, and guard checks then run unchanged. The ref is not a credential, bearer capability, recorder identity, or "current/recent Session" inference. If the pinned Session disappears or its exact incarnation cannot be proven, the old ref fails closed and is never recycled or silently retargeted. Canonical Session ids remain authoritative for persistence, audit, diagnostics, internal joins, and explicit API/CLI consumers.
 
-`recording_session_id` remains a separate provenance contract. A `session_ref` never creates sticky recorder context and is not accepted as an implicit recorder selector.
+`recording_session_id` remains a separate provenance contract. It may explicitly carry the same principal-scoped `session_ref` returned for that exact Session; Runtime canonicalizes the ref before recorder authorization and durable provenance recording. This does not make recorder provenance a business Session target, and omission never selects a recorder implicitly or creates sticky recorder context.
 
 Stateless MCP 2026 never derives a Workflow Session recorder identity from transport/window continuity. ChatGPT may supply `_meta["openai/session"]` as a hashed `ClientWindow`, but that identity is intentionally not a Workflow Session selector or trusted provenance source. Its `tools/list` schema therefore projects `recording_session_id` as explicit wrapper metadata for runtime tools. A call may carry `recording_session_id=W` while the concrete tool body carries business `session_id=C`; the MCP adapter removes the recorder field before concrete parsing and the kernel independently authorizes `W` before it can record evidence or supply trusted collaboration provenance. This does not revive legacy `mcp-session-id`, grant target authority, or infer a recorder from credentials, project identity, connection state, or `ClientWindow`.
 
@@ -139,7 +139,7 @@ with its canonical authority and replay fences; standalone tools remain valid.
 
 Executable todo completion is assignment-fenced in 0.4. A worker first calls `get_session_assignment` for the exact coordinator `session_id + message_id`; one atomic store snapshot returns the open todo, every retained direct reply within the bound, and an opaque Session/todo-bound `assignment_fence`. Current `complete_session_message` requests require that exact token as `expected_assignment_fence` together with the independent caller `completion_key`. Assignment-local semantic changes stale the fence before mutation; unrelated Session traffic and ACK bookkeeping do not. A stale result has `state_changed=false` and includes the current assignment plus a fresh durable fence only when that exact current state remains provable. Retention loss or an oversized direct-reply set is non-completable from stale context.
 
-The fence and completion key are different identity domains: the fence proves the semantic assignment snapshot, while the completion key correlates one accepted intent across uncertain retries. `ack_session_message_ids` and compact Session `ack_ref` are request-scoped ACK evidence; message-observation tokens are a separate cursor domain. `session_ref` is only a principal-scoped business Session selector and never ACK evidence. None substitutes for assignment/completion identity. Business `session_id` remains the independently authorized target; `recording_session_id` remains provenance only and never supplies business guards or execution defaults. Current persisted rows must carry the assignment-history and completion-fence tracking metadata required by the v2 format; restore never invents a missing fence, fingerprint, or tracking state, and a row that cannot prove the current shape is discarded rather than admitted for replay.
+The fence and completion key are different identity domains: the fence proves the semantic assignment snapshot, while the completion key correlates one accepted intent across uncertain retries. `ack_session_message_ids` and compact Session `ack_ref` are request-scoped ACK evidence; message-observation tokens are a separate cursor domain. `session_ref` is a principal-scoped exact-Session selector and never ACK evidence. The field carrying it determines the role: business `session_id` remains the independently authorized target, while `recording_session_id` remains provenance only and never supplies business guards or execution defaults. None substitutes for assignment/completion identity. Current persisted rows must carry the assignment-history and completion-fence tracking metadata required by the v2 format; restore never invents a missing fence, fingerprint, or tracking state, and a row that cannot prove the current shape is discarded rather than admitted for replay.
 
 ### Explicit handoff recovery and internal snapshot fencing
 
diff --git a/docs/agent/tool-contract-guidelines.md b/docs/agent/tool-contract-guidelines.md
index 5509ccea2..2a75a100c 100644
--- a/docs/agent/tool-contract-guidelines.md
+++ b/docs/agent/tool-contract-guidelines.md
@@ -181,7 +181,7 @@ Runtime Project identity remains canonical as `agent:<client_id>:<project_id>`.
 
 Resolving a `project_ref` must always look up the pinned canonical identity and then run the ordinary current Project resolution/authorization path again. The ref is not a credential, bearer token or capability. If the canonical Project disappears, becomes invisible, loses stable identity, or the same canonical address is later registered for a different root, the old ref fails closed. Never recycle or silently retarget an issued ref. Discovery/bootstrap may expose both `project_ref` and canonical identity; ordinary hot-path results should not repeat them when no model decision depends on that duplication.
 
-The same typed durable-reference layer may issue a principal-scoped `session_ref` such as `~s1` for one exact Workflow Session incarnation. Canonical `wc_sess_*` remains authoritative for Session persistence, audit, diagnostics and internal joins. Business `session_id` inputs may use the short selector, but Runtime canonicalizes it before Session-aware authorization/dispatch and then reruns the ordinary Project visibility, Session authority, lifecycle and guard checks. `recording_session_id` is a separate recorder-provenance contract and remains canonical-only; a Session ref never creates ambient or sticky recorder state. Bootstrap, discovery and handoff may expose both identities, while ordinary hot-path results should avoid redundant duplication.
+The same typed durable-reference layer may issue a principal-scoped `session_ref` such as `~s1` for one exact Workflow Session incarnation. Canonical `wc_sess_*` remains authoritative for Session persistence, audit, diagnostics and internal joins. Business `session_id` and wrapper `recording_session_id` remain separate semantic roles, but either may explicitly carry an already-issued Session ref. Runtime canonicalizes the selector before the role-specific authorization/dispatch path: business targeting still reruns Project visibility, Session authority, lifecycle and guards, while recorder provenance still reruns its independent recorder authorization and never supplies business authority. A Session ref never creates ambient or sticky recorder state. Bootstrap, discovery and handoff may expose both identities, while ordinary hot-path results should avoid redundant duplication.
 
 ### Model-projection deletion test
 
diff --git a/src/mcp/discovery.rs b/src/mcp/discovery.rs
index c4a514096..f97d46e12 100644
--- a/src/mcp/discovery.rs
+++ b/src/mcp/discovery.rs
@@ -3,6 +3,8 @@
 
 use serde_json::Value;
 
+use super::tools::RECORDING_SESSION_SELECTOR_SCHEMA_PATTERN;
+
 // MCP discovery targets, independent of GPT Actions' importer limits. Keep
 // purpose, the nearest selection boundary, and essential continuation guidance.
 pub(super) const TOOL_DESCRIPTION_MAX_CHARS: usize = 420;
@@ -45,7 +47,7 @@ pub(super) fn compact_tool(tool: &mut Value) {
         // session_id keeps its own canonical-derived copy and requiredness.
         // Nested IDs/resolution have no description; keep their type hints here.
         for (pointer, description) in [
-            ("/properties/recording_session_id", "Optional explicit wc_sess_* recorder for one exact Workflow Session; never execution/business authority. If omitted, authorized same-Window affinity may still deliver and ACK Session collaboration without recording."),
+            ("/properties/recording_session_id", "Optional explicit recorder for one exact Workflow Session (wc_sess_* or issued ~sN); never execution/business authority. Omission may still allow authorized same-Window attention without recording."),
             ("/properties/ack_session_message_ids", "ACK-required wc_msg_* IDs retained in model context; Session uses recorder/window affinity; never resolves or authorizes."),
             ("/properties/ack_ref", "Compact exact Session ACK-set evidence returned in session_attention; Session-only, request-scoped, non-authoritative, and never resolves messages."),
             ("/properties/session_message_resolution", "Resolve one handled non-todo recorder message by exact wc_msg_*; ACK separately if required. Independent of call success."),
@@ -97,7 +99,7 @@ fn compact_discovery_validation_annotations(schema: &mut Value) {
     for (pointer, pattern) in [
         (
             "/properties/recording_session_id",
-            "^wc_sess_([A-Za-z0-9_-]{16}|[0-9a-f]{32})$",
+            RECORDING_SESSION_SELECTOR_SCHEMA_PATTERN,
         ),
         (
             "/properties/ack_session_message_ids/items",
diff --git a/src/mcp/tools.rs b/src/mcp/tools.rs
index 46a62a0f5..de9393045 100644
--- a/src/mcp/tools.rs
+++ b/src/mcp/tools.rs
@@ -558,6 +558,9 @@ fn insert_stateless_collaboration_ack_property(properties: &mut serde_json::Map<
     );
 }
 
+pub(super) const RECORDING_SESSION_SELECTOR_SCHEMA_PATTERN: &str =
+    "^(~s[1-9][0-9]{0,19}|wc_sess_([A-Za-z0-9_-]{16}|[0-9a-f]{32}))$";
+
 pub(super) fn add_stateless_workflow_recorder_metadata(payload: &mut Value) {
     let Some(tools) = payload.get_mut("tools").and_then(Value::as_array_mut) else {
         return;
@@ -582,8 +585,8 @@ pub(super) fn add_stateless_workflow_recorder_metadata(payload: &mut Value) {
             crate::tool_runtime::sessions::TOOL_CALL_RECORDING_SESSION_ID_FIELD.to_string(),
             json!({
                 "type": "string",
-                "pattern": "^wc_sess_([A-Za-z0-9_-]{16}|[0-9a-f]{32})$",
-                "description": "Optional explicit recorder provenance for one exact Workflow Session. Never execution authority or a business Session target. When omitted, authorized same-Window affinity may still deliver and ACK Session collaboration without recording this call."
+                "pattern": RECORDING_SESSION_SELECTOR_SCHEMA_PATTERN,
+                "description": "Optional explicit recorder provenance for one exact Workflow Session; accepts canonical wc_sess_* or issued principal-scoped ~sN. Never execution/business authority. Omission may still allow authorized same-Window attention without recording."
             }),
         );
         insert_stateless_collaboration_ack_property(properties);
@@ -1445,6 +1448,15 @@ pub(super) fn strip_recording_session_id(arguments: &mut Value) -> Result<Option
     }
 }
 
+fn canonicalize_recording_session_id(
+    runtime: &crate::tool_runtime::ToolRuntime,
+    raw: Option<String>,
+    auth: Option<&crate::auth::AuthContext>,
+) -> Result<Option<String>, String> {
+    raw.map(|raw| runtime.canonicalize_explicit_session_selector(&raw, auth))
+        .transpose()
+}
+
 pub(super) fn strip_stateless_ack_session_message_ids(
     arguments: &mut Value,
 ) -> Result<Vec<String>, String> {
@@ -1843,6 +1855,17 @@ pub(super) async fn handle_call(
         let ToolCall::PluginTool(plugin) = call else {
             unreachable!("plugin_tool parser must yield ToolCall::PluginTool");
         };
+        let recording_session_id =
+            match canonicalize_recording_session_id(runtime, recording_session_id, auth) {
+                Ok(session_id) => session_id,
+                Err(message) => {
+                    if let Some(lc) = lifecycle.as_deref() {
+                        lc.dispatch_failed("invalid_arguments");
+                        lc.dispatch_finished(false, Some(false), "invalid_arguments");
+                    }
+                    return McpOutcome::BadRequest(rpc_error(id, -32602, message));
+                }
+            };
         if let Some(lc) = lifecycle.as_deref() {
             lc.capture_payload_lazy("effective_arguments", || {
                 crate::plugin_gateway::audit_arguments(&params.arguments)
@@ -1950,6 +1973,18 @@ pub(super) async fn handle_call(
                 return McpOutcome::BadRequest(rpc_error(id, -32602, message));
             }
         };
+        // Resolve once so a valid short recorder can drive the same best-effort
+        // fallback Project projection as its canonical id. Defer ref errors until
+        // business parsing succeeds to preserve the existing fallback precedence.
+        let canonical_recording_session_id =
+            canonicalize_recording_session_id(runtime, recording_session_id.clone(), auth);
+        let recorder_project = || {
+            canonical_recording_session_id
+                .as_ref()
+                .ok()
+                .and_then(|session_id| session_id.as_deref())
+                .and_then(|session_id| runtime.sessions.session_project(session_id).flatten())
+        };
         let policy = match crate::ssh_resource_gateway::operation_policy(&params.arguments) {
             Ok(policy) => policy,
             Err(_) => {
@@ -1960,9 +1995,7 @@ pub(super) async fn handle_call(
                 }
                 let mut result =
                     crate::ssh_resource_gateway::call(runtime, params.arguments, auth).await;
-                let project = recording_session_id
-                    .as_deref()
-                    .and_then(|session_id| runtime.sessions.session_project(session_id).flatten());
+                let project = recorder_project();
                 runtime.add_peer_collaboration_to_mcp_call_result(
                     &mut result,
                     auth,
@@ -1996,9 +2029,7 @@ pub(super) async fn handle_call(
                 }
                 let mut result =
                     crate::ssh_resource_gateway::call(runtime, params.arguments, auth).await;
-                let project = recording_session_id
-                    .as_deref()
-                    .and_then(|session_id| runtime.sessions.session_project(session_id).flatten());
+                let project = recorder_project();
                 runtime.add_peer_collaboration_to_mcp_call_result(
                     &mut result,
                     auth,
@@ -2020,6 +2051,16 @@ pub(super) async fn handle_call(
                 ));
             }
         };
+        let recording_session_id = match canonical_recording_session_id {
+            Ok(session_id) => session_id,
+            Err(message) => {
+                if let Some(lc) = lifecycle.as_deref() {
+                    lc.dispatch_failed("invalid_arguments");
+                    lc.dispatch_finished(false, Some(false), "invalid_arguments");
+                }
+                return McpOutcome::BadRequest(rpc_error(id, -32602, message));
+            }
+        };
         let invocation = match crate::ssh_resource_gateway::invoke(
             runtime,
             request,
@@ -2219,6 +2260,27 @@ pub(super) async fn handle_call(
         "goal_plan_sync" | "work_result_state" | "work_result_send_message" | "changes_file_diff"
     ) {
         session_id = None;
+    } else {
+        session_id = match canonicalize_recording_session_id(runtime, session_id, auth) {
+            Ok(session_id) => session_id,
+            Err(message) => {
+                if let Some(lc) = lifecycle.as_deref() {
+                    lc.dispatch_failed("invalid_arguments");
+                    lc.dispatch_finished(false, Some(false), "invalid_arguments");
+                }
+                if let (Some(slot), Some(timer)) = (
+                    model_ergonomics_out.as_deref_mut(),
+                    pre_kernel_model_ergonomics.take(),
+                ) {
+                    *slot = Some(
+                        timer
+                            .finish()
+                            .record_for_pre_result_failure("invalid_arguments"),
+                    );
+                }
+                return McpOutcome::BadRequest(rpc_error(id, -32602, message));
+            }
+        };
     }
     let session_message_resolution = if stateless_2026 {
         match strip_stateless_session_message_resolution(&mut params.arguments) {
diff --git a/src/mcp_tests/goal_plan_app.rs b/src/mcp_tests/goal_plan_app.rs
index b301f22ae..e30910535 100644
--- a/src/mcp_tests/goal_plan_app.rs
+++ b/src/mcp_tests/goal_plan_app.rs
@@ -463,7 +463,7 @@ async fn goal_plan_sync_discards_unadvertised_recording_session_wrapper() {
                 "name": "goal_plan_sync",
                 "arguments": {
                     "goal_id": goal_id,
-                    "recording_session_id": session.session_id
+                    "recording_session_id": "~s01"
                 }
             })),
         ),
diff --git a/src/mcp_tests/plugin_tools.rs b/src/mcp_tests/plugin_tools.rs
index b50acd17d..f41287cea 100644
--- a/src/mcp_tests/plugin_tools.rs
+++ b/src/mcp_tests/plugin_tools.rs
@@ -703,7 +703,10 @@ async fn plugin_operation_scopes_are_independent_and_fail_closed() {
 
 #[tokio::test]
 async fn read_only_session_allows_plugin_inspect_but_denies_call_before_provider_dispatch() {
-    let runtime = test_runtime();
+    let tmp = tempfile::tempdir().unwrap();
+    let runtime = test_runtime().with_project_reference_database(std::sync::Arc::new(
+        crate::Database::open(&tmp.path().join("plugin-recorder-refs.db")).unwrap(),
+    ));
     let auth = plugin_auth_with_scopes(&[
         crate::auth::SCOPE_PLUGIN_INSPECT,
         crate::auth::SCOPE_PLUGIN_INVOKE,
@@ -719,6 +722,9 @@ async fn read_only_session_allows_plugin_inspect_but_denies_call_before_provider
     .await;
     let session =
         start_authorized_test_session(&runtime, &auth, crate::tool_runtime::SessionMode::ReadOnly);
+    let recorder_ref = runtime
+        .session_reference_for_id(&session.session_id, Some(&auth))
+        .expect("authorized Plugin recorder should expose a Session ref");
 
     let inspect = handle_mcp_request(
         &runtime,
@@ -729,7 +735,7 @@ async fn read_only_session_allows_plugin_inspect_but_denies_call_before_provider
                 "name": crate::plugin_gateway::PLUGIN_TOOL_NAME,
                 "arguments": {
                     "action":"list",
-                    "recording_session_id":session.session_id
+                    "recording_session_id":recorder_ref
                 }
             }),
         ),
@@ -752,7 +758,7 @@ async fn read_only_session_allows_plugin_inspect_but_denies_call_before_provider
                     "action":"call",
                     "binding":"wc_pbind_ASNFZ4mrze8BI0VniavN7w",
                     "arguments":{"query":"must-not-run"},
-                    "recording_session_id":session.session_id
+                    "recording_session_id":recorder_ref
                 }
             }),
         ),
diff --git a/src/mcp_tests/ssh_resource.rs b/src/mcp_tests/ssh_resource.rs
index dd00d3b74..96e5a8d29 100644
--- a/src/mcp_tests/ssh_resource.rs
+++ b/src/mcp_tests/ssh_resource.rs
@@ -394,11 +394,17 @@ async fn managed_ssh_invalid_post_dispatch_response_is_outcome_unknown_and_bindi
 
 #[tokio::test]
 async fn read_only_session_allows_ssh_inspect_but_denies_management_before_runner_dispatch() {
-    let runtime = Arc::new(test_runtime());
+    let tmp = tempfile::tempdir().unwrap();
+    let runtime = Arc::new(test_runtime().with_project_reference_database(Arc::new(
+        crate::Database::open(&tmp.path().join("ssh-recorder-refs.db")).unwrap(),
+    )));
     let auth = ssh_auth();
     register_managed_runner(&runtime, "instance-a").await;
     let session =
         start_authorized_test_session(&runtime, &auth, crate::tool_runtime::SessionMode::ReadOnly);
+    let recorder_ref = runtime
+        .session_reference_for_id(&session.session_id, Some(&auth))
+        .expect("authorized SSH recorder should expose a Session ref");
 
     let list_task = call_in_task(
         Arc::clone(&runtime),
@@ -406,7 +412,7 @@ async fn read_only_session_allows_ssh_inspect_but_denies_management_before_runne
         json!({
             "action":"list",
             "runner":"runner-a",
-            "recording_session_id":session.session_id
+            "recording_session_id":recorder_ref
         }),
         808,
     )
@@ -441,7 +447,7 @@ async fn read_only_session_allows_ssh_inspect_but_denies_management_before_runne
                     "binding":binding,
                     "name":"w10",
                     "target":"private-user@private-host",
-                    "recording_session_id":session.session_id
+                    "recording_session_id":recorder_ref
                 }),
             ),
         ),
diff --git a/src/mcp_tests/tools.rs b/src/mcp_tests/tools.rs
index 35739d379..c586c3d80 100644
--- a/src/mcp_tests/tools.rs
+++ b/src/mcp_tests/tools.rs
@@ -1675,7 +1675,7 @@ fn assert_compact_tool_diff(full: &Value, compact: &Value) {
     for (pointer, pattern) in [
         (
             "/properties/recording_session_id",
-            "^wc_sess_([A-Za-z0-9_-]{16}|[0-9a-f]{32})$",
+            "^(~s[1-9][0-9]{0,19}|wc_sess_([A-Za-z0-9_-]{16}|[0-9a-f]{32}))$",
         ),
         (
             "/properties/ack_session_message_ids/items",
@@ -1817,7 +1817,7 @@ async fn mcp_compact_preserves_safety_patterns_and_wrapper_bounds() {
 #[test]
 fn mcp_compact_opaque_patterns_require_exact_wrapper_location_and_format() {
     use crate::mcp::discovery::compact_tool;
-    let session_pattern = "^wc_sess_([A-Za-z0-9_-]{16}|[0-9a-f]{32})$";
+    let session_pattern = "^(~s[1-9][0-9]{0,19}|wc_sess_([A-Za-z0-9_-]{16}|[0-9a-f]{32}))$";
     // Even at a known path, a future/different format must not silently vanish.
     for pattern in [
         "^wc_sess_[A-Za-z0-9_-]{16}$",
@@ -1854,6 +1854,34 @@ fn mcp_compact_opaque_patterns_require_exact_wrapper_location_and_format() {
     );
 }
 
+#[tokio::test]
+async fn mcp_recording_session_ref_fails_closed_when_malformed() {
+    let runtime = test_runtime();
+    let outcome = handle_mcp_request(
+        &runtime,
+        rpc(
+            "tools/call",
+            Some(json!(1)),
+            mcp_2026_params(adaptive_runtime_gateway_params(
+                "list_projects",
+                json!({
+                    crate::tool_runtime::sessions::TOOL_CALL_RECORDING_SESSION_ID_FIELD: "~s01"
+                }),
+            )),
+        ),
+        None,
+    )
+    .await;
+    let value = match outcome {
+        McpOutcome::BadRequest(value) => value,
+        other => panic!("expected malformed recorder ref BadRequest, got {other:?}"),
+    };
+    assert_eq!(value["error"]["code"], -32602);
+    assert!(value["error"]["message"]
+        .as_str()
+        .is_some_and(|message| message.contains("unknown_session_ref")));
+}
+
 #[allow(clippy::await_holding_lock)]
 #[tokio::test]
 async fn mcp_compact_stateless_wrapper_ids_still_reject_malformed_invocations() {
@@ -2790,8 +2818,27 @@ async fn mcp_tools_call_rejects_legacy_session_alias_even_with_canonical_recorde
 
 #[tokio::test]
 async fn mcp_tools_call_records_event_with_recording_session_id() {
-    let runtime = test_runtime();
-    let session = runtime.sessions.start_session(None, None);
+    let tmp = tempfile::tempdir().unwrap();
+    let runtime = test_runtime().with_project_reference_database(std::sync::Arc::new(
+        crate::Database::open(&tmp.path().join("recorder-refs.db")).unwrap(),
+    ));
+    let authority = crate::tool_runtime::workflow_session_authority_fingerprint(None)
+        .expect("local test principal should have stable authority");
+    let session = runtime
+        .sessions
+        .start_session_with_options(
+            crate::tool_runtime::SessionCreateOptions::new(
+                None,
+                Some("short recorder".to_string()),
+                crate::tool_runtime::SessionMode::Normal,
+                crate::tool_runtime::SessionGuards::default(),
+            )
+            .with_owner_authority_fingerprint(Some(authority)),
+        )
+        .unwrap();
+    let session_ref = runtime
+        .session_reference_for_id(&session.session_id, None)
+        .expect("test runtime should issue Session refs");
     let outcome = handle_mcp_request(
         &runtime,
         rpc(
@@ -2800,7 +2847,7 @@ async fn mcp_tools_call_records_event_with_recording_session_id() {
             mcp_2026_params(adaptive_runtime_gateway_params(
                 "list_projects",
                 json!({
-                    crate::tool_runtime::sessions::TOOL_CALL_RECORDING_SESSION_ID_FIELD: &session.session_id
+                    crate::tool_runtime::sessions::TOOL_CALL_RECORDING_SESSION_ID_FIELD: session_ref
                 }),
             )),
         ),
diff --git a/src/tool_runtime/kernel.rs b/src/tool_runtime/kernel.rs
index 33fc9fdc4..5560fdd4e 100644
--- a/src/tool_runtime/kernel.rs
+++ b/src/tool_runtime/kernel.rs
@@ -539,6 +539,26 @@ impl ToolRuntime {
                 correlation: Default::default(),
             };
         }
+        let canonical_recording_session_id = match context.session_id {
+            Some(raw) => match self.canonicalize_explicit_session_selector(raw, context.auth) {
+                Ok(canonical) => Some(canonical),
+                Err(message) => {
+                    return ToolCallOutcome {
+                        success: false,
+                        result: None,
+                        error_status: Some(ToolCallErrorStatus::InvalidArguments { message }),
+                        project: None,
+                        model_ergonomics: None,
+                        correlation: Default::default(),
+                    };
+                }
+            },
+            None => None,
+        };
+        let context = ToolCallContext {
+            session_id: canonical_recording_session_id.as_deref(),
+            ..context
+        };
         // Action-dependent gateways resolve exact policy before the generic
         // static Session/permission lifecycle and own one specialized ledger.
         if let Some(mut outcome) =
diff --git a/src/tool_runtime/model_references.rs b/src/tool_runtime/model_references.rs
index 4e5b7f438..9785ecebc 100644
--- a/src/tool_runtime/model_references.rs
+++ b/src/tool_runtime/model_references.rs
@@ -92,9 +92,23 @@ impl ToolRuntime {
         Some(Ok(record.canonical_id))
     }
 
+    pub(crate) fn canonicalize_explicit_session_selector(
+        &self,
+        raw: &str,
+        auth: Option<&AuthContext>,
+    ) -> Result<String, String> {
+        let Some(resolved) = self.resolve_session_reference(raw, auth) else {
+            return Ok(raw.to_string());
+        };
+        resolved.map_err(|_| {
+            format!(
+                "unknown_session_ref: {raw}; reuse a currently issued session_ref or the canonical wc_sess_* id"
+            )
+        })
+    }
+
     /// Canonicalize only the concrete business Session selector. Wrapper
-    /// recording_session_id is stripped by the transport adapter and never
-    /// enters this path.
+    /// recorder provenance uses the same selector primitive independently.
     pub(crate) fn canonicalize_session_reference_argument(
         &self,
         arguments: &mut Value,
@@ -106,15 +120,10 @@ impl ToolRuntime {
         let Some(raw) = object.get("session_id").and_then(Value::as_str) else {
             return Ok(());
         };
-        let Some(resolved) = self.resolve_session_reference(raw, auth) else {
-            return Ok(());
-        };
-        let canonical = resolved.map_err(|_| {
-            format!(
-                "unknown_session_ref: {raw}; reuse a currently issued session_ref or the canonical wc_sess_* id"
-            )
-        })?;
-        object.insert("session_id".to_string(), Value::String(canonical));
+        let canonical = self.canonicalize_explicit_session_selector(raw, auth)?;
+        if canonical != raw {
+            object.insert("session_id".to_string(), Value::String(canonical));
+        }
         Ok(())
     }
 }
@@ -260,6 +269,175 @@ mod tests {
         assert_eq!(arguments["session_id"], session_ref);
     }
 
+    #[test]
+    fn explicit_session_selector_reuses_session_ref_for_recorder_provenance() {
+        let tmp = tempfile::tempdir().unwrap();
+        let runtime = ToolRuntime::new_for_tests().with_project_reference_database(Arc::new(
+            crate::Database::open(&tmp.path().join("session-refs.db")).unwrap(),
+        ));
+        let authority = workflow_session_authority_fingerprint(None).unwrap();
+        let summary = runtime
+            .sessions
+            .start_session_with_options(
+                SessionCreateOptions::new(
+                    None,
+                    Some("recorder ref".to_string()),
+                    SessionMode::Normal,
+                    SessionGuards::default(),
+                )
+                .with_owner_authority_fingerprint(Some(authority)),
+            )
+            .unwrap();
+        let session_ref = runtime
+            .session_reference_for_id(&summary.session_id, None)
+            .unwrap();
+        assert_eq!(
+            runtime
+                .canonicalize_explicit_session_selector(&session_ref, None)
+                .unwrap(),
+            summary.session_id
+        );
+        assert_eq!(
+            runtime
+                .canonicalize_explicit_session_selector(&summary.session_id, None)
+                .unwrap(),
+            summary.session_id
+        );
+
+        runtime.sessions.close_session(&summary.session_id).unwrap();
+        assert_eq!(
+            runtime
+                .canonicalize_explicit_session_selector(&session_ref, None)
+                .unwrap(),
+            summary.session_id,
+            "recorder selector must preserve the existing canonical closed-Session behavior"
+        );
+    }
+
+    #[tokio::test]
+    async fn recording_session_ref_stays_separate_from_business_session_target() {
+        let tmp = tempfile::tempdir().unwrap();
+        let runtime = ToolRuntime::new_for_tests().with_project_reference_database(Arc::new(
+            crate::Database::open(&tmp.path().join("recorder-separation.db")).unwrap(),
+        ));
+        let authority = workflow_session_authority_fingerprint(None).unwrap();
+        let recorder = runtime
+            .sessions
+            .start_session_with_options(
+                SessionCreateOptions::new(
+                    None,
+                    Some("recorder".to_string()),
+                    SessionMode::Normal,
+                    SessionGuards::default(),
+                )
+                .with_owner_authority_fingerprint(Some(authority.clone())),
+            )
+            .unwrap();
+        let business = runtime
+            .sessions
+            .start_session_with_options(
+                SessionCreateOptions::new(
+                    None,
+                    Some("business".to_string()),
+                    SessionMode::Normal,
+                    SessionGuards::default(),
+                )
+                .with_owner_authority_fingerprint(Some(authority)),
+            )
+            .unwrap();
+        let recorder_ref = runtime
+            .session_reference_for_id(&recorder.session_id, None)
+            .unwrap();
+
+        let outcome = runtime
+            .call_tool_with_context(
+                crate::tool_runtime::kernel::ToolCallRequest {
+                    tool_name: "session_summary".to_string(),
+                    arguments: serde_json::json!({"session_id": business.session_id}),
+                },
+                crate::tool_runtime::kernel::ToolCallContext {
+                    transport: crate::tool_runtime::kernel::ToolTransport::Api,
+                    session_id: Some(&recorder_ref),
+                    auth: None,
+                    window: None,
+                    record_oauth_scope_denials: true,
+                    host_file_import_trust:
+                        crate::tool_runtime::kernel::HostFileImportTrust::Untrusted,
+                },
+            )
+            .await;
+        assert!(outcome.success, "{:?}", outcome.result);
+        let result = outcome.result.unwrap();
+        assert_eq!(result.output["session_id"], business.session_id);
+        let recorder_summary = runtime
+            .sessions
+            .summary(&recorder.session_id, Some(20))
+            .unwrap();
+        let recorded = recorder_summary
+            .events
+            .iter()
+            .find(|event| event.kind == "tool_call_started")
+            .expect("short recorder selector should record canonical provenance");
+        assert_eq!(recorded.tool_name, "session_summary");
+        assert_eq!(
+            recorded
+                .input_summary
+                .as_ref()
+                .expect("recorder event should keep bounded input summary")["session_id"],
+            business.session_id
+        );
+    }
+
+    #[test]
+    fn explicit_session_selector_fails_closed_for_foreign_or_deleted_ref() {
+        let tmp = tempfile::tempdir().unwrap();
+        let db_path = tmp.path().join("session-refs.db");
+        let mut alice = crate::auth::AuthContext::new(crate::auth::AuthKind::ApiToken);
+        alice.user_id = Some("user-alice".to_string());
+        alice.username = Some("alice".to_string());
+        alice.api_key_id = Some("key-alice".to_string());
+        alice.token_kind = Some("user".to_string());
+        let mut bob = crate::auth::AuthContext::new(crate::auth::AuthKind::ApiToken);
+        bob.user_id = Some("user-bob".to_string());
+        bob.username = Some("bob".to_string());
+        bob.api_key_id = Some("key-bob".to_string());
+        bob.token_kind = Some("user".to_string());
+
+        let session_ref = {
+            let runtime = ToolRuntime::new_for_tests().with_project_reference_database(Arc::new(
+                crate::Database::open(&db_path).unwrap(),
+            ));
+            let authority = workflow_session_authority_fingerprint(Some(&alice)).unwrap();
+            let summary = runtime
+                .sessions
+                .start_session_with_options(
+                    SessionCreateOptions::new(
+                        None,
+                        Some("foreign recorder".to_string()),
+                        SessionMode::Normal,
+                        SessionGuards::default(),
+                    )
+                    .with_owner_authority_fingerprint(Some(authority)),
+                )
+                .unwrap();
+            let session_ref = runtime
+                .session_reference_for_id(&summary.session_id, Some(&alice))
+                .unwrap();
+            assert!(runtime
+                .canonicalize_explicit_session_selector(&session_ref, Some(&bob))
+                .unwrap_err()
+                .contains("unknown_session_ref"));
+            session_ref
+        };
+
+        let restarted = ToolRuntime::new_for_tests()
+            .with_project_reference_database(Arc::new(crate::Database::open(&db_path).unwrap()));
+        assert!(restarted
+            .canonicalize_explicit_session_selector(&session_ref, Some(&alice))
+            .unwrap_err()
+            .contains("unknown_session_ref"));
+    }
+
     #[test]
     fn durable_session_ref_never_retargets_after_runtime_restart() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/src/tool_runtime/startup_brief.rs b/src/tool_runtime/startup_brief.rs
index cc1d3aa0f..0d4bfa55f 100644
--- a/src/tool_runtime/startup_brief.rs
+++ b/src/tool_runtime/startup_brief.rs
@@ -79,7 +79,7 @@ pub(crate) fn builtin_coding_workflow_projection(profile: CodingGuidanceProfile)
             "goal_continuation": "Automatic continuation needs an exact explicit durable controller Agent and the existing production Host carrier. Reuse the same Agent already made callable by explicit setup or exact Wake context; never infer Agent identity from a Window or create a second Goal-only identity. An Agent may be both Task assignee and Goal controller: Tasks/Attempts own execution, the controller routes next reasoning only. Goal Plan detects; the separate Agent Continuation card carries turns. Stalled is not offline; dispatch acceptance is not resume. An exact stall Wake requires bootstrap, immediate consume, get_goal and exact Session handoff recovery; never retry an uncertain prior effect.",
             "goal_checkpoint": "After a plan phase completes, prefer _control.before.goal_progress on the next ordinary call: mark the previous phase complete and next phase current with exact revision/key. Record only facts already true; never pre-complete tests or defer checkpoints to closeout. checkpoint_goal remains valid standalone. Complete all steps and verify/review before explicit update_goal or finish_coding_task + goal_completion; the Server cannot judge natural-language conditions.",
             "handoff_recovery": "Use handoff recovery only after task-context loss/compaction/restart, explicit cross-window/Agent handoff, or user-requested recovery. Never use it for routine progress/baselines. A frontend timeout alone does not imply Workflow Session loss. If task context is genuinely lost and the exact session_id is unknown, request context_request=[\"workflow.resume\"], choose an exact authorized candidate, call session_handoff_summary with the exact session_id, check basis completeness, then resume with work_on_project(project=..., session_id=...). A dirty workspace after context loss is not evidence of external or concurrent modification by itself. Recover exact Workflow Session evidence first.",
-            "session_recording": "When work_on_project creates or resumes, pass recording_session_id for recorder provenance only. business session_id may target another Session; it grants no authority.",
+            "session_recording": "When work_on_project creates or resumes, prefer its returned session_ref as recording_session_id for recorder provenance only; canonical wc_sess_* remains valid. business session_id may target another Session; it grants no authority.",
             "session_message_ack": "For retained session_attention with requires_ack, echo ack_session_message_ids. This proves model-context retention only; it never resolves messages, grants authority, or gates execution.",
             "session_message_resolution": "For a handled non-todo, send session_message_resolution on the next ordinary call with recording_session_id; if requires_ack, also send ack_session_message_ids. It cannot predict the main call. Todos use complete_session_message.",
             "control_sidecars": "_control is optional: piggyback an established transition only when an ordinary call is already needed; otherwise omit it or use the standalone canonical tool. before supports goal_progress, wake_consume, attempt_heartbeat, session_context_update; after_success supports todo_completion, plus goal_completion/session_close on non-blocking finish_coding_task. One mutation per phase, independently authorized; no automatic transitions. Post failure preserves main success. session_context_update is fail-closed pending CAS/replay support.",
diff --git a/src/tool_runtime/tests/sessions_guards.rs b/src/tool_runtime/tests/sessions_guards.rs
index 2945c988d..075cf27ce 100644
--- a/src/tool_runtime/tests/sessions_guards.rs
+++ b/src/tool_runtime/tests/sessions_guards.rs
@@ -318,14 +318,30 @@ async fn read_only_recording_session_does_not_guard_same_project_write() {
 #[tokio::test]
 async fn closed_recording_session_remains_provenance_only_for_business_write() {
     let tmp = tempfile::tempdir().unwrap();
-    let runtime = test_runtime();
+    let runtime = test_runtime().with_project_reference_database(std::sync::Arc::new(
+        crate::Database::open(&tmp.path().join("closed-recorder-refs.db")).unwrap(),
+    ));
     let project =
         register_runner_project_at_path(&runtime, "guard-closed-recorder", "demo", tmp.path())
             .await;
     let auth = auth_context(None, true);
+    let authority = crate::tool_runtime::workflow_session_authority_fingerprint(Some(&auth))
+        .expect("closed recorder auth should have stable authority");
     let recorder = runtime
         .sessions
-        .start_session(Some(project.clone()), Some("closed recorder".to_string()));
+        .start_session_with_options(
+            crate::tool_runtime::SessionCreateOptions::new(
+                Some(project.clone()),
+                Some("closed recorder".to_string()),
+                crate::tool_runtime::SessionMode::Normal,
+                crate::tool_runtime::SessionGuards::default(),
+            )
+            .with_owner_authority_fingerprint(Some(authority)),
+        )
+        .unwrap();
+    let recorder_ref = runtime
+        .session_reference_for_id(&recorder.session_id, Some(&auth))
+        .expect("closed recorder test should issue a Session ref before close");
     runtime
         .sessions
         .close_session(&recorder.session_id)
@@ -334,7 +350,7 @@ async fn closed_recording_session_remains_provenance_only_for_business_write() {
     let task = tokio::spawn({
         let runtime = runtime.clone();
         let project = project.clone();
-        let recorder_id = recorder.session_id.clone();
+        let recorder_id = recorder_ref;
         let auth = auth.clone();
         async move {
             runtime
diff --git a/src/tool_runtime/tests/startup_brief.rs b/src/tool_runtime/tests/startup_brief.rs
index 3e6780290..dda59a9ae 100644
--- a/src/tool_runtime/tests/startup_brief.rs
+++ b/src/tool_runtime/tests/startup_brief.rs
@@ -132,6 +132,8 @@ fn assert_builtin_workflow(output: &Value) {
         .expect("Session recording guidance");
     assert!(recording_guidance.contains("work_on_project creates or resumes"));
     assert!(recording_guidance.contains("recording_session_id"));
+    assert!(recording_guidance.contains("prefer its returned session_ref"));
+    assert!(recording_guidance.contains("canonical wc_sess_* remains valid"));
     assert!(recording_guidance.contains("recorder provenance only"));
     assert!(recording_guidance.contains("business session_id may target another Session"));
     assert!(recording_guidance.contains("grants no authority"));