diff --git a/MandoCode b/MandoCode
index 859db1a..7200b81 160000
--- a/MandoCode
+++ b/MandoCode
@@ -1 +1 @@
-Subproject commit 859db1aec45392e9a5470af5366ae96499b4ada5
+Subproject commit 7200b81371c06762f5f521bb1361189ba9b86d5d
diff --git a/docs/session-persistence.md b/docs/session-persistence.md
new file mode 100644
index 0000000..9135caa
--- /dev/null
+++ b/docs/session-persistence.md
@@ -0,0 +1,86 @@
+# Session Persistence & Snapshots
+
+How MandoCode Desktop remembers — the concepts, the architecture, and where it goes next.
+
+## The two concepts
+
+- **History JSON is *memory*** — verbatim, heavy, machine-format, tied to one conversation's
+  continuation. It answers *"resume exactly where I was."*
+- **A snapshot is a *knowledge artifact*** — distilled by an LLM, named by you, human-readable,
+  cheap to inject anywhere. It answers *"carry what we learned somewhere else."*
+
+> **Memory doesn't transfer between minds; knowledge does.**
+
+That line is the design rule. Anything that continues *the same* conversation (relaunch, model
+switch on the same tab) should use memory. Anything that moves context *between* conversations
+(another agent, another project, a fresh start) should use knowledge — a snapshot. When a new
+feature needs "the agent should know about X," ask which side of the line X lives on.
+
+## The persistence tiers
+
+Each tier ships independently and degrades gracefully into the one below it.
+
+| Tier | What survives | Store | Mechanism |
+|------|---------------|-------|-----------|
+| 1 | Workspace shape: tabs, titles, folders, models, active tab | `workspace.json` | Saved on every structural change + close; restored at launch |
+| 1 | Snapshots | `snapshots.json` | Rewritten on add/remove; loaded at construction |
+| 2 | The visible transcript | `transcripts/<key>.jsonl` | Append-on-write journal of every HTML block; replayed into the WebView on restore |
+| 3 | The model's memory | `histories/<key>.json` | `AIService.ExportHistoryJson()` at every turn end (write-then-rename); `TryRestoreHistoryJson()` on restore |
+| 3 fallback | A plain-text tail of the dialogue | `conversations/<key>.jsonl` | Armed as imported background on the next send when full fidelity can't apply |
+
+All stores live under `%LOCALAPPDATA%\MandoCode.Desktop\`, keyed by each session's durable
+`PersistKey` (a GUID that survives relaunches, unlike the process-local session Id). All writes
+are best-effort and append-or-atomic: a crash loses at most the in-flight block. Caps are
+enforced on the **write** side, not just at load — an app that never restarts must still have
+bounded files.
+
+### The restore cascade (per tab, in order)
+
+1. **Full fidelity** — rehydrate the harness `ChatHistory` verbatim, tool calls included.
+   The agent genuinely *remembers*. Runs only **after** any saved model is re-selected,
+   because model selection clears history.
+2. **Tail-brief** — a bounded verbatim excerpt of the dialogue rides the next send as
+   imported background. The agent is *briefed*, not remembering.
+3. **Honest amnesia** — if a transcript was replayed but no memory exists, the model is told
+   exactly that, so it never has to guess about pixels it can't see.
+
+Cleanup is symmetrical: `/clear`, closing a tab, and the startup orphan sweep remove all of a
+session's files together. Cleared means cleared.
+
+## Model switches
+
+A switch clears the live history ("a different model mid-history is a different conversation"
+was the original stance — from before any serialization existed). The offer bar now presents
+both sides of the concept line:
+
+- **Keep memory** — the pre-switch history is re-imported verbatim; the same conversation
+  continues under the new model. Right choice cloud↔cloud or when moving to a *bigger* model.
+- **Snapshot** — the conversation is summarized into a named, portable recap. Right choice
+  when **downsizing** (a small local model may not fit the verbatim history) or when you want
+  a clean slate plus the lessons.
+
+"Keep memory" appears only for switch offers, never for manual "Take snapshot" offers (nothing
+was cleared, there is nothing to carry). If the verbatim import fails, the offer stays up and
+the snapshot path remains as salvage.
+
+## Where snapshots are left off (future building)
+
+Snapshots persist across launches now, they record their project root, and IDs survive — but
+the panel hasn't caught up: **no grouping by project, no search, and the import UX is
+unchanged.** Those are polish items waiting for the snapshot library to grow now that it's
+durable. Nothing broken, just room.
+
+Other known headroom, in rough order of value:
+
+- **Session history browser** — the per-key journals already on disk would support a
+  "reopen any past conversation as a new tab" picker (Claude Code's `/resume` equivalent),
+  not just restoring the tabs that were open at close.
+- **Summarize-at-restore upgrade** — the tail-brief fallback could run `HistorySummarizer`
+  over the stored dialogue instead of excerpting it, trading an LLM call for better coverage
+  of long sessions.
+- **CLI `--continue`** — `ExportHistoryJson`/`TryRestoreHistoryJson` live in the harness
+  precisely so the CLI can grow its own resume without new plumbing.
+- **Cross-provider carry verification** — verbatim history with function-call content moving
+  between Ollama and cloud connectors should map cleanly through Semantic Kernel's generic
+  content types; it deserves a deliberate test before "Keep memory" is treated as guaranteed
+  across providers (the graceful fallback already handles failure).
diff --git a/src/MandoCode.Desktop/Controls/ChatTabView.xaml b/src/MandoCode.Desktop/Controls/ChatTabView.xaml
index bfc3f77..cfb890f 100644
--- a/src/MandoCode.Desktop/Controls/ChatTabView.xaml
+++ b/src/MandoCode.Desktop/Controls/ChatTabView.xaml
@@ -378,14 +378,22 @@
                         <ColumnDefinition Width="*"/>
                         <ColumnDefinition Width="Auto"/>
                         <ColumnDefinition Width="Auto"/>
+                        <ColumnDefinition Width="Auto"/>
                     </Grid.ColumnDefinitions>
                     <FontIcon Glyph="&#xE722;" FontSize="14" VerticalAlignment="Center"
                               Foreground="{StaticResource MandoAccentBrush}"/>
                     <TextBlock x:Name="SnapshotNotifyText" Grid.Column="1" VerticalAlignment="Center"
                                FontSize="13" TextTrimming="CharacterEllipsis"/>
-                    <Button Grid.Column="2" Content="Create" Padding="12,4"
-                            Click="SnapshotNotifyCreate_Click" Style="{StaticResource AccentButtonStyle}"/>
-                    <Button Grid.Column="3" Click="SnapshotOfferDismiss_Click" Padding="6"
+                    <!-- Model switches only (hidden for manual snapshot offers): continue the
+                         SAME conversation on the new model, verbatim — memory, not a recap. -->
+                    <Button x:Name="SnapshotKeepMemoryButton" Grid.Column="2" Content="Keep memory"
+                            Padding="12,4" Visibility="Collapsed" Click="SnapshotKeepMemory_Click"
+                            Style="{StaticResource AccentButtonStyle}"
+                            ToolTipService.ToolTip="Continue this conversation on the new model with full memory — nothing summarized, nothing lost"/>
+                    <Button Grid.Column="3" Content="Snapshot" Padding="12,4"
+                            Click="SnapshotNotifyCreate_Click"
+                            ToolTipService.ToolTip="Save a summarized, portable recap you can import into any agent"/>
+                    <Button Grid.Column="4" Click="SnapshotOfferDismiss_Click" Padding="6"
                             Background="Transparent" BorderThickness="0"
                             ToolTipService.ToolTip="Dismiss — the conversation won't be saved">
                         <FontIcon Glyph="&#xE711;" FontSize="12"/>
diff --git a/src/MandoCode.Desktop/Controls/ChatTabView.xaml.cs b/src/MandoCode.Desktop/Controls/ChatTabView.xaml.cs
index 970b117..624609b 100644
--- a/src/MandoCode.Desktop/Controls/ChatTabView.xaml.cs
+++ b/src/MandoCode.Desktop/Controls/ChatTabView.xaml.cs
@@ -169,8 +169,12 @@ public async Task InitializeAsync()
 
             core.Settings.AreDefaultContextMenusEnabled = true;
             core.Settings.AreDevToolsEnabled = true;   // F12 in the transcript
-            core.NavigationCompleted += (_, _) =>
+            core.NavigationCompleted += async (_, _) =>
             {
+                // Replay the journaled transcript FIRST (while _webViewReady is still false,
+                // so live blocks keep queueing) — restored history must precede this
+                // launch's boot output.
+                await RestoreJournaledTranscriptAsync();
                 _webViewReady = true;
                 while (_pendingHtml.Count > 0) AppendHtml(_pendingHtml.Dequeue());
             };
@@ -348,6 +352,120 @@ public void HandleEscape()
     // Transcript
     // ============================================================
 
+    private bool _journalRestored;
+
+    /// <summary>Replays this session's journaled transcript into the fresh WebView — via
+    /// ExecuteScript directly, NOT through TranscriptWriter (that would re-journal every
+    /// block). Chunked so a long history is a few script calls, not a thousand.</summary>
+    private async Task RestoreJournaledTranscriptAsync()
+    {
+        if (_journalRestored) return;
+        _journalRestored = true;
+        try
+        {
+            var blocks = TranscriptJournal.Load(Session.PersistKey)
+                .Where(b => !TranscriptHtmlBuilder.IsEphemeralStatus(b))
+                .ToList();
+            if (blocks.Count == 0) return;
+
+            var chunk = new System.Text.StringBuilder();
+            foreach (var block in blocks)
+            {
+                chunk.Append(block);
+                if (chunk.Length > 400_000)
+                {
+                    await AppendRawAsync(chunk.ToString());
+                    chunk.Clear();
+                }
+            }
+            if (chunk.Length > 0) await AppendRawAsync(chunk.ToString());
+
+            // Divider goes through AppendRawAsync too — journaling it would stack one
+            // divider per relaunch. Memory restore happens LATER (RestoreConversationMemoryAsync,
+            // called by MainWindow after any saved model is re-selected — a model switch clears
+            // history, so restoring memory here would risk it being wiped moments later).
+            _replayedBlockCount = blocks.Count;
+            await AppendRawAsync(_html.Dim("— restored from your previous session —"));
+        }
+        catch { /* a failed replay must never block a fresh conversation */ }
+    }
+
+    private int _replayedBlockCount;
+
+    /// <summary>
+    /// Gives the restored session its memory back, best fidelity first. Called by MainWindow
+    /// AFTER the tab's harness is initialized and any saved model re-selected. Cascade:
+    /// 1) full-fidelity harness history (the agent genuinely remembers, tool calls included);
+    /// 2) plain-text tail armed as imported background (briefed, not remembering);
+    /// 3) an honest amnesia note, so the model never has to guess about the replayed pixels.
+    /// Fresh tabs have none of the files and fall straight through as a no-op.
+    /// </summary>
+    public async Task RestoreConversationMemoryAsync()
+    {
+        try
+        {
+            // 1) Full fidelity: rehydrate the harness's ChatHistory verbatim.
+            var historyJson = SessionHistoryStore.Load(Session.PersistKey);
+            if (historyJson != null)
+            {
+                var restored = await Task.Run(() => Session.Ai.TryRestoreHistoryJson(historyJson));
+                if (restored > 0)
+                {
+                    await AppendRawAsync(_html.Dim(
+                        $"Conversation memory restored — the agent remembers this session ({restored} messages)."));
+                    return;
+                }
+            }
+
+            // 2) Tail-brief: bounded verbatim excerpt rides the next send as imported background.
+            var turns = ConversationLog.Load(Session.PersistKey);
+            if (turns.Count > 0)
+            {
+                const int budget = 12_000;
+                var picked = new List<ConversationTurn>();
+                var used = 0;
+                for (var i = turns.Count - 1; i >= 0; i--)
+                {
+                    if (picked.Count > 0 && used + turns[i].T.Length > budget) break;
+                    picked.Add(turns[i]);
+                    used += turns[i].T.Length;
+                }
+                picked.Reverse();
+
+                var sb = new System.Text.StringBuilder();
+                if (picked.Count < turns.Count)
+                    sb.Append($"(Older turns omitted — this is the most recent {picked.Count} of {turns.Count}.)\n\n");
+                foreach (var turn in picked)
+                    sb.Append(turn.R == "u" ? "User: " : "Assistant: ").Append(turn.T).Append("\n\n");
+
+                _controller.ArmRestoredConversation(
+                    "From \"your previous session in this tab\" (verbatim excerpt, not a recap):\n" +
+                    sb.ToString().TrimEnd());
+                await AppendRawAsync(_html.Dim(
+                    "Context re-armed — the agent will be briefed on this conversation with your next message."));
+                return;
+            }
+
+            // 3) Transcript was replayed but no memory of any kind exists — say so to the model.
+            if (_replayedBlockCount > 0)
+                _controller.NoteWorkspaceEvent(
+                    "This tab was restored from a previous session. The transcript the user sees above is a replay " +
+                    "for their benefit; it is NOT in your context and you have no memory of it. If the user refers " +
+                    "to earlier work, say so honestly and re-read files instead of guessing.");
+        }
+        catch { /* memory restore is best-effort; a fresh conversation always works */ }
+    }
+
+    private async Task AppendRawAsync(string html)
+    {
+        try
+        {
+            await TranscriptView.CoreWebView2.ExecuteScriptAsync(
+                $"window.__append({JsonSerializer.Serialize(html)})");
+        }
+        catch { }
+    }
+
     private async void AppendHtml(string html)
     {
         if (_shutDown) return;
@@ -397,7 +515,12 @@ private void RefreshSnapshotOffer()
         }
 
         // Stage 1: notification bar. Non-blocking — the user can ignore it and keep prompting.
-        SnapshotNotifyText.Text = $"Snapshot available — save the {offer.OriginModel} conversation.";
+        // "Keep memory" only appears when a switch actually cleared a conversation.
+        SnapshotKeepMemoryButton.Visibility = _controller.CanCarryMemory
+            ? Visibility.Visible : Visibility.Collapsed;
+        SnapshotNotifyText.Text = _controller.CanCarryMemory
+            ? $"Keep the {offer.OriginModel} conversation going, or save it as a snapshot?"
+            : $"Snapshot available — save the {offer.OriginModel} conversation.";
         SnapshotNotifyBar.Visibility = Visibility.Visible;
         SnapshotOfferCard.Visibility = Visibility.Collapsed;
         SnapshotOfferRoot.Visibility = Visibility.Visible;
@@ -534,6 +657,12 @@ private void SetSnapshotBusy(bool busy)
     private void SnapshotOfferDismiss_Click(object sender, RoutedEventArgs e)
         => _controller.DismissSnapshotOffer();
 
+    /// <summary>"Keep memory": verbatim continuation on the new model. On success the offer
+    /// clears itself (SnapshotOfferChanged → RefreshSnapshotOffer); on failure the bar stays
+    /// so Snapshot remains available as the salvage path.</summary>
+    private void SnapshotKeepMemory_Click(object sender, RoutedEventArgs e)
+        => _controller.TryCarryMemoryAcrossSwitch();
+
     /// <summary>Saves this tab's transcript as a standalone HTML page. Shared by the header save
     /// button and the tab's options menu.</summary>
     public async Task ExportTranscriptAsync()
@@ -628,6 +757,12 @@ private void UpdateBusy(bool busy, string? activity)
             // detecting OUTSIDE-the-conversation changes before the next send.
             _wsTracker.MarkCapturePending();
             RefreshBranchChip(force: true);
+
+            // Persist the model's full memory as of this turn (tier-3 full fidelity).
+            // Off-thread: serialization of a long history shouldn't touch UI latency.
+            var key = Session.PersistKey;
+            var ai = Session.Ai;
+            _ = Task.Run(() => SessionHistoryStore.Save(key, ai.ExportHistoryJson()));
         }
     }
 
diff --git a/src/MandoCode.Desktop/MainWindow.xaml.cs b/src/MandoCode.Desktop/MainWindow.xaml.cs
index 72e244a..329af07 100644
--- a/src/MandoCode.Desktop/MainWindow.xaml.cs
+++ b/src/MandoCode.Desktop/MainWindow.xaml.cs
@@ -177,7 +177,27 @@ public MainWindow()
 
         // The first agent. Its whole service graph — AIService, approvals, transcript, token
         // tracking — belongs to it alone, so opening a second tab can't disturb it.
-        CreateChatTab();
+        // Reopen the previous workspace shape (tabs, roots, models, active tab). Folders
+        // that no longer exist are skipped; no saved shape (or nothing usable) means the
+        // classic single default tab.
+        var shape = WorkspaceState.TryLoad();
+        if (shape != null)
+        {
+            foreach (var t in shape.Tabs.Where(t => Directory.Exists(t.ProjectRoot)))
+                CreateChatTab(t.ProjectRoot, t.Title, t.Model, t.Key);
+            if (_tabs.Count == 0) CreateChatTab();
+            else SelectTab(_tabs[Math.Clamp(shape.ActiveIndex, 0, _tabs.Count - 1)]);
+        }
+        else
+        {
+            CreateChatTab();
+        }
+
+        // Journals whose sessions no longer exist (tabs closed during a crash, pruned
+        // folders) have nothing to replay into — clean them up.
+        TranscriptJournal.Sweep(_tabs.Select(t => t.View.Session.PersistKey));
+        ConversationLog.Sweep(_tabs.Select(t => t.View.Session.PersistKey));
+        SessionHistoryStore.Sweep(_tabs.Select(t => t.View.Session.PersistKey));
 
         // Size the window; defer WebView2 + harness init until the tree is loaded.
         AppWindow.Resize(new Windows.Graphics.SizeInt32(1180, 840));
@@ -193,6 +213,7 @@ public MainWindow()
     /// </summary>
     private void MainWindow_Closed(object sender, WindowEventArgs args)
     {
+        SaveWorkspace();   // capture the shape BEFORE teardown starts mutating state
         foreach (var tab in _tabs) tab.View.Shutdown();
         _terminal?.ShutDown();   // kill any ConPTY shells so no processes leak
 
@@ -380,10 +401,42 @@ private void Root_Loaded(object sender, RoutedEventArgs e)
     {
         if (_initialized) return;
         _initialized = true;
-        _ = _tabs[0].View.InitializeAsync();
+        // Restored workspaces can open with several tabs — initialize them all (each owns
+        // its WebView2 + harness, same cost as if the user had opened them by hand).
+        foreach (var entry in _tabs) _ = InitTabAsync(entry);
         InitBgPreview();
     }
 
+    private async Task InitTabAsync(ChatTabEntry entry)
+    {
+        await entry.View.InitializeAsync();
+        // Best-effort per-tab model restore: if the saved model is gone (Ollama not running,
+        // cloud model renamed), the tab simply keeps the default and says so in its header.
+        var desired = entry.RestoreModel;
+        if (!string.IsNullOrEmpty(desired) && desired != entry.View.Session.Controller.ModelName)
+        {
+            await Task.Run(() => entry.View.Session.Controller.SelectModelAsync(desired));
+            entry.View.UpdateHeader();
+        }
+
+        // Memory comes back only after the model has settled — selecting a model clears
+        // history, so this order is what keeps the restored memory alive.
+        await entry.View.RestoreConversationMemoryAsync();
+    }
+
+    /// <summary>Writes the current workspace shape (tabs + active) to disk. Called on close
+    /// and after any structural change, so even a crash loses at most the latest tweak.</summary>
+    private void SaveWorkspace()
+    {
+        var tabs = _tabs.Select(t => new WorkspaceTabState(
+            t.View.Session.Title,
+            t.View.Session.ProjectRoot.ProjectRoot,
+            t.View.Session.Controller.ModelName,
+            t.View.Session.PersistKey)).ToList();
+        var active = _selected == null ? 0 : Math.Max(0, _tabs.IndexOf(_selected));
+        WorkspaceState.Save(new WorkspaceShape(tabs, active));
+    }
+
     // ============================================================
     // Appearance-page live preview — a real miniature transcript
     // ============================================================
@@ -500,6 +553,10 @@ private sealed class ChatTabEntry
         public required TextBlock Label { get; init; }
         public required Ellipse Badge { get; init; }
         public required ChatTabView View { get; init; }
+
+        /// <summary>Model to select once this tab's harness is initialized — set only for
+        /// tabs recreated from a saved workspace. Best-effort: unavailable model = default.</summary>
+        public string? RestoreModel { get; init; }
     }
 
     private readonly List<ChatTabEntry> _tabs = new();
@@ -517,11 +574,13 @@ private void AddTab_Click(object sender, RoutedEventArgs e)
     {
         var entry = CreateChatTab();
         _ = entry.View.InitializeAsync();
+        SaveWorkspace();
     }
 
-    private ChatTabEntry CreateChatTab()
+    private ChatTabEntry CreateChatTab(string? projectRoot = null, string? title = null, string? restoreModel = null, string? persistKey = null)
     {
-        var session = _sessions.CreateSession();
+        var session = _sessions.CreateSession(projectRoot, persistKey);
+        if (!string.IsNullOrWhiteSpace(title)) session.Title = title;
         var view = new ChatTabView(this, session, _html) { Visibility = Visibility.Collapsed };
 
         view.SetupRequested += () => SwitchPage("settings");
@@ -537,12 +596,13 @@ private ChatTabEntry CreateChatTab()
         {
             var tab = _tabs.FirstOrDefault(t => ReferenceEquals(t.View, v));
             if (tab != null) tab.Label.Text = v.Session.Title;
+            SaveWorkspace();   // renames, folder switches, and model switches all land here
         };
 
         TabHost.Children.Add(view);
 
         var (header, label, badge) = BuildTabHeader(session.Title);
-        var entry = new ChatTabEntry { Header = header, Label = label, Badge = badge, View = view };
+        var entry = new ChatTabEntry { Header = header, Label = label, Badge = badge, View = view, RestoreModel = restoreModel };
         _tabs.Add(entry);
         TabStrip.Children.Add(header);
         WireHeader(entry);
@@ -1017,15 +1077,20 @@ private void CloseTab(ChatTabEntry entry)
         entry.View.Shutdown();
         TabHost.Children.Remove(entry.View);
         _sessions.CloseSession(entry.View.Session);
+        TranscriptJournal.Delete(entry.View.Session.PersistKey);   // closed tab = conversation gone
+        ConversationLog.Delete(entry.View.Session.PersistKey);
+        SessionHistoryStore.Delete(entry.View.Session.PersistKey);
 
         if (!ReferenceEquals(_selected, entry))
         {
             RefreshTabStrip();
+            SaveWorkspace();
             return;
         }
 
         _selected = null;
         SelectTab(_tabs[Math.Min(index, _tabs.Count - 1)]);
+        SaveWorkspace();
     }
 
     private void RefreshTabStrip()
diff --git a/src/MandoCode.Desktop/Services/AgentSession.cs b/src/MandoCode.Desktop/Services/AgentSession.cs
index e23af0d..e8848d4 100644
--- a/src/MandoCode.Desktop/Services/AgentSession.cs
+++ b/src/MandoCode.Desktop/Services/AgentSession.cs
@@ -37,6 +37,11 @@ public sealed class AgentSession
     /// <summary>Tab-strip label. Defaults to the project folder's leaf name.</summary>
     public string Title { get; set; }
 
+    /// <summary>Durable identity across app launches (unlike <see cref="Id"/>, a process-local
+    /// counter). Names this session's transcript journal on disk; a restored tab passes its
+    /// saved key back in so it reattaches to its own history.</summary>
+    public string PersistKey { get; }
+
     // ---- Per-session graph ----
     public MandoCodeConfig Config { get; }
     public ProjectRootAccessor ProjectRoot { get; }
@@ -61,9 +66,11 @@ public AgentSession(
         IServiceProvider globals,
         ConfigCoordinator configs,
         McpCoordinator mcp,
-        string projectRoot)
+        string projectRoot,
+        string? persistKey = null)
     {
         Id = Interlocked.Increment(ref _nextId);
+        PersistKey = string.IsNullOrWhiteSpace(persistKey) ? Guid.NewGuid().ToString("N") : persistKey;
 
         // Globals — shared with every other tab. The MCP manager comes from the coordinator that
         // owns it, not from DI, so every agent talks to the one set of server processes.
@@ -92,6 +99,15 @@ public AgentSession(
 
         Busy = new BusyStateService();
         Transcript = new TranscriptWriter();
+        // Journal every transcript block as it's written (tier-2 session persistence).
+        // /clear also clears the on-disk history — cleared means cleared, both files.
+        Transcript.BlockAdded += htmlBlock => TranscriptJournal.Append(PersistKey, htmlBlock);
+        Transcript.Cleared += () =>
+        {
+            TranscriptJournal.Delete(PersistKey);
+            ConversationLog.Delete(PersistKey);
+            SessionHistoryStore.Delete(PersistKey);
+        };
         PromptGate = new ApprovalPromptGate();
         Approvals = new WinUiApprovalService(PromptGate, Busy, PlanHandoff, Transcript, html);
         Shell = new ShellRunner(ProjectRoot, Transcript, html);
@@ -101,6 +117,10 @@ public AgentSession(
             mcpManager, McpGate, Skills, FileProvider, ProjectRoot,
             music, updateCheck, Approvals, Transcript, html, Busy, Shell, PromptGate,
             configs, mcp, Snapshots);
+
+        // Tier-3 persistence: plain-text turns feed the ConversationLog so a restored
+        // session can re-brief the model.
+        Controller.ConversationLogger = (role, text) => ConversationLog.Append(PersistKey, role, text);
     }
 
     /// <summary>Repoints this tab at a different project folder and rebuilds its AI session.</summary>
diff --git a/src/MandoCode.Desktop/Services/ContextSnapshot.cs b/src/MandoCode.Desktop/Services/ContextSnapshot.cs
index d610bc5..0ef5784 100644
--- a/src/MandoCode.Desktop/Services/ContextSnapshot.cs
+++ b/src/MandoCode.Desktop/Services/ContextSnapshot.cs
@@ -31,10 +31,16 @@ public sealed class ContextSnapshot
     /// <summary>Conversation length (messages, excluding the system prompt).</summary>
     public required int MessageCount { get; init; }
 
+    /// <summary>Project folder the conversation happened in, when known — lets the panel
+    /// group snapshots by project now that they survive across launches.</summary>
+    public string? ProjectRoot { get; init; }
+
     // ---- display helpers for the snapshots panel ----
 
     /// <summary>Card title: the user's name if given, else the model that had the conversation.</summary>
+    [System.Text.Json.Serialization.JsonIgnore]
     public string DisplayTitle => string.IsNullOrWhiteSpace(Name) ? OriginModel : Name!;
 
+    [System.Text.Json.Serialization.JsonIgnore]
     public string TimeLabel => CapturedAt.LocalDateTime.ToString("MMM d · h:mm tt");
 }
diff --git a/src/MandoCode.Desktop/Services/ConversationLog.cs b/src/MandoCode.Desktop/Services/ConversationLog.cs
new file mode 100644
index 0000000..c358b32
--- /dev/null
+++ b/src/MandoCode.Desktop/Services/ConversationLog.cs
@@ -0,0 +1,115 @@
+using System.Text.Json;
+
+namespace MandoCode.Desktop.Services;
+
+/// <summary>One turn in the plain-text conversation log ("u" = user, "a" = assistant).</summary>
+public sealed record ConversationTurn(string R, string T);
+
+/// <summary>
+/// Tier-3 companion to <see cref="TranscriptJournal"/>: a per-session plain-TEXT log of
+/// user/assistant turns (no HTML, no tool chrome), used to re-brief the model after a
+/// restart. Same contract as the journal: append-on-write (crash-safe), write-side cap
+/// (bounded even if the app never restarts), best-effort everywhere.
+/// </summary>
+public static class ConversationLog
+{
+    private const int MaxTurns = 200;
+    private const int TrimSlack = 64;
+    /// <summary>Per-turn size cap — one giant paste must not dominate the re-brief.</summary>
+    private const int MaxTurnChars = 4000;
+
+    private static readonly object Gate = new();
+    private static readonly Dictionary<string, int> Counts = new(StringComparer.OrdinalIgnoreCase);
+
+    private static string Folder => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "MandoCode.Desktop", "conversations");
+
+    private static string PathFor(string key) => Path.Combine(Folder, key + ".jsonl");
+
+    public static void Append(string key, string role, string text)
+    {
+        try
+        {
+            if (string.IsNullOrWhiteSpace(text)) return;
+            if (text.Length > MaxTurnChars) text = text[..MaxTurnChars] + "… [truncated]";
+
+            lock (Gate)
+            {
+                Directory.CreateDirectory(Folder);
+                var path = PathFor(key);
+
+                if (!Counts.TryGetValue(key, out var count))
+                    count = File.Exists(path) ? File.ReadLines(path).Count() : 0;
+
+                File.AppendAllText(path, JsonSerializer.Serialize(new ConversationTurn(role, text)) + "\n");
+                count++;
+
+                if (count > MaxTurns + TrimSlack)
+                {
+                    var tail = File.ReadAllLines(path).Where(l => l.Length > 0).TakeLast(MaxTurns).ToArray();
+                    File.WriteAllLines(path, tail);
+                    count = tail.Length;
+                }
+
+                Counts[key] = count;
+            }
+        }
+        catch { }
+    }
+
+    /// <summary>Turns oldest-first; empty on any failure.</summary>
+    public static IReadOnlyList<ConversationTurn> Load(string key)
+    {
+        try
+        {
+            var path = PathFor(key);
+            if (!File.Exists(path)) return Array.Empty<ConversationTurn>();
+
+            string[] lines;
+            lock (Gate) lines = File.ReadAllLines(path);
+
+            var turns = new List<ConversationTurn>();
+            foreach (var line in lines.Where(l => l.Length > 0))
+            {
+                try
+                {
+                    var turn = JsonSerializer.Deserialize<ConversationTurn>(line);
+                    if (turn != null && !string.IsNullOrEmpty(turn.T)) turns.Add(turn);
+                }
+                catch { /* torn line — skip */ }
+            }
+            return turns;
+        }
+        catch
+        {
+            return Array.Empty<ConversationTurn>();
+        }
+    }
+
+    public static void Delete(string key)
+    {
+        try
+        {
+            lock (Gate)
+            {
+                File.Delete(PathFor(key));
+                Counts.Remove(key);
+            }
+        }
+        catch { }
+    }
+
+    public static void Sweep(IEnumerable<string> liveKeys)
+    {
+        try
+        {
+            if (!Directory.Exists(Folder)) return;
+            var keep = new HashSet<string>(liveKeys, StringComparer.OrdinalIgnoreCase);
+            foreach (var file in Directory.EnumerateFiles(Folder, "*.jsonl"))
+                if (!keep.Contains(Path.GetFileNameWithoutExtension(file)))
+                    try { File.Delete(file); } catch { }
+        }
+        catch { }
+    }
+}
diff --git a/src/MandoCode.Desktop/Services/SessionHistoryStore.cs b/src/MandoCode.Desktop/Services/SessionHistoryStore.cs
new file mode 100644
index 0000000..7a4b602
--- /dev/null
+++ b/src/MandoCode.Desktop/Services/SessionHistoryStore.cs
@@ -0,0 +1,73 @@
+namespace MandoCode.Desktop.Services;
+
+/// <summary>
+/// Full-fidelity model memory per session: the JSON that AIService.ExportHistoryJson
+/// produces, written whole-file at each turn end and rehydrated on session restore via
+/// TryRestoreHistoryJson. This is the highest tier of session persistence — when it
+/// applies, the restored agent genuinely REMEMBERS the conversation (tool calls included)
+/// instead of being briefed about it; ConversationLog's tail-brief is the fallback.
+/// Best-effort everywhere, like its siblings.
+/// </summary>
+public static class SessionHistoryStore
+{
+    /// <summary>Safety valve: a history JSON beyond this size isn't persisted (the harness's
+    /// own compaction shrinks the live history long before this in practice).</summary>
+    private const int MaxBytes = 8 * 1024 * 1024;
+
+    private static readonly object Gate = new();
+
+    private static string Folder => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "MandoCode.Desktop", "histories");
+
+    private static string PathFor(string key) => Path.Combine(Folder, key + ".json");
+
+    public static void Save(string key, string? json)
+    {
+        try
+        {
+            if (string.IsNullOrEmpty(json) || json.Length > MaxBytes) return;
+            lock (Gate)
+            {
+                Directory.CreateDirectory(Folder);
+                // Write-then-rename so a crash mid-write can't leave a torn file where a
+                // good previous export used to be.
+                var tmp = PathFor(key) + ".tmp";
+                File.WriteAllText(tmp, json);
+                File.Move(tmp, PathFor(key), overwrite: true);
+            }
+        }
+        catch { }
+    }
+
+    public static string? Load(string key)
+    {
+        try
+        {
+            var path = PathFor(key);
+            lock (Gate) return File.Exists(path) ? File.ReadAllText(path) : null;
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
+    public static void Delete(string key)
+    {
+        try { lock (Gate) File.Delete(PathFor(key)); } catch { }
+    }
+
+    public static void Sweep(IEnumerable<string> liveKeys)
+    {
+        try
+        {
+            if (!Directory.Exists(Folder)) return;
+            var keep = new HashSet<string>(liveKeys, StringComparer.OrdinalIgnoreCase);
+            foreach (var file in Directory.EnumerateFiles(Folder, "*.json"))
+                if (!keep.Contains(Path.GetFileNameWithoutExtension(file)))
+                    try { File.Delete(file); } catch { }
+        }
+        catch { }
+    }
+}
diff --git a/src/MandoCode.Desktop/Services/SessionManager.cs b/src/MandoCode.Desktop/Services/SessionManager.cs
index efc1175..5f63dca 100644
--- a/src/MandoCode.Desktop/Services/SessionManager.cs
+++ b/src/MandoCode.Desktop/Services/SessionManager.cs
@@ -47,10 +47,10 @@ public SessionManager(
     /// Opens a new agent. It inherits the active tab's project folder — a new tab is almost always
     /// "another agent on what I'm already working on" — and the canonical default model.
     /// </summary>
-    public AgentSession CreateSession(string? projectRoot = null)
+    public AgentSession CreateSession(string? projectRoot = null, string? persistKey = null)
     {
         var root = projectRoot ?? Active?.ProjectRoot.ProjectRoot ?? _initialProjectRoot;
-        var session = new AgentSession(_globals, _configs, _mcp, root);
+        var session = new AgentSession(_globals, _configs, _mcp, root, persistKey);
         session.Title = NextAgentName();
 
         _sessions.Add(session);
diff --git a/src/MandoCode.Desktop/Services/SnapshotStore.cs b/src/MandoCode.Desktop/Services/SnapshotStore.cs
index 8e24003..d974c42 100644
--- a/src/MandoCode.Desktop/Services/SnapshotStore.cs
+++ b/src/MandoCode.Desktop/Services/SnapshotStore.cs
@@ -1,20 +1,52 @@
+using System.Text.Json;
+
 namespace MandoCode.Desktop.Services;
 
 /// <summary>
 /// App-wide store of <see cref="ContextSnapshot"/>s — one list shared by every tab, so a snapshot
 /// captured while Agent 1 switches models can be imported into a brand-new tab running a capable
-/// model. Session-scoped: it lives for the life of the process and is not persisted (matching the
-/// app's "settings reset on launch" stance; disk persistence is a possible follow-up).
+/// model. PERSISTED: loaded from disk at construction and rewritten on every add/remove
+/// (best-effort — a failed write never breaks the in-memory store), so snapshots survive
+/// app restarts.
 ///
 /// <see cref="Changed"/> can fire on a background thread (captures happen during a model switch),
 /// so subscribers must marshal to the UI thread themselves.
 /// </summary>
 public sealed class SnapshotStore
 {
+    private static string StorePath => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "MandoCode.Desktop", "snapshots.json");
+
     private readonly object _lock = new();
     private readonly List<ContextSnapshot> _items = new();
     private int _nextId;
 
+    public SnapshotStore()
+    {
+        try
+        {
+            if (!File.Exists(StorePath)) return;
+            var loaded = JsonSerializer.Deserialize<List<ContextSnapshot>>(File.ReadAllText(StorePath));
+            if (loaded == null) return;
+            _items.AddRange(loaded);
+            _nextId = _items.Count == 0 ? 0 : _items.Max(s => s.Id);
+        }
+        catch { /* corrupt/unreadable store — start empty rather than crash the app */ }
+    }
+
+    private void Persist()
+    {
+        try
+        {
+            List<ContextSnapshot> copy;
+            lock (_lock) copy = _items.ToList();
+            Directory.CreateDirectory(Path.GetDirectoryName(StorePath)!);
+            File.WriteAllText(StorePath, JsonSerializer.Serialize(copy));
+        }
+        catch { /* persistence is best-effort; the in-memory store is still correct */ }
+    }
+
     /// <summary>Raised after any add/remove. May arrive on a background thread.</summary>
     public event Action? Changed;
 
@@ -30,7 +62,7 @@ public int Count
     }
 
     public ContextSnapshot Add(string originModel, string summarizerModel, string recap, int messageCount,
-        string? name = null)
+        string? name = null, string? projectRoot = null)
     {
         ContextSnapshot snapshot;
         lock (_lock)
@@ -44,9 +76,11 @@ public ContextSnapshot Add(string originModel, string summarizerModel, string re
                 Recap = recap,
                 MessageCount = messageCount,
                 Name = string.IsNullOrWhiteSpace(name) ? null : name.Trim(),
+                ProjectRoot = projectRoot,
             };
             _items.Insert(0, snapshot);   // newest first
         }
+        Persist();
         Changed?.Invoke();
         return snapshot;
     }
@@ -55,6 +89,8 @@ public void Remove(ContextSnapshot snapshot)
     {
         bool removed;
         lock (_lock) removed = _items.Remove(snapshot);
-        if (removed) Changed?.Invoke();
+        if (!removed) return;
+        Persist();
+        Changed?.Invoke();
     }
 }
diff --git a/src/MandoCode.Desktop/Services/TranscriptHtmlBuilder.cs b/src/MandoCode.Desktop/Services/TranscriptHtmlBuilder.cs
index fbcf1ea..b3e0e77 100644
--- a/src/MandoCode.Desktop/Services/TranscriptHtmlBuilder.cs
+++ b/src/MandoCode.Desktop/Services/TranscriptHtmlBuilder.cs
@@ -60,6 +60,19 @@ public string AssistantCard(string markdown) =>
     public string Error(string text) => $"<div class=\"line error\">{E(text)}</div>";
     public string Dim(string text) => $"<div class=\"line dim\">{E(text)}</div>";
 
+    /// <summary>True for blocks that describe LIVE session state (status chips: connection,
+    /// model ready, MCP counts, pending offers) rather than conversation history. Session
+    /// restore replays journaled transcripts — replaying a dead process's state pills next
+    /// to the new session's real ones ("MCP connected" twice, stale "ready") reads as
+    /// duplicate/conflicting status, so replay skips them. Journals still CONTAIN them:
+    /// capture stays dumb and faithful; the judgment lives at replay.</summary>
+    public static bool IsEphemeralStatus(string blockHtml) =>
+        blockHtml.StartsWith("<div class=\"chip-row\"", StringComparison.Ordinal)
+        // Boot/progress narration — true only while it was happening. ("Project root
+        // changed to: X" is deliberately NOT here: that's a real event, kept as history.)
+        || blockHtml.Contains(">Rebuilding the AI session for the new project…<", StringComparison.Ordinal)
+        || blockHtml.Contains(">✓ Ready.<", StringComparison.Ordinal);
+
     /// <summary>A compact status pill — a colored state dot, a bold primary value, and an
     /// optional dim qualifier. The dot replaces status emoji: crisp and theme-aware.
     /// <paramref name="state"/> is "ok", "warn", "err", or "" (neutral).</summary>
diff --git a/src/MandoCode.Desktop/Services/TranscriptJournal.cs b/src/MandoCode.Desktop/Services/TranscriptJournal.cs
new file mode 100644
index 0000000..6d211a3
--- /dev/null
+++ b/src/MandoCode.Desktop/Services/TranscriptJournal.cs
@@ -0,0 +1,129 @@
+using System.Text.Json;
+
+namespace MandoCode.Desktop.Services;
+
+/// <summary>
+/// Append-only on-disk journal of each session's transcript HTML blocks — tier 2 of session
+/// persistence. One JSONL file per session persist-key: every block TranscriptWriter emits
+/// is appended the moment it happens (crash-safe by construction — there is no save-on-exit
+/// to miss), and replayed into a fresh WebView on restore. Best-effort everywhere: a failed
+/// journal write or read must never break the live chat.
+/// </summary>
+public static class TranscriptJournal
+{
+    /// <summary>Replay/retention cap: the newest N blocks are kept.</summary>
+    private const int MaxBlocks = 1000;
+
+    /// <summary>Write-side trim slack. Trimming rewrites the whole file, so it runs once per
+    /// ~SLACK appends instead of on every one. Enforced during Append — an app that never
+    /// restarts (and therefore never Loads) must still have bounded journals.</summary>
+    private const int TrimSlack = 256;
+
+    private static readonly object Gate = new();
+
+    /// <summary>Line counts per key, maintained so Append knows when to trim without
+    /// re-counting the file each time. Lazily initialized on first touch. Guarded by Gate.</summary>
+    private static readonly Dictionary<string, int> Counts = new(StringComparer.OrdinalIgnoreCase);
+
+    private static string Folder => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "MandoCode.Desktop", "transcripts");
+
+    private static string PathFor(string key) => Path.Combine(Folder, key + ".jsonl");
+
+    public static void Append(string key, string html)
+    {
+        try
+        {
+            lock (Gate)
+            {
+                Directory.CreateDirectory(Folder);
+                var path = PathFor(key);
+
+                if (!Counts.TryGetValue(key, out var count))
+                    count = File.Exists(path) ? File.ReadLines(path).Count() : 0;
+
+                File.AppendAllText(path, JsonSerializer.Serialize(html) + "\n");
+                count++;
+
+                if (count > MaxBlocks + TrimSlack)
+                {
+                    var tail = File.ReadAllLines(path)
+                        .Where(l => l.Length > 0)
+                        .TakeLast(MaxBlocks).ToArray();
+                    File.WriteAllLines(path, tail);
+                    count = tail.Length;
+                }
+
+                Counts[key] = count;
+            }
+        }
+        catch { }
+    }
+
+    /// <summary>Blocks for replay, oldest first, capped to the newest <see cref="MaxBlocks"/>
+    /// (the file is rewritten to the cap when it exceeds it).</summary>
+    public static IReadOnlyList<string> Load(string key)
+    {
+        try
+        {
+            var path = PathFor(key);
+            if (!File.Exists(path)) return Array.Empty<string>();
+
+            List<string> lines;
+            lock (Gate) lines = File.ReadAllLines(path).Where(l => l.Length > 0).ToList();
+
+            if (lines.Count > MaxBlocks)
+            {
+                lines = lines.Skip(lines.Count - MaxBlocks).ToList();
+                lock (Gate) File.WriteAllLines(path, lines);
+            }
+            lock (Gate) Counts[key] = lines.Count;
+
+            var blocks = new List<string>(lines.Count);
+            foreach (var line in lines)
+            {
+                try
+                {
+                    var html = JsonSerializer.Deserialize<string>(line);
+                    if (!string.IsNullOrEmpty(html)) blocks.Add(html);
+                }
+                catch { /* one corrupt line (torn write at crash) — skip it, keep the rest */ }
+            }
+            return blocks;
+        }
+        catch
+        {
+            return Array.Empty<string>();
+        }
+    }
+
+    /// <summary>Forgets a session's journal — used by /clear and when a tab is closed.</summary>
+    public static void Delete(string key)
+    {
+        try
+        {
+            lock (Gate)
+            {
+                File.Delete(PathFor(key));
+                Counts.Remove(key);
+            }
+        }
+        catch { }
+    }
+
+    /// <summary>Removes journals that no longer belong to any open tab (closed while the
+    /// app couldn't clean up, e.g. after a crash).</summary>
+    public static void Sweep(IEnumerable<string> liveKeys)
+    {
+        try
+        {
+            if (!Directory.Exists(Folder)) return;
+            var keep = new HashSet<string>(liveKeys, StringComparer.OrdinalIgnoreCase);
+            foreach (var file in Directory.EnumerateFiles(Folder, "*.jsonl"))
+                if (!keep.Contains(Path.GetFileNameWithoutExtension(file)))
+                    try { File.Delete(file); } catch { }
+        }
+        catch { }
+    }
+}
diff --git a/src/MandoCode.Desktop/Services/WorkspaceState.cs b/src/MandoCode.Desktop/Services/WorkspaceState.cs
new file mode 100644
index 0000000..b699445
--- /dev/null
+++ b/src/MandoCode.Desktop/Services/WorkspaceState.cs
@@ -0,0 +1,48 @@
+using System.Text.Json;
+
+namespace MandoCode.Desktop.Services;
+
+/// <summary>One open tab as remembered across launches. <paramref name="Key"/> is the
+/// session's durable persist-key — it reattaches the restored tab to its transcript
+/// journal (null in files written before journaling existed).</summary>
+public sealed record WorkspaceTabState(string Title, string ProjectRoot, string? Model, string? Key = null);
+
+/// <summary>The workspace's shape: which tabs were open and which was active.</summary>
+public sealed record WorkspaceShape(List<WorkspaceTabState> Tabs, int ActiveIndex);
+
+/// <summary>
+/// Persists the workspace SHAPE — open tabs (title, project folder, model) and the active
+/// tab — so a relaunch reopens where the user left off. Deliberately shape-only: transcript
+/// and model-context persistence are separate, later tiers. Best-effort on both ends: a
+/// missing/corrupt file means a default single-tab start, never a crash.
+/// </summary>
+public static class WorkspaceState
+{
+    private static string StorePath => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "MandoCode.Desktop", "workspace.json");
+
+    public static WorkspaceShape? TryLoad()
+    {
+        try
+        {
+            if (!File.Exists(StorePath)) return null;
+            var shape = JsonSerializer.Deserialize<WorkspaceShape>(File.ReadAllText(StorePath));
+            return shape is { Tabs.Count: > 0 } ? shape : null;
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
+    public static void Save(WorkspaceShape shape)
+    {
+        try
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(StorePath)!);
+            File.WriteAllText(StorePath, JsonSerializer.Serialize(shape));
+        }
+        catch { /* best-effort */ }
+    }
+}
diff --git a/src/MandoCode.Desktop/ViewModels/ChatController.cs b/src/MandoCode.Desktop/ViewModels/ChatController.cs
index b31adb6..b2beed8 100644
--- a/src/MandoCode.Desktop/ViewModels/ChatController.cs
+++ b/src/MandoCode.Desktop/ViewModels/ChatController.cs
@@ -71,6 +71,16 @@ public void RemoveReaction(string cardId, string emoji) =>
     /// away, the oldest facts are the most likely to be stale anyway.</summary>
     private readonly List<string> _pendingWorkspaceNotes = new();
 
+    /// <summary>Set by AgentSession: receives ("u"/"a", text) for every conversational turn,
+    /// feeding the per-session ConversationLog that re-briefs the model after a restart.
+    /// Only real dialogue is logged — /commands and !shell lines are not conversation.</summary>
+    public Action<string, string>? ConversationLogger { get; set; }
+
+    /// <summary>Arms a restored previous-session conversation to ride the next send as
+    /// imported background — the automatic counterpart of importing a snapshot, used by
+    /// session restore (tier 3).</summary>
+    public void ArmRestoredConversation(string context) => _armedContexts.Add(context);
+
     public void NoteWorkspaceEvent(string note)
     {
         if (_pendingWorkspaceNotes.Count >= 30) _pendingWorkspaceNotes.RemoveAt(0);
@@ -386,6 +396,8 @@ public async Task SubmitAsync(string input)
                 return;
             }
 
+            ConversationLogger?.Invoke("u", input);
+
             // Plan heuristic BEFORE @file expansion so attachments don't inflate it.
             var needsPlanning = _taskPlanner.RequiresPlanning(input);
             var processedInput = ProcessFileReferences(input);
@@ -500,6 +512,7 @@ private async Task ProcessDirectRequestAsync(string input)
                     {
                         segments.Add(segment);
                         _transcript.Append(_html.AssistantCard(segment));
+                        ConversationLogger?.Invoke("a", segment);
                     }
                 } while (await enumerator.MoveNextAsync());
 
@@ -839,7 +852,10 @@ private async Task HandleProgressEventAsync(TaskProgressEvent progressEvent, Tas
             case TaskProgressType.StepCompleted:
                 PlanProgressChanged?.Invoke(progressEvent.CurrentStep, progressEvent.TotalSteps, true);
                 if (!string.IsNullOrEmpty(progressEvent.Message))
+                {
                     _transcript.Append(_html.AssistantCard(progressEvent.Message));
+                    ConversationLogger?.Invoke("a", progressEvent.Message!);
+                }
                 _transcript.Append(_html.Success($"Step {progressEvent.CurrentStep} completed."));
                 break;
 
@@ -1231,6 +1247,10 @@ private async Task ApplyModelSwitchAsync(string modelTag)
         // model of their choice) after the switch; if they ignore the offer, the buffer is discarded.
         var previousModel = _config.GetEffectiveModelName();
         _pending = await BufferConversationAsync(previousModel);
+        // Full-fidelity carry: grab the verbatim history too (tool calls included), so the
+        // user can choose "keep memory" — continue the SAME conversation on the new model —
+        // instead of (or in addition to having the option of) a summarized snapshot.
+        _pendingCarryJson = _pending == null ? null : _ai.ExportHistoryJson();
 
         _config.ModelName = modelTag;
         _config.ModelPath = null;
@@ -1261,7 +1281,7 @@ private async Task ApplyModelSwitchAsync(string modelTag)
         // conversation to clear. Switching an empty chat has nothing to salvage, so stay quiet.
         if (_pending != null)
         {
-            _transcript.Append(_html.StatusChip("Context cleared", "create a snapshot?", ""));
+            _transcript.Append(_html.StatusChip("Context cleared", "keep memory, or snapshot it?", ""));
             SnapshotOfferChanged?.Invoke();
         }
 
@@ -1303,6 +1323,7 @@ public sealed record PendingSnapshot(string OriginModel, string RawHistory, int
     /// without switching models or clearing it. Shows the create card, or notes there's nothing to save.</summary>
     public async Task OfferManualSnapshotAsync()
     {
+        _pendingCarryJson = null;   // nothing was cleared — "keep memory" doesn't apply here
         _pending = await BufferConversationAsync(ModelName);
         if (_pending == null)
         {
@@ -1331,7 +1352,7 @@ public async Task OfferManualSnapshotAsync()
             if (string.IsNullOrWhiteSpace(recap))
                 return "The model returned an empty recap.";
 
-            _snapshots.Add(pending.OriginModel, summarizerModel, recap, pending.MessageCount, name);
+            _snapshots.Add(pending.OriginModel, summarizerModel, recap, pending.MessageCount, name, ProjectRootPath);
             _pending = null;
             SnapshotOfferChanged?.Invoke();
             var label = string.IsNullOrWhiteSpace(name) ? $"summarized by {summarizerModel}" : $"\"{name.Trim()}\"";
@@ -1350,7 +1371,43 @@ public void DismissSnapshotOffer()
     {
         if (_pending == null) return;
         _pending = null;
+        _pendingCarryJson = null;
+        SnapshotOfferChanged?.Invoke();
+    }
+
+    /// <summary>Verbatim pre-switch history (AIService export JSON), held alongside
+    /// <see cref="_pending"/> only for model switches — never for manual snapshot offers,
+    /// where nothing was cleared. Same lifetime as the offer: consumed, dismissed, or
+    /// replaced by the next switch.</summary>
+    private string? _pendingCarryJson;
+
+    /// <summary>Whether the current offer supports "keep memory" (model switches only).</summary>
+    public bool CanCarryMemory => _pendingCarryJson != null;
+
+    /// <summary>
+    /// "Keep memory" on the model-switch offer: re-imports the pre-switch conversation
+    /// VERBATIM into the new model — full fidelity, tool calls included; the same
+    /// conversation simply continues under new management. On failure the offer stays up,
+    /// so the summarized-snapshot path remains available as the fallback.
+    /// </summary>
+    public bool TryCarryMemoryAcrossSwitch()
+    {
+        var json = _pendingCarryJson;
+        if (json == null) return false;
+
+        var restored = _ai.TryRestoreHistoryJson(json);
+        if (restored == 0)
+        {
+            _transcript.Append(_html.Warn(
+                "Couldn't carry the conversation into the new model — you can still save it as a snapshot."));
+            return false;
+        }
+
+        _pendingCarryJson = null;
+        _pending = null;   // offer consumed — the conversation lives on, nothing to salvage
+        _transcript.Append(_html.StatusChip("Memory carried", $"{restored} messages continue here", "ok"));
         SnapshotOfferChanged?.Invoke();
+        return true;
     }
 
     /// <summary>Arms a snapshot's recap so it rides along (invisibly) with this agent's next message.</summary>