@@ -7,6 +7,7 @@ import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
 import { WorkOSError } from "../auth/errors";
 import {
   V2_MOVED_READ_TIMEOUT_MS,
+  mustReinitializeForV2Move,
   v2MovedInstructionsText,
   v2MovedMcpInstructions,
 } from "./v2-moved-instructions";
@@ -101,3 +102,24 @@ describe("v2 moved MCP instructions", () => {
     }).pipe(Effect.provide(workosAnswering(() => Effect.never))),
   );
 });
+
+describe("re-initializing a session for the v2 move", () => {
+  it("re-initializes a client that got no notice once the org has moved", () => {
+    expect(mustReinitializeForV2Move(undefined, EXPECTED)).toBe(true);
+  });
+
+  it("re-initializes a client whose notice is out of date", () => {
+    expect(
+      mustReinitializeForV2Move(EXPECTED.replace("example-team", "other-team"), EXPECTED),
+    ).toBe(true);
+  });
+
+  it("leaves a client that got the current notice alone", () => {
+    expect(mustReinitializeForV2Move(EXPECTED, EXPECTED)).toBe(false);
+  });
+
+  it("leaves a client alone when the org has not moved or the read failed", () => {
+    expect(mustReinitializeForV2Move(undefined, undefined)).toBe(false);
+    expect(mustReinitializeForV2Move(EXPECTED, undefined)).toBe(false);
+  });
+});
@@ -8,16 +8,21 @@
 // PostHog client, so `trackEvent` is a no-op. Their names and properties are
 // fixed by the typed catalog in `packages/react/src/api/analytics.tsx`.
 import { expect } from "@effect/vitest";
-import { Effect } from "effect";
+import { Duration, Effect } from "effect";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import type { Page } from "playwright";
+import {
+  StreamableHTTPClientTransport,
+  StreamableHTTPError,
+} from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import type { Locator, Page } from "playwright";
 
 import { scenario } from "../src/scenario";
 import { Browser, Mcp, Target } from "../src/services";
 import { revisit, settle, visit } from "../src/surfaces/browser";
 import type { Identity, Target as TargetShape } from "../src/target";
 import { WORKOS_EMULATOR_PORT } from "../targets/cloud";
+import { configuredMcpSessionTimeoutMs } from "../setup/mcp-session-timeouts";
+import { E2E_MCP_V2_MOVED_RECHECK_MS } from "../setup/v2-moved-recheck";
 import { verifyAdmin } from "./support/admin-mfa";
 import { cookieOf } from "./support/session";
 
@@ -86,9 +91,9 @@ const setOrgMetadata = (
     await response.body?.cancel();
   });
 
-const markMoved = (organizationId: string) =>
+const markMoved = (organizationId: string, slug: string = V2_SLUG) =>
   setOrgMetadata(organizationId, {
-    executor_v2_org_slug: V2_SLUG,
+    executor_v2_org_slug: slug,
     executor_v2_moved_at: MOVED_AT,
   });
 
@@ -127,9 +132,10 @@ const v2McpUrlOf = (target: TargetShape, answer: V2ImportAnswer): string => {
 
 const emailOf = (identity: Identity): string => identity.credentials?.email ?? identity.label;
 
-/** A real MCP client's handshake: the server's `initialize` instructions. */
-const initializeInstructions = (mcpUrl: string, bearer: string) =>
-  Effect.acquireUseRelease(
+/** A real MCP client, connected (the `initialize` handshake done) for the
+ *  scope, closed after. */
+const connectedClient = (mcpUrl: string, bearer: string) =>
+  Effect.acquireRelease(
     Effect.promise(async () => {
       const client = new Client({ name: "executor-e2e-v2-moved", version: "0.0.1" });
       await client.connect(
@@ -139,14 +145,55 @@ const initializeInstructions = (mcpUrl: string, bearer: string) =>
       );
       return client;
     }),
-    (client) =>
-      Effect.promise(async () => ({
+    (client) => Effect.promise(() => client.close().catch(() => undefined)),
+  );
+
+/** A real MCP client's handshake: the server's `initialize` instructions. */
+const initializeInstructions = (mcpUrl: string, bearer: string) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const client = yield* connectedClient(mcpUrl, bearer);
+      return yield* Effect.promise(async () => ({
         instructions: client.getInstructions(),
         tools: (await client.listTools()).tools.map((tool) => tool.name),
-      })),
-    (client) => Effect.promise(() => client.close().catch(() => undefined)),
+      }));
+    }),
   );
 
+/** The HTTP status a request on the client's session answers, or 200. */
+const listToolsStatus = (client: Client): Effect.Effect<number> =>
+  Effect.promise(() =>
+    client.listTools().then(
+      () => 200,
+      (error: unknown) => {
+        if (error instanceof StreamableHTTPError && error.code !== undefined) return error.code;
+        throw error;
+      },
+    ),
+  );
+
+const movedInstructions = (v2McpUrl: string, slug: string = V2_SLUG) =>
+  "This organization moved to Executor v2 on October 9, 2026. " +
+  `Its MCP server is now ${v2McpUrl}; ask the user to reconnect their agent there ` +
+  `and choose the ${slug} organization when signing in. ` +
+  "Changes made through this server won't reach v2.";
+
+/** Where an element's text is drawn, which overflows the element's own box
+ *  when the text cannot wrap. */
+const textExtent = (locator: Locator) =>
+  locator.evaluate((element) => {
+    const range = document.createRange();
+    range.selectNodeContents(element);
+    const box = range.getBoundingClientRect();
+    return { left: box.left, right: box.right };
+  });
+
+const boxOf = async (locator: Locator, label: string) => {
+  const box = await locator.boundingBox();
+  if (box === null) throw new Error(`${label} has no layout box`);
+  return { left: box.x, right: box.x + box.width };
+};
+
 /** Open the dashboard and wait for the v2 answer it renders the notice from. */
 const openDashboard = async (page: Page, slug: string) => {
   const answered = page.waitForResponse((response) => response.url().endsWith(V2_IMPORT_API));
@@ -460,11 +507,121 @@ scenario(
 
     const after = yield* initializeInstructions(target.mcpUrl, bearer);
     expect(after.instructions, "the initialize result names the org's v2 MCP server").toBe(
-      "This organization moved to Executor v2 on October 9, 2026. " +
-        `Its MCP server is now ${v2McpUrl}; ask the user to reconnect their agent there ` +
-        `and choose the ${V2_SLUG} organization when signing in. ` +
-        "Changes made through this server won't reach v2.",
+      movedInstructions(v2McpUrl),
     );
     expect(after.tools, "the tools are unchanged").toEqual(before.tools);
   }),
 );
+
+/**
+ * An agent connected before the move got `initialize` instructions without the
+ * notice, and instructions only travel in `initialize`. Its session ends (HTTP
+ * 404, which tells a Streamable HTTP client to start a new session), and the
+ * new session's `initialize` carries the notice. `wait` is how long the agent
+ * stays quiet after the move.
+ */
+const connectedBeforeTheMove = (wait: Duration.Input) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const mcp = yield* Mcp;
+      const identity = yield* target.newIdentity();
+      const org = yield* orgOf(target, identity);
+      const bearer = yield* mcp.mintBearer(emailOf(identity));
+
+      const early = yield* connectedClient(target.mcpUrl, bearer);
+      expect(early.getInstructions(), "an org that has not moved gets no notice").toBeUndefined();
+      expect(yield* listToolsStatus(early), "the session works before the move").toBe(200);
+
+      yield* markMoved(org.id);
+      const v2McpUrl = v2McpUrlOf(target, yield* v2ImportOf(target, identity));
+      yield* Effect.sleep(wait);
+
+      expect(
+        yield* listToolsStatus(early),
+        "the next request ends the session, so the client starts a new one",
+      ).toBe(404);
+
+      const again = yield* connectedClient(target.mcpUrl, bearer);
+      expect(again.getInstructions(), "the new session's initialize carries the notice").toBe(
+        movedInstructions(v2McpUrl),
+      );
+      // Past the re-read window, a session that already got the notice keeps
+      // working: the client is not sent round again.
+      yield* Effect.sleep(Duration.millis(E2E_MCP_V2_MOVED_RECHECK_MS * 2));
+      expect(yield* listToolsStatus(again), "the new session keeps working").toBe(200);
+      expect(yield* listToolsStatus(again), "and keeps working").toBe(200);
+    }),
+  );
+
+scenario(
+  "v2 moved · an agent connected before the move is told on its next request",
+  { timeout: 180_000 },
+  // Longer than the re-read window and shorter than the idle timeout, so the
+  // session's runtime is still in memory and re-reads the move.
+  connectedBeforeTheMove(Duration.millis(E2E_MCP_V2_MOVED_RECHECK_MS * 1.5)),
+);
+
+scenario(
+  "v2 moved · an agent connected before the move is told after its session is restored",
+  { timeout: 180_000 },
+  // Past the idle timeout, with room for the alarm: the session's runtime is
+  // released, and the next request restores it without an `initialize`.
+  connectedBeforeTheMove(Duration.millis(configuredMcpSessionTimeoutMs() + 4_000)),
+);
+
+// v2's slug rule allows 45 characters with no hyphen, which is one word the
+// browser cannot break by default.
+const UNBROKEN_SLUG = "syntheticorgslugwithnohyphensforlayoutchecks0";
+
+scenario(
+  "v2 moved · the longest unbroken v2 slug stays inside the notice and the Connect card on a phone",
+  { timeout: 180_000 },
+  Effect.gen(function* () {
+    expect(UNBROKEN_SLUG, "the longest slug v2 allows").toHaveLength(45);
+    const target = yield* Target;
+    const browser = yield* Browser;
+    const identity = yield* target.newIdentity();
+    const org = yield* orgOf(target, identity);
+    yield* markMoved(org.id, UNBROKEN_SLUG);
+
+    yield* browser.session(identity, async ({ page, step }) => {
+      // The narrowest common phone width.
+      await page.setViewportSize({ width: 320, height: 640 });
+
+      await step("Open the moved org's dashboard on a phone-sized screen", async () => {
+        await openDashboard(page, org.slug);
+        await noticeOf(page).waitFor();
+      });
+
+      await step("See the org to choose at sign-in wrap inside the notice", async () => {
+        const notice = noticeOf(page);
+        const hint = notice
+          .getByRole("region", { name: "v2 MCP server URL" })
+          .getByText(
+            `Connect your agents to v2 instead, and choose ${UNBROKEN_SLUG} when you sign in:`,
+            { exact: true },
+          );
+        const dialog = await boxOf(notice, "the notice");
+        const text = await textExtent(hint);
+        expect(text.left, "the sentence starts inside the notice").toBeGreaterThanOrEqual(
+          dialog.left,
+        );
+        expect(text.right, "the sentence ends inside the notice").toBeLessThanOrEqual(dialog.right);
+      });
+
+      await step("Close the notice and see the hint wrap inside the Connect card", async () => {
+        await noticeOf(page).getByRole("button", { name: "Close" }).click();
+        await noticeOf(page).waitFor({ state: "hidden" });
+        const next = page.getByRole("region", { name: "New MCP server" });
+        const card = page.locator('[data-slot="card-stack"]').filter({ has: next });
+        const hint = next.getByText(`Choose ${UNBROKEN_SLUG} when you sign in.`, { exact: true });
+        await hint.scrollIntoViewIfNeeded();
+        const cardBox = await boxOf(card, "the Connect card");
+        const text = await textExtent(hint);
+        expect(text.left, "the hint starts inside the card").toBeGreaterThanOrEqual(cardBox.left);
+        expect(text.right, "the hint ends inside the card").toBeLessThanOrEqual(cardBox.right);
+      });
+    });
+  }),
+);
@@ -17,6 +17,7 @@ import {
   E2E_EXECUTION_RATE_LIMIT_CHECK_TIMEOUT_MS,
 } from "./execution-limits";
 import { E2E_MCP_RESIDENT_RUNTIME_SOFT_CAP } from "./resident-runtime-cap";
+import { E2E_MCP_V2_MOVED_RECHECK_MS } from "./v2-moved-recheck";
 
 export const cloudDir = fileURLToPath(new URL("../../apps/cloud/", import.meta.url));
 
@@ -112,6 +113,8 @@ export const bootCloud = async (options: CloudBootOptions): Promise<CloudBooted>
     // set unconditionally for the whole boot (same treatment as the execution
     // rate limit below).
     MCP_RESIDENT_RUNTIME_SOFT_CAP: String(E2E_MCP_RESIDENT_RUNTIME_SOFT_CAP),
+    // See v2-moved-recheck.ts.
+    MCP_V2_MOVED_RECHECK_MS: String(E2E_MCP_V2_MOVED_RECHECK_MS),
     ALLOW_LOCAL_NETWORK: "true",
     // A first-party GitHub app for the first-party-oauth scenario: proves the
     // env → HostConfig → executor plumbing end to end. The scenario asserts the
 
@@ -0,0 +1,7 @@
+// How often the e2e worker's resident MCP sessions re-read their org's move to
+// v2 (MCP_V2_MOVED_RECHECK_MS; production waits five minutes). One constant
+// with two consumers, the boot recipe env (cloud.boot.ts) and the v2-moved
+// scenario (cloud/v2-moved-notice.test.ts), so they cannot drift apart. Short
+// enough for a scenario to wait out, and well under the e2e idle timeout, so a
+// session that is still resident re-reads instead of being restored.
+export const E2E_MCP_V2_MOVED_RECHECK_MS = 1_000;