@@ -609,6 +609,9 @@ final class AppModel {
   /// deliberately not observable.
   var isSafeMode: Bool { safeMode }
 
+  /// Eligibility captured before Sparkle's relaunch UI mark is consumed.
+  @ObservationIgnored private var recoverLegacyUpdateHandbacks: Bool
+
   var volumeMode: MultiKeyboardVolume { appPrefs.multiKeyboardVolume }
 
   /// Bumped by the propagation seam on any pref write a view renders. The panel
@@ -704,6 +707,7 @@ final class AppModel {
     hdrToggling: (any HDRToggling)? = nil,
     audioDevices: (any AudioDeviceProviding)? = nil,
     safeMode: Bool = false,
+    recoverLegacyUpdateHandbacks: Bool = false,
     discoverDisplays: @escaping (Set<CGDirectDisplayID>) -> DisplayDiscoverySurvey = {
       DisplayDiscovery.survey(excluding: $0)
     }
@@ -713,6 +717,7 @@ final class AppModel {
     self.hdrToggling = hdrToggling ?? MonitorPanelService()
     self.audioDevices = audioDevices ?? CoreAudioDeviceProvider()
     self.safeMode = safeMode
+    self.recoverLegacyUpdateHandbacks = recoverLegacyUpdateHandbacks
     self.discoverDisplays = discoverDisplays
     appPrefs = DisplayPrefs(persistenceKey: "app", safeMode: safeMode)
   }
@@ -1308,18 +1313,22 @@ final class AppModel {
   )
 
   /// Puts back the brightness of a display a previous process left dimmed.
-  /// Externals only (the built-in has no DDC register to strand) and brightness
-  /// only: the dim never touched contrast or volume.
-  func recoverInterruptedDims() {
-    let evaluated = displays.count
+  /// Externals only, on their DDC or native HDR leg. Polling starts after the
+  /// queued restores finish, so an old dim cannot be mistaken for a user change.
+  func recoverInterruptedDims() async {
+    let recoveryDisplays = displays
+    let evaluated = recoveryDisplays.count
     var reasserted = 0
+    var recovering: [(key: String, controller: BrightnessController)] = []
+    let liveDimKeysAtStart = Set(recoveryDisplays.filter { $0.controller.temporaryDimFactor != nil }
+      .map(\.display.persistenceKey))
     // Twins share a marker, but each has its own wire. Snapshot before any
     // clearing so discovery order cannot decide which one gets recovered.
-    let markedKeys = Set(displays.map(\.display.persistenceKey)).filter {
+    let markedKeys = Set(recoveryDisplays.map(\.display.persistenceKey)).filter {
       DisplayPrefs(persistenceKey: $0, safeMode: safeMode).temporaryDimEngaged
     }
     var keysToClear: Set<String> = []
-    for state in displays {
+    for state in recoveryDisplays {
       let key = state.display.persistenceKey
       switch InterruptedDimRecovery.action(
         markerSurvived: markedKeys.contains(key),
@@ -1336,21 +1345,35 @@ final class AppModel {
         // reaches the wire.
         state.controller.resetWriteMemo()
         state.controller.reassertHardware()
+        recovering.append((key, state.controller))
         keysToClear.insert(key)
+      }
+    }
+    // Submission alone does not mean the panel has moved. Keep the marker
+    // through the drain so opening a surface cannot adopt the old native value.
+    var failedKeys: Set<String> = []
+    for (key, controller) in recovering {
+      if await controller.drainPendingWrites() {
         reasserted += 1
-        // The tag, never the persistence key: a key without an EDID UUID embeds
-        // the panel's serial number.
         restoreLog.info("""
-          interrupted dim recovered on display \
+          interrupted dim recovery applied on display \
+          \(DisplayLogging.tag(for: key), privacy: .public)
+          """)
+      } else {
+        failedKeys.insert(key)
+        restoreLog.warning("""
+          interrupted dim recovery not applied; retaining marker on display \
           \(DisplayLogging.tag(for: key), privacy: .public)
           """)
       }
     }
     // A recovered twin cannot consume the signal a still-live dim needs if
-    // this process crashes next. The whole pass is synchronous on the main actor.
-    let liveDimKeys = Set(displays.filter { $0.controller.temporaryDimFactor != nil }
+    // this process crashes next. Retain departed controllers too: a dim can
+    // begin while the drain is suspended, then disappear from discovery.
+    let liveDimKeys = liveDimKeysAtStart.union((recoveryDisplays + displays)
+      .filter { $0.controller.temporaryDimFactor != nil }
       .map(\.display.persistenceKey))
-    for key in keysToClear.subtracting(liveDimKeys) {
+    for key in keysToClear.subtracting(liveDimKeys).subtracting(failedKeys) {
       DisplayPrefs(persistenceKey: key, safeMode: safeMode).temporaryDimEngaged = false
     }
     // `.info`, not `.debug`: macOS does not persist debug records. This line is
@@ -1359,6 +1382,8 @@ final class AppModel {
       interrupted dim pass: \(evaluated, privacy: .public) evaluated, \
       \(reasserted, privacy: .public) reasserted
       """)
+    hasCompletedLaunchBrightnessRecovery = true
+    restartPoller()
   }
 
   /// One write-restore pass: every duplicate memo reset FIRST, then re-write
@@ -1398,6 +1423,10 @@ final class AppModel {
   /// must never outlive the pass that dropped it.
   @ObservationIgnored private var pollerTask: Task<Void, Never>?
 
+  @ObservationIgnored private var hasCompletedLaunchBrightnessRecovery = false
+
+  var isNativeBrightnessPolling: Bool { pollerTask != nil }
+
   /// Whether a surface showing a brightness value is on screen; one of the
   /// poller's cadence signals.
   let surfaceVisibility = SurfaceVisibility()
@@ -1493,6 +1522,10 @@ final class AppModel {
   /// before the drain task exits, so no explicit `waitForPendingWrites()` is
   /// needed.
   private func performRefresh(settling: Bool = false) async -> [CGDirectDisplayID] {
+    // The updater hint belongs only to the initial discovery, even if no panels
+    // are attached. Consume it before any suspension or later topology pass.
+    let recoverLegacyHandbacks = recoverLegacyUpdateHandbacks
+    recoverLegacyUpdateHandbacks = false
     redactRecentDisplayEvents()
     // The display set is about to be re-derived, so a memoized "discovery does
     // not know this id" is no longer evidence about anything.
@@ -1591,6 +1624,11 @@ final class AppModel {
       appeared.append(state)
       return state
     }
+    // Seed every controller before the first read can consume a shared identity's
+    // record. Safe Mode persists the hint but continues to skip hardware changes.
+    if recoverLegacyHandbacks {
+      for state in appeared { state.controller.noteLegacyUpdateHandback() }
+    }
     refreshBuiltIn()
     // The diagnostics ring's one insertion point for externals: `appeared` and
     // whatever is LEFT in `existing` are this pass's arrivals and departures,
@@ -1786,7 +1824,7 @@ final class AppModel {
   /// stay in sync on the native path.
   private func restartPoller() {
     pollerTask?.cancel()
-    guard !displays.isEmpty || builtIn != nil else {
+    guard hasCompletedLaunchBrightnessRecovery, !displays.isEmpty || builtIn != nil else {
       pollerTask = nil
       return
     }
 
@@ -64,7 +64,9 @@ final class StatusItemController: NSObject, NSApplicationDelegate, NSMenuDelegat
     // instance.
     let monitor = GammaInterferenceMonitor(gamma: gamma, alerts: EngineAlerts())
     interferenceMonitor = monitor
-    let model = AppModel(shade: shade, gamma: gamma, safeMode: safeMode)
+    let model = AppModel(
+      shade: shade, gamma: gamma, safeMode: safeMode,
+      recoverLegacyUpdateHandbacks: UpdateRelaunch.needsLegacyBrightnessRecovery())
     self.model = model
     // Reporting-only handoff: built here because it needs the AppKit alert
     // island, read there because the diagnostics pane has no other way to say how
@@ -680,7 +682,9 @@ final class StatusItemController: NSObject, NSApplicationDelegate, NSMenuDelegat
       // `oledCare.displaysReconfigured()` first, which drops the lock dim for at
       // least one care tick; a recovery in that window would see no live dim,
       // write the undimmed value to a locked screen, and spend the marker.
-      if !isSafeMode { model.recoverInterruptedDims() }
+      // Safe Mode preserves every marker and issues no recovery writes, but
+      // still completes this launch gate so ordinary native polling can begin.
+      await model.recoverInterruptedDims()
       restoreCoordinator.noteLaunchOrReconfigure()
       // Before the first open, for the same reason the display list is warmed
       // here: nothing the panel starts can be relied on to run while the menu
 
@@ -14,6 +14,22 @@ enum UpdateRelaunch {
     defaults.set(true, forKey: defaultsKey)
   }
 
+  /// Only the shipped predecessor is known to have written full-range DDC
+  /// brightness without recording its origin. Read this before consuming the UI mark.
+  static func needsLegacyBrightnessRecovery(
+    in defaults: UserDefaults = .standard, version: String = AppInfo.version
+  ) -> Bool {
+    guard defaults.bool(forKey: defaultsKey),
+          defaults.string(forKey: previousVersionKey) == "1.0.3" else { return false }
+    let parts = version.split(separator: ".", omittingEmptySubsequences: false)
+    guard parts.count == 3,
+          parts.allSatisfy({ !$0.isEmpty && $0.utf8.allSatisfy { (48...57).contains($0) } })
+    else { return false }
+    let numbers = parts.compactMap { Int($0) }
+    guard numbers.count == 3 else { return false }
+    return [1, 0, 3].lexicographicallyPrecedes(numbers)
+  }
+
   static func consume(in defaults: UserDefaults = .standard) -> Bool {
     guard defaults.bool(forKey: defaultsKey) else { return false }
     defaults.removeObject(forKey: defaultsKey)
 
@@ -55,7 +55,7 @@ enum SafetySentence {
   /// The same sentence shown under the control. Nil for the HDR block, which
   /// is stated once for the whole page at the foot of Control Method, so that
   /// case goes into the label and nowhere else.
-  var visibleCaption: SettingsCaption? {
+  @MainActor var visibleCaption: SettingsCaption? {
     switch self {
     case .blankDisplay, .hardwareMute: spoken.map { SettingsCaption(verbatim: $0) }
     case .hdrBlock: nil