@huseynsnmz/pi-board 0.15.3 → 0.17.0

package/docs/superpowers/plans/2026-09-08-legacy-stale-host-recovery.md

@@ -1,125 +0,0 @@
-# issue #87 plan：legacy 死 host 安全回收实现
-
-日期：2026-09-08 · spec：docs/superpowers/specs/2026-09-08-legacy-stale-host-recovery-design.md
-
-## 任务拆解
-
-### T1：纯决策函数 `canFinalizeLegacyHost`（A1）
-
-**文件**：`src/core/host-coordination.mjs`（新增导出，放 `classifyProbeResult` 附近）
-
-```js
-/**
- * Whether a legacy (pre-instanceId) host record can be safely finalized as
- * exited: the runner pid is provably dead (a reused pid reads alive →
- * conservative false) AND the endpoint is unreachable. Satisfies spec §10.1's
- * "never recovered" conservatism — recovery only fires when identity is
- * certain (issue #87).
- * @param {{ host: HostStatus|null, hostPid: number|null|undefined, hostPidAlive: boolean, probeClassification: string }} input
- * @returns {boolean}
- */
-export function canFinalizeLegacyHost({ host, hostPid, hostPidAlive, probeClassification }) {
-	if (!host || host.instanceId != null) return false;
-	if (host.state !== "starting" && host.state !== "alive") return false;
-	if (hostPid == null || hostPidAlive) return false;
-	return probeClassification === "missing" || probeClassification === "stale";
-}
-```
-
-**测试**：`test/host-coordination.test.mjs` 新增真值表用例（在文件既有风格下）：
-- 全条件满足（starting/alive × missing/stale 四组合）→ true
-- instanceId 非 null → false
-- state ∈ {exited, failed, stopping} → false
-- hostPid null / hostPidAlive true → false
-- classification ∈ {ready, starting, occupied, unknown} → false
-- host null → false
-
-### T2：resolver 两处改造（A2-A5）
-
-**文件**：`src/runtime/service.mjs`
-
-1. **import 更新**：`readHostPid` 加入 store.mjs import 列表；`canFinalizeLegacyHost` 加入 host-coordination.mjs import（L28 现有 `canReplaceHost` 同处）。
-
-2. **新增模块内 helper**（resolver 函数前，模块作用域）：
-
-```js
-/**
- * Finalize a provably-dead legacy host as exited so the resolver loop's next
- * iteration sees hostActive=false and claims a fresh new-protocol host
- * (issue #87). Legacy records have no instanceId — no concurrent owner exists,
- * so an unfenced writeHost is safe; the claim path is serialized by the
- * host-start lease.
- * @returns {boolean} true when finalized (caller should `continue` the loop).
- */
-function finalizeDeadLegacyHost(root, viewId, host, probeClassification) {
-	const hostPid = Object.hasOwn(host, "runnerPid") ? host.runnerPid : readHostPid(root, viewId);
-	if (!canFinalizeLegacyHost({ host, hostPid, hostPidAlive: isAlive(hostPid), probeClassification })) return false;
-	writeHost(root, { ...host, state: "exited", endedAt: Date.now(), lastSeenAt: Date.now(), error: "legacy host finalized: runner pid dead (issue #87)" });
-	try {
-		appendDiagnostic(root, viewId, {
-			source: "service", level: "info", code: "legacy_host_finalized",
-			message: `Finalized stale legacy host (pid ${hostPid} dead, probe ${probeClassification}) — next attach claims a fresh host`,
-			details: { hostPid, probeClassification, previousState: host.state },
-		});
-	} catch { /* best effort */ }
-	return true;
-}
-```
-
-注意：`writeHost` 签名是 `(root, host)`（host 内含 viewId），与 updateOwnedHost 不同。appendDiagnostic 签名参照文件内现有调用（`appendDiagnostic(root, viewId, {...})`，如 recoverHost 附近用法——实现时以现有调用为准）。
-
-3. **resolver legacy alive 分支**（现 L963 附近）：
-
-```js
-} else if (legacy) {
-	// Legacy host unreachable. spec §10.1 says never recover — unless the
-	// runner pid is provably dead, in which case finalize and self-heal
-	// (issue #87).
-	if (finalizeDeadLegacyHost(root, viewId, host, probe.classification)) {
-		await sleepFnImpl(HOST_PROBE_RETRY_MS);
-		continue;
-	}
-	return pending(sessionFile, "legacy host unreachable — manual restart needed");
-}
-```
-
-4. **resolver starting-legacy 分支**（现 L953-957 附近，`withinGrace || legacy` 等待分支）：
-
-```js
-if (withinGrace || legacy) {
-	// A legacy starting host whose runner is provably dead would wait out
-	// the grace window forever (withinGrace is always true for legacy) —
-	// finalize it now instead (issue #87).
-	if (legacy && finalizeDeadLegacyHost(root, viewId, host, probe.classification)) {
-		await sleepFnImpl(HOST_PROBE_RETRY_MS);
-		continue;
-	}
-	// Normal cold start (or a legacy starting host — legacy is never recovered,
-	// spec §10.1): wait out the grace window.
-	await sleepFnImpl(HOST_PROBE_RETRY_MS);
-	continue;
-}
-```
-
-（此分支 probe 已在上方 L939 执行，classification 可得。）
-
-**测试**：`test/host-resolver.test.mjs` 新增 4 个测试（fixtures 复用 hostRecord/scriptProbe/instantSleep/resolverService；launchHost override 模仿现有 adoption 测试的成功 spawn 模式）：
-
-- **A2 自愈闭环**：legacy alive host（hostRecord：instanceId:null、state:"alive"、**无 runnerPid 属性**——用 delete 或构造时排除）+ host-pid.json 写死 pid（writeHostPid 或 readHostPid 对应写法，参照 store.mjs 导出；用不可能存活的 pid 如 999999——注意须确认该 pid 在测试机不存在，现有 fixture aliveHost 已用 999999 表达"死 pid"，同法）+ scriptProbe(["missing"]) + launchHost override 成功 spawn → 断言：resolveAttachTarget 最终返回 kind:"pty"（新 host）；readHost 状态变迁——最终 host 是新 instance（launchHost 写入 starting）；diagnostics 含 legacy_host_finalized。
-  - 实现细节：claim/launch 后 readHost 读到的是新 host 记录，验证 finalize 发生要靠 diagnostics 断言 + resolve 结果非 pending。
-- **A3 保守分支**：同上但 host-pid.json 写 `process.pid`（活 pid）→ 断言返回 pending（reason 含 "legacy host unreachable"）且 host.json 未被改写（state 仍 alive）。
-- **A4 starting-legacy 回收**：legacy starting host（claimAt 久远超 grace，pid 死）+ probe missing + launchHost spawn 成功 → 断言不自 deadline timeout、最终 kind:"pty"、diagnostics 含 legacy_host_finalized。
-- **A5 unknown 不回收**：pid 死 + scriptProbe(["unknown"]) → 断言 pending 且不写盘。
-
-⚠️ fixture 要点：hostRecord 默认写 `runnerPid: null`——这会让 `Object.hasOwn(host, "runnerPid")` 为 true，fallback 不到 host-pid.json。legacy fixture 必须构造**没有 runnerPid 属性**的记录（hostRecord 加 `legacy: true` 选项删除 instanceId/runnerPid 等字段，或新写 `legacyHostRecord` helper），并配 `writeHostPid(root, viewId, pid)` 写镜像。
-
-### T3：全量回归（A6）
-
-`npm test` + `npm run typecheck`（基线 602）。
-
-## 验收对账
-
-- A1 → T1 真值表单测
-- A2/A3/A4/A5 → T2 四个集成测试
-- A6 → T3
-- U1（用户实测，合并前）：本机 6 个真实卡死 legacy view attach 验证——主 session 合并前提示用户执行，或合并后实测反馈。

package/docs/superpowers/plans/2026-09-08-spawn-async-error-swallow.md

@@ -1,56 +0,0 @@
-# issue #86 plan：spawn 异步 error 兜底实现
-
-日期：2026-09-08 · spec：docs/superpowers/specs/2026-09-08-spawn-async-error-swallow-design.md
-
-## 任务拆解
-
-### T1：launch.mjs spawnDetached helper + 4 处收敛（A1, A2）
-
-**改动**（`src/core/launch.mjs`）：
-1. 文件底部（或 import 后）新增模块内 helper：
-```js
-function spawnDetached(command, args, cwd) {
-	const child = spawn(command, args, {
-		cwd,
-		detached: true,
-		stdio: "ignore",
-		env: process.env,
-		// Windows: detached children get their own console window unless
-		// suppressed (CREATE_NO_WINDOW; no-op on POSIX) — issue #49.
-		windowsHide: true,
-	});
-	// Swallow async spawn failures (e.g. transient ENOENT on the node binary):
-	// without an 'error' listener the EventEmitter rethrows as uncaughtException
-	// and takes down the whole host Pi process (issue #86). Callers already
-	// record state "failed" via the pid == null branch.
-	child.on("error", () => {});
-	child.unref();
-	return child;
-}
-```
-2. `launchRun` / `launchHost` / `launchTitle` / `launchAutoState` 四处的 `spawn(...)` + `child.unref()` 收敛为 `const child = spawnDetached(node, [opts.runnerScript, configPath], config.cwd);`，返回值逻辑（`child.pid ?? null`、writePid 等）不变。
-
-**测试**（`test/launch.test.mjs`，复用现有注入模式）：
-- 新增 1 个测试：注入 `node: "/nonexistent/node-ENOENT-test"`，依次调用 4 个入口，断言：各自正常返回 `{ pid: null }`；`process.on("uncaughtException")` spy 不被触发；等待 ~300ms 让异步 error 有机会冒泡（进程崩 = 测试天然失败）。
-- 现有 4 个测试不动（A2 回归）。
-
-### T2：pty-attach.ts openExternalTarget error 兜底（A3）
-
-**改动**（`src/ui/pty-attach.ts` L1150-1167）：三分支统一为：
-```ts
-const child = spawn("xdg-open", [sanitized], { detached: true, stdio: "ignore" });
-child.on("error", () => {});
-child.unref();
-```
-（darwin `open`、win32 `cmd /c start` 同理）。参照 L847-848 xclip 既有模式。
-
-### T3：全量回归（A4）
-
-`npm test` + `npm run typecheck`，568+ 全绿。
-
-## 验收对账
-
-- A1 → T1 新测试
-- A2 → T1 既有测试回归
-- A3 → T2 代码审查 + `rg 'child.on\("error"' src/ui/pty-attach.ts` 断言三分支（A3 static）
-- A4 → T3

package/docs/superpowers/plans/2026-09-08-stale-model-attach-guard.md

@@ -1,96 +0,0 @@
-# issue #90 plan：defaultModel 失效防护实现
-
-日期：2026-09-08 · spec：docs/superpowers/specs/2026-09-08-stale-model-attach-guard-design.md
-
-## 任务拆解
-
-### T1：core 匹配函数 + service 注入（A1, A4）
-
-1. `src/core/launch-options.mjs` 新增导出（spec D1.1 签名原样）：
-```js
-export function modelRefAvailable(modelRef, availableModels) {
-	const ref = String(modelRef ?? "").trim().toLowerCase();
-	if (!ref) return true;                    // no constraint
-	if (!availableModels || availableModels.length === 0) return true;  // can't judge → allow
-	return availableModels.some((m) => `${m.provider}/${m.id}`.toLowerCase() === ref);
-}
-```
-2. 单测：若已有 `test/launch-options*.test.mjs` 则加入，否则新建。真值表：精确匹配（大小写混合）→ true；不匹配 → false；null/空串 → true；availableModels undefined/[] → true；部分匹配（"glm-5.3" 不配 provider）→ false。
-3. `src/ui/dashboard.ts` L1738 `findLaunchModelByRef` 改为内部调用 core 的匹配逻辑（保持返回 LaunchModel 对象：find 复用 `modelRefAvailable` 不可行——它返回 boolean；改为直接复用 core 里新增的共享比较，或最简单：dashboard 本地函数改为 `models.find(m => modelRefAvailable(ref, [m])) ?? null`。选最简单且单一事实源的写法）。
-   - 注：若这步让 diff 变脏（import 路径等），可以跳过，dashboard 本地函数保持——在 plan 偏差里说明即可。优先级低。
-
-### T2：service 校验接线（A2, A3, A5）
-
-1. `createService` opts 新增：`availableModels`（`() => Array<{provider:string,id:string}> | undefined`；默认 undefined → 跳过校验）。JSDoc typedef 更新（文件内 createService opts 注释处）。
-2. service.mjs 模块内新增 helper：
-```js
-/** @returns {string|null} error message when the view's defaultModel is provably unavailable. */
-function validateViewModelMeta(meta) {
-	const model = meta.defaultModel ?? null;
-	if (!model || !optsAvailableModels) return null;
-	const list = optsAvailableModels() ?? undefined;
-	if (modelRefAvailable(model, list)) return null;
-	return `Model "${model}" configured for this session is no longer available — update the view's model (or clear defaultModel) and retry attach.`;
-}
-```
-（注意 availableModels() 调用本身 try/catch → undefined。）
-3. `startHostUnderLease`（L205）：在 canReplaceHost 检查之后、instanceId 生成之前插入：
-```js
-const modelError = validateViewModelMeta(meta);
-if (modelError) return { ok: false, error: modelError };
-```
-（校验失败不留 claim、不 spawn。）
-4. `adoptClaimedHost`（L775 起）：config 构建前插入校验；失败时：
-```js
-updateOwnedHost(root, viewId, instanceId, (h) => ({ ...h, state: "failed", endedAt: nowImpl(), exitCode: 1, error: modelError, claimPid: null, claimIdentity: null }));
-return { ok: true, pending: true, socketPath: null, instanceId };
-```
-（对齐该函数既有 spawnError 失败处理模式。）
-5. `src/index.ts` serviceFor 与 `src/commands/agent-board.ts` flag 路径注入：
-```ts
-availableModels: () => { try { return ctx.modelRegistry.getAvailable(); } catch { return undefined; } },
-```
-（agent-board.ts flag 路径 L115 的 createService 调用同款注入；dashboard 路径 L95 已有 availableModels 变量但那是 UI deps，service 注入仍需单独传。）
-6. 集成测试（`test/host-resolver.test.mjs` 或 `test/service.test.mjs`，看 ensure 测试在哪更顺）：
-   - A2：view meta defaultModel="glm/glm-5.3"，注入 availableModels: () => [{provider:"zai-coding-cn",id:"glm-5.3"}]，launchHost spy → ensureHost("v1") 断言 ok:false、error 含模型名、spy 零调用、readHost 无 starting 残留；
-   - A3 对照：availableModels 含 glm/glm-5.3 → 正常 claim+spawn（断言 started/started pending 路径与现状一致）；
-   - A4：不注入 availableModels → 跳过校验正常 launch；
-   - A5：废弃 starting claim（adopt 路径，参照现有 adoption 测试 fixture）+ 失效模型 → 断言落 failed、不 spawn。
-
-### T3：runner exit 归因（A6, A7）
-
-1. `src/core/heuristics.mjs` 新增导出：
-```js
-/**
- * Last non-empty visible line of a raw terminal log chunk (ANSI/OSC stripped,
- * per-line carriage-return resolved). @returns {string|null}
- */
-export function lastVisibleLogLine(text, maxLen = 200)
-```
-实现：strip `/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g`（OSC）→ `/\x1b\[[0-9;?]*[ -/]*[@-~]/g`（CSI）→ 其他 `\x1b.` 单字符转义 → 按 `\n` 切分 → 每行取最后一个 `\r` 之后段 → trim → 过滤空 → 取最后一行 → truncate(maxLen)（复用同文件 truncate）。
-2. 单测（heuristics 测试文件）：ANSI 颜色、OSC 链接、`\r` 覆盖行、空行跳过、截断、空输入 → null。
-3. `runner/pty-runner.mjs` child exit 回调（L213-223 区域）：
-```js
-if (!crashed) {
-	let exitError = null;
-	if (exitCode !== 0) {
-		try {
-			const tail = readScreenLogTail(screenLog, 8192);  // openSync/readSync seek 尾部
-			exitError = lastVisibleLogLine(tail);
-		} catch { /* best effort */ }
-	}
-	update({ state: "exited", endedAt: Date.now(), exitCode, childPid: null, ...(exitError ? { error: exitError } : {}) });
-	...
-}
-```
-（screenLog 变量在 L62 作用域内可见；确认该回调能访问到。readScreenLogTail 写成 runner 内私有小函数。）
-4. 集成测试（test/pty-runner.integration.test.mjs）：用 test-support/ 下 fake pi 模式（看 fake-slow-start-pi.mjs；若无"立即 exit 1 + 输出错误"的 fake 就新增一个 `fake-failing-pi.mjs`：打印 `Error: Model "glm/glm-5.3" not found.` 后 exit 1）→ spawn runner → 等 exit → 断言 readHost 的 error 含 "Model" / "not found"；对照 exit 0（现有 fake）→ error 字段保持 null。注意 hasNodePty skip 守卫参照现有测试。
-
-### T4：全量回归（A8）
-
-`npm test` + `npm run typecheck`（基线 608）。
-
-## 验收对账
-
-- A1 → T1.2 · A2/A3/A4/A5 → T2.6 · A6 → T3.2 · A7 → T3.4 · A8 → T4
-- U1（用户实测，合并后）：view_539a5e9e20 恢复失效 defaultModel → attach 看 notify + diagnostics 不再累积；改回有效模型 attach 成功。

package/docs/superpowers/plans/2026-09-09-claimpid-blocks-replace.md

@@ -1,267 +0,0 @@
-# claimPid-Blocks-Replace Fix Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Fix issue #99 — an exited/failed host whose `claimPid` (the dashboard process) is still alive must be replaceable, so attach no longer pends to `host start timed out`.
-
-**Architecture:** The fix relaxes one pure decision function (`canReplaceHost` in `src/core/host-coordination.mjs`): the claim role no longer participates in the replacement gate for terminal hosts, because claim protection (a launcher mid-transaction between claim and spawn) only matters while a host is `starting`. The observation helper (`observeHostForReplace` in `src/runtime/service.mjs`) drops its now-unused `claimObservation` field.
-
-**Tech Stack:** Node.js (node:test, node:assert/strict), plain ESM modules, no new dependencies.
-
-**Spec:** `docs/superpowers/specs/2026-09-09-claimpid-blocks-replace-design.md`
-
-## Global Constraints
-
-- Change only the claim-role gate semantics; runner/child unknown observations must still block replacement (spec A2), `launchLeaseActive` must still block (spec A3), non-terminal hosts must still refuse (spec A4).
-- `canReplaceHost` signature loses `claimObservation`; `observeHostForReplace` stops computing it (one fewer `process.kill(pid, 0)` syscall).
-- All existing tests in `test/host-coordination.test.mjs` and `test/host-resolver.test.mjs` must keep passing (no behavioral regressions outside the claim-role gate).
-- `npm run typecheck` must pass (service.mjs is .mjs but the repo runs tsc over TS sources; keep JSDoc types consistent).
-- No changes to pty-runner.mjs, store.mjs, or host.json structure (spec non-goals).
-
-## Acceptance traceability
-
-| Spec ID | Plan coverage |
-|---------|---------------|
-| A1 (exited/failed + live claimPid → replaceable) | Task 1 Step 1 test `canReplaceHost allows replacing a terminal host whose claimPid is still alive` |
-| A2 (runner/child unknown still blocks) | Task 1 Step 1 test `canReplaceHost still refuses unknown runner/child observations` + legacy case 1 of `canReplaceHost refuses unknown observations` |
-| A3 (launchLeaseActive still blocks) | Task 1 Step 1 legacy case 3 of `canReplaceHost refuses unknown observations` |
-| A4 (non-terminal hosts refuse; host null) | Task 1 Step 1 test `canReplaceHost refuses non-terminal hosts and null host` |
-| A5 (foreign/not_started releasable) | Task 1 Step 1 test `canReplaceHost SAFE_TO_RELEASE boundary regression` |
-| A6 (resolver integration: exited + live claimPid → new host) | Task 2 |
-| U1 (real dashboard attach) | Post-implementation manual task (Task 3) |
-
----
-
-### Task 1: Relax `canReplaceHost` claim-role gate + drop `claimObservation` (A1-A5)
-
-**Files:**
-- Modify: `src/core/host-coordination.mjs:60-80` (canReplaceHost + its JSDoc)
-- Modify: `src/runtime/service.mjs:2006-2013` (observeHostForReplace)
-- Test: `test/host-coordination.test.mjs:30-35`
-
-**Interfaces:**
-- Consumes: `SAFE_TO_RELEASE` set (already defined at `host-coordination.mjs:57`).
-- Produces: `canReplaceHost({ host, runnerObservation, childObservation, launchLeaseActive }) → boolean` — the `claimObservation` parameter is REMOVED. Sole caller `observeHostForReplace` (service.mjs, internal, not exported) stops passing it. Task 2's integration test relies on this behavior only indirectly (through `resolveAttachTarget`), so no signature dependency.
-
-- [ ] **Step 1: Write the failing tests**
-
-In `test/host-coordination.test.mjs`, first EDIT the existing `canReplaceHost refuses unknown observations` test (line 30-35) to drop the `claimObservation` argument from all three assertions (the parameter is being removed):
-
-```js
-test("canReplaceHost refuses unknown observations", () => {
-	const host = { state: "failed" };
-	assert.equal(canReplaceHost({ host, runnerObservation: "unknown", childObservation: "dead", launchLeaseActive: false }), false);
-	assert.equal(canReplaceHost({ host, runnerObservation: "dead", childObservation: "not_started", launchLeaseActive: false }), true);
-	assert.equal(canReplaceHost({ host, runnerObservation: "dead", childObservation: "dead", launchLeaseActive: true }), false);
-});
-```
-
-Then ADD these four tests right after it:
-
-```js
-test("canReplaceHost allows replacing a terminal host whose claimPid is still alive (issue #99)", () => {
-	// The bug: an exited/failed host keeps its claimPid (the dashboard process
-	// that wrote the claim), and a live pid observed as "unknown" used to block
-	// replacement forever — attach pended to "host start timed out". Claim
-	// protection only matters while a claim is mid-transaction (state
-	// "starting"); a terminal host cannot still be being launched.
-	assert.equal(canReplaceHost({ host: { state: "exited" }, runnerObservation: "dead", childObservation: "dead", launchLeaseActive: false }), true);
-	assert.equal(canReplaceHost({ host: { state: "failed" }, runnerObservation: "dead", childObservation: "dead", launchLeaseActive: false }), true);
-});
-
-test("canReplaceHost still refuses unknown runner/child observations (issue #99 conservatism)", () => {
-	assert.equal(canReplaceHost({ host: { state: "exited" }, runnerObservation: "unknown", childObservation: "dead", launchLeaseActive: false }), false);
-	assert.equal(canReplaceHost({ host: { state: "exited" }, runnerObservation: "dead", childObservation: "unknown", launchLeaseActive: false }), false);
-	assert.equal(canReplaceHost({ host: { state: "failed" }, runnerObservation: "unknown", childObservation: "unknown", launchLeaseActive: false }), false);
-});
-
-test("canReplaceHost refuses non-terminal hosts and null host (issue #99)", () => {
-	for (const state of ["starting", "alive", "stopping"]) {
-		assert.equal(canReplaceHost({ host: { state }, runnerObservation: "dead", childObservation: "dead", launchLeaseActive: false }), false, `state ${state} must refuse`);
-	}
-	assert.equal(canReplaceHost({ host: null, runnerObservation: "dead", childObservation: "dead", launchLeaseActive: false }), false);
-});
-
-test("canReplaceHost SAFE_TO_RELEASE boundary regression (issue #99)", () => {
-	assert.equal(canReplaceHost({ host: { state: "exited" }, runnerObservation: "foreign", childObservation: "dead", launchLeaseActive: false }), true, "foreign runner (pid reuse) is releasable");
-	assert.equal(canReplaceHost({ host: { state: "exited" }, runnerObservation: "not_started", childObservation: "not_started", launchLeaseActive: false }), true);
-});
-```
-
-- [ ] **Step 2: Run tests to verify they fail**
-
-Run: `node --test test/host-coordination.test.mjs 2>&1 | tail -30`
-Expected: FAIL — the first new test fails (`exited` + dead runner/child returns `false` under the old three-role gate). The edited legacy test fails too: the old implementation ignores the removed `claimObservation` key but still requires `claimObservation` in SAFE_TO_RELEASE via `undefined → not in set → false`… actually with `claimObservation` absent, `SAFE_TO_RELEASE.has(undefined)` is `false`, so case 2 of the legacy test (`"dead"` args → expected `true`) FAILS under the old code. Both failures prove the tests exercise the gate.
-
-- [ ] **Step 3: Implement the relaxation**
-
-In `src/core/host-coordination.mjs`, replace the `canReplaceHost` function (lines ~63-80) with:
-
-```js
-/**
- * Whether an exited/failed host can be replaced by a new claim. The runner and
- * child roles must be provably gone; any `unknown` observation or an active
- * launch lease blocks replacement. The claim role does NOT participate: claim
- * protection (a launcher mid-transaction between claim and spawn) only matters
- * while the host is `starting`, and this gate only ever sees terminal hosts —
- * a terminal host cannot still be being launched (issue #99: a live claimPid —
- * the dashboard process that wrote the claim — must not block re-attach).
- * @param {{
- *   host: HostStatus|null|undefined,
- *   runnerObservation: string,
- *   childObservation: string,
- *   launchLeaseActive: boolean,
- * }} input
- * @returns {boolean}
- */
-export function canReplaceHost({ host, runnerObservation, childObservation, launchLeaseActive }) {
-	if (!host || (host.state !== "exited" && host.state !== "failed")) return false;
-	if (launchLeaseActive) return false;
-	return (
-		SAFE_TO_RELEASE.has(runnerObservation) &&
-		SAFE_TO_RELEASE.has(childObservation)
-	);
-}
-```
-
-In `src/runtime/service.mjs`, edit `observeHostForReplace` (line ~2006) to drop the `claimObservation` line:
-
-```js
-/** @param {import("../core/types.mjs").HostStatus|null} host */
-function observeHostForReplace(host) {
-	return {
-		host,
-		runnerObservation: conservativeObservation(host?.runnerPid ?? null),
-		childObservation: conservativeObservation(host?.childPid ?? null),
-		launchLeaseActive: false,
-	};
-}
-```
-
-- [ ] **Step 4: Run tests to verify they pass**
-
-Run: `node --test test/host-coordination.test.mjs 2>&1 | tail -10`
-Expected: PASS — all tests in the file pass (4 new + edited legacy + all untouched).
-
-Run: `node --test test/host-resolver.test.mjs test/host-recovery.test.mjs test/host-crash.test.mjs 2>&1 | tail -10`
-Expected: PASS — no regressions in adjacent host suites.
-
-Run: `npm run typecheck`
-Expected: exit 0.
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/core/host-coordination.mjs src/runtime/service.mjs test/host-coordination.test.mjs
-git commit -m "fix(host): claim role no longer blocks terminal host replacement (#99)"
-```
-
----
-
-### Task 2: Resolver integration test — exited host + live claimPid attaches via fresh spawn (A6)
-
-**Files:**
-- Test: `test/host-resolver.test.mjs` (add one test after the `resolver finalizes a provably-dead legacy alive host` test, ~line 163)
-
-**Interfaces:**
-- Consumes: existing helpers `freshRoot`, `resolverService`, `healServiceOverrides(probe, spawns)`, `scriptProbe(seq)`, `hostRecord(root, viewId, over)` (defaults `claimPid: process.pid` — exactly the live-claimer shape), `createView` (returns `{ sessionFile, ... }`), and `writeFileSync` (already imported). Task 1's relaxed `canReplaceHost` must be in place — this test verifies the full attach chain (resolver → ensureHost → startHostUnderLease → canReplaceHost → spawn → probe ready).
-- Produces: nothing downstream (terminal verification task).
-
-- [ ] **Step 1: Write the integration test**
-
-Add to `test/host-resolver.test.mjs` after the issue #87 legacy-alive test (~line 163):
-
-```js
-test("resolver replaces an exited host whose claimPid is still alive (issue #99)", async () => {
-	const root = freshRoot();
-	try {
-		const meta = createView(root, { id: "v1", name: "a", cwd: "/r" });
-		writeFileSync(meta.sessionFile, "");
-		// The bug's exact shape: the host ran to completion (exited, exitCode 0,
-		// stopReason child_exit) but its claimPid — the dashboard process that
-		// wrote the claim — is STILL ALIVE (hostRecord defaults claimPid to
-		// process.pid). Before the fix, canReplaceHost saw the live claim as
-		// "unknown" and the resolver pended to "host start timed out".
-		hostRecord(root, "v1", {
-			instanceId: "i1",
-			state: "exited",
-			runnerPid: 999999,
-			childPid: null,
-			endedAt: Date.now(),
-			exitCode: 0,
-			stopReason: "child_exit",
-		});
-		const probe = scriptProbe(["ready"]);
-		const spawns = [];
-		const svc = resolverService(root, healServiceOverrides(probe, spawns));
-		const result = await svc.resolveAttachTarget("v1", { timeoutMs: 2_000 });
-		assert.equal(result.kind, "pty", `must replace the exited host despite the live claimPid: ${JSON.stringify(result)}`);
-		assert.equal(spawns.length, 1, "exactly one fresh claim spawn");
-		assert.notEqual(result.instanceId, "i1", "attaches to the replacement instance");
-	} finally {
-		rmSync(root, { recursive: true, force: true });
-	}
-});
-```
-
-- [ ] **Step 2: Sanity-verify the test fails against the pre-fix gate (optional but recommended)**
-
-Temporarily `git stash` the Task 1 commit (`git stash` won't work across commits — instead: `git checkout HEAD~1 -- src/core/host-coordination.mjs src/runtime/service.mjs`), then run:
-
-Run: `node --test --test-name-pattern "issue #99" test/host-resolver.test.mjs 2>&1 | tail -15`
-Expected: the new test FAILS or times out (resolver pends — the pre-fix behavior). Then restore: `git checkout HEAD -- src/core/host-coordination.mjs src/runtime/service.mjs`.
-
-If the timeout makes the run slow, the 2_000 ms timeoutMs bounds it.
-
-- [ ] **Step 3: Run the test against the fix**
-
-Run: `node --test --test-name-pattern "issue #99" test/host-resolver.test.mjs 2>&1 | tail -10`
-Expected: PASS — `kind: "pty"`, exactly one spawn, replacement instanceId.
-
-- [ ] **Step 4: Run the full suite**
-
-Run: `npm test 2>&1 | tail -15`
-Expected: PASS — all suites green, no regressions.
-
-Run: `npm run typecheck`
-Expected: exit 0.
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add test/host-resolver.test.mjs
-git commit -m "test(resolver): exited host with live claimPid attaches via fresh spawn (#99)"
-```
-
----
-
-### Task 3: U1 manual verification (post-implementation, user-executed)
-
-**Files:** none (manual).
-
-**Interfaces:** none.
-
-- [ ] **Step 1: Restart dashboard process** (loads new code — the "immediately effective on existing bad records" property requires restart).
-
-- [ ] **Step 2: Attach view_2472d82627 from the dashboard** — observe: attach enters the session, history renders, no `host start timed out`.
-
-- [ ] **Step 3: Exit the session, attach again** — confirm repeatability.
-
-- [ ] **Step 4: Same check on view_4b667ad75d / view_c038badb30** (the other two exited + live-claimPid views).
-
-- [ ] **Step 5: Record results in the issue** (comment each view's outcome; mark U1 pass/pending in the final report).
-
----
-
-## Self-Review
-
-**1. Spec coverage:**
-- A1-A5 → Task 1 Step 1 (three new tests + edited legacy test covers A2/A3 cases) ✓
-- A6 → Task 2 ✓
-- U1 → Task 3 ✓
-- 改动文件清单 (spec) → Task 1 + Task 2 files match exactly (host-coordination.mjs, service.mjs, host-coordination.test.mjs, host-resolver.test.mjs) ✓
-- 非目标: no pty-runner/store/host.json changes in any task ✓
-
-**2. Placeholder scan:** no TBD/TODO; every code step has full code; verification commands concrete. ✓
-
-**3. Type consistency:** `canReplaceHost` new signature `{host, runnerObservation, childObservation, launchLeaseActive}` used consistently in Task 1 tests, Task 1 implementation, and matches Task 2's indirect usage (no direct call). `healServiceOverrides(probe, spawns)` helper name matches file. ✓