@zhuxixi/pi-agent-board 0.6.2 → 0.8.0

package/src/runtime/service.mjs

@@ -9,13 +9,14 @@ import { randomBytes } from "node:crypto";
 import { createRequire } from "node:module";
 import { createConnection } from "node:net";
 import { resolve } from "node:path";
-import { applyAutoStateToStatus, autoStateEnabled, heuristicAutoState } from "../core/auto-state.mjs";
+import { applyAutoStateToStatus, autoStateEnabled, heuristicAutoState, isManualCompletion } from "../core/auto-state.mjs";
 import { appendLine, atomicWriteJson, removeFile } from "../core/atomic.mjs";
 import { finalizeRun, projectViewState, reduceEvent } from "../core/events.mjs";
 import { clearDiagnostics, appendDiagnostic, tailDiagnostics } from "../core/diagnostics.mjs";
 import { emptyEvidenceSnapshot, finalizeEvidence, readEvidence, reduceEvidence, summarizeEvidence, writeEvidence } from "../core/evidence.mjs";
 import { updateCodeRefsFromEvidence } from "../core/code-refs-store.mjs";
-import { claimNextFollowUp, completeFollowUp, enqueueFollowUp, readFollowUpQueue, releaseFollowUp, summarizeFollowUpQueue, clearQueuedFollowUps, removeLastFollowUp } from "../core/follow-up-queue.mjs";
+import { claimNextFollowUp, completeFollowUp, enqueueFollowUp, failFollowUp, readFollowUpQueue, releaseFollowUp, summarizeFollowUpQueue, clearQueuedFollowUps, removeLastFollowUp } from "../core/follow-up-queue.mjs";
+import { foregroundPreviewCache } from "../core/foreground-preview-cache.mjs";
 import { approvePlan as approvePlanState, markExecutingApprovedPlan, readSteering, recordPlanReady, requestPlan as requestPlanState, requestPlanChanges as requestPlanChangesState, summarizeSteering } from "../core/steering.mjs";
 import { buildApprovePlanPrompt, buildPlanChangesPrompt, buildPlanRequestPrompt } from "../core/steering-prompts.mjs";
 import { isGenericStatusText } from "../core/derive.mjs";
@@ -27,6 +28,9 @@ import { isAlive, killProcess } from "../core/pid.mjs";
 import { acquireOwnedViewLock, tryAcquireOwnedViewLock } from "../core/locks.mjs";
 import { canFinalizeLegacyHost, canReplaceHost } from "../core/host-coordination.mjs";
 import { modelRefAvailable } from "../core/launch-options.mjs";
+import { ensureCoordinator, sendStateCommand, coordinatorDisabled } from "../core/coordinator-client.mjs";
+import { createDesyncEpisodeThrottle, rereadPair, statusRevisionDesynced } from "../core/status-consistency.mjs";
+import { commandRejectDiagnostic } from "../core/state-commands.mjs";
 import { HOST_PROBE_RETRY_MS, probeHost } from "../core/host-probe.mjs";
 import * as P from "../core/paths.mjs";
 import {
@@ -88,6 +92,7 @@ const ATTACH_RESOLVE_TIMEOUT_MS = 120_000;
  *   signalOwnedProcess?: (identity: {pid: number, startToken: string|null}, signal: string) => void,
  *   probeHostFn?: typeof probeHost,
  *   sleepFn?: (ms: number) => Promise<void>,
+ *   sendStateCommand?: typeof sendStateCommand,
  *   availableModels?: () => Array<{ provider: string, id: string }> | undefined,
  * }} opts
  */
@@ -104,6 +109,11 @@ export function createService(opts) {
 	const nowImpl = opts.now ?? Date.now;
 	const acquireLockImpl = opts.acquireLock ?? acquireOwnedViewLock;
 	const tryAcquireLockImpl = opts.tryAcquireLock ?? tryAcquireOwnedViewLock;
+	const sendStateCommandImpl = opts.sendStateCommand ?? sendStateCommand;
+	const ensureCoordinatorImpl = opts.ensureCoordinator ?? ensureCoordinator;
+	// Desync episode throttle: a stuck (stateRev:statusRev) pair logs once per
+	// service, not once per reconcile pass — see createDesyncEpisodeThrottle().
+	const desyncThrottle = createDesyncEpisodeThrottle();
 	// Identity-aware observation/signalling for host recovery (issue #70). Callers must
 	// only signal after observeProcess returned "owned" for that exact identity.
 	const observeProcessImpl = opts.observeProcess ?? defaultObserveProcess;
@@ -144,9 +154,11 @@ export function createService(opts) {
 	 * @param {import("../core/types.mjs").ViewMeta} meta
 	 * @param {string} prompt
 	 * @param {RunKind} kind
-	 * @returns {{ runId: string, pid: number|null }}
+	 * @returns {Promise<{ runId: string, pid: number|null }>} resolves after
+	 *   mark_queued has landed and the detached runner is spawned (ordering
+	 *   contract: the row must be queued before the runner can boot, final-review F2).
 	 */
-	function launchForView(meta, prompt, kind) {
+	async function launchForView(meta, prompt, kind) {
 		const runId = newRunId();
 		/** @type {import("../core/types.mjs").RunConfig} */
 		const config = {
@@ -163,9 +175,17 @@ export function createService(opts) {
 			thinkingLevel: meta.defaultThinking ?? null,
 			tools: null,
 		};
+		// Final-review F2 residual (fix round 2): mark_queued must LAND before the
+		// runner can boot. A detached runner that boots faster than this round-trip
+		// used to send run_started while the row was still manual-completed → the
+		// command hit the manual fence → row stuck queued/alive with no status file
+		// → beats and run_finalized reject stale_run forever → permanent zombie.
+		// Spawn regardless of the result: with the coordinator unreachable the
+		// runner's own commands fail the same way either way — launch availability
+		// beats strict ordering.
+		await markQueued(meta.id, runId);
 		const { pid } = launch(root, config, { runnerScript: opts.runnerScript });
 		appendDiagnostic(root, meta.id, { source: "service", runId, code: "launch_run", message: "Detached runner launched", details: { kind, pid } });
-		markQueued(meta.id, runId);
 		return { runId, pid };
 	}
 
@@ -176,9 +196,9 @@ export function createService(opts) {
 	 * can never stack a second host on top of a live claim.
 	 * @param {import("../core/types.mjs").ViewMeta} meta
 	 * @param {string|null} initialPrompt
-	 * @returns {{ ok: true, status: "started"|"pending"|"reused", pid: number|null, socketPath: string|null, instanceId: string|null } | { ok: false, error: string, fallbackReason?: string }}
+	 * @returns {Promise<{ ok: true, status: "started"|"pending"|"reused", pid: number|null, socketPath: string|null, instanceId: string|null } | { ok: false, error: string, fallbackReason?: string }>}
 	 */
-	function launchHost(meta, initialPrompt, launchOpts = {}) {
+	async function launchHost(meta, initialPrompt, launchOpts = {}) {
 		let lease;
 		try {
 			lease = acquireLockImpl(root, meta.id, "host-start", { waitMs: HOST_START_LOCK_WAIT_MS, identity: serviceIdentity() });
@@ -190,7 +210,12 @@ export function createService(opts) {
 			return pendingLaunchResult(existing);
 		}
 		try {
-			return startHostUnderLease(meta, initialPrompt, launchOpts);
+			// Same ordering contract as launchForView (final-review F2 residual):
+			// the row must leave completed/fenced before the host can start work.
+			// `return await` (not `return`) keeps the host-start lease held until
+			// the two-phase claim transaction settles.
+			if (launchOpts.markQueued !== false) await markQueued(meta.id, null);
+			return await startHostUnderLease(meta, initialPrompt, launchOpts);
 		} finally {
 			try { lease.release(); } catch { /* best effort */ }
 		}
@@ -228,7 +253,7 @@ export function createService(opts) {
 	 * lease; this function never acquires or releases it.
 	 * @param {import("../core/types.mjs").ViewMeta} meta
 	 * @param {string|null} initialPrompt
-	 * @returns {ReturnType<typeof launchHost>}
+	 * @returns {{ ok: true, status: "reused"|"pending"|"started", pid: number|null, socketPath: string|null, instanceId: string|null } | { ok: false, error: string, fallbackReason?: string }}
 	 */
 	function startHostUnderLease(meta, initialPrompt, launchOpts = {}) {
 		const existing = readHost(root, meta.id);
@@ -304,7 +329,6 @@ export function createService(opts) {
 		}
 		updateOwnedHost(root, meta.id, instanceId, (h) => ({ ...h, runnerPid: pid, runnerSpawnedAt: nowImpl() }));
 		appendDiagnostic(root, meta.id, { source: "service", code: "launch_host", message: "PTY host launched", details: { pid, instanceId, hasInitialPrompt: Boolean(initialPrompt) } });
-		if (launchOpts.markQueued !== false) markQueued(meta.id, null);
 		return { ok: true, status: "started", pid, socketPath, instanceId };
 	}
 
@@ -337,17 +361,36 @@ export function createService(opts) {
 	/**
 	 * Apply immediate heuristic auto-state and, when configured, queue a detached
 	 * model pass to refine the row without blocking the live Pi child.
+	 *
+	 * Issue #91 (A8, service source): the classification lands through the View
+	 * State Coordinator — the single writer of state.json/status.json. On apply,
+	 * projection-relevant fields are refreshed from the materialized state so the
+	 * caller's foreground projection (writeForegroundState) cannot clobber the
+	 * patch with stale in-memory values. Ambiguous transport outcomes (timeout /
+	 * connection_reset) never fall back to a direct write — the command may
+	 * already be journaled, and the coordinator's boot replay is the recovery
+	 * path. coordinator_disabled keeps the pre-coordinator in-memory apply.
 	 * @param {import("../core/types.mjs").ViewMeta} meta
-	 * @param {import("../core/types.mjs").RunStatus} status
+	 * @param {import("../core/types.mjs").RunStatus} status refreshed in place on apply
 	 * @param {import("../core/types.mjs").EvidenceSnapshot} evidence
-	 * @returns {boolean}
+	 * @returns {Promise<boolean>} whether the classification was applied
 	 */
-	function queueAutoState(meta, status, evidence) {
+	async function queueAutoState(meta, status, evidence) {
 		if (!autoStateEnabled()) return false;
 		if (status.processState === "alive" || status.semanticState === "failed" || status.semanticState === "stopped") return false;
 		const latest = latestEvidenceText(evidence) || status.latestAssistantPreview || status.summary || "";
 		if (!latest.trim()) return false;
-		const changed = applyAutoStateToStatus(status, heuristicAutoState(latest, { lastAgentActivityAt: status.lastAgentActivityAt ?? null }), Date.now());
+		const classification = heuristicAutoState(latest, { lastAgentActivityAt: status.lastAgentActivityAt ?? null });
+		const commandRunId = status.runId === "foreground" ? null : status.runId;
+		const result = await sendStateCommandImpl(root, {
+			type: "state_command",
+			viewId: meta.id,
+			runId: commandRunId,
+			source: "service",
+			kind: "auto_state_classified",
+			expectedRevision: null,
+			payload: { classification },
+		});
 		if (opts.autoStateRunnerScript) {
 			try {
 				launchAutoStateImpl(root, {
@@ -362,11 +405,47 @@ export function createService(opts) {
 				appendDiagnostic(root, meta.id, { source: "service", level: "warn", code: "auto_state_launch_failed", message: "Auto-state classifier could not be launched", details: { error: err instanceof Error ? err.message : String(err) } });
 			}
 		}
-		return changed;
+		if (result.status === "applied") {
+			const fresh = readState(root, meta.id);
+			if (fresh) {
+				status.semanticState = fresh.semanticState;
+				status.summary = fresh.summary;
+				status.question = fresh.question;
+				status.autoState = fresh.autoState ?? null;
+			}
+			return true;
+		}
+		if (result.reason === "coordinator_disabled") {
+			return applyAutoStateToStatus(status, classification, Date.now());
+		}
+		// Unified decided/ambiguous classification (CR r2 issue-3): decided
+		// rejects (manual_fence/stale_run/…) log as info *_skipped — the
+		// coordinator's verdict is authoritative; only genuinely ambiguous
+		// outcomes (timeout/connection_reset) keep the recovery-path warn.
+		appendDiagnostic(root, meta.id, { source: "service", runId: commandRunId, ...commandRejectDiagnostic("auto_state", "Auto-state classification", result.reason, "otherwise the next classification pass will converge the row"), details: { reason: result.reason } });
+		return false;
 	}
 
-	/** @param {string} viewId @param {string|null} runId */
-	function markQueued(viewId, runId) {
+	/**
+	 * Fire a state command for a non-run lifecycle/metadata mutation and surface
+	 * non-applied outcomes. Ambiguity contract (issue #91): timeout /
+	 * connection_reset mean the command MAY already be journaled — never fall
+	 * back to a direct write on those; only the explicit
+	 * AGENT_BOARD_COORDINATOR=off escape hatch takes the legacy branch (the
+	 * caller checks `reason === "coordinator_disabled"`).
+	 * @param {object} command
+	 * @param {string} [viewId] defaults to command.viewId
+	 */
+	async function sendLifecycleCommand(command, viewId = command.viewId) {
+		const result = await sendStateCommandImpl(root, command);
+		if (result.status !== "applied" && result.reason !== "coordinator_disabled") {
+			appendDiagnostic(root, viewId, { source: "service", level: "warn", code: "state_command_not_applied", message: `${command.kind} ${result.status} (${result.reason})`, details: { kind: command.kind, reason: result.reason } });
+		}
+		return result;
+	}
+
+	/** Legacy direct write for mark_queued — coordinator_disabled escape hatch only. */
+	function markQueuedDirect(viewId, runId) {
 		const state = readState(root, viewId) ?? blankState(viewId);
 		state.currentRunId = runId;
 		state.semanticState = "queued";
@@ -383,23 +462,111 @@ export function createService(opts) {
 		writeState(root, state);
 	}
 
-	/** @param {string} viewId @returns {{ ok: boolean, error?: string }} */
-	function markVisited(viewId) {
-		const row = loadRow(root, viewId);
-		if (!row) return { ok: false, error: "Unknown session" };
-		const state = readState(root, viewId) ?? row.state ?? blankState(viewId);
+	/** @param {string} viewId @param {string|null} runId @returns {Promise<{status: string, reason: string|null, materializedRevision?: number}>} */
+	function markQueued(viewId, runId) {
+		if (coordinatorDisabled()) {
+			markQueuedDirect(viewId, runId);
+			return Promise.resolve({ status: "applied", reason: "coordinator_disabled" });
+		}
+		// Fire-and-forget: legacy issued this write right after launch() without
+		// waiting on the runner, and the coordinator serializes arrival order the
+		// same way. N1 (Task 1): command.runId stays null — the new run's id rides
+		// in the payload and the decision branch pins currentRunId, so the generic
+		// stale-run guard cannot fire against the PREVIOUS run.
+		//
+		// source is "dashboard-user" on purpose (final-review F1): launching a run
+		// from these flows is ALWAYS user intent (reply / dispatch / attach), and
+		// the manual fence exists to protect the user's verdict from AUTOMATED late
+		// writes — a user-initiated re-launch IS the user changing the verdict, so
+		// mark_queued must lift the fence for the rest of the new run (otherwise a
+		// reply on a done row would execute invisibly while the row stays
+		// completed). Automated re-launch stays guarded upstream: the job-runner's
+		// post-exit follow-up claim refuses manually-completed rows
+		// (drainQueuedFollowUp: `if (isManualCompletion(readState(...))) return;`),
+		// and the service-side drain path delivers already-queued user follow-ups
+		// with no fence by design (prompt-not-lost, issue #70 — its live-host input
+		// path never fenced either).
+		// Fix round 2 (launch ordering): this promise is now AWAITED by launchForView
+		// / launchHost before they spawn — see the ordering notes there.
+		return sendLifecycleCommand({
+			type: "state_command",
+			viewId,
+			runId: null,
+			source: "dashboard-user",
+			kind: "mark_queued",
+			expectedRevision: null,
+			payload: { runId },
+		}).catch(() => ({ status: "rejected", reason: "connection_reset" }));
+	}
+
+	/** Legacy direct write for markVisited — coordinator_disabled escape hatch only. */
+	function markVisitedDirect(row) {
+		const state = readState(root, row.meta.id) ?? row.state ?? blankState(row.meta.id);
 		state.lastVisitedAt = Date.now();
 		state.updatedAt = Date.now();
 		writeState(root, state);
-		return { ok: true };
 	}
 
-	/** @param {string} viewId @returns {{ ok: boolean, error?: string }} */
-	function completeView(viewId) {
+	/**
+	 * @param {string} viewId
+	 * @returns {Promise<{ ok: boolean, error?: string }>}
+	 */
+	async function markVisited(viewId) {
 		const row = loadRow(root, viewId);
 		if (!row) return { ok: false, error: "Unknown session" };
-		if (isAgentBusy(row)) return { ok: false, error: "Wait for the active run to finish before marking done" };
-		const state = readState(root, viewId) ?? row.state ?? blankState(viewId);
+		if (coordinatorDisabled()) {
+			markVisitedDirect(row);
+			return { ok: true };
+		}
+		// dashboard-user (not "service"): visiting is a user action, and the
+		// manual fence must not stop visit-recency tracking on completed rows —
+		// legacy stamped lastVisitedAt unconditionally. Whitelist: lastVisitedAt only.
+		const result = await sendLifecycleCommand({
+			type: "state_command",
+			viewId,
+			source: "dashboard-user",
+			kind: "patch_fields",
+			expectedRevision: null,
+			payload: { state: { lastVisitedAt: Date.now() } },
+		}, viewId);
+		if (result.reason === "coordinator_disabled") markVisitedDirect(row);
+		// Visit tracking is best-effort metadata — never fail the UI action.
+		return { ok: true };
+	}
+
+	/** Legacy direct write for adoptSession — coordinator_disabled escape hatch only. */
+	function adoptStateDirect(viewId, state) {
+		const target = state ?? readState(root, viewId) ?? blankState(viewId);
+		target.semanticState = "idle";
+		target.processState = "exited";
+		target.needsInput = false;
+		target.hasError = false;
+		target.question = null;
+		target.pendingQuestions = [];
+		target.error = null;
+		target.summary = "Backgrounded session";
+		target.updatedAt = Date.now();
+		target.lastActivityAt = Date.now();
+		writeState(root, target);
+	}
+
+	/** Route the adopt-idle transition through the coordinator (fenced, journaled). */
+	async function adoptIdleState(viewId, state) {
+		const result = await sendLifecycleCommand({
+			type: "state_command",
+			viewId,
+			runId: null,
+			source: "dashboard-user",
+			kind: "adopt_session",
+			expectedRevision: null,
+			payload: {},
+		}, viewId);
+		if (result.reason === "coordinator_disabled") adoptStateDirect(viewId, state);
+	}
+
+	/** Legacy direct-write completion — only reachable when the coordinator is
+	 *  explicitly disabled (AGENT_BOARD_COORDINATOR=off tests/escape hatch). */
+	function completeViewDirect(state) {
 		state.semanticState = "completed";
 		state.processState = "exited";
 		state.needsInput = false;
@@ -414,21 +581,72 @@ export function createService(opts) {
 		// Also clear autoState in the run status so in-flight model passes
 		// (job-runner / state-runner) see the manual completion and skip refinement.
 		if (state.currentRunId) {
-			const status = readStatus(root, viewId, state.currentRunId);
+			const status = readStatus(root, state.viewId, state.currentRunId);
 			if (status) {
 				status.autoState = null;
 				writeStatus(root, status);
 			}
 		}
 		writeState(root, state);
-		return { ok: true };
+	}
+
+	/**
+	 * Explicitly mark an inactive session as done via the View State Coordinator
+	 * (issue #91): the command is journaled and materialized by the single owner,
+	 * which also rejects stale-run and fenced manual-completion overwrites.
+	 * @param {string} viewId
+	 * @returns {Promise<{ ok: boolean, error?: string }>}
+	 */
+	async function completeView(viewId) {
+		const row = loadRow(root, viewId);
+		if (!row) return { ok: false, error: "Unknown session" };
+		// Fast local pre-check for instant UI feedback; the coordinator's decision
+		// stays authoritative (its "busy" rejection maps to the same wording).
+		if (isAgentBusy(row)) return { ok: false, error: "Wait for the active run to finish before marking done" };
+		const state = readState(root, viewId) ?? row.state ?? blankState(viewId);
+		const result = await sendStateCommandImpl(root, {
+			type: "state_command",
+			viewId,
+			runId: state.currentRunId ?? null,
+			source: "dashboard-user",
+			kind: "mark_completed",
+			expectedRevision: null,
+			payload: {},
+		});
+		if (result.status === "applied") return { ok: true };
+		if (result.reason === "busy") return { ok: false, error: "Wait for the active run to finish before marking done" };
+		if (result.reason === "coordinator_disabled") {
+			completeViewDirect(state);
+			return { ok: true };
+		}
+		// Ambiguous outcomes (timeout / connection_reset: the command MAY already be
+		// journaled) and real rejections surface verbatim — never fall back to a
+		// direct write here, it would bypass the single-writer fence.
+		return { ok: false, error: result.reason ?? "state_command_failed" };
+	}
+
+	/** Legacy direct write for archiveView's busy-row stop — coordinator_disabled escape hatch only. */
+	function archiveStateDirect(row) {
+		const state = readState(root, row.meta.id) ?? row.state ?? blankState(row.meta.id);
+		state.semanticState = "stopped";
+		state.processState = "exited";
+		state.needsInput = false;
+		state.hasError = false;
+		state.question = null;
+		state.pendingQuestions = [];
+		state.error = null;
+		state.autoState = null;
+		state.summary = "Stopped";
+		state.lastActivityAt = Date.now();
+		state.updatedAt = Date.now();
+		writeState(root, state);
 	}
 
 	/**
 	 * @param {string} viewId
-	 * @returns {{ ok: boolean, error?: string }}
+	 * @returns {Promise<{ ok: boolean, error?: string }>}
 	 */
-	function archiveView(viewId) {
+	async function archiveView(viewId) {
 		const row = loadRow(root, viewId);
 		if (!row) return { ok: false, error: "Unknown session" };
 		if (row.host?.instanceId) stopHostRow(row, "archive");
@@ -438,20 +656,19 @@ export function createService(opts) {
 			if (pid) killProcess(pid);
 		}
 		if (isAgentBusy(row)) {
-			const state = readState(root, viewId) ?? row.state ?? blankState(viewId);
-			state.semanticState = "stopped";
-			state.processState = "exited";
-			state.needsInput = false;
-			state.hasError = false;
-			state.question = null;
-			state.pendingQuestions = [];
-			state.error = null;
-			state.autoState = null;
-			state.summary = "Stopped";
-			state.lastActivityAt = Date.now();
-			state.updatedAt = Date.now();
-			writeState(root, state);
+			// dashboard-user: archiving is a user action. Busy rows are allowed by
+			// the decision kind (archiving a working row stops it — legacy parity).
+			const result = await sendLifecycleCommand({
+				type: "state_command",
+				viewId,
+				source: "dashboard-user",
+				kind: "archive_view",
+				expectedRevision: null,
+				payload: {},
+			}, viewId);
+			if (result.reason === "coordinator_disabled") archiveStateDirect(row);
 		}
+		foregroundPreviewCache.forget(viewId);
 		row.meta.archived = true;
 		writeMeta(root, row.meta);
 		return { ok: true };
@@ -525,14 +742,34 @@ export function createService(opts) {
 	/**
 	 * @param {import("../core/store.mjs").Row} row
 	 * @param {import("../core/types.mjs").RunStatus} status
+	 * @returns {Promise<void>}
 	 */
-	function writeForegroundState(row, status) {
+	async function writeForegroundState(row, status) {
 		const projected = projectViewState(status, Date.now(), readState(root, row.meta.id) ?? row.state ?? null);
 		// Foreground turns are driven by the interactive Pi process, not a detached
 		// runner, so keep currentRunId null. This prevents reconcile()/stop() from
-		// treating a foreground turn as a managed background runner pid.
+		// treating a foreground turn as a managed background runner pid. (The
+		// decision kind force-nulls it too; the caller-side null keeps the
+		// coordinator_disabled direct write at legacy parity.)
 		projected.currentRunId = null;
-		writeState(root, projected);
+		// Issue #113: remember the freshest known foreground fields before the
+		// coordinator round trip — syncRowEvent rebuilds from disk on the next
+		// event and must not read an older projection than this one.
+		foregroundPreviewCache.remember(row.meta.id, projected);
+		if (coordinatorDisabled()) {
+			writeState(root, projected);
+			return;
+		}
+		const result = await sendLifecycleCommand({
+			type: "state_command",
+			viewId: row.meta.id,
+			runId: null,
+			source: "service",
+			kind: "sync_foreground",
+			expectedRevision: null,
+			payload: { projection: projected },
+		}, row.meta.id);
+		if (result.reason === "coordinator_disabled") writeState(root, projected);
 	}
 
 	/** @param {string} sessionFile */
@@ -1086,7 +1323,7 @@ export function createService(opts) {
 	 * async: the item is only completed on input_ack; any failure releases it
 	 * back to queued for a later retry (issue #70 A13).
 	 * @param {string} viewId
-	 * @returns {Promise<{ ok: boolean, error?: string, sent?: boolean, started?: boolean, pending?: boolean, item?: any }>}
+	 * @returns {Promise<{ ok: boolean, error?: string, sent?: boolean, started?: boolean, pending?: boolean, failed?: boolean, item?: any }>} (failed=true: §10 accepted_unknown — marked failed, never re-sent)
 	 */
 	async function drainNextFollowUp(viewId) {
 		const row = loadRow(root, viewId);
@@ -1116,13 +1353,27 @@ export function createService(opts) {
 					return { ok: true, pending: true, item };
 				}
 				const sent = socketPath
-					? await sendHostInput(socketPath, `${prompt}\r`, { requestId: item.id })
+					? await sendHostInput(socketPath, `${prompt}\r`, {
+						requestId: item.id,
+						commandId: item.id,
+						viewId,
+						instanceId: row.host.instanceId,
+					})
 					: { ok: false, error: "No host socket", retryable: true };
 				if (sent.ok) {
 					completeFollowUp(root, viewId, item.id);
 					appendDiagnostic(root, viewId, { source: "queue", code: "follow_up_sent", message: "Queued follow-up sent to live host", details: { kind: item.kind } });
 					return { ok: true, sent: true, item };
 				}
+				if (sent.ambiguous) {
+					// §10: the prompt was accepted by a host that restarted before
+					// delivering it — a re-send can only return cached stages, so the
+					// honest terminal state is failed-with-reason (mirrors the queue's
+					// existing failure marking; the item keeps its text for re-send).
+					failFollowUp(root, viewId, item.id, "accepted_unknown: accepted but never applied; outcome unknowable (§10); not re-sent");
+					appendDiagnostic(root, viewId, { source: "queue", level: "error", code: "follow_up_ambiguous", message: "Queued follow-up accepted_unknown after host restart — marked failed, not re-sent", details: { kind: item.kind, commandId: item.id } });
+					return { ok: true, failed: true, item };
+				}
 				releaseFollowUp(root, viewId, item.id);
 				appendDiagnostic(root, viewId, { source: "queue", level: "warn", code: "follow_up_send_failed", message: "Queued follow-up could not be delivered to the host", details: { kind: item.kind, error: sent.error ?? "unknown", retryable: sent.retryable !== false } });
 				return { ok: true, pending: true, item };
@@ -1135,7 +1386,7 @@ export function createService(opts) {
 			let hostMode = "pty";
 			if (!pty.ok) hostMode = "json-runner";
 			if (pty.ok) {
-				const launched = launchHost(row.meta, prompt);
+				const launched = await launchHost(row.meta, prompt);
 				if (launched.ok && launched.status !== "started") {
 					// An existing claim owns the view; the item stays queued and retries
 					// after that host becomes ready (issue #70 prompt-not-lost invariant).
@@ -1152,7 +1403,7 @@ export function createService(opts) {
 				return { ok: false, error: "PTY is required to drain adopted session follow-ups safely" };
 			}
 			if (hostMode === "json-runner") {
-				runId = launchForView(row.meta, prompt, runKindForFollowUp(item)).runId;
+				({ runId } = await launchForView(row.meta, prompt, runKindForFollowUp(item)));
 			}
 			completeFollowUp(root, viewId, item.id, { runId });
 			appendDiagnostic(root, viewId, { source: "queue", code: "follow_up_started", message: "Queued follow-up started", details: { kind: item.kind, hostMode } });
@@ -1164,10 +1415,22 @@ export function createService(opts) {
 		}
 	}
 
-	/** @param {import("../core/store.mjs").Row} row @param {any} event */
-	function syncRowEvent(row, event) {
+	/**
+	 * Mirror a foreground/hosted session event into the row state. Async since
+	 * issue #91: the terminal classification routes through the View State
+	 * Coordinator command socket (fire-and-forget callers are fine — the returned
+	 * promise resolves after the classification outcome is known).
+	 * @param {import("../core/store.mjs").Row} row @param {any} event
+	 * @returns {Promise<boolean>} whether a managed row was updated
+	 */
+	async function syncRowEvent(row, event) {
 		const now = Date.now();
 		const status = statusFromRow(row);
+		// Issue #113: the previous event's projection may still be in flight (the
+		// coordinator journals + fsyncs before materializing), so a disk rebuild
+		// can lag the freshest known preview/activity. Restore read-your-writes
+		// before any event branch touches the status.
+		foregroundPreviewCache.backfill(row.meta.id, status);
 		let evidence = readEvidence(root, row.meta.id);
 		if (!evidence.viewId) evidence = emptyEvidenceSnapshot({ viewId: row.meta.id, source: "hosted" });
 		try {
@@ -1187,26 +1450,55 @@ export function createService(opts) {
 			status.error = null;
 			status.summary = "Running…";
 			status.lastActivityAt = now;
-			writeForegroundState(row, status);
+			// Throughput path: periodic self-healing mirror, fire-and-forget.
+			void writeForegroundState(row, status);
 			return true;
 		}
 
 		if (event.type === "agent_end") {
+			// #46-class fence (issue #91): a manual completion is a user verdict that
+			// outlives the turn. A late/duplicate agent_end after markCompleted must
+			// not resurrect the row via finalizeRun + projection — skip all semantic
+			// writes (baseline, steering, classification) and keep evidence only.
+			// The fence read is repeated after the classification await below; the
+			// window between the two reads is covered by the coordinator's own
+			// manual_fence rejection plus the guarded tail write.
+			if (isManualCompletion(readState(root, row.meta.id))) {
+				status.evidenceSummary = summarizeEvidence(evidence);
+				writeEvidence(root, evidence);
+				return false;
+			}
 			finalizeRun(status, { exitCode: 0 }, now);
 			finalizeEvidence(evidence, status, now);
 			const steering = readSteering(root, row.meta.id);
+			let classificationQueued = false;
 			if (steering.status === "plan_requested" || steering.status === "changes_requested") {
 				recordPlanReady(root, row.meta.id, { planText: latestEvidenceText(evidence) || status.latestAssistantPreview || evidence.summary || "Plan ready", runId: status.runId });
 				status.semanticState = "needs_input";
 				status.question = "Approve this plan?";
 				status.summary = "Plan ready for approval";
-			} else if (queueAutoState(row.meta, status, evidence)) {
-				finalizeEvidence(evidence, status, now);
+			} else {
+				// Baseline the exited projection BEFORE the classification command:
+				// the coordinator's delegated auto-state rules key on processState,
+				// and its materialized patch lands after this write and wins. When
+				// the coordinator applies, the projection write below is skipped so
+				// the stale in-memory fields cannot clobber the patch (#46 class).
+				// The legacy coordinator_disabled path applies in-memory instead and
+				// still needs the tail projection write (pre-coordinator behavior).
+				// Awaited: this ordering IS the fence — the classification command
+				// must observe processState "exited" or its delegated rules skip.
+				await writeForegroundState(row, status);
+				classificationQueued = await queueAutoState(row.meta, status, evidence);
+				if (classificationQueued) finalizeEvidence(evidence, status, now);
 			}
 			status.evidenceSummary = summarizeEvidence(evidence);
 			writeEvidence(root, evidence);
 			updateCodeRefsFromEvidence(root, row.meta.id, evidence, row.meta);
-			writeForegroundState(row, status);
+			// Re-read the fence after the classification await: a completion landing
+			// between the baseline write and the coordinator's decision read gets
+			// manual_fence back (classificationQueued=false), and writing the stale
+			// in-memory projection here would clobber it (#46 class).
+			if (!isManualCompletion(readState(root, row.meta.id)) && !(classificationQueued && !coordinatorDisabled())) await writeForegroundState(row, status);
 			pruneWarmHosts({ keepViewId: row.meta.id });
 			// Async delivery (ack-gated, issue #70 A13): fire-and-forget here — the
 			// queue item's own state records the outcome, ordering is preserved by
@@ -1217,7 +1509,8 @@ export function createService(opts) {
 
 		if (reduceEvent(status, event, now, { interactive: true })) {
 			status.processState = "alive";
-			writeForegroundState(row, status);
+			// Throughput path: periodic self-healing mirror, fire-and-forget.
+			void writeForegroundState(row, status);
 			return true;
 		}
 		return false;
@@ -1237,9 +1530,9 @@ export function createService(opts) {
 		 *   model?: string|null,
 		 *   thinkingLevel?: "off"|"minimal"|"low"|"medium"|"high"|"xhigh"|"max"|null,
 		 * }} [dispatchOpts]
-		 * @returns {{ ok: boolean, viewId?: string, error?: string, hostMode?: "pty"|"json-runner", fallbackReason?: string }}
+		 * @returns {Promise<{ ok: boolean, viewId?: string, error?: string, hostMode?: "pty"|"json-runner", fallbackReason?: string }>}
 		 */
-		dispatch(text, dispatchOpts = {}) {
+		async dispatch(text, dispatchOpts = {}) {
 			const prompt = String(text || "").trim();
 			if (!prompt) return { ok: false, error: "Empty task" };
 
@@ -1271,7 +1564,7 @@ export function createService(opts) {
 			let fallbackReason;
 			let queued;
 			if (pty.ok) {
-				const launched = launchHost(meta, prompt);
+				const launched = await launchHost(meta, prompt);
 				if (launched.ok) {
 					hostMode = "pty";
 					if (launched.status !== "started") {
@@ -1283,11 +1576,11 @@ export function createService(opts) {
 					}
 				} else {
 					fallbackReason = launched.fallbackReason ?? launched.error;
-					launchForView(meta, prompt, "dispatch");
+					await launchForView(meta, prompt, "dispatch");
 				}
 			} else {
 				fallbackReason = nodePtyFallbackMessage(pty);
-				launchForView(meta, prompt, "dispatch");
+				await launchForView(meta, prompt, "dispatch");
 			}
 			queueGeneratedTitle(meta, prompt);
 			return {
@@ -1340,13 +1633,24 @@ export function createService(opts) {
 				}
 				const socketPath = row.host?.socketPath;
 				const sent = socketPath
-					? await sendHostInput(socketPath, `${prompt}\r`, { requestId: queued.item.id })
+					? await sendHostInput(socketPath, `${prompt}\r`, {
+						requestId: queued.item.id,
+						commandId: queued.item.id,
+						viewId,
+						instanceId: row.host.instanceId,
+					})
 					: { ok: false, error: "No host socket", retryable: true };
 				if (sent.ok) {
 					completeFollowUp(root, viewId, queued.item.id);
 					appendDiagnostic(root, viewId, { source: "queue", code: "follow_up_sent", message: "Queued follow-up sent to live host", details: { kind } });
 					return { ok: true, sent: true, item: queued.item };
 				}
+				if (sent.ambiguous) {
+					// §10: see drainNextFollowUp — never re-queue, never complete.
+					failFollowUp(root, viewId, queued.item.id, "accepted_unknown: accepted but never applied; outcome unknowable (§10); not re-sent");
+					appendDiagnostic(root, viewId, { source: "queue", level: "error", code: "follow_up_ambiguous", message: "Queued follow-up accepted_unknown after host restart — marked failed, not re-sent", details: { kind, commandId: queued.item.id } });
+					return { ok: true, failed: true, item: queued.item };
+				}
 				// Not an error: starting host, busy socket or lost ack — the drain
 				// loop retries once the host acks (issue #70 prompt-not-lost).
 				return { ok: true, queued: true, summary: queued.summary };
@@ -1356,7 +1660,7 @@ export function createService(opts) {
 			let hostMode = null;
 			let fallbackReason;
 			if (pty.ok) {
-				const launched = launchHost(row.meta, prompt);
+				const launched = await launchHost(row.meta, prompt);
 				if (launched.ok) {
 					if (launched.status !== "started") {
 						// The existing claim will consume the prompt later — keep it queued
@@ -1377,7 +1681,7 @@ export function createService(opts) {
 			}
 			if (!hostMode) {
 				if (isExternalSession(row.meta)) return { ok: false, error: "PTY is required to continue an adopted foreground session safely" };
-				launchForView(row.meta, prompt, runKindForKind(kind));
+				await launchForView(row.meta, prompt, runKindForKind(kind));
 				hostMode = "json-runner";
 			}
 			return { ok: true, hostMode, ...(hostMode === "json-runner" ? { fallbackReason } : {}) };
@@ -1475,7 +1779,7 @@ export function createService(opts) {
 			return { kind: "session", sessionFile: row.meta.sessionFile };
 		},
 
-		adoptSession(adoptOpts = {}) {
+		async adoptSession(adoptOpts = {}) {
 			const sessionFile = String(adoptOpts.sessionFile || "").trim();
 			if (!sessionFile) return { ok: false, error: "No session file to adopt" };
 			const existing = rowForSession(sessionFile);
@@ -1484,18 +1788,7 @@ export function createService(opts) {
 				if (adoptOpts.name) existing.meta.name = String(adoptOpts.name).trim() || existing.meta.name;
 				writeMeta(root, existing.meta);
 				if (!isAgentBusy(existing)) {
-					const state = readState(root, existing.meta.id) ?? existing.state ?? blankState(existing.meta.id);
-					state.semanticState = "idle";
-					state.processState = "exited";
-					state.needsInput = false;
-					state.hasError = false;
-					state.question = null;
-					state.pendingQuestions = [];
-					state.error = null;
-					state.summary = "Backgrounded session";
-					state.updatedAt = Date.now();
-					state.lastActivityAt = Date.now();
-					writeState(root, state);
+					await adoptIdleState(existing.meta.id, readState(root, existing.meta.id) ?? existing.state ?? blankState(existing.meta.id));
 				}
 				appendDiagnostic(root, existing.meta.id, { source: "service", code: "session_adopted", message: "Existing session adopted into Agent Board", details: { reused: true } });
 				return { ok: true, viewId: existing.meta.id, reused: true };
@@ -1517,12 +1810,7 @@ export function createService(opts) {
 				sessionFile,
 			});
 			const state = readState(root, id) ?? blankState(id);
-			state.semanticState = "idle";
-			state.processState = "exited";
-			state.summary = "Backgrounded session";
-			state.updatedAt = Date.now();
-			state.lastActivityAt = Date.now();
-			writeState(root, state);
+			await adoptIdleState(id, state);
 			appendDiagnostic(root, id, { source: "service", code: "session_adopted", message: "Current session adopted into Agent Board", details: { reused: false } });
 			return { ok: true, viewId: meta.id, reused: false };
 		},
@@ -1560,7 +1848,7 @@ export function createService(opts) {
 			return { ok: true };
 		},
 
-		/** @param {string} viewId @returns {{ ok: boolean, error?: string }} */
+		/** @param {string} viewId @returns {Promise<{ ok: boolean, error?: string }>} */
 		markVisited(viewId) {
 			return markVisited(viewId);
 		},
@@ -1569,7 +1857,7 @@ export function createService(opts) {
 		 * Explicitly mark an inactive session as done. Successful runs settle as
 		 * `idle` until the user reviews and confirms this action from the dashboard.
 		 * @param {string} viewId
-		 * @returns {{ ok: boolean, error?: string }}
+		 * @returns {Promise<{ ok: boolean, error?: string }>}
 		 */
 		markCompleted(viewId) {
 			return completeView(viewId);
@@ -1640,7 +1928,12 @@ export function createService(opts) {
 			return { state, summary: summarizeSteering(state) };
 		},
 
-		markCompletedMany(viewIds) {
+		/**
+		 * Bulk mark sessions done, skipping live/already-done rows.
+		 * @param {string[]} viewIds
+		 * @returns {Promise<{ ok: boolean, completed: number, skipped: number, completedIds: string[] }>}
+		 */
+		async markCompletedMany(viewIds) {
 			const ids = [...new Set((viewIds ?? []).filter(Boolean))];
 			let completed = 0;
 			let skipped = 0;
@@ -1651,7 +1944,7 @@ export function createService(opts) {
 					skipped += 1;
 					continue;
 				}
-				const res = completeView(viewId);
+				const res = await completeView(viewId);
 				if (res.ok) {
 					completed += 1;
 					completedIds.push(viewId);
@@ -1672,9 +1965,9 @@ export function createService(opts) {
 		/**
 		 * Bulk archive explicit row ids, skipping live/missing rows.
 		 * @param {string[]} viewIds
-		 * @returns {{ ok: boolean, archived: number, skipped: number }}
+		 * @returns {Promise<{ ok: boolean, archived: number, skipped: number }>}
 		 */
-		archiveMany(viewIds) {
+		async archiveMany(viewIds) {
 			const ids = [...new Set((viewIds ?? []).filter(Boolean))];
 			let archived = 0;
 			let skipped = 0;
@@ -1684,7 +1977,7 @@ export function createService(opts) {
 					skipped += 1;
 					continue;
 				}
-				const res = archiveView(viewId);
+				const res = await archiveView(viewId);
 				if (res.ok) archived += 1;
 				else skipped += 1;
 			}
@@ -1708,6 +2001,7 @@ export function createService(opts) {
 				}
 				if (row.host?.instanceId) stopHostRow(row, "archive");
 				else if (row.hostAlive) sendHostMessage(row, { type: "terminate" });
+				foregroundPreviewCache.forget(row.meta.id);
 				row.meta.archived = true;
 				writeMeta(root, row.meta);
 				archived += 1;
@@ -1719,9 +2013,9 @@ export function createService(opts) {
 		 * Recovery: reconcile rows whose runner died without finalizing (e.g. machine crash
 		 * or the runner was killed). If a terminal status exists, project it; otherwise mark
 		 * the row failed/stale. Safe to call on every dashboard open and on session_start.
-		 * @returns {number} number of rows reconciled.
+		 * @returns {Promise<number>} number of rows reconciled.
 		 */
-		reconcile() {
+		async reconcile() {
 			const now = Date.now();
 			let fixed = 0;
 			for (const row of listRows(root)) {
@@ -1734,34 +2028,131 @@ export function createService(opts) {
 					// its runner pid may legitimately be absent — never finalize it to failed yet.
 					if (row.host.state === "starting" && now - (row.host.claimAt ?? row.host.startedAt ?? 0) < HOST_START_GRACE_MS) continue;
 						const failed = row.host.state === "starting" || row.host.state === "alive" || row.host.state === "failed" || Boolean(row.host.error) || (row.host.exitCode !== null && row.host.exitCode !== 0);
-						s.semanticState = failed ? "failed" : "idle";
-						s.processState = "exited";
-						s.hasError = failed;
-						s.needsInput = false;
-						s.question = null;
-						s.pendingQuestions = [];
-						s.error = failed ? (s.error ?? row.host.error ?? "PTY host exited unexpectedly") : null;
-						s.summary = failed ? "Failed (PTY host exited)" : "Needs instructions";
-						s.updatedAt = now;
-						writeState(root, s);
+						// F6: failed verdicts must carry a reason (legacy guaranteed an
+						// error string). The row has no currentRunId here, so only the
+						// state half participates (no status.json to sync).
+						const result = await sendLifecycleCommand({
+							type: "state_command",
+							viewId: row.meta.id,
+							runId: null,
+							source: "service",
+							kind: "reconcile_finalize",
+							expectedRevision: null,
+							payload: {
+								semanticState: failed ? "failed" : "idle",
+								summary: failed ? "Failed (PTY host exited)" : "Needs instructions",
+								reason: failed ? (s.error ?? row.host.error ?? "PTY host exited unexpectedly") : null,
+							},
+						}, row.meta.id);
+						if (result.status !== "applied") {
+							if (result.reason === "coordinator_disabled") {
+								s.semanticState = failed ? "failed" : "idle";
+								s.processState = "exited";
+								s.hasError = failed;
+								s.needsInput = false;
+								s.question = null;
+								s.pendingQuestions = [];
+								s.error = failed ? (s.error ?? row.host.error ?? "PTY host exited unexpectedly") : null;
+								s.summary = failed ? "Failed (PTY host exited)" : "Needs instructions";
+								s.updatedAt = now;
+								writeState(root, s);
+							} else continue; // rejected/ambiguous: nothing mutated, not fixed
+						}
 						appendDiagnostic(root, row.meta.id, { source: "service", level: failed ? "error" : "info", code: "host_reconciled", message: failed ? "PTY host exited before final event" : "PTY host finalized without final event", details: { hostState: row.host.state, exitCode: row.host.exitCode } });
 						fixed += 1;
 					}
 					continue;
 				}
 				if (row.alive) continue;
-				const status = readStatus(root, row.meta.id, s.currentRunId);
+				let status = readStatus(root, row.meta.id, s.currentRunId);
+				if (statusRevisionDesynced(s, status)) {
+					// TOCTOU guard: `s` is a listRows snapshot, and earlier rows'
+					// awaited commands may have let the on-disk pair advance past
+					// it — re-read BOTH files fresh and act only on a pair that
+					// still disagrees. (The residual window between the two fresh
+					// reads is sub-ms under the coordinator's view-lock pairing
+					// invariant.)
+					const reread = rereadPair(root, row.meta.id, s.currentRunId);
+					if (reread.desynced) {
+						// Half-materialized pair (a coordinator crashed between its paired
+						// writes): don't combine the mismatched halves into one decision —
+						// record it and kick a coordinator so boot replay repairs the pair.
+						// The row is skipped this pass (not fixed); the next pass sees the
+						// repaired stamps and proceeds normally.
+						// Episode throttle: a stuck pair logs once, not once per 700ms
+						// reconcile pass — diagnostics must stay bounded for unrepairable
+						// pairs (torn transient beat has no journal record; coordinator off).
+						// Episode throttle gates the DIAGNOSTIC (a stuck pair logs once —
+						// CR r1); the repair KICK is retried independently while it keeps
+						// failing (CR r2 issue-4): a transient ensureCoordinator failure
+						// (spawn window exhausted) must not consume the recovery path —
+						// an idle dashboard would otherwise never run boot replay. A
+						// successful kick stops the retries: the coordinator is up, boot
+						// replay already repaired a repairable pair, and an
+						// unrepairable-torn pair gains nothing from re-kicking.
+						// (shouldLog records the episode — evaluate it exactly once.)
+						const logEpisode = desyncThrottle.shouldLog(row.meta.id, reread.state.materializedRevision, reread.status.materializedRevision);
+						if (logEpisode) {
+							appendDiagnostic(root, row.meta.id, { source: "service", level: "warn", code: "state_status_revision_desync", message: "state.json and status.json revisions disagree; skipping reconcile projection and requesting coordinator repair", details: { stateRevision: reread.state.materializedRevision, statusRevision: reread.status.materializedRevision, runId: s.currentRunId } });
+						}
+						if (logEpisode || desyncThrottle.shouldRetryKick(row.meta.id)) {
+							void ensureCoordinatorImpl(root).then((res) => {
+								if (res?.ok) desyncThrottle.clearKickFailed(row.meta.id);
+								else desyncThrottle.markKickFailed(row.meta.id);
+							}).catch(() => desyncThrottle.markKickFailed(row.meta.id));
+						}
+						continue;
+					}
+					// Snapshot was stale but the fresh pair agrees — project from it.
+					status = reread.status;
+				}
 				if (status?.endedAt) {
-					writeState(root, projectViewState(status, now, readState(root, row.meta.id) ?? row.state ?? null));
+					// The run's terminal status exists but the row was never materialized
+					// from it (crash between the two writes, or a pre-coordinator row).
+					// Project mode lets the status's own verdict govern (completed rows
+					// must not be forced to failed/idle).
+					const result = await sendLifecycleCommand({
+						type: "state_command",
+						viewId: row.meta.id,
+						runId: s.currentRunId,
+						source: "service",
+						kind: "reconcile_finalize",
+						expectedRevision: null,
+						payload: { project: true },
+					}, row.meta.id);
+					if (result.status !== "applied" && result.reason !== "coordinator_disabled") {
+						// Fix round 2 (F5 leftover): a rejected/ambiguous project-mode
+						// row (manual fence, no_change, stale_run, timeout) mutated
+						// nothing — it must not count toward the fixed tally.
+						continue;
+					}
+					if (result.reason === "coordinator_disabled") writeState(root, projectViewState(status, now, readState(root, row.meta.id) ?? row.state ?? null));
 				} else {
-					s.semanticState = "failed";
-					s.processState = "exited";
-					s.hasError = true;
-					s.needsInput = false;
-					s.error = s.error ?? "Runner exited unexpectedly";
-					s.summary = "Failed (runner exited)";
-					s.updatedAt = now;
-					writeState(root, s);
+					const result = await sendLifecycleCommand({
+						type: "state_command",
+						viewId: row.meta.id,
+						runId: s.currentRunId,
+						source: "service",
+						kind: "reconcile_finalize",
+						expectedRevision: null,
+						payload: {
+							semanticState: "failed",
+							summary: "Failed (runner exited)",
+							reason: s.error ?? "Runner exited unexpectedly",
+						},
+					}, row.meta.id);
+					if (result.status !== "applied") {
+						if (result.reason === "coordinator_disabled") {
+							s.semanticState = "failed";
+							s.processState = "exited";
+							s.hasError = true;
+							s.needsInput = false;
+							s.error = s.error ?? "Runner exited unexpectedly";
+							s.summary = "Failed (runner exited)";
+							s.updatedAt = now;
+							writeState(root, s);
+						} else continue;
+					}
 				}
 				fixed += 1;
 			}
@@ -1782,20 +2173,20 @@ export function createService(opts) {
 		 * looking stale after the user types a follow-up in the real Pi session.
 		 * @param {string|undefined} sessionFile
 		 * @param {any} event
-		 * @returns {boolean} whether a managed row was updated
+		 * @returns {Promise<boolean>} whether a managed row was updated
 		 */
 		syncForegroundEvent(sessionFile, event) {
-			if (!sessionFile || !event?.type) return false;
+			if (!sessionFile || !event?.type) return Promise.resolve(false);
 			const row = rowForSession(sessionFile);
-			if (!row) return false;
+			if (!row) return Promise.resolve(false);
 			return syncRowEvent(row, event);
 		},
 
 		/** @param {string|undefined} viewId @param {any} event */
 		syncHostedEvent(viewId, event) {
-			if (!viewId || !event?.type) return false;
+			if (!viewId || !event?.type) return Promise.resolve(false);
 			const row = loadRow(root, viewId);
-			if (!row) return false;
+			if (!row) return Promise.resolve(false);
 			return syncRowEvent(row, event);
 		},
 
@@ -2040,11 +2431,184 @@ function sendHostMessage(row, message) {
 }
 
 /**
- * Default window service waits for the runner's input_ack before treating a
- * host input as undelivered (issue #70 A13).
+ * Default window service waits for the runner's input_ack (or, on the staged
+ * path, `cmd_ack applied`) before treating a host input as undelivered
+ * (issue #70 A13; phase 5 D4).
  */
 const HOST_INPUT_ACK_TIMEOUT_MS = 2_000;
 
+/**
+ * Reconcile-query one commandId against a host control socket (§10 discipline:
+ * a timeout must be resolved by query, never by a blind retry).
+ * @returns {Promise<"accepted_unknown"|"reconciled_clean"|"unavailable">}
+ */
+function reconcileQueryCommand(socketPath, commandId, opts = {}) {
+	const { viewId, instanceId, clientId = "service", connect = createConnection, timeoutMs = HOST_INPUT_ACK_TIMEOUT_MS } = opts;
+	return new Promise((resolve) => {
+		let settled = false;
+		let buffer = "";
+		/** @type {import("node:net").Socket|null} */
+		let socket = null;
+		const finish = (verdict) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			try { socket?.destroy(); } catch { /* best effort */ }
+			resolve(verdict);
+		};
+		const timer = setTimeout(() => finish("unavailable"), timeoutMs);
+		timer.unref?.();
+		try {
+			socket = connect(socketPath);
+		} catch {
+			finish("unavailable");
+			return;
+		}
+		socket.on("connect", () => {
+			try {
+				socket.write(JSON.stringify({ type: "reconcile", commandId: `reconcile-${commandId}`, clientId, seq: 1, viewId, instanceId }) + "\n");
+			} catch {
+				finish("unavailable");
+			}
+		});
+		socket.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				if (!line.trim()) continue;
+				let msg;
+				try { msg = JSON.parse(line); } catch { continue; }
+				if (msg?.type !== "reconcile_result") continue;
+				const unresolved = Array.isArray(msg.unresolved) ? msg.unresolved : [];
+				finish(unresolved.some((u) => u?.commandId === commandId) ? "accepted_unknown" : "reconciled_clean");
+				return;
+			}
+		});
+		socket.on("error", () => finish("unavailable"));
+		socket.on("close", () => finish("unavailable"));
+	});
+}
+
+/**
+ * Staged durable-input delivery (phase 5 D4): enveloped `{durable:true}` input
+ * expecting `cmd_ack accepted → applied` against a generation-capable runner,
+ * with the §10 reconcile-query on timeout. Runners whose hello lacks a
+ * `generation` token predate the control lifecycle: the SAME connection falls
+ * back to the legacy requestId/input_ack contract (byte-identical bytes), so
+ * phase-4 owned hosts (instanceId known, envelope-ignorant) keep their dedup
+ * instead of double-writing.
+ *
+ * Result shapes (never rejects):
+ * - `{ok:true, applied:true}` — the runner wrote the child.
+ * - `{ok:false, ambiguous:true, error:"accepted_unknown", retryable:false}` —
+ *   accepted but never applied (restart/write-failure window); the caller must
+ *   NOT re-send (§10) and must NOT treat the prompt as delivered.
+ * - `{ok:false, error, retryable}` — everything else (starting window, dead
+ *   socket, legacy timeout); re-send is safe (journal dedup or requestId dedup).
+ * @param {string} socketPath
+ * @param {string} text
+ * @param {{ requestId?: string|null, commandId?: string|null, viewId?: string, instanceId?: string|null, clientId?: string, timeoutMs?: number, connect?: (path: string) => import("node:net").Socket }} [opts]
+ */
+function sendHostInputStaged(socketPath, text, opts = {}) {
+	const commandId = opts.commandId ?? opts.requestId;
+	const clientId = opts.clientId ?? "service";
+	const timeoutMs = opts.timeoutMs ?? HOST_INPUT_ACK_TIMEOUT_MS;
+	const connect = opts.connect ?? createConnection;
+	const { viewId, instanceId } = opts;
+	return new Promise((resolve) => {
+		let settled = false;
+		let buffer = "";
+		let helloSeen = false;
+		let sawAccepted = false;
+		/** @type {import("node:net").Socket|null} */
+		let socket = null;
+		const finish = (result) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			try { socket?.destroy(); } catch { /* best effort */ }
+			resolve(result);
+		};
+		/** §10: resolve the deadline by query, never by a blind retry. */
+		const resolveByReconcile = (fallbackError) => {
+			if (settled) return;
+			reconcileQueryCommand(socketPath, commandId, { viewId, instanceId, clientId, connect, timeoutMs }).then((verdict) => {
+				if (verdict === "accepted_unknown") finish({ ok: false, ambiguous: true, error: "accepted_unknown", retryable: false });
+				else if (verdict === "reconciled_clean") finish({ ok: false, error: fallbackError, retryable: true });
+				else finish({ ok: false, error: fallbackError, retryable: true });
+			});
+		};
+		const timer = setTimeout(() => resolveByReconcile("timeout"), timeoutMs);
+		timer.unref?.();
+		try {
+			socket = connect(socketPath);
+		} catch (err) {
+			finish({ ok: false, error: err instanceof Error ? err.message : String(err), retryable: true });
+			return;
+		}
+		socket.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				if (!line.trim()) continue;
+				let msg;
+				try { msg = JSON.parse(line); } catch { continue; }
+				if (!helloSeen) {
+					if (msg?.type !== "hello") continue; // wait for the capability answer
+					helloSeen = true;
+					try {
+						if (typeof msg.generation === "string" && msg.generation) {
+							socket.write(JSON.stringify({ type: "input", durable: true, commandId, clientId, seq: 1, viewId, instanceId, data: text }) + "\n");
+						} else {
+							// Pre-lifecycle runner: legacy requestId contract, same bytes.
+							socket.write(JSON.stringify({ type: "input", requestId: commandId, data: text }) + "\n");
+						}
+					} catch (err) {
+						finish({ ok: false, error: err instanceof Error ? err.message : String(err), retryable: true });
+					}
+					continue;
+				}
+				if (msg?.type === "cmd_ack" && msg.commandId === commandId) {
+					if (msg.stage === "applied") finish({ ok: true, applied: true });
+					if (msg.stage === "accepted") {
+						sawAccepted = true;
+						// accepted → applied is synchronous runner-side (Task 2 ruling 4);
+						// a dropped socket between them is resolved by the deadline's query.
+					}
+					continue;
+				}
+				if (msg?.type === "input_ack" && msg.requestId === commandId) {
+					// Legacy fallback answer on this same connection.
+					finish({ ok: true });
+					return;
+				}
+				if (msg?.type === "error") {
+					const code = msg.code ?? msg.message ?? "host_error";
+					if (code === "command_failed") {
+						// Taxonomy: reconcile by commandId before any retry decision.
+						resolveByReconcile(code);
+						return;
+					}
+					finish({ ok: false, error: code, retryable: code !== "envelope_invalid" });
+					return;
+				}
+				// hello/status/output lines are ignored — keep waiting.
+			}
+		});
+		socket.on("error", (err) => {
+			const code = /** @type {NodeJS.ErrnoException} */ (err).code;
+			finish({ ok: false, error: code ?? (err instanceof Error ? err.message : String(err)), retryable: true });
+		});
+		socket.on("close", () => {
+			// A close after an accepted ack is the §10 window — resolve by query.
+			if (sawAccepted) resolveByReconcile("socket_closed");
+			else finish({ ok: false, error: "socket_closed", retryable: true });
+		});
+	});
+}
+
 /**
  * Send one input line to a host control socket and wait for the runner's
  * input_ack (issue #70 A13). Fire-and-forget "connected" no longer counts as
@@ -2067,6 +2631,15 @@ const HOST_INPUT_ACK_TIMEOUT_MS = 2_000;
  * @returns {Promise<{ ok: boolean, error?: string, retryable?: boolean }>}
  */
 export function sendHostInput(socketPath, text, opts = {}) {
+	// Staged durable path (phase 5 D4): the caller knows the host fence
+	// (viewId + instanceId) and a stable commandId — envelope it and expect
+	// accepted → applied with the §10 reconcile-query on timeout. Runners whose
+	// hello lacks a generation fall back to the legacy requestId contract on
+	// the same connection, so the legacy branch below stays for callers that
+	// have no fence (pre-instanceId hosts).
+	if (opts.viewId && opts.instanceId != null && (opts.commandId || opts.requestId)) {
+		return sendHostInputStaged(socketPath, text, opts);
+	}
 	const requestId = opts.requestId ?? null;
 	const timeoutMs = opts.timeoutMs ?? HOST_INPUT_ACK_TIMEOUT_MS;
 	const connect = opts.connect ?? createConnection;