@zhuxixi/pi-agent-board 0.7.0 → 0.8.0

package/src/runtime/service.mjs

@@ -15,7 +15,8 @@ import { finalizeRun, projectViewState, reduceEvent } from "../core/events.mjs";
 import { clearDiagnostics, appendDiagnostic, tailDiagnostics } from "../core/diagnostics.mjs";
 import { emptyEvidenceSnapshot, finalizeEvidence, readEvidence, reduceEvidence, summarizeEvidence, writeEvidence } from "../core/evidence.mjs";
 import { updateCodeRefsFromEvidence } from "../core/code-refs-store.mjs";
-import { claimNextFollowUp, completeFollowUp, enqueueFollowUp, readFollowUpQueue, releaseFollowUp, summarizeFollowUpQueue, clearQueuedFollowUps, removeLastFollowUp } from "../core/follow-up-queue.mjs";
+import { claimNextFollowUp, completeFollowUp, enqueueFollowUp, failFollowUp, readFollowUpQueue, releaseFollowUp, summarizeFollowUpQueue, clearQueuedFollowUps, removeLastFollowUp } from "../core/follow-up-queue.mjs";
+import { foregroundPreviewCache } from "../core/foreground-preview-cache.mjs";
 import { approvePlan as approvePlanState, markExecutingApprovedPlan, readSteering, recordPlanReady, requestPlan as requestPlanState, requestPlanChanges as requestPlanChangesState, summarizeSteering } from "../core/steering.mjs";
 import { buildApprovePlanPrompt, buildPlanChangesPrompt, buildPlanRequestPrompt } from "../core/steering-prompts.mjs";
 import { isGenericStatusText } from "../core/derive.mjs";
@@ -27,7 +28,9 @@ import { isAlive, killProcess } from "../core/pid.mjs";
 import { acquireOwnedViewLock, tryAcquireOwnedViewLock } from "../core/locks.mjs";
 import { canFinalizeLegacyHost, canReplaceHost } from "../core/host-coordination.mjs";
 import { modelRefAvailable } from "../core/launch-options.mjs";
-import { sendStateCommand, coordinatorDisabled } from "../core/coordinator-client.mjs";
+import { ensureCoordinator, sendStateCommand, coordinatorDisabled } from "../core/coordinator-client.mjs";
+import { createDesyncEpisodeThrottle, rereadPair, statusRevisionDesynced } from "../core/status-consistency.mjs";
+import { commandRejectDiagnostic } from "../core/state-commands.mjs";
 import { HOST_PROBE_RETRY_MS, probeHost } from "../core/host-probe.mjs";
 import * as P from "../core/paths.mjs";
 import {
@@ -107,6 +110,10 @@ export function createService(opts) {
 	const acquireLockImpl = opts.acquireLock ?? acquireOwnedViewLock;
 	const tryAcquireLockImpl = opts.tryAcquireLock ?? tryAcquireOwnedViewLock;
 	const sendStateCommandImpl = opts.sendStateCommand ?? sendStateCommand;
+	const ensureCoordinatorImpl = opts.ensureCoordinator ?? ensureCoordinator;
+	// Desync episode throttle: a stuck (stateRev:statusRev) pair logs once per
+	// service, not once per reconcile pass — see createDesyncEpisodeThrottle().
+	const desyncThrottle = createDesyncEpisodeThrottle();
 	// Identity-aware observation/signalling for host recovery (issue #70). Callers must
 	// only signal after observeProcess returned "owned" for that exact identity.
 	const observeProcessImpl = opts.observeProcess ?? defaultObserveProcess;
@@ -147,7 +154,9 @@ export function createService(opts) {
 	 * @param {import("../core/types.mjs").ViewMeta} meta
 	 * @param {string} prompt
 	 * @param {RunKind} kind
-	 * @returns {{ runId: string, pid: number|null }}
+	 * @returns {Promise<{ runId: string, pid: number|null }>} resolves after
+	 *   mark_queued has landed and the detached runner is spawned (ordering
+	 *   contract: the row must be queued before the runner can boot, final-review F2).
 	 */
 	async function launchForView(meta, prompt, kind) {
 		const runId = newRunId();
@@ -244,7 +253,7 @@ export function createService(opts) {
 	 * lease; this function never acquires or releases it.
 	 * @param {import("../core/types.mjs").ViewMeta} meta
 	 * @param {string|null} initialPrompt
-	 * @returns {ReturnType<typeof launchHost>}
+	 * @returns {{ ok: true, status: "reused"|"pending"|"started", pid: number|null, socketPath: string|null, instanceId: string|null } | { ok: false, error: string, fallbackReason?: string }}
 	 */
 	function startHostUnderLease(meta, initialPrompt, launchOpts = {}) {
 		const existing = readHost(root, meta.id);
@@ -409,11 +418,11 @@ export function createService(opts) {
 		if (result.reason === "coordinator_disabled") {
 			return applyAutoStateToStatus(status, classification, Date.now());
 		}
-		if (result.reason === "manual_fence" || result.reason === "no_change" || result.reason === "stale_run") {
-			// Designed fences — informational, not errors.
-			return false;
-		}
-		appendDiagnostic(root, meta.id, { source: "service", runId: commandRunId, level: "warn", code: "auto_state_command_ambiguous", message: `Auto-state classification outcome unknown (${result.reason}); if the command was journaled, coordinator replay will recover it; otherwise the next classification pass will converge the row`, details: { reason: result.reason } });
+		// Unified decided/ambiguous classification (CR r2 issue-3): decided
+		// rejects (manual_fence/stale_run/…) log as info *_skipped — the
+		// coordinator's verdict is authoritative; only genuinely ambiguous
+		// outcomes (timeout/connection_reset) keep the recovery-path warn.
+		appendDiagnostic(root, meta.id, { source: "service", runId: commandRunId, ...commandRejectDiagnostic("auto_state", "Auto-state classification", result.reason, "otherwise the next classification pass will converge the row"), details: { reason: result.reason } });
 		return false;
 	}
 
@@ -659,6 +668,7 @@ export function createService(opts) {
 			}, viewId);
 			if (result.reason === "coordinator_disabled") archiveStateDirect(row);
 		}
+		foregroundPreviewCache.forget(viewId);
 		row.meta.archived = true;
 		writeMeta(root, row.meta);
 		return { ok: true };
@@ -742,6 +752,10 @@ export function createService(opts) {
 		// decision kind force-nulls it too; the caller-side null keeps the
 		// coordinator_disabled direct write at legacy parity.)
 		projected.currentRunId = null;
+		// Issue #113: remember the freshest known foreground fields before the
+		// coordinator round trip — syncRowEvent rebuilds from disk on the next
+		// event and must not read an older projection than this one.
+		foregroundPreviewCache.remember(row.meta.id, projected);
 		if (coordinatorDisabled()) {
 			writeState(root, projected);
 			return;
@@ -1309,7 +1323,7 @@ export function createService(opts) {
 	 * async: the item is only completed on input_ack; any failure releases it
 	 * back to queued for a later retry (issue #70 A13).
 	 * @param {string} viewId
-	 * @returns {Promise<{ ok: boolean, error?: string, sent?: boolean, started?: boolean, pending?: boolean, item?: any }>}
+	 * @returns {Promise<{ ok: boolean, error?: string, sent?: boolean, started?: boolean, pending?: boolean, failed?: boolean, item?: any }>} (failed=true: §10 accepted_unknown — marked failed, never re-sent)
 	 */
 	async function drainNextFollowUp(viewId) {
 		const row = loadRow(root, viewId);
@@ -1339,13 +1353,27 @@ export function createService(opts) {
 					return { ok: true, pending: true, item };
 				}
 				const sent = socketPath
-					? await sendHostInput(socketPath, `${prompt}\r`, { requestId: item.id })
+					? await sendHostInput(socketPath, `${prompt}\r`, {
+						requestId: item.id,
+						commandId: item.id,
+						viewId,
+						instanceId: row.host.instanceId,
+					})
 					: { ok: false, error: "No host socket", retryable: true };
 				if (sent.ok) {
 					completeFollowUp(root, viewId, item.id);
 					appendDiagnostic(root, viewId, { source: "queue", code: "follow_up_sent", message: "Queued follow-up sent to live host", details: { kind: item.kind } });
 					return { ok: true, sent: true, item };
 				}
+				if (sent.ambiguous) {
+					// §10: the prompt was accepted by a host that restarted before
+					// delivering it — a re-send can only return cached stages, so the
+					// honest terminal state is failed-with-reason (mirrors the queue's
+					// existing failure marking; the item keeps its text for re-send).
+					failFollowUp(root, viewId, item.id, "accepted_unknown: accepted but never applied; outcome unknowable (§10); not re-sent");
+					appendDiagnostic(root, viewId, { source: "queue", level: "error", code: "follow_up_ambiguous", message: "Queued follow-up accepted_unknown after host restart — marked failed, not re-sent", details: { kind: item.kind, commandId: item.id } });
+					return { ok: true, failed: true, item };
+				}
 				releaseFollowUp(root, viewId, item.id);
 				appendDiagnostic(root, viewId, { source: "queue", level: "warn", code: "follow_up_send_failed", message: "Queued follow-up could not be delivered to the host", details: { kind: item.kind, error: sent.error ?? "unknown", retryable: sent.retryable !== false } });
 				return { ok: true, pending: true, item };
@@ -1398,6 +1426,11 @@ export function createService(opts) {
 	async function syncRowEvent(row, event) {
 		const now = Date.now();
 		const status = statusFromRow(row);
+		// Issue #113: the previous event's projection may still be in flight (the
+		// coordinator journals + fsyncs before materializing), so a disk rebuild
+		// can lag the freshest known preview/activity. Restore read-your-writes
+		// before any event branch touches the status.
+		foregroundPreviewCache.backfill(row.meta.id, status);
 		let evidence = readEvidence(root, row.meta.id);
 		if (!evidence.viewId) evidence = emptyEvidenceSnapshot({ viewId: row.meta.id, source: "hosted" });
 		try {
@@ -1600,13 +1633,24 @@ export function createService(opts) {
 				}
 				const socketPath = row.host?.socketPath;
 				const sent = socketPath
-					? await sendHostInput(socketPath, `${prompt}\r`, { requestId: queued.item.id })
+					? await sendHostInput(socketPath, `${prompt}\r`, {
+						requestId: queued.item.id,
+						commandId: queued.item.id,
+						viewId,
+						instanceId: row.host.instanceId,
+					})
 					: { ok: false, error: "No host socket", retryable: true };
 				if (sent.ok) {
 					completeFollowUp(root, viewId, queued.item.id);
 					appendDiagnostic(root, viewId, { source: "queue", code: "follow_up_sent", message: "Queued follow-up sent to live host", details: { kind } });
 					return { ok: true, sent: true, item: queued.item };
 				}
+				if (sent.ambiguous) {
+					// §10: see drainNextFollowUp — never re-queue, never complete.
+					failFollowUp(root, viewId, queued.item.id, "accepted_unknown: accepted but never applied; outcome unknowable (§10); not re-sent");
+					appendDiagnostic(root, viewId, { source: "queue", level: "error", code: "follow_up_ambiguous", message: "Queued follow-up accepted_unknown after host restart — marked failed, not re-sent", details: { kind, commandId: queued.item.id } });
+					return { ok: true, failed: true, item: queued.item };
+				}
 				// Not an error: starting host, busy socket or lost ack — the drain
 				// loop retries once the host acks (issue #70 prompt-not-lost).
 				return { ok: true, queued: true, summary: queued.summary };
@@ -1804,7 +1848,7 @@ export function createService(opts) {
 			return { ok: true };
 		},
 
-		/** @param {string} viewId @returns {{ ok: boolean, error?: string }} */
+		/** @param {string} viewId @returns {Promise<{ ok: boolean, error?: string }>} */
 		markVisited(viewId) {
 			return markVisited(viewId);
 		},
@@ -1957,6 +2001,7 @@ export function createService(opts) {
 				}
 				if (row.host?.instanceId) stopHostRow(row, "archive");
 				else if (row.hostAlive) sendHostMessage(row, { type: "terminate" });
+				foregroundPreviewCache.forget(row.meta.id);
 				row.meta.archived = true;
 				writeMeta(root, row.meta);
 				archived += 1;
@@ -2019,7 +2064,48 @@ export function createService(opts) {
 					continue;
 				}
 				if (row.alive) continue;
-				const status = readStatus(root, row.meta.id, s.currentRunId);
+				let status = readStatus(root, row.meta.id, s.currentRunId);
+				if (statusRevisionDesynced(s, status)) {
+					// TOCTOU guard: `s` is a listRows snapshot, and earlier rows'
+					// awaited commands may have let the on-disk pair advance past
+					// it — re-read BOTH files fresh and act only on a pair that
+					// still disagrees. (The residual window between the two fresh
+					// reads is sub-ms under the coordinator's view-lock pairing
+					// invariant.)
+					const reread = rereadPair(root, row.meta.id, s.currentRunId);
+					if (reread.desynced) {
+						// Half-materialized pair (a coordinator crashed between its paired
+						// writes): don't combine the mismatched halves into one decision —
+						// record it and kick a coordinator so boot replay repairs the pair.
+						// The row is skipped this pass (not fixed); the next pass sees the
+						// repaired stamps and proceeds normally.
+						// Episode throttle: a stuck pair logs once, not once per 700ms
+						// reconcile pass — diagnostics must stay bounded for unrepairable
+						// pairs (torn transient beat has no journal record; coordinator off).
+						// Episode throttle gates the DIAGNOSTIC (a stuck pair logs once —
+						// CR r1); the repair KICK is retried independently while it keeps
+						// failing (CR r2 issue-4): a transient ensureCoordinator failure
+						// (spawn window exhausted) must not consume the recovery path —
+						// an idle dashboard would otherwise never run boot replay. A
+						// successful kick stops the retries: the coordinator is up, boot
+						// replay already repaired a repairable pair, and an
+						// unrepairable-torn pair gains nothing from re-kicking.
+						// (shouldLog records the episode — evaluate it exactly once.)
+						const logEpisode = desyncThrottle.shouldLog(row.meta.id, reread.state.materializedRevision, reread.status.materializedRevision);
+						if (logEpisode) {
+							appendDiagnostic(root, row.meta.id, { source: "service", level: "warn", code: "state_status_revision_desync", message: "state.json and status.json revisions disagree; skipping reconcile projection and requesting coordinator repair", details: { stateRevision: reread.state.materializedRevision, statusRevision: reread.status.materializedRevision, runId: s.currentRunId } });
+						}
+						if (logEpisode || desyncThrottle.shouldRetryKick(row.meta.id)) {
+							void ensureCoordinatorImpl(root).then((res) => {
+								if (res?.ok) desyncThrottle.clearKickFailed(row.meta.id);
+								else desyncThrottle.markKickFailed(row.meta.id);
+							}).catch(() => desyncThrottle.markKickFailed(row.meta.id));
+						}
+						continue;
+					}
+					// Snapshot was stale but the fresh pair agrees — project from it.
+					status = reread.status;
+				}
 				if (status?.endedAt) {
 					// The run's terminal status exists but the row was never materialized
 					// from it (crash between the two writes, or a pre-coordinator row).
@@ -2345,11 +2431,184 @@ function sendHostMessage(row, message) {
 }
 
 /**
- * Default window service waits for the runner's input_ack before treating a
- * host input as undelivered (issue #70 A13).
+ * Default window service waits for the runner's input_ack (or, on the staged
+ * path, `cmd_ack applied`) before treating a host input as undelivered
+ * (issue #70 A13; phase 5 D4).
  */
 const HOST_INPUT_ACK_TIMEOUT_MS = 2_000;
 
+/**
+ * Reconcile-query one commandId against a host control socket (§10 discipline:
+ * a timeout must be resolved by query, never by a blind retry).
+ * @returns {Promise<"accepted_unknown"|"reconciled_clean"|"unavailable">}
+ */
+function reconcileQueryCommand(socketPath, commandId, opts = {}) {
+	const { viewId, instanceId, clientId = "service", connect = createConnection, timeoutMs = HOST_INPUT_ACK_TIMEOUT_MS } = opts;
+	return new Promise((resolve) => {
+		let settled = false;
+		let buffer = "";
+		/** @type {import("node:net").Socket|null} */
+		let socket = null;
+		const finish = (verdict) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			try { socket?.destroy(); } catch { /* best effort */ }
+			resolve(verdict);
+		};
+		const timer = setTimeout(() => finish("unavailable"), timeoutMs);
+		timer.unref?.();
+		try {
+			socket = connect(socketPath);
+		} catch {
+			finish("unavailable");
+			return;
+		}
+		socket.on("connect", () => {
+			try {
+				socket.write(JSON.stringify({ type: "reconcile", commandId: `reconcile-${commandId}`, clientId, seq: 1, viewId, instanceId }) + "\n");
+			} catch {
+				finish("unavailable");
+			}
+		});
+		socket.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				if (!line.trim()) continue;
+				let msg;
+				try { msg = JSON.parse(line); } catch { continue; }
+				if (msg?.type !== "reconcile_result") continue;
+				const unresolved = Array.isArray(msg.unresolved) ? msg.unresolved : [];
+				finish(unresolved.some((u) => u?.commandId === commandId) ? "accepted_unknown" : "reconciled_clean");
+				return;
+			}
+		});
+		socket.on("error", () => finish("unavailable"));
+		socket.on("close", () => finish("unavailable"));
+	});
+}
+
+/**
+ * Staged durable-input delivery (phase 5 D4): enveloped `{durable:true}` input
+ * expecting `cmd_ack accepted → applied` against a generation-capable runner,
+ * with the §10 reconcile-query on timeout. Runners whose hello lacks a
+ * `generation` token predate the control lifecycle: the SAME connection falls
+ * back to the legacy requestId/input_ack contract (byte-identical bytes), so
+ * phase-4 owned hosts (instanceId known, envelope-ignorant) keep their dedup
+ * instead of double-writing.
+ *
+ * Result shapes (never rejects):
+ * - `{ok:true, applied:true}` — the runner wrote the child.
+ * - `{ok:false, ambiguous:true, error:"accepted_unknown", retryable:false}` —
+ *   accepted but never applied (restart/write-failure window); the caller must
+ *   NOT re-send (§10) and must NOT treat the prompt as delivered.
+ * - `{ok:false, error, retryable}` — everything else (starting window, dead
+ *   socket, legacy timeout); re-send is safe (journal dedup or requestId dedup).
+ * @param {string} socketPath
+ * @param {string} text
+ * @param {{ requestId?: string|null, commandId?: string|null, viewId?: string, instanceId?: string|null, clientId?: string, timeoutMs?: number, connect?: (path: string) => import("node:net").Socket }} [opts]
+ */
+function sendHostInputStaged(socketPath, text, opts = {}) {
+	const commandId = opts.commandId ?? opts.requestId;
+	const clientId = opts.clientId ?? "service";
+	const timeoutMs = opts.timeoutMs ?? HOST_INPUT_ACK_TIMEOUT_MS;
+	const connect = opts.connect ?? createConnection;
+	const { viewId, instanceId } = opts;
+	return new Promise((resolve) => {
+		let settled = false;
+		let buffer = "";
+		let helloSeen = false;
+		let sawAccepted = false;
+		/** @type {import("node:net").Socket|null} */
+		let socket = null;
+		const finish = (result) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			try { socket?.destroy(); } catch { /* best effort */ }
+			resolve(result);
+		};
+		/** §10: resolve the deadline by query, never by a blind retry. */
+		const resolveByReconcile = (fallbackError) => {
+			if (settled) return;
+			reconcileQueryCommand(socketPath, commandId, { viewId, instanceId, clientId, connect, timeoutMs }).then((verdict) => {
+				if (verdict === "accepted_unknown") finish({ ok: false, ambiguous: true, error: "accepted_unknown", retryable: false });
+				else if (verdict === "reconciled_clean") finish({ ok: false, error: fallbackError, retryable: true });
+				else finish({ ok: false, error: fallbackError, retryable: true });
+			});
+		};
+		const timer = setTimeout(() => resolveByReconcile("timeout"), timeoutMs);
+		timer.unref?.();
+		try {
+			socket = connect(socketPath);
+		} catch (err) {
+			finish({ ok: false, error: err instanceof Error ? err.message : String(err), retryable: true });
+			return;
+		}
+		socket.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				if (!line.trim()) continue;
+				let msg;
+				try { msg = JSON.parse(line); } catch { continue; }
+				if (!helloSeen) {
+					if (msg?.type !== "hello") continue; // wait for the capability answer
+					helloSeen = true;
+					try {
+						if (typeof msg.generation === "string" && msg.generation) {
+							socket.write(JSON.stringify({ type: "input", durable: true, commandId, clientId, seq: 1, viewId, instanceId, data: text }) + "\n");
+						} else {
+							// Pre-lifecycle runner: legacy requestId contract, same bytes.
+							socket.write(JSON.stringify({ type: "input", requestId: commandId, data: text }) + "\n");
+						}
+					} catch (err) {
+						finish({ ok: false, error: err instanceof Error ? err.message : String(err), retryable: true });
+					}
+					continue;
+				}
+				if (msg?.type === "cmd_ack" && msg.commandId === commandId) {
+					if (msg.stage === "applied") finish({ ok: true, applied: true });
+					if (msg.stage === "accepted") {
+						sawAccepted = true;
+						// accepted → applied is synchronous runner-side (Task 2 ruling 4);
+						// a dropped socket between them is resolved by the deadline's query.
+					}
+					continue;
+				}
+				if (msg?.type === "input_ack" && msg.requestId === commandId) {
+					// Legacy fallback answer on this same connection.
+					finish({ ok: true });
+					return;
+				}
+				if (msg?.type === "error") {
+					const code = msg.code ?? msg.message ?? "host_error";
+					if (code === "command_failed") {
+						// Taxonomy: reconcile by commandId before any retry decision.
+						resolveByReconcile(code);
+						return;
+					}
+					finish({ ok: false, error: code, retryable: code !== "envelope_invalid" });
+					return;
+				}
+				// hello/status/output lines are ignored — keep waiting.
+			}
+		});
+		socket.on("error", (err) => {
+			const code = /** @type {NodeJS.ErrnoException} */ (err).code;
+			finish({ ok: false, error: code ?? (err instanceof Error ? err.message : String(err)), retryable: true });
+		});
+		socket.on("close", () => {
+			// A close after an accepted ack is the §10 window — resolve by query.
+			if (sawAccepted) resolveByReconcile("socket_closed");
+			else finish({ ok: false, error: "socket_closed", retryable: true });
+		});
+	});
+}
+
 /**
  * Send one input line to a host control socket and wait for the runner's
  * input_ack (issue #70 A13). Fire-and-forget "connected" no longer counts as
@@ -2372,6 +2631,15 @@ const HOST_INPUT_ACK_TIMEOUT_MS = 2_000;
  * @returns {Promise<{ ok: boolean, error?: string, retryable?: boolean }>}
  */
 export function sendHostInput(socketPath, text, opts = {}) {
+	// Staged durable path (phase 5 D4): the caller knows the host fence
+	// (viewId + instanceId) and a stable commandId — envelope it and expect
+	// accepted → applied with the §10 reconcile-query on timeout. Runners whose
+	// hello lacks a generation fall back to the legacy requestId contract on
+	// the same connection, so the legacy branch below stays for callers that
+	// have no fence (pre-instanceId hosts).
+	if (opts.viewId && opts.instanceId != null && (opts.commandId || opts.requestId)) {
+		return sendHostInputStaged(socketPath, text, opts);
+	}
 	const requestId = opts.requestId ?? null;
 	const timeoutMs = opts.timeoutMs ?? HOST_INPUT_ACK_TIMEOUT_MS;
 	const connect = opts.connect ?? createConnection;

package/src/ui/dashboard.ts

@@ -440,7 +440,7 @@ export class DashboardComponent implements Component {
 		const page = Math.max(1, termRows - 8);
 		if (matchesKey(data, Key.left) || matchesKey(data, Key.escape) || data === "<") {
 			const row = this.selectedRow();
-			if (row) this.deps.service.markVisited?.(row.meta.id);
+			if (row) void this.deps.service.markVisited?.(row.meta.id)?.catch(() => {});
 			this.mode = "list";
 			return;
 		}
@@ -847,6 +847,14 @@ export class DashboardComponent implements Component {
 		const launchCwd = launchOpts?.cwd ?? this.deps.defaultCwd;
 		const launchModel = launchOpts?.model ?? (this.launch?.model ? canonicalModelRef(this.launch.model) : null);
 		const launchThinking = launchOpts?.thinkingLevel ?? this.launch?.thinking ?? this.deps.currentThinkingLevel;
+		// Clear synchronously, BEFORE the async dispatch: closes the double-submit
+		// window — a second Enter during the coordinator round-trip (mark_queued
+		// lands before the runner spawns, issue #91) must not re-dispatch.
+		this.setInput("");
+		this.launch = null;
+		this.mode = "list";
+		this.inputNotice = null;
+		this.refresh();
 		// dispatch is async (mark_queued routes through the view-state coordinator
 		// before the runner spawns, issue #91); notices/attach land when it settles.
 		void Promise.resolve(
@@ -856,38 +864,38 @@ export class DashboardComponent implements Component {
 				thinkingLevel: launchThinking,
 			}),
 		).then((res) => {
-			if (!res.ok) this.notice(res.error ?? "Dispatch failed", "error");
-			else {
-				this.lastLaunchPrefs = { ...this.deps.service.getLaunchPrefs?.(), cwd: launchCwd, model: launchModel, thinkingLevel: launchThinking };
-				try {
-					recordCwdLaunch(this.deps.root, launchCwd);
-				} catch {
-					/* best effort: stats must never block dispatch */
-				}
-				try {
-					this.deps.service.saveLaunchPrefs?.(this.lastLaunchPrefs);
-				} catch {
-					/* best effort */
-				}
-				this.selectedId = res.viewId ?? this.selectedId;
-				if (launchOpts?.attach && res.hostMode === "pty" && res.viewId) {
-					this.setInput("");
-					this.launch = null;
-					this.mode = "list";
-					this.inputNotice = null;
-					this.done({ action: "attach", viewId: res.viewId, stopFirst: false });
-					return;
-				}
-				if (res.hostMode === "json-runner") {
-					this.notice(launchOpts?.attach ? `Start & attach needs PTY; launched in background: ${res.fallbackReason ?? "PTY unavailable"}` : `Dispatched with non-live fallback: ${res.fallbackReason ?? "PTY unavailable"}`, "warn");
-				} else {
-					this.notice(`Dispatched: ${truncate(text, 40)}`, "info");
-				}
+			if (!res.ok) {
+				this.notice(res.error ?? "Dispatch failed", "error");
+				this.refresh();
+				return;
 			}
-			this.setInput("");
-			this.launch = null;
-			this.mode = "list";
-			this.inputNotice = null;
+			this.lastLaunchPrefs = { ...this.deps.service.getLaunchPrefs?.(), cwd: launchCwd, model: launchModel, thinkingLevel: launchThinking };
+			try {
+				recordCwdLaunch(this.deps.root, launchCwd);
+			} catch {
+				/* best effort: stats must never block dispatch */
+			}
+			try {
+				this.deps.service.saveLaunchPrefs?.(this.lastLaunchPrefs);
+			} catch {
+				/* best effort */
+			}
+			this.selectedId = res.viewId ?? this.selectedId;
+			if (launchOpts?.attach && res.hostMode === "pty" && res.viewId) {
+				this.done({ action: "attach", viewId: res.viewId, stopFirst: false });
+				return;
+			}
+			if (res.hostMode === "json-runner") {
+				this.notice(launchOpts?.attach ? `Start & attach needs PTY; launched in background: ${res.fallbackReason ?? "PTY unavailable"}` : `Dispatched with non-live fallback: ${res.fallbackReason ?? "PTY unavailable"}`, "warn");
+			} else {
+				this.notice(`Dispatched: ${truncate(text, 40)}`, "info");
+			}
+			this.refresh();
+		}).catch(() => {
+			// dispatch() is not expected to reject (its failures surface as
+			// {ok:false}); this guards fs-class throws from escaping as unhandled
+			// rejections (issue #91 hygiene).
+			this.notice("Dispatch failed", "error");
 			this.refresh();
 		});
 	}
@@ -1067,7 +1075,7 @@ export class DashboardComponent implements Component {
 
 	private openSessionView(): void {
 		if (!this.selectedId) return;
-		this.deps.service.markVisited?.(this.selectedId);
+		void this.deps.service.markVisited?.(this.selectedId)?.catch(() => {});
 		this.sessionScrollTop = 0;
 		this.mode = "session";
 	}