[wingleeio]

Fixes the two reported bugs plus a batch of robustness defects found by an adversarial audit of the ACP + session-DO rework, all verified against a real wrangler edge (real DOs) and the real claude harness on haiku.

The two reported bugs

Timer opens at ~30:00 on send. started_at survived a session settling: a steer into a parked run kept the previous turn's base, and the UI's pending-send overlay read the stale row directly. Now set_status restamps on any entry into Working from a settled state, clears the base on Idle/Errored, the steer boundary restamps (timers are per user message), and the status strip clamps to the in-flight send during the send→ack window. Verified live: second message into a parked haiku session stamped startedAt 5ms after send.

Session completes but is never marked completed; timer runs forever. The ACP adapter could emit Steered after the turn's Done when the _session/steering response raced the prompt response — the engine un-parks on Steered and then waits forever for a Done that never comes, with the liveness heartbeat keeping the phantom fresh. Steering calls now settle at the turn boundary, before the turn closes; Steered can never trail Done (regression test: steer_racing_the_turn_end_never_emits_steered_after_done).

Audit findings fixed (highlights)

• chat2 seed was doubly broken: v0.1.32's self-pin (every seed aborted — cutover DOA) and, once un-blocked, a data-loss race (seeding from the pre-backfill local doc forked other devices' rows into the retired lineage). Seeds now wait for room join + 2s of frontier quiet, and a frontier seal aborts the flip on any doc movement since the rebuild.
• Cutover converges live watchers: registry flip retires s2 handles immediately; watch streams end cleanly and clients resubscribe onto the chat2 adopt path (verified: 36 live s2 frames → flip → resubscribe → full converged transcript).
• Routed-steer at-least-once ledger: a steer accepted by a dying run (idle-reaper race, parked child death, error discarding queued steers) is re-dispatched at run exit — a message that shows as sent can never silently not run.
• Input-request stranding: resolvers drain at turn end; a question arriving while parked is auto-declined instead of un-parking into a dead AwaitingInput.
• Live plan/todo chip: the stale-echo filter ate the stable acp-plan id after the first park/steer boundary — plans never rendered again for the rest of the run.
• UI standing watches resubscribe (Sessions/Chats/Devices/Spaces): a daemon restart froze them for the app's life — remote Idle/Completed transitions never arrived.
• Registry batch wedge: ops chunk at 400/batch (delete_space on a ≥250-chat space minted a forever-rejected batch that blocked every later write from the device, session-status rows included).
• chat2 handles evictable again (sink holds a Weak doc ref), host reacts to ServerReset/PushRejected with compensating checkpoints, chat2 rooms join user-signal liveness probes, checkpoint Range-resume restarts when the blob changes mid-download.
• e2e-smoke.sh build fix (--example filtered out the comet bin — the smoke never ran) and driver fixes (resubscribe on stream end; parse the framed WatchDocMessages protocol).

Verification

• Full workspace test suite green (new regression tests: parked-steer timer restamp, ACP steering race).
• Two-device e2e smoke passes end to end against a real wrangler edge: doc-queued cross-device run, transcript sync, working→idle status round-trip, chat2 seed+flip+adopt underneath.
• Real claude harness (haiku): run→working(fresh start)→idle(cleared), steer into parked session (fresh timer, reply lands), interrupt (partial output stamped aborted, settles idle).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}