Summary

Fixes #5. When the desktop backend exits ungracefully (SIGKILL / crash / OOM — no SIGTERM), in-flight agent turns are left frozen at projection_turns.state = "running" with projection_thread_sessions.active_turn_id still set. Nothing reconciles them on next launch, so on a later resume the provider reports the cut-off turn as cancelled/aborted, and auto-resume never recovers them. A clean quit does the right thing via an Effect finalizer (ProviderService.runStopAll → adapter.stopAll() → a session-set that settles running turns to interrupted); only ungraceful exit was broken.

Approach

At fresh boot no turn is actually live — adapter session maps start empty and runtime rows carry no pid/epoch — so every leftover in-flight turn in the read model is by definition a crash remnant. The fix adds a one-shot boot reconciler that mirrors the graceful path exactly:

• New apps/server/src/orchestration/Layers/CrashRecoveryReconciler.ts — reconcileInterruptedTurnsOnBoot reads the read model (ProjectionSnapshotQuery.getSnapshot()), finds threads with a leftover in-flight turn (latestTurn.state === "running", or session status ∈ {running, starting}, or non-null activeTurnId), and for each dispatches a thread.session.set command with status: "stopped", activeTurnId: null (mirroring what ProviderRuntimeIngestion dispatches on session.exited). This settles the running turn to the canonical resumable interrupted state and clears active_turn_id.
• Wired into serverRuntimeStartup.ts as a startup phase before reactors.start and before command-ready is signalled, so no reactor or user command observes the stale state, and the (now-unblocked) ProviderSessionReaper can idle-sweep the runtime row.

Key correctness property: reconciliation goes through the event log (a dispatched command), never a direct projection write — projections are a pure function of the event log and a direct write would be reverted on rebuild. It is fully error-swallowed (never error channel) so a bad thread or persistence hiccup can't block boot.

Scope (deliberate)

Reconciling to a resumable interrupted state satisfies the issue's primary acceptance ("or at minimum settled to a resumable interrupted state"). Auto-resume re-arming (auto-continuing the turn) needs a new crash marker + a boot-time producer to distinguish crash-interrupted from user/stop-interrupted turns; that's a documented, separate follow-up (noted in code comments) rather than bundled here.

Tests (TDD — red first)

• CrashRecoveryReconciler.test.ts (new, integration over the real engine + projection pipeline + in-memory sqlite): precondition (turn running, session running, active_turn_id set) → reconcile → turn interrupted with completed_at, session stopped, active_turn_id null, reconciledCount === 1; idempotency (second run is a no-op); multi-thread selectivity (only crashed threads change; already-settled untouched); event-log backing (a new thread.session-set event is appended, surviving a rebuild).
• serverRuntimeStartup.test.ts (extended): the reconcile phase runs before reactors.start / command-ready, and a dispatch failure is swallowed (startup still completes).
• t3x/autoResume/guards.test.ts (extended): a settled interrupted + stopped thread is not threadIsProgressing (documents resumability).

Verification

• New/extended trio → 33 pass; full src/orchestration/ + src/t3x/autoResume/ → 255 pass.
• tsgo --noEmit → exit 0, no errors.
• vp fmt --check on changed files → clean.

Note: src/t3x/autoResume/Reactor.test.ts has a pre-existing timing-flaky case (unchanged by this PR — verified identical to main); unrelated to this change.

🤖 Generated with Claude Code