Reload can unlock the UI without proving the send failed.Check durable Session truth before retrying, or a lost response can become a duplicate prompt.
Route the unresolved stage.
File read and base64 conversion happen before the signalled Host prompt.
The request started but the carrier has no terminal response.
The Host may have accepted the prompt before acknowledgement was lost.
No sequence-owned settlement returned the machine to plain.
One repair contract, four terminal states.
Remove only attachments owned by the accepted attempt.
Name the failed stage and preserve retryable input.
Check admission identity before enabling replay.
An AbortController is not a timeout.
rc.8 creates a signal, but no deadline fires it, and image serialization does not receive it.
Primary evidence.
Unlock without duplicating the prompt.
The complete runbook includes operator containment, stage routing, an incident bundle, deterministic tests, deadline design, a runtime repair contract, and fifteen acceptance gates.
Read the complete runbook