@@ -39,31 +39,37 @@ object DevSuiteStore {
         val p = prefs(context)
         val out = mutableMapOf<String, ComponentState>()
         for (id in p.all.keys) {
-            val raw = p.getString(id, null) ?: continue
-            val parts = raw.split('\u0001', limit = 3)
-            val status = when (parts.getOrNull(0)) {
-                "INSTALLING" -> Status.INSTALLING
-                "INSTALLED" -> Status.INSTALLED
-                "FAILED" -> Status.FAILED
-                else -> Status.NOT_INSTALLED
-            }
-            out[id] = ComponentState(
-                componentId = id,
-                status = status,
-                progressLine = parts.getOrNull(1).orEmpty(),
-                updatedAtMs = parts.getOrNull(2)?.toLongOrNull() ?: 0L,
-            )
+            out[id] = decodeComponentState(id, p.getString(id, null)) ?: continue
         }
         _states.value = out
         return out
     }
 
     fun update(context: Context, componentId: String, status: Status, progressLine: String = "") {
-        val p = prefs(context)
-        p.edit()
-            .putString(componentId, "$status\u0001$progressLine\u0001${System.currentTimeMillis()}")
-            .apply()
-        snapshot(context)
+        val previous = _states.value[componentId]
+        val next = ComponentState(
+            componentId = componentId,
+            status = status,
+            progressLine = progressLine,
+            updatedAtMs = System.currentTimeMillis(),
+        )
+        // [T-dev-suite-prefs-storm] Persist ONLY status transitions. The
+        // installer feeds every apt/pip output line through here — hundreds
+        // of full-XML SharedPreferences rewrites per install, and each
+        // apply() queues a disk write that QueuedWork.waitToFinish() can
+        // later force the MAIN thread to drain (observed as a multi-second
+        // main-thread stall during installs that deferred the foreground
+        // service's createService dispatch past its deadline — the
+        // install-crash amplifier). Progress lines are UI-only state: they
+        // flow through the in-memory StateFlow and never touch disk. Crash
+        // recovery (recoverInterrupted) only needs the status marker, and
+        // it overwrites the line anyway.
+        if (shouldPersistComponentState(previous?.status, status)) {
+            prefs(context).edit()
+                .putString(componentId, encodeComponentState(status, progressLine, next.updatedAtMs))
+                .apply()
+        }
+        _states.value = _states.value + (componentId to next)
     }
 
     /**
@@ -80,4 +86,35 @@ object DevSuiteStore {
         interrupted.forEach { update(context, it, Status.FAILED, "安装被中断") }
         return interrupted
     }
+
+    /**
+     * [T-dev-suite-prefs-storm] True when this update must hit disk: ONLY
+     * status transitions. Progress-line refreshes (the installer feeds every
+     * apt/pip output line through [update]) stay in memory — see the block
+     * comment in [update]. Pure so the throttle contract is unit-testable.
+     */
+    internal fun shouldPersistComponentState(previous: Status?, next: Status): Boolean =
+        previous != next
+
+    /** Encodes one component marker for SharedPreferences. Pure (testable). */
+    internal fun encodeComponentState(status: Status, progressLine: String, updatedAtMs: Long): String =
+        "$status\u0001$progressLine\u0001$updatedAtMs"
+
+    /** Decodes one component marker; null for absent/corrupt rows. Pure (testable). */
+    internal fun decodeComponentState(componentId: String, raw: String?): ComponentState? {
+        if (raw == null) return null
+        val parts = raw.split('\u0001', limit = 3)
+        val status = when (parts.getOrNull(0)) {
+            "INSTALLING" -> Status.INSTALLING
+            "INSTALLED" -> Status.INSTALLED
+            "FAILED" -> Status.FAILED
+            else -> Status.NOT_INSTALLED
+        }
+        return ComponentState(
+            componentId = componentId,
+            status = status,
+            progressLine = parts.getOrNull(1).orEmpty(),
+            updatedAtMs = parts.getOrNull(2)?.toLongOrNull() ?: 0L,
+        )
+    }
 }
@@ -239,6 +239,27 @@ class AgentForegroundService : Service() {
                 "processAliveMs=${android.os.SystemClock.elapsedRealtime() - processStartElapsedMs} " +
                 "slots=${SessionConcurrencyManager.diagSnapshot()}",
         )
+        // [T-fgs-deadline-invariant] Every Context.startForegroundService()
+        // delivery must be answered by Service.startForeground() in THIS
+        // dispatch — unconditionally. The refresh pipeline below deliberately
+        // skips no-op publishes (identical state) and applyForeground's
+        // notify()-only branch (non-forked SystemUI) never re-anchors; both
+        // are fine for notification churn but leave the platform's 5-10s
+        // foreground deadline armed against a service that already considers
+        // itself anchored (crash-2026-10-15_01-00-01 class). Re-anchoring
+        // with the CURRENT state notification is a cheap idempotent no-op for
+        // the platform, and it must run BEFORE any stopSelf() return path —
+        // stopSelf() tears the component down but does NOT retract the
+        // pending foreground requirement (see applyForeground's catch).
+        if (bootstrapPosted) {
+            val anchor = try {
+                buildNotification(notificationState())
+            } catch (t: Throwable) {
+                Log.w(TAG, "anchor build failed, using stub: ${t.message}")
+                stubForegroundNotification()
+            }
+            applyForeground(anchor, reanchor = true)
+        }
         // onCreate already satisfied the foreground deadline with a plain stub.
         // If even the stub failed, no background service should remain alive.
         if (!bootstrapPosted || com.openminis.app.crash.CrashFrequencyDetector.isSafeMode()) {
 
@@ -0,0 +1,70 @@
+package com.openminis.app.service
+
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+
+/**
+ * [T-fgs-stop-linger] Defers a foreground-service stop by [lingerMs].
+ *
+ * Root cause this closes (install-time ForegroundServiceDidNotStartInTimeException,
+ * crash-2026-10-15_01-00-01): every sandbox command (probe / apt / post-install
+ * step) drove the tracker through setActive → startForegroundService() → command →
+ * setInactive → stopService(). A probe against an already-installed component
+ * finishes in ~7ms, so the stopService() binder call and the NEXT command's
+ * startForegroundService() cross in flight at ActivityManager. The platform
+ * defers the start behind the teardown and arms the 5-10s foreground deadline
+ * against a service instance that has not been created yet — the deadline fires
+ * before onCreate ever runs, and the process is killed.
+ *
+ * Lingering the stop closes the crossing for every rapid command sequence
+ * (dev-suite assemblies, chat tool-call chains, probe cascades): the next
+ * setActive/setPresent lands while the service is still alive, cancels the
+ * pending stop, and the sequence keeps ONE service instance instead of
+ * churning start/stop per command. The stop still fires after a genuinely
+ * idle window, so no battery regression beyond [DEFAULT_LINGER_MS] of
+ * completed-state notification.
+ *
+ * Pure coroutine class (no Android imports) so the schedule/cancel/restart
+ * contract is unit-testable with virtual time.
+ */
+class ServiceStopLinger(
+    private val scope: CoroutineScope,
+    private val lingerMs: Long = DEFAULT_LINGER_MS,
+    private val onStop: () -> Unit,
+) {
+    private var job: Job? = null
+
+    /** True while a stop is scheduled but has not fired yet. */
+    val isPending: Boolean get() = job?.isActive == true
+
+    /**
+     * (Re)schedule the deferred stop. Calling this again restarts the window —
+     * the linger measures quiet time since the LAST emptiness event, not since
+     * the first.
+     */
+    fun schedule() {
+        job?.cancel()
+        job = scope.launch {
+            delay(lingerMs)
+            onStop()
+        }
+    }
+
+    /** Cancel a pending stop — the service is needed again. */
+    fun cancel() {
+        job?.cancel()
+        job = null
+    }
+
+    companion object {
+        /**
+         * Long enough to bridge command-to-command gaps (ExecutionCoordinator
+         * bind-mount + shell-reuse overhead is sub-second; component-to-component
+         * transitions in an assembly are adjacent), short enough that the
+         * completed-state notification clears promptly after a real idle.
+         */
+        const val DEFAULT_LINGER_MS: Long = 10_000L
+    }
+}
@@ -3,6 +3,9 @@ package com.openminis.app.service
 import android.content.Context
 import android.os.SystemClock
 import android.util.Log
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
@@ -26,6 +29,21 @@ object SessionActivityTracker {
 
     private const val TAG = "SessionTracker"
 
+    // [T-fgs-stop-linger] Owns the deferred service stop. See
+    // [ServiceStopLinger] for the crossing this closes.
+    private val trackerScope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+    private val stopLinger = ServiceStopLinger(
+        scope = trackerScope,
+        onStop = { stopService() },
+    )
+
+    /**
+     * Test seam: true while a deferred service stop is scheduled. The stop
+     * itself is a no-op without an initialized [appContext], so unit tests
+     * observe the linger wiring through this instead.
+     */
+    val isStopPendingForTest: Boolean get() = stopLinger.isPending
+
     private val _activeSessions = MutableStateFlow<Set<String>>(emptySet())
     val activeSessions: StateFlow<Set<String>> = _activeSessions.asStateFlow()
 
@@ -315,6 +333,10 @@ object SessionActivityTracker {
      * action can fan out to every running session.
      */
     fun setActive(sessionId: String, onStop: (() -> Unit)? = null) {
+        // [T-fgs-stop-linger] A new run cancels any deferred stop — the
+        // service is needed again, and the next startForegroundService()
+        // must not race the teardown it would have triggered.
+        stopLinger.cancel()
         val wasIdle = !shouldRunService()
         // [T-android-live-update-completed] Capture BEFORE mutating: a run
         // "begins" only on the empty → non-empty edge. A second concurrent
@@ -393,8 +415,13 @@ object SessionActivityTracker {
         }
         publishNotificationTimeline()
         if (!shouldRunService()) {
-            stopService()
+            // [T-fgs-stop-linger] Deferred stop: a rapid follow-up command
+            // (next probe / apt step in the same assembly) cancels this and
+            // keeps one service instance, instead of crossing stopService()
+            // with its own startForegroundService() at ActivityManager.
+            stopLinger.schedule()
         } else {
+            stopLinger.cancel()
             updateService()
         }
         // T180-bg-notif: fire the completion listener AFTER service state
@@ -425,6 +452,9 @@ object SessionActivityTracker {
      */
     fun setPresent(sessionId: String) {
         if (sessionId in _presentSessions.value) return
+        // [T-fgs-stop-linger] Presence re-holds the service the same way a
+        // new active session does — cancel any deferred stop.
+        stopLinger.cancel()
         val wasIdle = !shouldRunService()
         _presentSessions.value = _presentSessions.value + sessionId
         Log.d(TAG, "Presence set: $sessionId (present total: ${_presentSessions.value.size})")
@@ -446,8 +476,10 @@ object SessionActivityTracker {
         _presentSessions.value = _presentSessions.value - sessionId
         Log.d(TAG, "Presence cleared: $sessionId (present total: ${_presentSessions.value.size})")
         if (!shouldRunService()) {
-            stopService()
+            // [T-fgs-stop-linger] see setInactive — deferred, cancellable.
+            stopLinger.schedule()
         } else {
+            stopLinger.cancel()
             updateService()
         }
     }
@@ -464,8 +496,10 @@ object SessionActivityTracker {
         _presentSessions.value = emptySet()
         Log.d(TAG, "Presence cleared (all)")
         if (!shouldRunService()) {
-            stopService()
+            // [T-fgs-stop-linger] see setInactive — deferred, cancellable.
+            stopLinger.schedule()
         } else {
+            stopLinger.cancel()
             updateService()
         }
     }
 
@@ -0,0 +1,85 @@
+package com.openminis.app.plugins
+
+import com.openminis.app.plugins.DevSuiteStore.Status
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * [T-dev-suite-prefs-storm] Contract for the SharedPreferences write throttle.
+ *
+ * The installer feeds every apt/pip output line through
+ * [DevSuiteStore.update] — hundreds of full-XML prefs rewrites per install
+ * used to queue disk writes that QueuedWork.waitToFinish() could later force
+ * the MAIN thread to drain (the install-crash amplifier). The contract:
+ * only STATUS transitions persist; progress lines are in-memory only.
+ *
+ * Pure functions only (repo convention: framework entry points are
+ * documented trade-offs, not unit-test targets).
+ */
+class DevSuiteStoreThrottleTest {
+
+    // -- shouldPersistComponentState --
+
+    @Test
+    fun `progress-line refreshes with the same status never persist`() {
+        // The apt/pip line stream: same status, new line, hundreds of times.
+        assertFalse(DevSuiteStore.shouldPersistComponentState(Status.INSTALLING, Status.INSTALLING))
+        assertFalse(DevSuiteStore.shouldPersistComponentState(Status.INSTALLED, Status.INSTALLED))
+        assertFalse(DevSuiteStore.shouldPersistComponentState(Status.FAILED, Status.FAILED))
+        assertFalse(DevSuiteStore.shouldPersistComponentState(Status.NOT_INSTALLED, Status.NOT_INSTALLED))
+    }
+
+    @Test
+    fun `status transitions always persist`() {
+        // First write (nothing known yet), every real transition, and the
+        // purge path back to NOT_INSTALLED.
+        assertTrue(DevSuiteStore.shouldPersistComponentState(null, Status.INSTALLING))
+        assertTrue(DevSuiteStore.shouldPersistComponentState(Status.INSTALLING, Status.INSTALLED))
+        assertTrue(DevSuiteStore.shouldPersistComponentState(Status.INSTALLING, Status.FAILED))
+        assertTrue(DevSuiteStore.shouldPersistComponentState(Status.FAILED, Status.INSTALLING))
+        assertTrue(DevSuiteStore.shouldPersistComponentState(Status.INSTALLED, Status.NOT_INSTALLED))
+    }
+
+    // -- encode / decode round trip --
+
+    @Test
+    fun `encode decode round trip preserves every field`() {
+        val raw = DevSuiteStore.encodeComponentState(Status.INSTALLING, "apt 42% (Reading database…)", 1_728_950_000_000L)
+        val state = DevSuiteStore.decodeComponentState("nodejs-suite", raw)!!
+
+        assertEquals("nodejs-suite", state.componentId)
+        assertEquals(Status.INSTALLING, state.status)
+        assertEquals("apt 42% (Reading database…)", state.progressLine)
+        assertEquals(1_728_950_000_000L, state.updatedAtMs)
+    }
+
+    @Test
+    fun `decode tolerates absent and corrupt rows without throwing`() {
+        assertNull(DevSuiteStore.decodeComponentState("x", null))
+
+        // Corrupt/legacy row: unknown status token falls back to
+        // NOT_INSTALLED, missing timestamp decodes as 0 — snapshot() must
+        // never throw on prefs written by an older build.
+        val state = DevSuiteStore.decodeComponentState("x", "GARBAGE")!!
+        assertEquals(Status.NOT_INSTALLED, state.status)
+        assertEquals("", state.progressLine)
+        assertEquals(0L, state.updatedAtMs)
+    }
+
+    @Test
+    fun `decode degrades gracefully when a line contains the separator`() {
+        // split(limit = 3) keeps the remainder in the LAST field, so a
+        // progress line that itself contains \u0001 swallows the timestamp
+        // (toLongOrNull → null → 0). The status stays intact and nothing
+        // throws — that is the pinned contract: prefs corruption degrades,
+        // never crashes snapshot().
+        val raw = "INSTALLING\u0001line\u0001with\u0001sep\u0001123"
+        val state = DevSuiteStore.decodeComponentState("x", raw)!!
+        assertEquals(Status.INSTALLING, state.status)
+        assertEquals("line", state.progressLine)
+        assertEquals(0L, state.updatedAtMs)
+    }
+}