diff --git a/app/desktop/src/hosts.test.ts b/app/desktop/src/hosts.test.ts
index e310c26c0..3b2f1a291 100644
--- a/app/desktop/src/hosts.test.ts
+++ b/app/desktop/src/hosts.test.ts
@@ -14,11 +14,13 @@ import {
   findHostByOrigin,
   hostInfos,
   loadHosts,
+  moveHost,
   normalizeOrigin,
   removeHost,
   resolveActiveHost,
   saveHosts,
   setActiveHost,
+  setHostAccentColor,
   setHostLastPath,
 } from "./hosts";
 
@@ -362,3 +364,122 @@ test("loadHosts keeps a pre-remote file unchanged (schema still version 1)", ()
   assert.equal(loaded.hosts.length, 1);
   assert.equal("remote" in loaded.hosts[0], false);
 });
+
+test("loadHosts keeps a string accentColor and drops a wrong-typed one (schema still version 1)", () => {
+  const dir = tmpDataDir();
+  const stored = {
+    version: 1,
+    activeId: "a",
+    hosts: [
+      { id: "a", name: "bad", url: "http://h:1", accentColor: 42 },
+      { id: "b", name: "good", url: "http://h:2", accentColor: "#8b7ff0" },
+      { id: "c", name: "plain", url: "http://h:3" },
+    ],
+  };
+  writeFileSync(join(dir, "hosts.json"), JSON.stringify(stored), "utf8");
+  const loaded = loadHosts(dir);
+  assert.equal(loaded.version, 1);
+  assert.equal(loaded.hosts.length, 3);
+  assert.equal("accentColor" in loaded.hosts[0], false);
+  assert.equal(loaded.hosts[1].accentColor, "#8b7ff0");
+  assert.equal("accentColor" in loaded.hosts[2], false);
+});
+
+test("setHostAccentColor sets, overwrites, and round-trips through load", () => {
+  const dir = tmpDataDir();
+  const a = addHost(dir, "a", "http://a:1");
+  const b = addHost(dir, "b", "http://b:2");
+  assert.equal(a.ok && b.ok, true);
+  if (!a.ok || !b.ok) return;
+
+  setHostAccentColor(dir, a.host.id, "#8b7ff0");
+  const next = setHostAccentColor(dir, a.host.id, "#4a4468");
+  assert.equal(next.hosts[0].accentColor, "#4a4468");
+  // Only the target entry is patched.
+  assert.equal("accentColor" in next.hosts[1], false);
+  assert.deepEqual(loadHosts(dir), next);
+});
+
+test("setHostAccentColor with an unknown id writes nothing", () => {
+  const dir = tmpDataDir();
+  const a = addHost(dir, "a", "http://a:1");
+  assert.equal(a.ok, true);
+  if (!a.ok) return;
+
+  const before = readFileSync(join(dir, "hosts.json"), "utf8");
+  const result = setHostAccentColor(dir, "nope", "#8b7ff0");
+  assert.deepEqual(result, a.list);
+  assert.equal(readFileSync(join(dir, "hosts.json"), "utf8"), before);
+});
+
+test("setHostAccentColor with an unchanged value writes nothing", () => {
+  const dir = tmpDataDir();
+  const a = addHost(dir, "a", "http://a:1");
+  assert.equal(a.ok, true);
+  if (!a.ok) return;
+
+  const first = setHostAccentColor(dir, a.host.id, "#8b7ff0");
+  const before = readFileSync(join(dir, "hosts.json"), "utf8");
+  const again = setHostAccentColor(dir, a.host.id, "#8b7ff0");
+  assert.deepEqual(again, first);
+  assert.equal(readFileSync(join(dir, "hosts.json"), "utf8"), before);
+});
+
+test("moveHost reorders by id and leaves activeId untouched", () => {
+  const dir = tmpDataDir();
+  const a = addHost(dir, "a", "http://a:1");
+  assert.equal(a.ok, true);
+  if (!a.ok) return;
+  const b = addHost(dir, "b", "http://b:2");
+  const c = addHost(dir, "c", "http://c:3");
+  assert.equal(b.ok && c.ok, true);
+  if (!b.ok || !c.ok) return;
+
+  const next = moveHost(dir, c.host.id, 0);
+  assert.deepEqual(
+    next.hosts.map((h) => h.id),
+    [c.host.id, a.host.id, b.host.id],
+  );
+  assert.equal(next.activeId, c.host.id); // c was active (added last)
+  assert.deepEqual(loadHosts(dir), next);
+});
+
+test("moveHost clamps an out-of-range target index", () => {
+  const dir = tmpDataDir();
+  const a = addHost(dir, "a", "http://a:1");
+  const b = addHost(dir, "b", "http://b:2");
+  const c = addHost(dir, "c", "http://c:3");
+  assert.equal(a.ok && b.ok && c.ok, true);
+  if (!a.ok || !b.ok || !c.ok) return;
+
+  const next = moveHost(dir, a.host.id, 5);
+  assert.deepEqual(
+    next.hosts.map((h) => h.id),
+    [b.host.id, c.host.id, a.host.id],
+  );
+});
+
+test("moveHost with an unknown id or a same-index move writes nothing", () => {
+  const dir = tmpDataDir();
+  const a = addHost(dir, "a", "http://a:1");
+  const b = addHost(dir, "b", "http://b:2");
+  assert.equal(a.ok && b.ok, true);
+  if (!a.ok || !b.ok) return;
+
+  const before = readFileSync(join(dir, "hosts.json"), "utf8");
+  assert.deepEqual(moveHost(dir, "nope", 0).hosts, b.list.hosts);
+  assert.equal(readFileSync(join(dir, "hosts.json"), "utf8"), before);
+  assert.deepEqual(moveHost(dir, a.host.id, 0).hosts, b.list.hosts);
+  assert.equal(readFileSync(join(dir, "hosts.json"), "utf8"), before);
+});
+
+test("hostInfos carries accentColor when the entry has one (and never fills waiting)", () => {
+  const colored = { id: "h1", name: "one", url: "http://one:1", accentColor: "#8b7ff0" };
+  const plain = { id: "h2", name: "two", url: "http://two:2" };
+  const infos = hostInfos({ version: 1, activeId: "h1", hosts: [colored, plain] });
+  assert.deepEqual(infos, [
+    { id: "h1", name: "one", url: "http://one:1", active: true, accentColor: "#8b7ff0" },
+    { id: "h2", name: "two", url: "http://two:2", active: false },
+  ]);
+  for (const info of infos) assert.equal("waiting" in info, false);
+});
diff --git a/app/desktop/src/hosts.ts b/app/desktop/src/hosts.ts
index 825c35b4f..8790422ba 100644
--- a/app/desktop/src/hosts.ts
+++ b/app/desktop/src/hosts.ts
@@ -28,6 +28,13 @@ export interface HostEntry {
    * state when the tunnel is down — acceptable degradation, no v2 bump.
    */
   remote?: string;
+  /**
+   * The host's instance accent color (`#…` hex as reported by the SPA's
+   * `theme-color` meta via `did-change-theme-color`), persisted so the
+   * host-switcher's edge bar survives cold start. Additive optional field
+   * like `lastPath` — the schema stays version 1.
+   */
+  accentColor?: string;
 }
 
 export interface HostList {
@@ -71,9 +78,9 @@ export function normalizeOrigin(input: string): NormalizeResult {
 /**
  * Parse one stored entry. The required fields (id/name/url) must be strings —
  * anything else rejects the entry (and, via parseHostList, the file). The
- * optional `lastPath` and `remote` are tolerant: absent → fine, string →
- * kept, any other type → the field is dropped but the entry (and file) still
- * loads.
+ * optional `lastPath`, `remote`, and `accentColor` are tolerant: absent →
+ * fine, string → kept, any other type → the field is dropped but the entry
+ * (and file) still loads.
  */
 function parseHostEntry(value: unknown): HostEntry | null {
   if (typeof value !== "object" || value === null) return null;
@@ -92,6 +99,9 @@ function parseHostEntry(value: unknown): HostEntry | null {
   if ("remote" in value && typeof value.remote === "string") {
     entry.remote = value.remote;
   }
+  if ("accentColor" in value && typeof value.accentColor === "string") {
+    entry.accentColor = value.accentColor;
+  }
   return entry;
 }
 
@@ -201,6 +211,45 @@ export function setHostLastPath(dir: string, id: string, lastPath: string): Host
   return next;
 }
 
+/**
+ * Record the host's instance accent color (captured from the view's
+ * `did-change-theme-color` reports in main.ts). Unknown id or an unchanged
+ * value is a no-op (nothing written) — capture fires on every theme-color
+ * report, so the fast path avoids rewriting an identical file.
+ */
+export function setHostAccentColor(dir: string, id: string, accentColor: string): HostList {
+  const list = loadHosts(dir);
+  const entry = list.hosts.find((h) => h.id === id);
+  if (!entry || entry.accentColor === accentColor) return list;
+  const next: HostList = {
+    ...list,
+    hosts: list.hosts.map((h) => (h.id === id ? { ...h, accentColor } : h)),
+  };
+  saveHosts(dir, next);
+  return next;
+}
+
+/**
+ * Move a host to `toIndex`, clamped to the list bounds. Order is
+ * user-meaningful — it IS the ⌥⌘1–9/⇧Ctrl+1–9 accelerator map — so this is
+ * the reorder seam behind `servers:reorder`. Unknown id or a move landing on
+ * the entry's current index is a no-op (nothing written); `activeId` and
+ * every other field are untouched — only array order changes.
+ */
+export function moveHost(dir: string, id: string, toIndex: number): HostList {
+  const list = loadHosts(dir);
+  const from = list.hosts.findIndex((h) => h.id === id);
+  if (from === -1) return list;
+  const to = Math.min(Math.max(toIndex, 0), list.hosts.length - 1);
+  if (to === from) return list;
+  const hosts = [...list.hosts];
+  const [moved] = hosts.splice(from, 1);
+  hosts.splice(to, 0, moved);
+  const next: HostList = { ...list, hosts };
+  saveHosts(dir, next);
+  return next;
+}
+
 /**
  * Resolve the host to load at startup / after a mutation: the active entry,
  * falling back to the first host when `activeId` dangles, `null` when the
@@ -226,20 +275,29 @@ export interface HostInfo {
   name: string;
   url: string;
   active: boolean;
+  /** The entry's persisted instance accent color, when known (never
+   *  null/empty — absent entries omit the field). */
+  accentColor?: string;
+  /** Cached waiting-agent count from the view registry — NEVER filled here
+   *  (this module is store-pure); the `servers:list` handler in main.ts
+   *  joins it in. */
+  waiting?: number;
 }
 
 /**
  * Read-only projection of the list for the `servers:list` IPC surface (the
  * channel name is the SPA-facing contract and keeps its server naming): every
  * entry plus an `active` flag derived via `resolveActiveHost`, so a dangling
- * `activeId` marks the same first-host fallback that startup would load.
+ * `activeId` marks the same first-host fallback that startup would load. The
+ * optional `accentColor` rides along when the entry carries one.
  */
 export function hostInfos(list: HostList): HostInfo[] {
   const activeId = resolveActiveHost(list)?.id ?? null;
-  return list.hosts.map(({ id, name, url }) => ({
+  return list.hosts.map(({ id, name, url, accentColor }) => ({
     id,
     name,
     url,
     active: id === activeId,
+    ...(accentColor !== undefined ? { accentColor } : {}),
   }));
 }
diff --git a/app/desktop/src/main.ts b/app/desktop/src/main.ts
index bb8d8c98b..68323ae0b 100644
--- a/app/desktop/src/main.ts
+++ b/app/desktop/src/main.ts
@@ -79,10 +79,12 @@ import {
   HostInfo,
   hostInfos,
   loadHosts,
+  moveHost,
   normalizeOrigin,
   removeHost,
   resolveActiveHost,
   setActiveHost,
+  setHostAccentColor,
   setHostLastPath,
 } from "./hosts";
 import {
@@ -394,6 +396,11 @@ function createHostView(hostId: string): WebContentsView {
   // the switch seam re-applies the incoming view's cached color instead).
   contents.on("did-change-theme-color", (_event, color) => {
     views = setViewThemeColor(views, hostId, color);
+    // Persist the accent per host entry so the host-switcher's edge bar
+    // survives cold start. A null report never clears the stored value; the
+    // dev sentinel view (__dev__) matches no entry — the membership guard
+    // silently covers it. Unchanged values short-circuit (no write).
+    if (color !== null) setHostAccentColor(userDataDir(), hostId, color);
     if (views.activeHostId === hostId) {
       applyOverlayColor(color ?? DEFAULT_STRIP_COLOR);
     }
@@ -1117,6 +1124,14 @@ function parseAddPayload(value: unknown): { name: string; url: string } | null {
   return { name, url: value.url };
 }
 
+function parseReorderPayload(value: unknown): { id: string; toIndex: number } | null {
+  if (typeof value !== "object" || value === null) return null;
+  if (!("id" in value) || typeof value.id !== "string") return null;
+  if (!("toIndex" in value) || typeof value.toIndex !== "number") return null;
+  if (!Number.isInteger(value.toIndex) || value.toIndex < 0) return null;
+  return { id: value.id, toIndex: value.toIndex };
+}
+
 function registerIpcHandlers(): void {
   ipcMain.handle(
     "welcome:test-host",
@@ -1179,7 +1194,18 @@ function registerIpcHandlers(): void {
   // entries are hosts shell-side.
   ipcMain.handle("servers:list", (event): ServersListResult => {
     if (!isHostsSender(event)) return { ok: false, error: "Not allowed" };
-    return { ok: true, servers: hostInfos(loadHosts(userDataDir())) };
+    // Join the store projection with the view registry's cached badge counts:
+    // a host with a live view whose last `badge:set` report was > 0 carries
+    // `waiting` (the switcher menu's amber ● N); never-visited hosts (no
+    // view) and zero counts omit the field. The menu refetches on every
+    // open, so this open-time snapshot needs no subscription.
+    const servers = hostInfos(loadHosts(userDataDir())).map((info) => {
+      const view = getView(views, info.id);
+      return view !== null && view.badgeCount > 0
+        ? { ...info, waiting: view.badgeCount }
+        : info;
+    });
+    return { ok: true, servers };
   });
 
   ipcMain.handle("servers:switch", (event, id: unknown): IpcResult => {
@@ -1198,6 +1224,21 @@ function registerIpcHandlers(): void {
     return openAddHost();
   });
 
+  // servers:reorder — move-by-id ({id, toIndex}); a full-array payload would
+  // trust renderer-supplied order, so only the immutable id + target index
+  // cross the bridge. List order IS the native menu's accelerator map, so a
+  // committed move rebuilds the menu to re-derive the ⌥⌘1–9/⇧Ctrl+1–9
+  // bindings. An unknown id is the store's no-op convention (still ok — the
+  // rebuild is harmless), not an error.
+  ipcMain.handle("servers:reorder", (event, payload: unknown): IpcResult => {
+    if (!isHostsSender(event)) return { ok: false, error: "Not allowed" };
+    const parsed = parseReorderPayload(payload);
+    if (!parsed) return { ok: false, error: "Invalid request" };
+    moveHost(userDataDir(), parsed.id, parsed.toIndex);
+    rebuildMenu();
+    return { ok: true };
+  });
+
   // badge:* — the SPA's waiting-agent count report, gated exactly like
   // `servers:*` (registered host origins + welcome). Structurally validated:
   // only a non-negative integer reaches the OS badge surface. Counts are
diff --git a/app/desktop/src/preload.ts b/app/desktop/src/preload.ts
index 82d1b3d47..f6245b36a 100644
--- a/app/desktop/src/preload.ts
+++ b/app/desktop/src/preload.ts
@@ -5,8 +5,8 @@
  *   - `version` / `platform`: readable by EVERY page (including pages loaded
  *     from registered rk servers) — this is the SPA's shell-detection seam
  *     (`app/frontend/src/lib/shell.ts`).
- *   - `servers`: list/switch/add invokers for the SPA command palette and
- *     titlebar-strip host switcher. The group
+ *   - `servers`: list/switch/add/reorder invokers for the SPA command
+ *     palette and titlebar-strip host switcher. The group
  *     name and its `servers:*` channels are the web SPA's contract and keep
  *     their server naming (the entries are hosts — rk instances — shell-side).
  *     Privileged for registered host origins AND the welcome page — main.ts
@@ -48,6 +48,8 @@ contextBridge.exposeInMainWorld("runkitShell", {
     list: (): Promise<unknown> => ipcRenderer.invoke("servers:list"),
     switch: (id: string): Promise<unknown> => ipcRenderer.invoke("servers:switch", id),
     add: (): Promise<unknown> => ipcRenderer.invoke("servers:add"),
+    reorder: (id: string, toIndex: number): Promise<unknown> =>
+      ipcRenderer.invoke("servers:reorder", { id, toIndex }),
   },
   badge: {
     set: (count: number): Promise<unknown> => ipcRenderer.invoke("badge:set", count),
diff --git a/app/frontend/src/components/shell-titlebar-strip.test.tsx b/app/frontend/src/components/shell-titlebar-strip.test.tsx
index b76f892aa..66689e221 100644
--- a/app/frontend/src/components/shell-titlebar-strip.test.tsx
+++ b/app/frontend/src/components/shell-titlebar-strip.test.tsx
@@ -45,9 +45,15 @@ function accentValue(overrides: Partial<InstanceAccent> = {}): InstanceAccent {
 
 /** Install a bridge whose `servers.list` resolves the given list (`null` =
  *  rejected call, i.e. an older shell / denial). `withAdd` includes the
- *  optional `add` invoker (newer shells — drives the `+ Add Host…` footer).
- *  Returns the list/switch/add spies for call-count and payload assertions. */
-function shellBridge(servers: unknown[] | null, platform = "darwin", withAdd = false) {
+ *  optional `add` invoker (newer shells — drives the `+ Add Host…` footer);
+ *  `withReorder` includes the optional `reorder` invoker (drives the drag
+ *  grip + ⌥↑/⌥↓ move). Returns the spies for call-count/payload assertions. */
+function shellBridge(
+  servers: unknown[] | null,
+  platform = "darwin",
+  withAdd = false,
+  withReorder = false,
+) {
   const list = vi.fn(() =>
     servers === null
       ? Promise.reject(new Error("ipc gone"))
@@ -55,12 +61,18 @@ function shellBridge(servers: unknown[] | null, platform = "darwin", withAdd = f
   );
   const switchFn = vi.fn(() => Promise.resolve({ ok: true }));
   const add = vi.fn(() => Promise.resolve({ ok: true }));
+  const reorder = vi.fn(() => Promise.resolve({ ok: true }));
   window.runkitShell = {
     version: "1.2.3",
     platform,
-    servers: withAdd ? { list, switch: switchFn, add } : { list, switch: switchFn },
+    servers: {
+      list,
+      switch: switchFn,
+      ...(withAdd ? { add } : {}),
+      ...(withReorder ? { reorder } : {}),
+    },
   };
-  return { list, switch: switchFn, add };
+  return { list, switch: switchFn, add, reorder };
 }
 
 function renderStrip(accent: InstanceAccent = accentValue()) {
@@ -82,8 +94,13 @@ const hosts = [
 
 /** Render with a populated bridge and wait for the mount fetch to enable the
  *  switcher trigger. */
-async function renderInteractive(list: unknown[] = hosts, platform = "darwin", withAdd = false) {
-  const bridge = shellBridge(list, platform, withAdd);
+async function renderInteractive(
+  list: unknown[] = hosts,
+  platform = "darwin",
+  withAdd = false,
+  withReorder = false,
+) {
+  const bridge = shellBridge(list, platform, withAdd, withReorder);
   renderStrip();
   await waitFor(() => {
     expect(screen.getByRole("button", { name: "Switch host" })).toBeInTheDocument();
@@ -447,3 +464,200 @@ describe("ShellTitlebarStrip host switcher (260731-4bqi)", () => {
     });
   });
 });
+
+describe("ShellTitlebarStrip host menu — accent bars, waiting counts, reorder (1i7j)", () => {
+  const coloredHosts = [
+    { id: "a", name: "studio-mac", url: "http://a:3000", active: true, accentColor: "#8b7ff0" },
+    { id: "b", name: "lab", url: "http://b:3000", active: false },
+    { id: "c", name: "buildbox", url: "http://c:3000", active: false, accentColor: "#4a4468" },
+  ];
+
+  it("renders the accent edge bar for hosts with a color, none for colorless rows", async () => {
+    await renderInteractive(coloredHosts);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    const rows = screen.getAllByRole("menuitemradio");
+    const barA = rows[0].querySelector("[data-testid='shell-host-accent-bar']");
+    expect(barA).not.toBeNull();
+    expect((barA as HTMLElement).style.backgroundColor).toBe("rgb(139, 127, 240)");
+    expect(rows[1].querySelector("[data-testid='shell-host-accent-bar']")).toBeNull();
+    const barC = rows[2].querySelector("[data-testid='shell-host-accent-bar']");
+    expect((barC as HTMLElement).style.backgroundColor).toBe("rgb(74, 68, 104)");
+    // The bar overlays the left edge — the row content keeps its alignment.
+    expect(rows[1].textContent).toContain("lab");
+    expect(rows[1].textContent).toContain("http://b:3000");
+  });
+
+  it("renders no bar for a non-hex accentColor (never reaches style interpolation)", async () => {
+    await renderInteractive([
+      { id: "a", name: "evil", url: "http://a:3000", active: true, accentColor: "javascript:alert(1)" },
+    ]);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    expect(screen.queryByTestId("shell-host-accent-bar")).not.toBeInTheDocument();
+  });
+
+  it("renders the amber waiting chip on background rows only, before the hint", async () => {
+    await renderInteractive([
+      { id: "a", name: "studio-mac", url: "http://a:3000", active: true, waiting: 2 },
+      { id: "b", name: "lab", url: "http://b:3000", active: false, waiting: 3 },
+      { id: "c", name: "quiet", url: "http://c:3000", active: false },
+    ]);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    const rows = screen.getAllByRole("menuitemradio");
+    // Active row: the count is suppressed (the dock badge is its surface).
+    expect(rows[0].textContent).not.toContain("●");
+    // Background row: amber ● N between the origin and the accelerator hint.
+    expect(rows[1].textContent).toContain("● 3");
+    const chip = screen.getByText("● 3");
+    expect(chip.className).toContain("text-amber-600");
+    expect(rows[1].textContent?.indexOf("● 3")).toBeLessThan(
+      rows[1].textContent?.indexOf("⌥⌘2") ?? Infinity,
+    );
+    // Absent count renders nothing extra.
+    expect(rows[2].textContent).not.toContain("●");
+  });
+
+  it("⌥↑ moves the focused row with one invoke per press, live hint re-numbering, focus follows", async () => {
+    const four = [
+      { id: "a", name: "alpha", url: "http://a:3000", active: true },
+      { id: "b", name: "beta", url: "http://b:3000", active: false },
+      { id: "c", name: "gamma", url: "http://c:3000", active: false },
+      { id: "d", name: "delta", url: "http://d:3000", active: false },
+    ];
+    const bridge = await renderInteractive(four, "darwin", false, true);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    let rows = screen.getAllByRole("menuitemradio");
+    await waitFor(() => {
+      expect(document.activeElement).toBe(rows[0]); // active row seeded
+    });
+    fireEvent.keyDown(document, { key: "ArrowDown" }); // focus beta (index 1)
+    expect(document.activeElement).toBe(rows[1]);
+    fireEvent.keyDown(document, { key: "ArrowUp", altKey: true });
+    expect(bridge.reorder).toHaveBeenCalledTimes(1);
+    expect(bridge.reorder).toHaveBeenCalledWith("b", 0);
+    // Optimistic local reorder: beta first, hints re-numbered.
+    rows = screen.getAllByRole("menuitemradio");
+    expect(rows[0].textContent).toContain("beta");
+    expect(rows[0].textContent).toContain("⌥⌘1");
+    expect(rows[1].textContent).toContain("alpha");
+    expect(rows[1].textContent).toContain("⌥⌘2");
+    // Focus stays on the moved row.
+    expect(document.activeElement).toBe(rows[0]);
+    expect(rows[0]).toHaveAttribute("tabindex", "0");
+  });
+
+  it("⌥↑/⌥↓ at the list edges is a no-op (no invoke, no wrap, key swallowed)", async () => {
+    const bridge = await renderInteractive(hosts, "darwin", false, true);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    const rows = screen.getAllByRole("menuitemradio");
+    await waitFor(() => {
+      expect(document.activeElement).toBe(rows[0]);
+    });
+    // First row, move up: swallowed, no invoke (fireEvent false = preventDefaulted).
+    expect(fireEvent.keyDown(document, { key: "ArrowUp", altKey: true })).toBe(false);
+    expect(bridge.reorder).not.toHaveBeenCalled();
+    expect(screen.getAllByRole("menuitemradio")[0].textContent).toContain("studio-mac");
+    // Last row, move down: same.
+    fireEvent.keyDown(document, { key: "ArrowDown" }); // focus lab (index 1)
+    expect(fireEvent.keyDown(document, { key: "ArrowDown", altKey: true })).toBe(false);
+    expect(bridge.reorder).not.toHaveBeenCalled();
+  });
+
+  it("⌥↑/⌥↓ on the Add-Host footer falls through to the roving cycle (footer not movable)", async () => {
+    const bridge = await renderInteractive(hosts, "darwin", true, true);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    const rows = screen.getAllByRole("menuitemradio");
+    const footer = screen.getByRole("menuitem", { name: "Add Host…" });
+    await waitFor(() => {
+      expect(document.activeElement).toBe(rows[0]);
+    });
+    fireEvent.keyDown(document, { key: "ArrowUp" }); // wrap to footer
+    expect(document.activeElement).toBe(footer);
+    fireEvent.keyDown(document, { key: "ArrowDown", altKey: true }); // roves, never moves
+    expect(bridge.reorder).not.toHaveBeenCalled();
+    expect(document.activeElement).toBe(rows[0]);
+  });
+
+  it("without the reorder capability, ⌥↑/⌥↓ fall through to today's roving focus (no grips)", async () => {
+    await renderInteractive(hosts); // no reorder invoker
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    const rows = screen.getAllByRole("menuitemradio");
+    await waitFor(() => {
+      expect(document.activeElement).toBe(rows[0]);
+    });
+    expect(screen.queryByText("⋮⋮")).not.toBeInTheDocument();
+    for (const row of rows) expect(row).toHaveAttribute("draggable", "false");
+    fireEvent.keyDown(document, { key: "ArrowDown", altKey: true });
+    expect(document.activeElement).toBe(rows[1]); // plain roving move
+  });
+
+  it("drag-drop commits exactly one reorder invocation with optimistic order", async () => {
+    const four = [
+      { id: "a", name: "alpha", url: "http://a:3000", active: true },
+      { id: "b", name: "beta", url: "http://b:3000", active: false },
+      { id: "c", name: "gamma", url: "http://c:3000", active: false },
+      { id: "d", name: "delta", url: "http://d:3000", active: false },
+    ];
+    const bridge = await renderInteractive(four, "darwin", false, true);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    // Grips render (hover-revealed) and rows are draggable.
+    expect(screen.getAllByText("⋮⋮")).toHaveLength(4);
+    const rows = screen.getAllByRole("menuitemradio");
+    for (const row of rows) expect(row).toHaveAttribute("draggable", "true");
+    const dataTransfer = {
+      setData: vi.fn(),
+      types: ["application/x-shell-host-reorder"],
+      effectAllowed: "",
+      dropEffect: "",
+    };
+    // Drag row 4 (delta) onto row 1 (alpha) — insert-before → index 0.
+    fireEvent.dragStart(rows[3], { dataTransfer });
+    expect(dataTransfer.setData).toHaveBeenCalledWith("application/x-shell-host-reorder", "d");
+    fireEvent.dragOver(rows[0], { dataTransfer });
+    fireEvent.drop(rows[0], { dataTransfer });
+    fireEvent.dragEnd(rows[3], { dataTransfer });
+    expect(bridge.reorder).toHaveBeenCalledTimes(1);
+    expect(bridge.reorder).toHaveBeenCalledWith("d", 0);
+    // Optimistic order renders with re-numbered hints.
+    const reordered = screen.getAllByRole("menuitemradio");
+    expect(reordered[0].textContent).toContain("delta");
+    expect(reordered[0].textContent).toContain("⌥⌘1");
+    expect(reordered[1].textContent).toContain("alpha");
+  });
+
+  it("a denied drag-drop reorder surfaces the error toast and refetches the list", async () => {
+    const bridge = await renderInteractive(hosts, "darwin", false, true);
+    bridge.reorder.mockResolvedValue({ ok: false });
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    expect(bridge.list).toHaveBeenCalledTimes(2); // mount + open refetch
+    const rows = screen.getAllByRole("menuitemradio");
+    const dataTransfer = {
+      setData: vi.fn(),
+      types: ["application/x-shell-host-reorder"],
+      effectAllowed: "",
+      dropEffect: "",
+    };
+    fireEvent.dragStart(rows[1], { dataTransfer });
+    fireEvent.dragOver(rows[0], { dataTransfer });
+    fireEvent.drop(rows[0], { dataTransfer });
+    await waitFor(() => {
+      expect(screen.getByText("Shell host reorder failed")).toBeInTheDocument();
+    });
+    expect(bridge.list).toHaveBeenCalledTimes(3); // failure refetch reconciles
+  });
+
+  it("older-shell degradation: a plain 4-field projection renders today's menu with no affordances", async () => {
+    // list/switch only (no add, no reorder), entries without accentColor/waiting.
+    await renderInteractive(hosts);
+    fireEvent.click(screen.getByRole("button", { name: "Switch host" }));
+    const rows = screen.getAllByRole("menuitemradio");
+    expect(rows).toHaveLength(2);
+    expect(rows[0].textContent).toContain("✓");
+    expect(rows[0].textContent).toContain("⌥⌘1");
+    expect(rows[1].textContent).toContain("⌥⌘2");
+    expect(screen.queryByTestId("shell-host-accent-bar")).not.toBeInTheDocument();
+    expect(screen.queryByText("⋮⋮")).not.toBeInTheDocument();
+    expect(screen.queryByText(/●/)).not.toBeInTheDocument();
+    for (const row of rows) expect(row).toHaveAttribute("draggable", "false");
+    expect(screen.queryByRole("menuitem", { name: "Add Host…" })).not.toBeInTheDocument();
+  });
+});
diff --git a/app/frontend/src/components/shell-titlebar-strip.tsx b/app/frontend/src/components/shell-titlebar-strip.tsx
index dc055f17e..66913e2d6 100644
--- a/app/frontend/src/components/shell-titlebar-strip.tsx
+++ b/app/frontend/src/components/shell-titlebar-strip.tsx
@@ -3,7 +3,15 @@ import { useInstanceAccent } from "@/contexts/instance-accent-context";
 import { useTheme } from "@/contexts/theme-context";
 import { Tip } from "@/components/tip";
 import { useToast } from "@/components/toast";
-import { addShellHost, canAddShellHost, listShellServers, shellInfo, switchShellServer } from "@/lib/shell";
+import {
+  addShellHost,
+  canAddShellHost,
+  canReorderShellHosts,
+  listShellServers,
+  reorderShellHosts,
+  shellInfo,
+  switchShellServer,
+} from "@/lib/shell";
 import type { ShellServer } from "@/lib/shell";
 import {
   activeShellHostName,
@@ -14,6 +22,7 @@ import {
   stripLabelColor,
   stripSwitcherEnabled,
 } from "@/lib/shell-strip";
+import type { ShellHostMenuRow } from "@/lib/shell-strip";
 
 /**
  * Desktop-shell titlebar strip (260731-ofws): a 28px full-width draggable
@@ -50,7 +59,23 @@ import {
  * in add mode (`servers:add` → the same main-side path as the native
  * `Hosts → Add Host…` menu item). Older shells without the invoker render
  * the menu without the footer.
+ *
+ * Three additive, independently capability-gated row features (1i7j): a
+ * ~3px left-edge bar in the host's persisted accent color (hex-validated in
+ * the row model), an amber `● N` waiting-agent count on BACKGROUND rows
+ * (the active host's attention surface is the dock badge), and manual
+ * reorder — a hover drag grip (commit-on-drop) plus ⌥↑/⌥↓ while the menu is
+ * open (one move per keypress). Order IS the ⌥⌘1–9/⇧Ctrl+1–9 accelerator
+ * map, so reordering re-numbers the hints live; the shell rebuilds its
+ * native menu on each committed move. All three ride the optional
+ * `reorder` invoker / additive projection fields — an older shell renders
+ * exactly the plain marker/name/origin/hint rows.
  */
+
+/** Custom MIME so a host-reorder drag never collides with the other
+ *  drag-reorder payloads (server/session/board-list). */
+const HOST_REORDER_MIME = "application/x-shell-host-reorder";
+
 export function ShellTitlebarStrip() {
   const { titlebarHex } = useInstanceAccent();
   const { theme } = useTheme();
@@ -108,6 +133,9 @@ export function ShellTitlebarStrip() {
   // The `+ Add Host…` footer rides the optional `servers.add` invoker — older
   // shells expose only list/switch and render the menu without it.
   const canAdd = canAddShellHost();
+  // The reorder affordances (drag grip, ⌥↑/⌥↓) ride the optional
+  // `servers.reorder` invoker — an older shell renders plain rows.
+  const canReorder = canReorderShellHosts();
 
   // Latest COMMITTED host-row count, read live inside the capture-phase
   // keydown handler: that handler stays attached from a commit until the
@@ -121,6 +149,104 @@ export function ShellTitlebarStrip() {
     hostCountRef.current = rows.length;
   }, [rows.length]);
 
+  // Live copy of the derived rows for the reorder gestures (the keydown
+  // handler's subscription can lag a reorder commit the same way it lags a
+  // count change — the ref always reads the committed order).
+  const rowsRef = useRef<ShellHostMenuRow[]>([]);
+  useLayoutEffect(() => {
+    rowsRef.current = rows;
+  });
+
+  // One committed shell invocation per gesture; a denial/failure surfaces
+  // the toast precedent and refetches so the list reconciles with the store.
+  const commitReorder = useCallback(
+    (id: string, toIndex: number) => {
+      void reorderShellHosts(id, toIndex).then((ok) => {
+        if (!ok) {
+          addToast("Shell host reorder failed", "error");
+          fetchServers();
+        }
+      });
+    },
+    [addToast, fetchServers],
+  );
+
+  // Shared move commit (⌥↑/⌥↓ per keypress): the local list reorders
+  // OPTIMISTICALLY so the accelerator hints re-number immediately, and the
+  // roving-tabindex seat follows the moved row (DOM focus follows on its
+  // own — the row's keyed element moves with it).
+  const moveHostRow = useCallback(
+    (from: number, to: number) => {
+      const row = rowsRef.current[from];
+      if (!row) return;
+      setServers((prev) => {
+        if (!prev) return prev;
+        const next = [...prev];
+        const [moved] = next.splice(from, 1);
+        next.splice(to, 0, moved);
+        return next;
+      });
+      setFocusedIndex(to);
+      commitReorder(row.id, to);
+    },
+    [commitReorder],
+  );
+
+  // Drag-grip reorder (the board-tile/session-reorder precedent): the local
+  // order reorders optimistically during the drag (presentation state — the
+  // open-time refetch reconciles), and exactly ONE reorder invocation
+  // commits at drop, keyed on the immutable host id.
+  const dragIdRef = useRef<string | null>(null);
+
+  const onRowDragStart = useCallback((e: React.DragEvent, id: string) => {
+    dragIdRef.current = id;
+    e.dataTransfer.setData(HOST_REORDER_MIME, id);
+    e.dataTransfer.effectAllowed = "move";
+  }, []);
+
+  const onRowDragOver = useCallback((e: React.DragEvent, targetId: string) => {
+    const dragId = dragIdRef.current;
+    if (!dragId || !e.dataTransfer.types.includes(HOST_REORDER_MIME)) return;
+    // Accept the drop BEFORE the self-target bail: the final dragover lands
+    // on the dragged row's own element, and only a preventDefaulted dragover
+    // registers the release as a drop.
+    e.preventDefault();
+    e.dataTransfer.dropEffect = "move";
+    if (dragId === targetId) return;
+    // Resolve indexes by id INSIDE the functional updater: React can batch
+    // several dragover updates before a commit refreshes `rowsRef`, so
+    // ref-derived indexes could be stale relative to the `prev` being spliced.
+    setServers((prev) => {
+      if (!prev) return prev;
+      const from = prev.findIndex((s) => s.id === dragId);
+      const to = prev.findIndex((s) => s.id === targetId);
+      if (from === -1 || to === -1 || from === to) return prev;
+      const next = [...prev];
+      const [moved] = next.splice(from, 1);
+      next.splice(to, 0, moved);
+      return next;
+    });
+  }, []);
+
+  const onRowDrop = useCallback(
+    (e: React.DragEvent) => {
+      const dragId = dragIdRef.current;
+      if (!dragId || !e.dataTransfer.types.includes(HOST_REORDER_MIME)) return;
+      e.preventDefault();
+      dragIdRef.current = null;
+      // The optimistic dragover splices already landed the row at its drop
+      // position — commit exactly that index.
+      const to = rowsRef.current.findIndex((r) => r.id === dragId);
+      if (to === -1) return;
+      commitReorder(dragId, to);
+    },
+    [commitReorder],
+  );
+
+  const onRowDragEnd = useCallback(() => {
+    dragIdRef.current = null;
+  }, []);
+
   // An open-time refetch can EMPTY the list: the trigger and menu unmount
   // (interactive flips false) while `open` would otherwise stay true, leaving
   // the capture-phase key handling subscribed with nothing visible. Release
@@ -142,8 +268,9 @@ export function ShellTitlebarStrip() {
   }, [open]);
 
   // Escape closes + refocuses the trigger; ArrowDown/ArrowUp move focus with
-  // wraparound (capture-phase, mirroring BreadcrumbDropdown). Enter needs no
-  // handler — the focused row is a native <button>.
+  // wraparound (capture-phase, mirroring BreadcrumbDropdown). With the
+  // reorder capability, ⌥↑/⌥↓ instead MOVES the focused host row. Enter
+  // needs no handler — the focused row is a native <button>.
   useEffect(() => {
     if (!open) return;
     function handleKey(e: KeyboardEvent) {
@@ -167,12 +294,28 @@ export function ShellTitlebarStrip() {
         if (hostCount === 0) return;
         e.preventDefault();
         e.stopPropagation();
+        const delta = e.key === "ArrowDown" ? 1 : -1;
+        // ⌥↑/⌥↓ moves the focused HOST row (all platforms — arrows compose
+        // no characters): one committed move per keypress, hints re-number
+        // live via the optimistic reorder. The Add-Host footer is NOT
+        // movable — Alt-arrows there (and ALL Alt-arrows on an older shell
+        // without the capability) fall through to the roving cycle. No wrap
+        // at the list edges: a move past either end swallows the key
+        // without invoking the shell.
+        if (e.altKey && canReorder) {
+          const from = itemRefs.current.findIndex((el) => el === document.activeElement);
+          if (from >= 0 && from < hostCount) {
+            const to = from + delta;
+            if (to < 0 || to >= hostCount) return;
+            moveHostRow(from, to);
+            return;
+          }
+        }
         // The roving set spans the host rows PLUS the Add-Host footer when
         // the bridge carries it — the footer is the last stop in the arrow
         // cycle. The modulus derives from the same live read, so a
         // shrunk-but-non-empty list also cycles over the live count.
         const count = hostCount + (canAdd ? 1 : 0);
-        const delta = e.key === "ArrowDown" ? 1 : -1;
         setFocusedIndex((prev) => {
           const next = (prev + delta + count) % count;
           itemRefs.current[next]?.focus();
@@ -182,7 +325,7 @@ export function ShellTitlebarStrip() {
     }
     document.addEventListener("keydown", handleKey, { capture: true });
     return () => document.removeEventListener("keydown", handleKey, { capture: true });
-  }, [open, rows.length, canAdd]);
+  }, [open, rows.length, canAdd, canReorder, moveHostRow]);
 
   // Focus lands on the active row on open.
   useEffect(() => {
@@ -303,12 +446,31 @@ export function ShellTitlebarStrip() {
                   aria-checked={row.active}
                   tabIndex={focusedIndex === i ? 0 : -1}
                   onClick={() => selectHost(row.id)}
-                  className={`flex w-full items-baseline gap-2 px-3 py-2 text-left text-sm transition-colors ${
+                  draggable={canReorder}
+                  onDragStart={(e) => onRowDragStart(e, row.id)}
+                  onDragOver={(e) => onRowDragOver(e, row.id)}
+                  onDrop={onRowDrop}
+                  onDragEnd={onRowDragEnd}
+                  className={`group relative flex w-full items-baseline gap-2 py-2 pl-3 text-left text-sm transition-colors ${
+                    canReorder ? "pr-6" : "pr-3"
+                  } ${
                     row.active
                       ? "text-accent"
                       : "text-text-secondary hover:bg-bg-card hover:text-text-primary"
                   }`}
                 >
+                  {/* Accent edge bar — absolutely overlaid on the row's left
+                      edge so a colorless row keeps identical alignment. The
+                      row model hex-validated the value (no interpolation of
+                      unvalidated strings). */}
+                  {row.accentColor !== null && (
+                    <span
+                      aria-hidden="true"
+                      data-testid="shell-host-accent-bar"
+                      className="absolute bottom-1 left-0 top-1 w-[3px] rounded-full"
+                      style={{ backgroundColor: row.accentColor }}
+                    />
+                  )}
                   {/* Active marker column — fixed width so names align. */}
                   <span aria-hidden="true" className="w-3 shrink-0">
                     {row.active ? "✓" : ""}
@@ -317,13 +479,35 @@ export function ShellTitlebarStrip() {
                   {/* Dimmed origin — display names are not unique, the origin
                       disambiguates. */}
                   <span className="min-w-0 truncate text-xs opacity-60">{row.origin}</span>
+                  {/* Amber waiting-agent count — BACKGROUND hosts only (the
+                      row model nulls the active row's count; the dock badge
+                      is the active host's attention surface). Waiting-only
+                      semantics: 0/absent renders nothing. */}
+                  {row.waiting !== null && (
+                    <span className="ml-auto shrink-0 pl-2 text-xs text-amber-600">
+                      ● {row.waiting}
+                    </span>
+                  )}
                   {/* Trailing accelerator hint mirroring the native Hosts
                       menu bindings (⌥⌘1–9 mac / ⇧Ctrl+1–9 win-linux, 9-cap). */}
                   {row.hint && (
-                    <span className="ml-auto shrink-0 pl-2 text-xs text-text-secondary">
+                    <span
+                      className={`${row.waiting === null ? "ml-auto " : ""}shrink-0 pl-2 text-xs text-text-secondary`}
+                    >
                       {row.hint}
                     </span>
                   )}
+                  {/* Drag grip — hover-revealed at the row's trailing edge
+                      (the `pr-6` above reserves its width). Visual affordance
+                      only; the row itself is the draggable. */}
+                  {canReorder && (
+                    <span
+                      aria-hidden="true"
+                      className="pointer-events-none absolute right-1.5 top-1/2 -translate-y-1/2 text-[10px] leading-none tracking-[-2px] text-text-secondary opacity-0 transition-opacity group-hover:opacity-60"
+                    >
+                      ⋮⋮
+                    </span>
+                  )}
                 </button>
               ))}
               {canAdd && (
diff --git a/app/frontend/src/lib/shell-strip.test.ts b/app/frontend/src/lib/shell-strip.test.ts
index 905cc88aa..f8c04b243 100644
--- a/app/frontend/src/lib/shell-strip.test.ts
+++ b/app/frontend/src/lib/shell-strip.test.ts
@@ -85,8 +85,8 @@ describe("shellHostMenuRows", () => {
       "darwin",
     );
     expect(rows).toEqual([
-      { id: "a", name: "studio-mac", origin: "http://a:3000", active: true, hint: "⌥⌘1" },
-      { id: "b", name: "gcp-box", origin: "http://b:3000", active: false, hint: "⌥⌘2" },
+      { id: "a", name: "studio-mac", origin: "http://a:3000", active: true, hint: "⌥⌘1", accentColor: null, waiting: null },
+      { id: "b", name: "gcp-box", origin: "http://b:3000", active: false, hint: "⌥⌘2", accentColor: null, waiting: null },
     ]);
   });
 
@@ -126,3 +126,39 @@ describe("stripSwitcherEnabled", () => {
     expect(stripSwitcherEnabled([a])).toBe(true);
   });
 });
+
+describe("shellHostMenuRows accentColor / waiting", () => {
+  const base = { id: "a", name: "studio-mac", url: "http://a:3000", active: false };
+
+  it("passes a valid hex accentColor through (#RGB / #RRGGBB / #RRGGBBAA)", () => {
+    for (const hex of ["#fff", "#8b7ff0", "#8b7ff0cc", "#ABC"]) {
+      const [row] = shellHostMenuRows([{ ...base, accentColor: hex }], "darwin");
+      expect(row.accentColor).toBe(hex);
+    }
+  });
+
+  it("nulls a non-hex accentColor (never reaches style interpolation)", () => {
+    for (const bad of ["javascript:alert(1)", "red", "#12345", "8b7ff0", "#gggggg"]) {
+      const [row] = shellHostMenuRows([{ ...base, accentColor: bad }], "darwin");
+      expect(row.accentColor).toBeNull();
+    }
+  });
+
+  it("nulls accentColor when the field is absent (older shell)", () => {
+    const [row] = shellHostMenuRows([base], "darwin");
+    expect(row.accentColor).toBeNull();
+    expect(row.waiting).toBeNull();
+  });
+
+  it("carries a positive waiting count on a background row", () => {
+    const [row] = shellHostMenuRows([{ ...base, waiting: 3 }], "darwin");
+    expect(row.waiting).toBe(3);
+  });
+
+  it("suppresses waiting on the active row and on zero/absent counts", () => {
+    const [active] = shellHostMenuRows([{ ...base, active: true, waiting: 2 }], "darwin");
+    expect(active.waiting).toBeNull();
+    const [zero] = shellHostMenuRows([{ ...base, waiting: 0 }], "darwin");
+    expect(zero.waiting).toBeNull();
+  });
+});
diff --git a/app/frontend/src/lib/shell-strip.ts b/app/frontend/src/lib/shell-strip.ts
index 8e59aeb76..63bd1fb99 100644
--- a/app/frontend/src/lib/shell-strip.ts
+++ b/app/frontend/src/lib/shell-strip.ts
@@ -82,6 +82,12 @@ export interface ShellHostMenuRow {
   active: boolean;
   /** Accelerator hint mirroring the native Hosts menu, or null past the cap. */
   hint: string | null;
+  /** The host's instance accent color (left-edge bar), hex-validated — null
+   *  when absent or not a strict hex value (never interpolated unvalidated). */
+  accentColor: string | null;
+  /** Cached waiting-agent count (amber ● N), or null — background rows only
+   *  (the active host's attention surface is the dock badge). */
+  waiting: number | null;
 }
 
 /** The entry's origin for display: the store persists origins already, so
@@ -94,10 +100,17 @@ function hostOrigin(url: string): string {
   }
 }
 
+/** Strict hex gate before style interpolation — the shell-side
+ *  `fallbackStripCss` precedent: `#RGB` / `#RRGGBB` / `#RRGGBBAA` only. */
+const HOST_ACCENT_HEX = /^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
+
 /**
  * Menu rows for the host-switcher dropdown, derived from the bridge's
- * `servers:list` projection (`{id, name, url, active}` — no bridge change
- * needed). List order is preserved (it is the native menu's binding order).
+ * `servers:list` projection. List order is preserved (it is the native
+ * menu's binding order). The additive `accentColor` passes through only when
+ * it hex-validates; `waiting` rides along only when positive and the row is
+ * NOT active (background hosts only). Both are null on older shells, whose
+ * projection omits the fields.
  */
 export function shellHostMenuRows(servers: ShellServer[], platform: string): ShellHostMenuRow[] {
   return servers.map((s, i) => ({
@@ -106,6 +119,10 @@ export function shellHostMenuRows(servers: ShellServer[], platform: string): She
     origin: hostOrigin(s.url),
     active: s.active,
     hint: hostAcceleratorHint(platform, i),
+    accentColor: s.accentColor !== undefined && HOST_ACCENT_HEX.test(s.accentColor)
+      ? s.accentColor
+      : null,
+    waiting: !s.active && s.waiting !== undefined && s.waiting > 0 ? s.waiting : null,
   }));
 }
 
diff --git a/app/frontend/src/lib/shell.test.ts b/app/frontend/src/lib/shell.test.ts
index 2fbbbe577..0a1a4e311 100644
--- a/app/frontend/src/lib/shell.test.ts
+++ b/app/frontend/src/lib/shell.test.ts
@@ -2,8 +2,10 @@ import { describe, it, expect, afterEach } from "vitest";
 import {
   addShellHost,
   canAddShellHost,
+  canReorderShellHosts,
   isShell,
   listShellServers,
+  reorderShellHosts,
   setShellBadge,
   shellInfo,
   switchShellServer,
@@ -255,3 +257,101 @@ describe("setShellBadge", () => {
     expect(await setShellBadge(1)).toBe(false);
   });
 });
+
+// accentColor / waiting are ADDITIVE optionals on the servers:list entries
+// (cross-version shells omit them): absence always parses; a wrong-typed
+// present field rejects the list.
+
+describe("listShellServers optional fields", () => {
+  it("parses a newer shell's accentColor/waiting and an older shell's 4-field entries", async () => {
+    bridgeWith({
+      list: () =>
+        Promise.resolve({
+          ok: true,
+          servers: [
+            { ...serverA, accentColor: "#8b7ff0", waiting: 3 },
+            serverB, // older-shell shape: both optionals absent
+          ],
+        }),
+      switch: () => Promise.resolve({ ok: true }),
+    });
+    expect(await listShellServers()).toEqual([
+      { ...serverA, accentColor: "#8b7ff0", waiting: 3 },
+      serverB,
+    ]);
+  });
+
+  it("resolves null when a present optional is wrong-typed", async () => {
+    bridgeWith({
+      list: () =>
+        Promise.resolve({ ok: true, servers: [{ ...serverA, accentColor: 42 }] }),
+      switch: () => Promise.resolve({ ok: true }),
+    });
+    expect(await listShellServers()).toBeNull();
+    bridgeWith({
+      list: () =>
+        Promise.resolve({ ok: true, servers: [{ ...serverA, waiting: "3" }] }),
+      switch: () => Promise.resolve({ ok: true }),
+    });
+    expect(await listShellServers()).toBeNull();
+  });
+});
+
+// The reorder invoker is ADDITIVE to the servers group (older shells expose
+// only list/switch/add): canReorderShellHosts gates the strip's reorder
+// affordances on its presence, and reorderShellHosts degrades exactly like
+// its siblings — false for plain browser, pre-reorder shells, a non-function
+// member, denial, and rejected invokes.
+
+describe("canReorderShellHosts / reorderShellHosts", () => {
+  it("resolves true on an { ok: true } ack when the group carries reorder", async () => {
+    let seen: { id: string; toIndex: number } | null = null;
+    bridgeWith({
+      list: () => Promise.resolve({ ok: true, servers: [] }),
+      switch: () => Promise.resolve({ ok: true }),
+      reorder: (id: string, toIndex: number) => {
+        seen = { id, toIndex };
+        return Promise.resolve({ ok: true });
+      },
+    });
+    expect(canReorderShellHosts()).toBe(true);
+    expect(await reorderShellHosts("b", 0)).toBe(true);
+    expect(seen).toEqual({ id: "b", toIndex: 0 });
+  });
+
+  it("reads as unavailable in a plain browser and on a shell without reorder (older shell)", async () => {
+    expect(canReorderShellHosts()).toBe(false);
+    expect(await reorderShellHosts("a", 0)).toBe(false);
+    bridgeWith({
+      list: () => Promise.resolve({ ok: true, servers: [serverA, serverB] }),
+      switch: () => Promise.resolve({ ok: true }),
+    });
+    expect(canReorderShellHosts()).toBe(false);
+    expect(await reorderShellHosts("a", 0)).toBe(false);
+  });
+
+  it("reads as unavailable when reorder is not a function", async () => {
+    bridgeWith({
+      list: () => Promise.resolve({ ok: true, servers: [] }),
+      switch: () => Promise.resolve({ ok: true }),
+      reorder: "servers:reorder",
+    });
+    expect(canReorderShellHosts()).toBe(false);
+    expect(await reorderShellHosts("a", 0)).toBe(false);
+  });
+
+  it("resolves false on a denied result and on a rejected invoke", async () => {
+    bridgeWith({
+      list: () => Promise.resolve({ ok: true, servers: [] }),
+      switch: () => Promise.resolve({ ok: true }),
+      reorder: () => Promise.resolve({ ok: false, error: "Not allowed" }),
+    });
+    expect(await reorderShellHosts("a", 0)).toBe(false);
+    bridgeWith({
+      list: () => Promise.resolve({ ok: true, servers: [] }),
+      switch: () => Promise.resolve({ ok: true }),
+      reorder: () => Promise.reject(new Error("ipc gone")),
+    });
+    expect(await reorderShellHosts("a", 0)).toBe(false);
+  });
+});
diff --git a/app/frontend/src/lib/shell.ts b/app/frontend/src/lib/shell.ts
index de3f257b9..a07843a7b 100644
--- a/app/frontend/src/lib/shell.ts
+++ b/app/frontend/src/lib/shell.ts
@@ -24,6 +24,12 @@ export interface ShellServer {
   name: string;
   url: string;
   active: boolean;
+  /** The host's persisted instance accent color (newer shells; absent on
+   *  older shells and for never-visited hosts). */
+  accentColor?: string;
+  /** The host's cached waiting-agent count (newer shells; absent when the
+   *  host has no live view or a zero count). */
+  waiting?: number;
 }
 
 /** The bridge's `servers` group — thin IPC invokers resolving unknown shapes. */
@@ -37,6 +43,11 @@ interface ShellServersAddBridge extends ShellServersBridge {
   add: () => Promise<unknown>;
 }
 
+/** A `servers` group that also carries the optional `reorder` invoker (newer shells). */
+interface ShellServersReorderBridge extends ShellServersBridge {
+  reorder: (id: string, toIndex: number) => Promise<unknown>;
+}
+
 declare global {
   interface Window {
     /** Injected by the desktop shell's preload; absent in plain browsers. */
@@ -89,7 +100,12 @@ function isShellServer(value: unknown): value is ShellServer {
     typeof value.id === "string" &&
     typeof value.name === "string" &&
     typeof value.url === "string" &&
-    typeof value.active === "boolean"
+    typeof value.active === "boolean" &&
+    // Optional fields are strict-when-present: the response comes from our
+    // own shell, which omits fields rather than mistyping them — absence is
+    // always valid (older shells), a wrong-typed present field rejects.
+    (!("accentColor" in value) || typeof value.accentColor === "string") &&
+    (!("waiting" in value) || typeof value.waiting === "number")
   );
 }
 
@@ -172,6 +188,44 @@ export async function addShellHost(): Promise<boolean> {
   );
 }
 
+/**
+ * The `reorder` invoker is additive to the `servers` group (shells older
+ * than the host-switcher's drag/⌥↑⌥↓ reorder expose only list/switch/add),
+ * so it is narrowed separately from `isServersBridge` — the group stays
+ * usable without it.
+ */
+function isServersReorderBridge(
+  bridge: ShellServersBridge,
+): bridge is ShellServersReorderBridge {
+  return "reorder" in bridge && typeof Reflect.get(bridge, "reorder") === "function";
+}
+
+/** True when the shell can reorder its host list (`servers.reorder` present). */
+export function canReorderShellHosts(): boolean {
+  const bridge = serversBridge();
+  return bridge !== null && isServersReorderBridge(bridge);
+}
+
+/**
+ * Move a host to `toIndex` in the shell's host list — the switcher menu's
+ * order IS the ⌥⌘1–9/⇧Ctrl+1–9 accelerator map, so the shell rebuilds its
+ * native menu on commit. Resolves `false` in a plain browser, on an older
+ * shell whose `servers` group lacks the `reorder` invoker, or when the shell
+ * rejects/denies the call. Never throws.
+ */
+export async function reorderShellHosts(id: string, toIndex: number): Promise<boolean> {
+  const bridge = serversBridge();
+  if (!bridge || !isServersReorderBridge(bridge)) return false;
+  let result: unknown;
+  try {
+    result = await bridge.reorder(id, toIndex);
+  } catch {
+    return false;
+  }
+  return (
+    typeof result === "object" && result !== null && "ok" in result && result.ok === true
+  );
+}
 /** The bridge's `badge` group — thin IPC invoker resolving unknown shapes. */
 interface ShellBadgeBridge {
   set: (count: number) => Promise<unknown>;
diff --git a/docs/memory/run-kit/desktop-shell.md b/docs/memory/run-kit/desktop-shell.md
index 4501f8efd..4294fef3e 100644
--- a/docs/memory/run-kit/desktop-shell.md
+++ b/docs/memory/run-kit/desktop-shell.md
@@ -59,7 +59,7 @@ Package tests run via `node --test "dist/**/*.test.js"` after compile — the st
   "version": 1,
   "activeId": "b3f1…",
   "hosts": [
-    { "id": "<randomUUID>", "name": "studio-mac", "url": "http://100.101.2.3:3000", "lastPath": "/utils2/rk-dev?x=1" },
+    { "id": "<randomUUID>", "name": "studio-mac", "url": "http://100.101.2.3:3000", "lastPath": "/utils2/rk-dev?x=1", "accentColor": "#8b7ff0" },
     { "id": "<randomUUID>", "name": "buildbox", "url": "http://127.0.0.1:3100", "remote": "buildbox" }
   ]
 }
@@ -69,14 +69,15 @@ Package tests run via `node --test "dist/**/*.test.js"` after compile — the st
 - **Origin normalization**: `url` is stored as `new URL(input).origin` — only `http:`/`https:` accepted; anything else (ftp:, file:, garbage) is a validation error and is never persisted. Path/query/case in the input are dropped by the origin reduction.
 - **`lastPath` is optional and additive**: the SPA-route remainder (`pathname + search`) last seen for that host, at schema **version 1** — the field carries no version bump because absence is a valid state.
 - **`remote` is optional and additive too**: the `rk remote` name of an SSH-only host (§ SSH Remote Hosts), also at schema **version 1**. `url` stays required and real for these entries — the stable local tunnel origin `http://127.0.0.1:<port>` — so an older shell reads the entry as a plain URL host and shows the normal dead-host state when the tunnel is down. That acceptable degradation is why the field is additive rather than a v2 bump, which would empty the whole host list into welcome on an older shell. `addHost(dir, name, urlInput, remote?)` persists it only when the trimmed value is non-empty.
+- **`accentColor` is optional and additive too**: the host's instance accent color — the `theme-color`-meta value its view reports — persisted so the host-switcher's edge bar survives cold start (§ Hidden Titlebar & Accent Strip). Same version-1 additive shape: absence is a valid state, and a host never visited has no color.
 - **Atomic write**: tmp-file-then-rename in the same directory (`hosts.json.tmp-<pid>` → `hosts.json`).
-- **Corrupt → empty, with per-field tolerance on the optional fields**: a missing, unreadable, corrupt, or wrong-shape file loads as an empty list without throwing — the required shape is structurally validated (`version === 1`, `activeId` string-or-null, `hosts` an array, and `id`/`name`/`url` strings on every entry), and any violation there rejects the whole file. The two optional fields, `lastPath` and `remote`, are the tolerant ones: absent → the entry loads unchanged, a string → kept, any other type → the field is dropped and the entry (and file) still loads. Startup routes to welcome only on the empty-list outcome.
+- **Corrupt → empty, with per-field tolerance on the optional fields**: a missing, unreadable, corrupt, or wrong-shape file loads as an empty list without throwing — the required shape is structurally validated (`version === 1`, `activeId` string-or-null, `hosts` an array, and `id`/`name`/`url` strings on every entry), and any violation there rejects the whole file. The three optional fields — `lastPath`, `remote`, and `accentColor` — are the tolerant ones: absent → the entry loads unchanged, a string → kept, any other type → the field is dropped and the entry (and file) still loads. Startup routes to welcome only on the empty-list outcome.
 - **Active resolution**: `resolveActiveHost` returns the `activeId` entry, falls back to the **first** host when `activeId` dangles, `null` when the list is empty. `addHost` sets the new entry active (empty display name defaults to the origin); removing the active host promotes the first remaining entry.
 - **Origin ownership**: `findHostByOrigin(list, origin)` answers "which entry owns this origin" — `addHost` never dedupes, so several entries can share one origin; the **active** entry wins among the matches, else the first match, else `null`. Its one caller is the local-connect dedupe (§ Local Daemon Control), which asks whether the just-probed local origin is already registered before adding a second entry for it. Last-path capture does not use this rule — it keys on the view's host id (§ Last-Path Capture & Restore) — so the active-wins tiebreak serves only that dedupe, which never has a meaningful tie to break. The tiebreak nuance is a recorded deletion candidate; the function itself stays.
-- **Per-host mutators, all `id`-keyed**: `setActiveHost(dir, id)` and `setHostLastPath(dir, id, lastPath)` share one shape — load → membership guard (unknown `id` is a no-op that writes nothing) → patch → atomic `saveHosts`. `setHostLastPath` additionally short-circuits an *unchanged* value, because capture runs on every switch/add/close and the fast path should not rewrite an identical file. Per-host state (`lastPath`, the `activeId` linkage) keys on the immutable `id` and never on the display name — names are not unique, and `addHost` mints a fresh `randomUUID`, so anything id-keyed is scoped to exactly one registration.
+- **Per-host mutators, all `id`-keyed**: `setActiveHost(dir, id)`, `setHostLastPath(dir, id, lastPath)`, and `setHostAccentColor(dir, id, accentColor)` share one shape — load → membership guard (unknown `id` is a no-op that writes nothing) → patch → atomic `saveHosts`. `setHostLastPath` and `setHostAccentColor` additionally short-circuit an *unchanged* value, because capture runs on every switch/add/close (last path) or every theme-color report (accent), and the fast path should not rewrite an identical file. `moveHost(dir, id, toIndex)` is the array-move variant behind `servers:reorder`: remove the entry and re-insert at `toIndex` clamped to `[0, hosts.length - 1]`, with an unknown id or a same-index move a no-op that writes nothing; `activeId` and every other field are untouched — only array order changes, and order is user-meaningful (it IS the ⌥⌘1–9/⇧Ctrl+1–9 accelerator map, § Keyboard-Tier Menu Seam). Per-host state (`lastPath`, `accentColor`, the `activeId` linkage) keys on the immutable `id` and never on the display name — names are not unique, and `addHost` mints a fresh `randomUUID`, so anything id-keyed is scoped to exactly one registration.
 - **Display names are set once, at add-time**: the persisted `name` is whatever the caller passes (the health ping's `hostname`, in every real flow), with the origin as the blank-input fallback. The store exposes no name mutator — changing a display name means removing the entry and re-adding it (§ Design Decisions → Names auto-derive at add-time; there is no rename affordance).
 - **Electron-free**: the data directory is a parameter (`main.ts` passes `app.getPath('userData')`), keeping the module unit-testable under plain `node --test`.
-- **IPC projection**: `hostInfos(list)` is the read-only projection to the `{ id, name, url, active }[]` shape the `servers:list` channel returns (§ Bridge — that channel keeps its server naming as the frozen SPA contract). `active` is derived via `resolveActiveHost`, so a dangling `activeId` flags the **first** host — the same fallback startup would load — and an empty list projects to `[]`.
+- **IPC projection**: `hostInfos(list)` is the read-only projection to the `{ id, name, url, active, accentColor? }[]` shape the `servers:list` channel returns (§ Bridge — that channel keeps its server naming as the frozen SPA contract). `active` is derived via `resolveActiveHost`, so a dangling `activeId` flags the **first** host — the same fallback startup would load — and an empty list projects to `[]`. The optional `accentColor` rides along when the entry carries one (absent entries omit the field — never `null`/empty-string). The `HostInfo` wire type also declares an optional `waiting?: number`, which `hostInfos` NEVER fills — this module is store-pure, and the view-registry badge-count join happens in the `servers:list` handler in `main.ts` (§ Bridge).
 
 ## Startup Routing & Welcome Flow
 
@@ -196,7 +197,7 @@ Call sites are exactly the two moments a route would otherwise be lost: the main
 
 The window has **no native titlebar**: the page's top edge is the visible titlebar. `titleBarStyle` is `"hiddenInset"` on darwin (traffic lights composite over the page-drawn band) and `"hidden"` elsewhere plus a `titleBarOverlay: { color, symbolColor, height: STRIP_HEIGHT_PX }` so the native `─ ▢ ✕` controls draw over the band's right end. `STRIP_HEIGHT_PX = 28` is one value shared by the overlay height and the SPA's strip, so the controls composite over the strip exactly. The overlay always renders **above** an attached host view, which is why views can take the full content bounds. This is a *strip*, not a titlebar merge — the SPA's top bar is untouched below it, and the merge stays possible on the same foundation.
 
-**The SPA draws the strip; the shell provides no color API.** The band is a 28px accent-tinted band the SPA renders above its top bar, gated on `isShell()` (see [ui-patterns](/run-kit/ui-patterns.md) § Desktop-Shell Titlebar Strip). Because the strip owns the titlebar band reservation, the SPA's top bar drops its `pt-[env(safe-area-inset-top)]` safe-area guard in-shell (`isShell()`-gated): macOS hidden-titlebar windows can report the band as `safe-area-inset-top`, and stacking that padding on the strip would reserve the band twice ([ui-patterns](/run-kit/ui-patterns.md) § Safe-Area Insets; `260805-9hn1`). The band is a drag surface with **exactly one** no-drag island: its centered host-name label is the SPA's host-switcher dropdown trigger, which hands off to `switchToHost` through the existing `servers.switch` channel — a renderer-side feature that needs no shell change (§ Design Decisions → The titlebar is colored by a page-drawn strip). The shell's only color seam is the page's **existing `theme-color` meta**: each view's `did-change-theme-color` records the observed color **into that view's registry cache** and repaints the overlay only when that view is the attached one — a background host re-accenting must not tint the window. `applyOverlayColor(color)` is the one painting helper: non-darwin calls `win.setTitleBarOverlay({ color, symbolColor: symbolColorFor(color), height })`; macOS returns early (traffic lights are OS-drawn and take no color); a throwing call degrades silently, since Linux window-controls-overlay support is partial. Because that meta is already accent-aware end-to-end — including the pre-paint localStorage echo in `index.html` — the native controls tint with the instance accent without a single new IPC channel. `symbolColorFor` is a pure WCAG-luminance pick between the two standard text hexes (`#e5e7eb` light / `#111827` dark; unparseable input reads as dark).
+**The SPA draws the strip; the shell provides no color API.** The band is a 28px accent-tinted band the SPA renders above its top bar, gated on `isShell()` (see [ui-patterns](/run-kit/ui-patterns.md) § Desktop-Shell Titlebar Strip). Because the strip owns the titlebar band reservation, the SPA's top bar drops its `pt-[env(safe-area-inset-top)]` safe-area guard in-shell (`isShell()`-gated): macOS hidden-titlebar windows can report the band as `safe-area-inset-top`, and stacking that padding on the strip would reserve the band twice ([ui-patterns](/run-kit/ui-patterns.md) § Safe-Area Insets; `260805-9hn1`). The band is a drag surface with **exactly one** no-drag island: its centered host-name label is the SPA's host-switcher dropdown trigger, which hands off to `switchToHost` through the existing `servers.switch` channel — a renderer-side feature that needs no shell change (§ Design Decisions → The titlebar is colored by a page-drawn strip). The shell's only color seam is the page's **existing `theme-color` meta**: each view's `did-change-theme-color` records the observed color **into that view's registry cache**, persists it to the host entry's `accentColor` via `setHostAccentColor` (non-null reports only — a `null` report leaves the stored value untouched, and the dev sentinel view matches no entry, so the mutator's membership guard silently covers it), and repaints the overlay only when that view is the attached one — a background host re-accenting must not tint the window. Persistence is what makes the host-switcher's per-host edge bars correct at cold start and for hosts visited in a previous run but not yet this one (§ Design Decisions → Accent color persists in hosts.json). `applyOverlayColor(color)` is the one painting helper: non-darwin calls `win.setTitleBarOverlay({ color, symbolColor: symbolColorFor(color), height })`; macOS returns early (traffic lights are OS-drawn and take no color); a throwing call degrades silently, since Linux window-controls-overlay support is partial. Because that meta is already accent-aware end-to-end — including the pre-paint localStorage echo in `index.html` — the native controls tint with the instance accent without a single new IPC channel. `symbolColorFor` is a pure WCAG-luminance pick between the two standard text hexes (`#e5e7eb` light / `#111827` dark; unparseable input reads as dark).
 
 **A switch repaints the overlay from the incoming view's cache**, so the accent flips with the host at switch speed rather than waiting for the new page to re-report — a view that never reported one (and the welcome page) paints `DEFAULT_STRIP_COLOR`.
 
@@ -307,7 +308,7 @@ The sandboxed preload exposes exactly one bridge via `contextBridge.exposeInMain
 
 - **`version`** — the shell app version, read from the `--runkit-shell-version=` argv entry (passed via `webPreferences.additionalArguments`, since sandboxed preloads read `process.argv` but cannot call `app.getVersion()`).
 - **`platform`** — `process.platform`.
-- **`servers`** — `{ list(), switch(id) }`, thin invokers for the `servers:list` / `servers:switch` channels; the SPA command palette's switch path. **This group name, its two channel names, and the `servers` key inside the `servers:list` success envelope are a frozen contract** — they keep their server naming even though the entries they carry are hosts (§ Design Decisions → The SPA bridge boundary keeps its server naming).
+- **`servers`** — `{ list(), switch(id), add(), reorder(id, toIndex) }`, thin invokers for the `servers:*` channels; the SPA command palette's switch path and the titlebar-strip host switcher (its `+ Add Host…` footer and drag/⌥↑⌥↓ reorder ride the `add`/`reorder` invokers). **This group name, the channel names, and the `servers` key inside the `servers:list` success envelope are a frozen contract** — they keep their server naming even though the entries they carry are hosts (§ Design Decisions → The SPA bridge boundary keeps its server naming).
 - **`badge`** — `{ set(count) }`, a thin invoker for the `badge:set` channel; the SPA's waiting-agent-count report driving the dock/taskbar badge (§ Dock/Taskbar Waiting Badge).
 - **`__welcome`** — `{ testHost(url), addHost(name, url), cancel() }`, thin `ipcRenderer.invoke` wrappers for the `welcome:*` channels.
 - **`__daemon`** — `{ status(), start(), stop() }`, thin wrappers for the three `daemon:*` channels behind the welcome page's "This Mac" section. All three are argument-less: every parameter the flows need (the origin, the name, the dedupe target) is derived main-side, so the renderer hands over no payload at all.
@@ -323,9 +324,9 @@ The sandboxed preload exposes exactly one bridge via `contextBridge.exposeInMain
 | `servers:*` | registered host origins (the pages that serve the SPA palette) **plus** the welcome page | `isHostsSender` — delegates to `isAllowedNavigation`, the same set the navigation guard computes (so it also covers the `RK_DESKTOP_URL` dev origin) |
 | `badge:set` | registered host origins **plus** the welcome page | `isHostsSender` — the same gate as `servers:*`, reusing the one allowlist rather than computing a second |
 
-Any sender outside a channel's allowlist gets `{ ok: false, error: "Not allowed" }` and no state change — so a host-loaded page can read shell metadata, switch hosts, and set the badge, but never invoke a `welcome:*` call, and **never reach a `daemon:*` channel** (a subprocess-spawning surface: the gate is what keeps a page loaded from a registered host origin from starting or stopping the daemon). `servers:list` answers the discriminated `{ ok: true, servers: HostInfo[] } | { ok: false, error }` envelope — the `servers` key is part of the frozen contract, the payload type is host-named; `servers:switch` rejects a non-string payload as `"Invalid request"` and an unregistered id as `"Unknown host"` without navigating (error text is not narrowed by the SPA). `badge:set` takes a non-negative **integer** and answers the bare `IpcResult` ack: a float, a negative, or a non-number is rejected `"Invalid request"` and never reaches the OS badge surface. `daemon:status` answers `{ ok: true, status: DaemonStatus } | { ok: false, error }`; `daemon:start` / `daemon:stop` answer the same bare `IpcResult` ack shape the `welcome:*` mutators use.
+Any sender outside a channel's allowlist gets `{ ok: false, error: "Not allowed" }` and no state change — so a host-loaded page can read shell metadata, switch hosts, and set the badge, but never invoke a `welcome:*` call, and **never reach a `daemon:*` channel** (a subprocess-spawning surface: the gate is what keeps a page loaded from a registered host origin from starting or stopping the daemon). `servers:list` answers the discriminated `{ ok: true, servers: HostInfo[] } | { ok: false, error }` envelope — the `servers` key is part of the frozen contract, the payload type is host-named — and its handler **joins the store projection with the view registry's cached badge counts**: a host with a live view whose last `badge:set` report was > 0 carries `waiting` (the switcher menu's amber ● N); never-visited hosts (no view) and zero counts omit the field. The menu refetches on every open, so this open-time snapshot needs no subscription. `servers:switch` rejects a non-string payload as `"Invalid request"` and an unregistered id as `"Unknown host"` without navigating (error text is not narrowed by the SPA). `servers:reorder` takes a structurally validated `{ id, toIndex }` payload (string id, non-negative integer index — anything else is `"Invalid request"`), moves the entry via `moveHost`, then calls `rebuildMenu()` because the native Hosts-menu ⌥⌘1–9/⇧Ctrl+1–9 accelerators derive from list order; an unknown id is still `{ ok: true }` — the store's no-op convention, the rebuild harmless — not an error (§ Design Decisions → Reorder is move-by-id). `badge:set` takes a non-negative **integer** and answers the bare `IpcResult` ack: a float, a negative, or a non-number is rejected `"Invalid request"` and never reaches the OS badge surface. `daemon:status` answers `{ ok: true, status: DaemonStatus } | { ok: false, error }`; `daemon:start` / `daemon:stop` answer the same bare `IpcResult` ack shape the `welcome:*` mutators use.
 
-**SPA side** (`app/frontend/src/lib/shell.ts`, the only SPA file the shell touches): `RunkitShell` interface (`{ version, platform }`), a `declare global` Window typing that types `runkitShell` as `unknown` (the bridge is runtime-injected, so it is validated structurally — type-narrowing guards, no `as` casts), `shellInfo()` returning a plain `{ version, platform }` (never leaking `__welcome`) or `null`, `isShell()`, the `servers`-group wrappers `listShellServers(): Promise<ShellServer[] | null>` / `switchShellServer(id): Promise<boolean>`, and the `badge`-group wrapper `setShellBadge(count): Promise<boolean>`. Every wrapper **never throws**: a plain browser, an older shell lacking the group, a malformed entry, an `{ ok: false }` denial, and a rejected invoke all resolve `null`/`false`. Covered by the sibling vitest suite `shell.test.ts` (present / absent / malformed shapes of each surface).
+**SPA side** (`app/frontend/src/lib/shell.ts`, the only SPA file the shell touches): `RunkitShell` interface (`{ version, platform }`), a `declare global` Window typing that types `runkitShell` as `unknown` (the bridge is runtime-injected, so it is validated structurally — type-narrowing guards, no `as` casts), `shellInfo()` returning a plain `{ version, platform }` (never leaking `__welcome`) or `null`, `isShell()`, the `servers`-group wrappers `listShellServers(): Promise<ShellServer[] | null>` / `switchShellServer(id): Promise<boolean>`, the additive capability pairs `canAddShellHost()`/`addShellHost()` and `canReorderShellHosts()`/`reorderShellHosts(id, toIndex): Promise<boolean>` (each invoker narrowed separately from the base group, so the group stays usable on shells that lack it), and the `badge`-group wrapper `setShellBadge(count): Promise<boolean>`. Every wrapper **never throws**: a plain browser, an older shell lacking the group, a malformed entry, an `{ ok: false }` denial, and a rejected invoke all resolve `null`/`false`. Covered by the sibling vitest suite `shell.test.ts` (present / absent / malformed shapes of each surface).
 
 Three SPA surfaces consume this seam today. The palette's shell-gated `Server: Switch to "<name>"` block gates on the `servers` group's own emptiness (`listShellServers()` resolving `null`/`[]` outside the shell) rather than calling `isShell()`, since an older shell exposes `version`/`platform` without the group (see [ui-patterns](/run-kit/ui-patterns.md) § Keyboard Shortcuts). The **titlebar strip** and the **badge reporter** mount on `isShell()` instead — they are shell-only *chrome*, so the shell's own presence is the honest gate, and each degrades independently inside it (the strip falls back to `location.hostname` when `servers.list()` is unavailable; `setShellBadge` resolves `false` on an older shell with no `badge` group). The welcome page's own script narrows the bridge the same structural way (`Reflect.get(window, "runkitShell")`, no global augmentation).
 
@@ -523,6 +524,12 @@ The vitest column of the split also covers `palette-shell.test.ts` (the palette-
 **Rejected**: A `titlebar:color` IPC channel (a second copy of state the meta already broadcasts, plus a gate and an ordering hazard); reading the meta tag from main via `executeJavaScript` (a poll or a race where the event is a push); passing the color through the URL or a query param (nothing to update it on a live accent change).
 *Introduced by*: 260731-ofws-shell-accent-titlebar-dock-badge
 
+### Accent color persists in hosts.json, not just the view registry
+**Decision**: Each host entry carries an additive optional `accentColor` (schema stays version 1), captured from the view's `did-change-theme-color` reports (non-null strings only, unchanged values short-circuited), rather than projecting the registry's session-scoped `themeColor` cache.
+**Why**: The registry cache dies with the window and never exists for hosts not yet visited this run; persistence makes the host-switcher's per-host edge bars correct at cold start — precisely when the menu is most needed to tell hosts apart.
+**Rejected**: Registry-only projection — colors would blank on every launch until each host is visited.
+*Introduced by*: 260813-1i7j-host-switcher-color-reorder-waiting
+
 ### The version-skew fallback strip is self-disabling CSS, not a probe
 **Decision**: `fallbackStripCss` is injected on **every** registered-host load, with all selectors keyed on `html:not(.rk-shell-strip)`; the SPA sets that marker class on `<html>` while its strip is mounted. The shell never asks the page whether it has a strip.
 **Why**: Hiding the native titlebar removes the window's only drag surface, so an older SPA under a newer shell would be undraggable — a genuine skew hazard, since shell and SPA ship on independent release trains. CSS is live, which makes the marker a *continuous* answer rather than a point-in-time one: whenever the real strip mounts (including after a slow hydration), the injected rules stop applying, with no timing window in either direction. A probe would have to pick a moment, and every candidate moment is wrong for some page.
@@ -619,6 +626,18 @@ The vitest column of the split also covers `palette-shell.test.ts` (the palette-
 **Rejected**: Bare-array success plus an object failure — two unrelated top-level shapes for one channel to narrow.
 *Introduced by*: 260730-9lez-shell-keyboard-tier-symmetry
 
+### Reorder is move-by-id (`{id, toIndex}`), committed per gesture
+**Decision**: One IPC channel `servers:reorder` carrying `{id, toIndex}`; each keyboard press (⌥↑/⌥↓) or drag-drop commits one move, and each committed move rebuilds the native menu because the Hosts-menu accelerators derive from list order.
+**Why**: Keys on the immutable host id (the store's id-keyed-mutator rule); a full-array payload would trust renderer-supplied order and need set-equality validation. Host list order IS the ⌥⌘1–9/⇧Ctrl+1–9 accelerator map, which is also why ordering is manual at all — alphabetical auto-sort would silently remap accelerators whenever a host is added or renamed.
+**Rejected**: `{order: id[]}` full-list replace — larger validation surface, and a stale renderer list would silently drop concurrently-added hosts.
+*Introduced by*: 260813-1i7j-host-switcher-color-reorder-waiting
+
+### Waiting count joins at the `servers:list` handler, not in `hostInfos`
+**Decision**: `hostInfos` (electron-free, store-only) never fills `waiting`; the `main.ts` handler joins the registry's per-view `badgeCount` caches into the projection (count > 0 → `waiting` set; no view or zero → field omitted).
+**Why**: Keeps `hosts.ts` electron-free and store-pure (the module boundary the whole test strategy rides on); the registry is main-side state.
+**Rejected**: Passing the registry into `hostInfos` — couples the store module to view state for a three-line join.
+*Introduced by*: 260813-1i7j-host-switcher-color-reorder-waiting
+
 ### Shared `switchToHost` seam in main
 **Decision**: The switch body (set active via the store → attach the host's view → rebuild menu) is one function called by the menu radio callback, the `servers:switch` handler, the local-connect tail, and the `welcome:add-host` handler.
 **Why**: The IPC switch must behave identically to clicking the radio; a shared function makes divergence structurally impossible instead of merely intended. The seam carries real complexity — view creation, attach/detach, badge and overlay repaint — which is exactly the kind of body that would drift across four call sites were each to keep its own copy.
diff --git a/docs/memory/run-kit/ui-patterns.md b/docs/memory/run-kit/ui-patterns.md
index 19563493e..0d02a0e8a 100644
--- a/docs/memory/run-kit/ui-patterns.md
+++ b/docs/memory/run-kit/ui-patterns.md
@@ -1832,15 +1832,17 @@ The instance accent's **third consumer surface**, and the only one that exists o
 
 **Host-switcher dropdown — the mouse-secondary switch path.** When the bridge answers a **non-empty** host list (`stripSwitcherEnabled(servers)`, a type guard) the label renders as a trigger button — `<active-host-name> ▾`, `aria-haspopup="menu"` / `aria-expanded`, `aria-label="Switch host"`, with a subtle currentColor-tinted hover pill (`hover:bg-current/15`, which reads on any accent-blended strip background since the label color is already contrast-derived against it) — reusing the top bar's `▾` switcher vocabulary (§ Crumb Affordance Vocabulary). It is the mouse-secondary companion to the ⌥⌘1–9 / ⇧Ctrl+1–9 accelerators and the palette's `Server: Switch to` block, which stay the primary paths (Constitution V). Below the gate — an older shell exposing only `version`/`platform`, a denial, or an empty store — the label is a plain static span with no chevron, no pill, and no click behavior; the band still mounts, because its gate is `isShell()` alone (§ Design Decisions → Shell chrome mounts on `isShell()`).
 
-**Row anatomy** (`shellHostMenuRows(servers, platform)` in `lib/shell-strip.ts`, list order preserved because that IS the native menu's binding order): a fixed-width ✓ marker column so names align, the active row in `text-accent`; the display name; the **dimmed origin** (`new URL(url).origin`, falling back to the raw string on a parse failure) — host display names are not unique because the shell's store never dedupes, so the origin disambiguates; and a trailing accelerator hint `⌥⌘{n}` on darwin / `⇧Ctrl+{n}` elsewhere, `null` past `MAX_SHELL_SWITCHER_HINTS = 9` (mirroring the native menu's `MAX_SWITCHER_ACCELERATORS` — a host with no binding gets no hint). Platform comes from the bridge's `shellInfo()?.platform`. Rows need no bridge change: `servers:list` already projects `{id, name, url, active}`.
+**Row anatomy** (`shellHostMenuRows(servers, platform)` in `lib/shell-strip.ts`, list order preserved because that IS the native menu's binding order): a fixed-width ✓ marker column so names align, the active row in `text-accent`; the display name; the **dimmed origin** (`new URL(url).origin`, falling back to the raw string on a parse failure) — host display names are not unique because the shell's store never dedupes, so the origin disambiguates; and a trailing accelerator hint `⌥⌘{n}` on darwin / `⇧Ctrl+{n}` elsewhere, `null` past `MAX_SHELL_SWITCHER_HINTS = 9` (mirroring the native menu's `MAX_SWITCHER_ACCELERATORS` — a host with no binding gets no hint). Platform comes from the bridge's `shellInfo()?.platform`. The row model also carries two additive, independently optional fields from the `servers:list` projection ([desktop-shell](/run-kit/desktop-shell.md) § Bridge): `accentColor: string | null` — the host's persisted instance accent, passed through only when it hex-validates against a strict `#RGB`/`#RRGGBB`/`#RRGGBBAA` pattern (the shell-side `fallbackStripCss` precedent — an unvalidated value never reaches style interpolation); and `waiting: number | null` — the view-registry-joined waiting-agent count, kept only when positive and the row is NOT active (the active host's attention surface is the dock badge). An older shell's plain `{id, name, url, active}` projection parses fine with both fields absent (`isShellServer` validates optionals strict-when-present) and derives `null`/`null`.
+
+**Three capability-gated row features render off that model.** A non-null `accentColor` paints a ~3px left-edge bar (`absolute bottom-1 left-0 top-1 w-[3px] rounded-full`, `aria-hidden`) overlaid on the row's edge, so a colorless row keeps identical text alignment. A non-null `waiting` renders an amber `● {N}` chip (`text-amber-600`) in the trailing `ml-auto` cluster before the accelerator hint — waiting-only semantics, `0`/absent renders nothing, matching the dock badge's "non-zero means act now" rule. **Manual reorder** rides the optional `reorder` invoker (`canReorderShellHosts()` / `reorderShellHosts(id, toIndex)` in `lib/shell.ts`, following the optional-invoker pattern exactly — separate structural narrowing of the additive bridge member, `false` outside the shell or on rejection, never throws): a hover-revealed drag grip (`⋮⋮`, trailing edge, width reserved by `pr-6` only when the capability is present) starts an HTML5 drag keyed on a custom MIME (`application/x-shell-host-reorder`, so it never collides with the sidebar/board drag payloads); the local order reorders optimistically during the drag (derive-over-store presentation state — the open-time refetch reconciles), and exactly ONE `reorderShellHosts(id, toIndex)` commits at drop, with a failure surfacing the error-toast precedent plus a refetch. With the menu open, ⌥↑/⌥↓ (Alt+ArrowUp/Down on ALL platforms — arrows compose no characters, so the macOS Option-composition issue does not apply) moves the focused row one step per keypress with the same optimistic reorder so the accelerator hints re-number live; focus follows the moved row, there is no wrap at the list edges (an edge move swallows the key without invoking the shell), and the Add-Host footer is not movable. Each committed move lands in the shell's store and rebuilds its native menu ([desktop-shell](/run-kit/desktop-shell.md) § `window.runkitShell` Bridge). Without the capability (older shell) no grips render and Alt+arrows fall through to the plain roving-focus cycle; all three features degrade independently, so an older shell renders exactly the marker/name/origin/hint rows.
 
 **Refetch on open, guarded by a monotonic sequence.** Every open issues a fresh `listShellServers()` — the native `Hosts → Remove "<name>"…` menu mutates the store without a page reload, so a mount-time-only list goes stale. One `listSeqRef` counter guards *both* fetches: a resolution whose sequence is not the latest issued is dropped, so out-of-order resolutions can never leave a stale list rendered, and the mount effect's cleanup bump doubles as cancellation (the open-time fetch has no effect cleanup to cancel it). A `null` resolution — the never-throw wrapper's denial signal — keeps the last known list rather than blanking an open menu.
 
-**Menu semantics copy `BreadcrumbDropdown`'s contract** (§ Breadcrumb Dropdowns): `role="menu"` with `role="menuitem"` rows, capture-phase keydown for Escape (close + refocus trigger) and ArrowDown/ArrowUp (wrapping roving tabindex; Enter needs no handler because each row is a native `<button>`), outside-`mousedown` close, and focus landing on the active row on open. The menu is a plain `absolute left-1/2 top-full` anchor — the strip has no `overflow: hidden` ancestor clipping below it, so no fixed-position machinery is needed — and it paints in theme surface colors (`bg-bg-primary`/`border-border`) rather than the strip's accent blend, because it overlays SPA content below the band. Three guards make an open-time refetch that changes the row count safe: the seed effect keys on the **open transition only** (re-running on a refetched set would yank focus mid-arrowing); a separate clamp effect keyed on `[open, rows.length]` re-seats the roving tabindex when a refetch *shrinks* the set below the current seat (an in-bounds seat is left alone, so an unchanged or growing list never moves focus); and the arrow branch's emptied-list guard reads the live committed row count from `hostCountRef` — a ref a `useLayoutEffect` keyed on `rows.length` writes at commit time — returning before `preventDefault` when it is 0, so even a stale capture-phase subscription still attached in the commit→passive-effect-flush window observes the zero and releases the key instead of swallowing arrows app-wide (a passive-effect ref write would flush in the same phase it is meant to beat); the wraparound modulus derives from the same live read, so a shrunk-but-non-empty refetched list also cycles over the committed count (§ Design Decisions → The emptied-list arrow guard reads the live row count from a commit-synced ref). A close-on-empty effect then releases `open` so the menu's effects tear down with it.
+**Menu semantics copy `BreadcrumbDropdown`'s contract** (§ Breadcrumb Dropdowns): `role="menu"` with `role="menuitem"` rows, capture-phase keydown for Escape (close + refocus trigger) and ArrowDown/ArrowUp (wrapping roving tabindex — Alt-modified arrows are intercepted for row moves instead when the reorder capability is present; Enter needs no handler because each row is a native `<button>`), outside-`mousedown` close, and focus landing on the active row on open. The menu is a plain `absolute left-1/2 top-full` anchor — the strip has no `overflow: hidden` ancestor clipping below it, so no fixed-position machinery is needed — and it paints in theme surface colors (`bg-bg-primary`/`border-border`) rather than the strip's accent blend, because it overlays SPA content below the band. Three guards make an open-time refetch that changes the row count safe: the seed effect keys on the **open transition only** (re-running on a refetched set would yank focus mid-arrowing); a separate clamp effect keyed on `[open, rows.length]` re-seats the roving tabindex when a refetch *shrinks* the set below the current seat (an in-bounds seat is left alone, so an unchanged or growing list never moves focus); and the arrow branch's emptied-list guard reads the live committed row count from `hostCountRef` — a ref a `useLayoutEffect` keyed on `rows.length` writes at commit time — returning before `preventDefault` when it is 0, so even a stale capture-phase subscription still attached in the commit→passive-effect-flush window observes the zero and releases the key instead of swallowing arrows app-wide (a passive-effect ref write would flush in the same phase it is meant to beat); the wraparound modulus derives from the same live read, so a shrunk-but-non-empty refetched list also cycles over the committed count (§ Design Decisions → The emptied-list arrow guard reads the live row count from a commit-synced ref). A close-on-empty effect then releases `open` so the menu's effects tear down with it.
 
 **Selection hands off to the shell, no optimistic UI.** Picking a row closes the menu and calls `switchShellServer(id)`; the shell's single `switchToHost` seam swaps the displayed host, so there is nothing to update optimistically and no SPA-side path handling exists. The swap is a detach/attach flip between per-host renderer views ([desktop-shell](/run-kit/desktop-shell.md) § Host Views), so this component instance simply stops being displayed — it keeps running, with its state intact, and is shown again unchanged when the user switches back. A `false` resolution surfaces an error toast (the palette's precedent), and selecting the already-active row is a harmless no-op — the same behavior the palette action and the native menu radios have, so all three switch paths behave identically.
 
-**Marker class + mount gating.** While mounted the component sets `rk-shell-strip` on `<html>` (a `useLayoutEffect`, removed on unmount) — the shell's version-skew fallback CSS is keyed on `html:not(.rk-shell-strip)` and self-disables against it ([desktop-shell](/run-kit/desktop-shell.md) § Hidden Titlebar & Accent Strip). `AppLayout` mounts the strip gated on `isShell()`, as a **sibling above** the top-bar wrapper — the top bar itself is untouched, which is the explicit contrast with a titlebar merge. `isShell()` is false in every browser and in Playwright, so **no e2e sees the strip or its dropdown**: the whole surface is covered by two colocated vitest suites — `lib/shell-strip.test.ts` for the pure helpers and `shell-titlebar-strip.test.tsx` for the component (rendered inside `ToastProvider`, asserting the gate branch, the open-time refetch call count, row anatomy, shrunk/emptied-list focus behavior, out-of-order resolutions, selection, and Escape/Arrow keys) — plus manual verification in the real shell. The band persists in macOS fullscreen (traffic lights auto-hide over it; no fullscreen bridge flag exists).
+**Marker class + mount gating.** While mounted the component sets `rk-shell-strip` on `<html>` (a `useLayoutEffect`, removed on unmount) — the shell's version-skew fallback CSS is keyed on `html:not(.rk-shell-strip)` and self-disables against it ([desktop-shell](/run-kit/desktop-shell.md) § Hidden Titlebar & Accent Strip). `AppLayout` mounts the strip gated on `isShell()`, as a **sibling above** the top-bar wrapper — the top bar itself is untouched, which is the explicit contrast with a titlebar merge. `isShell()` is false in every browser and in Playwright, so **no e2e sees the strip or its dropdown**: the whole surface is covered by two colocated vitest suites — `lib/shell-strip.test.ts` for the pure helpers and `shell-titlebar-strip.test.tsx` for the component (rendered inside `ToastProvider`, asserting the gate branch, the open-time refetch call count, row anatomy including the accent bar / waiting chip / drag grip, ⌥↑/⌥↓ moves with live hint re-numbering and edge no-ops, drop-commits-one-invoke, the older-shell degradation, shrunk/emptied-list focus behavior, out-of-order resolutions, selection, and Escape/Arrow keys) — plus manual verification in the real shell. The band persists in macOS fullscreen (traffic lights auto-hide over it; no fullscreen bridge flag exists).
 
 ### Desktop-Shell Waiting Badge Reporter (`components/shell-badge-reporter.tsx`)
 
@@ -3405,6 +3407,12 @@ The regression test in `app/frontend/src/hooks/use-dialog-state.test.tsx` flips
 **Rejected**: A shared accelerator module imported by all three (crosses the main/renderer boundary the shell's electron-free-module discipline maintains); deriving the display strings from the Electron syntax at runtime (a parser for three literals); collapsing the overlay's segmented array to a plain string so two of the three could share (loses the keycap rendering the overlay is built on). A future change to the binding tier must update all three deliberately — this entry is the pointer that names them.
 *Introduced by*: 260731-4bqi-shell-strip-host-switcher-dropdown
 
+### The host-switcher waiting chip surfaces background hosts only
+**Decision**: The dropdown's amber `● N` waiting chip derives from the `servers:list` projection's `waiting` field but is nulled on the ACTIVE row in `shellHostMenuRows` — only background hosts ever show a count.
+**Why**: The menu's job here is to make a background host's waiting agents visible BEFORE the user switches; the active host already has its attention surface — the dock/taskbar badge, which stays deliberately active-host-only ([desktop-shell](/run-kit/desktop-shell.md) § Dock/Taskbar Waiting Badge). Showing the count on the active row too would duplicate that signal inside the menu that already serves it.
+**Rejected**: Showing the count on every row including the active one (duplicates the dock badge on the one host whose count the user can already see); aggregating all hosts' counts into the dock badge instead (contradicts the badge's per-window identity claim — a recorded non-goal).
+*Introduced by*: 260813-1i7j-host-switcher-color-reorder-waiting
+
 ### Shell chrome mounts on `isShell()`; switch affordances gate on list emptiness
 **Decision**: The titlebar strip and the badge reporter are *mounted* from `AppLayout` behind `isShell()`. Every affordance that actually *switches* hosts — the shell server-switch palette block and the strip's own switcher trigger inside the mounted band — gates instead on `listShellServers()` resolving a non-empty list (`stripSwitcherEnabled`). The two gates nest: the band mounts on `isShell()`, its trigger appears on the list.
 **Why**: The gates answer different questions and both answers are right for their surface. A switch affordance asks "does the `servers` bridge group actually answer?" — an older shell exposes `version`/`platform` without the group, and offering a switch that cannot switch is worse than offering none. Window chrome asks "is this a shell window at all?" — the strip must exist whenever the native titlebar is hidden, even if `servers.list()` fails (the label falls back to `location.hostname`), and the reporter is harmless when the `badge` group is absent (`setShellBadge` resolves `false`). Splitting the strip's mount gate from its trigger gate is what lets both answers hold on one surface: a denied list degrades the band to a static label instead of removing the window's drag surface.
diff --git a/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/.history.jsonl b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/.history.jsonl
new file mode 100644
index 000000000..debd54194
--- /dev/null
+++ b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/.history.jsonl
@@ -0,0 +1,13 @@
+{"action":"enter","driver":"fab-new","event":"stage-transition","stage":"intake","ts":"2026-08-13T18:24:32Z"}
+{"args":"Desktop-shell host-switcher menu: per-host accent color edge bar, manual reorder (drag grip + Alt-arrow keyboard move), and per-host waiting counts in the titlebar-strip dropdown","cmd":"fab-new","event":"command","ts":"2026-08-13T18:24:32Z"}
+{"delta":"+4.5","event":"confidence","score":4.5,"trigger":"calc-score","ts":"2026-08-13T18:27:00Z"}
+{"cmd":"fab-switch","event":"command","ts":"2026-08-13T18:28:12Z"}
+{"cmd":"fab-fff","event":"command","ts":"2026-08-13T18:30:00Z"}
+{"action":"enter","driver":"fab-fff","event":"stage-transition","stage":"apply","ts":"2026-08-13T18:30:14Z"}
+{"action":"enter","driver":"fab-fff","event":"stage-transition","stage":"review","ts":"2026-08-13T18:57:23Z"}
+{"action":"enter","driver":"fab-fff","event":"stage-transition","stage":"hydrate","ts":"2026-08-13T19:03:14Z"}
+{"event":"review","result":"passed","ts":"2026-08-13T19:03:14Z"}
+{"action":"enter","driver":"fab-fff","event":"stage-transition","stage":"ship","ts":"2026-08-13T19:12:43Z"}
+{"action":"enter","driver":"git-pr","event":"stage-transition","stage":"review-pr","ts":"2026-08-13T19:16:51Z"}
+{"cmd":"git-pr-review","event":"command","ts":"2026-08-13T19:18:23Z"}
+{"event":"review","result":"passed","ts":"2026-08-13T19:29:36Z"}
diff --git a/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/.status.yaml b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/.status.yaml
new file mode 100644
index 000000000..9811f5681
--- /dev/null
+++ b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/.status.yaml
@@ -0,0 +1,57 @@
+id: 1i7j
+name: 260813-1i7j-host-switcher-color-reorder-waiting
+created: 2026-08-13T18:24:32Z
+created_by: sahil-noon
+change_type: feat
+issues: []
+progress:
+    intake: done
+    apply: done
+    review: done
+    hydrate: done
+    ship: done
+    review-pr: done
+plan:
+    generated: true
+    task_count: 15
+    acceptance_count: 26
+    acceptance_completed: 26
+confidence:
+    certain: 11
+    confident: 5
+    tentative: 0
+    unresolved: 0
+    score: 4.5
+    fuzzy: true
+    dimensions:
+        signal: 77.5
+        reversibility: 84.4
+        competence: 87.5
+        disambiguation: 83.1
+stage_metrics:
+    intake: {started_at: "2026-08-13T18:24:32Z", driver: fab-new, iterations: 1, completed_at: "2026-08-13T18:30:14Z"}
+    apply: {started_at: "2026-08-13T18:30:14Z", driver: fab-fff, iterations: 1, completed_at: "2026-08-13T18:57:23Z"}
+    review: {started_at: "2026-08-13T18:57:23Z", driver: fab-fff, iterations: 1, completed_at: "2026-08-13T19:03:14Z"}
+    hydrate: {started_at: "2026-08-13T19:03:14Z", driver: fab-fff, iterations: 1, completed_at: "2026-08-13T19:12:43Z"}
+    ship: {started_at: "2026-08-13T19:12:43Z", driver: fab-fff, iterations: 1, completed_at: "2026-08-13T19:16:51Z"}
+    review-pr: {started_at: "2026-08-13T19:16:51Z", driver: git-pr, iterations: 1, completed_at: "2026-08-13T19:29:36Z"}
+prs:
+    - https://github.com/sahil87/run-kit/pull/588
+change_type_source: explicit
+true_impact:
+    added: 1332
+    deleted: 38
+    net: 1294
+    excluding:
+        added: 852
+        deleted: 27
+        net: 825
+    tests:
+        added: 259
+        deleted: 2
+        net: 257
+    computed_at: "2026-08-13T19:16:51Z"
+    computed_at_stage: ship
+summary: 'Desktop shell: hosts.json accentColor field + moveHost mutator, servers:reorder IPC, servers:list waiting-count join; switcher menu accent edge bar, amber waiting chip, drag/Alt-arrow reorder'
+# true_impact: lazily created on first stage-finish that computes it (no placeholder here).
+last_updated: 2026-08-13T19:29:36Z
diff --git a/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/intake.md b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/intake.md
new file mode 100644
index 000000000..3437070c0
--- /dev/null
+++ b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/intake.md
@@ -0,0 +1,103 @@
+# Intake: Desktop-Shell Host-Switcher Menu — Per-Host Accent Color, Manual Reorder, Per-Host Waiting Counts
+
+**Change**: 260813-1i7j-host-switcher-color-reorder-waiting
+**Created**: 2026-08-13
+
+## Origin
+
+Promptless dispatch (`/fab-proceed` create-new, `{questioning-mode} = promptless-defer`) from a synthesized design-discussion capture. A visual mock was reviewed in that discussion and specific options were chosen; this intake records those decisions verbatim — no questions were asked at intake time, and every would-be question is a deferred Unresolved row in `## Assumptions`.
+
+> **Feature: Desktop-shell host-switcher menu — per-host accent color, manual reorder, and per-host waiting counts.** The Electron desktop shell's titlebar-strip host-switcher dropdown (`app/frontend/src/components/shell-titlebar-strip.tsx`, rows built by `shellHostMenuRows` in `app/frontend/src/lib/shell-strip.ts`, data via the `servers:list` bridge projection `hostInfos` in `app/desktop/src/hosts.ts` — currently `{id, name, url, active}`) gets three enhancements: (1) a ~3px left-edge bar per row in that host's instance accent color (mock option B); (2) manual reordering via a hover drag grip (option E) plus ⌥↑/⌥↓ keyboard move while the menu is open (option F), because host list order IS the ⌥⌘1–9 / ⇧Ctrl+1–9 accelerator map; (3) each background host's row shows its cached waiting-agent count as an amber `● N`.
+
+## Why
+
+1. **Pain point — rows are indistinguishable and order is arbitrary.** The dropdown today renders name + dimmed origin + accelerator hint. Hosts have per-instance accent identity everywhere else (each host's SPA tints its own titlebar strip via the `theme-color` meta), but the menu that switches between them carries none of it. And the list order is insertion order with no way to change it — yet **order IS the accelerator map**: ⌥⌘1–9 (mac) / ⇧Ctrl+1–9 (win/linux) bind by index over the hosts array, in both the native Hosts menu and the dropdown's trailing hints (`hostAcceleratorHint` in `shell-strip.ts`). A user cannot put their most-used host at ⌥⌘1.
+
+2. **Consequence of not fixing.** Multi-host users scan text to find the right row, the muscle-memory value of the digit accelerators stays locked to registration order, and "an agent is waiting on a background host" is invisible until the user switches there — the dock badge is deliberately active-host-only, so background hosts have no attention surface at all.
+
+3. **Why this approach.** All three legs ride existing machinery: the accent color is already observed per view (`did-change-theme-color` → `themeColor` cache in `app/desktop/src/views.ts`), the waiting count is already reported continuously per view (`badge:set` → `badgeCount` cache), and hosts.json already has the additive-optional-field pattern (`lastPath`) and the id-keyed mutator shape. Manual ordering (not auto-sort) is chosen precisely because order carries accelerator semantics — **alphabetical auto-sort was explicitly REJECTED** (it silently remaps accelerators when a host is added/renamed). Rejected color treatments: dot (A — implied by mock set), tinted name (C — collides with the "active row = accent-green text" convention), row wash (D — too loud, ambiguous hover). Option B rhymes with the strip itself, costs zero width, and doesn't conflict with the ✓ active-marker column.
+
+## What Changes
+
+### 1. Host color — left-edge bar (option B)
+
+- Each host row in the dropdown shows a **~3px left-edge bar** in that host's instance accent color — the same value that tints its titlebar strip (the SPA's `theme-color` meta, accent-blended).
+- **Persistence**: a new `accentColor` field in `hosts.json`, as an **additive optional field** exactly like `lastPath` — per-field tolerance: absent → entry loads unchanged; string → kept; wrong type → field dropped, entry still loads. **NO schema version bump** (`version` stays `1`; absence is a valid state).
+- **Capture**: shell-side, from each view's `did-change-theme-color` reports. The view registry (`app/desktop/src/views.ts`) already caches per-view `themeColor` via `setViewThemeColor` (wired at `main.ts` `contents.on("did-change-theme-color", …)`); persistence makes colors survive cold start and cover hosts not yet visited *in this run* but visited in a previous one. A host never visited at all has no color → no bar.
+- **Projection**: extend `hostInfos` / the `servers:list` payload to carry `accentColor` (optional string alongside `{id, name, url, active}`).
+- **Rendering**: `shellHostMenuRows` adds the color to `ShellHostMenuRow`; the strip component renders the bar. Hex-validate before style interpolation (the `fallbackStripCss` precedent in `app/desktop/src/strip.ts`); an invalid value renders no bar.
+- **Older-shell degradation**: the SPA renders no bar when the field is absent from the projection — mirrors the existing `canAddShellHost` optional-capability pattern in `app/frontend/src/lib/shell.ts`.
+
+### 2. Sorting — drag grip + keyboard move (options E and F together)
+
+Governing constraint (design-critical): **host list order IS the accelerator map**. Manual ordering is therefore a feature — the user puts their most-used host at ⌥⌘1. Alphabetical auto-sort explicitly REJECTED (silently remaps accelerators).
+
+- **E (mouse)**: a drag handle (grip) appears on row hover in the dropdown; drag to reorder — the sidebar session-reorder precedent in the SPA.
+- **F (keyboard)**: ⌥↑/⌥↓ (Alt+ArrowUp/ArrowDown) while the menu is open moves the focused row up/down; the ⌥⌘N hints re-number live as the row moves so the user sees the accelerator being assigned. The strip already has a capture-phase ArrowUp/ArrowDown roving-focus handler to extend. Alt-modified arrows don't hit the macOS Option-composes-characters issue since arrows compose nothing.
+- **Plumbing**:
+  - One new IPC channel — `servers:reorder` with a move-by-id shape <!-- assumed at Confident: name/payload left open in discussion; move-by-id `{id, toIndex}` follows the id-keyed mutator convention --> — exposed through the preload bridge (`app/desktop/src/preload.ts`, `window.runkitShell.servers`), sender-gated like every existing `servers:*` handler.
+  - An id-keyed array-move mutator in `app/desktop/src/hosts.ts` following the existing mutator shape: load → membership guard (unknown id is a no-op that writes nothing) → patch → atomic tmp-then-rename save.
+  - After a reorder the shell **must rebuild the native application menu** (accelerators derive from order); the rebuild-on-host-list-change seam already exists (`rebuildMenu()` in `main.ts`).
+- **Older-shell degradation**: no reorder invoker on the bridge → no grips, no ⌥↑/⌥↓ handling (same optional-invoker pattern as `canAddShellHost`).
+- **Optional/deferred supplement**: command-palette reorder commands were suggested as a discoverable supplement, but the user named only E and F — treat palette commands as optional/deferred (see Open Questions / Assumptions #16).
+
+### 3. Per-host waiting count
+
+Chosen from an "extras" set; the ssh tag and an unreachable ⚠ row state were mocked but **NOT selected**.
+
+- Each **background** host's row shows its cached waiting-agent count as an amber `● N` before the accelerator hint. **Waiting only** — matching the dock badge's "non-zero means act now" semantics (busy/idle never show).
+- Data already exists shell-side: every visited host's view continuously reports its waiting count via `badge:set`, cached per view in the view registry (`badgeCount`); today only the active view's count paints the dock. Extend the `servers:list` projection to include the cached count.
+- A never-visited host has no view → no count → the row shows nothing.
+- **The dock badge itself stays active-host-only** — cross-host aggregation there remains a deliberate non-goal.
+- **Projection join**: the projection currently reads only the hosts.json store; waiting counts live in the view registry in `main.ts` — the `servers:list` IPC handler joins the two (store list + registry `badgeCount` caches). Freshness: the menu refetches on every open (existing behavior), so an open-time snapshot of cached counts suffices.
+
+### Explicitly rejected / out of scope
+
+- Rename-host affordance (recorded design decision in desktop-shell memory: names auto-derive at add-time; remove+re-add is the path)
+- Alphabetical auto-sort
+- Color treatments A (dot) / C (tinted name) / D (row wash)
+- ssh tag on rows; unreachable ⚠ row state
+- Cross-host dock-badge aggregation
+- Command-palette reorder commands (deferred, not selected — see Assumptions)
+
+## Affected Memory
+
+- `run-kit/desktop-shell`: (modify) hosts.json gains the additive `accentColor` field (lastPath-style tolerance); new id-keyed reorder mutator; `hostInfos`/`servers:list` projection extended (accentColor + waiting count via registry join); new `servers:reorder` IPC channel + preload bridge entry; theme-color persistence seam; menu rebuild after reorder
+- `run-kit/ui-patterns`: (modify) titlebar-strip host-switcher dropdown — accent edge bar, amber waiting count, drag-grip + Alt-arrow reorder with live hint re-numbering, capability-gated degradation
+
+## Impact
+
+- `app/desktop/src/hosts.ts` (+ `hosts.test.ts`): `accentColor` field tolerance, reorder/move mutator, `hostInfos` projection changes
+- `app/desktop/src/main.ts`: accentColor capture/persist on `did-change-theme-color`, `servers:reorder` IPC handler + sender gating, `servers:list` projection join with view-registry badge counts, native-menu rebuild after reorder
+- `app/desktop/src/preload.ts`: bridge addition (reorder invoker; new projection fields ride the existing `servers:list`)
+- `app/frontend/src/lib/shell.ts` / `shell-strip.ts` (+ tests): `ShellServer` type extension, row model (color, waitingCount), capability detection for reorder
+- `app/frontend/src/components/shell-titlebar-strip.tsx` (+ `.test.tsx`): edge bar, waiting count, drag-grip reorder, ⌥↑/⌥↓ handling with live hint re-numbering
+- **Tests**: desktop modules run via `node --test` over compiled electron-free modules; frontend via Vitest (`just test-frontend`). The strip renders only inside the Electron shell, so Playwright e2e is not applicable (existing precedent: `shell-titlebar-strip.test.tsx` unit coverage).
+- No backend (Go) changes; no new routes; no database (Constitution II untouched — hosts.json is the desktop shell's own store, an established exception outside the rk server).
+
+## Open Questions
+
+- Should the command-palette reorder commands (the discoverable supplement to E/F) ship in this change, or be dropped/deferred to a follow-up? The user named only E and F; the palette supplement was left "optional/deferred". (Deferred — promptless dispatch; see Assumptions #16.)
+
+## Assumptions
+
+| # | Grade | Decision | Rationale | Scores |
+|---|-------|----------|-----------|--------|
+| 1 | Certain | Host color renders as a ~3px left-edge bar (mock option B), colored by the host's instance accent — the same `theme-color`-meta value that tints its titlebar strip | Discussed — user chose B over dot/tinted-name/row-wash with explicit rationale (rhymes with strip, zero width cost, no ✓-column conflict) | S:95 R:85 A:90 D:95 |
+| 2 | Certain | `accentColor` persists in hosts.json as an additive optional field with lastPath-style per-field tolerance (absent → unchanged, string → kept, wrong type → dropped, entry still loads); NO schema version bump | Discussed — plumbing decided verbatim; matches the established `lastPath`/`remote` additive-field pattern | S:95 R:80 A:95 D:95 |
+| 3 | Certain | Capture is shell-side from `did-change-theme-color` (view registry already caches per-view `themeColor`); persistence exists to survive cold start and cover previously-visited hosts; a never-visited host shows no bar | Discussed — capture seam named in the design; registry cache verified in views.ts/main.ts | S:90 R:80 A:90 D:90 |
+| 4 | Certain | The `hostInfos` / `servers:list` projection is extended to carry `accentColor` and the cached waiting count (no new list channel) | Discussed — "extend the hostInfos projection / servers:list payload"; projection verified at hosts.ts:237 | S:90 R:80 A:90 D:90 |
+| 5 | Certain | Reorder ships as drag grip on row hover (E) + Alt-arrow keyboard move while menu open (F); alphabetical auto-sort REJECTED because host list order IS the ⌥⌘1–9/⇧Ctrl+1–9 accelerator map | Discussed — user named E and F; governing constraint stated as design-critical | S:95 R:75 A:90 D:95 |
+| 6 | Certain | After a reorder the shell rebuilds the native application menu (accelerators derive from order) via the existing rebuild-on-host-list-change seam | Discussed — named explicitly; `rebuildMenu()` seam verified in main.ts | S:90 R:80 A:95 D:90 |
+| 7 | Certain | Waiting count shows on background host rows as amber `● N` before the accelerator hint, waiting-only semantics; dock badge stays active-host-only; never-visited host (no view) shows nothing | Discussed — chosen from the extras set with mock; aggregation non-goal restated | S:95 R:85 A:90 D:90 |
+| 8 | Certain | Older-shell degradation follows the optional-capability pattern: absent `accentColor` field → no bar; absent reorder invoker on the bridge → no grips, no Alt-arrow handling | Discussed — mirrors `canAddShellHost` precedent (shell.ts:149) | S:90 R:85 A:95 D:90 |
+| 9 | Certain | Out of scope: rename-host affordance, alphabetical auto-sort, color options A/C/D, ssh tag, unreachable ⚠ row state | Discussed — explicitly rejected list; rename rejection is already a recorded desktop-shell design decision | S:95 R:90 A:90 D:95 |
+| 10 | Confident | New IPC channel is `servers:reorder` with a move-by-id payload (`{id, toIndex}`), exposed under the preload `servers` group and sender-gated like existing `servers:*` handlers | Discussion left "`servers:reorder` or a move-by-id shape" open; move-by-id keys on the immutable id per the store's id-keyed-mutator rule; easily renamed pre-merge | S:60 R:85 A:85 D:70 |
+| 11 | Confident | The hosts.ts mutator follows the existing id-keyed shape (load → membership guard, unknown id no-op → array move → atomic tmp-then-rename save) with out-of-range target index clamped | Shape dictated by discussion + existing `setActiveHost`/`setHostLastPath` mutators; clamp behavior is my fill | S:60 R:85 A:90 D:70 |
+| 12 | Confident | Alt+ArrowUp/ArrowDown is the move chord on ALL platforms (not per-platform); each keypress commits one move (reorder invoke + live hint re-number); no wrap at list edges | Discussion gave mac notation only; Alt+arrows are safe cross-platform (no AltGr digit issue — arrows, not characters), and per-keypress commit is what makes hints re-number live | S:60 R:85 A:80 D:70 |
+| 13 | Confident | Drag reorder commits on drop — one reorder invocation per drag, local row order updated optimistically during the drag | Sidebar session-reorder precedent (derive-over-store, commit at drag end); reversible UI detail | S:55 R:85 A:75 D:65 |
+| 14 | Certain | `accentColor` persists only when the value actually changed (short-circuit identical writes), and the SPA hex-validates before style interpolation (no bar on invalid value) | Codebase precedent determines both: `setHostLastPath`'s unchanged-value short-circuit, `strip.ts` hex-validation before CSS interpolation | S:55 R:90 A:90 D:85 |
+| 15 | Certain | Test strategy: `node --test` over compiled electron-free desktop modules (hosts, views), Vitest for shell-strip/shell/component; NO Playwright e2e (strip renders only in-shell) | Config/context determine this — established split, `shell-titlebar-strip.test.tsx` precedent | S:70 R:90 A:95 D:90 |
+| 16 | Unresolved | Command-palette reorder commands (discoverable supplement to E/F): excluded from this change's required scope; ship-or-drop decision left to the user | Deferred — promptless dispatch (user named only E and F; the palette supplement was suggested but not selected) | S:45 R:90 A:60 D:50 |
+
+16 assumptions (11 certain, 4 confident, 0 tentative, 1 unresolved).
diff --git a/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/plan.md b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/plan.md
new file mode 100644
index 000000000..64c2c6d11
--- /dev/null
+++ b/fab/changes/260813-1i7j-host-switcher-color-reorder-waiting/plan.md
@@ -0,0 +1,274 @@
+# Plan: Desktop-Shell Host-Switcher Menu — Per-Host Accent Color, Manual Reorder, Per-Host Waiting Counts
+
+**Change**: 260813-1i7j-host-switcher-color-reorder-waiting
+**Intake**: `intake.md`
+
+## Requirements
+
+### Desktop Shell Store (`app/desktop/src/hosts.ts`): accentColor + reorder
+
+#### R1: `accentColor` additive optional field
+`HostEntry` SHALL gain an optional `accentColor?: string` field persisted in `hosts.json`, with `lastPath`-style per-field tolerance in `parseHostEntry`: absent → entry loads unchanged; string → kept; any other type → the field is dropped and the entry (and file) still loads. The schema `version` MUST stay `1` (absence is a valid state — no bump).
+
+- **GIVEN** a stored `hosts.json` whose entry carries `"accentColor": 42` (wrong type)
+- **WHEN** `loadHosts` parses it
+- **THEN** the entry loads without the field and no other field is affected
+- **AND** an entry with `"accentColor": "#8b7ff0"` loads with the field kept
+
+#### R2: `setHostAccentColor` mutator
+`hosts.ts` SHALL export an id-keyed mutator `setHostAccentColor(dir, id, accentColor)` following the existing mutator shape: load → membership guard (unknown `id` is a no-op that writes nothing) → patch → atomic `saveHosts`. It MUST short-circuit an unchanged value (the `setHostLastPath` precedent — the capture seam fires on every theme-color report, so identical writes must not rewrite the file).
+
+- **GIVEN** a host whose stored `accentColor` is already `"#8b7ff0"`
+- **WHEN** `setHostAccentColor(dir, id, "#8b7ff0")` runs
+- **THEN** no file write occurs and the returned list is unchanged
+- **AND** a different value patches only that entry and persists atomically
+
+#### R3: `moveHost` reorder mutator
+`hosts.ts` SHALL export an id-keyed array-move mutator `moveHost(dir, id, toIndex)`: load → membership guard (unknown `id` no-ops, writes nothing) → remove the entry from its current position and insert at `toIndex` **clamped** to `[0, hosts.length - 1]` → atomic save. A move that lands on the entry's current index MUST be a no-op that writes nothing. `activeId` and every other field are untouched — only array order changes.
+
+- **GIVEN** hosts `[A, B, C]` and a call `moveHost(dir, C.id, 0)`
+- **WHEN** the mutator runs
+- **THEN** the persisted order is `[C, A, B]` and `activeId` is unchanged
+- **AND** `moveHost(dir, X.id, 5)` on a 3-entry list clamps to index 2
+- **AND** `moveHost(dir, unknown, 1)` writes nothing
+
+#### R4: projection carries `accentColor`; `waiting` rides the same wire type
+`HostInfo` SHALL gain two optional fields: `accentColor?: string` (filled by `hostInfos` from the store entry when present) and `waiting?: number` (NEVER filled by `hostInfos` — the view-registry join happens in `main.ts`, R7). The `servers:list` envelope shape (`{ ok: true, servers: HostInfo[] }`) is unchanged — no new channel.
+
+- **GIVEN** a list whose entry carries `accentColor`
+- **WHEN** `hostInfos(list)` projects it
+- **THEN** the projected info carries the same `accentColor`, and entries without one project without the field (never `null`/empty-string)
+
+### Desktop Shell Main + Preload (`app/desktop/src/main.ts`, `preload.ts`)
+
+#### R5: accent persistence seam on `did-change-theme-color`
+The existing per-view `did-change-theme-color` wiring in `main.ts` SHALL, in addition to the registry cache + overlay repaint it already does, persist the reported color via `setHostAccentColor(userDataDir(), hostId, color)` **only when `color` is a non-null string** — a `null` report leaves the stored value untouched. The dev-override sentinel view (`__dev__`) matches no store entry, so the mutator's membership guard silently covers it.
+
+- **GIVEN** a host view reporting theme color `"#4a4468"`
+- **WHEN** the event fires
+- **THEN** the host's `hosts.json` entry gains/updates `accentColor: "#4a4468"` (short-circuited when unchanged)
+- **AND** a `null` report changes nothing on disk
+
+#### R6: `servers:reorder` IPC handler
+`main.ts` SHALL register a `servers:reorder` handler gated by the existing `isHostsSender` (registered host origins + welcome, like every `servers:*` handler). Payload is `{ id, toIndex }`, structurally validated (`id` a string, `toIndex` a non-negative integer) — anything else returns `{ ok: false, error: "Invalid request" }`. On a valid payload it calls `moveHost` and then `rebuildMenu()` (native Hosts-menu accelerators derive from list order), returning `{ ok: true }`. An unknown id is still `{ ok: true }` (no-op mutator, menu rebuild harmless) — the store's unknown-id-no-op convention, not an error.
+
+- **GIVEN** the SPA invokes `servers.reorder(id, 0)` for a registered host
+- **WHEN** the handler runs
+- **THEN** `hosts.json` order changes, the native menu is rebuilt with re-derived ⌥⌘1–9/⇧Ctrl+1–9 accelerators, and `{ ok: true }` returns
+- **AND** a disallowed sender gets `{ ok: false, error: "Not allowed" }`
+
+#### R7: `servers:list` joins view-registry waiting counts
+The `servers:list` handler SHALL join the store projection with the view registry: for each projected info, when a view exists for that host id and its cached `badgeCount > 0`, set `waiting` to that count; otherwise omit the field. A never-visited host (no view) and a zero count both project without `waiting`. The dock badge pipeline (`badge:set` → `applyBadge`) is untouched — cross-host aggregation stays a non-goal.
+
+- **GIVEN** a background host whose view last reported `badge:set 3`
+- **WHEN** the SPA calls `servers:list`
+- **THEN** that host's entry carries `waiting: 3`
+- **AND** hosts with no view or a `0` count carry no `waiting` field
+
+#### R8: preload bridge reorder invoker
+`preload.ts` SHALL add `reorder: (id, toIndex) => ipcRenderer.invoke("servers:reorder", { id, toIndex })` to the existing `servers` group. Nothing else about the bridge changes; older-SPA pages simply never call it.
+
+- **GIVEN** the SPA detects the invoker
+- **WHEN** it calls `runkitShell.servers.reorder(id, 2)`
+- **THEN** the gated main-side handler receives `{ id, toIndex: 2 }`
+
+### Frontend Shell Lib (`app/frontend/src/lib/shell.ts`, `shell-strip.ts`)
+
+#### R9: `ShellServer` type + structural validation extension
+`ShellServer` SHALL gain optional `accentColor?: string` and `waiting?: number`. `isShellServer` validates them **when present** (wrong type rejects the entry, and thereby the list — these values come from our own shell, not user input; absence is always valid, preserving older-shell responses).
+
+- **GIVEN** a `servers:list` response from an older shell (`{id, name, url, active}` only)
+- **WHEN** `listShellServers()` narrows it
+- **THEN** the list parses successfully with both fields absent
+
+#### R10: reorder capability detection + invoker
+`shell.ts` SHALL add `canReorderShellHosts(): boolean` and `reorderShellHosts(id, toIndex): Promise<boolean>` following the `canAddShellHost`/`addShellHost` optional-invoker pattern exactly (separate structural narrowing of the additive `reorder` member; resolves `false` outside the shell, on an older shell, or on rejection/denial; never throws).
+
+- **GIVEN** an older shell whose `servers` group lacks `reorder`
+- **WHEN** `canReorderShellHosts()` runs
+- **THEN** it returns `false` and the strip renders no reorder affordances (R14–R16)
+
+#### R11: row model carries hex-validated color + waiting count
+`ShellHostMenuRow` SHALL gain `accentColor: string | null` and `waiting: number | null`. `shellHostMenuRows` fills `accentColor` only when the server's value matches a strict hex pattern (`#RGB`/`#RRGGBB`/`#RRGGBBAA` — the shell-side `fallbackStripCss` hex-validation precedent, guarding style interpolation) and fills `waiting` only when present and `> 0` **and the row is not active** (the active host's attention is the dock badge's job; the menu surfaces *background* hosts).
+
+- **GIVEN** a server entry with `accentColor: "javascript:alert(1)"`
+- **WHEN** rows derive
+- **THEN** that row's `accentColor` is `null` (no bar, no style interpolation)
+- **AND** an active entry with `waiting: 2` derives `waiting: null` while a background one keeps `2`
+
+### Strip Component (`app/frontend/src/components/shell-titlebar-strip.tsx`)
+
+#### R12: accent edge bar
+Each menu row with a non-null `accentColor` SHALL render a ~3px left-edge bar in that color (vertically inset, matching the row's height minus small padding). Rows without a color render no bar and keep identical text alignment (the bar must not shift row content — it overlays the row's left edge, absolutely positioned).
+
+- **GIVEN** hosts with distinct accent colors
+- **WHEN** the menu opens
+- **THEN** each row shows its host's accent as a left-edge bar and colorless rows show none, with all names left-aligned identically
+
+#### R13: waiting-count chip
+Each row with a non-null `waiting` SHALL render an amber `● {N}` indicator between the origin and the accelerator hint (`ml-auto` cluster). Waiting-only semantics — the component never renders busy/idle states, and `0`/absent renders nothing.
+
+- **GIVEN** a background host with `waiting: 3`
+- **WHEN** the menu renders
+- **THEN** its row shows an amber `● 3` before the `⌥⌘N` hint, and rows without a count show nothing extra
+
+#### R14: ⌥↑/⌥↓ keyboard move with live hint re-numbering
+When the reorder capability is present, the menu's capture-phase keydown handler SHALL treat Alt+ArrowUp/Alt+ArrowDown (all platforms — `e.altKey && (ArrowUp|ArrowDown)`) as "move the focused row": each keypress commits one move (`reorderShellHosts(id, index±1)`), optimistically reorders the local list state so the accelerator hints re-number live, and keeps focus (and the roving-tabindex seat) on the moved row. No wrap at the list edges — a move past either end is a no-op that swallows the key. Plain (unmodified) ArrowUp/ArrowDown keep today's roving-focus behavior; without the capability, Alt+arrows fall through to today's arrow handling. The Add-Host footer is not movable and is skipped by Alt+arrow handling.
+
+- **GIVEN** the menu is open with focus on row 2 of 4 and reorder capability present
+- **WHEN** the user presses ⌥↑
+- **THEN** the row moves to index 1, `reorderShellHosts` is invoked once with `(id, 1)`, the hints re-number (the moved row now shows `⌥⌘2`), and focus stays on the moved row
+- **AND** ⌥↑ on the first row is a no-op (no invoke, no order change)
+
+#### R15: drag-grip reorder
+When the reorder capability is present, each host row SHALL show a drag grip (`⋮⋮`) on row hover at the row's trailing edge; dragging a row and dropping it at another position commits **one** `reorderShellHosts(id, toIndex)` invocation at drop, with local row order updated optimistically during the drag (the sidebar session-reorder derive-over-store precedent: local order is presentation state, the open-time refetch reconciles). A failed invoke surfaces the existing toast pattern (`addToast(..., "error")`) and refetches the list.
+
+- **GIVEN** the menu is open with 4 hosts and reorder capability present
+- **WHEN** the user drags row 4 to position 1 and drops
+- **THEN** exactly one `reorderShellHosts` call fires with `(row4.id, 0)`, the rows render in the new order, and the hints re-number
+
+#### R16: capability degradation
+Without the reorder capability (older shell): no grips render, Alt+arrows are not intercepted. Without `accentColor` on an entry: no bar. Without `waiting`: no chip. The menu MUST render correctly against an older shell's plain `{id, name, url, active}` projection — all three features are independently additive.
+
+- **GIVEN** an older shell exposing only `list`/`switch`/`add`
+- **WHEN** the menu opens
+- **THEN** it renders exactly today's rows (marker, name, origin, hint) with no new affordances and no errors
+
+### Non-Goals
+
+- Rename-host affordance — recorded desktop-shell design decision stands (names auto-derive at add-time; remove + re-add)
+- Alphabetical or any auto-sort — order IS the accelerator map; auto-sort silently remaps accelerators
+- Color treatments A (dot) / C (tinted name) / D (row wash) — rejected in design review
+- ssh tag on rows; unreachable ⚠ row state — mocked, not selected
+- Cross-host dock-badge aggregation — the dock badge stays active-host-only
+- Command-palette reorder commands — deferred (intake Open Question; not selected)
+- Native Hosts-menu row colors/counts — the native menu keeps its current shape; only its accelerator order follows reorder
+
+### Design Decisions
+
+#### Accent color persists in hosts.json, not just the view registry
+**Decision**: Persist `accentColor` per host entry (additive optional field), captured from `did-change-theme-color`, rather than projecting the registry's session-scoped `themeColor` cache.
+**Why**: The registry cache dies with the window and never exists for hosts not yet visited this run; persistence makes colors correct at cold start — precisely when the menu is most needed to tell hosts apart.
+**Rejected**: Registry-only projection — colors would blank on every launch until each host is visited.
+*Introduced by*: 260813-1i7j-host-switcher-color-reorder-waiting
+
+#### Reorder is move-by-id (`{id, toIndex}`), committed per gesture
+**Decision**: One IPC channel `servers:reorder` carrying `{id, toIndex}`; each keyboard press or drag-drop commits one move.
+**Why**: Keys on the immutable host id (the store's id-keyed-mutator rule); a full-array payload would trust renderer-supplied order and need set-equality validation.
+**Rejected**: `{order: id[]}` full-list replace — larger validation surface, and a stale renderer list would silently drop concurrently-added hosts.
+*Introduced by*: 260813-1i7j-host-switcher-color-reorder-waiting
+
+#### Waiting count joins at the `servers:list` handler, not in `hostInfos`
+**Decision**: `hostInfos` (electron-free, store-only) never fills `waiting`; the `main.ts` handler joins registry `badgeCount` caches into the projection.
+**Why**: Keeps `hosts.ts` electron-free and store-pure (the module boundary the whole test strategy rides on); the registry is main-side state.
+**Rejected**: Passing the registry into `hostInfos` — couples the store module to view state for a three-line join.
+*Introduced by*: 260813-1i7j-host-switcher-color-reorder-waiting
+
+## Tasks
+
+### Phase 1: Store + pure logic (`app/desktop`)
+
+- [x] T001 Add `accentColor?: string` to `HostEntry` with per-field parse tolerance in `parseHostEntry`, and to `HostInfo` (+ `waiting?: number`) with `hostInfos` filling `accentColor` only, in `app/desktop/src/hosts.ts` <!-- R1, R4 -->
+- [x] T002 Add `setHostAccentColor(dir, id, accentColor)` mutator (membership guard, unchanged-value short-circuit, atomic save) in `app/desktop/src/hosts.ts` <!-- R2 -->
+- [x] T003 Add `moveHost(dir, id, toIndex)` mutator (membership guard, clamp, same-index no-op, atomic save) in `app/desktop/src/hosts.ts` <!-- R3 -->
+- [x] T004 Cover T001–T003 in `app/desktop/src/hosts.test.ts`: tolerance matrix (absent/string/wrong-type), short-circuit write behavior, move/clamp/no-op cases, projection field pass-through <!-- R1, R2, R3, R4 -->
+
+### Phase 2: Shell main + preload (`app/desktop`)
+
+- [x] T005 Persist accent in the `did-change-theme-color` wiring (non-null string only) in `app/desktop/src/main.ts` <!-- R5 -->
+- [x] T006 Join view-registry `badgeCount` into the `servers:list` projection (`waiting` when a view exists and count > 0) in `app/desktop/src/main.ts` <!-- R7 -->
+- [x] T007 Register the `servers:reorder` handler (isHostsSender gate, payload validation, `moveHost` + `rebuildMenu()`) in `app/desktop/src/main.ts` <!-- R6 -->
+- [x] T008 Add the `reorder` invoker to the `servers` group in `app/desktop/src/preload.ts` <!-- R8 -->
+
+### Phase 3: Frontend shell lib (`app/frontend`)
+
+- [x] T009 Extend `ShellServer` (+ `isShellServer` present-field validation) and add `canReorderShellHosts`/`reorderShellHosts` per the `add`-invoker pattern in `app/frontend/src/lib/shell.ts`; cover in `app/frontend/src/lib/shell.test.ts` <!-- R9, R10 -->
+- [x] T010 Extend `ShellHostMenuRow` with hex-validated `accentColor` and background-only `waiting` in `app/frontend/src/lib/shell-strip.ts`; cover derivation (hex accept/reject matrix, active-row suppression, absent fields) in its test file <!-- R11 -->
+
+### Phase 4: Strip component (`app/frontend`)
+
+- [x] T011 Render the accent edge bar and the amber `● N` waiting chip in `app/frontend/src/components/shell-titlebar-strip.tsx`; cover both (present/absent) in `shell-titlebar-strip.test.tsx` <!-- R12, R13 -->
+- [x] T012 Implement ⌥↑/⌥↓ move in the capture-phase keydown handler (capability-gated, per-press commit, optimistic reorder, focus-follows, edge no-op, footer skipped) in `shell-titlebar-strip.tsx`; cover in `shell-titlebar-strip.test.tsx` <!-- R14 -->
+- [x] T013 Implement the hover drag grip with commit-on-drop and optimistic order (failure → toast + refetch) in `shell-titlebar-strip.tsx`; cover in `shell-titlebar-strip.test.tsx` <!-- R15 -->
+- [x] T014 Add the older-shell degradation test (plain 4-field projection → today's rendering, no affordances) in `shell-titlebar-strip.test.tsx` <!-- R16 -->
+
+### Phase 5: Verification
+
+- [x] T015 Full gates: `cd app/desktop && pnpm compile && node --test "dist/**/*.test.js"`; `cd app/frontend && npx tsc --noEmit`; `just test-frontend` <!-- R1–R16 -->
+
+## Execution Order
+
+- T001 blocks T002–T004 (types) and T005–T006 (main.ts uses the new exports)
+- T007 depends on T003; T008 is independent after T007's channel name is fixed
+- T009 blocks T010–T014; T010 blocks T011–T013
+- T015 runs last
+
+## Acceptance
+
+### Functional Completeness
+
+- [x] A-001 R1: `hosts.json` round-trips `accentColor` with lastPath-style tolerance (absent kept-out, string kept, wrong type dropped without rejecting the entry), schema version still 1
+- [x] A-002 R2: `setHostAccentColor` patches only the target entry, no-ops on unknown id, and skips the write on an unchanged value
+- [x] A-003 R3: `moveHost` reorders by id with clamped target index, no-ops on unknown id and same-index moves, and never touches `activeId`
+- [x] A-004 R4: `hostInfos` carries `accentColor` (and never fills `waiting`); the wire type carries both optionals
+- [x] A-005 R5: a non-null theme-color report persists to the reporting host's entry; null reports and the dev sentinel view write nothing
+- [x] A-006 R6: `servers:reorder` is sender-gated, validates `{id, toIndex}`, moves + rebuilds the native menu, and returns ok
+- [x] A-007 R7: `servers:list` carries `waiting` exactly for hosts with a live view whose cached count > 0
+- [x] A-008 R8: the preload `servers` group exposes the `reorder` invoker
+- [x] A-009 R10: `canReorderShellHosts`/`reorderShellHosts` follow the optional-invoker pattern (false/no-throw outside shell and on older shells)
+- [x] A-010 R11: row derivation hex-validates `accentColor` and suppresses `waiting` on the active row
+- [x] A-011 R12: rows render the accent edge bar without shifting content; colorless rows render none
+- [x] A-012 R13: background rows with a count render the amber `● N` chip before the hint
+- [x] A-013 R14: ⌥↑/⌥↓ moves the focused row with one invoke per press, live hint re-numbering, focus-follow, and edge no-ops
+- [x] A-014 R15: drag-drop commits exactly one reorder invocation with optimistic order and toast+refetch on failure
+
+### Behavioral Correctness
+
+- [x] A-015 R9: an older shell's 4-field `servers:list` response still parses (absent optionals valid); wrong-typed present optionals reject
+- [x] A-016 R14: plain (unmodified) arrows keep today's roving-focus behavior; Alt+arrows without the capability fall through unchanged
+
+### Scenario Coverage
+
+- [x] A-017 R16: the degradation scenario is an explicit test — plain projection renders today's menu with no grips, bars, or chips
+- [x] A-018 R6: after a reorder, the native Hosts menu's digit accelerators reflect the new order (rebuild verified via the menu-rebuild seam)
+
+### Edge Cases & Error Handling
+
+- [x] A-019 R11: a non-hex `accentColor` value never reaches style interpolation (bar suppressed)
+- [x] A-020 R14: Alt+arrow at a list edge swallows the key without invoking reorder or wrapping
+- [x] A-021 R15: a rejected/denied reorder invoke surfaces the error toast and refetches the list
+
+### Code Quality
+
+- [x] A-022 Pattern consistency: new store mutators mirror the existing load→guard→patch→atomic-save shape; bridge additions mirror the `add`-invoker narrowing pattern; no `as` casts in frontend narrowing
+- [x] A-023 No unnecessary duplication: hex validation, toast usage, and roving-focus logic reuse/extend the existing seams rather than parallel implementations
+- [x] A-024 Tests included: every behavior change lands with tests in the module's established runner (`node --test` desktop, Vitest frontend)
+- [x] A-025 No Go-backend or route changes; Constitution II/IV untouched
+
+### Security
+
+- [x] A-026 R6: `servers:reorder` is gated by `isHostsSender` and structurally validates its payload; no renderer-supplied array order is trusted (move-by-id only)
+
+## Notes
+
+- Check items as you review: `- [x]`
+- All acceptance items must pass before `/fab-continue` (hydrate)
+- If an item is not applicable, mark checked and prefix with **N/A**: `- [x] A-NNN **N/A**: {reason}`
+
+## Deletion Candidates
+
+None — this change adds new functionality without making existing code redundant.
+
+## Assumptions
+
+| # | Grade | Decision | Rationale | Scores |
+|---|-------|----------|-----------|--------|
+| 1 | Confident | `null` theme-color reports never clear a persisted `accentColor` (persist non-null strings only) | The SPA's theme-color meta is accent-aware end-to-end and effectively always present; clearing on transient nulls would flicker stored state. Easily revisited | S:60 R:85 A:80 D:70 |
+| 2 | Confident | Frontend validation rejects a wrong-typed present optional (vs hosts.ts-style field-drop) | The response comes from our own shell, not user data — cross-version shells omit fields rather than mistype them; strict-when-present is simpler and matches `isShellServer`'s existing strictness | S:55 R:85 A:80 D:65 |
+| 3 | Confident | Waiting chip suppressed on the ACTIVE row (backend still sends the count; row derivation nulls it) | Intake says "background host's row"; the active host's attention surface is the dock badge. Display-layer choice, trivially reversible | S:65 R:90 A:80 D:75 |
+| 4 | Confident | Reorder payload `{id, toIndex}` on channel `servers:reorder`; wrong-shape payload → `Invalid request`, unknown id → ok no-op | Carried from intake #10; unknown-id-ok mirrors the store's no-op convention (remove/setActive precedents) | S:60 R:85 A:85 D:70 |
+| 5 | Confident | Alt+ArrowUp/Down on all platforms, per-press commit, no wrap, footer excluded from movement | Carried from intake #12; arrows compose no characters so the mac Option issue doesn't apply; no-wrap matches accelerator-assignment mental model | S:60 R:85 A:80 D:70 |
+| 6 | Confident | Drag implemented with commit-on-drop + optimistic local order; open-time refetch is the reconcile seam | Carried from intake #13 (sidebar derive-over-store precedent); exact DOM drag mechanism left to apply within these semantics | S:55 R:85 A:75 D:65 |
+| 7 | Certain | Native Hosts menu gets no colors/counts — only its accelerator order follows reorder via the existing rebuild | Intake scopes the feature to the SPA dropdown; menu.ts change surface stays zero beyond the rebuild call | S:80 R:90 A:90 D:85 |
+
+7 assumptions (1 certain, 6 confident, 0 tentative).