@cortexkit/aft-bridge 0.58.1 → 0.59.0

package/dist/subc-transport.js

@@ -16,12 +16,13 @@
  * top of it. subc-client is a build-time path dependency bundled into the
  * published plugin dist; it is never a published runtime dependency.
  */
-import { existsSync, statSync } from "node:fs";
-import { connectionFileExists, isConsumerReconnectTransient, StaleRouteHandleError, SubcCallError, SubcClient, SubcError, } from "@cortexkit/subc-client";
+import { statSync } from "node:fs";
+import { AuthError, connectionFileExists, isConsumerReconnectTransient, StaleRouteHandleError, SubcCallError, SubcClient, SubcError, } from "@cortexkit/subc-client";
 import { log, warn } from "./active-logger.js";
 import { isRouteOpenReloadWindowError, isRouteRequestReloadRefusal } from "./error-contract.js";
 import { asCanonicalRootPath, asRootGeneration, LifecycleRegistry, } from "./lifecycle-registry.js";
 import { canonicalizeProjectRoot } from "./project-identity.js";
+import { callPresetFor, PRESET_FIELD, WORKER_SESSION_FIELD } from "./transport.js";
 /** The subc pool is closing and cannot carry another request. */
 export class SubcTransportShuttingDownError extends SubcCallError {
     constructor() {
@@ -29,6 +30,57 @@ export class SubcTransportShuttingDownError extends SubcCallError {
         this.name = "SubcTransportShuttingDownError";
     }
 }
+/**
+ * The plugin closed one of its own routes (pool shutdown, session close,
+ * project-root close, or a sibling call on the same session discarding the
+ * shared route) while this call's request was already in flight on it.
+ *
+ * subc-client records a request as pending and starts writing its frame in the
+ * same synchronous step, and its `closeRoute` rejects exactly those pending
+ * requests. So a request rejected that way was written, or queued to be
+ * written, and the daemon may have run it: the outcome is unknown. The call
+ * must not be blind-retried, and bash must not re-run it on the host.
+ */
+export class SubcRouteClosedMidCallError extends SubcCallError {
+    reason;
+    constructor(reason, cause) {
+        super("outcome_unknown", `the command may have run; the route closed mid-call: ${reason}`, "route_closed", cause);
+        this.name = "SubcRouteClosedMidCallError";
+        this.reason = reason;
+    }
+}
+/**
+ * subc-client's rejection of a request that was pending when the client itself
+ * closed the route: `closeRoute` tearing that route down, or the client closing
+ * its connection. The client types both with `closeReason: "closed_by_caller"`;
+ * a daemon GOODBYE carries the daemon's reason and a lost connection carries
+ * `"connection_lost"`. A route closed with no request pending produces no error
+ * at all, and a request started on an already-closed route fails with
+ * `StaleRouteHandleError`. A route closed while still opening is reported as a
+ * not-sent `SubcCallError`, which is not a `SubcError` and so never matches.
+ */
+export function isLocalRouteCloseRejection(error) {
+    return error instanceof SubcError && error.closeReason === "closed_by_caller";
+}
+/** The route-close reason that matches a session's teardown, if it was torn down. */
+function teardownCloseReason(teardown) {
+    switch (teardown) {
+        case "shutdown":
+            return "transport shutting down";
+        case "session_closed":
+            return "session closed";
+        case "root_reaped":
+            return "project root closed";
+        default:
+            return null;
+    }
+}
+class ReconnectKeyChangedError extends Error {
+    constructor() {
+        super("the subc daemon restarted and its connection key changed; the reconnect did not complete within the deadline, retry");
+        this.name = "ReconnectKeyChangedError";
+    }
+}
 /** True when subc-client rejected locally because its connection was already closed. */
 export function isSubcClientClosedError(error) {
     return error instanceof SubcError && error.message === "client closed";
@@ -49,6 +101,10 @@ export function isSubcClientClosedError(error) {
  * the connection has already been torn down locally.
  */
 export function isSocketDeathError(error, depth = 0) {
+    // Raw data-plane requests wrap socket death in a SubcError; its typed
+    // connection-loss reason survives even when the underlying errno does not.
+    if (error instanceof SubcError && error.closeReason === "connection_lost")
+        return true;
     if (error instanceof SubcCallError) {
         const cause = error.cause;
         return depth < 4 && cause !== undefined && cause !== error
@@ -343,6 +399,11 @@ class BgSubscription {
         const initial = client.droppedIngressFrames;
         if (typeof initial !== "number")
             return () => undefined;
+        const existing = dispatchProbes.get(client);
+        if (existing) {
+            existing.users += 1;
+            return () => releaseDispatchProbe(client);
+        }
         let previous = initial;
         const timer = setInterval(() => {
             const total = client.droppedIngressFrames;
@@ -352,8 +413,10 @@ class BgSubscription {
             previous = total;
             this.info("dispatch-epoch-drop", `client ingress epoch drops scope=client observed_while_channel=${routeId} delta=${delta} total=${total}`);
         }, this.dispatchProbeIntervalMs);
+        dispatchProbeTimers += 1;
         timer.unref?.();
-        return () => clearInterval(timer);
+        dispatchProbes.set(client, { users: 1, timer });
+        return () => releaseDispatchProbe(client);
     }
     async run() {
         let backoffAttempt = 0;
@@ -469,7 +532,7 @@ class BgSubscription {
                     if (!this.isCurrent()) {
                         this.info("nudge-stale-carrier", `nudge carried by stale subscription; checking current session channel=${routeId}`);
                     }
-                    this.onNudge();
+                    this.onNudge(true);
                 });
                 this.current = sub;
                 this.attached = client;
@@ -487,7 +550,7 @@ class BgSubscription {
                 // A reconnect may have missed completions, so force a drain after every
                 // successful subscribe to replay anything queued while the stream was down.
                 if (!this.stopped && this.isCurrent())
-                    this.onNudge();
+                    this.onNudge(false);
                 await sub.closed;
                 this.info("stream-end", `stream ended channel=${routeId}`);
                 if (this.stopped) {
@@ -603,6 +666,21 @@ function abortedRequestError() {
     error.name = "AbortError";
     return error;
 }
+// The metric is connection-wide, so observing it needs one timer, not one per
+// session. Last unsubscribe releases the timer, including on a dead socket.
+const dispatchProbes = new Map();
+let dispatchProbeTimers = 0;
+function releaseDispatchProbe(client) {
+    const probe = dispatchProbes.get(client);
+    if (!probe || --probe.users > 0)
+        return;
+    clearInterval(probe.timer);
+    dispatchProbeTimers -= 1;
+    dispatchProbes.delete(client);
+}
+export function __dispatchProbeCountForTests() {
+    return dispatchProbeTimers;
+}
 /**
  * A route open that resolved AFTER its session was torn down (closeSession /
  * shutdown / client swap). The caller's request can't proceed, but this is an
@@ -611,6 +689,25 @@ function abortedRequestError() {
  */
 class RouteTornDownError extends Error {
 }
+/**
+ * True when a call stopped at a teardown before its request was handed to the
+ * client (a closed session, or a route that opened after the teardown), so the
+ * request provably never reached AFT.
+ */
+export function isSubcRouteTornDownError(error) {
+    return error instanceof RouteTornDownError;
+}
+/**
+ * Turn subc-client's bare rejection of a request that was in flight on a route
+ * the plugin closed into an outcome-unknown error that names the close reason.
+ * Any other error passes through unchanged.
+ */
+function routeClosedMidCallError(error, entry, record) {
+    if (!isLocalRouteCloseRejection(error))
+        return error;
+    const reason = teardownCloseReason(record.teardownReason) ?? entry.closedBy ?? "route closed by the plugin";
+    return new SubcRouteClosedMidCallError(reason, error);
+}
 /**
  * Re-lift the route reply into the flat {@link ToolCallResult} shape the standalone
  * `BinaryBridge.toolCall` returns. The Rust module wraps the full flat response
@@ -700,6 +797,9 @@ class SubcTransport {
             body.edit_slot_survives = editSlotSurvives;
         if (preview === true)
             body.preview = true;
+        if (options?.workerSession === true)
+            body[WORKER_SESSION_FIELD] = true;
+        body[PRESET_FIELD] = callPresetFor(options?.workerSession === true);
         const reply = await this.pool.routeRequest(this.identityFor(sessionId), body, timeoutMs, onProgress, this.generation, abortSignal);
         return reliftReply(reply);
     }
@@ -720,7 +820,14 @@ class SubcTransport {
         }
         const { timeoutMs, onProgress, abortSignal } = this.splitOptions(options);
         const session = typeof params.session_id === "string" ? params.session_id : undefined;
-        const body = { name: command, arguments: params };
+        // The caller's role travels beside the call, like the session (which the
+        // route bind carries), not inside the command's arguments: the module
+        // reads it from the call body.
+        const { [WORKER_SESSION_FIELD]: workerSession, ...args } = params;
+        const body = { name: command, arguments: args };
+        if (workerSession === true)
+            body[WORKER_SESSION_FIELD] = true;
+        body[PRESET_FIELD] = callPresetFor(workerSession === true);
         const editSlotSurvives = this.pool.getEditSlotSurvives();
         if (editSlotSurvives !== undefined)
             body.edit_slot_survives = editSlotSurvives;
@@ -765,6 +872,7 @@ export class SubcTransportPool {
     lifecycleRegistration = null;
     outerFacadeEvictor;
     client = null;
+    hadWorkingClient = false;
     /** Single-flight guard so concurrent first calls share one connect. */
     connecting = null;
     /** The growing delay for a safe, once-only route resend after route closure. */
@@ -775,6 +883,10 @@ export class SubcTransportPool {
     routeReopenRetryMs = null;
     /** Per-session records keyed by the opaque identity key. */
     sessions = new Map();
+    // Pending host creation events are bounded. Forgetting one only makes that
+    // session unknown (retained), never falsely eligible for eviction.
+    observedStarts = new Set();
+    sessionSweep = null;
     /**
      * The sole root-scoped session enumeration authority. Keys are opaque and are
      * removed by the same detacher that removes the corresponding session record.
@@ -896,9 +1008,10 @@ export class SubcTransportPool {
         return asCanonicalRootPath(canonicalizeProjectRoot(projectRoot));
     }
     /**
-     * Check a root immediately before opening a route. The reclaim marker is only
-     * an existence hint; a directory that has already returned wins over a stale
-     * sibling marker, so the marker contents are never parsed.
+     * Check a root immediately before opening a route. Only the directory's
+     * existence decides: a reclaim marker beside it (`<root>.reclaimed`) needs
+     * no check, since an absent directory suspends the bind either way and a
+     * directory that has returned wins over a stale marker.
      */
     rootCanAttach(root) {
         let directoryExists = false;
@@ -912,13 +1025,6 @@ export class SubcTransportPool {
             this.dormantRoots.delete(root);
             return true;
         }
-        // Read the marker only as a latency hint. Directory absence is sufficient
-        // to suspend the bind, and the marker's JSON is intentionally irrelevant.
-        const reclaimedMarkerPresent = existsSync(`${root}.reclaimed`);
-        if (reclaimedMarkerPresent) {
-            this.markRootDormant(root);
-            return false;
-        }
         this.markRootDormant(root);
         return false;
     }
@@ -1150,6 +1256,7 @@ export class SubcTransportPool {
             if (this.lifecycleEnabled() && record.generation !== generation) {
                 throw this.generationExpiredError(root, generation ?? asRootGeneration(1));
             }
+            record.lastUsedAt = Date.now();
             return record;
         }
         record = {
@@ -1158,10 +1265,18 @@ export class SubcTransportPool {
             canonicalRoot: root,
             generation,
             routeEntry: null,
+            retiredRoutes: new Set(),
             bgSub: null,
             closed: false,
             teardownReason: null,
             inflight: 0,
+            lastUsedAt: Date.now(),
+            observedFromStart: this.observedStarts.delete(key),
+            backgroundTasks: new Map(),
+            backgroundWatches: new Map(),
+            unknownBackgroundWork: false,
+            pendingBgNudge: false,
+            pendingDetach: false,
         };
         this.sessions.set(key, record);
         let keys = this.rootIndex.get(root);
@@ -1170,8 +1285,173 @@ export class SubcTransportPool {
             this.rootIndex.set(root, keys);
         }
         keys.add(key);
+        if (!this.sessionSweep) {
+            this.sessionSweep = setInterval(() => {
+                void this.reapIdleSessions();
+            }, 60_000);
+            this.sessionSweep.unref?.();
+        }
         return record;
     }
+    /** Release only idle carriers, not the daemon's durable session or completion queue.
+     * The next request opens a new route and subscribes again; subscription startup
+     * always nudges a drain, replaying completions queued while no carrier existed.
+     */
+    async reapIdleSessions(now = Date.now()) {
+        for (const [key, state] of this.nudgeDeliveryLogState) {
+            if (now - state.lastEmittedAt >= 15 * 60_000)
+                this.nudgeDeliveryLogState.delete(key);
+        }
+        const detached = [];
+        for (const [key, record] of this.sessions) {
+            if (
+            // The wire has no session-wide background census. A resumed/rebound
+            // session may have tasks or watches this pool never saw, so only a
+            // host-observed creation can establish a complete lifetime history.
+            !record.observedFromStart ||
+                record.backgroundTasks.size > 0 ||
+                record.backgroundWatches.size > 0 ||
+                record.unknownBackgroundWork ||
+                record.pendingBgNudge ||
+                record.pendingDetach ||
+                record.inflight > 0 ||
+                record.retiredRoutes.size > 0 ||
+                record.routeEntry?.opening ||
+                now - record.lastUsedAt < 15 * 60_000)
+                continue;
+            const owner = this.detachSession(key, "session_closed");
+            if (owner)
+                detached.push(owner);
+        }
+        if (this.sessions.size === 0 && this.sessionSweep) {
+            clearInterval(this.sessionSweep);
+            this.sessionSweep = null;
+        }
+        const cleanup = Promise.allSettled(detached.map((owner) => this.cleanupDetached(owner)));
+        this.pendingRootCleanups.add(cleanup);
+        try {
+            await cleanup;
+        }
+        finally {
+            this.pendingRootCleanups.delete(cleanup);
+        }
+    }
+    observeSessionStart(projectRoot, session) {
+        if (this.shuttingDown || !session)
+            return;
+        const key = identityKey({
+            project_root: canonicalizeProjectRoot(projectRoot),
+            harness: this.harness,
+            session,
+        });
+        const record = this.sessions.get(key);
+        if (record) {
+            record.observedFromStart = true;
+            return;
+        }
+        if (this.observedStarts.size >= 256)
+            this.observedStarts.delete(this.observedStarts.values().next().value);
+        this.observedStarts.add(key);
+    }
+    __pendingSessionStartsForTests() {
+        return this.observedStarts.size;
+    }
+    observeBackgroundReply(record, body, reply) {
+        const name = String(body.name);
+        const args = isRecord(body.arguments) ? body.arguments : {};
+        const data = isRecord(reply) && isRecord(reply.structuredContent) ? reply.structuredContent : null;
+        const affectsBackground = name === "bash" ||
+            name === "powershell" ||
+            [
+                "bash_status",
+                "bash_kill",
+                "bash_write",
+                "bash_promote",
+                "bash_watch",
+                "bash_notify",
+                "bash_unnotify",
+                "bash_wait_detach",
+                "bash_drain_completions",
+                "bash_ack_completions",
+            ].includes(name);
+        if (!data || data.success !== true) {
+            if (affectsBackground) {
+                if (typeof args.task_id === "string") {
+                    if (!record.backgroundTasks.has(args.task_id))
+                        record.backgroundTasks.set(args.task_id, "unknown");
+                }
+                else
+                    record.unknownBackgroundWork = true;
+            }
+            return;
+        }
+        if (typeof data.task_id === "string") {
+            // Terminal tasks remain pinned until the daemon explicitly ACKs them.
+            const terminal = ["completed", "failed", "killed", "timed_out"].includes(String(data.status));
+            const running = ["starting", "running", "killing"].includes(String(data.status));
+            record.backgroundTasks.set(data.task_id, terminal ? "terminal" : running ? "running" : "unknown");
+            if (name === "bash" || name === "powershell")
+                record.pendingDetach = false;
+        }
+        if (Array.isArray(data.bg_completions)) {
+            for (const completion of data.bg_completions) {
+                if (isRecord(completion) && typeof completion.task_id === "string")
+                    record.backgroundTasks.set(completion.task_id, "terminal");
+                else
+                    record.unknownBackgroundWork = true;
+            }
+        }
+        if (Array.isArray(data.pending_matches)) {
+            for (const match of data.pending_matches) {
+                if (isRecord(match) &&
+                    typeof match.watch_id === "string" &&
+                    typeof match.task_id === "string")
+                    record.backgroundWatches.set(match.watch_id, match.task_id);
+                else
+                    record.unknownBackgroundWork = true;
+            }
+        }
+        if (name === "bash_drain_completions" &&
+            Array.isArray(data.bg_completions) &&
+            Array.isArray(data.pending_matches))
+            record.pendingBgNudge = false;
+        if (name === "bash_notify") {
+            if (typeof data.watch_id === "string" && typeof args.task_id === "string")
+                record.backgroundWatches.set(data.watch_id, args.task_id);
+            else
+                record.unknownBackgroundWork = true;
+        }
+        if (name === "bash_unnotify" && data.unregistered === true && typeof args.watch_id === "string")
+            record.backgroundWatches.delete(args.watch_id);
+        if (name === "bash_ack_completions" && Array.isArray(data.acked_task_ids)) {
+            // ACK also acknowledges mid-run pattern matches. It does not prove a
+            // running/unknown task is terminal, so those must keep their carrier.
+            for (const task of data.acked_task_ids)
+                if (typeof task === "string" && record.backgroundTasks.get(task) === "terminal") {
+                    record.backgroundTasks.delete(task);
+                    // The daemon's terminal ACK also removes every watch on that task.
+                    for (const [watch, owner] of record.backgroundWatches) {
+                        if (owner === task)
+                            record.backgroundWatches.delete(watch);
+                    }
+                }
+        }
+        if (name === "bash_wait_detach") {
+            if (typeof data.detached === "boolean")
+                record.pendingDetach = data.detached;
+            else
+                record.unknownBackgroundWork = true;
+        }
+    }
+    __retainedSessionCountsForTests() {
+        return {
+            sessions: this.sessions.size,
+            roots: this.rootIndex.size,
+            routes: [...this.sessions.values()].filter((r) => r.routeEntry !== null).length,
+            subscriptions: [...this.sessions.values()].filter((r) => r.bgSub !== null).length,
+            sweepTimers: this.sessionSweep ? 1 : 0,
+        };
+    }
     isCurrentSession(key, record) {
         return this.sessions.get(key) === record && !record.closed;
     }
@@ -1216,6 +1496,12 @@ export class SubcTransportPool {
         if (this.sessions.get(record.identityKey) === record &&
             !record.closed &&
             record.inflight === 0 &&
+            record.retiredRoutes.size === 0 &&
+            record.backgroundTasks.size === 0 &&
+            record.backgroundWatches.size === 0 &&
+            !record.unknownBackgroundWork &&
+            !record.pendingBgNudge &&
+            !record.pendingDetach &&
             record.routeEntry === null &&
             record.bgSub === null) {
             this.sessions.delete(record.identityKey);
@@ -1234,6 +1520,10 @@ export class SubcTransportPool {
         record.teardownReason = reason;
         this.sessions.delete(key);
         this.removeIndexMembership(record);
+        for (const logKey of this.nudgeDeliveryLogState.keys()) {
+            if (logKey.endsWith(`\u0000${key}`))
+                this.nudgeDeliveryLogState.delete(logKey);
+        }
         const bgSub = record.bgSub;
         record.bgSub = null;
         const routeEntry = record.routeEntry;
@@ -1246,14 +1536,19 @@ export class SubcTransportPool {
         const cleanup = [];
         if (detached.bgSub)
             cleanup.push(detached.bgSub.stop());
-        const routeEntry = detached.routeEntry;
-        const route = routeEntry?.handle;
-        if (routeEntry && route !== null && route !== undefined) {
-            try {
-                cleanup.push(Promise.resolve(routeEntry.client.closeRouteChannel(route)).catch(() => undefined));
-            }
-            catch {
-                // A client may throw synchronously when its socket is already closed.
+        const entries = new Set(detached.record.retiredRoutes);
+        detached.record.retiredRoutes.clear();
+        if (detached.routeEntry)
+            entries.add(detached.routeEntry);
+        for (const entry of entries) {
+            entry.closed = true;
+            if (entry.handle != null) {
+                try {
+                    cleanup.push(Promise.resolve(entry.client.closeRouteChannel(entry.handle)).catch(() => undefined));
+                }
+                catch {
+                    // A client may throw synchronously when its socket is already closed.
+                }
             }
         }
         await Promise.allSettled(cleanup);
@@ -1283,9 +1578,25 @@ export class SubcTransportPool {
         }
         return this.rootReapedError(record);
     }
+    closeRetiredRoute(record, entry) {
+        if (entry.inflight > 0 || !record.retiredRoutes.delete(entry))
+            return;
+        if (entry.handle != null)
+            safeCloseRoute(entry.client, entry.handle);
+        this.deleteSessionIfEmpty(record.identityKey, record);
+    }
+    releaseRouteRequest(record, entry) {
+        entry.inflight -= 1;
+        this.closeRetiredRoute(record, entry);
+    }
     /** Open or reuse a route while guarding every lifecycle boundary. */
     async routeRequest(identity, body, timeoutMs, onProgress, expectedGeneration, abortSignal) {
         const callStartedAt = performance.now();
+        const callDeadlineMs = timeoutMs ?? SUBC_DEFAULT_REQUEST_TIMEOUT_MS;
+        // Charge shared backoff delays even when an injected sleeper advances no real time.
+        let scheduledDelayMs = 0;
+        const spentMs = () => Math.max(performance.now() - callStartedAt, scheduledDelayMs);
+        const remainingMs = () => callDeadlineMs - spentMs();
         const root = asCanonicalRootPath(identity.project_root);
         let generation = expectedGeneration;
         if (this.lifecycleEnabled()) {
@@ -1301,7 +1612,54 @@ export class SubcTransportPool {
         try {
             let client;
             try {
-                client = await this.ensureClient();
+                let keyChanged;
+                while (true) {
+                    const remaining = remainingMs();
+                    if (remaining <= 0)
+                        throw keyChanged ?? callDeadlinePassedError(undefined, callDeadlineMs);
+                    let timer;
+                    try {
+                        // Each attempt calls SubcClient.connect anew, which re-reads the connection file.
+                        const acquired = await Promise.race([
+                            this.ensureClient(),
+                            new Promise((resolve) => {
+                                timer = setTimeout(() => resolve(CALL_DEADLINE_EXPIRED), remaining);
+                            }),
+                        ]);
+                        if (acquired === CALL_DEADLINE_EXPIRED) {
+                            throw keyChanged ?? callDeadlinePassedError(undefined, callDeadlineMs);
+                        }
+                        client = acquired;
+                        break;
+                    }
+                    catch (error) {
+                        if (!(error instanceof ReconnectKeyChangedError))
+                            throw error;
+                        keyChanged = error;
+                        if (spentMs() + this.nextRouteReopenDelayMs() >= callDeadlineMs)
+                            throw error;
+                    }
+                    finally {
+                        clearTimeout(timer);
+                    }
+                    const { delayMs, wait } = this.waitForRouteReopenBackoff();
+                    scheduledDelayMs = spentMs() + delayMs;
+                    // A shared retry sleeper may outlive this caller's remaining budget.
+                    let retryTimer;
+                    try {
+                        const waited = await Promise.race([
+                            wait,
+                            new Promise((resolve) => {
+                                retryTimer = setTimeout(() => resolve(CALL_DEADLINE_EXPIRED), callDeadlineMs - (performance.now() - callStartedAt));
+                            }),
+                        ]);
+                        if (waited === CALL_DEADLINE_EXPIRED)
+                            throw keyChanged;
+                    }
+                    finally {
+                        clearTimeout(retryTimer);
+                    }
+                }
                 this.assertRecordLive(record);
             }
             catch (error) {
@@ -1351,18 +1709,10 @@ export class SubcTransportPool {
             // (a bind relay can hold one for about 12 s), retry sleeps, and the
             // request itself, which is sent with only the time that is left. So the
             // call never outlives the deadline it was given, whichever path it takes.
-            const callDeadlineMs = timeoutMs ?? SUBC_DEFAULT_REQUEST_TIMEOUT_MS;
             const reloadWaitBudgetMs = Math.min(callDeadlineMs, ROUTE_OPEN_RELOAD_WAIT_CEILING_MS);
-            // Retry delays this call has been charged for. Spent time never counts
-            // less than these: a caller that joins a shared retry timer part-way is
-            // still charged its full delay, as it always was, and an injected test
-            // sleeper may finish a delay without real time passing.
-            let scheduledDelayMs = 0;
             // The most recent route refusal, so a deadline that passes mid-open still
             // names the daemon's reason instead of a bare timeout.
             let lastRefusal;
-            const spentMs = () => Math.max(performance.now() - callStartedAt, scheduledDelayMs);
-            const remainingMs = () => callDeadlineMs - spentMs();
             // subc-client's routeOpen takes no deadline of its own (only its fixed
             // channel-0 default), so the call stops waiting for the open once its
             // own time is up. An open that completes later still lands in the
@@ -1411,9 +1761,10 @@ export class SubcTransportPool {
                 if (record.routeEntry !== entry)
                     return;
                 entry.closed = true;
+                entry.closedBy ??= "route replaced";
                 record.routeEntry = null;
-                if (entry.handle != null)
-                    safeCloseRoute(entry.client, entry.handle);
+                record.retiredRoutes.add(entry);
+                this.closeRetiredRoute(record, entry);
             };
             const handleRequestFailure = (error, entry) => {
                 const aborted = error instanceof Error && error.name === "AbortError";
@@ -1429,20 +1780,30 @@ export class SubcTransportPool {
                         route: routeLabel(entry.handle),
                     });
                 }
-                clearRouteEntry(entry);
+                // A call's timeout or refusal says nothing about the route's health.
+                // Retire only a cancelled carrier or one known to be gone; a slow live
+                // route remains reusable, and no replacement may cut its other calls.
+                if (aborted ||
+                    isRouteProvenAbsentError(error) ||
+                    (error instanceof SubcError && error.closeReason !== undefined)) {
+                    clearRouteEntry(entry);
+                }
                 if (aborted || !ownsClient || this.client !== client)
                     return;
                 if (isRouteProvenAbsentError(error))
                     return;
-                // Anything else is this call's own outcome: a timeout, a GOODBYE, a
-                // refusal, or a managed not_sent/outcome_unknown verdict. It fails this
-                // call and route only; a run of them just checks the connection.
-                this.noteUnansweredCall(client, {
-                    error,
-                    trigger: "request",
-                    session: identity.session,
-                    route: routeLabel(entry.handle),
-                });
+                if (isDaemonAnswerError(error)) {
+                    this.transportFailures = 0;
+                    this.noteClientAlive(client);
+                }
+                else if (isUnansweredCallError(error)) {
+                    this.noteUnansweredCall(client, {
+                        error,
+                        trigger: "request",
+                        session: identity.session,
+                        route: routeLabel(entry.handle),
+                    });
+                }
             };
             const requestOnRoute = async (route, entry, requestTimeoutMs) => {
                 this.assertRecordLive(record);
@@ -1460,10 +1821,22 @@ export class SubcTransportPool {
                 };
                 abortSignal?.addEventListener("abort", onAbort, { once: true });
                 try {
-                    const request = client.request(route, body, {
-                        timeoutMs: Math.ceil(requestTimeoutMs),
-                        onProgress,
-                    });
+                    // Track the actual client promise, not the abort race. A cancelled
+                    // caller has no terminal from the daemon yet, so closing its carrier
+                    // here would still cut sibling calls and invalidate request credits.
+                    entry.inflight += 1;
+                    let request;
+                    try {
+                        request = client.request(route, body, {
+                            timeoutMs: Math.ceil(requestTimeoutMs),
+                            onProgress,
+                        });
+                    }
+                    catch (error) {
+                        this.releaseRouteRequest(record, entry);
+                        throw error;
+                    }
+                    request = request.finally(() => this.releaseRouteRequest(record, entry));
                     const reply = abortSignal ? await Promise.race([request, aborted]) : await request;
                     // A legacy closeSession may intentionally let an already-delivered reply
                     // settle. It must not mutate shared state or recreate a subscription.
@@ -1476,6 +1849,7 @@ export class SubcTransportPool {
                     if (this.client === client)
                         this.transportFailures = 0;
                     this.noteClientAlive(client);
+                    this.observeBackgroundReply(record, body, reply);
                     this.ensureBgSubscription(identity, record);
                     return reply;
                 }
@@ -1487,6 +1861,10 @@ export class SubcTransportPool {
             let reopened = false;
             let retriedAbsentRoute = false;
             while (true) {
+                // Another call can retire a just-acquired carrier before this caller
+                // dispatches. Only already-pending requests belong on retired routes.
+                if (routeAndEntry.entry.closed)
+                    routeAndEntry = await openRouteAfterReloadWindow();
                 // Checked outside the try below so the retry branches never mistake
                 // this call's own expiry for a daemon refusal worth retrying.
                 const requestTimeoutMs = remainingMs();
@@ -1498,7 +1876,8 @@ export class SubcTransportPool {
                         this.resetRouteReopenBackoff();
                     return reply;
                 }
-                catch (error) {
+                catch (requestError) {
+                    const error = routeClosedMidCallError(requestError, routeAndEntry.entry, record);
                     if (this.isReapInduced(record))
                         throw this.annotateReapError(error, record);
                     const ownsRoute = this.isCurrentSession(key, record) && this.client === client;
@@ -1547,10 +1926,14 @@ export class SubcTransportPool {
         catch (error) {
             if (this.isReapInduced(record))
                 throw this.annotateReapError(error, record);
+            this.observeBackgroundReply(record, body, null);
+            if (record.backgroundTasks.size > 0 || record.unknownBackgroundWork)
+                this.ensureBgSubscription(identity, record);
             throw error;
         }
         finally {
             record.inflight -= 1;
+            record.lastUsedAt = Date.now();
             this.deleteSessionIfEmpty(key, record);
         }
     }
@@ -1611,11 +1994,18 @@ export class SubcTransportPool {
                 throw new SubcTransportShuttingDownError();
             }
             this.client = client;
+            this.hadWorkingClient = true;
             this.transportFailures = 0;
             return client;
         })
             .catch((error) => {
             this.connecting = null;
+            // A previously authenticated transport can race the daemon's key rotation.
+            // Without a prior authenticated client, a proof mismatch can mean an impostor
+            // or misconfiguration, so preserve the SDK's permanent authentication error.
+            if (this.hadWorkingClient && error instanceof AuthError) {
+                throw new ReconnectKeyChangedError();
+            }
             throw error;
         });
         return this.connecting;
@@ -1633,6 +2023,8 @@ export class SubcTransportPool {
             opening: null,
             handle: null,
             closed: false,
+            inflight: 0,
+            closedBy: null,
         };
         this.assertRootCanAttach(record.canonicalRoot);
         const opening = client
@@ -1680,12 +2072,12 @@ export class SubcTransportPool {
             return;
         if (!this.isCurrentSession(record.identityKey, record))
             return;
-        if (!this.rootCanAttach(record.canonicalRoot))
-            return;
         if (record.bgSub)
             return;
+        if (!this.rootCanAttach(record.canonicalRoot))
+            return;
         const nudgeRef = this.nudgeRefFor(record);
-        const onNudge = () => {
+        const onNudge = (observedEvent) => {
             const currentRecord = this.currentSessionForNudge(identity);
             if (!currentRecord) {
                 this.logNudgeDelivery("drop-no-current-session", record, `nudge dropped cause=no-current-session root=${record.canonicalRoot}`);
@@ -1694,6 +2086,9 @@ export class SubcTransportPool {
             if (currentRecord !== record) {
                 this.logNudgeDelivery("forward-superseded-carrier", currentRecord, `nudge forwarding cause=superseded-carrying-record root=${currentRecord.canonicalRoot}`);
             }
+            currentRecord.lastUsedAt = Date.now();
+            if (observedEvent)
+                currentRecord.pendingBgNudge = true;
             const currentRef = this.nudgeRefFor(currentRecord);
             let delivered = false;
             if (currentRef && this.onBgEventsNudgeRef) {
@@ -1758,6 +2153,12 @@ export class SubcTransportPool {
             ` message=${JSON.stringify(message)}`);
         this.client = null;
         for (const record of this.sessions.values()) {
+            for (const retired of record.retiredRoutes) {
+                if (retired.client !== client)
+                    continue;
+                retired.closed = true;
+                record.retiredRoutes.delete(retired);
+            }
             const entry = record.routeEntry;
             if (entry?.client !== client)
                 continue;
@@ -1929,6 +2330,12 @@ export class SubcTransportPool {
         if (this.shuttingDown)
             return;
         this.shuttingDown = true;
+        if (this.sessionSweep)
+            clearInterval(this.sessionSweep);
+        this.sessionSweep = null;
+        this.nudgeDeliveryLogState.clear();
+        this.generationRejections.clear();
+        this.observedStarts.clear();
         this.dormantRoots.clear();
         // Deregistration synchronously tombstones all registered roots and invokes
         // closeProjectRoot before this method reaches its first await.