@linxin666/dsh-client-ui-task-board 0.4.2 → 0.4.4

package/src/host-service.ts

@@ -38,20 +38,82 @@ export interface TaskBoardTeamDispatcher {
   spawn(input: TeamSpawnInput): Promise<TeamSpawnResult>
 }
 
+/** Session-roster poll cadence — the one recurring Host timer this service still holds. */
 const SESSION_POLL_MS = 5_000
-const SCHEDULE_TICK_MS = 30_000
-const RESUME_GAP_MS = SCHEDULE_TICK_MS + 15_000
+/**
+ * How late an armed schedule fire may be before it counts as a resume rather
+ * than a normal occurrence. The schedule timer is armed AT the next due
+ * instant, so landing this far past its target means the Host was suspended,
+ * the process throttled, or the wall clock jumped forward — the same condition
+ * the old fixed 30 s heartbeat detected through its own gap threshold.
+ */
+const RECOVERY_TOLERANCE_MS = 60_000
+/** Largest delay a Node timer represents without clamping; longer targets re-arm in segments. */
+const MAX_TIMER_DELAY_MS = 2_147_483_647
+/**
+ * Consecutive polls that may report one execution's session history as
+ * unreadable before it is reported failed. The roster poll runs every 5 s, so
+ * this is two minutes of a session that is NOT running: no turn is executing
+ * there and its history cannot be read, which means no verdict will ever
+ * arrive. Reporting that as a failure keeps a card — and every ancestor of it —
+ * out of the running column, which nothing else can rescue.
+ */
+const UNREADABLE_SETTLE_POLLS = 24
+
+/**
+ * Provenance of one cron-triggered cascade: when the rule fired and the zone
+ * its wall clock was read in. Passed into every launched prompt of that run so
+ * a scheduled job knows its own clock rather than inferring one.
+ */
+export interface ScheduledRunContext {
+  triggeredAt: number
+  timeZone: string
+  cron: string
+}
+
+/**
+ * Actions that can move an armed trigger. Only these re-arm the native timer;
+ * an unrelated card edit leaves the pending fire untouched.
+ */
+const SCHEDULE_WRITE_ACTIONS: ReadonlySet<TaskBoardAction['kind']> = new Set(['set-schedule', 'delete', 'archive'])
+
+/**
+ * The native timer face the Host arms through. The cordis `timer` service
+ * (dsh-base's own `cordis-plugin-timer` row) provides it: its handles are
+ * registered on the owning fiber, so unloading the board clears every armed
+ * timer without this service tracking handles by hand. A composition that
+ * serves no timer service falls back to the process globals.
+ */
+export interface HostTimerFace {
+  timeout(callback: () => void, delay: number): () => void
+  interval(callback: () => void, delay: number): () => void
+}
+
+/** Process-global fallback used when the deployment serves no cordis timer service. */
+const PROCESS_TIMERS: HostTimerFace = {
+  timeout(callback: () => void, delay: number): () => void {
+    const handle = setTimeout(callback, delay)
+    return () => { clearTimeout(handle) }
+  },
+  interval(callback: () => void, delay: number): () => void {
+    const handle = setInterval(callback, delay)
+    return () => { clearInterval(handle) }
+  },
+}
 
 export class TaskBoardHostService {
   readonly ledger: HostTaskLedger
   readonly runner: HostExecutionRunner
   readonly power: PowerInhibitor
   private readonly listeners = new Set<() => void>()
-  private timers: Array<ReturnType<typeof setInterval>> = []
-  private lastScheduleTick: number | undefined
+  /** The one recurring timer: the session-roster poll. */
+  private pollTimer: (() => void) | undefined
+  /** The armed schedule timer, if a trigger is pending. */
+  private scheduleTimer: (() => void) | undefined
+  /** The instant the armed schedule timer targets (ms epoch), for resume detection. */
+  private scheduleTarget: number | undefined
   private disposed = false
   private pollInFlight = false
-  private tickInFlight = false
   private active = true
   /**
    * Ids the last roster poll saw as present and idle; undefined while the
@@ -60,8 +122,15 @@ export class TaskBoardHostService {
    * conversation instead of prompting into a session it cannot see.
    */
   private idleSessionIds: ReadonlySet<string> | undefined
+  /**
+   * Consecutive unreadable-history polls per open execution (see
+   * {@link noteUnreadableInspection}). Cleared as soon as an inspection
+   * resolves, so a transient reader failure never fails a card.
+   */
+  private readonly unreadablePolls = new Map<string, number>()
   private preventIdleSleep = false
   private readonly team: TaskBoardTeamDispatcher | undefined
+  private readonly timers: HostTimerFace
   private lastPowerJson = ''
   private readonly now: () => number
 
@@ -74,6 +143,7 @@ export class TaskBoardHostService {
     sessionDefaultPermission?: TaskPermission
     maxSubtaskDepth?: number
     team?: TaskBoardTeamDispatcher
+    timers?: HostTimerFace
   } = {}) {
     this.ledger = options.ledger ?? new HostTaskLedger(undefined, undefined, {
       sessionDefaultPermission: options.sessionDefaultPermission,
@@ -81,6 +151,7 @@ export class TaskBoardHostService {
     })
     this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry)
     this.team = options.team
+    this.timers = options.timers ?? PROCESS_TIMERS
     this.power = options.power ?? new PowerInhibitor()
     this.now = options.now ?? Date.now
     installStreamErrorGuards()
@@ -100,12 +171,15 @@ export class TaskBoardHostService {
   }
 
   start(): void {
-    if (this.disposed || this.timers.length > 0) return
+    if (this.disposed || this.pollTimer !== undefined) return
     this.syncPowerReasons()
-    this.timers.push(setInterval(() => { this.schedulePoll() }, SESSION_POLL_MS))
-    this.timers.push(setInterval(() => { this.scheduleTick(false) }, SCHEDULE_TICK_MS))
+    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, SESSION_POLL_MS)
     this.schedulePoll()
-    this.scheduleTick(true)
+    // Boot is a recovery point: an occurrence armed while the Host was down is
+    // not replayed, and each schedule rolls to its next future target. A
+    // schedule the Board should have served while running is then armed
+    // normally by the timer below.
+    this.recoverSchedule()
   }
 
   setConfiguration(active: boolean, preventIdleSleep: boolean): void {
@@ -123,7 +197,11 @@ export class TaskBoardHostService {
     this.power.setEnabled(active && preventIdleSleep)
     if (resumed) {
       this.schedulePoll()
-      this.scheduleTick(true)
+      this.recoverSchedule()
+    } else if (!active) {
+      // A disabled board holds no timer: its schedules must not fire while the
+      // master switch is off.
+      this.clearScheduleTimer()
     }
     this.emit()
   }
@@ -164,6 +242,10 @@ export class TaskBoardHostService {
     }
     const result = this.ledger.applyRequest(requestId, action, initiator)
     if (result.runs !== undefined) this.dispatchRuns(result.runs)
+    // A committed schedule write (create / update / toggle / delete) moves the
+    // nearest trigger; re-arm on every action so a newly enabled schedule fires
+    // at its own instant without waiting for the previous target to elapse.
+    if (SCHEDULE_WRITE_ACTIONS.has(action.kind)) this.refreshSchedule()
     return {
       schemaVersion: TASK_BOARD_SCHEMA_VERSION,
       revision: result.state.revision,
@@ -175,13 +257,15 @@ export class TaskBoardHostService {
 
   dispose(): void {
     this.disposed = true
-    for (const timer of this.timers.splice(0)) clearInterval(timer)
+    this.clearScheduleTimer()
+    this.pollTimer?.()
+    this.pollTimer = undefined
     this.power.dispose()
     this.ledger.dispose()
     this.listeners.clear()
   }
 
-  private async launch(opened: OpenedRun, others: readonly OpenedRun[] = []): Promise<void> {
+  private async launch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): Promise<void> {
     try {
       // A team run always mints a fresh Lead session: teammates are immutable
       // children of that session, so reusing an older one would collide on
@@ -190,13 +274,17 @@ export class TaskBoardHostService {
       const reuseSessionId = team ? undefined : reusableSessionId(opened.task, this.idleSessionIds)
       // Both modes tell the launched agent what else this run opens; only a team
       // run names teammates, because only then does this session own them.
-      const promptContext = others.length === 0 ? undefined : {
-        peers: others.map(other => ({
-          id: other.task.id,
-          title: other.task.title,
-          ...(team ? { name: teammateName(other.task.title, other.execution.runGroupId ?? other.task.id) } : {}),
-        })),
+      const peers = others.length === 0 ? undefined : others.map(other => ({
+        id: other.task.id,
+        title: other.task.title,
+        ...(team ? { name: teammateName(other.task.title, other.execution.runGroupId ?? other.task.id, other.task.id) } : {}),
+      }))
+      // A cron-triggered run additionally states its own firing instant and
+      // rule zone, so a scheduled job can resolve "today" without guessing.
+      const promptContext = peers === undefined && schedule === undefined ? undefined : {
+        ...(peers === undefined ? {} : { peers }),
         ...(team ? { team: true } : {}),
+        ...(schedule === undefined ? {} : { schedule }),
       }
       const sessionId = await this.runner.launch(opened.task, {
         ...(reuseSessionId === undefined ? {} : { reuseSessionId }),
@@ -234,7 +322,7 @@ export class TaskBoardHostService {
     try {
       const member = await team.spawn({
         leadSessionId,
-        name: teammateName(opened.task.title, opened.execution.runGroupId ?? opened.task.id),
+        name: teammateName(opened.task.title, opened.execution.runGroupId ?? opened.task.id, opened.task.id),
         description: opened.task.title,
         prompt: promptText(opened.task),
       })
@@ -263,6 +351,10 @@ export class TaskBoardHostService {
       return
     }
     this.idleSessionIds = new Set(running.items.filter(item => !item.running).map(item => item.sessionId))
+    // Fold whatever the board can already decide before spending inspection
+    // RPCs: a team run whose Lead recorded its verdict, and any lineage whose
+    // members are all settled. Idempotent, so an already folded board is free.
+    this.ledger.finalizeReadyRuns()
     // Read after the RPC so executions attached while it was in flight are
     // included in this pass, matching the former full-state snapshot timing.
     const runtime = this.ledger.runtimeView()
@@ -284,29 +376,124 @@ export class TaskBoardHostService {
     for (const execution of executions) {
       if (execution.sessionId === undefined) continue
       try {
-        const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions)
-        if (result.outcome === 'pending') continue
+        // A team member's turn is read even while the roster calls its session
+        // running: a durable teammate never goes idle for good.
+        const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions, {
+          whileRunning: execution.teamMember,
+        })
+        if (result.outcome === 'pending') {
+          if (result.unreadable === true) this.noteUnreadableInspection(execution, result.reason)
+          else this.unreadablePolls.delete(execution.executionId)
+          continue
+        }
+        this.unreadablePolls.delete(execution.executionId)
         this.ledger.settle(execution.taskId, execution.executionId, result.outcome, 'error' in result ? result.error : undefined)
       } catch {
         // A transient inspection failure never settles a running execution.
       }
     }
+    const open = new Set(executions.map(execution => execution.executionId))
+    for (const executionId of [...this.unreadablePolls.keys()]) {
+      if (!open.has(executionId)) this.unreadablePolls.delete(executionId)
+    }
   }
 
-  private async tickSchedule(first: boolean): Promise<void> {
+  /**
+   * Count one poll whose session history could not be read. A reader failure is
+   * not progress: the session is not running (the runner only reads history for
+   * one that is idle), so nothing will ever change that verdict. After
+   * {@link UNREADABLE_SETTLE_POLLS} consecutive polls the execution is reported
+   * failed with the recorded reason, instead of holding its card — and every
+   * ancestor of it — in the running column with no way out. The first poll of
+   * each streak is logged, so the Host log names the session.
+   */
+  private noteUnreadableInspection(execution: OpenExecutionReference, reason: string | undefined): void {
+    const polls = (this.unreadablePolls.get(execution.executionId) ?? 0) + 1
+    this.unreadablePolls.set(execution.executionId, polls)
+    const detail = reason ?? 'no reason reported'
+    if (polls === 1) {
+      safeConsoleError('[dsh-task-board] execution session ' + (execution.sessionId ?? 'unknown')
+        + ' history is unreadable; it stays pending for up to ' + UNREADABLE_SETTLE_POLLS + ' polls: ' + detail)
+    }
+    if (polls < UNREADABLE_SETTLE_POLLS) return
+    this.unreadablePolls.delete(execution.executionId)
+    this.ledger.settle(
+      execution.taskId,
+      execution.executionId,
+      'failed',
+      'execution session history is unreadable (' + UNREADABLE_SETTLE_POLLS + ' consecutive polls); the outcome cannot be determined: ' + detail,
+    )
+  }
+
+  /** Drop the armed schedule timer and forget its target. */
+  private clearScheduleTimer(): void {
+    this.scheduleTimer?.()
+    this.scheduleTimer = undefined
+    this.scheduleTarget = undefined
+  }
+
+  /**
+   * Boot / resume recovery: skip every occurrence that came due while the
+   * board was not running and roll each schedule to its next future target,
+   * then arm the timer for the nearest one. Rendering the occurrence is
+   * deliberately not attempted: the ACL of a card that fired hours ago is
+   * stale, and the board's own recovery contract is "missed triggers are
+   * skipped, never replayed".
+   */
+  private recoverSchedule(): void {
+    if (this.disposed) return
+    this.clearScheduleTimer()
+    const now = this.now()
+    this.ledger.setScheduler({ lastTickAt: now })
+    this.ledger.skipMissed(now)
+    this.armSchedule()
+  }
+
+  /**
+   * Arm the native timer at the nearest armed future trigger. One timer serves
+   * every schedule: the ledger's next target is the only instant the Host has
+   * to wake for. A target beyond the platform's timer ceiling re-arms in
+   * segments, and a target already past (the wall clock jumped, or the process
+   * was suspended) is handled immediately as a recovery.
+   */
+  private armSchedule(): void {
+    if (this.disposed || !this.active) return
+    this.clearScheduleTimer()
+    const target = this.ledger.nextArmedRunAt(this.now())
+    if (target === undefined) return
+    this.scheduleTarget = target
+    const delay = Math.max(0, Math.min(target - this.now(), MAX_TIMER_DELAY_MS))
+    this.scheduleTimer = this.timers.timeout(() => {
+      this.scheduleTimer = undefined
+      this.onScheduleFire(target)
+    }, delay)
+  }
+
+  /**
+   * One armed target became due. A fire landing well past its target is a
+   * resume (suspend, throttle, forward clock jump) rather than a normal
+   * occurrence, so it takes the recovery path instead of launching a run for a
+   * long-stale instant.
+   */
+  private onScheduleFire(target: number): void {
     if (this.disposed || !this.active) return
     const now = this.now()
-    const recovered = first || (this.lastScheduleTick !== undefined && now - this.lastScheduleTick > RESUME_GAP_MS)
-    this.lastScheduleTick = now
+    this.scheduleTarget = undefined
     this.ledger.setScheduler({ lastTickAt: now })
-    if (recovered) {
-      this.ledger.skipMissed(now)
+    if (now - target > RECOVERY_TOLERANCE_MS) {
+      this.recoverSchedule()
       return
     }
     for (const schedule of this.ledger.dueSchedules(now)) {
-      const next = nextRunAtMs(schedule.cron, schedule.nextRunAt)
-      this.dispatchRuns(this.ledger.openScheduled(schedule.taskId, next, now))
+      const next = nextRunAtMs(schedule.cron, schedule.nextRunAt, schedule.timeZone)
+      this.dispatchRuns(
+        this.ledger.openScheduled(schedule.taskId, next, now),
+        { triggeredAt: now, timeZone: schedule.timeZone, cron: schedule.cron },
+      )
     }
+    // The launched run (or the rolled-forward target) moved every due schedule,
+    // so the next nearest target has to be recomputed from the ledger.
+    this.armSchedule()
   }
 
   private armedSchedules(): number {
@@ -320,18 +507,18 @@ export class TaskBoardHostService {
    * others back. A team run's members are spawned inside the root's Lead
    * session instead, once that session exists.
    */
-  private dispatchRuns(runs: readonly OpenedRun[]): void {
+  private dispatchRuns(runs: readonly OpenedRun[], schedule?: ScheduledRunContext): void {
     if (runs.length === 0) return
     const root = runs.find(run => run.dispatch !== 'teammate') ?? runs[0]
     const others = runs.filter(run => run !== root)
-    this.scheduleLaunch(root, others)
+    this.scheduleLaunch(root, others, schedule)
     for (const run of others) {
-      if (run.dispatch !== 'teammate') this.scheduleLaunch(run)
+      if (run.dispatch !== 'teammate') this.scheduleLaunch(run, [], schedule)
     }
   }
 
-  private scheduleLaunch(opened: OpenedRun, others: readonly OpenedRun[] = []): void {
-    void this.launch(opened, others).catch(error => {
+  private scheduleLaunch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): void {
+    void this.launch(opened, others, schedule).catch(error => {
       safeConsoleError('[dsh-task-board] execution launch settlement failed', error)
     })
   }
@@ -344,12 +531,18 @@ export class TaskBoardHostService {
     }).finally(() => { this.pollInFlight = false })
   }
 
-  private scheduleTick(first: boolean): void {
-    if (this.tickInFlight || this.disposed) return
-    this.tickInFlight = true
-    void this.tickSchedule(first).catch(error => {
-      safeConsoleError('[dsh-task-board] scheduler tick failed', error)
-    }).finally(() => { this.tickInFlight = false })
+  /**
+   * Re-arm from the ledger's current targets. Callers that just changed a
+   * schedule (the host routes, the agent tools) invoke this after the write
+   * commits, so a new or edited trigger arms without waiting for the next fire.
+   */
+  refreshSchedule(): void {
+    if (this.disposed) return
+    if (!this.active) {
+      this.clearScheduleTimer()
+      return
+    }
+    this.armSchedule()
   }
 
   private syncPowerReasons(): void {

package/src/index.ts

@@ -17,7 +17,7 @@ import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-tools'
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
 import type { LlmRuntime } from '@deepseek-ai/dsh-llm'
-import { TaskBoardHostService, type TaskBoardTeamDispatcher } from './host-service.ts'
+import { TaskBoardHostService, type HostTimerFace, type TaskBoardTeamDispatcher } from './host-service.ts'
 import { parseTaskDraft, TaskParseError } from './host-ai.ts'
 import { TASK_PERMISSIONS, type TaskPermission } from './core/tasks.ts'
 import { DEFAULT_SUBTASK_DEPTH, SUBTASK_DEPTH_MAX, SUBTASK_DEPTH_MIN } from './core/subtask.ts'
@@ -179,6 +179,27 @@ export function resolveToolRegistry(ctx: Context): AgentToolRegistry | undefined
   }
 }
 
+/**
+ * Resolve the native cordis timer service (dsh-base's own `cordis-plugin-timer`
+ * row). The board arms its schedule through it so unloading the row clears
+ * every pending timer with the owning fiber, instead of the row tracking raw
+ * process handles by hand. A composition that serves no timer service keeps
+ * working on the process globals.
+ * @param ctx - the plugin context.
+ * @returns the timer face, or undefined when this deployment serves none.
+ */
+export function resolveHostTimers(ctx: Context): HostTimerFace | undefined {
+  try {
+    const timer = ctx.get('timer') as Partial<HostTimerFace> | undefined
+    if (timer === undefined) return undefined
+    return typeof timer.timeout === 'function' && typeof timer.interval === 'function'
+      ? { timeout: timer.timeout.bind(timer), interval: timer.interval.bind(timer) }
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /** Schema default, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULT_ANNOUNCE = false
 
@@ -301,6 +322,7 @@ function applyImpl(ctx: Context, config?: Config): void {
     workspaceRegistry: ctx.workspaceRegistry,
     sessionDefaultPermission: config?.sessionDefaultPermission ?? DEFAULT_SESSION_PERMISSION,
     maxSubtaskDepth: maxSubtaskDepth(),
+    timers: resolveHostTimers(ctx),
     team: buildTeamDispatcher(ctx, config?.teamProvider ?? DEFAULT_TEAM_PROVIDER),
     commandDispatcher: {
       async execute(sessionId, line, signal) {

package/src/mount-once.ts

@@ -5,44 +5,138 @@
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
- * and fail the boot. mountOnce makes the second host apply a no-op for the
- * lifetime of the first instance (the browser half is already deduped by
- * package name in the client module host).
+ * and fail the boot. mountOnce makes a mount of an already-mounted package a
+ * no-op for as long as the first instance lives (the browser half is already
+ * deduped by package name in the client module host).
+ *
+ * A no-op is only safe while the holder is ALIVE. The holder can be disposed
+ * long after the refused mount ran its course: the Host reloads a profile by
+ * creating the new loader entries before the old ones are torn down (a
+ * plugin-manager enable/disable/install write, a settings-driven row reload,
+ * HMR), so the new aggregate shell entry mounts its family plugin while the
+ * previous entry still owns the name. Dropping that refused mount lost the
+ * plugin for good - the previous entry then disposed its own mount, releasing
+ * the name with nobody left to take it, and the family row stayed listed as
+ * active while its host routes 404ed (the task-board panel showed
+ * "board.hostError.notMounted", no degraded record appeared, and only a Host
+ * restart recovered it).
+ *
+ * The refused mount is therefore QUEUED, not dropped, and replayed the moment
+ * the holder releases the name - if the waiting fiber is still alive then. The
+ * single-instance guarantee is unchanged: exactly one mount is live per
+ * package name, and the replay re-enters the guard so a later mount still
+ * dedupes against it.
  *
  * The registry rides a global symbol so two module instances of the same
- * package (npm copy vs repository link) still share one verdict. cordis
- * `ctx.effect` runs its callback immediately and treats the callback's
+ * package (npm copy vs repository link) still share one verdict. That symbol
+ * is a CROSS-REPOSITORY contract, not this file's private state: the four
+ * satellite packages (dsh-skins / dsh-pet / dsh-presets /
+ * dsh-community-plugins) are separate repositories carrying their own copy of
+ * this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+ * must keep the shape every published copy reads (a `Set` of package names
+ * with `has`/`add`/`delete`). The wait queues this guard added therefore live
+ * under their own additive key, and the registry reads back a `Set` even when
+ * some other build left a different value there. Changing `MOUNTED`'s shape
+ * in place broke that contract once: a satellite's legacy copy created a
+ * `Set`, the family's new copy read it as a `Map`, and every family row
+ * mounted after it failed with "claims.get is not a function".
+ *
+ * cordis `ctx.effect` runs its callback immediately and treats the callback's
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
 
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for('dsh-web.mounted-plugins')
 
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for('dsh-web.mounted-plugins.waiters')
+
+/** The slice of a cordis context this guard touches. */
+interface MountContext {
+  effect?: (effect: () => unknown) => unknown
+}
+
+/** One mount that was refused while another fiber owned the package name. */
+interface PendingMount {
+  /** Replay the refused mount; a no-op once its own fiber has been disposed. */
+  run(): void
+}
+
 interface MountRegistry {
-  [MOUNTED]?: Set<string>
+  [MOUNTED]?: unknown
+  [WAITERS]?: Map<string, PendingMount[]>
 }
 
+/**
+ * The shared name registry, always a `Set` whatever another build stored here:
+ * a foreign value (an interim shape, a hand-written global) must not take every
+ * family plugin down with it.
+ * @returns the process-wide set of mounted package names.
+ */
 function mountedSet(): Set<string> {
   const registry = globalThis as MountRegistry
-  return (registry[MOUNTED] ??= new Set())
+  const existing = registry[MOUNTED]
+  if (existing instanceof Set) return existing as Set<string>
+  const created = new Set<string>()
+  registry[MOUNTED] = created
+  return created
+}
+
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters(): Map<string, PendingMount[]> {
+  const registry = globalThis as MountRegistry
+  return (registry[WAITERS] ??= new Map())
 }
 
 /**
  * Wrap a cordis plugin apply so the package runs at most once per process.
- * The first mount registers normally and unmarks when its fiber disposes;
- * any later mount of the same package name is a no-op.
+ * The first mount registers normally and releases the name when its fiber
+ * disposes; a mount refused while that name is held waits for the release and
+ * then runs, unless its own fiber disposes first.
  * @param packageName - npm package identity shared by every install source.
  * @param fn - the original plugin apply.
  * @returns an apply of the same shape.
  */
 export function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T {
-  return ((...args: unknown[]) => {
+  const mount = (...args: unknown[]): unknown => {
     const mounted = mountedSet()
-    if (mounted.has(packageName)) return
+    const ctx = args[0] as MountContext | undefined
+    if (mounted.has(packageName)) {
+      // Another fiber (the aggregate row, a standalone install, or a copy built
+      // from an older revision of this guard) owns the name. Queue instead of
+      // dropping: dropping lost the plugin for the rest of the process when the
+      // holder was disposed by a reload.
+      const waiters = mountWaiters()
+      const queue = waiters.get(packageName) ?? []
+      let alive = true
+      const pending: PendingMount = {
+        run: () => {
+          if (alive) mount(...args)
+        },
+      }
+      // A fiber that dies while it waits must not be replayed afterwards: its
+      // context is disposed and registering effects on it would throw.
+      ctx?.effect?.(() => () => {
+        alive = false
+        const index = queue.indexOf(pending)
+        if (index >= 0) queue.splice(index, 1)
+      })
+      queue.push(pending)
+      waiters.set(packageName, queue)
+      return
+    }
     mounted.add(packageName)
-    const ctx = args[0] as { effect?: (effect: () => unknown) => unknown } | undefined
     ctx?.effect?.(() => () => {
       mounted.delete(packageName)
+      const waiters = mountWaiters()
+      const queue = waiters.get(packageName)
+      if (queue === undefined) return
+      waiters.delete(packageName)
+      // Defer the handover one microtask so the disposing mount's own effects
+      // (routes, ledger, timers) are torn down before the next one registers.
+      for (const waiter of queue.splice(0)) queueMicrotask(() => { waiter.run() })
     })
     return fn(...args)
-  }) as T
+  }
+  return mount as T
 }