@mnemonik/shared 7.152.1 → 7.154.0

package/src/gateOutbox.ts

@@ -0,0 +1,181 @@
+/**
+ * Gate telemetry rides the next injections request instead of its own.
+ *
+ * Why: every PreToolUse a hook gated used to end with an awaited POST
+ * /api/v1/hooks/gate-fired, a whole extra round trip (about 220 ms from New
+ * Zealand to us-east-1) after the decision was already made, because the host
+ * waits for the hook process to exit. Measured on 26 October 2026 it was about
+ * 30% of a PreToolUse hook's process time on an idle machine, and one in three
+ * hook requests the server received. The event is telemetry: who gated what,
+ * how, and the action observation for credit capture. Nothing on the agent's
+ * path waits for it.
+ *
+ * So the hook writes the event to a small per-session folder (synchronous, no
+ * network) and the next injections request of the same session claims the
+ * events and carries them as `gateEvents`; the server records them exactly as
+ * the gate-fired route does. A request that gets no answer puts its events
+ * back for the next one; each event carries an id the server records once, so
+ * a request that was recorded but whose answer was lost does not count twice.
+ * Events still queued when a session goes idle for GATE_OUTBOX_MAX_AGE_MS are
+ * dropped, and the folder holds at most GATE_OUTBOX_CAP events (the oldest
+ * go first), so a server that stays unreachable cannot grow it without
+ * bound. Temporary and claimed files a killed hook process left behind are
+ * swept after GATE_OUTBOX_STRAY_MS. Never throws.
+ *
+ * One file per event, written to a temporary name and renamed into the folder,
+ * and claimed by renaming it again: a reader never sees half an event, two
+ * hook processes never claim the same one, and a writer racing a reader never
+ * loses its event.
+ */
+
+import { randomUUID } from 'node:crypto';
+import {
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+
+/** The per-session folder name (pass it to the host's session state path helper). */
+export const GATE_OUTBOX_FILE = 'gate-outbox';
+
+/** The most events one request carries; the server accepts the same. */
+export const GATE_OUTBOX_MAX_EVENTS = 32;
+
+/** Events older than this are dropped rather than reported: the session went idle. */
+export const GATE_OUTBOX_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+/** The most events the folder holds; past it the oldest are dropped. */
+export const GATE_OUTBOX_CAP = 500;
+
+/**
+ * A temporary or claimed file older than this belongs to a hook process that
+ * was killed between two renames (a live one holds it for milliseconds).
+ */
+export const GATE_OUTBOX_STRAY_MS = 10 * 60 * 1000;
+
+export interface QueuedGateEvent {
+  /** Unique per event; the server records each id once. */
+  id: string;
+  tool: string;
+  mode: string;
+  outcome: string;
+  /** Epoch ms when the gate fired; the server stores it as the event's time. */
+  at: number;
+  host?: string;
+  cwd?: string;
+  projectId?: string;
+  projectRoot?: string;
+  actionObservation?: unknown;
+}
+
+function write(folder: string, event: QueuedGateEvent): void {
+  mkdirSync(folder, { recursive: true, mode: 0o700 });
+  const name = `${String(event.at).padStart(15, '0')}-${event.id}.json`;
+  const temporary = join(folder, `.${name}.tmp`);
+  writeFileSync(temporary, JSON.stringify(event), { mode: 0o600 });
+  renameSync(temporary, join(folder, name));
+}
+
+const unlinkQuietly = (path: string): void => {
+  try {
+    unlinkSync(path);
+  } catch {
+    // Already gone.
+  }
+};
+
+/** Event file names, oldest first (names start with the zero-padded time). */
+function queuedNames(folder: string): string[] {
+  return readdirSync(folder)
+    .filter((name) => name.endsWith('.json') && !name.startsWith('.'))
+    .sort();
+}
+
+/** Drop the oldest events past GATE_OUTBOX_CAP. */
+function enforceCap(folder: string): void {
+  try {
+    const names = queuedNames(folder);
+    for (const name of names.slice(0, Math.max(0, names.length - GATE_OUTBOX_CAP)))
+      unlinkQuietly(join(folder, name));
+  } catch {
+    // Telemetry.
+  }
+}
+
+export function queueGateEvent(folder: string, event: Omit<QueuedGateEvent, 'id'>): boolean {
+  try {
+    write(folder, { ...event, id: randomUUID() });
+    enforceCap(folder);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Claim every queued event of this session, oldest first, at most
+ * GATE_OUTBOX_MAX_EVENTS (the rest wait for the next request).
+ */
+export function takeGateEvents(folder: string, now: number = Date.now()): QueuedGateEvent[] {
+  let entries: string[];
+  try {
+    entries = readdirSync(folder);
+  } catch {
+    return [];
+  }
+  // Sweep what killed hook processes left between renames.
+  for (const name of entries) {
+    if (!name.startsWith('.') || !(name.endsWith('.tmp') || name.endsWith('.claimed'))) continue;
+    const path = join(folder, name);
+    try {
+      if (now - statSync(path).mtimeMs > GATE_OUTBOX_STRAY_MS) unlinkQuietly(path);
+    } catch {
+      // Gone meanwhile.
+    }
+  }
+  const names = entries.filter((name) => name.endsWith('.json') && !name.startsWith('.')).sort();
+  const events: QueuedGateEvent[] = [];
+  for (const name of names) {
+    if (events.length >= GATE_OUTBOX_MAX_EVENTS) break;
+    const claimed = join(folder, `.${name}.${process.pid}.claimed`);
+    try {
+      renameSync(join(folder, name), claimed);
+    } catch {
+      continue; // Another hook process of this session took it.
+    }
+    try {
+      const event = JSON.parse(readFileSync(claimed, 'utf8')) as QueuedGateEvent;
+      if (
+        typeof event?.id === 'string' &&
+        typeof event.tool === 'string' &&
+        typeof event.mode === 'string' &&
+        typeof event.outcome === 'string' &&
+        typeof event.at === 'number' &&
+        now - event.at <= GATE_OUTBOX_MAX_AGE_MS
+      )
+        events.push(event);
+    } catch {
+      // Unreadable; dropped.
+    } finally {
+      unlinkQuietly(claimed);
+    }
+  }
+  return events;
+}
+
+/** Put back events a request could not deliver, so the next request carries them. */
+export function returnGateEvents(folder: string, events: readonly QueuedGateEvent[]): void {
+  for (const event of events) {
+    try {
+      write(folder, event);
+    } catch {
+      // Lost; telemetry.
+    }
+  }
+  enforceCap(folder);
+}

package/src/hookConversation.ts

@@ -3,6 +3,7 @@ import { constants } from 'node:fs';
 import { lstat, mkdir, open, rename, rm, utimes } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { withFileLock } from './settingsIo.js';
+import { HOOK_REQUEST_ID_HEADER } from './hookTimeouts.js';
 import { ensureWindowsPrivateDirectorySync } from './runtimeSigners.js';
 
 type HookFetchInit = NonNullable<Parameters<typeof fetch>[1]>;
@@ -27,6 +28,15 @@ function boundedHandle(value: unknown): value is string {
 
 export class HookConversation {
   private conversationId?: string;
+  /**
+   * The hook call (x-mnemonik-hook-request-id) whose acquiring request holds
+   * the conversation lock in this process. Its hedged second request
+   * (hedgedHookRequest) is the same call: waiting for the lock would hold it
+   * until the first request finished, which is exactly what the hedge exists
+   * to route around. The server hands both requests the same answer, so the
+   * second may save the handle without the lock.
+   */
+  private lockHeldFor?: string;
   private readonly scope: string;
   constructor(private readonly input: HookConversationInput) {
     this.scope = createHash('sha256')
@@ -185,7 +195,20 @@ export class HookConversation {
       } else if (this.conversationId) await this.save(this.conversationId);
       return response;
     };
-    const response = acquisition ? await this.locked(send) : await send();
+    const callId = hookCallId(init.headers);
+    let response: Response;
+    if (!acquisition || (callId !== undefined && this.lockHeldFor === callId)) {
+      response = await send();
+    } else {
+      response = await this.locked(async () => {
+        this.lockHeldFor = callId;
+        try {
+          return await send();
+        } finally {
+          if (this.lockHeldFor === callId) this.lockHeldFor = undefined;
+        }
+      });
+    }
     // The server refused the cached handle (a signing-secret rotation, say).
     // Forget it so the next acquiring event mints a fresh one; this request
     // is never resent, and a handle another event acquired meanwhile stays.
@@ -263,6 +286,14 @@ export function conversationMarker(): string | undefined {
 export async function adoptHookConversation(result: unknown): Promise<void> {
   await active?.adopt(result);
 }
+function hookCallId(headers: HookFetchInit['headers']): string | undefined {
+  try {
+    return new Headers(headers).get(HOOK_REQUEST_ID_HEADER) ?? undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export function withHookConversation(
   url: string,
   init: HookFetchInit,

package/src/hookRuntime.ts

@@ -295,3 +295,4 @@ export * from './projectSetupHandoff.js';
 
 export * from './hookConversation.js';
 export * from './hookTrace.js';
+export * from './gateOutbox.js';

package/src/hookTimeouts.ts

@@ -1,3 +1,5 @@
+import diagnosticsChannel from 'node:diagnostics_channel';
+
 /**
  * Hook dispatcher HTTP timeout budgets + AbortSignal helper.
  *
@@ -108,51 +110,63 @@ export function withHookTimeout(ms: number): { signal: AbortSignal; cleanup: ()
 }
 
 /**
- * One second attempt on the main hook call (POST /api/v1/hooks/injections).
+ * The main hook call (POST /api/v1/hooks/injections) is hedged: when the first
+ * request has not answered by HOOK_HEDGE_SHARE of the budget, a second request
+ * starts beside it on a fresh connection, and whichever answers first is used.
+ *
+ * Why a second request at all: on 24 October 2026 about a third of one
+ * machine's hook calls were lost for 50 minutes to a stall between Cloudflare
+ * and one load-balancer node. The server had accepted those requests and was
+ * waiting for a body that never finished arriving. A second request opens a new
+ * connection and normally lands on a healthy path.
  *
- * Why it exists: on 24 October 2026 about a third of one machine's hook calls
- * were lost for 50 minutes to a stall between Cloudflare and one load-balancer
- * node. The server had accepted those requests and was waiting for a body that
- * never finished arriving. A second request opens a new connection and
- * normally lands on a healthy path. The call is idempotent by design (the
- * injection bus dedups on the server), so repeating it is safe.
+ * Why it is a hedge and not a retry: v7.149.0 abandoned the first request at
+ * 65% of the budget and then retried. Every hook process opens its own
+ * connection (DNS, TCP and TLS from the user's machine to Cloudflare), and the
+ * credential is read before the request leaves, so on 25 October that first
+ * request had often been on the wire for only a few hundred milliseconds when
+ * it was abandoned. Answers that were merely slow were thrown away, half the
+ * calls on the owner's machine needed two requests, about 8% lost both, and the
+ * load balancer counted each abandoned request as a client close (ELB 460). A
+ * hedge never abandons an answer that is on its way: the first request keeps
+ * running to the end of the budget.
  *
- * Shape: the whole call, both attempts included, still ends inside `budgetMs`,
- * so the budget every hook event is checked against (tests/HookEventBudgets
- * .test.ts) and the host's kill limit do not move. The first attempt gets
- * HOOK_FIRST_ATTEMPT_SHARE of the budget; the second gets whatever is left.
- * A first attempt that fails fast leaves the second nearly the whole budget.
+ * Both requests share one deadline, `budgetMs` from the call, so the budget
+ * every hook event is checked against (tests/HookEventBudgets.test.ts) and the
+ * host's kill limit do not move. A first request that fails fast (a connection
+ * error or a gateway status) starts the second at once instead of at the hedge
+ * point.
  *
- * What is retried: a timeout, a connection error, and the gateway statuses
- * that mean the request never reached the application (408, 502, 503, 504 and
- * Cloudflare's 52x). Nothing else is: a 4xx or a 500 repeats exactly, and a
- * response that arrives is final.
+ * What counts as an answer: any response other than a gateway status (408, 502,
+ * 503, 504, Cloudflare's 52x) and other than the server's "the first request is
+ * still working" reply (HOOK_REPLAY_HEADER: pending). A 4xx or a 500 is an
+ * answer (null to the caller): repeating it would repeat the failure.
  *
- * Nothing is queued or stored on the client. A call that fails twice is dropped,
- * as before. The server keeps an answer for 15 s so the second attempt can have
- * it when the first attempt gave up on an answer that was already decided.
+ * The server de-duplicates the two requests by HOOK_REQUEST_ID_HEADER
+ * (src/server/hookReplay.ts): the second request is handed the first one's
+ * answer, or waits for it, and nothing is counted twice. Nothing is queued or
+ * stored on the client; a call with no answer by the deadline is dropped.
  */
-export const HOOK_FIRST_ATTEMPT_SHARE = 0.65;
+export const HOOK_HEDGE_SHARE = 0.65;
 
-/** Below this much budget left, a second attempt cannot complete a round trip. */
+/** Below this much budget left, a second request cannot complete a round trip. */
 export const HOOK_SECOND_ATTEMPT_MIN_MS = 300;
 
-/** Sent on every attempt so the server can count how many calls needed a second one. */
+/** Sent on every request: 1 for the first, 2 for the hedge. */
 export const HOOK_ATTEMPT_HEADER = 'x-mnemonik-hook-attempt';
 
 /**
- * Sent on both attempts with the same value. The server keeps the first
- * attempt's answer for a few seconds under this id and hands it to the second
- * attempt, so an answer decided after the first attempt gave up is delivered
- * rather than lost, and nothing is counted twice (src/server/hookReplay.ts).
+ * Sent on both requests with the same value. The server keeps the first
+ * request's answer for a few seconds under this id and hands it to the second,
+ * so an answer decided by one request is delivered through either, and nothing
+ * is counted twice (src/server/hookReplay.ts).
  */
 export const HOOK_REQUEST_ID_HEADER = 'x-mnemonik-hook-request-id';
 
 /**
- * Sent on every attempt: how many milliseconds this attempt may still take.
- * The server never waits for a first attempt's answer longer than this less a
- * margin for the return trip, so it does not hold a request for a client that
- * has already given up.
+ * Sent on every request: how many milliseconds the caller will still wait. The
+ * server fits its own work inside this less the return trip, so it never
+ * decides an answer the client will not be there to receive.
  */
 export const HOOK_BUDGET_HEADER = 'x-mnemonik-hook-budget-ms';
 
@@ -171,11 +185,75 @@ export function withHookVersion<T extends { headers?: unknown }>(
   runtime: string,
   version: string
 ): T {
-  const headers = new Headers(init.headers as ConstructorParameters<typeof Headers>[0]);
+  const raw = init.headers;
+  if (raw && typeof raw === 'object' && !(raw instanceof Headers) && !Array.isArray(raw)) {
+    // A plain record is copied with its property descriptors, not its values:
+    // the hedged hook client's budget header is a getter read when the
+    // request is sent, after the credential is read (hedgedHookRequest).
+    const headers = Object.defineProperties({}, Object.getOwnPropertyDescriptors(raw)) as Record<
+      string,
+      string
+    >;
+    for (const name of Object.keys(headers)) {
+      if (name.toLowerCase() === HOOK_VERSION_HEADER) delete headers[name];
+    }
+    headers[HOOK_VERSION_HEADER] = `${runtime}/${version}`;
+    return { ...init, headers };
+  }
+  const headers = new Headers(raw as ConstructorParameters<typeof Headers>[0]);
   headers.set(HOOK_VERSION_HEADER, `${runtime}/${version}`);
   return { ...init, headers: Object.fromEntries(headers.entries()) };
 }
 
+/**
+ * Sent on every request by a hedging client (hedgedHookRequest). Its budget
+ * header is what the whole call still has; clients v7.149 to v7.151 sent the
+ * first attempt's own 1.3 s cut-off instead, so a server that sees no marker
+ * assumes the whole-call 2 s budget rather than trusting that header.
+ */
+export const HOOK_HEDGED_HEADER = 'x-mnemonik-hook-hedged';
+
+/**
+ * Sent on the second request only: what had become of the first when the second
+ * left. `pending; sent=812` (still waiting, its body finished sending 812 ms
+ * earlier), `pending; sent=none` (it had not finished sending, so the client
+ * itself was slow), `gateway; sent=<ms>` (the edge answered 502/503/504/52x) or
+ * `transport; sent=<ms>` (the connection failed). The server uses it to count
+ * requests the network lost on the way in, which is what the edge alarm reads
+ * (src/server/hookReplay.ts, hookEdgeMetrics.ts).
+ */
+export const HOOK_FIRST_ATTEMPT_HEADER = 'x-mnemonik-hook-first-attempt';
+
+/**
+ * Set by the server on a reply that is not an answer: the request found the
+ * other request of the same call still working on it and could not wait any
+ * longer. The client keeps waiting for the other request.
+ */
+export const HOOK_REPLAY_HEADER = 'x-mnemonik-hook-replay';
+export const HOOK_REPLAY_PENDING = 'pending';
+
+export type HookFirstAttemptState = 'pending' | 'gateway' | 'transport';
+
+export interface HookFirstAttempt {
+  state: HookFirstAttemptState;
+  /** Milliseconds since the first request finished sending its body; null when it had not. */
+  sentAgoMs: number | null;
+}
+
+export function formatHookFirstAttempt(first: HookFirstAttempt): string {
+  return `${first.state}; sent=${first.sentAgoMs === null ? 'none' : Math.max(0, Math.round(first.sentAgoMs))}`;
+}
+
+export function parseHookFirstAttempt(value: unknown): HookFirstAttempt | null {
+  if (typeof value !== 'string') return null;
+  const match = /^(pending|gateway|transport); sent=(none|\d{1,6})$/.exec(value.trim());
+  if (!match) return null;
+  return {
+    state: match[1] as HookFirstAttemptState,
+    sentAgoMs: match[2] === 'none' ? null : Number(match[2]),
+  };
+}
+
 /** Statuses that mean the request did not reach, or was not served by, the application. */
 export function isRetryableHookStatus(status: number): boolean {
   return (
@@ -200,44 +278,157 @@ export function isTransientHookFetchError(error: unknown): boolean {
   );
 }
 
-export type HookAttemptResult<T> = { done: true; value: T } | { done: false };
+/**
+ * When the first request finished sending its body, read from Node's fetch
+ * (undici) diagnostics channels. Matched by the request id header, so other
+ * requests the process makes at the same time are ignored. Reports null when
+ * the channels are unavailable or the body never finished sending; nothing
+ * depends on it except the HOOK_FIRST_ATTEMPT_HEADER the server counts.
+ */
+function watchFirstRequestSent(
+  requestId: string,
+  clock: () => number
+): { sentAt(): number | null; stop(): void } {
+  let sentAt: number | null = null;
+  let request: object | null = null;
+  const onCreate = (message: unknown): void => {
+    const candidate = (message as { request?: { headers?: unknown } } | null)?.request;
+    if (request || !candidate) return;
+    if (String(candidate.headers ?? '').includes(requestId)) request = candidate;
+  };
+  const onBodySent = (message: unknown): void => {
+    if (sentAt === null && request && (message as { request?: object })?.request === request) {
+      sentAt = clock();
+    }
+  };
+  try {
+    diagnosticsChannel.subscribe('undici:request:create', onCreate);
+    diagnosticsChannel.subscribe('undici:request:bodySent', onBodySent);
+  } catch {
+    return { sentAt: () => null, stop: () => undefined };
+  }
+  return {
+    sentAt: () => sentAt,
+    stop: () => {
+      try {
+        diagnosticsChannel.unsubscribe('undici:request:create', onCreate);
+        diagnosticsChannel.unsubscribe('undici:request:bodySent', onBodySent);
+      } catch {
+        // Nothing to undo.
+      }
+    },
+  };
+}
+
+type HookAttemptOutcome<T> =
+  { final: true; value: T | null } | { final: false; kind: 'gateway' | 'transport' | 'pending' };
 
 /**
- * Run `attempt` and, when it ends in a transient failure, run it once more
- * inside the rest of `budgetMs`. Returns the value of the attempt that
- * finished, or null when neither did. `attempt` returns `{ done: false }` for
- * a retryable response and throws for a transport failure; anything else it
- * returns is final.
+ * Send one hook call as up to two hedged requests inside `budgetMs` (see
+ * HOOK_HEDGE_SHARE). `send` performs one request with the headers and signal it
+ * is given; `parse` reads an answer. Returns the first answer, null when no
+ * request answered in time or the answer was an error status, and rejects only
+ * when `send` or `parse` fails in a way that is not a transport failure.
  */
-export async function withSecondAttempt<T>(
+export function hedgedHookRequest<T>(
   budgetMs: number,
-  attempt: (
-    signal: AbortSignal,
-    attemptNumber: 1 | 2,
-    requestId: string,
-    budgetMs: number
-  ) => Promise<HookAttemptResult<T>>,
+  send: (headers: Record<string, string>, signal: AbortSignal) => Promise<Response>,
+  parse: (response: Response) => Promise<T>,
   clock: () => number = Date.now
 ): Promise<T | null> {
   const startedAt = clock();
+  const deadline = startedAt + budgetMs;
   const requestId = globalThis.crypto.randomUUID();
-  const run = async (attemptNumber: 1 | 2, timeoutMs: number): Promise<HookAttemptResult<T>> => {
-    const { signal, cleanup } = withHookTimeout(timeoutMs);
-    try {
-      return await attempt(signal, attemptNumber, requestId, timeoutMs);
-    } catch (error) {
-      if (!isTransientHookFetchError(error)) throw error;
-      return { done: false };
-    } finally {
-      cleanup();
-    }
-  };
+  const sent = watchFirstRequestSent(requestId, clock);
+  const controllers: AbortController[] = [];
+
+  return new Promise<T | null>((resolve, reject) => {
+    let settled = false;
+    let running = 0;
+    let secondStarted = false;
+    let firstFailure: 'gateway' | 'transport' | null = null;
+    let hedgeTimer: ReturnType<typeof setTimeout> | undefined;
+
+    const finish = (value: T | null, error?: unknown, winner?: AbortController): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadlineTimer);
+      clearTimeout(hedgeTimer);
+      sent.stop();
+      // Cancel whatever is still in flight; the request that answered is done.
+      for (const controller of controllers) if (controller !== winner) controller.abort();
+      if (error !== undefined) reject(error);
+      else resolve(value);
+    };
+    const deadlineTimer = setTimeout(() => finish(null), budgetMs);
+
+    const startSecond = (): boolean => {
+      if (settled || secondStarted) return secondStarted;
+      if (deadline - clock() < HOOK_SECOND_ATTEMPT_MIN_MS) return false;
+      secondStarted = true;
+      clearTimeout(hedgeTimer);
+      launch(2);
+      return true;
+    };
 
-  const first = await run(1, Math.floor(budgetMs * HOOK_FIRST_ATTEMPT_SHARE));
-  if (first.done) return first.value;
+    const launch = (attemptNumber: 1 | 2): void => {
+      const controller = new AbortController();
+      controllers.push(controller);
+      const now = clock();
+      const headers: Record<string, string> = {
+        [HOOK_ATTEMPT_HEADER]: String(attemptNumber),
+        [HOOK_REQUEST_ID_HEADER]: requestId,
+        [HOOK_HEDGED_HEADER]: '1',
+      };
+      // Read when the request is actually built (after the credential read or
+      // rotation and the conversation lock), not when the attempt starts, so
+      // the server's deadline does not include time already spent here.
+      Object.defineProperty(headers, HOOK_BUDGET_HEADER, {
+        enumerable: true,
+        get: () => String(Math.max(0, Math.floor(deadline - clock()))),
+      });
+      if (attemptNumber === 2) {
+        const sentAt = sent.sentAt();
+        headers[HOOK_FIRST_ATTEMPT_HEADER] = formatHookFirstAttempt({
+          state: firstFailure ?? 'pending',
+          sentAgoMs: sentAt === null ? null : now - sentAt,
+        });
+      }
+      running += 1;
+      void (async () => {
+        let outcome: HookAttemptOutcome<T>;
+        try {
+          const response = await send(headers, controller.signal);
+          if (isRetryableHookStatus(response.status)) outcome = { final: false, kind: 'gateway' };
+          else if (response.headers.get(HOOK_REPLAY_HEADER) === HOOK_REPLAY_PENDING)
+            outcome = { final: false, kind: 'pending' };
+          else if (!response.ok) outcome = { final: true, value: null };
+          else outcome = { final: true, value: await parse(response) };
+        } catch (error) {
+          if (!settled && !isTransientHookFetchError(error)) {
+            running -= 1;
+            finish(null, error);
+            return;
+          }
+          outcome = { final: false, kind: 'transport' };
+        }
+        running -= 1;
+        if (settled) return;
+        if (outcome.final) {
+          finish(outcome.value, undefined, controller);
+          return;
+        }
+        // Not an answer. The first request's failure starts the second at once;
+        // with no request left running there is no answer to wait for.
+        if (attemptNumber === 1) {
+          if (outcome.kind !== 'pending') firstFailure = outcome.kind;
+          startSecond();
+        }
+        if (running === 0) finish(null);
+      })();
+    };
 
-  const remainingMs = budgetMs - (clock() - startedAt);
-  if (remainingMs < HOOK_SECOND_ATTEMPT_MIN_MS) return null;
-  const second = await run(2, Math.floor(remainingMs));
-  return second.done ? second.value : null;
+    launch(1);
+    hedgeTimer = setTimeout(startSecond, Math.floor(budgetMs * HOOK_HEDGE_SHARE));
+  });
 }