crbro-memory 2.10.0 → 2.11.0

package/dist/daemon/proxy.js

@@ -5,17 +5,22 @@
 // always has. In daemon mode that process loads no index and no model: it
 // finds the daemon (or starts it), proves who it is, and from then on copies
 // lines — client to daemon, daemon to client. It reads each line only to keep
-// three things it needs on the worst day:
+// what it needs on the worst day:
 //
-//   · the client's `initialize`, so that if the daemon dies the handshake can
-//     be replayed against its replacement without the client ever knowing;
+//   · `initialize`, `ping` and `tools/list` it answers itself, at once: their
+//     answers are fixed per build (surface.ts) and a client must not wait for
+//     a daemon to be found or started to learn them;
+//   · the client's `initialize`, which it replays — under an id of its own,
+//     answer swallowed — on every backend it attaches to, the first included;
 //   · which requests are in flight, so each gets an error instead of a
 //     silence that would hang the conversation until a timeout;
 //   · nothing else.
 //
-// And if no daemon can be had at all, the backend is a server inside this
+// And if no daemon can be had in time, the backend is a server inside this
 // process — CRBRO exactly as it was before 2.5. The daemon is an optimisation;
-// the memory is not allowed to depend on it.
+// the memory is not allowed to depend on it. Nor is that fallback for life:
+// the proxy keeps looking, quietly, and moves back to a daemon once one
+// answers and nothing is running here.
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -32,25 +37,40 @@ const lines_js_1 = require("./lines.js");
 const endpoint_js_1 = require("./endpoint.js");
 const CONNECT_TIMEOUT_MS = 1_500;
 const HANDSHAKE_TIMEOUT_MS = 4_000;
+/** The whole budget for a daemon (finding it, starting it, its handshake) before serving in-process. Every attempt fits inside it. */
 const SPAWN_WAIT_MS = 12_000;
 const POLL_MS = 200;
-/** Daemon connections lost inside this window before the proxy stops trusting daemons for the rest of its life. */
+/** Daemon connections lost inside this window before the proxy stops trying daemons for a while. */
 const FLAP_WINDOW_MS = 60_000;
 const FLAP_LIMIT = 3;
+/** How long "a while" is, the first time; it doubles on each new burst, up to the cap. Never for ever. */
+const FLAP_COOLDOWN_MS = 60_000;
+const MAX_COOLDOWN_MS = 10 * 60_000;
+/** Serving in-process: how often to look for a daemon again (doubling between the two). */
+const PROBE_MIN_MS = 2_000;
+const PROBE_MAX_MS = 60_000;
+const PROBE_BUDGET_MS = 3_000;
+/** A daemon that refused calls because it is stopping, and then did not go: how long before we stop waiting for it. */
+const STOPPING_GRACE_MS = 15_000;
 /** After the client closes its end: how long calls already accepted may take to finish before we leave anyway. */
 const DRAIN_TIMEOUT_MS = 30_000;
+const LOST_MESSAGE = 'CRBRO restarted while this call was running, before answering it. The call may or may not have taken effect: check (crbro_recall or crbro_inspect) before repeating a write.';
 /**
  * Connect to the daemon of this brain and build, and get through the
  * handshake. Null on any failure; 'config-mismatch' when the daemon is
  * genuine but was started with settings that are not this client's.
+ * `deadline` (epoch ms) bounds the whole attempt: no step waits past it.
  */
 async function connectDaemon(brainRoot, build = (0, endpoint_js_1.buildId)(), options = {}) {
+    const left = () => (options.deadline === undefined ? Infinity : options.deadline - Date.now());
+    if (left() <= 0)
+        return null;
     const state = await (0, endpoint_js_1.readState)(brainRoot, build);
     if (!state)
         return null;
     const socket = await new Promise(resolve => {
         const s = node_net_1.default.connect(state.endpoint);
-        const t = setTimeout(() => { s.destroy(); resolve(null); }, CONNECT_TIMEOUT_MS);
+        const t = setTimeout(() => { s.destroy(); resolve(null); }, Math.max(1, Math.min(CONNECT_TIMEOUT_MS, left())));
         s.once('connect', () => { clearTimeout(t); resolve(s); });
         s.once('error', () => { clearTimeout(t); resolve(null); });
     });
@@ -62,8 +82,11 @@ async function connectDaemon(brainRoot, build = (0, endpoint_js_1.buildId)(), op
     socket.on('data', chunk => lines.push(typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk));
     socket.on('error', () => undefined);
     const next = () => new Promise(resolve => {
-        const t = setTimeout(() => resolve(null), HANDSHAKE_TIMEOUT_MS);
-        const done = (v) => { clearTimeout(t); socket.off('close', onClose); resolve(v); };
+        let settled = false;
+        const done = (v) => { if (settled)
+            return; settled = true; clearTimeout(t); socket.off('close', onClose); resolve(v); };
+        // An answer that arrived while this loop was busy is read before the timeout is believed.
+        const t = setTimeout(() => setImmediate(() => done(null)), Math.max(1, Math.min(HANDSHAKE_TIMEOUT_MS, left())));
         const onClose = () => done(null);
         socket.once('close', onClose);
         sink = line => { sink = () => undefined; try {
@@ -123,37 +146,7 @@ function spawnDetachedDaemon(brainRoot) {
     child.on('error', () => undefined);
     child.unref();
 }
-/** 'unusable': a daemon exists but is not for us, or cannot be had — do not wait for one, and do not ask again. */
-async function daemonBackend(o, ev, resumed) {
-    const build = o.build ?? (0, endpoint_js_1.buildId)();
-    let c = await connectDaemon(o.brainRoot, build, { resumed });
-    if (!c && o.spawnDaemon) {
-        const since = Date.now() - 1_000;
-        try {
-            await o.spawnDaemon();
-        }
-        catch (err) {
-            o.log?.(`could not start a daemon: ${err.message}`);
-        }
-        const until = Date.now() + (o.spawnWaitMs ?? SPAWN_WAIT_MS);
-        while (!c && Date.now() < until) {
-            await new Promise(r => setTimeout(r, POLL_MS));
-            c = await connectDaemon(o.brainRoot, build, { resumed });
-            if (!c) {
-                const why = await (0, endpoint_js_1.blockedSince)(o.brainRoot, build, since);
-                if (why) {
-                    o.log?.(`the daemon could not take its endpoint (${why}): serving from this process`);
-                    return 'unusable';
-                }
-            }
-        }
-    }
-    if (c === 'config-mismatch') {
-        o.log?.('a daemon is running with other settings than this client\'s (CRBRO_SEMANTIC, CRBRO_BACKUP_DIR…): serving from this process so they keep their meaning');
-        return 'unusable';
-    }
-    if (!c)
-        return null;
+function linkBackend(c, ev) {
     const { socket, reader } = c;
     let closing = false;
     reader(ev.onLine);
@@ -175,13 +168,47 @@ async function daemonBackend(o, ev, resumed) {
         }),
     };
 }
+/** 'unusable': a daemon exists but is not for us, or cannot be had — do not wait for one. */
+async function daemonBackend(a, ev) {
+    let c = await connectDaemon(a.brainRoot, a.build, { resumed: a.resumed, deadline: a.deadline });
+    if (!c && a.spawn) {
+        const since = Date.now() - 1_000;
+        try {
+            await a.spawn();
+        }
+        catch (err) {
+            a.log(`could not start a daemon: ${err.message}`);
+        }
+        a.trace('daemon launched', '', true);
+        while (!c && Date.now() < a.deadline) {
+            await new Promise(r => setTimeout(r, Math.max(1, Math.min(POLL_MS, a.deadline - Date.now()))));
+            c = await connectDaemon(a.brainRoot, a.build, { resumed: a.resumed, deadline: a.deadline });
+            if (!c) {
+                const why = await (0, endpoint_js_1.blockedSince)(a.brainRoot, a.build, since);
+                if (why) {
+                    a.log(`the daemon could not start (${why}): serving from this process`);
+                    return 'unusable';
+                }
+            }
+        }
+    }
+    if (c === 'config-mismatch') {
+        if (!a.quiet)
+            a.log('a daemon is running with other settings than this client\'s (CRBRO_SEMANTIC, CRBRO_BACKUP_DIR…): serving from this process so they keep their meaning');
+        return 'unusable';
+    }
+    if (!c)
+        return null;
+    return linkBackend(c, ev);
+}
 /** CRBRO as it was before daemons: the whole server, in this process. */
 async function localBackend(ev, resumed) {
     const { createEngines, createServer } = await import('../server.js');
     const { sessionScope, newTally } = await import('../engine/cortex.js');
     const engines = createEngines();
     const transport = new lines_js_1.LoopbackTransport(ev.onLine);
-    await createServer(engines).connect(transport);
+    const server = createServer(engines);
+    await server.connect(transport);
     // After a lost daemon this server starts with an empty tally that the
     // conversation's earlier writes are not in: mark it, so consolidate says so.
     const scope = resumed ? { tally: newTally(), resumed: true } : null;
@@ -194,47 +221,102 @@ async function localBackend(ev, resumed) {
                 await engines.searchEngine.flush();
             }
             catch { /* derived data */ }
+            try {
+                await server.close();
+            }
+            catch { /* leaving anyway */ }
         },
     };
 }
+const isRequest = (m) => !!m && typeof m.method === 'string' && m.id !== undefined && m.id !== null;
+const requestIdOf = (line) => {
+    try {
+        const q = JSON.parse(line);
+        return isRequest(q) ? q.id : null;
+    }
+    catch {
+        return null;
+    }
+};
 function runProxy(o) {
     const log = o.log ?? (() => undefined);
+    const trace = o.trace ?? (() => undefined);
     const isEnabled = o.isEnabled ?? (() => true);
     const makeLocal = o.local ?? localBackend;
+    // Once, here: a proxy that recomputed it at every reconnection could pick up
+    // a newer release unpacked in place and launch a daemon of code it never ran.
+    const build = o.build ?? (0, endpoint_js_1.buildId)();
+    const budgetMs = o.spawnWaitMs ?? SPAWN_WAIT_MS;
+    const probeMin = o.probeMs?.min ?? PROBE_MIN_MS;
+    const probeMax = o.probeMs?.max ?? PROBE_MAX_MS;
+    // ── The backend, and where it is in its own handshake ──
     let backend = null;
-    let connecting = true;
+    let gen = 0; // every backend attempt gets a number; only the active one is listened to
+    let activeGen = -1;
+    let pendingGen = -1; // a daemon link held while moving over to it
+    let pending = null;
+    let phase = 'none';
+    let backendInitDone = false;
+    let acquiring = true;
+    let switching = false;
     let inputEnded = false; // the client closed its end: no more requests, but what it asked for is still owed
     let ended = false; // we are done: nothing more is written, nothing more is started
     let reconnects = 0;
-    let trustDaemons = true;
+    let switches = 0;
+    let distrustUntil = 0;
+    let cooldownMs = o.flapCooldownMs ?? FLAP_COOLDOWN_MS;
     const losses = [];
-    let initialize = null;
-    let initialized = null;
-    const inflight = new Set();
-    const waiting = []; // client lines held while there is no usable backend
-    let replayId = null; // id of the initialize we are replaying, while its answer is pending
+    // ── What the client said that we must remember ──
+    let surface = o.surface;
+    const early = []; // lines that arrived before we knew whether we have a surface
+    let clientInit = null;
+    let initAnswered = false; // the client has its answer to initialize (ours, or a backend's)
+    let clientInitialized = null;
+    const inflight = new Map(); // sent to the backend, unanswered: id → the line, should it need sending again
+    const waiting = []; // client lines held while there is no ready backend
+    const toolCalls = new Set();
+    let replayId = null;
     let replays = 0;
+    // The client's last crbro_boot that succeeded: the project it bound lives on
+    // the backend that served it, so a new backend gets it again (2.11).
+    let lastBoot = null;
+    const bootCalls = new Map(); // crbro_boot calls sent, unanswered → their params
+    let rebootId = null;
+    let requeueAt = 0; // where the next call a stopping daemon never started goes back in line
     let drainTimer = null;
+    let probeTimer = null;
+    let probeDelay = probeMin;
+    let stoppingTimer = null;
+    let idleWaiters = [];
     let resolveClosed;
     let rejectClosed;
     const closed = new Promise((res, rej) => { resolveClosed = res; rejectClosed = rej; });
     const toClient = (line) => { if (!ended)
         o.output.write(`${line}\n`); };
+    const ready = () => backend !== null && phase === 'ready' && !switching;
+    const owed = () => inflight.size > 0 || waiting.some(l => requestIdOf(l) !== null) || early.some(l => requestIdOf(l) !== null);
+    const daemonsWanted = () => isEnabled() && Date.now() >= distrustUntil;
     /** Leave — but only once every call the client made has been answered and written out. */
     const maybeFinish = () => {
-        if (ended || !inputEnded || connecting || waiting.length > 0 || inflight.size > 0)
+        if (ended || !inputEnded || owed())
             return;
         void shutdown();
     };
     const shutdown = async () => {
         if (ended)
             return;
-        if (drainTimer)
-            clearTimeout(drainTimer);
+        ended = true;
+        for (const t of [drainTimer, probeTimer, stoppingTimer])
+            if (t)
+                clearTimeout(t);
         try {
             await backend?.close();
         }
         catch { /* leaving anyway */ }
+        try {
+            await pending?.close();
+        }
+        catch { /* leaving anyway */ }
         // stdout on a Windows pipe is asynchronous: the caller exits the process
         // next, and the last answer must be out of our hands before it does.
         await new Promise(resolve => { try {
@@ -243,9 +325,54 @@ function runProxy(o) {
         catch {
             resolve();
         } });
-        ended = true;
         resolveClosed();
     };
+    const settleIdle = () => {
+        if (inflight.size > 0 || phase === 'handshaking')
+            return;
+        const w = idleWaiters;
+        idleWaiters = [];
+        for (const f of w)
+            f();
+    };
+    const whenIdle = () => new Promise(resolve => {
+        if (inflight.size === 0 && phase !== 'handshaking')
+            resolve();
+        else
+            idleWaiters.push(resolve);
+    });
+    const forward = (line) => {
+        const id = requestIdOf(line);
+        if (id !== null)
+            inflight.set(id, line);
+        backend.send(line);
+    };
+    const drain = () => {
+        while (ready() && waiting.length)
+            forward(waiting.shift());
+        maybeFinish();
+    };
+    /** Bring the backend up to where the client is: the client's initialize (ours to answer, its answer swallowed), then initialized. */
+    const handshake = () => {
+        if (!backend || backendInitDone || phase === 'handshaking')
+            return;
+        if (!clientInit || !initAnswered) {
+            // Nothing to replay yet; or the client's own initialize is still queued and is about to reach this backend itself.
+            phase = 'ready';
+            drain();
+            return;
+        }
+        phase = 'handshaking';
+        replayId = `crbro-replay-${++replays}`;
+        backend.send(JSON.stringify({ ...clientInit, id: replayId }));
+    };
+    /** The backend is where the client is: let the queue through. */
+    const backendReady = () => {
+        phase = 'ready';
+        trace('backend ready', backend?.kind ?? '', true);
+        settleIdle();
+        drain();
+    };
     const fromBackend = (line) => {
         let m = null;
         try {
@@ -253,135 +380,244 @@ function runProxy(o) {
         }
         catch { /* not ours to judge: pass it on */ }
         if (m && replayId !== null && m.id === replayId && m.method === undefined) {
-            // The replacement answered the replayed handshake. The client already
-            // has the original answer; this one stops here.
+            // The backend answered the handshake we made for the client. The client
+            // already has its answer; this one stops here.
             replayId = null;
-            if (initialized && backend)
-                backend.send(initialized);
-            connecting = false;
-            drain();
+            backendInitDone = true;
+            if (m.error)
+                log(`the backend refused the replayed initialize: ${m.error?.message ?? 'no reason'}`);
+            if (clientInitialized && backend)
+                backend.send(clientInitialized);
+            if (lastBoot && backend) {
+                // The project crbro_boot bound for this conversation lived on the
+                // backend that is gone: boot again with the same arguments, answer
+                // swallowed, before anything queued reaches the new one.
+                rebootId = `crbro-reboot-${replays}`;
+                backend.send(JSON.stringify({ jsonrpc: '2.0', id: rebootId, method: 'tools/call', params: lastBoot }));
+                return;
+            }
+            backendReady();
+            return;
+        }
+        if (m && rebootId !== null && m.id === rebootId && m.method === undefined) {
+            rebootId = null;
+            if (m.error || m.result?.isError)
+                log('the replayed crbro_boot failed: this conversation may have lost its project binding');
+            backendReady();
             return;
         }
-        if (m && m.id !== undefined && m.id !== null && m.method === undefined)
+        if (m && m.method === undefined && m.id !== undefined && m.id !== null) {
+            if (m.error?.data?.crbro === lines_js_1.NOT_STARTED && inflight.has(m.id)) {
+                // The daemon is stopping and never ran this call: it goes to whoever serves next, first in line.
+                waiting.splice(requeueAt++, 0, inflight.get(m.id));
+                inflight.delete(m.id);
+                stopping();
+                settleIdle();
+                return;
+            }
             inflight.delete(m.id);
+            if (bootCalls.has(m.id)) {
+                const p = bootCalls.get(m.id);
+                bootCalls.delete(m.id);
+                if (!m.error && !m.result?.isError)
+                    lastBoot = p;
+            }
+            if (!initAnswered && clientInit && m.id === clientInit.id) {
+                initAnswered = true;
+                backendInitDone = true;
+                trace('initialize answered', `by the ${backend?.kind ?? 'backend'}`, true);
+            }
+            if (toolCalls.delete(m.id))
+                trace('first tool result', backend?.kind ?? '', true);
+            settleIdle();
+        }
         toClient(line);
         maybeFinish();
     };
-    const drain = () => {
-        while (backend && !connecting && waiting.length)
-            backend.send(waiting.shift());
-        maybeFinish();
+    /** The daemon said it is stopping: hold new lines until it is gone, and do not wait for it for ever. */
+    const stopping = () => {
+        if (phase === 'stopping')
+            return;
+        phase = 'stopping';
+        const g = activeGen;
+        stoppingTimer = setTimeout(() => {
+            stoppingTimer = null;
+            if (activeGen !== g || ended)
+                return;
+            log('the daemon said it was stopping and did not go: leaving it');
+            const b = backend;
+            void lost();
+            void b?.close().catch(() => undefined);
+        }, STOPPING_GRACE_MS);
+        stoppingTimer.unref();
     };
-    const fromClient = (line) => {
+    const handleClient = (line) => {
         let m = null;
         try {
             m = JSON.parse(line);
         }
         catch { /* the backend will answer the parse error */ }
-        if (m?.method === 'initialize')
-            initialize = m;
-        else if (m?.method === 'notifications/initialized')
-            initialized = line;
-        if (m && m.method !== undefined && m.id !== undefined && m.id !== null)
-            inflight.add(m.id);
-        if (backend && !connecting)
-            backend.send(line);
+        if (m && surface) {
+            const { answerFromSurface } = surfaceApi;
+            const a = answerFromSurface(surface, m);
+            if (a) {
+                toClient(JSON.stringify(a));
+                if (m.method === 'initialize') {
+                    clientInit = m;
+                    initAnswered = true;
+                    trace('initialize answered', 'by the proxy', true);
+                    if (backend && phase === 'ready' && !backendInitDone)
+                        handshake();
+                }
+                maybeFinish();
+                return;
+            }
+        }
+        if (isRequest(m) && m.method === 'initialize') {
+            clientInit = m;
+            initAnswered = false;
+        }
+        if (m && m.method === 'notifications/initialized' && m.id === undefined) {
+            clientInitialized = line;
+            // Ours to send, right after the replayed initialize: never ahead of it.
+            if (initAnswered && !backendInitDone)
+                return;
+        }
+        if (isRequest(m) && m.method === 'tools/call') {
+            toolCalls.add(m.id);
+            if (m.params?.name === 'crbro_boot')
+                bootCalls.set(m.id, m.params);
+        }
+        if (ready())
+            forward(line);
         else
             waiting.push(line);
     };
-    const events = {
-        onLine: fromBackend,
-        onClose: () => { void lost(); },
+    let surfaceApi = null;
+    const fromClient = (line) => {
+        if (surface === undefined || (surface && !surfaceApi)) {
+            early.push(line);
+            return;
+        }
+        handleClient(line);
     };
+    const eventsFor = (g) => ({
+        onLine: line => { if (g === activeGen)
+            fromBackend(line); },
+        onClose: () => {
+            if (g === activeGen)
+                void lost();
+            else if (g === pendingGen) {
+                pendingGen = -1;
+                pending = null;
+            }
+        },
+    });
     /** No backend of any kind could be had. Say so on every call that is owed an answer, and stop — as the classic server does when it cannot start. */
     const fatal = (err) => {
         if (ended)
             return;
         log(`no backend could be started: ${err.message}`);
-        const ids = new Set(inflight);
-        for (const l of waiting) {
-            try {
-                const q = JSON.parse(l);
-                if (q?.method !== undefined && q.id !== undefined && q.id !== null)
-                    ids.add(q.id);
-            }
-            catch { /* not a request */ }
+        const ids = new Set(inflight.keys());
+        for (const l of [...waiting, ...early]) {
+            const id = requestIdOf(l);
+            if (id !== null)
+                ids.add(id);
         }
         for (const id of ids)
             toClient(JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32000, message: `CRBRO could not start: ${err.message}` } }));
         inflight.clear();
         waiting.length = 0;
+        early.length = 0;
         ended = true;
+        for (const t of [drainTimer, probeTimer, stoppingTimer])
+            if (t)
+                clearTimeout(t);
         rejectClosed(err);
     };
+    const activate = (b, g) => {
+        backend = b;
+        activeGen = g;
+        phase = 'none';
+        requeueAt = 0;
+        backendInitDone = false;
+        replayId = null;
+        rebootId = null;
+        trace(b.kind === 'daemon' ? 'backend connected' : 'in-process fallback', b.kind === 'local' ? 'engine ready' : '', true);
+        if (b.kind === 'local')
+            scheduleProbe();
+        else
+            probeDelay = probeMin;
+        handshake();
+    };
     async function acquire(first) {
-        connecting = true;
+        acquiring = true;
         backend = null;
+        activeGen = -1;
+        phase = 'none';
         let b = null;
+        const g = ++gen;
         // Asked every time, not once at launch: `crbro daemon off` removes the
         // flag and stops the daemon, and a proxy that only knew how to respawn one
         // undid it within 200 ms.
-        if (trustDaemons && isEnabled()) {
-            const d = await daemonBackend(o, events, !first);
+        if (daemonsWanted()) {
+            const d = await daemonBackend({
+                brainRoot: o.brainRoot, build, resumed: !first, deadline: Date.now() + budgetMs,
+                spawn: o.spawnDaemon, log, trace,
+            }, eventsFor(g));
             if (d === 'unusable')
-                trustDaemons = false;
-            else
+                distrust(FLAP_COOLDOWN_MS);
+            else if (d)
                 b = d;
-        }
-        if (!b) {
-            if (trustDaemons && isEnabled())
+            else
                 log('no daemon reachable: serving from this process');
-            b = await makeLocal(events, !first);
         }
+        if (!b)
+            b = await makeLocal(eventsFor(g), !first);
+        acquiring = false;
         if (ended) {
             await b.close();
             return;
         }
-        backend = b;
-        if (!first && initialize) {
-            // Same request the client once sent, under an id of our own.
-            replayId = `crbro-replay-${++replays}`;
-            b.send(JSON.stringify({ ...initialize, id: replayId }));
-            return; // `connecting` stays true until the replayed handshake is answered
-        }
-        connecting = false;
-        drain();
+        activate(b, g);
     }
+    const distrust = (ms) => { distrustUntil = Math.max(distrustUntil, Date.now() + ms); };
     async function lost() {
         if (ended)
             return;
+        if (stoppingTimer) {
+            clearTimeout(stoppingTimer);
+            stoppingTimer = null;
+        }
         reconnects++;
         const now = Date.now();
         losses.push(now);
         while (losses.length && now - losses[0] > FLAP_WINDOW_MS)
             losses.shift();
         if (losses.length >= FLAP_LIMIT) {
-            trustDaemons = false;
-            log('daemon lost three times in a minute: staying in-process');
-        }
-        // Whatever was waiting for an answer will not get one from a dead process.
-        // What never left this proxy is not in that position: it is still queued,
-        // and answering it here too would hand the client two replies to one id.
-        const queued = new Set();
-        for (const line of waiting) {
-            try {
-                const q = JSON.parse(line);
-                if (q?.id !== undefined && q.id !== null)
-                    queued.add(q.id);
-            }
-            catch { /* not a request */ }
+            // A daemon that keeps dying is not worth the client's time for a while — a while, not for ever.
+            distrust(cooldownMs);
+            log(`daemon lost ${losses.length} times in a minute: serving in-process for ${Math.round(cooldownMs / 1000)} s, then looking again`);
+            cooldownMs = Math.min(cooldownMs * 2, MAX_COOLDOWN_MS);
+            losses.length = 0;
         }
-        for (const id of [...inflight]) {
-            if (queued.has(id))
-                continue;
-            inflight.delete(id);
-            toClient(JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32000, message: 'CRBRO restarted while this call was running. Nothing was lost on disk; call it again.' } }));
+        // Whatever was waiting for an answer will not get one from a dead process,
+        // and nobody can say whether it ran: say exactly that. What never left this
+        // proxy (still queued) is not in that position and goes to the next backend.
+        for (const id of [...inflight.keys()]) {
+            toolCalls.delete(id);
+            toClient(JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32000, message: LOST_MESSAGE } }));
         }
+        inflight.clear();
         replayId = null;
+        rebootId = null;
         backend = null;
+        activeGen = -1;
+        phase = 'none';
+        backendInitDone = false;
+        settleIdle();
         // The client has gone and is owed nothing more: a replacement would serve nobody.
-        if (inputEnded && waiting.length === 0 && inflight.size === 0) {
-            connecting = false;
+        if (inputEnded && !owed()) {
             void shutdown();
             return;
         }
@@ -392,7 +628,98 @@ function runProxy(o) {
             fatal(err);
         }
     }
-    const reader = new lines_js_1.LineReader(fromClient, () => undefined);
+    // ── Serving in-process: keep looking for a daemon, and move back to one ──
+    function scheduleProbe() {
+        if (probeTimer || ended)
+            return;
+        probeTimer = setTimeout(() => { probeTimer = null; void probe(); }, probeDelay);
+        probeTimer.unref();
+        probeDelay = Math.min(probeDelay * 2, probeMax);
+    }
+    async function probe() {
+        if (ended || !backend || backend.kind !== 'local' || switching)
+            return;
+        if (!daemonsWanted()) {
+            scheduleProbe();
+            return;
+        }
+        const g = ++gen;
+        pendingGen = g;
+        const d = await daemonBackend({
+            brainRoot: o.brainRoot, build, resumed: true, deadline: Date.now() + PROBE_BUDGET_MS,
+            spawn: null, log, trace, quiet: true,
+        }, eventsFor(g)).catch(() => null);
+        if (!d || d === 'unusable' || pendingGen !== g || ended || !backend || backend.kind !== 'local') {
+            if (pendingGen === g)
+                pendingGen = -1;
+            if (d && d !== 'unusable')
+                await d.close();
+            if (d === 'unusable')
+                distrust(FLAP_COOLDOWN_MS);
+            scheduleProbe();
+            return;
+        }
+        pending = d;
+        await switchTo(d, g);
+    }
+    /**
+     * Move the conversation from this process's server to the daemon. Only when
+     * nothing is running here (new lines wait meanwhile), and the in-process
+     * index is flushed BEFORE the daemon serves: the daemon catches up with
+     * what this process wrote (it refreshes from disk for a resumed
+     * connection), and its own later save is a superset, never overwritten by
+     * ours. The daemon's tally of this conversation starts empty, as after a
+     * lost daemon: consolidate says so (`resumed`).
+     */
+    async function switchTo(d, g) {
+        switching = true;
+        await whenIdle();
+        const old = backend;
+        const stillThere = () => pendingGen === g && !ended;
+        if (!stillThere() || !old) {
+            switching = false;
+            if (pendingGen === g) {
+                pendingGen = -1;
+                pending = null;
+            }
+            await d.close().catch(() => undefined);
+            if (!ended) {
+                drain();
+                scheduleProbe();
+            }
+            return;
+        }
+        activeGen = -1; // nothing is in flight: nothing more is owed by the old server
+        await old.close().catch(() => undefined);
+        const linkAlive = pendingGen === g;
+        pendingGen = -1;
+        pending = null;
+        switching = false;
+        backend = null;
+        if (ended) {
+            await d.close().catch(() => undefined);
+            return;
+        }
+        if (!linkAlive) {
+            // The daemon went away while we flushed: back to the start, as after any lost backend.
+            try {
+                await acquire(false);
+            }
+            catch (err) {
+                fatal(err);
+            }
+            return;
+        }
+        switches++;
+        log('a daemon answers again: this conversation moved back to it from the in-process server');
+        trace('moved back to the daemon');
+        activate(d, g);
+    }
+    const reader = new lines_js_1.LineReader(fromClient, head => {
+        const id = (0, lines_js_1.idFromHead)(head);
+        log(`refused a message larger than ${lines_js_1.MAX_LINE_BYTES / 1048576} MB${id !== null ? ` (id ${JSON.stringify(id)})` : ''}`);
+        toClient(JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32600, message: `Invalid Request: a message larger than ${lines_js_1.MAX_LINE_BYTES / 1048576} MB was not read.` } }));
+    });
     o.input.on('data', (chunk) => reader.push(typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk));
     const onInputEnd = () => {
         if (inputEnded)
@@ -406,7 +733,35 @@ function runProxy(o) {
     };
     o.input.on('end', onInputEnd);
     o.input.on('close', onInputEnd);
-    void acquire(true).catch(err => fatal(err));
-    return { closed, backendKind: () => (backend ? backend.kind : 'none'), reconnects: () => reconnects };
+    // ── The surface: given, or found now; lines that came meanwhile are handled in order ──
+    const surfaceReady = (async () => {
+        try {
+            surfaceApi = await import('./surface.js');
+            if (surface === undefined)
+                surface = await surfaceApi.getSurface(build);
+        }
+        catch {
+            if (surface === undefined)
+                surface = null;
+        }
+        if (!surfaceApi)
+            surface = null;
+        for (const line of early.splice(0))
+            handleClient(line);
+        maybeFinish();
+    })();
+    void acquire(true).catch(async (err) => {
+        // initialize is the proxy's to answer even when nothing can serve: a
+        // backend that fails faster than the surface is computed in-process (a
+        // build without its snapshot) must not turn that answer into an error.
+        await Promise.race([surfaceReady, new Promise(r => { const t = setTimeout(r, 5_000); t.unref(); })]);
+        fatal(err);
+    });
+    return {
+        closed,
+        backendKind: () => (backend ? backend.kind : 'none'),
+        reconnects: () => reconnects,
+        switches: () => switches,
+    };
 }
 //# sourceMappingURL=proxy.js.map