mixdog 0.9.1 → 0.9.3

package/src/runtime/channels/lib/boot-profile.mjs

@@ -0,0 +1,23 @@
+import { performance } from "perf_hooks";
+
+// Boot-timing instrumentation + shared local timestamp helper.
+// Extracted verbatim from channels/index.mjs (behavior-preserving).
+const BOOT_PROFILE_ENABLED = /^(1|true|yes|on)$/i.test(String(process.env.MIXDOG_BOOT_PROFILE || ""));
+const BOOT_PROFILE_START = globalThis.__mixdogBootProfileStart || (globalThis.__mixdogBootProfileStart = performance.now());
+
+function bootProfile(event, fields = {}) {
+  if (!BOOT_PROFILE_ENABLED) return;
+  const elapsedMs = performance.now() - BOOT_PROFILE_START;
+  const parts = [`[mixdog-boot] +${elapsedMs.toFixed(1)}ms`, `channels:${event}`];
+  for (const [key, value] of Object.entries(fields || {})) {
+    if (value === undefined || value === null || value === "") continue;
+    parts.push(`${key}=${String(value).replace(/\s+/g, "_")}`);
+  }
+  try { process.stderr.write(`${parts.join(" ")}\n`); } catch {}
+}
+
+function localTimestamp() {
+  return (/* @__PURE__ */ new Date()).toLocaleString("sv-SE", { hour12: false });
+}
+
+export { BOOT_PROFILE_ENABLED, BOOT_PROFILE_START, bootProfile, localTimestamp };

package/src/runtime/channels/lib/config.mjs

@@ -1,7 +1,8 @@
 import { readFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { DiscordBackend } from "../backends/discord.mjs";
-import { readSection, updateSection, CONFIG_PATH as MIXDOG_CONFIG_PATH, getDiscordToken, diagnoseDiscordTokenValue } from "../../shared/config.mjs";
+import { TelegramBackend } from "../backends/telegram.mjs";
+import { readSection, updateSection, CONFIG_PATH as MIXDOG_CONFIG_PATH, getDiscordToken, getTelegramToken, diagnoseDiscordTokenValue } from "../../shared/config.mjs";
 import { listSchedules } from "../../shared/schedules-store.mjs";
 import { resolvePluginData } from "../../shared/plugin-paths.mjs";
 import { isHolidaySync } from "./holidays.mjs";
@@ -15,6 +16,7 @@ const DEFAULT_ACCESS = {
 const DEFAULT_CONFIG = {
   backend: "discord",
   discord: { token: "" },
+  telegram: { token: "" },
   access: DEFAULT_ACCESS,
   mainChannel: "main",
   channelsConfig: {
@@ -47,6 +49,22 @@ function applyDefaults(config) {
   out.webhook = { ...CONFIG_DEFAULTS.webhook, ...(out.webhook || {}) };
   return out;
 }
+
+function channelIdForBackend(entry = {}, backend = "discord") {
+  if (backend === "telegram") {
+    return String(entry?.telegramChatId || (entry?.discordChannelId ? "" : entry?.channelId) || "");
+  }
+  return String(entry?.discordChannelId || (entry?.telegramChatId ? "" : entry?.channelId) || "");
+}
+
+function channelsConfigForBackend(rawChannelsConfig = {}, backend = "discord") {
+  return Object.fromEntries(Object.entries(rawChannelsConfig || {}).map(([name, entry]) => {
+    const value = entry && typeof entry === "object" ? entry : {};
+    const channelId = channelIdForBackend(value, backend);
+    return [name, { ...value, channelId }];
+  }));
+}
+
 /**
  * Shared DND / quiet-window helper used by scheduler + webhook.
  *
@@ -185,11 +203,20 @@ function loadConfig() {
     if (discordTokenProblem) {
       process.stderr.write(`mixdog: discord token ignored: ${discordTokenProblem}\n`);
     }
+    // Single-backend select: config.backend picks ONE of discord|telegram.
+    // Anything else falls back to the discord default.
+    const backend = raw.backend === "telegram" ? "telegram" : "discord";
+    const telegramToken = getTelegramToken();
+    const rawChannelsConfig = { ...DEFAULT_CONFIG.channelsConfig, ...(raw.channelsConfig || {}) };
     return applyDefaults({
       ...DEFAULT_CONFIG,
       ...raw,
-      backend: "discord",
+      backend,
+      channelsConfig: channelsConfigForBackend(rawChannelsConfig, backend),
       discord: { ...DEFAULT_CONFIG.discord, ...(({ token: _, ...rest }) => rest)(raw.discord || {}), ...(discordToken && !discordTokenProblem ? { token: discordToken } : {}) },
+      // Merge the keychain-resolved telegram token (harmless when backend is
+      // discord; the secret never lands in the on-disk config either way).
+      telegram: { ...DEFAULT_CONFIG.telegram, ...(({ token: _t, ...rest }) => rest)(raw.telegram || {}), ...(telegramToken ? { token: telegramToken } : {}) },
       access: {
         ...DEFAULT_ACCESS,
         // Drop the retired pairing-era keys at the config layer too (the
@@ -218,6 +245,10 @@ function loadConfig() {
 }
 const HEADLESS_BACKEND = {
   name: "headless",
+  MAX_MESSAGE_LENGTH: 2000,
+  formatOutgoing(t) {
+    return t;
+  },
   async connect() {
   },
   async disconnect() {
@@ -244,6 +275,26 @@ const HEADLESS_BACKEND = {
   }
 };
 function createBackend(config) {
+  // Single-backend select: exactly one backend is constructed based on
+  // config.backend (discord|telegram). The two are mutually exclusive.
+  if (config.backend === "telegram") {
+    const telegramToken = getTelegramToken();
+    if (!telegramToken) {
+      process.stderr.write("mixdog: telegram bot not configured; channel runtime running in headless mode\n");
+      return HEADLESS_BACKEND;
+    }
+    const tgStateDir = config.telegram?.stateDir ?? join(DATA_DIR, "telegram");
+    mkdirSync(tgStateDir, { recursive: true });
+    return new TelegramBackend({
+      ...config.telegram,
+      configPath: CONFIG_FILE,
+      access: config.access,
+      // Single-source channel setup: the main chat is auto-allowed inside
+      // TelegramBackend.loadAccess() so a configured channelsConfig.main.channelId
+      // is enough for both inbound gating and outbound.
+      mainChannelId: config.channelsConfig?.main?.channelId
+    }, tgStateDir);
+  }
   const discordToken = getDiscordToken();
   const discordTokenProblem = diagnoseDiscordTokenValue(discordToken, config);
   if (discordTokenProblem) {
@@ -278,6 +329,7 @@ export {
   DEFAULT_HOLIDAY_COUNTRY,
   createBackend,
   getDiscordToken,
+  getTelegramToken,
   isInQuietWindow,
   loadConfig,
   loadProfileConfig

package/src/runtime/channels/lib/crash-log.mjs

@@ -0,0 +1,106 @@
+import * as fs from "fs";
+import * as path from "path";
+import { DATA_DIR } from "./config.mjs";
+import { localTimestamp } from "./boot-profile.mjs";
+
+// Crash logging + degraded-state tracking for the channels worker.
+// Extracted verbatim from channels/index.mjs (behavior-preserving).
+//
+// Degraded/stderr-broken state is module-scoped here; index.mjs reads it via
+// isChannelsDegraded() and installs the process-level unhandledRejection/
+// uncaughtException handlers (which need the worker's stop()).
+let crashLogging = false;
+let _channelsDegraded = false;
+let _stderrBroken = false;
+function isChannelsDegraded() { return _channelsDegraded; }
+
+// stderr can break when the parent stdio pipe closes. Node then emits an
+// async 'error' on process.stderr, which sync try/catch around write() does
+// not catch — without a listener, that error becomes uncaughtException and
+// re-enters logCrash, looping until the disk fills. Register a suppressor
+// once at load time and stop writing to stderr after the first EPIPE so the
+// loop cannot start.
+try {
+  process.stderr.on('error', (e) => {
+    if (e && (e.code === 'EPIPE' || /EPIPE/.test(String(e.message || '')))) {
+      _stderrBroken = true;
+      _channelsDegraded = true;
+    }
+  });
+} catch {}
+
+// Crash log guards: dedup repeated identical errors (a single broken handler
+// can fire thousands of times per minute) and rotate at a 10 MB cap so the
+// file cannot grow unbounded. One .old generation is kept; older rolls drop.
+const CRASH_LOG_MAX_BYTES = 10 * 1024 * 1024;
+let _lastCrashSig = "";
+let _crashRepeatCount = 0;
+
+function _writeCrashLine(crashLog, line) {
+  try {
+    let size = 0;
+    try { size = fs.statSync(crashLog).size; } catch {}
+    if (size + line.length > CRASH_LOG_MAX_BYTES) {
+      try { fs.renameSync(crashLog, crashLog + ".old"); } catch {}
+    }
+    fs.appendFileSync(crashLog, line);
+  } catch {}
+}
+
+function logCrash(label, err) {
+  if (crashLogging) return;
+  crashLogging = true;
+  const msg = `[${localTimestamp()}] mixdog: ${label}: ${err}
+${err instanceof Error ? err.stack : ""}
+`;
+  if (!_stderrBroken) {
+    try { process.stderr.write(msg); } catch (e) {
+      if (e && (e.code === 'EPIPE' || /EPIPE/.test(String(e.message || '')))) {
+        _stderrBroken = true;
+      }
+    }
+  }
+  const sig = `${label}|${err && err.message ? err.message : String(err)}`;
+  const crashLog = path.join(DATA_DIR, "crash.log");
+  if (sig === _lastCrashSig) {
+    // Same error repeating — count it but skip the disk write. The next
+    // distinct error (or EPIPE branch below) flushes the suppressed total.
+    _crashRepeatCount += 1;
+  } else {
+    if (_crashRepeatCount > 0) {
+      _writeCrashLine(crashLog, `[${localTimestamp()}] mixdog: previous error repeated ${_crashRepeatCount} more time(s)\n`);
+      _crashRepeatCount = 0;
+    }
+    _lastCrashSig = sig;
+    _writeCrashLine(crashLog, msg);
+  }
+  if (err instanceof Error && err.message.includes("EPIPE")) {
+    _channelsDegraded = true;
+    _stderrBroken = true;
+  }
+  crashLogging = false;
+}
+
+// Benign whitelist: transient EPERM/EACCES/EBUSY on the active-instance
+// rename path is expected under Windows file-lock contention and is
+// already retried elsewhere (atomic-file.mjs RETRY_CODES) — a single
+// occurrence must NOT be fatal, only a run of 3+ in a row without an
+// intervening distinct/successful event.
+const BENIGN_CRASH_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const BENIGN_CRASH_FATAL_THRESHOLD = 3;
+// "In a row" needs a time dimension: benign errors minutes/hours apart are
+// independent contention events, not a corrupted-state run. Only count a
+// streak when hits land within this window of the previous one.
+const BENIGN_CRASH_STREAK_WINDOW_MS = 60_000;
+function _isBenignCrash(err) {
+  const code = err?.code || (/\b(EPERM|EACCES|EBUSY)\b/.exec(String(err?.message || err)) || [])[0];
+  return BENIGN_CRASH_CODES.has(code);
+}
+
+export {
+  isChannelsDegraded,
+  logCrash,
+  _isBenignCrash,
+  BENIGN_CRASH_FATAL_THRESHOLD,
+  BENIGN_CRASH_STREAK_WINDOW_MS,
+};

package/src/runtime/channels/lib/format.mjs

@@ -140,7 +140,8 @@ function safeCodeBlock(content, lang = "") {
   const escaped = content.replace(/```/g, "`​``");
   return "```" + lang + "\n" + escaped + "\n```";
 }
-function chunk(text, limit = 2e3) {
+const MAX_DISCORD_MESSAGE = 2000;
+function chunk(text, limit = MAX_DISCORD_MESSAGE) {
   if (text.length <= limit) return [text];
   const out = [];
   let rest = text;
@@ -184,5 +185,6 @@ function chunk(text, limit = 2e3) {
 export {
   chunk,
   formatForDiscord,
-  safeCodeBlock
+  safeCodeBlock,
+  MAX_DISCORD_MESSAGE
 };

package/src/runtime/channels/lib/index-drop-trace.mjs

@@ -0,0 +1,72 @@
+import * as fs from "fs";
+import * as path from "path";
+import { DATA_DIR } from "./config.mjs";
+
+// Drop-trace instrumentation for channels/index.mjs.
+// Extracted verbatim (behavior-preserving). Distinct from lib/drop-trace.mjs
+// (which the output-forwarder uses): this instance is owned by index.mjs and
+// keeps its own buffered writer + `preview` helper so the two trace streams
+// stay byte-identical to the pre-split behavior.
+const _dropTraceLog = path.join(DATA_DIR, "drop-trace.log");
+const DROP_TRACE_ENABLED =
+  process.env.MIXDOG_DROP_TRACE === "1" ||
+  process.env.MIXDOG_DROP_TRACE === "true" ||
+  process.env.MIXDOG_DEBUG_CHANNELS === "1" ||
+  process.env.MIXDOG_DEBUG_CHANNELS === "true";
+// One-shot rotation for drop-trace.log at worker boot.
+if (DROP_TRACE_ENABLED) {
+  try { if (fs.statSync(_dropTraceLog).size > 10 * 1024 * 1024) fs.renameSync(_dropTraceLog, _dropTraceLog + '.1') } catch {}
+}
+
+// ── Buffered drop-trace writer (channels/index) ──────────────────────────────
+// Flushes every 1 s OR when buffer reaches 64 KB — whichever fires first.
+// Drains on process exit so no log lines are lost.
+let _dtIdxBuf = "";
+let _dtIdxBytes = 0;
+let _dtIdxFlushTimer = null;
+let _dtIdxStream = null;
+function _dtIdxGetStream() {
+  if (!_dtIdxStream) _dtIdxStream = fs.createWriteStream(_dropTraceLog, { flags: "a" });
+  return _dtIdxStream;
+}
+async function _dtIdxFlush() {
+  if (_dtIdxFlushTimer) { clearTimeout(_dtIdxFlushTimer); _dtIdxFlushTimer = null; }
+  if (!_dtIdxBuf) return;
+  const stream = _dtIdxGetStream();
+  const buf = _dtIdxBuf;
+  _dtIdxBuf = "";
+  _dtIdxBytes = 0;
+  try {
+    const ok = stream.write(buf);
+    if (!ok) { const { once } = await import("node:events"); await once(stream, "drain").catch(() => {}); }
+  } catch {}
+}
+function _dtIdxScheduleFlush() {
+  if (_dtIdxFlushTimer) return;
+  _dtIdxFlushTimer = setTimeout(() => { void _dtIdxFlush(); }, 1000);
+  if (_dtIdxFlushTimer.unref) _dtIdxFlushTimer.unref();
+}
+function _dtIdxAppend(line) {
+  _dtIdxBuf += line;
+  _dtIdxBytes += Buffer.byteLength(line);
+  if (_dtIdxBytes >= 65536) { void _dtIdxFlush(); return; }
+  _dtIdxScheduleFlush();
+}
+process.on("exit", () => { void _dtIdxFlush(); });
+
+function preview(text) {
+  if (!text) return "";
+  const s = String(text).replace(/\n/g, "\\n");
+  return s.length > 120 ? s.slice(0, 120) + "…" : s;
+}
+function dropTrace(event, fields) {
+  if (!DROP_TRACE_ENABLED) return;
+  try {
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const loc = `[${ts}][pid=${process.pid}] ${event}`;
+    const kv = fields ? " " + Object.entries(fields).map(([k, v]) => `${k}=${v}`).join(" ") : "";
+    _dtIdxAppend(loc + kv + "\n");
+  } catch {}
+}
+
+export { DROP_TRACE_ENABLED, dropTrace, preview, _dtIdxFlush };

package/src/runtime/channels/lib/output-forwarder.mjs

@@ -1,6 +1,6 @@
 import { existsSync, statSync, watch, openSync, readSync, closeSync } from "fs";
 import { createHash } from "crypto";
-import { formatForDiscord, chunk, safeCodeBlock } from "./format.mjs";
+import { safeCodeBlock } from "./format.mjs";
 import { dropTrace, _dtPreview } from "./drop-trace.mjs";
 import {
   formatToolSurface,
@@ -154,6 +154,14 @@ class OutputForwarder {
     try {
       const stat = this._pendingStat ?? statSync(this.transcriptPath);
       this._pendingStat = null;
+      // File shrank below our cursor: the transcript was rotated out from
+      // under us (buffered-appender rotation, or an external truncation).
+      // Treat it as a fresh file and reset the cursor instead of getting
+      // stuck forever (stat.size <= readFileSize would otherwise short
+      // circuit below and never read the new content).
+      if (stat.size < this.readFileSize) {
+        this.readFileSize = 0;
+      }
       if (stat.size <= this.readFileSize) {
         return { lines: [], nextFileSize: this.readFileSize };
       }
@@ -282,7 +290,12 @@ class OutputForwarder {
       this.commitReadProgress(item.nextFileSize);
       return;
     }
-    const formatted = item.preformatted ? item.text : formatForDiscord(item.text);
+    // Formatting is routed through the active backend via the send-callback so
+    // the forwarder stays backend-agnostic (Discord/Telegram/etc). Preformatted
+    // items (tool logs) are sent as-is. Fallback to raw text when no hook.
+    const formatted = item.preformatted
+      ? item.text
+      : (this.cb.formatOutgoing ? this.cb.formatOutgoing(item.text) : item.text);
     const hash = item.skipHashDedup
       ? ""
       : item.dedupKey
@@ -292,48 +305,25 @@ class OutputForwarder {
       this.commitReadProgress(item.nextFileSize);
       return;
     }
-    const chunks = chunk(formatted, 2e3);
-    const _t0Send = Date.now();
-    // Resume from _nextChunkIdx if this item is being retried after a partial send.
-    // This avoids re-sending chunks that already landed successfully.
-    if (item._chunks === undefined) {
-      item._chunks = chunks;
-      item._nextChunkIdx = 0;
-      item._sendRetries = 0;
-    }
-    for (let _ci = item._nextChunkIdx; _ci < item._chunks.length; _ci++) {
-      const c = item._chunks[_ci];
-      try {
-        await this.cb.send(targetChannelId, c);
-        item._nextChunkIdx = _ci + 1;
-        dropTrace("discord.send.ok", null);
-      } catch (err) {
-        // Discord 429 or transient error — honour Retry-After then re-throw so
-        // drainQueue's retry loop calls deliverQueueItem again. Chunk progress
-        // is stored on item so we resume from the failed chunk, not chunk 0.
-        const status = err?.status ?? err?.code ?? err?.httpStatus;
-        const retryAfter = err?.retryAfter ?? err?.retry_after
-          ?? err?.headers?.["retry-after"] ?? err?.response?.headers?.["retry-after"];
-        dropTrace("discord.send.err", { channelId: this.channelId, chunkIndex: _ci, status, retryAfter: retryAfter ?? "(none)", err: String(err) });
-        item._sendRetries = (item._sendRetries || 0) + 1;
-        if (item._sendRetries >= 3) {
-          // Cap retries to avoid infinite duplicate loop — give up on this item
-          process.stderr.write(`[output-forwarder] chunk send exceeded 3 retries at chunk ${_ci}, dropping item\n`);
-          item._nextChunkIdx = item._chunks.length; // mark exhausted
-          return;
-        }
-        if (status === 429) {
-          if (retryAfter != null) {
-            const ms = Number(retryAfter) > 1000 ? Number(retryAfter) : Number(retryAfter) * 1000;
-            if (Number.isFinite(ms) && ms > 0) {
-              await new Promise((r) => setTimeout(r, Math.min(ms, 60_000)));
-            }
-          } else {
-            await new Promise((r) => setTimeout(r, 1000));
-          }
-        }
-        throw err;
-      }
+    // Backend owns chunking + send retry: pass the whole (unchunked) text once.
+    // On failure the backend has already exhausted its per-chunk retries and
+    // throws; we re-throw so drainQueue/scheduleRetry requeues the whole item.
+    try {
+      // Hand back any opaque resume token stored from a prior partial-send
+      // failure so the backend resumes at the failed chunk instead of
+      // re-sending chunks that already landed. The token is opaque here —
+      // the forwarder only stores/passes/clears it, never interprets it.
+      await this.cb.send(targetChannelId, formatted, item._resumeToken ? { resumeToken: item._resumeToken } : undefined);
+      // Full success — drop any stale token so a later reuse of this item
+      // object can't carry a dead token.
+      item._resumeToken = undefined;
+      dropTrace("discord.send.ok", null);
+    } catch (err) {
+      // Persist the opaque resume token (if any) on the item so the requeued
+      // retry resumes from the failed chunk.
+      if (err?.resumeToken) item._resumeToken = err.resumeToken;
+      dropTrace("discord.send.err", { channelId: this.channelId, err: String(err) });
+      throw err;
     }
     if (!item.skipHashDedup) {
       this.lastHash = hash;
@@ -344,7 +334,9 @@ class OutputForwarder {
 
 ${_bt.trim()}` : _bt.trim();
     }
-    this.sentCount += chunks.length;
+    // sentCount now tracks delivered items (the forwarder no longer knows the
+    // backend's chunk count). Increment by 1 per delivered item.
+    this.sentCount += 1;
     this.commitReadProgress(item.nextFileSize);
   }
   scheduleRetry() {
@@ -375,7 +367,13 @@ ${_bt.trim()}` : _bt.trim();
     // finalLane[0] is being drained when this.sending; coalesce into tail only
     // when tail is not index 0 (i.e. length >= 2) or drain is not in flight.
     const ftLen = this.finalLane.length;
-    const ftTail = (ftLen > 0 && !(this.sending && ftLen === 1))
+    // A partially-delivered item carries an opaque _resumeToken pinned (by
+    // hash) to its exact text. Mutating its text here would break that hash on
+    // the next retry, forcing the backend to full-resend from chunk 0 and
+    // duplicate the chunks already delivered. Treat any tokenized item as
+    // sealed: never coalesce/cap-merge into it; new text goes behind it as a
+    // separate item.
+    const ftTail = (ftLen > 0 && !(this.sending && ftLen === 1) && !this.finalLane[ftLen - 1]._resumeToken)
       ? this.finalLane[ftLen - 1] : null;
     if (ftTail) {
       ftTail.text = `${ftTail.text}\n\n${newText}`;
@@ -391,6 +389,8 @@ ${_bt.trim()}` : _bt.trim();
       const capEnd = this.sending ? 1 : 0;
       for (let i = this.finalLane.length - 1; i >= capEnd; i--) {
         const cap = this.finalLane[i];
+        // Never fold into a sealed (partially-delivered) item — see above.
+        if (cap._resumeToken) continue;
         cap.text = `${cap.text}\n\n${newText}`;
         cap.bufferText = `${cap.bufferText}\n\n${newText}`;
         cap.nextFileSize = nextFileSize;
@@ -446,8 +446,20 @@ ${_bt.trim()}` : _bt.trim();
           }
           lane.shift();
         } catch (err) {
-          process.stderr.write(`mixdog: send failed: ${err}
-`);
+          // Permanent (non-retryable) send failure — e.g. Telegram 400 "chat
+          // not found", Discord 403/404. Retrying would loop forever and wedge
+          // the queue, so DROP the item: advance the read cursor past its bytes
+          // (so it never reprocesses), clear any stale resume token, and keep
+          // draining the next item.
+          if (err?.permanent) {
+            process.stderr.write(`[output-forwarder] permanent send failure, dropping item: ${err?.message || err}\n`);
+            dropTrace("drain.send.permanent", { lane: fromFinal ? "final" : "stream", itemType: item?.type, err: String(err) });
+            item._resumeToken = undefined;
+            this.commitReadProgress(item.nextFileSize);
+            lane.shift();
+            continue;
+          }
+          process.stderr.write(`[output-forwarder] send failed: ${err}\n`);
           dropTrace("drain.send.err", { finalLen: this.finalLane.length, streamLen: this.streamLane.length, lane: fromFinal ? "final" : "stream", itemType: item?.type, err: String(err) });
           this.scheduleRetry();
           break;
@@ -467,8 +479,7 @@ ${_bt.trim()}` : _bt.trim();
         }
         await this.cb.react(this.channelId, this.userMessageId, newEmoji);
         this.emoji = newEmoji;
-      } catch {
-      }
+      } catch {} // best-effort: reaction is non-critical
     }
     await this.deliverQueueItem(item);
   }
@@ -487,7 +498,7 @@ ${_bt.trim()}` : _bt.trim();
       try {
         this.pendingFinalFlush = true;
         this.updateState((state) => { state.pendingFinalFlush = true; });
-      } catch {}
+      } catch {} // best-effort: durable flush marker is non-critical
       if (retries < 5) {
         setTimeout(() => void this.forwardFinalText(retries + 1, channelId), 300);
       } else {
@@ -511,8 +522,7 @@ ${_bt.trim()}` : _bt.trim();
       if (this.userMessageId && this.emoji) {
         try {
           await this.cb.removeReaction(channelId, this.userMessageId, this.emoji);
-        } catch {
-        }
+        } catch {} // best-effort: remove reaction is non-critical
       }
       const { text: newText, nextFileSize } = this.extractNewText();
       if (newText) {
@@ -520,14 +530,23 @@ ${_bt.trim()}` : _bt.trim();
         try {
           await this.deliverQueueItem(finalItem);
         } catch (err) {
-          // Transient send failure: extractNewText already advanced the read
-          // cursor past these bytes, so dropping the item here would lose the
-          // final text. Requeue it (it retains per-chunk send progress) and let
-          // drainQueue retry instead of silently discarding. pendingFinalFlush
-          // stays set so a process restart can also resume the flush.
-          this.finalLane.push(finalItem);
-          this.scheduleRetry();
-          return;
+          // Permanent (non-retryable) failure — drop instead of requeue so we
+          // don't loop forever on a dead channel. extractNewText already
+          // advanced the read cursor, so commit it and let the frame go.
+          if (err?.permanent) {
+            process.stderr.write(`[output-forwarder] permanent final-send failure, dropping: ${err?.message || err}\n`);
+            this.commitReadProgress(nextFileSize);
+          } else {
+            // Transient send failure: extractNewText already advanced the read
+            // cursor past these bytes, so dropping the item here would lose the
+            // final text. Requeue the WHOLE item and let drainQueue retry
+            // instead of silently discarding. The backend owns chunking+retry,
+            // so a requeued send restarts from chunk 0. pendingFinalFlush stays
+            // set so a process restart can also resume the flush.
+            this.finalLane.push(finalItem);
+            this.scheduleRetry();
+            return;
+          }
         }
       } else {
         this.commitReadProgress(nextFileSize);
@@ -546,7 +565,7 @@ ${_bt.trim()}` : _bt.trim();
       try {
         this.pendingFinalFlush = false;
         this.updateState((state) => { state.pendingFinalFlush = false; });
-      } catch {}
+      } catch {} // best-effort: clear flush marker is non-critical
       this.updateState((state) => {
         state.sessionIdle = true;
       });
@@ -569,7 +588,7 @@ ${_bt.trim()}` : _bt.trim();
     // isHidden, because that helper would re-consult the module-local
     // HIDDEN_TOOLS Set and ignore the OutputForwarder static.
     if (OutputForwarder.HIDDEN_TOOLS.has(name)) return true;
-    if ((name.includes("plugin_mixdog") && !name.endsWith("recall_memory")) || name === "reply" || name === "react" || name === "edit_message" || name === "fetch" || name === "download_attachment") return true;
+    if (name === "reply" || name === "react" || name === "edit_message" || name === "fetch" || name === "download_attachment") return true;
     return false;
   };
   /** Concatenate text blocks from a transcript entry (user or assistant). */
@@ -684,13 +703,12 @@ ${_bt.trim()}` : _bt.trim();
       this.watchDebounce = null;
       let _wfStat = null;
       if (this.transcriptPath) {
-        try { _wfStat = statSync(this.transcriptPath); } catch {}
+        try { _wfStat = statSync(this.transcriptPath); } catch {} // best-effort: stat during flush
       }
       if (this.transcriptPath && !_wfStat) {
         const relocated = detectCurrentSessionTranscript()?.transcriptPath ?? findLatestTranscriptByMtime();
         if (relocated && relocated !== this.transcriptPath) {
-          process.stderr.write(`mixdog: watched transcript gone during flush, relocated to ${relocated}
-`);
+          process.stderr.write(`[output-forwarder] watched transcript gone during flush, relocated to ${relocated}\n`);
           dropTrace("watch.flush.relocate", { from: this.transcriptPath, to: relocated });
           this.closeWatcher();
           this.transcriptPath = relocated;
@@ -754,5 +772,8 @@ ${_bt.trim()}` : _bt.trim();
   }
 }
 export {
-  OutputForwarder
+  OutputForwarder,
+  discoverSessionBoundTranscript,
+  findLatestTranscriptByMtime,
+  sameResolvedPath
 };

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -68,6 +68,7 @@ function isPidAlive(pid) {
     return e?.code === "EPERM";
   }
 }
+const UI_HEARTBEAT_STALE_MS = 5 * 60 * 1e3;
 function activeInstanceStaleReason(state) {
   const ownerPid = getActiveOwnerPid(state);
   if (!isPidAlive(ownerPid)) return `owner PID ${ownerPid ?? "unknown"} is dead`;
@@ -77,8 +78,35 @@ function activeInstanceStaleReason(state) {
   if (workerPid && !isPidAlive(workerPid)) return `worker PID ${workerPid} is dead`;
   const serverPid = parsePositivePid(state?.server_pid);
   if (serverPid && !isPidAlive(serverPid)) return `server PID ${serverPid} is dead`;
+  // Zombie-Lead repro (2026-07-02): a Lead's owner/channels/worker/server
+  // PIDs can all still be alive (process not killed) while the TUI's render
+  // loop is dead in the water — no signal ever fires, so pid-only staleness
+  // never trips. If the TUI is heartbeating (field present), treat a stale
+  // heartbeat as stale ownership too. Backward-compat: state written by an
+  // older/non-TUI process (or before the first heartbeat tick) simply omits
+  // ui_heartbeat_at, so this branch is a no-op and pid-only judgment stands.
+  const uiHeartbeatAt = Number(state?.ui_heartbeat_at);
+  if (Number.isFinite(uiHeartbeatAt) && uiHeartbeatAt > 0) {
+    const age = Date.now() - uiHeartbeatAt;
+    if (age > UI_HEARTBEAT_STALE_MS) {
+      return `ui heartbeat stale (${Math.round(age / 1000)}s since last tick)`;
+    }
+  }
   return null;
 }
+// Called from src/tui on a 30s timer while the render loop is alive. Only
+// touches ui_heartbeat_at (and updatedAt) so it never races/clobbers the
+// channels worker's own refreshActiveInstance() writes.
+function touchUiHeartbeat(instanceId) {
+  ensureRuntimeDirs();
+  try {
+    updateJsonAtomicSync(ACTIVE_INSTANCE_FILE, (curRaw) => {
+      if (!curRaw) return undefined;
+      if (instanceId && curRaw.instanceId !== instanceId) return undefined;
+      return { ...curRaw, ui_heartbeat_at: Date.now(), updatedAt: Date.now() };
+    }, { compact: true, fsync: false, fsyncDir: false });
+  } catch { /* best-effort; a missed tick just relies on the next one */ }
+}
 function buildRuntimeIdentity() {
   const terminalLeadPid = getTerminalLeadPid();
   const serverPid = getServerPid();
@@ -487,5 +515,6 @@ export {
   readActiveInstance,
   refreshActiveInstance,
   releaseOwnedChannelLocks,
+  touchUiHeartbeat,
   writeServerPid
 };

package/src/runtime/channels/lib/scheduler.mjs

@@ -8,7 +8,7 @@ import { runScript as execScript, ensureNopluginDir } from "./executor.mjs";
 import { withFileLockSync } from "../../shared/atomic-file.mjs";
 import { makeAgentDispatch } from '../../agent/orchestrator/agent-runtime/agent-dispatch.mjs';
 
-const schedulerLlm = makeAgentDispatch({ taskType: 'scheduler-task', role: 'scheduler-task', sourceType: 'scheduler' });
+const schedulerLlm = makeAgentDispatch({ taskType: 'scheduler-task', agent: 'scheduler-task', sourceType: 'scheduler' });
 const SCHEDULE_LOG = join(DATA_DIR, "schedule.log");
 // Buffered async logger — coalesces per-line appends into batched writes.
 let _schedLogBuf = [];