mixdog 0.9.17 → 0.9.18

package/src/runtime/channels/index.mjs

@@ -305,6 +305,11 @@ const forwarder = new OutputForwarder({
   removeReaction: (ch, mid, emoji) => {
     if (!channelBridgeActive) return Promise.resolve();
     return backend.removeReaction(ch, mid, emoji);
+  },
+  // Watchdog backstop: force the backend to tear down + rebuild a wedged
+  // client so an over-budget send fails fast and the queue releases.
+  resetBackend: async () => {
+    if (typeof backend?._resetClient === "function") await backend._resetClient();
   }
 }, statusState);
 forwarder.setOnIdle(() => {
@@ -323,7 +328,11 @@ forwarder.setOnIdle(() => {
 forwarder.setOwnerGetter(() => bridgeRuntimeConnected && currentOwnerState().owned);
 function applyTranscriptBinding(channelId, transcriptPath, options = {}) {
   if (!transcriptPath) return;
-  forwarder.setContext(channelId, transcriptPath, { replayFromStart: options.replayFromStart, catchUpFromPersisted: options.catchUpFromPersisted });
+  forwarder.setContext(channelId, transcriptPath, {
+    replayFromStart: options.replayFromStart,
+    catchUpFromPersisted: options.catchUpFromPersisted,
+    recoverUnsyncedTail: options.recoverUnsyncedTail,
+  });
   const boundTranscriptPath = forwarder.transcriptPath || transcriptPath;
   forwarder.startWatch();
   void memoryIngestTranscript(boundTranscriptPath, { cwd: options.cwd });
@@ -336,14 +345,31 @@ function applyTranscriptBinding(channelId, transcriptPath, options = {}) {
   refreshActiveInstance(INSTANCE_ID, { channelId, transcriptPath: boundTranscriptPath }, { onlyIfOwned: true });
   if (options.persistStatus !== false) {
     statusState.update((state) => {
+      const wasSameTranscript = typeof state.transcriptPath === "string"
+        && state.transcriptPath
+        && sameResolvedPath(state.transcriptPath, boundTranscriptPath);
+      const prevSentCount = Number(state.sentCount ?? 0);
+      const nextSentCount = Number(forwarder.sentCount ?? 0);
       state.channelId = channelId;
       state.transcriptPath = boundTranscriptPath;
       state.lastFileSize = forwarder.lastFileSize;
-      state.sentCount = forwarder.sentCount;
-      state.lastSentHash = forwarder.lastHash;
-      state.lastSentTime = 0;
-      state.sessionIdle = false;
-      state.sessionCwd = options.cwd ?? null;
+      if (wasSameTranscript) {
+        state.sentCount = Math.max(
+          Number.isFinite(prevSentCount) ? prevSentCount : 0,
+          Number.isFinite(nextSentCount) ? nextSentCount : 0,
+        );
+        if (forwarder.lastHash) state.lastSentHash = forwarder.lastHash;
+        else if (typeof state.lastSentHash !== "string") state.lastSentHash = "";
+        if (!Number.isFinite(Number(state.lastSentTime))) state.lastSentTime = 0;
+        if (typeof state.sessionIdle !== "boolean") state.sessionIdle = false;
+      } else {
+        state.sentCount = forwarder.sentCount;
+        state.lastSentHash = forwarder.lastHash;
+        state.lastSentTime = 0;
+        state.sessionIdle = false;
+      }
+      if (options.cwd !== undefined) state.sessionCwd = options.cwd ?? null;
+      else if (!wasSameTranscript) state.sessionCwd = null;
     });
   }
 }
@@ -421,7 +447,8 @@ async function rebindTranscriptContext(channelId, options = {}) {
       applyTranscriptBinding(channelId, explicitTranscriptPath, {
         replayFromStart: Boolean(options.catchUp),
         catchUpFromPersisted: options.catchUpFromPersisted,
-        persistStatus: options.persistStatus
+        persistStatus: options.persistStatus,
+        recoverUnsyncedTail: options.recoverUnsyncedTail,
       });
       if (options.catchUp || options.catchUpFromPersisted) {
         await forwarder.forwardNewText();
@@ -452,6 +479,7 @@ async function rebindTranscriptContext(channelId, options = {}) {
         applyTranscriptBinding(channelId, bound.transcriptPath, {
           replayFromStart,
           catchUpFromPersisted: options.catchUpFromPersisted,
+          recoverUnsyncedTail: options.recoverUnsyncedTail,
           persistStatus: options.persistStatus,
           cwd: bound.sessionCwd,
         });
@@ -497,6 +525,7 @@ async function rebindTranscriptContext(channelId, options = {}) {
       applyTranscriptBinding(channelId, pendingTranscriptPath, {
         replayFromStart: !samePersisted,
         catchUpFromPersisted: samePersisted,
+        recoverUnsyncedTail: options.recoverUnsyncedTail,
         cwd: pendingTranscriptCwd,
         persistStatus: options.persistStatus,
       });
@@ -512,7 +541,11 @@ async function rebindTranscriptContext(channelId, options = {}) {
     }
   }
   if (previousPath && options.fallbackPrevious !== false) {
-    applyTranscriptBinding(channelId, previousPath, { catchUpFromPersisted: true, cwd: statusState.read().sessionCwd });
+    applyTranscriptBinding(channelId, previousPath, {
+      catchUpFromPersisted: true,
+      recoverUnsyncedTail: options.recoverUnsyncedTail,
+      cwd: statusState.read().sessionCwd
+    });
     if (fs.existsSync(previousPath)) {
       await forwarder.forwardNewText();
     } else {
@@ -631,7 +664,8 @@ async function bindPersistedTranscriptIfAny() {
   const bound = await rebindTranscriptContext(currentStatus.channelId, {
     previousPath: getPersistedTranscriptPath(),
     persistStatus: true,
-    catchUpFromPersisted: true
+    catchUpFromPersisted: true,
+    recoverUnsyncedTail: true,
   });
   if (bound) {
     process.stderr.write(`mixdog: initial transcript bind: ${bound}
@@ -710,8 +744,40 @@ function syncOwnedWebhookAndEventRuntime({ reload = false } = {}) {
     webhookServer = null;
   }
 }
+let _ownedRuntimeSelfHealing = false;
+// Explicit restore path for an already-connected owner. The 3s ownership tick
+// must not run this implicitly: re-binding status on every tick can move the
+// transcript cursor to EOF, and probing the gateway during Discord's own
+// reconnect window can reset a healthy reconnect loop. Keep this for explicit
+// activation/reload recovery only.
+async function selfHealOwnedRuntime(options = {}) {
+  const shouldRestoreBinding = options.restoreBinding === true;
+  const shouldResetBackend = options.resetBackend === true;
+  if (!shouldRestoreBinding && !shouldResetBackend) return;
+  if (_ownedRuntimeSelfHealing) return;
+  _ownedRuntimeSelfHealing = true;
+  try {
+    if (shouldRestoreBinding) {
+      await bindPersistedTranscriptIfAny().catch((e) => {
+        process.stderr.write(`mixdog: self-heal bindPersistedTranscriptIfAny failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`);
+      });
+    }
+    if (shouldResetBackend && typeof backend?._resetClient === "function") {
+      await backend._resetClient().catch((e) => {
+        process.stderr.write(`mixdog: self-heal backend reset failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`);
+      });
+    }
+    // Nudge the forwarder to drain anything the rebind/reconnect surfaced.
+    void forwarder.forwardNewText().catch(() => {});
+  } finally {
+    _ownedRuntimeSelfHealing = false;
+  }
+}
 async function startOwnedRuntime(options = {}) {
-  if (bridgeRuntimeConnected) return;
+  if (bridgeRuntimeConnected) {
+    if (!bridgeRuntimeStarting) await selfHealOwnedRuntime(options);
+    return;
+  }
   if (bridgeRuntimeStarting) return;
   if (!channelBridgeActive) return;
   bridgeRuntimeStarting = true;
@@ -928,8 +994,13 @@ async function refreshBridgeOwnership(options = {}) {
     if (active && active.instanceId && active.instanceId !== INSTANCE_ID) {
       if (bridgeRuntimeConnected) {
         await stopOwnedRuntime("ownership lost (newer remote session)");
-        notifyRemoteSuperseded();
       }
+      // Notify the parent UNCONDITIONALLY (not only when we were connected):
+      // a loser whose backend never connected (seat stolen mid-connect,
+      // connect failed, or already in standby) must still drop its Remote
+      // indicator. The parent handler is idempotent — it only acts while
+      // remoteEnabled is still true — so repeat ticks are harmless.
+      notifyRemoteSuperseded();
       return;
     }
     // No live owner — claim the empty seat and start.
@@ -1658,6 +1729,26 @@ backend.onMessage = (msg) => {
     });
   })();
 };
+const NETWORK_ERR_RE = /fetch failed|ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|socket hang up|network|timeout|aborted|TimeoutError/i;
+function isNetworkError(err) {
+  const s = `${err?.code ?? ""} ${err?.name ?? ""} ${err?.message ?? err ?? ""}`;
+  return NETWORK_ERR_RE.test(s);
+}
+async function retryOnNetwork(fn, { attempts = 3, baseDelayMs = 300, label = "op" } = {}) {
+  let lastErr;
+  for (let i = 0; i < attempts; i++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (i === attempts - 1 || !isNetworkError(err)) throw err;
+      const delay = baseDelayMs * (i + 1);
+      process.stderr.write(`mixdog: ${label} network failure (attempt ${i + 1}/${attempts}), retrying in ${delay}ms: ${err?.message || err}\n`);
+      await new Promise((r) => setTimeout(r, delay));
+    }
+  }
+  throw lastErr;
+}
 async function handleInbound(msg, route, options = {}) {
   const handleStartMs = Date.now();
   let text = msg.text;
@@ -1668,11 +1759,19 @@ async function handleInbound(msg, route, options = {}) {
       text = text || "[voice message]";
     } else {
       try {
-        const files = await backend.downloadAttachment(msg.chatId, msg.messageId);
+        const files = await retryOnNetwork(
+          // Short per-attempt timeout (vs the 180s default) bounds worst-case
+          // blockage of the serial inboundQueue on a bad voice message.
+          () => backend.downloadAttachment(msg.chatId, msg.messageId, { timeoutMs: 20_000 }),
+          { label: "voice.download" }
+        );
         // concurrency handled inside transcribeVoice queue; loop is sequential so last att wins
         for (const f of voiceAtts.map(a => files.find(df => df.id === a.id) ?? null).filter(Boolean)) {
           const _t0 = Date.now();
-          const transcript = await transcribeVoice(f.path, { attachmentId: f.id });
+          const transcript = await retryOnNetwork(
+            () => transcribeVoice(f.path, { attachmentId: f.id }),
+            { label: "voice.transcription" }
+          );
           const _elapsed = Date.now() - _t0;
           if (transcript) {
             text = transcript;
@@ -1683,8 +1782,12 @@ async function handleInbound(msg, route, options = {}) {
           }
         }
       } catch (err) {
-        process.stderr.write(`mixdog: voice.transcription error: ${err}\n`);
-        text = text || `[voice message \u2014 transcription error: ${err?.message || err}]`;
+        const netFail = isNetworkError(err);
+        process.stderr.write(`mixdog: voice.transcription error${netFail ? " (network, retries exhausted)" : ""}: ${err}\n`);
+        const marker = netFail
+          ? "[attachment: voice transcription failed (network)]"
+          : `[voice message \u2014 transcription error: ${err?.message || err}]`;
+        text = text ? `${text} ${marker}` : marker;
       }
     }
   }
@@ -1953,15 +2056,39 @@ if (_isWorkerMode && process.send) {
   })
   void (async () => {
     const startedAt = performance.now()
-    try {
-      await start()
-      bootProfile("worker:ready", { ms: (performance.now() - startedAt).toFixed(1) })
-      process.send({ type: 'ready' })
-    } catch (e) {
-      bootProfile("worker:failed", { ms: (performance.now() - startedAt).toFixed(1), error: e?.message || String(e) })
-      process.stderr.write(`[channels-worker] start() failed: ${e && (e.message || e)}\n`)
-      process.send({ type: 'ready', degraded: true, error: e?.message || String(e) })
+    const MAX_START_ATTEMPTS = 3
+    const BASE_BACKOFF_MS = 250
+    const isTransientStartErr = (err) =>
+      err?.code === 'ELOCKTIMEOUT' || /atomic lock timeout/i.test(err?.message || '')
+    let lastErr
+    for (let attempt = 1; attempt <= MAX_START_ATTEMPTS; attempt++) {
+      if (_channelsStopInFlight) return
+      try {
+        await start()
+        bootProfile("worker:ready", { ms: (performance.now() - startedAt).toFixed(1), attempt })
+        process.send({ type: 'ready' })
+        return
+      } catch (e) {
+        lastErr = e
+        const transient = isTransientStartErr(e)
+        bootProfile("worker:start-failed", { attempt, transient, error: e?.message || String(e) })
+        process.stderr.write(`[channels-worker] start() failed (attempt ${attempt}/${MAX_START_ATTEMPTS}, transient=${transient}): ${e && (e.message || e)}\n`)
+        if (!transient || attempt >= MAX_START_ATTEMPTS) break
+        const backoff = BASE_BACKOFF_MS * attempt + Math.floor(Math.random() * BASE_BACKOFF_MS)
+        await new Promise((r) => setTimeout(r, backoff))
+        if (_channelsStopInFlight) return
+      }
     }
+    // A stop landed while we were failing — let clean shutdown proceed, never exit over it.
+    if (_channelsStopInFlight) return
+    // Terminal failure: do NOT mask as a (degraded) ready. Exit non-zero so the
+    // parent's exit-before-ready path respawns or rejects startRemote instead of
+    // silently losing remote output forwarding.
+    bootProfile("worker:failed", { ms: (performance.now() - startedAt).toFixed(1), error: lastErr?.message || String(lastErr) })
+    process.stderr.write(`[channels-worker] start() giving up after ${MAX_START_ATTEMPTS} attempts: ${lastErr && (lastErr.message || lastErr)}\n`)
+    // Exit 2 = terminal (non-transient) start failure: parent must reject, not respawn.
+    // Exit 1 = exhausted transient retries: parent may respawn.
+    process.exit(isTransientStartErr(lastErr) ? 1 : 2)
   })()
 }
 

package/src/runtime/channels/lib/crash-log.mjs

@@ -86,15 +86,33 @@ ${err instanceof Error ? err.stack : ""}
 // already retried elsewhere (atomic-file.mjs RETRY_CODES) — a single
 // occurrence must NOT be fatal, only a run of 3+ in a row without an
 // intervening distinct/successful event.
-const BENIGN_CRASH_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const BENIGN_CRASH_CODES = new Set([
+  "EPERM", "EACCES", "EBUSY",
+  // Transient transport blips: a raw http/https ClientRequest (or an
+  // undici socket) can emit these when a keep-alive connection is torn
+  // down mid-flight (Discord gateway flapping, proxy resets). One blip
+  // must NOT kill the worker — it is benign; only a repeat storm within
+  // the streak window force-exits (see _fatalCrash).
+  "ECONNRESET", "ETIMEDOUT", "ECONNREFUSED", "EPIPE", "EHOSTUNREACH",
+  "ENETUNREACH", "ENETDOWN", "EAI_AGAIN", "ERR_STREAM_PREMATURE_CLOSE",
+  "UND_ERR_SOCKET", "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT", "UND_ERR_ABORTED",
+]);
+// Some transient socket errors arrive with no `.code` (notably the classic
+// "socket hang up" thrown by node:_http_client socketOnEnd — the exact crash
+// this guard exists for). Match those by message so they classify benign too.
+const BENIGN_CRASH_MESSAGE_RE = /socket hang up|ECONNRESET|ETIMEDOUT|EPIPE|UND_ERR_/i;
 const BENIGN_CRASH_FATAL_THRESHOLD = 3;
 // "In a row" needs a time dimension: benign errors minutes/hours apart are
 // independent contention events, not a corrupted-state run. Only count a
 // streak when hits land within this window of the previous one.
 const BENIGN_CRASH_STREAK_WINDOW_MS = 60_000;
 function _isBenignCrash(err) {
-  const code = err?.code || (/\b(EPERM|EACCES|EBUSY)\b/.exec(String(err?.message || err)) || [])[0];
-  return BENIGN_CRASH_CODES.has(code);
+  const msg = String(err?.message || err);
+  const code = err?.code
+    || (/\b(EPERM|EACCES|EBUSY|ECONNRESET|ETIMEDOUT|ECONNREFUSED|EPIPE|EHOSTUNREACH|ENETUNREACH|ENETDOWN|EAI_AGAIN|UND_ERR_[A-Z_]+)\b/.exec(msg) || [])[0];
+  if (BENIGN_CRASH_CODES.has(code)) return true;
+  return BENIGN_CRASH_MESSAGE_RE.test(msg);
 }
 
 export {

package/src/runtime/channels/lib/output-forwarder.mjs

@@ -28,8 +28,24 @@ import {
   buildToolLine
 } from "./tool-format.mjs";
 
+// Per-item send watchdog. drainQueue awaits ONE backend send at a time; a hung
+// send would otherwise never settle, so drainQueue never returns and `sending`
+// stays true forever — wedging ALL outbound behind the queue head. The watchdog
+// does NOT abandon the send (racing a still-running send against a retry would
+// double-deliver): it only pokes the backend to reset its wedged client so the
+// AWAITED send fails fast and `sending` releases on real settlement. Sized above
+// the backend's worst-case per-attempt retries.
+const SEND_ITEM_TIMEOUT_MS = 120_000;
+// After the watchdog resets the backend, wait at most this long for the
+// abandoned send to actually settle before releasing the queue.
+const SEND_SETTLE_CAP_MS = 15_000;
+const TAIL_RECOVERY_BYTES = 256 * 1024;
+
 class OutputForwarder {
   ownerGetter = null;
+  // Generation of the in-flight supervised send. Bumped when a send is
+  // abandoned (settlement cap) so a late/zombie completion can't double-advance.
+  _activeSendGen = 0;
   setOwnerGetter(fn) {
     this.ownerGetter = fn;
   }
@@ -111,20 +127,35 @@ class OutputForwarder {
     try {
       const stat = existsSync(this.transcriptPath) ? statSync(this.transcriptPath) : null;
       const currentSize = stat?.size ?? 0;
+      const persisted = this.statusState?.read?.();
+      const sameTranscript = persisted?.transcriptPath &&
+        sameResolvedPath(persisted.transcriptPath, this.transcriptPath);
       let fileSize;
       if (options.replayFromStart) {
         fileSize = 0;
       } else if (options.catchUpFromPersisted) {
-        const persisted = this.statusState?.read?.();
         const persistedSize = typeof persisted?.lastFileSize === "number" ? persisted.lastFileSize : -1;
-        const sameTranscript = persisted?.transcriptPath &&
-          sameResolvedPath(persisted.transcriptPath, this.transcriptPath);
         fileSize = (sameTranscript && persistedSize >= 0)
           ? Math.min(Math.max(persistedSize, 0), currentSize)
           : currentSize;
       } else {
         fileSize = currentSize;
       }
+      if (options.recoverUnsyncedTail && fileSize === currentSize && currentSize > 0) {
+        const sentCount = Number(persisted?.sentCount ?? 0);
+        const lastSentTime = Number(persisted?.lastSentTime ?? 0);
+        const hasSentHash = typeof persisted?.lastSentHash === "string" && persisted.lastSentHash.length > 0;
+        const noSendEvidence = (!Number.isFinite(sentCount) || sentCount <= 0)
+          && (!Number.isFinite(lastSentTime) || lastSentTime <= 0)
+          && !hasSentHash;
+        if (!sameTranscript || noSendEvidence) {
+          const tailOffset = this.findLastAssistantTextOffset(currentSize);
+          if (tailOffset >= 0 && tailOffset < currentSize) {
+            fileSize = tailOffset;
+            dropTrace("context.recoverUnsyncedTail", { path: this.transcriptPath, offset: tailOffset, currentSize, sameTranscript: !!sameTranscript });
+          }
+        }
+      }
       this.lastFileSize = fileSize;
       this.readFileSize = fileSize;
     } catch {
@@ -132,6 +163,46 @@ class OutputForwarder {
       this.readFileSize = 0;
     }
   }
+  findLastAssistantTextOffset(fileSize) {
+    if (!this.transcriptPath || fileSize <= 0) return -1;
+    const bytesToRead = Math.min(fileSize, TAIL_RECOVERY_BYTES);
+    const startOffset = fileSize - bytesToRead;
+    let fd = null;
+    try {
+      fd = openSync(this.transcriptPath, "r");
+      const buf = Buffer.alloc(bytesToRead);
+      readSync(fd, buf, 0, bytesToRead, startOffset);
+      const raw = buf.toString("utf8");
+      let chunkStart = 0;
+      if (startOffset > 0) {
+        const firstNewline = raw.indexOf("\n");
+        if (firstNewline < 0) return -1;
+        chunkStart = firstNewline + 1;
+      }
+      let cursor = startOffset + chunkStart;
+      let lastOffset = -1;
+      for (const line of raw.slice(chunkStart).split("\n")) {
+        const lineOffset = cursor;
+        cursor += Buffer.byteLength(line, "utf8") + 1;
+        if (!line.trim()) continue;
+        try {
+          const entry = JSON.parse(line);
+          if (entry.isSidechain || entry.type !== "assistant") continue;
+          const parts = entry.message?.content;
+          if (!Array.isArray(parts)) continue;
+          if (parts.some((c) => c?.type === "text" && typeof c.text === "string" && c.text.trim())) {
+            lastOffset = lineOffset;
+          }
+        } catch {
+        }
+      }
+      return lastOffset;
+    } catch {
+      return -1;
+    } finally {
+      if (fd != null) closeSync(fd);
+    }
+  }
   /** Reset counters for new turn */
   reset() {
     this.sentCount = 0;
@@ -282,6 +353,7 @@ class OutputForwarder {
   }
   async deliverQueueItem(item) {
     const targetChannelId = item.channelId ?? this.channelId;
+    const gen = ++this._activeSendGen;
     if (!item.text || !targetChannelId) {
       this.commitReadProgress(item.nextFileSize);
       return;
@@ -314,10 +386,13 @@ class OutputForwarder {
       // re-sending chunks that already landed. The token is opaque here —
       // the forwarder only stores/passes/clears it, never interprets it.
       await this.cb.send(targetChannelId, formatted, item._resumeToken ? { resumeToken: item._resumeToken } : undefined);
+      dropTrace("discord.send.ok", null);
+      // A zombie completion (send abandoned past the settlement cap, gen bumped)
+      // must not mutate ANY item/queue state — including the resume token.
+      if (gen !== this._activeSendGen) return;
       // Full success — drop any stale token so a later reuse of this item
       // object can't carry a dead token.
       item._resumeToken = undefined;
-      dropTrace("discord.send.ok", null);
     } catch (err) {
       // Persist the opaque resume token (if any) on the item so the requeued
       // retry resumes from the failed chunk.
@@ -349,7 +424,18 @@ ${_bt.trim()}` : _bt.trim();
   }
   /** Forward new assistant text to Discord. Returns true if text was sent. */
   async forwardNewText() {
-    if (!this._isOwner()) return false;
+    if (!this._isOwner()) {
+      // Silent no-send is invisible and has masked real ownership-gate bugs
+      // (a live seat that never forwards). Surface it, rate-limited to one
+      // line per 60s so a persistent non-owner state stays visible without
+      // flooding stderr on every poll tick.
+      const now = Date.now();
+      if (!this._lastOwnerGateLogAt || now - this._lastOwnerGateLogAt >= 60_000) {
+        this._lastOwnerGateLogAt = now;
+        process.stderr.write(`[output-forwarder] forwardNewText skipped: not seat owner (channelId=${this.channelId ?? "none"})\n`);
+      }
+      return false;
+    }
     if (!this.channelId) return false;
     const { text: newText, nextFileSize } = this.extractNewText();
     if (!newText) {
@@ -428,6 +514,31 @@ ${_bt.trim()}` : _bt.trim();
   _kickDrain() {
     this.drainQueue().catch(err => process.stderr.write(`[output-forwarder] drainQueue rejected: ${err?.message || err}\n`));
   }
+  /** Supervise a per-item send. The underlying promise is AWAITED to real
+   *  settlement so `sending` is never released early (no unsupervised send
+   *  racing a retry → duplicate). The watchdog's only job is to reset the
+   *  backend's wedged client so the awaited send fails fast. */
+  _sendSupervised(promise, label) {
+    const settled = Promise.resolve(promise);
+    settled.catch(() => {}); // never leak an unhandled rejection on late settle
+    return new Promise((resolve, reject) => {
+      let capTimer = null;
+      const watchdog = setTimeout(() => {
+        process.stderr.write(`[output-forwarder] ${label} watchdog fired after ${SEND_ITEM_TIMEOUT_MS}ms; resetting backend\n`);
+        Promise.resolve(this.cb?.resetBackend?.()).catch(() => {});
+        // Bound the post-reset settlement wait; past the cap, invalidate the
+        // in-flight send (gen bump → zombie can't double-advance) and release.
+        capTimer = setTimeout(() => {
+          this._activeSendGen++;
+          reject(new Error(`${label} abandoned after ${SEND_SETTLE_CAP_MS}ms settlement cap`));
+        }, SEND_SETTLE_CAP_MS);
+      }, SEND_ITEM_TIMEOUT_MS);
+      settled.then(
+        (v) => { clearTimeout(watchdog); if (capTimer) clearTimeout(capTimer); resolve(v); },
+        (e) => { clearTimeout(watchdog); if (capTimer) clearTimeout(capTimer); reject(e); }
+      );
+    });
+  }
   /** Drain both priority lanes sequentially. finalLane drains first when non-empty. */
   async drainQueue() {
     if (this.sending) return;
@@ -440,9 +551,9 @@ ${_bt.trim()}` : _bt.trim();
         const item = lane[0];
         try {
           if (item.type === "text") {
-            await this.deliverQueueItem(item);
+            await this._sendSupervised(this.deliverQueueItem(item), "deliverQueueItem");
           } else if (item.type === "toolLog") {
-            await this.processToolLog(item);
+            await this._sendSupervised(this.processToolLog(item), "processToolLog");
           }
           lane.shift();
         } catch (err) {

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -360,6 +360,19 @@ function refreshActiveInstance(instanceId, meta, options) {
         }
       }
     }
+    // Worker-owned seat: when THIS process is the channels worker and it is
+    // the seat owner (no distinct TUI/supervisor Lead — ownerLeadPid resolves
+    // to our own pid), keep ui_heartbeat_at fresh. A headless worker never
+    // runs the TUI render loop, so an inherited heartbeat (written by a prior
+    // TUI session and carried forward in prevRest) would otherwise go stale at
+    // UI_HEARTBEAT_STALE_MS and falsely flag a live worker-owned seat. A
+    // TUI-owned seat has a distinct supervisor (ownerLeadPid !== our pid), so
+    // this branch is a no-op there and TUI staleness is preserved.
+    const workerOwnsSeat = process.env.MIXDOG_WORKER_MODE === "1"
+      && identity.ownerLeadPid === process.pid;
+    if (workerOwnsSeat) {
+      next.ui_heartbeat_at = Date.now();
+    }
     return { ...preservedExtra, ...next };
   }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' });
 }

package/src/runtime/channels/lib/voice-transcription.mjs

@@ -167,9 +167,11 @@ function createVoiceTranscription({ getConfig, dataDir }) {
       if (attachmentId && result) _voiceTranscriptCache.set(attachmentId, result);
       return result;
     } catch (err) {
-      if (err?.message?.startsWith('voice runtime not installed')) throw err; // propagate setup errors; caller posts user-visible failure
+      // Propagate ALL real failures so the caller's retry (network-class) and
+      // failure marker (index.mjs catch) fire; null is reserved strictly for a
+      // legit empty transcript.
       process.stderr.write(`mixdog: voice.transcription failed: ${err}\n`);
-      return null;
+      throw err;
     }
   }
 

package/src/standalone/channel-worker.mjs

@@ -75,6 +75,8 @@ export function createStandaloneChannelWorker({
   let readyResolve = null;
   let readyReject = null;
   let stopPromise = null;
+  let stopRequested = false;
+  let bootGeneration = 0;
   let inProcessMod = null;
   let inProcessStartPromise = null;
   let nextCallId = 1;
@@ -153,6 +155,7 @@ export function createStandaloneChannelWorker({
       return stopPromise.then(() => start());
     }
     if (child && child.exitCode == null && !child.killed) return readyPromise || Promise.resolve(status());
+    stopRequested = false;
     readyPromise = new Promise((resolve, reject) => {
       readyResolve = resolve;
       readyReject = reject;
@@ -181,6 +184,9 @@ export function createStandaloneChannelWorker({
       windowsHide: true,
     });
     const spawnedPid = child.pid;
+    // Per-boot generation: a later start()/respawn bumps this, so a stale old
+    // child's late exit is ignored instead of respawning/rejecting the current one.
+    const myGeneration = ++bootGeneration;
     startChildGuardian({ childPid: spawnedPid, label: 'channel-worker', orphanGraceMs: 8000, forceGraceMs: 3000 });
     if (spawnedPid) ownedChildPids.add(spawnedPid);
     installParentExitHook();
@@ -215,13 +221,17 @@ export function createStandaloneChannelWorker({
     });
 
     child.on('exit', (code, signal) => {
+      if (myGeneration !== bootGeneration) return;
       if (spawnedPid) ownedChildPids.delete(spawnedPid);
       const error = new Error(`channels runtime exited (${signal || (code ?? 'unknown')})`);
-      if (!becameReady && readyReject && !stopPromise && attempt < WORKER_BOOT_MAX_ATTEMPTS) {
+      // Exit code 2 = terminal (non-transient) worker start failure: reject, never respawn.
+      // A requested stop (stopRequested) also suppresses respawn even if stopPromise's
+      // settle timer already cleared it before the child exited.
+      if (!becameReady && readyReject && !stopPromise && !stopRequested && code !== 2 && attempt < WORKER_BOOT_MAX_ATTEMPTS) {
         logLine(logPath, `worker exited before ready (${signal || (code ?? 'unknown')}), attempt ${attempt}/${WORKER_BOOT_MAX_ATTEMPTS}; retrying in ${WORKER_BOOT_RETRY_DELAY_MS}ms`);
         child = null;
         setTimeout(() => {
-          if (stopPromise || !readyReject) return;
+          if (stopPromise || stopRequested || !readyReject) return;
           spawnWorkerChild(attempt + 1);
         }, WORKER_BOOT_RETRY_DELAY_MS);
         return;
@@ -235,6 +245,7 @@ export function createStandaloneChannelWorker({
     });
 
     child.on('error', (error) => {
+      if (myGeneration !== bootGeneration) return;
       logLine(logPath, `runtime error: ${error?.message || error}`);
       if (readyReject) readyReject(error);
       readyResolve = null;
@@ -347,6 +358,7 @@ export function createStandaloneChannelWorker({
 
   function stop(reason = 'standalone shutdown', options = {}) {
     const waitForExit = options?.waitForExit !== false;
+    stopRequested = true;
     stopClientHeartbeat();
     if (stopPromise) return stopPromise;
     if (!useProcessWorker) {

package/src/tui/app/transcript-window.mjs

@@ -562,6 +562,17 @@ export function measuredTranscriptRows(item, columns, toolOutputExpanded) {
 
 const STREAMING_ROW_QUANTUM = 1;
 
+// Bottom-pinned flag for the streaming-tail row estimate. Set once per hook
+// render (use-transcript-window.mjs) BEFORE any tail resolution so every path
+// that resolves the streaming tail height (tailSig, buildTranscriptRowIndex,
+// incremental tail, transcriptStructureSignature) reads the same value and
+// cannot diverge. Bottom-pinned → fold the live estimate in (geometry right on
+// the first commit); away from bottom → d19cad1e defer-growth.
+let streamingBottomPinned = false;
+export function setStreamingBottomPinned(pinned) {
+  streamingBottomPinned = !!pinned;
+}
+
 function assistantTextForStreamingRowEstimate(text) {
   return streamingLayoutText(text);
 }
@@ -580,6 +591,17 @@ export function estimateTranscriptItemRowsCached(item, columns, toolOutputExpand
     const toolExpanded = toolOutputExpanded ? 1 : 0;
     const idEntry = streamingMeasuredRowsById.get(item.id);
     if (idEntry && idEntry.rows > 0 && idEntry.columns === columns && idEntry.toolExpanded === toolExpanded) {
+      if (streamingBottomPinned) {
+        // Bottom-pinned: the view follows the tail, so its geometry must be
+        // correct on the FIRST commit. Fold the freshly-grown live estimate in
+        // — max(measuredFloor, liveEstimate) — so totalRows/scrollOffset are
+        // right this frame instead of committing the stale measured floor and
+        // growing a frame later when the harvest bumps measuredRowsVersion
+        // (the judder). The measured floor still guards against an estimate
+        // that undercounts the real wrap. Away from bottom the defer-growth
+        // path below is kept (its anchor-stability / perf intent).
+        return Math.max(idEntry.rows, streamingEstimateRows(item, columns, toolOutputExpanded));
+      }
       // Defer-growth: while a confirmed (post-commit Yoga) measurement exists
       // for this streaming id, THIS render keeps that value instead of
       // folding in the freshly-grown estimate. Combining