mixdog 0.9.17 → 0.9.19

package/src/runtime/channels/index.mjs

@@ -42,6 +42,7 @@ import {
   readActiveInstance,
   refreshActiveInstance,
   cleanupStaleRuntimeFiles,
+  probeActiveOwner,
   cleanupInstanceRuntimeFiles,
   releaseOwnedChannelLocks,
   clearActiveInstance,
@@ -305,6 +306,11 @@ const forwarder = new OutputForwarder({
   removeReaction: (ch, mid, emoji) => {
     if (!channelBridgeActive) return Promise.resolve();
     return backend.removeReaction(ch, mid, emoji);
+  },
+  // Watchdog backstop: force the backend to tear down + rebuild a wedged
+  // client so an over-budget send fails fast and the queue releases.
+  resetBackend: async () => {
+    if (typeof backend?._resetClient === "function") await backend._resetClient();
   }
 }, statusState);
 forwarder.setOnIdle(() => {
@@ -323,7 +329,11 @@ forwarder.setOnIdle(() => {
 forwarder.setOwnerGetter(() => bridgeRuntimeConnected && currentOwnerState().owned);
 function applyTranscriptBinding(channelId, transcriptPath, options = {}) {
   if (!transcriptPath) return;
-  forwarder.setContext(channelId, transcriptPath, { replayFromStart: options.replayFromStart, catchUpFromPersisted: options.catchUpFromPersisted });
+  forwarder.setContext(channelId, transcriptPath, {
+    replayFromStart: options.replayFromStart,
+    catchUpFromPersisted: options.catchUpFromPersisted,
+    recoverUnsyncedTail: options.recoverUnsyncedTail,
+  });
   const boundTranscriptPath = forwarder.transcriptPath || transcriptPath;
   forwarder.startWatch();
   void memoryIngestTranscript(boundTranscriptPath, { cwd: options.cwd });
@@ -336,14 +346,31 @@ function applyTranscriptBinding(channelId, transcriptPath, options = {}) {
   refreshActiveInstance(INSTANCE_ID, { channelId, transcriptPath: boundTranscriptPath }, { onlyIfOwned: true });
   if (options.persistStatus !== false) {
     statusState.update((state) => {
+      const wasSameTranscript = typeof state.transcriptPath === "string"
+        && state.transcriptPath
+        && sameResolvedPath(state.transcriptPath, boundTranscriptPath);
+      const prevSentCount = Number(state.sentCount ?? 0);
+      const nextSentCount = Number(forwarder.sentCount ?? 0);
       state.channelId = channelId;
       state.transcriptPath = boundTranscriptPath;
       state.lastFileSize = forwarder.lastFileSize;
-      state.sentCount = forwarder.sentCount;
-      state.lastSentHash = forwarder.lastHash;
-      state.lastSentTime = 0;
-      state.sessionIdle = false;
-      state.sessionCwd = options.cwd ?? null;
+      if (wasSameTranscript) {
+        state.sentCount = Math.max(
+          Number.isFinite(prevSentCount) ? prevSentCount : 0,
+          Number.isFinite(nextSentCount) ? nextSentCount : 0,
+        );
+        if (forwarder.lastHash) state.lastSentHash = forwarder.lastHash;
+        else if (typeof state.lastSentHash !== "string") state.lastSentHash = "";
+        if (!Number.isFinite(Number(state.lastSentTime))) state.lastSentTime = 0;
+        if (typeof state.sessionIdle !== "boolean") state.sessionIdle = false;
+      } else {
+        state.sentCount = forwarder.sentCount;
+        state.lastSentHash = forwarder.lastHash;
+        state.lastSentTime = 0;
+        state.sessionIdle = false;
+      }
+      if (options.cwd !== undefined) state.sessionCwd = options.cwd ?? null;
+      else if (!wasSameTranscript) state.sessionCwd = null;
     });
   }
 }
@@ -421,7 +448,8 @@ async function rebindTranscriptContext(channelId, options = {}) {
       applyTranscriptBinding(channelId, explicitTranscriptPath, {
         replayFromStart: Boolean(options.catchUp),
         catchUpFromPersisted: options.catchUpFromPersisted,
-        persistStatus: options.persistStatus
+        persistStatus: options.persistStatus,
+        recoverUnsyncedTail: options.recoverUnsyncedTail,
       });
       if (options.catchUp || options.catchUpFromPersisted) {
         await forwarder.forwardNewText();
@@ -452,6 +480,7 @@ async function rebindTranscriptContext(channelId, options = {}) {
         applyTranscriptBinding(channelId, bound.transcriptPath, {
           replayFromStart,
           catchUpFromPersisted: options.catchUpFromPersisted,
+          recoverUnsyncedTail: options.recoverUnsyncedTail,
           persistStatus: options.persistStatus,
           cwd: bound.sessionCwd,
         });
@@ -497,6 +526,7 @@ async function rebindTranscriptContext(channelId, options = {}) {
       applyTranscriptBinding(channelId, pendingTranscriptPath, {
         replayFromStart: !samePersisted,
         catchUpFromPersisted: samePersisted,
+        recoverUnsyncedTail: options.recoverUnsyncedTail,
         cwd: pendingTranscriptCwd,
         persistStatus: options.persistStatus,
       });
@@ -512,7 +542,11 @@ async function rebindTranscriptContext(channelId, options = {}) {
     }
   }
   if (previousPath && options.fallbackPrevious !== false) {
-    applyTranscriptBinding(channelId, previousPath, { catchUpFromPersisted: true, cwd: statusState.read().sessionCwd });
+    applyTranscriptBinding(channelId, previousPath, {
+      catchUpFromPersisted: true,
+      recoverUnsyncedTail: options.recoverUnsyncedTail,
+      cwd: statusState.read().sessionCwd
+    });
     if (fs.existsSync(previousPath)) {
       await forwarder.forwardNewText();
     } else {
@@ -631,7 +665,8 @@ async function bindPersistedTranscriptIfAny() {
   const bound = await rebindTranscriptContext(currentStatus.channelId, {
     previousPath: getPersistedTranscriptPath(),
     persistStatus: true,
-    catchUpFromPersisted: true
+    catchUpFromPersisted: true,
+    recoverUnsyncedTail: true,
   });
   if (bound) {
     process.stderr.write(`mixdog: initial transcript bind: ${bound}
@@ -710,8 +745,40 @@ function syncOwnedWebhookAndEventRuntime({ reload = false } = {}) {
     webhookServer = null;
   }
 }
+let _ownedRuntimeSelfHealing = false;
+// Explicit restore path for an already-connected owner. The 3s ownership tick
+// must not run this implicitly: re-binding status on every tick can move the
+// transcript cursor to EOF, and probing the gateway during Discord's own
+// reconnect window can reset a healthy reconnect loop. Keep this for explicit
+// activation/reload recovery only.
+async function selfHealOwnedRuntime(options = {}) {
+  const shouldRestoreBinding = options.restoreBinding === true;
+  const shouldResetBackend = options.resetBackend === true;
+  if (!shouldRestoreBinding && !shouldResetBackend) return;
+  if (_ownedRuntimeSelfHealing) return;
+  _ownedRuntimeSelfHealing = true;
+  try {
+    if (shouldRestoreBinding) {
+      await bindPersistedTranscriptIfAny().catch((e) => {
+        process.stderr.write(`mixdog: self-heal bindPersistedTranscriptIfAny failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`);
+      });
+    }
+    if (shouldResetBackend && typeof backend?._resetClient === "function") {
+      await backend._resetClient().catch((e) => {
+        process.stderr.write(`mixdog: self-heal backend reset failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`);
+      });
+    }
+    // Nudge the forwarder to drain anything the rebind/reconnect surfaced.
+    void forwarder.forwardNewText().catch(() => {});
+  } finally {
+    _ownedRuntimeSelfHealing = false;
+  }
+}
 async function startOwnedRuntime(options = {}) {
-  if (bridgeRuntimeConnected) return;
+  if (bridgeRuntimeConnected) {
+    if (!bridgeRuntimeStarting) await selfHealOwnedRuntime(options);
+    return;
+  }
   if (bridgeRuntimeStarting) return;
   if (!channelBridgeActive) return;
   bridgeRuntimeStarting = true;
@@ -723,23 +790,54 @@ async function startOwnedRuntime(options = {}) {
   // backend WE started (not the freshly-swapped one), closing the
   // both-backends-live window.
   const startingBackend = backend;
-  // Advertise active-instance.json BEFORE backend connect so a newer remote
-  // session's last-wins claim is visible immediately. backendReady=false
-  // marks the partial state until backend.connect() succeeds.
-  // onlyIfOwned: startOwnedRuntime is only entered on the owned path, but a
-  // newer session can claim the seat between that check and this write; CAS
-  // aborts instead of re-stealing. The write result is checked below so a
-  // CAS abort stops the start path immediately (heartbeat/backend/scheduler
-  // never start) instead of relying on the 3s ownership timer to notice.
-  const casResult = refreshActiveInstance(INSTANCE_ID, { backendReady: false }, { onlyIfOwned: true });
-  // A successful CAS write always sets instanceId to ours; any other result
-  // (aborted write returning the stale/foreign/missing prior state) means
-  // the seat was not ours to claim — abort the start path here rather than
-  // relying on the 3s ownership timer to notice later.
-  if (casResult?.instanceId !== INSTANCE_ID) {
+  const claimAfterReady = options.claimAfterReady === true;
+  // Single-holder correctness: the seat is claimed BEFORE backend.connect(),
+  // never after. The old make-before-break (claim-after-ready) boot left two
+  // gateways connected and contending during the multi-second connect window;
+  // claiming first makes the previous owner observe owned=false on its next
+  // tick and drain+disconnect, so at most one gateway ever serves.
+  //   - boot (claimAfterReady): last-wins acquire — this new remote session
+  //     takes the seat outright.
+  //   - refresh/owned-path: CAS onlyIfOwned — abort fast if the seat moved.
+  // backendReady=false marks the partial state until backend.connect() succeeds.
+  // Wrapped so ANY throw in the pre-connect claim (lock contention/error)
+  // resets bridgeRuntimeStarting — otherwise a transient lock error would
+  // leave it stuck true and permanently block every future ownership attempt.
+  try {
+    if (claimAfterReady) {
+      refreshActiveInstance(INSTANCE_ID, { backendReady: false });
+      logOwnership("boot claim (pre-connect, last-wins)");
+    } else {
+      // Try-once (timeoutMs:0): a refresh-path re-acquire must never block on
+      // the active-instance lock. Contention throws → caught below and treated
+      // as "seat busy, abort this attempt"; the next 3s tick retries.
+      const casResult = refreshActiveInstance(INSTANCE_ID, { backendReady: false }, { onlyIfOwned: true, timeoutMs: 0 });
+      // A successful CAS write always sets instanceId to ours; any other result
+      // (aborted write returning the stale/foreign/missing prior state) means the
+      // seat was not ours to claim — abort here rather than relying on the timer.
+      if (casResult?.instanceId !== INSTANCE_ID) {
+        bridgeRuntimeStarting = false;
+        return;
+      }
+    }
+    // A newer session can claim between our write and this read. If we no longer
+    // own the seat, abort fast WITHOUT starting heartbeat/backend/scheduler/
+    // webhook/ngrok — ancillary runtime starts only past a confirmed-owned claim.
+    if (!currentOwnerState().owned) {
+      bridgeRuntimeStarting = false;
+      return;
+    }
+  } catch (e) {
     bridgeRuntimeStarting = false;
+    process.stderr.write(`mixdog: pre-connect seat claim aborted (${e instanceof Error ? e.message : String(e)})\n`);
     return;
   }
+  // Arm ownership-loss detection BEFORE backend.connect() so a session that is
+  // superseded during the (multi-second) connect window is torn down: the 3s
+  // tick observes a newer owner and flips _ownedRuntimeStopRequested, and
+  // bailIfStopRequested below disconnects the backend WE connected.
+  armBridgeOwnershipTimer();
+  // Heartbeat is ownership-gated; safe to arm now that we hold the seat.
   startOwnerHeartbeat();
   // Periodic buffer drain: replays memory-buffer/entry-*/ingest-*.json once the
   // memory service publishes its port. Idempotent + reentrancy-guarded inside
@@ -783,12 +881,34 @@ async function startOwnedRuntime(options = {}) {
       if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
       return;
     }
+    // Post-connect ownership confirm (CAS). The seat was claimed BEFORE
+    // connect; a newer session may have superseded us during the connect
+    // window (the 3s tick would already be tearing us down). onlyIfOwned:
+    // never re-steal here. If the CAS aborts we LOST the seat — disconnect the
+    // backend WE connected and mark the bridge runtime not connected (do NOT
+    // clear active-instance; the newer owner holds it).
+    let ownConfirm;
+    try {
+      ownConfirm = refreshActiveInstance(INSTANCE_ID, { backendReady: true }, { onlyIfOwned: true });
+    } catch { ownConfirm = null; }
+    if (ownConfirm?.instanceId !== INSTANCE_ID) {
+      try { await startingBackend.disconnect(); } catch {}
+      try { stopOwnerHeartbeat(); } catch {}
+      try { releaseOwnedChannelLocks(INSTANCE_ID); } catch {}
+      if (_memoryDrainTimer) { clearInterval(_memoryDrainTimer); _memoryDrainTimer = null; }
+      bridgeRuntimeConnected = false;
+      cancelPendingTranscriptRearm();
+      try { forwarder.stopWatch(); } catch {}
+      if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
+      notifyRemoteSuperseded();
+      return;
+    }
     bridgeRuntimeConnected = true;
-    // onlyIfOwned: backend.connect() above can take seconds — a newer owner
-    // claiming the seat during that await must not be overwritten here. On
-    // CAS abort the next refreshBridgeOwnership tick observes owned=false
-    // and stops this runtime; backendReady stays unset for the lost seat.
-    refreshActiveInstance(INSTANCE_ID, { backendReady: true }, { onlyIfOwned: true });
+    if (claimAfterReady) {
+      // First confirmed ownership at boot — tell the parent it holds the seat
+      // exactly once (heartbeat/refresh re-pin ownership but never re-enter).
+      notifyRemoteAcquired();
+    }
     // initProviders must complete before scheduler.start() — otherwise the
     // scheduler's first fire can land before the registry is populated and
     // return `Provider "<name>" not found or not enabled`. The previous
@@ -872,7 +992,14 @@ async function stopOwnedRuntime(reason) {
   try {
     // Only disconnect the backend when connect() actually completed; calling
     // disconnect() mid-connect races the connect promise.
-    if (wasConnected) await backend.disconnect();
+    if (wasConnected) {
+      // Drain in-flight outbound sends before disconnecting so a handoff
+      // (owned=false observed → ownership lost) never cuts off a reply
+      // mid-delivery. Bounded inside drainPendingSends so a wedged send can
+      // not stall teardown — we still disconnect promptly.
+      try { await backend.drainPendingSends?.(); } catch {}
+      await backend.disconnect();
+    }
   } finally {
     bridgeRuntimeConnected = false;
     logOwnership(`standby: ${reason}`);
@@ -881,6 +1008,16 @@ async function stopOwnedRuntime(reason) {
 function refreshBridgeOwnershipSafe(options = {}) {
   refreshBridgeOwnership(options).catch(err => process.stderr.write(`[channels] refreshBridgeOwnership rejected: ${err?.message || err}\n`));
 }
+// Ownership-loss / re-acquire detection timer. Armed BEFORE backend.connect()
+// (from startOwnedRuntime) so a session superseded during the connect window is
+// torn down promptly, and re-armed idempotently on every start path.
+function armBridgeOwnershipTimer() {
+  if (bridgeOwnershipTimer) return;
+  bridgeOwnershipTimer = setInterval(() => {
+    refreshBridgeOwnershipSafe();
+  }, 3e3);
+  bridgeOwnershipTimer.unref?.();
+}
 // Tell the parent session that this worker LOST the bridge seat to a newer
 // remote session (last-wins). The parent flips its remote mode OFF entirely —
 // exactly one session holds remote; losers fully release, no handover.
@@ -890,6 +1027,18 @@ function notifyRemoteSuperseded() {
     process.send({ type: 'notify', method: 'notifications/mixdog/remote', params: { state: 'superseded' } });
   } catch {}
 }
+// Symmetric to notifyRemoteSuperseded: tell the parent session this worker
+// ACQUIRED the bridge seat so it flips remote mode ON (badge/transcript writer).
+// Guarded by process.send so a manually-forked worker with no IPC parent is a
+// no-op instead of crashing. Callers fire this only on a genuine claim
+// transition (boot make-before-break, activate when not already owned) — never
+// on a heartbeat refresh — so the parent's idempotent handler sees it once.
+function notifyRemoteAcquired() {
+  if (!process.send) return;
+  try {
+    process.send({ type: 'notify', method: 'notifications/mixdog/remote', params: { state: 'acquired' } });
+  } catch {}
+}
 async function refreshBridgeOwnership(options = {}) {
   // Coalesce concurrent callers onto the in-flight refresh so backend tool
   // calls landing during normal login wait for the same connect attempt
@@ -906,35 +1055,44 @@ async function refreshBridgeOwnership(options = {}) {
       if (bridgeRuntimeConnected) await stopOwnedRuntime("bridge inactive");
       return;
     }
-    const { active, owned } = currentOwnerState();
+    // Non-blocking ownership probe (read-only, no lock): distinguishes a live
+    // owner from a genuinely empty/stale seat from an INDETERMINATE read (a
+    // concurrent atomic rename yields partial content). "Locked/unreadable =
+    // busy/unknown owner, never claimable" — skip the tick on 'unknown' so we
+    // never claim a seat we merely failed to read (double-owner guard).
+    const probe = probeActiveOwner();
+    if (probe.status === 'unknown') return;
+    const owned = probe.status === 'live' && probe.state?.instanceId === INSTANCE_ID;
     if (owned) {
-      // onlyIfOwned: ownership was checked outside the file lock; CAS mode
-      // prevents this periodic tick from overwriting a newer owner that
-      // claimed the seat in between (re-steal / ping-pong guard).
-      refreshActiveInstance(INSTANCE_ID, undefined, { onlyIfOwned: true });
+      // Try-once CAS refresh (timeoutMs:0): on lock contention treat as busy
+      // and skip the metadata touch — never block the tick. We still own, so
+      // ensure/keep the owned runtime up.
+      try { refreshActiveInstance(INSTANCE_ID, undefined, { onlyIfOwned: true, timeoutMs: 0 }); } catch {}
       await startOwnedRuntime(options);
       return;
     }
-    // Not the owner. Two sub-cases:
-    //   (a) A live remote session holds the seat (active-instance names a
-    //       different, non-stale instance) → last-wins: we lost, go quiet
-    //       (disconnect if we were connected) and tell the parent session to
-    //       drop remote mode entirely (single-holder, no handover).
-    //   (b) There is NO live owner (active is null/stale — e.g. our own entry
-    //       was cleared after a backend-connect failure or a bridge
-    //       deactivate/reactivate) → this remote session claims the empty seat
-    //       and starts the owned runtime. Without this, a remote session could
-    //       never (re)acquire ownership once its active entry was cleared.
-    if (active && active.instanceId && active.instanceId !== INSTANCE_ID) {
-      if (bridgeRuntimeConnected) {
+    if (probe.status === 'live' && probe.state.instanceId && probe.state.instanceId !== INSTANCE_ID) {
+      // A different live remote session holds the seat (last-wins: we lost).
+      // Go quiet (disconnect if connected) and tell the parent to drop remote
+      // mode entirely (single-holder, no handover). Notify UNCONDITIONALLY —
+      // a loser whose backend never connected must still drop its Remote
+      // indicator; the parent handler is idempotent.
+      // Also cover the STARTING phase: a worker stuck in backend.connect() must
+      // get _ownedRuntimeStopRequested set (stopOwnedRuntime does this while
+      // bridgeRuntimeStarting) so bailIfStopRequested tears it down promptly
+      // once connect() resolves — otherwise the superseded connect lingers.
+      if (bridgeRuntimeConnected || bridgeRuntimeStarting) {
         await stopOwnedRuntime("ownership lost (newer remote session)");
-        notifyRemoteSuperseded();
       }
+      notifyRemoteSuperseded();
       return;
     }
-    // No live owner — claim the empty seat and start.
-    claimBridgeOwnership("no active owner");
-    if (currentOwnerState().owned) {
+    // Empty (absent) or stale (dead owner) seat — claim it. Try-once
+    // (timeoutMs:0): a contended lock means a concurrent claimant is mid-write,
+    // so treat as busy and skip this tick rather than block.
+    let claimed = false;
+    try { claimed = claimBridgeOwnership("no active owner", { timeoutMs: 0 }); } catch { claimed = false; }
+    if (claimed) {
       await startOwnedRuntime(options);
     }
   })();
@@ -1444,10 +1602,12 @@ const {
   lifecycle: {
     getBridgeRuntimeConnected: () => bridgeRuntimeConnected,
     getChannelBridgeActive: () => channelBridgeActive,
+    getOwned: () => getBridgeOwnershipSnapshot().owned,
     setChannelBridgeActive: (v) => { channelBridgeActive = v; },
     writeBridgeState,
     stopServerTyping,
     claimBridgeOwnership,
+    notifyRemoteAcquired,
     refreshBridgeOwnership,
     bindPersistedTranscriptIfAny,
     stopOwnedRuntime,
@@ -1658,6 +1818,26 @@ backend.onMessage = (msg) => {
     });
   })();
 };
+const NETWORK_ERR_RE = /fetch failed|ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|socket hang up|network|timeout|aborted|TimeoutError/i;
+function isNetworkError(err) {
+  const s = `${err?.code ?? ""} ${err?.name ?? ""} ${err?.message ?? err ?? ""}`;
+  return NETWORK_ERR_RE.test(s);
+}
+async function retryOnNetwork(fn, { attempts = 3, baseDelayMs = 300, label = "op" } = {}) {
+  let lastErr;
+  for (let i = 0; i < attempts; i++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (i === attempts - 1 || !isNetworkError(err)) throw err;
+      const delay = baseDelayMs * (i + 1);
+      process.stderr.write(`mixdog: ${label} network failure (attempt ${i + 1}/${attempts}), retrying in ${delay}ms: ${err?.message || err}\n`);
+      await new Promise((r) => setTimeout(r, delay));
+    }
+  }
+  throw lastErr;
+}
 async function handleInbound(msg, route, options = {}) {
   const handleStartMs = Date.now();
   let text = msg.text;
@@ -1668,11 +1848,19 @@ async function handleInbound(msg, route, options = {}) {
       text = text || "[voice message]";
     } else {
       try {
-        const files = await backend.downloadAttachment(msg.chatId, msg.messageId);
+        const files = await retryOnNetwork(
+          // Short per-attempt timeout (vs the 180s default) bounds worst-case
+          // blockage of the serial inboundQueue on a bad voice message.
+          () => backend.downloadAttachment(msg.chatId, msg.messageId, { timeoutMs: 20_000 }),
+          { label: "voice.download" }
+        );
         // concurrency handled inside transcribeVoice queue; loop is sequential so last att wins
         for (const f of voiceAtts.map(a => files.find(df => df.id === a.id) ?? null).filter(Boolean)) {
           const _t0 = Date.now();
-          const transcript = await transcribeVoice(f.path, { attachmentId: f.id });
+          const transcript = await retryOnNetwork(
+            () => transcribeVoice(f.path, { attachmentId: f.id }),
+            { label: "voice.transcription" }
+          );
           const _elapsed = Date.now() - _t0;
           if (transcript) {
             text = transcript;
@@ -1683,8 +1871,12 @@ async function handleInbound(msg, route, options = {}) {
           }
         }
       } catch (err) {
-        process.stderr.write(`mixdog: voice.transcription error: ${err}\n`);
-        text = text || `[voice message \u2014 transcription error: ${err?.message || err}]`;
+        const netFail = isNetworkError(err);
+        process.stderr.write(`mixdog: voice.transcription error${netFail ? " (network, retries exhausted)" : ""}: ${err}\n`);
+        const marker = netFail
+          ? "[attachment: voice transcription failed (network)]"
+          : `[voice message \u2014 transcription error: ${err?.message || err}]`;
+        text = text ? `${text} ${marker}` : marker;
       }
     }
   }
@@ -1742,14 +1934,15 @@ async function init(_sharedMcp) {
 async function start() {
   channelBridgeActive = true;
   writeBridgeState(true);
-  // Opt-in remote, single-owner, last-wins. Claim the seat immediately so a
-  // later `mixdog --remote` session overwrites us and we drop on our next
-  // refresh tick. Then connect the owned runtime and arm the ownership timer
-  // that keeps checking whether a newer session has taken over.
-  claimBridgeOwnership("remote start");
+  // Opt-in remote, single-owner, last-wins, MAKE-BEFORE-BREAK. Do NOT claim the
+  // seat up front: connect our own gateway first and claim only after it reports
+  // READY (inside startOwnedRuntime, claimAfterReady). Until then the previous
+  // owner keeps serving, so a boot causes no send/receive gap. This is also the
+  // SINGLE boot claim — the old "remote start" pre-claim + "re-activate
+  // takeover" second claim (double reconnect) is gone.
   const _bindingReadyStart = Date.now();
   try {
-    await refreshBridgeOwnership({ restoreBinding: true });
+    await startOwnedRuntime({ restoreBinding: true, claimAfterReady: true });
     bindingReadyStatus = "resolved";
     dropTrace("bindingReady.resolve", { elapsedMs: Date.now() - _bindingReadyStart, status: bindingReadyStatus });
     _bindingReadyResolve(true);
@@ -1759,13 +1952,10 @@ async function start() {
     _bindingReadyResolve(e);
   }
   // Ownership timer: keep checking whether a newer remote session has taken
-  // over (last-wins) so a superseded owner disconnects promptly.
-  if (!bridgeOwnershipTimer) {
-    bridgeOwnershipTimer = setInterval(() => {
-      refreshBridgeOwnershipSafe();
-    }, 3e3);
-    bridgeOwnershipTimer.unref?.();
-  }
+  // over (last-wins) so a superseded owner disconnects promptly. Normally
+  // already armed by startOwnedRuntime before connect(); this is the fallback
+  // for a start path that aborted pre-connect (idempotent).
+  armBridgeOwnershipTimer();
   // Hot-reload config on file change (schedules/webhooks/events).
   if (!_configWatcher) {
     try {
@@ -1953,15 +2143,39 @@ if (_isWorkerMode && process.send) {
   })
   void (async () => {
     const startedAt = performance.now()
-    try {
-      await start()
-      bootProfile("worker:ready", { ms: (performance.now() - startedAt).toFixed(1) })
-      process.send({ type: 'ready' })
-    } catch (e) {
-      bootProfile("worker:failed", { ms: (performance.now() - startedAt).toFixed(1), error: e?.message || String(e) })
-      process.stderr.write(`[channels-worker] start() failed: ${e && (e.message || e)}\n`)
-      process.send({ type: 'ready', degraded: true, error: e?.message || String(e) })
+    const MAX_START_ATTEMPTS = 3
+    const BASE_BACKOFF_MS = 250
+    const isTransientStartErr = (err) =>
+      err?.code === 'ELOCKTIMEOUT' || /atomic lock timeout/i.test(err?.message || '')
+    let lastErr
+    for (let attempt = 1; attempt <= MAX_START_ATTEMPTS; attempt++) {
+      if (_channelsStopInFlight) return
+      try {
+        await start()
+        bootProfile("worker:ready", { ms: (performance.now() - startedAt).toFixed(1), attempt })
+        process.send({ type: 'ready' })
+        return
+      } catch (e) {
+        lastErr = e
+        const transient = isTransientStartErr(e)
+        bootProfile("worker:start-failed", { attempt, transient, error: e?.message || String(e) })
+        process.stderr.write(`[channels-worker] start() failed (attempt ${attempt}/${MAX_START_ATTEMPTS}, transient=${transient}): ${e && (e.message || e)}\n`)
+        if (!transient || attempt >= MAX_START_ATTEMPTS) break
+        const backoff = BASE_BACKOFF_MS * attempt + Math.floor(Math.random() * BASE_BACKOFF_MS)
+        await new Promise((r) => setTimeout(r, backoff))
+        if (_channelsStopInFlight) return
+      }
     }
+    // A stop landed while we were failing — let clean shutdown proceed, never exit over it.
+    if (_channelsStopInFlight) return
+    // Terminal failure: do NOT mask as a (degraded) ready. Exit non-zero so the
+    // parent's exit-before-ready path respawns or rejects startRemote instead of
+    // silently losing remote output forwarding.
+    bootProfile("worker:failed", { ms: (performance.now() - startedAt).toFixed(1), error: lastErr?.message || String(lastErr) })
+    process.stderr.write(`[channels-worker] start() giving up after ${MAX_START_ATTEMPTS} attempts: ${lastErr && (lastErr.message || lastErr)}\n`)
+    // Exit 2 = terminal (non-transient) start failure: parent must reject, not respawn.
+    // Exit 1 = exhausted transient retries: parent may respawn.
+    process.exit(isTransientStartErr(lastErr) ? 1 : 2)
   })()
 }
 

package/src/runtime/channels/lib/crash-log.mjs

@@ -86,15 +86,33 @@ ${err instanceof Error ? err.stack : ""}
 // already retried elsewhere (atomic-file.mjs RETRY_CODES) — a single
 // occurrence must NOT be fatal, only a run of 3+ in a row without an
 // intervening distinct/successful event.
-const BENIGN_CRASH_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const BENIGN_CRASH_CODES = new Set([
+  "EPERM", "EACCES", "EBUSY",
+  // Transient transport blips: a raw http/https ClientRequest (or an
+  // undici socket) can emit these when a keep-alive connection is torn
+  // down mid-flight (Discord gateway flapping, proxy resets). One blip
+  // must NOT kill the worker — it is benign; only a repeat storm within
+  // the streak window force-exits (see _fatalCrash).
+  "ECONNRESET", "ETIMEDOUT", "ECONNREFUSED", "EPIPE", "EHOSTUNREACH",
+  "ENETUNREACH", "ENETDOWN", "EAI_AGAIN", "ERR_STREAM_PREMATURE_CLOSE",
+  "UND_ERR_SOCKET", "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT", "UND_ERR_ABORTED",
+]);
+// Some transient socket errors arrive with no `.code` (notably the classic
+// "socket hang up" thrown by node:_http_client socketOnEnd — the exact crash
+// this guard exists for). Match those by message so they classify benign too.
+const BENIGN_CRASH_MESSAGE_RE = /socket hang up|ECONNRESET|ETIMEDOUT|EPIPE|UND_ERR_/i;
 const BENIGN_CRASH_FATAL_THRESHOLD = 3;
 // "In a row" needs a time dimension: benign errors minutes/hours apart are
 // independent contention events, not a corrupted-state run. Only count a
 // streak when hits land within this window of the previous one.
 const BENIGN_CRASH_STREAK_WINDOW_MS = 60_000;
 function _isBenignCrash(err) {
-  const code = err?.code || (/\b(EPERM|EACCES|EBUSY)\b/.exec(String(err?.message || err)) || [])[0];
-  return BENIGN_CRASH_CODES.has(code);
+  const msg = String(err?.message || err);
+  const code = err?.code
+    || (/\b(EPERM|EACCES|EBUSY|ECONNRESET|ETIMEDOUT|ECONNREFUSED|EPIPE|EHOSTUNREACH|ENETUNREACH|ENETDOWN|EAI_AGAIN|UND_ERR_[A-Z_]+)\b/.exec(msg) || [])[0];
+  if (BENIGN_CRASH_CODES.has(code)) return true;
+  return BENIGN_CRASH_MESSAGE_RE.test(msg);
 }
 
 export {

package/src/runtime/channels/lib/inbound-routing.mjs

@@ -28,6 +28,10 @@ function createInboundRouting({ getConfig, getInstanceId, getChannelOwnerPath })
     const now = Date.now();
     if (inboundSeen.has(key) && now - inboundSeen.get(key) < INBOUND_DEDUP_TTL) return true;
     inboundSeen.set(key, now);
+    // Cross-process marker write MUST stay synchronous: a fire-and-forget wx
+    // write opens a duplicate-delivery window where two processes both return
+    // false before either callback observes EEXIST. Single small write+stat is
+    // cheap. Only the periodic sweep is moved off the hot path (async).
     const marker = path.join(INBOUND_DEDUP_DIR, key.replace(/:/g, "_"));
     try {
       fs.writeFileSync(marker, String(now), { flag: "wx" });
@@ -39,24 +43,27 @@ function createInboundRouting({ getConfig, getInstanceId, getChannelOwnerPath })
         } catch {}
       }
     }
-    if (Math.random() < 0.1) {
-      try {
-        for (const f of fs.readdirSync(INBOUND_DEDUP_DIR)) {
-          const fp = path.join(INBOUND_DEDUP_DIR, f);
-          try {
-            if (now - fs.statSync(fp).mtimeMs > INBOUND_DEDUP_TTL) removeFileIfExists(fp);
-          } catch {
-          }
-        }
-      } catch {
-      }
-    }
+    scheduleSweep(now);
     for (const [k, t] of inboundSeen) {
       if (now - t > INBOUND_DEDUP_TTL) inboundSeen.delete(k);
     }
     return false;
   }
 
+  function scheduleSweep(now) {
+    if (Math.random() < 0.1) {
+      fs.readdir(INBOUND_DEDUP_DIR, (e, list) => {
+        if (e) return;
+        for (const f of list) {
+          const fp = path.join(INBOUND_DEDUP_DIR, f);
+          fs.stat(fp, (se, stat) => {
+            if (!se && now - stat.mtimeMs > INBOUND_DEDUP_TTL) removeFileIfExists(fp);
+          });
+        }
+      });
+    }
+  }
+
   function resolveInboundRoute(chatId, parentChatId) {
     const config = getConfig();
     // Single main channel: there is no per-channel label/mode map anymore.