mixdog 0.9.17 → 0.9.19

package/src/runtime/channels/lib/memory-client.mjs

@@ -190,25 +190,42 @@ function atomicWrite(targetPath, contents) {
   catch (e) { try { fs.unlinkSync(tmp) } catch {}; throw e }
 }
 
+// In-memory dedupeKey(filePath) -> absolute buffer path index. Replaces the
+// per-event O(N) readdir+read+parse dedupe scan in bufferToDisk. Seeded once
+// (lazily) from disk so cross-restart dedupe (one buffered ingest per
+// transcriptPath) still holds; maintained incrementally on write. A stale
+// entry (file drained/renamed) is caught by an existsSync guard at the call
+// site, so no drain/replay format or TTL semantics change.
+const _dedupeIndex = new Map()
+let _dedupeIndexSeeded = false
+function seedDedupeIndex(kind) {
+  if (_dedupeIndexSeeded) return
+  _dedupeIndexSeeded = true
+  let existing = []
+  try { existing = fs.readdirSync(BUFFER_DIR) } catch {}
+  for (const name of existing) {
+    if (!name.startsWith(`${kind}-`) || !name.endsWith('.json')) continue
+    try {
+      const prev = JSON.parse(fs.readFileSync(path.join(BUFFER_DIR, name), 'utf8'))
+      if (prev && prev.filePath != null) _dedupeIndex.set(prev.filePath, path.join(BUFFER_DIR, name))
+    } catch {}
+  }
+}
+
 function bufferToDisk(kind, payload, { dedupeKey = null } = {}) {
   try {
     fs.mkdirSync(BUFFER_DIR, { recursive: true })
     if (dedupeKey != null) {
-      let existing = []
-      try { existing = fs.readdirSync(BUFFER_DIR) } catch {}
-      for (const name of existing) {
-        if (!name.startsWith(`${kind}-`) || !name.endsWith('.json')) continue
-        const full = path.join(BUFFER_DIR, name)
-        try {
-          const prev = JSON.parse(fs.readFileSync(full, 'utf8'))
-          if (prev && prev.filePath === dedupeKey) {
-            // Atomic overwrite (tmp+rename); preserves the original (oldest)
-            // ordering slot without exposing a half-written file to a drainer.
-            atomicWrite(full, JSON.stringify(payload, null, 2))
-            return full
-          }
-        } catch {}
+      // In-memory index (seeded once from disk) replaces the per-event O(N)
+      // readdir+read+parse scan. Overwrite the existing buffered file for this
+      // dedupeKey in place (atomic tmp+rename) to keep its oldest ordering slot.
+      seedDedupeIndex(kind)
+      const idx = _dedupeIndex.get(dedupeKey)
+      if (idx && fs.existsSync(idx)) {
+        atomicWrite(idx, JSON.stringify(payload, null, 2))
+        return idx
       }
+      if (idx) _dedupeIndex.delete(dedupeKey)
     }
     enforceBufferCap()
     const random = Math.random().toString(36).slice(2, 10)
@@ -216,6 +233,7 @@ function bufferToDisk(kind, payload, { dedupeKey = null } = {}) {
     // ordering under a lexicographic sort.
     const bufferPath = path.join(BUFFER_DIR, `${kind}-${Date.now()}-${random}.json`)
     atomicWrite(bufferPath, JSON.stringify(payload, null, 2))
+    if (dedupeKey != null) _dedupeIndex.set(dedupeKey, bufferPath)
     return bufferPath
   } catch (bufErr) {
     process.stderr.write(`[memory-client] Failed to buffer ${kind}: ${bufErr.message}\n`)

package/src/runtime/channels/lib/output-forwarder.mjs

@@ -28,8 +28,24 @@ import {
   buildToolLine
 } from "./tool-format.mjs";
 
+// Per-item send watchdog. drainQueue awaits ONE backend send at a time; a hung
+// send would otherwise never settle, so drainQueue never returns and `sending`
+// stays true forever — wedging ALL outbound behind the queue head. The watchdog
+// does NOT abandon the send (racing a still-running send against a retry would
+// double-deliver): it only pokes the backend to reset its wedged client so the
+// AWAITED send fails fast and `sending` releases on real settlement. Sized above
+// the backend's worst-case per-attempt retries.
+const SEND_ITEM_TIMEOUT_MS = 120_000;
+// After the watchdog resets the backend, wait at most this long for the
+// abandoned send to actually settle before releasing the queue.
+const SEND_SETTLE_CAP_MS = 15_000;
+const TAIL_RECOVERY_BYTES = 256 * 1024;
+
 class OutputForwarder {
   ownerGetter = null;
+  // Generation of the in-flight supervised send. Bumped when a send is
+  // abandoned (settlement cap) so a late/zombie completion can't double-advance.
+  _activeSendGen = 0;
   setOwnerGetter(fn) {
     this.ownerGetter = fn;
   }
@@ -60,6 +76,9 @@ class OutputForwarder {
   lastFileSize = 0;
   readFileSize = 0;
   watchingPath = "";
+  // Set by readNewLines when a capped tick left more complete bytes on disk,
+  // so the poll callback re-arms a flush without waiting on a fresh fs event.
+  _pendingReadMore = false;
   watcher = null;
   idleTimer = null;
   onIdleCallback = null;
@@ -80,6 +99,11 @@ class OutputForwarder {
   // into the next pending text payload so we don't grow unbounded but
   // also don't lose content.
   static SEND_QUEUE_MAX = 200;
+  // Cap the bytes read per streaming tick so a large burst (e.g. a big tool
+  // result written at once) is amortized across ticks instead of allocating a
+  // multi-MB buffer and blocking the loop on one readSync. The cursor only
+  // advances by bytes actually consumed; the remainder is picked up next tick.
+  static MAX_TICK_READ_BYTES = 2 * 1024 * 1024;
   // Persisted final-flush ledger so a forwarder restart can resume final
   // forwarding instead of giving up after 5 short retries.
   pendingFinalFlush = false;
@@ -111,20 +135,35 @@ class OutputForwarder {
     try {
       const stat = existsSync(this.transcriptPath) ? statSync(this.transcriptPath) : null;
       const currentSize = stat?.size ?? 0;
+      const persisted = this.statusState?.read?.();
+      const sameTranscript = persisted?.transcriptPath &&
+        sameResolvedPath(persisted.transcriptPath, this.transcriptPath);
       let fileSize;
       if (options.replayFromStart) {
         fileSize = 0;
       } else if (options.catchUpFromPersisted) {
-        const persisted = this.statusState?.read?.();
         const persistedSize = typeof persisted?.lastFileSize === "number" ? persisted.lastFileSize : -1;
-        const sameTranscript = persisted?.transcriptPath &&
-          sameResolvedPath(persisted.transcriptPath, this.transcriptPath);
         fileSize = (sameTranscript && persistedSize >= 0)
           ? Math.min(Math.max(persistedSize, 0), currentSize)
           : currentSize;
       } else {
         fileSize = currentSize;
       }
+      if (options.recoverUnsyncedTail && fileSize === currentSize && currentSize > 0) {
+        const sentCount = Number(persisted?.sentCount ?? 0);
+        const lastSentTime = Number(persisted?.lastSentTime ?? 0);
+        const hasSentHash = typeof persisted?.lastSentHash === "string" && persisted.lastSentHash.length > 0;
+        const noSendEvidence = (!Number.isFinite(sentCount) || sentCount <= 0)
+          && (!Number.isFinite(lastSentTime) || lastSentTime <= 0)
+          && !hasSentHash;
+        if (!sameTranscript || noSendEvidence) {
+          const tailOffset = this.findLastAssistantTextOffset(currentSize);
+          if (tailOffset >= 0 && tailOffset < currentSize) {
+            fileSize = tailOffset;
+            dropTrace("context.recoverUnsyncedTail", { path: this.transcriptPath, offset: tailOffset, currentSize, sameTranscript: !!sameTranscript });
+          }
+        }
+      }
       this.lastFileSize = fileSize;
       this.readFileSize = fileSize;
     } catch {
@@ -132,6 +171,46 @@ class OutputForwarder {
       this.readFileSize = 0;
     }
   }
+  findLastAssistantTextOffset(fileSize) {
+    if (!this.transcriptPath || fileSize <= 0) return -1;
+    const bytesToRead = Math.min(fileSize, TAIL_RECOVERY_BYTES);
+    const startOffset = fileSize - bytesToRead;
+    let fd = null;
+    try {
+      fd = openSync(this.transcriptPath, "r");
+      const buf = Buffer.alloc(bytesToRead);
+      readSync(fd, buf, 0, bytesToRead, startOffset);
+      const raw = buf.toString("utf8");
+      let chunkStart = 0;
+      if (startOffset > 0) {
+        const firstNewline = raw.indexOf("\n");
+        if (firstNewline < 0) return -1;
+        chunkStart = firstNewline + 1;
+      }
+      let cursor = startOffset + chunkStart;
+      let lastOffset = -1;
+      for (const line of raw.slice(chunkStart).split("\n")) {
+        const lineOffset = cursor;
+        cursor += Buffer.byteLength(line, "utf8") + 1;
+        if (!line.trim()) continue;
+        try {
+          const entry = JSON.parse(line);
+          if (entry.isSidechain || entry.type !== "assistant") continue;
+          const parts = entry.message?.content;
+          if (!Array.isArray(parts)) continue;
+          if (parts.some((c) => c?.type === "text" && typeof c.text === "string" && c.text.trim())) {
+            lastOffset = lineOffset;
+          }
+        } catch {
+        }
+      }
+      return lastOffset;
+    } catch {
+      return -1;
+    } finally {
+      if (fd != null) closeSync(fd);
+    }
+  }
   /** Reset counters for new turn */
   reset() {
     this.sentCount = 0;
@@ -146,12 +225,13 @@ class OutputForwarder {
     }
   }
   /** Read new bytes from transcript file since readFileSize */
-  readNewLines() {
+  readNewLines(uncapped = false) {
     if (!this.transcriptPath || !existsSync(this.transcriptPath)) {
       return { lines: [], nextFileSize: this.readFileSize };
     }
     let fd = null;
     try {
+      this._pendingReadMore = false;
       const stat = this._pendingStat ?? statSync(this.transcriptPath);
       this._pendingStat = null;
       // File shrank below our cursor: the transcript was rotated out from
@@ -166,16 +246,33 @@ class OutputForwarder {
         return { lines: [], nextFileSize: this.readFileSize };
       }
       const startOffset = this.readFileSize;
+      const available = stat.size - startOffset;
+      // Cap the per-tick read (streaming path). The final-flush path passes
+      // uncapped=true to drain the whole tail in one shot.
+      let readLen = uncapped ? available : Math.min(available, OutputForwarder.MAX_TICK_READ_BYTES);
       fd = openSync(this.transcriptPath, "r");
-      const buf = Buffer.alloc(stat.size - startOffset);
-      readSync(fd, buf, 0, buf.length, startOffset);
+      let buf = Buffer.alloc(readLen);
+      readSync(fd, buf, 0, readLen, startOffset);
       // Only advance readFileSize to the last newline boundary. A trailing
       // partial line (writer still appending) must be re-read next tick;
       // otherwise the parse-failed slice is silently consumed forever.
-      const lastNl = buf.lastIndexOf(0x0a);
+      let lastNl = buf.lastIndexOf(0x0a);
+      // The capped window split a single JSONL line larger than the cap (no
+      // newline inside it). Fall back to reading the full available range this
+      // tick so the line boundary is found — matches the pre-cap behavior and
+      // avoids getting stuck forever on an oversize line.
+      if (lastNl < 0 && readLen < available) {
+        readLen = available;
+        buf = Buffer.alloc(readLen);
+        readSync(fd, buf, 0, readLen, startOffset);
+        lastNl = buf.lastIndexOf(0x0a);
+      }
       const consumed = lastNl >= 0 ? lastNl + 1 : 0;
       const nextFileSize = startOffset + consumed;
       this.readFileSize = nextFileSize;
+      // Capped read left more complete bytes on disk: signal the poll callback
+      // to re-tick so a burst drains without waiting on another fs event.
+      this._pendingReadMore = readLen < available && nextFileSize > startOffset;
       const text = consumed > 0 ? buf.slice(0, consumed).toString("utf8") : "";
       return {
         lines: text ? text.split("\n").filter((l) => l.trim()) : [],
@@ -193,8 +290,8 @@ class OutputForwarder {
   lastToolName = "";
   lastToolFilePath = "";
   /** Extract new assistant text + tool logs from transcript since readFileSize */
-  extractNewText() {
-    const { lines: newLines, nextFileSize } = this.readNewLines();
+  extractNewText(uncapped = false) {
+    const { lines: newLines, nextFileSize } = this.readNewLines(uncapped);
     let newText = "";
     for (const l of newLines) {
       try {
@@ -282,6 +379,7 @@ class OutputForwarder {
   }
   async deliverQueueItem(item) {
     const targetChannelId = item.channelId ?? this.channelId;
+    const gen = ++this._activeSendGen;
     if (!item.text || !targetChannelId) {
       this.commitReadProgress(item.nextFileSize);
       return;
@@ -314,10 +412,13 @@ class OutputForwarder {
       // re-sending chunks that already landed. The token is opaque here —
       // the forwarder only stores/passes/clears it, never interprets it.
       await this.cb.send(targetChannelId, formatted, item._resumeToken ? { resumeToken: item._resumeToken } : undefined);
+      dropTrace("discord.send.ok", null);
+      // A zombie completion (send abandoned past the settlement cap, gen bumped)
+      // must not mutate ANY item/queue state — including the resume token.
+      if (gen !== this._activeSendGen) return;
       // Full success — drop any stale token so a later reuse of this item
       // object can't carry a dead token.
       item._resumeToken = undefined;
-      dropTrace("discord.send.ok", null);
     } catch (err) {
       // Persist the opaque resume token (if any) on the item so the requeued
       // retry resumes from the failed chunk.
@@ -349,7 +450,18 @@ ${_bt.trim()}` : _bt.trim();
   }
   /** Forward new assistant text to Discord. Returns true if text was sent. */
   async forwardNewText() {
-    if (!this._isOwner()) return false;
+    if (!this._isOwner()) {
+      // Silent no-send is invisible and has masked real ownership-gate bugs
+      // (a live seat that never forwards). Surface it, rate-limited to one
+      // line per 60s so a persistent non-owner state stays visible without
+      // flooding stderr on every poll tick.
+      const now = Date.now();
+      if (!this._lastOwnerGateLogAt || now - this._lastOwnerGateLogAt >= 60_000) {
+        this._lastOwnerGateLogAt = now;
+        process.stderr.write(`[output-forwarder] forwardNewText skipped: not seat owner (channelId=${this.channelId ?? "none"})\n`);
+      }
+      return false;
+    }
     if (!this.channelId) return false;
     const { text: newText, nextFileSize } = this.extractNewText();
     if (!newText) {
@@ -428,6 +540,31 @@ ${_bt.trim()}` : _bt.trim();
   _kickDrain() {
     this.drainQueue().catch(err => process.stderr.write(`[output-forwarder] drainQueue rejected: ${err?.message || err}\n`));
   }
+  /** Supervise a per-item send. The underlying promise is AWAITED to real
+   *  settlement so `sending` is never released early (no unsupervised send
+   *  racing a retry → duplicate). The watchdog's only job is to reset the
+   *  backend's wedged client so the awaited send fails fast. */
+  _sendSupervised(promise, label) {
+    const settled = Promise.resolve(promise);
+    settled.catch(() => {}); // never leak an unhandled rejection on late settle
+    return new Promise((resolve, reject) => {
+      let capTimer = null;
+      const watchdog = setTimeout(() => {
+        process.stderr.write(`[output-forwarder] ${label} watchdog fired after ${SEND_ITEM_TIMEOUT_MS}ms; resetting backend\n`);
+        Promise.resolve(this.cb?.resetBackend?.()).catch(() => {});
+        // Bound the post-reset settlement wait; past the cap, invalidate the
+        // in-flight send (gen bump → zombie can't double-advance) and release.
+        capTimer = setTimeout(() => {
+          this._activeSendGen++;
+          reject(new Error(`${label} abandoned after ${SEND_SETTLE_CAP_MS}ms settlement cap`));
+        }, SEND_SETTLE_CAP_MS);
+      }, SEND_ITEM_TIMEOUT_MS);
+      settled.then(
+        (v) => { clearTimeout(watchdog); if (capTimer) clearTimeout(capTimer); resolve(v); },
+        (e) => { clearTimeout(watchdog); if (capTimer) clearTimeout(capTimer); reject(e); }
+      );
+    });
+  }
   /** Drain both priority lanes sequentially. finalLane drains first when non-empty. */
   async drainQueue() {
     if (this.sending) return;
@@ -440,9 +577,9 @@ ${_bt.trim()}` : _bt.trim();
         const item = lane[0];
         try {
           if (item.type === "text") {
-            await this.deliverQueueItem(item);
+            await this._sendSupervised(this.deliverQueueItem(item), "deliverQueueItem");
           } else if (item.type === "toolLog") {
-            await this.processToolLog(item);
+            await this._sendSupervised(this.processToolLog(item), "processToolLog");
           }
           lane.shift();
         } catch (err) {
@@ -524,7 +661,9 @@ ${_bt.trim()}` : _bt.trim();
           await this.cb.removeReaction(channelId, this.userMessageId, this.emoji);
         } catch {} // best-effort: remove reaction is non-critical
       }
-      const { text: newText, nextFileSize } = this.extractNewText();
+      // Final flush drains the whole remaining tail (uncapped) so a turn's
+      // last write can't be split across ticks with nothing left to re-tick it.
+      const { text: newText, nextFileSize } = this.extractNewText(true);
       if (newText) {
         const finalItem = { type: "text", text: newText, nextFileSize, bufferText: newText, channelId };
         try {
@@ -725,6 +864,9 @@ ${_bt.trim()}` : _bt.trim();
         if (hadText) {
           this.resetIdleTimer();
         }
+        // A capped tick left more complete bytes on disk: re-arm a flush so the
+        // burst drains even if the writer has gone quiet (no further fs event).
+        if (this._pendingReadMore) this.scheduleWatchFlush();
       }).catch(err => process.stderr.write(`[output-forwarder] forwardNewText rejected: ${err?.message || err}\n`));
     }, 100);
   }

package/src/runtime/channels/lib/owner-heartbeat.mjs

@@ -33,9 +33,15 @@ function createOwnerHeartbeat({
   function getBridgeOwnershipSnapshot() {
     return currentOwnerState();
   }
-  function claimBridgeOwnership(reason) {
-    refreshActiveInstance(getInstanceId());
-    logOwnership(`claimed owner (${reason})`);
+  function claimBridgeOwnership(reason, options = {}) {
+    // Returns true only when THIS instance actually holds the seat after the
+    // write. With options.timeoutMs:0 (try-once) a contended lock throws
+    // ELOCKCONTENDED — the caller catches it and treats the seat as busy.
+    const refreshOpts = Number.isFinite(options.timeoutMs) ? { timeoutMs: options.timeoutMs } : undefined;
+    const res = refreshActiveInstance(getInstanceId(), undefined, refreshOpts);
+    const claimed = res?.instanceId === getInstanceId();
+    if (claimed) logOwnership(`claimed owner (${reason})`);
+    return claimed;
   }
   function startOwnerHeartbeat() {
     if (ownerHeartbeatTimer) return;
@@ -49,7 +55,10 @@ function createOwnerHeartbeat({
         // onlyIfOwned: re-checks ownership INSIDE the file lock so a newer
         // owner claiming the seat between currentOwnerState() and the locked
         // write is never overwritten (see refreshActiveInstance CAS guard).
-        if (currentOwnerState().owned) refreshActiveInstance(getInstanceId(), undefined, { onlyIfOwned: true });
+        // Try-once (timeoutMs:0): the heartbeat must never block on the
+        // active-instance lock. On contention refreshActiveInstance throws and
+        // we simply skip this tick — the next tick catches up.
+        if (currentOwnerState().owned) refreshActiveInstance(getInstanceId(), undefined, { onlyIfOwned: true, timeoutMs: 0 });
       } catch (e) {
         process.stderr.write(`[ownership] heartbeat refresh failed: ${e instanceof Error ? e.message : String(e)}\n`);
       }

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -211,6 +211,34 @@ function writeActiveInstance(state) {
   ensureRuntimeDirs();
   writeJsonFile(ACTIVE_INSTANCE_FILE, state);
 }
+// Non-blocking ownership probe for the periodic refresh/heartbeat tick. Reads
+// active-instance WITHOUT taking the lock (never blocks). Distinguishes:
+//   'absent'  — file does not exist            → seat is claimable
+//   'stale'   — parseable but owner PID is dead → seat is claimable
+//   'live'    — parseable, owner PID alive      → seat is held (state.instanceId)
+//   'unknown' — file present but unreadable/partial (concurrent atomic rename)
+//               → INDETERMINATE; callers must treat as busy and NEVER claim.
+// This is the read-side guard for "locked/unreadable = busy/unknown owner,
+// never claimable/no-owner": a torn read during another writer's rename must
+// not be mistaken for an empty seat.
+function probeActiveOwner() {
+  try { statSync(ACTIVE_INSTANCE_FILE); } catch { return { status: 'absent', state: null }; }
+  let raw = readJsonFile(ACTIVE_INSTANCE_FILE, null);
+  if (!raw) {
+    // Transient partial content during an atomic rename — retry once.
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
+    raw = readJsonFile(ACTIVE_INSTANCE_FILE, null);
+    if (!raw) {
+      // Re-check existence to disambiguate a completed delete (absent) from a
+      // still-unreadable file (unknown/busy).
+      try { statSync(ACTIVE_INSTANCE_FILE); } catch { return { status: 'absent', state: null }; }
+      return { status: 'unknown', state: null };
+    }
+  }
+  const staleReason = activeInstanceStaleReason(raw);
+  if (staleReason) return { status: 'stale', state: raw, staleReason };
+  return { status: 'live', state: raw };
+}
 function buildActiveInstanceState(instanceId, meta) {
   const gatewayMeta = Object.fromEntries(
     Object.entries(meta || {}).filter(([k]) => k.startsWith('gateway_'))
@@ -233,6 +261,11 @@ function buildActiveInstanceState(instanceId, meta) {
 }
 function refreshActiveInstance(instanceId, meta, options) {
   ensureRuntimeDirs();
+  // Periodic refresh/heartbeat callers pass options.timeoutMs:0 (try-once) so
+  // the ownership tick never blocks on the active-instance lock — contention
+  // throws ELOCKCONTENDED, which the caller treats as "busy, skip this tick".
+  const writeOpts = { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' };
+  if (options && Number.isFinite(options.timeoutMs)) writeOpts.timeoutMs = options.timeoutMs;
   return updateJsonAtomicSync(ACTIVE_INSTANCE_FILE, (curRaw) => {
     const prevForPreserve = curRaw;
     const prev = activeInstanceStaleReason(curRaw) ? null : curRaw;
@@ -360,8 +393,21 @@ function refreshActiveInstance(instanceId, meta, options) {
         }
       }
     }
+    // Worker-owned seat: when THIS process is the channels worker and it is
+    // the seat owner (no distinct TUI/supervisor Lead — ownerLeadPid resolves
+    // to our own pid), keep ui_heartbeat_at fresh. A headless worker never
+    // runs the TUI render loop, so an inherited heartbeat (written by a prior
+    // TUI session and carried forward in prevRest) would otherwise go stale at
+    // UI_HEARTBEAT_STALE_MS and falsely flag a live worker-owned seat. A
+    // TUI-owned seat has a distinct supervisor (ownerLeadPid !== our pid), so
+    // this branch is a no-op there and TUI staleness is preserved.
+    const workerOwnsSeat = process.env.MIXDOG_WORKER_MODE === "1"
+      && identity.ownerLeadPid === process.pid;
+    if (workerOwnsSeat) {
+      next.ui_heartbeat_at = Date.now();
+    }
     return { ...preservedExtra, ...next };
-  }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' });
+  }, writeOpts);
 }
 const SERVER_PID_FILE = join(
   RUNTIME_ROOT,
@@ -512,6 +558,7 @@ export {
   notePreviousServerIfAny,
   makeInstanceId,
   readActiveInstance,
+  probeActiveOwner,
   refreshActiveInstance,
   releaseOwnedChannelLocks,
   touchUiHeartbeat,

package/src/runtime/channels/lib/tool-dispatch.mjs

@@ -19,10 +19,12 @@ function createToolDispatch({
   const {
     getBridgeRuntimeConnected,
     getChannelBridgeActive,
+    getOwned,
     setChannelBridgeActive,
     writeBridgeState,
     stopServerTyping,
     claimBridgeOwnership,
+    notifyRemoteAcquired,
     refreshBridgeOwnership,
     bindPersistedTranscriptIfAny,
     stopOwnedRuntime,
@@ -48,13 +50,21 @@ function createToolDispatch({
             setChannelBridgeActive(active);
             writeBridgeState(active);
             if (active) {
-              // Force-takeover semantics: activation ALWAYS claims the seat
-              // (last-wins overwrite of active-instance.json) and refreshes the
-              // output-forwarder binding onto THIS session — even when the
-              // bridge was already active. `/remote` relies on this to re-occupy
-              // after another session stole ownership, and to re-pin forwarding
-              // to the current session transcript.
-              claimBridgeOwnership(wasActive ? "re-activate takeover" : "bridge activated");
+              // Claim the seat only when we are NOT already the owner — a
+              // genuine /remote takeover or re-occupy after being superseded.
+              // When this session already owns the seat (e.g. the boot-time
+              // activate that fires right after start() claimed after READY),
+              // skip the redundant claim so boot performs ONE claim, not a
+              // remote-start + re-activate double claim (the latter forced a
+              // double reconnect). refreshBridgeOwnership below still re-pins
+              // the forwarder binding onto THIS session either way.
+              if (getOwned?.() !== true) {
+                claimBridgeOwnership(wasActive ? "re-activate takeover" : "bridge activated");
+                // Genuine acquire transition (we were NOT the owner) — tell the
+                // parent to flip remote ON. Not fired when we already own the
+                // seat, so an idempotent re-activate never re-notifies.
+                notifyRemoteAcquired?.();
+              }
               try {
                 await refreshBridgeOwnership({ restoreBinding: true });
                 // An already-connected owner returns early from

package/src/runtime/channels/lib/voice-transcription.mjs

@@ -167,9 +167,11 @@ function createVoiceTranscription({ getConfig, dataDir }) {
       if (attachmentId && result) _voiceTranscriptCache.set(attachmentId, result);
       return result;
     } catch (err) {
-      if (err?.message?.startsWith('voice runtime not installed')) throw err; // propagate setup errors; caller posts user-visible failure
+      // Propagate ALL real failures so the caller's retry (network-class) and
+      // failure marker (index.mjs catch) fire; null is reserved strictly for a
+      // legit empty transcript.
       process.stderr.write(`mixdog: voice.transcription failed: ${err}\n`);
-      return null;
+      throw err;
     }
   }
 

package/src/runtime/memory/lib/memory-recall-scope-filter.mjs

@@ -50,8 +50,14 @@ export function buildRecallScopeFilter(offset, options = {}, tableAlias = '') {
   ]
   const params = []
   let next = offset
-  const tsFrom = Number.isFinite(Number(options.ts_from)) ? Number(options.ts_from) : null
-  const tsTo = Number.isFinite(Number(options.ts_to)) ? Number(options.ts_to) : null
+  // Treat null AND undefined as "no bound". Number(null) === 0 (finite), so a
+  // caller forwarding a null ts bound would otherwise inject `ts >= 0` /
+  // `ts <= 0` — the latter silently drops every row (epoch-ms ts > 0). Callers
+  // pass null for "absent" throughout the recall path; never coerce it to 0.
+  const tsFrom = options.ts_from == null ? null
+    : (Number.isFinite(Number(options.ts_from)) ? Number(options.ts_from) : null)
+  const tsTo = options.ts_to == null ? null
+    : (Number.isFinite(Number(options.ts_to)) ? Number(options.ts_to) : null)
   if (tsFrom != null) { clauses.push(`${p}ts >= $${next++}`); params.push(tsFrom) }
   if (tsTo != null) { clauses.push(`${p}ts <= $${next++}`); params.push(tsTo) }
   const excludeStatuses = Array.isArray(options.excludeStatuses)