mixdog 0.9.18 → 0.9.19

package/src/runtime/channels/index.mjs

@@ -42,6 +42,7 @@ import {
   readActiveInstance,
   refreshActiveInstance,
   cleanupStaleRuntimeFiles,
+  probeActiveOwner,
   cleanupInstanceRuntimeFiles,
   releaseOwnedChannelLocks,
   clearActiveInstance,
@@ -789,23 +790,54 @@ async function startOwnedRuntime(options = {}) {
   // backend WE started (not the freshly-swapped one), closing the
   // both-backends-live window.
   const startingBackend = backend;
-  // Advertise active-instance.json BEFORE backend connect so a newer remote
-  // session's last-wins claim is visible immediately. backendReady=false
-  // marks the partial state until backend.connect() succeeds.
-  // onlyIfOwned: startOwnedRuntime is only entered on the owned path, but a
-  // newer session can claim the seat between that check and this write; CAS
-  // aborts instead of re-stealing. The write result is checked below so a
-  // CAS abort stops the start path immediately (heartbeat/backend/scheduler
-  // never start) instead of relying on the 3s ownership timer to notice.
-  const casResult = refreshActiveInstance(INSTANCE_ID, { backendReady: false }, { onlyIfOwned: true });
-  // A successful CAS write always sets instanceId to ours; any other result
-  // (aborted write returning the stale/foreign/missing prior state) means
-  // the seat was not ours to claim — abort the start path here rather than
-  // relying on the 3s ownership timer to notice later.
-  if (casResult?.instanceId !== INSTANCE_ID) {
+  const claimAfterReady = options.claimAfterReady === true;
+  // Single-holder correctness: the seat is claimed BEFORE backend.connect(),
+  // never after. The old make-before-break (claim-after-ready) boot left two
+  // gateways connected and contending during the multi-second connect window;
+  // claiming first makes the previous owner observe owned=false on its next
+  // tick and drain+disconnect, so at most one gateway ever serves.
+  //   - boot (claimAfterReady): last-wins acquire — this new remote session
+  //     takes the seat outright.
+  //   - refresh/owned-path: CAS onlyIfOwned — abort fast if the seat moved.
+  // backendReady=false marks the partial state until backend.connect() succeeds.
+  // Wrapped so ANY throw in the pre-connect claim (lock contention/error)
+  // resets bridgeRuntimeStarting — otherwise a transient lock error would
+  // leave it stuck true and permanently block every future ownership attempt.
+  try {
+    if (claimAfterReady) {
+      refreshActiveInstance(INSTANCE_ID, { backendReady: false });
+      logOwnership("boot claim (pre-connect, last-wins)");
+    } else {
+      // Try-once (timeoutMs:0): a refresh-path re-acquire must never block on
+      // the active-instance lock. Contention throws → caught below and treated
+      // as "seat busy, abort this attempt"; the next 3s tick retries.
+      const casResult = refreshActiveInstance(INSTANCE_ID, { backendReady: false }, { onlyIfOwned: true, timeoutMs: 0 });
+      // A successful CAS write always sets instanceId to ours; any other result
+      // (aborted write returning the stale/foreign/missing prior state) means the
+      // seat was not ours to claim — abort here rather than relying on the timer.
+      if (casResult?.instanceId !== INSTANCE_ID) {
+        bridgeRuntimeStarting = false;
+        return;
+      }
+    }
+    // A newer session can claim between our write and this read. If we no longer
+    // own the seat, abort fast WITHOUT starting heartbeat/backend/scheduler/
+    // webhook/ngrok — ancillary runtime starts only past a confirmed-owned claim.
+    if (!currentOwnerState().owned) {
+      bridgeRuntimeStarting = false;
+      return;
+    }
+  } catch (e) {
     bridgeRuntimeStarting = false;
+    process.stderr.write(`mixdog: pre-connect seat claim aborted (${e instanceof Error ? e.message : String(e)})\n`);
     return;
   }
+  // Arm ownership-loss detection BEFORE backend.connect() so a session that is
+  // superseded during the (multi-second) connect window is torn down: the 3s
+  // tick observes a newer owner and flips _ownedRuntimeStopRequested, and
+  // bailIfStopRequested below disconnects the backend WE connected.
+  armBridgeOwnershipTimer();
+  // Heartbeat is ownership-gated; safe to arm now that we hold the seat.
   startOwnerHeartbeat();
   // Periodic buffer drain: replays memory-buffer/entry-*/ingest-*.json once the
   // memory service publishes its port. Idempotent + reentrancy-guarded inside
@@ -849,12 +881,34 @@ async function startOwnedRuntime(options = {}) {
       if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
       return;
     }
+    // Post-connect ownership confirm (CAS). The seat was claimed BEFORE
+    // connect; a newer session may have superseded us during the connect
+    // window (the 3s tick would already be tearing us down). onlyIfOwned:
+    // never re-steal here. If the CAS aborts we LOST the seat — disconnect the
+    // backend WE connected and mark the bridge runtime not connected (do NOT
+    // clear active-instance; the newer owner holds it).
+    let ownConfirm;
+    try {
+      ownConfirm = refreshActiveInstance(INSTANCE_ID, { backendReady: true }, { onlyIfOwned: true });
+    } catch { ownConfirm = null; }
+    if (ownConfirm?.instanceId !== INSTANCE_ID) {
+      try { await startingBackend.disconnect(); } catch {}
+      try { stopOwnerHeartbeat(); } catch {}
+      try { releaseOwnedChannelLocks(INSTANCE_ID); } catch {}
+      if (_memoryDrainTimer) { clearInterval(_memoryDrainTimer); _memoryDrainTimer = null; }
+      bridgeRuntimeConnected = false;
+      cancelPendingTranscriptRearm();
+      try { forwarder.stopWatch(); } catch {}
+      if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
+      notifyRemoteSuperseded();
+      return;
+    }
     bridgeRuntimeConnected = true;
-    // onlyIfOwned: backend.connect() above can take seconds — a newer owner
-    // claiming the seat during that await must not be overwritten here. On
-    // CAS abort the next refreshBridgeOwnership tick observes owned=false
-    // and stops this runtime; backendReady stays unset for the lost seat.
-    refreshActiveInstance(INSTANCE_ID, { backendReady: true }, { onlyIfOwned: true });
+    if (claimAfterReady) {
+      // First confirmed ownership at boot — tell the parent it holds the seat
+      // exactly once (heartbeat/refresh re-pin ownership but never re-enter).
+      notifyRemoteAcquired();
+    }
     // initProviders must complete before scheduler.start() — otherwise the
     // scheduler's first fire can land before the registry is populated and
     // return `Provider "<name>" not found or not enabled`. The previous
@@ -938,7 +992,14 @@ async function stopOwnedRuntime(reason) {
   try {
     // Only disconnect the backend when connect() actually completed; calling
     // disconnect() mid-connect races the connect promise.
-    if (wasConnected) await backend.disconnect();
+    if (wasConnected) {
+      // Drain in-flight outbound sends before disconnecting so a handoff
+      // (owned=false observed → ownership lost) never cuts off a reply
+      // mid-delivery. Bounded inside drainPendingSends so a wedged send can
+      // not stall teardown — we still disconnect promptly.
+      try { await backend.drainPendingSends?.(); } catch {}
+      await backend.disconnect();
+    }
   } finally {
     bridgeRuntimeConnected = false;
     logOwnership(`standby: ${reason}`);
@@ -947,6 +1008,16 @@ async function stopOwnedRuntime(reason) {
 function refreshBridgeOwnershipSafe(options = {}) {
   refreshBridgeOwnership(options).catch(err => process.stderr.write(`[channels] refreshBridgeOwnership rejected: ${err?.message || err}\n`));
 }
+// Ownership-loss / re-acquire detection timer. Armed BEFORE backend.connect()
+// (from startOwnedRuntime) so a session superseded during the connect window is
+// torn down promptly, and re-armed idempotently on every start path.
+function armBridgeOwnershipTimer() {
+  if (bridgeOwnershipTimer) return;
+  bridgeOwnershipTimer = setInterval(() => {
+    refreshBridgeOwnershipSafe();
+  }, 3e3);
+  bridgeOwnershipTimer.unref?.();
+}
 // Tell the parent session that this worker LOST the bridge seat to a newer
 // remote session (last-wins). The parent flips its remote mode OFF entirely —
 // exactly one session holds remote; losers fully release, no handover.
@@ -956,6 +1027,18 @@ function notifyRemoteSuperseded() {
     process.send({ type: 'notify', method: 'notifications/mixdog/remote', params: { state: 'superseded' } });
   } catch {}
 }
+// Symmetric to notifyRemoteSuperseded: tell the parent session this worker
+// ACQUIRED the bridge seat so it flips remote mode ON (badge/transcript writer).
+// Guarded by process.send so a manually-forked worker with no IPC parent is a
+// no-op instead of crashing. Callers fire this only on a genuine claim
+// transition (boot make-before-break, activate when not already owned) — never
+// on a heartbeat refresh — so the parent's idempotent handler sees it once.
+function notifyRemoteAcquired() {
+  if (!process.send) return;
+  try {
+    process.send({ type: 'notify', method: 'notifications/mixdog/remote', params: { state: 'acquired' } });
+  } catch {}
+}
 async function refreshBridgeOwnership(options = {}) {
   // Coalesce concurrent callers onto the in-flight refresh so backend tool
   // calls landing during normal login wait for the same connect attempt
@@ -972,40 +1055,44 @@ async function refreshBridgeOwnership(options = {}) {
       if (bridgeRuntimeConnected) await stopOwnedRuntime("bridge inactive");
       return;
     }
-    const { active, owned } = currentOwnerState();
+    // Non-blocking ownership probe (read-only, no lock): distinguishes a live
+    // owner from a genuinely empty/stale seat from an INDETERMINATE read (a
+    // concurrent atomic rename yields partial content). "Locked/unreadable =
+    // busy/unknown owner, never claimable" — skip the tick on 'unknown' so we
+    // never claim a seat we merely failed to read (double-owner guard).
+    const probe = probeActiveOwner();
+    if (probe.status === 'unknown') return;
+    const owned = probe.status === 'live' && probe.state?.instanceId === INSTANCE_ID;
     if (owned) {
-      // onlyIfOwned: ownership was checked outside the file lock; CAS mode
-      // prevents this periodic tick from overwriting a newer owner that
-      // claimed the seat in between (re-steal / ping-pong guard).
-      refreshActiveInstance(INSTANCE_ID, undefined, { onlyIfOwned: true });
+      // Try-once CAS refresh (timeoutMs:0): on lock contention treat as busy
+      // and skip the metadata touch — never block the tick. We still own, so
+      // ensure/keep the owned runtime up.
+      try { refreshActiveInstance(INSTANCE_ID, undefined, { onlyIfOwned: true, timeoutMs: 0 }); } catch {}
       await startOwnedRuntime(options);
       return;
     }
-    // Not the owner. Two sub-cases:
-    //   (a) A live remote session holds the seat (active-instance names a
-    //       different, non-stale instance) → last-wins: we lost, go quiet
-    //       (disconnect if we were connected) and tell the parent session to
-    //       drop remote mode entirely (single-holder, no handover).
-    //   (b) There is NO live owner (active is null/stale — e.g. our own entry
-    //       was cleared after a backend-connect failure or a bridge
-    //       deactivate/reactivate) → this remote session claims the empty seat
-    //       and starts the owned runtime. Without this, a remote session could
-    //       never (re)acquire ownership once its active entry was cleared.
-    if (active && active.instanceId && active.instanceId !== INSTANCE_ID) {
-      if (bridgeRuntimeConnected) {
+    if (probe.status === 'live' && probe.state.instanceId && probe.state.instanceId !== INSTANCE_ID) {
+      // A different live remote session holds the seat (last-wins: we lost).
+      // Go quiet (disconnect if connected) and tell the parent to drop remote
+      // mode entirely (single-holder, no handover). Notify UNCONDITIONALLY —
+      // a loser whose backend never connected must still drop its Remote
+      // indicator; the parent handler is idempotent.
+      // Also cover the STARTING phase: a worker stuck in backend.connect() must
+      // get _ownedRuntimeStopRequested set (stopOwnedRuntime does this while
+      // bridgeRuntimeStarting) so bailIfStopRequested tears it down promptly
+      // once connect() resolves — otherwise the superseded connect lingers.
+      if (bridgeRuntimeConnected || bridgeRuntimeStarting) {
         await stopOwnedRuntime("ownership lost (newer remote session)");
       }
-      // Notify the parent UNCONDITIONALLY (not only when we were connected):
-      // a loser whose backend never connected (seat stolen mid-connect,
-      // connect failed, or already in standby) must still drop its Remote
-      // indicator. The parent handler is idempotent — it only acts while
-      // remoteEnabled is still true — so repeat ticks are harmless.
       notifyRemoteSuperseded();
       return;
     }
-    // No live owner — claim the empty seat and start.
-    claimBridgeOwnership("no active owner");
-    if (currentOwnerState().owned) {
+    // Empty (absent) or stale (dead owner) seat — claim it. Try-once
+    // (timeoutMs:0): a contended lock means a concurrent claimant is mid-write,
+    // so treat as busy and skip this tick rather than block.
+    let claimed = false;
+    try { claimed = claimBridgeOwnership("no active owner", { timeoutMs: 0 }); } catch { claimed = false; }
+    if (claimed) {
       await startOwnedRuntime(options);
     }
   })();
@@ -1515,10 +1602,12 @@ const {
   lifecycle: {
     getBridgeRuntimeConnected: () => bridgeRuntimeConnected,
     getChannelBridgeActive: () => channelBridgeActive,
+    getOwned: () => getBridgeOwnershipSnapshot().owned,
     setChannelBridgeActive: (v) => { channelBridgeActive = v; },
     writeBridgeState,
     stopServerTyping,
     claimBridgeOwnership,
+    notifyRemoteAcquired,
     refreshBridgeOwnership,
     bindPersistedTranscriptIfAny,
     stopOwnedRuntime,
@@ -1845,14 +1934,15 @@ async function init(_sharedMcp) {
 async function start() {
   channelBridgeActive = true;
   writeBridgeState(true);
-  // Opt-in remote, single-owner, last-wins. Claim the seat immediately so a
-  // later `mixdog --remote` session overwrites us and we drop on our next
-  // refresh tick. Then connect the owned runtime and arm the ownership timer
-  // that keeps checking whether a newer session has taken over.
-  claimBridgeOwnership("remote start");
+  // Opt-in remote, single-owner, last-wins, MAKE-BEFORE-BREAK. Do NOT claim the
+  // seat up front: connect our own gateway first and claim only after it reports
+  // READY (inside startOwnedRuntime, claimAfterReady). Until then the previous
+  // owner keeps serving, so a boot causes no send/receive gap. This is also the
+  // SINGLE boot claim — the old "remote start" pre-claim + "re-activate
+  // takeover" second claim (double reconnect) is gone.
   const _bindingReadyStart = Date.now();
   try {
-    await refreshBridgeOwnership({ restoreBinding: true });
+    await startOwnedRuntime({ restoreBinding: true, claimAfterReady: true });
     bindingReadyStatus = "resolved";
     dropTrace("bindingReady.resolve", { elapsedMs: Date.now() - _bindingReadyStart, status: bindingReadyStatus });
     _bindingReadyResolve(true);
@@ -1862,13 +1952,10 @@ async function start() {
     _bindingReadyResolve(e);
   }
   // Ownership timer: keep checking whether a newer remote session has taken
-  // over (last-wins) so a superseded owner disconnects promptly.
-  if (!bridgeOwnershipTimer) {
-    bridgeOwnershipTimer = setInterval(() => {
-      refreshBridgeOwnershipSafe();
-    }, 3e3);
-    bridgeOwnershipTimer.unref?.();
-  }
+  // over (last-wins) so a superseded owner disconnects promptly. Normally
+  // already armed by startOwnedRuntime before connect(); this is the fallback
+  // for a start path that aborted pre-connect (idempotent).
+  armBridgeOwnershipTimer();
   // Hot-reload config on file change (schedules/webhooks/events).
   if (!_configWatcher) {
     try {

package/src/runtime/channels/lib/inbound-routing.mjs

@@ -28,6 +28,10 @@ function createInboundRouting({ getConfig, getInstanceId, getChannelOwnerPath })
     const now = Date.now();
     if (inboundSeen.has(key) && now - inboundSeen.get(key) < INBOUND_DEDUP_TTL) return true;
     inboundSeen.set(key, now);
+    // Cross-process marker write MUST stay synchronous: a fire-and-forget wx
+    // write opens a duplicate-delivery window where two processes both return
+    // false before either callback observes EEXIST. Single small write+stat is
+    // cheap. Only the periodic sweep is moved off the hot path (async).
     const marker = path.join(INBOUND_DEDUP_DIR, key.replace(/:/g, "_"));
     try {
       fs.writeFileSync(marker, String(now), { flag: "wx" });
@@ -39,24 +43,27 @@ function createInboundRouting({ getConfig, getInstanceId, getChannelOwnerPath })
         } catch {}
       }
     }
-    if (Math.random() < 0.1) {
-      try {
-        for (const f of fs.readdirSync(INBOUND_DEDUP_DIR)) {
-          const fp = path.join(INBOUND_DEDUP_DIR, f);
-          try {
-            if (now - fs.statSync(fp).mtimeMs > INBOUND_DEDUP_TTL) removeFileIfExists(fp);
-          } catch {
-          }
-        }
-      } catch {
-      }
-    }
+    scheduleSweep(now);
     for (const [k, t] of inboundSeen) {
       if (now - t > INBOUND_DEDUP_TTL) inboundSeen.delete(k);
     }
     return false;
   }
 
+  function scheduleSweep(now) {
+    if (Math.random() < 0.1) {
+      fs.readdir(INBOUND_DEDUP_DIR, (e, list) => {
+        if (e) return;
+        for (const f of list) {
+          const fp = path.join(INBOUND_DEDUP_DIR, f);
+          fs.stat(fp, (se, stat) => {
+            if (!se && now - stat.mtimeMs > INBOUND_DEDUP_TTL) removeFileIfExists(fp);
+          });
+        }
+      });
+    }
+  }
+
   function resolveInboundRoute(chatId, parentChatId) {
     const config = getConfig();
     // Single main channel: there is no per-channel label/mode map anymore.

package/src/runtime/channels/lib/memory-client.mjs

@@ -190,25 +190,42 @@ function atomicWrite(targetPath, contents) {
   catch (e) { try { fs.unlinkSync(tmp) } catch {}; throw e }
 }
 
+// In-memory dedupeKey(filePath) -> absolute buffer path index. Replaces the
+// per-event O(N) readdir+read+parse dedupe scan in bufferToDisk. Seeded once
+// (lazily) from disk so cross-restart dedupe (one buffered ingest per
+// transcriptPath) still holds; maintained incrementally on write. A stale
+// entry (file drained/renamed) is caught by an existsSync guard at the call
+// site, so no drain/replay format or TTL semantics change.
+const _dedupeIndex = new Map()
+let _dedupeIndexSeeded = false
+function seedDedupeIndex(kind) {
+  if (_dedupeIndexSeeded) return
+  _dedupeIndexSeeded = true
+  let existing = []
+  try { existing = fs.readdirSync(BUFFER_DIR) } catch {}
+  for (const name of existing) {
+    if (!name.startsWith(`${kind}-`) || !name.endsWith('.json')) continue
+    try {
+      const prev = JSON.parse(fs.readFileSync(path.join(BUFFER_DIR, name), 'utf8'))
+      if (prev && prev.filePath != null) _dedupeIndex.set(prev.filePath, path.join(BUFFER_DIR, name))
+    } catch {}
+  }
+}
+
 function bufferToDisk(kind, payload, { dedupeKey = null } = {}) {
   try {
     fs.mkdirSync(BUFFER_DIR, { recursive: true })
     if (dedupeKey != null) {
-      let existing = []
-      try { existing = fs.readdirSync(BUFFER_DIR) } catch {}
-      for (const name of existing) {
-        if (!name.startsWith(`${kind}-`) || !name.endsWith('.json')) continue
-        const full = path.join(BUFFER_DIR, name)
-        try {
-          const prev = JSON.parse(fs.readFileSync(full, 'utf8'))
-          if (prev && prev.filePath === dedupeKey) {
-            // Atomic overwrite (tmp+rename); preserves the original (oldest)
-            // ordering slot without exposing a half-written file to a drainer.
-            atomicWrite(full, JSON.stringify(payload, null, 2))
-            return full
-          }
-        } catch {}
+      // In-memory index (seeded once from disk) replaces the per-event O(N)
+      // readdir+read+parse scan. Overwrite the existing buffered file for this
+      // dedupeKey in place (atomic tmp+rename) to keep its oldest ordering slot.
+      seedDedupeIndex(kind)
+      const idx = _dedupeIndex.get(dedupeKey)
+      if (idx && fs.existsSync(idx)) {
+        atomicWrite(idx, JSON.stringify(payload, null, 2))
+        return idx
       }
+      if (idx) _dedupeIndex.delete(dedupeKey)
     }
     enforceBufferCap()
     const random = Math.random().toString(36).slice(2, 10)
@@ -216,6 +233,7 @@ function bufferToDisk(kind, payload, { dedupeKey = null } = {}) {
     // ordering under a lexicographic sort.
     const bufferPath = path.join(BUFFER_DIR, `${kind}-${Date.now()}-${random}.json`)
     atomicWrite(bufferPath, JSON.stringify(payload, null, 2))
+    if (dedupeKey != null) _dedupeIndex.set(dedupeKey, bufferPath)
     return bufferPath
   } catch (bufErr) {
     process.stderr.write(`[memory-client] Failed to buffer ${kind}: ${bufErr.message}\n`)

package/src/runtime/channels/lib/output-forwarder.mjs

@@ -76,6 +76,9 @@ class OutputForwarder {
   lastFileSize = 0;
   readFileSize = 0;
   watchingPath = "";
+  // Set by readNewLines when a capped tick left more complete bytes on disk,
+  // so the poll callback re-arms a flush without waiting on a fresh fs event.
+  _pendingReadMore = false;
   watcher = null;
   idleTimer = null;
   onIdleCallback = null;
@@ -96,6 +99,11 @@ class OutputForwarder {
   // into the next pending text payload so we don't grow unbounded but
   // also don't lose content.
   static SEND_QUEUE_MAX = 200;
+  // Cap the bytes read per streaming tick so a large burst (e.g. a big tool
+  // result written at once) is amortized across ticks instead of allocating a
+  // multi-MB buffer and blocking the loop on one readSync. The cursor only
+  // advances by bytes actually consumed; the remainder is picked up next tick.
+  static MAX_TICK_READ_BYTES = 2 * 1024 * 1024;
   // Persisted final-flush ledger so a forwarder restart can resume final
   // forwarding instead of giving up after 5 short retries.
   pendingFinalFlush = false;
@@ -217,12 +225,13 @@ class OutputForwarder {
     }
   }
   /** Read new bytes from transcript file since readFileSize */
-  readNewLines() {
+  readNewLines(uncapped = false) {
     if (!this.transcriptPath || !existsSync(this.transcriptPath)) {
       return { lines: [], nextFileSize: this.readFileSize };
     }
     let fd = null;
     try {
+      this._pendingReadMore = false;
       const stat = this._pendingStat ?? statSync(this.transcriptPath);
       this._pendingStat = null;
       // File shrank below our cursor: the transcript was rotated out from
@@ -237,16 +246,33 @@ class OutputForwarder {
         return { lines: [], nextFileSize: this.readFileSize };
       }
       const startOffset = this.readFileSize;
+      const available = stat.size - startOffset;
+      // Cap the per-tick read (streaming path). The final-flush path passes
+      // uncapped=true to drain the whole tail in one shot.
+      let readLen = uncapped ? available : Math.min(available, OutputForwarder.MAX_TICK_READ_BYTES);
       fd = openSync(this.transcriptPath, "r");
-      const buf = Buffer.alloc(stat.size - startOffset);
-      readSync(fd, buf, 0, buf.length, startOffset);
+      let buf = Buffer.alloc(readLen);
+      readSync(fd, buf, 0, readLen, startOffset);
       // Only advance readFileSize to the last newline boundary. A trailing
       // partial line (writer still appending) must be re-read next tick;
       // otherwise the parse-failed slice is silently consumed forever.
-      const lastNl = buf.lastIndexOf(0x0a);
+      let lastNl = buf.lastIndexOf(0x0a);
+      // The capped window split a single JSONL line larger than the cap (no
+      // newline inside it). Fall back to reading the full available range this
+      // tick so the line boundary is found — matches the pre-cap behavior and
+      // avoids getting stuck forever on an oversize line.
+      if (lastNl < 0 && readLen < available) {
+        readLen = available;
+        buf = Buffer.alloc(readLen);
+        readSync(fd, buf, 0, readLen, startOffset);
+        lastNl = buf.lastIndexOf(0x0a);
+      }
       const consumed = lastNl >= 0 ? lastNl + 1 : 0;
       const nextFileSize = startOffset + consumed;
       this.readFileSize = nextFileSize;
+      // Capped read left more complete bytes on disk: signal the poll callback
+      // to re-tick so a burst drains without waiting on another fs event.
+      this._pendingReadMore = readLen < available && nextFileSize > startOffset;
       const text = consumed > 0 ? buf.slice(0, consumed).toString("utf8") : "";
       return {
         lines: text ? text.split("\n").filter((l) => l.trim()) : [],
@@ -264,8 +290,8 @@ class OutputForwarder {
   lastToolName = "";
   lastToolFilePath = "";
   /** Extract new assistant text + tool logs from transcript since readFileSize */
-  extractNewText() {
-    const { lines: newLines, nextFileSize } = this.readNewLines();
+  extractNewText(uncapped = false) {
+    const { lines: newLines, nextFileSize } = this.readNewLines(uncapped);
     let newText = "";
     for (const l of newLines) {
       try {
@@ -635,7 +661,9 @@ ${_bt.trim()}` : _bt.trim();
           await this.cb.removeReaction(channelId, this.userMessageId, this.emoji);
         } catch {} // best-effort: remove reaction is non-critical
       }
-      const { text: newText, nextFileSize } = this.extractNewText();
+      // Final flush drains the whole remaining tail (uncapped) so a turn's
+      // last write can't be split across ticks with nothing left to re-tick it.
+      const { text: newText, nextFileSize } = this.extractNewText(true);
       if (newText) {
         const finalItem = { type: "text", text: newText, nextFileSize, bufferText: newText, channelId };
         try {
@@ -836,6 +864,9 @@ ${_bt.trim()}` : _bt.trim();
         if (hadText) {
           this.resetIdleTimer();
         }
+        // A capped tick left more complete bytes on disk: re-arm a flush so the
+        // burst drains even if the writer has gone quiet (no further fs event).
+        if (this._pendingReadMore) this.scheduleWatchFlush();
       }).catch(err => process.stderr.write(`[output-forwarder] forwardNewText rejected: ${err?.message || err}\n`));
     }, 100);
   }

package/src/runtime/channels/lib/owner-heartbeat.mjs

@@ -33,9 +33,15 @@ function createOwnerHeartbeat({
   function getBridgeOwnershipSnapshot() {
     return currentOwnerState();
   }
-  function claimBridgeOwnership(reason) {
-    refreshActiveInstance(getInstanceId());
-    logOwnership(`claimed owner (${reason})`);
+  function claimBridgeOwnership(reason, options = {}) {
+    // Returns true only when THIS instance actually holds the seat after the
+    // write. With options.timeoutMs:0 (try-once) a contended lock throws
+    // ELOCKCONTENDED — the caller catches it and treats the seat as busy.
+    const refreshOpts = Number.isFinite(options.timeoutMs) ? { timeoutMs: options.timeoutMs } : undefined;
+    const res = refreshActiveInstance(getInstanceId(), undefined, refreshOpts);
+    const claimed = res?.instanceId === getInstanceId();
+    if (claimed) logOwnership(`claimed owner (${reason})`);
+    return claimed;
   }
   function startOwnerHeartbeat() {
     if (ownerHeartbeatTimer) return;
@@ -49,7 +55,10 @@ function createOwnerHeartbeat({
         // onlyIfOwned: re-checks ownership INSIDE the file lock so a newer
         // owner claiming the seat between currentOwnerState() and the locked
         // write is never overwritten (see refreshActiveInstance CAS guard).
-        if (currentOwnerState().owned) refreshActiveInstance(getInstanceId(), undefined, { onlyIfOwned: true });
+        // Try-once (timeoutMs:0): the heartbeat must never block on the
+        // active-instance lock. On contention refreshActiveInstance throws and
+        // we simply skip this tick — the next tick catches up.
+        if (currentOwnerState().owned) refreshActiveInstance(getInstanceId(), undefined, { onlyIfOwned: true, timeoutMs: 0 });
       } catch (e) {
         process.stderr.write(`[ownership] heartbeat refresh failed: ${e instanceof Error ? e.message : String(e)}\n`);
       }

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -211,6 +211,34 @@ function writeActiveInstance(state) {
   ensureRuntimeDirs();
   writeJsonFile(ACTIVE_INSTANCE_FILE, state);
 }
+// Non-blocking ownership probe for the periodic refresh/heartbeat tick. Reads
+// active-instance WITHOUT taking the lock (never blocks). Distinguishes:
+//   'absent'  — file does not exist            → seat is claimable
+//   'stale'   — parseable but owner PID is dead → seat is claimable
+//   'live'    — parseable, owner PID alive      → seat is held (state.instanceId)
+//   'unknown' — file present but unreadable/partial (concurrent atomic rename)
+//               → INDETERMINATE; callers must treat as busy and NEVER claim.
+// This is the read-side guard for "locked/unreadable = busy/unknown owner,
+// never claimable/no-owner": a torn read during another writer's rename must
+// not be mistaken for an empty seat.
+function probeActiveOwner() {
+  try { statSync(ACTIVE_INSTANCE_FILE); } catch { return { status: 'absent', state: null }; }
+  let raw = readJsonFile(ACTIVE_INSTANCE_FILE, null);
+  if (!raw) {
+    // Transient partial content during an atomic rename — retry once.
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
+    raw = readJsonFile(ACTIVE_INSTANCE_FILE, null);
+    if (!raw) {
+      // Re-check existence to disambiguate a completed delete (absent) from a
+      // still-unreadable file (unknown/busy).
+      try { statSync(ACTIVE_INSTANCE_FILE); } catch { return { status: 'absent', state: null }; }
+      return { status: 'unknown', state: null };
+    }
+  }
+  const staleReason = activeInstanceStaleReason(raw);
+  if (staleReason) return { status: 'stale', state: raw, staleReason };
+  return { status: 'live', state: raw };
+}
 function buildActiveInstanceState(instanceId, meta) {
   const gatewayMeta = Object.fromEntries(
     Object.entries(meta || {}).filter(([k]) => k.startsWith('gateway_'))
@@ -233,6 +261,11 @@ function buildActiveInstanceState(instanceId, meta) {
 }
 function refreshActiveInstance(instanceId, meta, options) {
   ensureRuntimeDirs();
+  // Periodic refresh/heartbeat callers pass options.timeoutMs:0 (try-once) so
+  // the ownership tick never blocks on the active-instance lock — contention
+  // throws ELOCKCONTENDED, which the caller treats as "busy, skip this tick".
+  const writeOpts = { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' };
+  if (options && Number.isFinite(options.timeoutMs)) writeOpts.timeoutMs = options.timeoutMs;
   return updateJsonAtomicSync(ACTIVE_INSTANCE_FILE, (curRaw) => {
     const prevForPreserve = curRaw;
     const prev = activeInstanceStaleReason(curRaw) ? null : curRaw;
@@ -374,7 +407,7 @@ function refreshActiveInstance(instanceId, meta, options) {
       next.ui_heartbeat_at = Date.now();
     }
     return { ...preservedExtra, ...next };
-  }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' });
+  }, writeOpts);
 }
 const SERVER_PID_FILE = join(
   RUNTIME_ROOT,
@@ -525,6 +558,7 @@ export {
   notePreviousServerIfAny,
   makeInstanceId,
   readActiveInstance,
+  probeActiveOwner,
   refreshActiveInstance,
   releaseOwnedChannelLocks,
   touchUiHeartbeat,