mixdog 0.9.19 → 0.9.21

package/src/session-runtime/workflow-agents-api.mjs

@@ -0,0 +1,238 @@
+import { clean, hasOwn, sessionHasConversationMessages } from './session-text.mjs';
+import { isKnownProvider } from '../standalone/provider-admin.mjs';
+import {
+  normalizeWorkflowRoute,
+  upsertWorkflowPreset,
+  workflowPresetId,
+  WORKFLOW_ROUTE_SLOTS,
+  FIXED_AGENT_SLOTS,
+  agentPresetSlot,
+  normalizeAgentId,
+  normalizeWorkflowId,
+  DEFAULT_WORKFLOW_ID,
+  normalizeSearchRouteConfig,
+} from './workflow.mjs';
+import { ONBOARDING_VERSION } from './quick-search-models.mjs';
+import { findOutputStyle } from './output-styles.mjs';
+import { ensureProviderEnabled } from './config-helpers.mjs';
+import { fastCapableFor, saveModelSettings } from './model-capabilities.mjs';
+
+// Onboarding + agents/workflows/output-style selection surface. Extracted
+// verbatim from the runtime API object; stateless helpers are imported directly
+// and the runtime injects live getters/setters for the mutable config/route/
+// session locals plus the closure callbacks.
+export function createWorkflowAgentsApi(deps) {
+  const {
+    getConfig, getRoute, setRouteState, getSession, setSession, getConfigHasSecrets,
+    cfgMod, reg, mgr, STANDALONE_DATA_DIR,
+    resolveRoute, lookupModelMeta, adoptConfig, saveConfigAndAdopt, displayConfig,
+    agentRouteFromConfig, loadAgentDefinition, activeWorkflowId, listWorkflowPacks,
+    loadWorkflowPack, workflowSummary,
+    getOutputStyleStatusCached, seedOutputStyleStatusCache, scheduleOutputStyleSave,
+    recreateCurrentSessionIfReady, notifyFnForSession, invalidateContextStatusCache,
+  } = deps;
+  return {
+    async completeOnboarding(payload = {}) {
+      // Only fall back to the live runtime route when the caller actually sent a
+      // defaultRoute. The onboarding "partial save" path (Main left unset, only
+      // Search/agent picks) omits defaultRoute entirely and must NOT persist the
+      // current route as Main or recreate the session.
+      const config = getConfig();
+      const defaultRoute = hasOwn(payload, 'defaultRoute')
+        ? normalizeWorkflowRoute(payload.defaultRoute, getRoute())
+        : null;
+      const workflowInput = payload.workflowRoutes && typeof payload.workflowRoutes === 'object'
+        ? payload.workflowRoutes
+        : {};
+      const nextConfig = { ...config };
+      if (hasOwn(payload, 'defaultProvider')) {
+        const requested = clean(payload.defaultProvider);
+        if (requested) {
+          if (!isKnownProvider(requested)) throw new Error(`unknown provider "${payload.defaultProvider}"`);
+          nextConfig.defaultProvider = requested;
+        }
+      }
+      let presets = Array.isArray(nextConfig.presets) ? nextConfig.presets.slice() : [];
+      const workflowRoutes = { ...(nextConfig.workflowRoutes || {}) };
+      const touchedWorkflowSlots = new Set();
+
+      if (defaultRoute) {
+        presets = upsertWorkflowPreset(presets, 'lead', defaultRoute);
+        workflowRoutes.lead = defaultRoute;
+        nextConfig.default = workflowPresetId('lead');
+      }
+
+      for (const slot of WORKFLOW_ROUTE_SLOTS) {
+        const normalized = normalizeWorkflowRoute(workflowInput[slot]);
+        if (!normalized) continue;
+        workflowRoutes[slot] = normalized;
+        presets = upsertWorkflowPreset(presets, slot, normalized);
+        touchedWorkflowSlots.add(slot);
+      }
+
+      nextConfig.presets = presets;
+      nextConfig.workflowRoutes = workflowRoutes;
+      nextConfig.maintenance = {
+        ...(nextConfig.maintenance || {}),
+        ...(touchedWorkflowSlots.has('explorer') ? { explore: normalizeWorkflowRoute(workflowRoutes.explorer) } : {}),
+        ...(touchedWorkflowSlots.has('memory') ? { memory: normalizeWorkflowRoute(workflowRoutes.memory) } : {}),
+      };
+      const agentInput = payload.agentRoutes && typeof payload.agentRoutes === 'object'
+        ? payload.agentRoutes
+        : null;
+      if (agentInput) {
+        const nextAgents = { ...(nextConfig.agents || {}) };
+        const nextMaintenance = { ...(nextConfig.maintenance || {}) };
+        for (const agent of FIXED_AGENT_SLOTS) {
+          const routeToSave = normalizeWorkflowRoute(agentInput[agent.id]);
+          if (!routeToSave) continue;
+          nextAgents[agent.id] = routeToSave;
+          presets = upsertWorkflowPreset(presets, agentPresetSlot(agent.id), routeToSave);
+          if (agent.workflowSlot) {
+            workflowRoutes[agent.workflowSlot] = routeToSave;
+            presets = upsertWorkflowPreset(presets, agent.workflowSlot, routeToSave);
+            if (agent.id === 'explore') nextMaintenance.explore = routeToSave;
+            if (agent.id === 'maintainer') nextMaintenance.memory = routeToSave;
+          }
+        }
+        nextConfig.agents = nextAgents;
+        nextConfig.presets = presets;
+        nextConfig.workflowRoutes = workflowRoutes;
+        nextConfig.maintenance = nextMaintenance;
+      }
+      nextConfig.onboarding = {
+        ...(nextConfig.onboarding || {}),
+        completed: true,
+        version: ONBOARDING_VERSION,
+        completedAt: new Date().toISOString(),
+      };
+
+      if (payload.searchRoute) {
+        const searchToSave = normalizeSearchRouteConfig(payload.searchRoute);
+        if (searchToSave) nextConfig.searchRoute = searchToSave;
+      }
+
+      saveConfigAndAdopt(nextConfig);
+      if (defaultRoute) {
+        setRouteState(resolveRoute(getConfig(), { provider: defaultRoute.provider, model: defaultRoute.model, effort: defaultRoute.effort }));
+        const session = getSession();
+        if (session?.id) mgr.closeSession(session.id, 'cli-onboarding-complete');
+        await recreateCurrentSessionIfReady();
+      }
+      return this.getOnboardingStatus();
+    },
+    listAgents() {
+      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
+      const config = getConfig();
+      return FIXED_AGENT_SLOTS.map((agent) => ({
+        ...agent,
+        locked: true,
+        route: agentRouteFromConfig(config, agent.id, dataDir),
+        definition: loadAgentDefinition(dataDir, agent.id),
+      }));
+    },
+    listWorkflows() {
+      const currentConfig = displayConfig();
+      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
+      const active = activeWorkflowId(currentConfig);
+      return listWorkflowPacks(dataDir).map((workflow) => ({
+        id: workflow.id,
+        name: workflow.name,
+        description: workflow.description,
+        source: workflow.source,
+        active: workflow.id === active,
+        agents: workflow.agents,
+      }));
+    },
+    getOutputStyle() {
+      return getOutputStyleStatusCached();
+    },
+    listOutputStyles() {
+      return getOutputStyleStatusCached();
+    },
+    async setOutputStyle(value) {
+      const before = getOutputStyleStatusCached({ fresh: true });
+      const selected = findOutputStyle(value, before.styles);
+      if (!selected) {
+        const names = before.styles.map((style) => style.label || style.id).join(', ') || 'Default';
+        throw new Error(`output style must be one of ${names}`);
+      }
+      // Adopt in-memory immediately so same-tick readers see the new style;
+      // persist off the key-handler tick via the flushOutputStyleSave debounce.
+      const nextConfig = { ...getConfig(), outputStyle: selected.id };
+      if (nextConfig.agent && typeof nextConfig.agent === 'object' && !Array.isArray(nextConfig.agent)) {
+        const agent = { ...nextConfig.agent };
+        delete agent.outputStyle;
+        nextConfig.agent = agent;
+      }
+      adoptConfig(nextConfig);
+      scheduleOutputStyleSave(selected.id);
+      const freshStatus = { configured: selected.id, current: selected, styles: before.styles };
+      seedOutputStyleStatusCache(freshStatus);
+      const session = getSession();
+      const hasConversation = sessionHasConversationMessages(session);
+      let appliedToCurrentSession = !hasConversation;
+      if (session?.id && !hasConversation) {
+        const closedSessionId = session.id;
+        mgr.closeSession(closedSessionId, 'cli-output-style-switch');
+        setSession(null);
+        setTimeout(() => {
+          recreateCurrentSessionIfReady().catch((err) => {
+            try {
+              notifyFnForSession(closedSessionId)(
+                `Failed to start a new session after output style change: ${err?.message || err}`,
+                { level: 'error' },
+              );
+            } catch {}
+          });
+        }, 0);
+      }
+      invalidateContextStatusCache();
+      return { ...freshStatus, appliedToCurrentSession };
+    },
+    async setWorkflow(workflowId) {
+      const id = normalizeWorkflowId(workflowId, DEFAULT_WORKFLOW_ID);
+      const dataDir = cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
+      const pack = loadWorkflowPack(dataDir, id);
+      if (!pack || pack.id !== id) throw new Error(`workflow "${workflowId}" not found`);
+      const nextConfig = { ...getConfig() };
+      nextConfig.workflow = { ...(nextConfig.workflow || {}), active: id };
+      saveConfigAndAdopt(nextConfig);
+      return workflowSummary(pack);
+    },
+    async setAgentRoute(agentId, next) {
+      const id = normalizeAgentId(agentId);
+      if (!id) throw new Error(`unknown agent "${agentId}"`);
+      let selectedRoute = resolveRoute(getConfig(), { ...(next || {}) });
+      await reg.initProviders(ensureProviderEnabled(getConfig(), selectedRoute.provider));
+      const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model);
+      const fastCapable = fastCapableFor(selectedRoute.provider, modelMeta);
+      selectedRoute = { ...selectedRoute, fast: fastCapable ? selectedRoute.fast === true : false };
+      adoptConfig(saveModelSettings(cfgMod, selectedRoute, { fastCapable, baseConfig: getConfig() }), { hasSecrets: getConfigHasSecrets() });
+
+      const routeToSave = normalizeWorkflowRoute(selectedRoute);
+      if (!routeToSave) throw new Error('agent route requires provider and model');
+      const agent = FIXED_AGENT_SLOTS.find((item) => item.id === id);
+      const nextConfig = { ...getConfig() };
+      nextConfig.agents = {
+        ...(nextConfig.agents || {}),
+        [id]: routeToSave,
+      };
+      nextConfig.presets = upsertWorkflowPreset(nextConfig.presets, agentPresetSlot(id), routeToSave);
+      if (agent?.workflowSlot) {
+        nextConfig.workflowRoutes = {
+          ...(nextConfig.workflowRoutes || {}),
+          [agent.workflowSlot]: routeToSave,
+        };
+        nextConfig.presets = upsertWorkflowPreset(nextConfig.presets, agent.workflowSlot, routeToSave);
+        nextConfig.maintenance = {
+          ...(nextConfig.maintenance || {}),
+          ...(id === 'explore' ? { explore: routeToSave } : {}),
+          ...(id === 'maintainer' ? { memory: routeToSave } : {}),
+        };
+      }
+      saveConfigAndAdopt(nextConfig);
+      return routeToSave;
+    },
+  };
+}

package/src/standalone/agent-tool.mjs

@@ -99,14 +99,14 @@ const DEFAULT_SPAWN_PREP_TIMEOUT_MS = envTimeoutMs('MIXDOG_AGENT_SPAWN_PREP_TIME
 // Global spawn-start stagger: unlimited-N parallel fan-out otherwise fires all
 // first provider calls in the same instant, racing the server-side prompt-
 // cache write/propagation window. Bench (parallel-10, identical-ms starts):
-// 12.5% cache miss; 3000ms lane stagger: 4.3%; 166ms: 6.0%. 2000ms default
+// 12.5% cache miss; 3000ms lane stagger: 4.3%; 166ms: 6.0%. 1000ms default
 // picked as a low-cost middle ground. Chain (not a fixed lane count) so it
 // scales to any N: each new spawn's start is pushed to at least STAGGER_MS
 // after the previous spawn's start; sequential/non-overlapping spawns (now
 // already past the window) pay zero added latency. MIXDOG_SPAWN_STAGGER_MS=0
 // disables. Applied inside the deferred job body (see startDeferredSpawnJob)
 // so the agent tool call itself still returns task_id immediately.
-const SPAWN_STAGGER_MS = envTimeoutMs('MIXDOG_SPAWN_STAGGER_MS', 2000);
+const SPAWN_STAGGER_MS = envTimeoutMs('MIXDOG_SPAWN_STAGGER_MS', 1000);
 let lastSpawnStartAt = 0;
 async function waitForSpawnStagger() {
   if (SPAWN_STAGGER_MS <= 0) return;

package/src/standalone/channel-worker.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { startChildGuardian } from '../runtime/shared/child-guardian.mjs';
 import { appendBuffered } from '../runtime/shared/buffered-appender.mjs';
 import { scrubLoaderVars } from '../runtime/agent/orchestrator/tools/env-scrub.mjs';
+import { rotateBoundedLog, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../lib/mixdog-debug.cjs';
 
 const CHANNEL_TOOLS = new Set([
   'reply',
@@ -98,6 +99,9 @@ export function createStandaloneChannelWorker({
   let inFlightToken = 0;
   let inFlightWatchdog = null;
   const logPath = join(dataDir, 'channels-worker-standalone.log');
+  // One-shot bound at own-process boot: this runtime may never pass through
+  // the channels-worker rotation path, so cap the log writer-side.
+  rotateBoundedLog(logPath, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES);
   const useProcessWorker = process.env.MIXDOG_CHANNEL_WORKER_PROCESS !== '0';
   const clientDir = join(runtimeRoot(), 'channel-clients');
   const clientPath = join(clientDir, `${process.pid}.json`);
@@ -248,6 +252,13 @@ export function createStandaloneChannelWorker({
         MIXDOG_STANDALONE: '1',
         MIXDOG_WORKER_MODE: '1',
         MIXDOG_CLI_OWNED: '0',
+        // Preserve the real terminal-lead PID (host TUI, or an outer run-mcp
+        // supervisor if one injected MIXDOG_SUPERVISOR_PID) through the fork.
+        // Without this the worker resolves getTerminalLeadPid() to its OWN pid,
+        // so the seat's ownerLeadPid tracks the headless worker instead of the
+        // terminal that owns it — and the seat can never be evicted when the
+        // owning terminal/TUI dies while the worker stays alive.
+        MIXDOG_SUPERVISOR_PID: process.env.MIXDOG_SUPERVISOR_PID || String(process.pid),
         MIXDOG_QUIET_SESSION_LOG: process.env.MIXDOG_QUIET_SESSION_LOG ?? '1',
       },
       windowsHide: true,
@@ -412,6 +423,12 @@ export function createStandaloneChannelWorker({
 
   function uninstallParentExitHook() {
     if (!parentExitCleanup) return;
+    // Refcount-aware: never strip the shared parent-exit protection while any
+    // owned child PID is still tracked. A newer worker may have been spawned
+    // (new PID added, hook install is a no-op because it is already present)
+    // before an older worker finishes its async teardown; letting that old
+    // teardown uninstall here would leave the live newer PID unprotected.
+    if (ownedChildPids.size > 0) return;
     const unregister = parentExitCleanup;
     parentExitCleanup = null;
     unregister();
@@ -454,27 +471,70 @@ export function createStandaloneChannelWorker({
     child = null;
     if (!waitForExit) {
       rejectPending(new Error(`channels runtime shutdown requested (${reason})`));
-      if (targetPid) ownedChildPids.delete(targetPid);
+      // Fast/detached path is still TERMINAL: the caller does not block on the
+      // full teardown, but a background escalation ladder guarantees the worker
+      // dies so no zombie survives. Exit-hook + PID tracking stay installed
+      // until the process ACTUALLY exits (not on IPC ack), so a parent that
+      // force-exits mid-grace still force-kills the tree via the exit cleanup.
+      let torn = false;
+      const teardown = () => {
+        if (torn) return;
+        torn = true;
+        clearTimeout(termTimer);
+        clearTimeout(killTimer);
+        if (targetPid) ownedChildPids.delete(targetPid);
+        unrefChildHandles(target);
+        uninstallParentExitHook();
+      };
+      // Bounded grace after IPC shutdown, then SIGTERM.
+      const termTimer = setTimeout(() => {
+        try {
+          if (target.exitCode == null && !target.killed) target.kill('SIGTERM');
+        } catch {}
+      }, 1500);
+      // Hard fallback: taskkill /T /F the whole tree, then SIGKILL the handle.
+      const killTimer = setTimeout(() => {
+        try {
+          if (target.exitCode == null) forceKillTree(targetPid);
+        } catch {}
+        try {
+          if (target.exitCode == null && !target.killed) target.kill('SIGKILL');
+        } catch {}
+        teardown();
+      }, 3000);
+      // Unref so these background escalation timers never keep the event loop
+      // (or a pending /exit) alive waiting out the grace/hard-kill window.
+      termTimer.unref?.();
+      killTimer.unref?.();
+      // Actual exit (or spawn error) is the only thing that tears down tracking.
+      target.once('exit', teardown);
+      target.once('error', teardown);
       stopPromise = new Promise((resolve) => {
         let settled = false;
-        const finish = (ok) => {
+        const settle = (ok) => {
           if (settled) return;
           settled = true;
           clearTimeout(sendTimer);
           stopPromise = null;
-          unrefChildHandles(target);
-          uninstallParentExitHook();
           resolve(ok);
         };
-        const sendTimer = setTimeout(() => finish(false), 250);
+        // Resolve the caller quickly once the IPC shutdown is acked/timed out;
+        // the escalation ladder above keeps running in the background.
+        const sendTimer = setTimeout(() => settle(true), 250);
+        sendTimer.unref?.();
+        target.once('exit', () => settle(true));
         try {
           target.send?.({ type: 'shutdown', reason }, () => {
             try { target.disconnect?.(); } catch {}
-            finish(true);
+            settle(true);
           });
         } catch {
           try { target.disconnect?.(); } catch {}
-          finish(false);
+          // IPC unavailable: skip the grace window and escalate now.
+          try {
+            if (target.exitCode == null && !target.killed) target.kill('SIGTERM');
+          } catch {}
+          settle(false);
         }
       });
       return stopPromise;

package/src/standalone/folder-dialog.mjs

@@ -232,7 +232,10 @@ namespace Mixdog {
   }
 }
 '@`,
-    'Add-Type -TypeDefinition $code -ReferencedAssemblies System.Windows.Forms | Out-Null',
+    // System.Drawing is required too: GetDialogOwnerCenter uses
+    // Screen.PrimaryScreen.WorkingArea (System.Drawing.Rectangle) — without it
+    // the Add-Type compile fails and the dialog silently falls back to typing.
+    'Add-Type -TypeDefinition $code -ReferencedAssemblies System.Windows.Forms,System.Drawing | Out-Null',
     // Invisible TopMost owner anchored to the TUI console (or foreground window)
     // so IFileOpenDialog is modal, centered, and not detached on another monitor.
     '$owner = New-Object System.Windows.Forms.Form',

package/src/standalone/memory-runtime-proxy.mjs

@@ -6,6 +6,7 @@ import { tmpdir } from 'node:os';
 import { pathToFileURL } from 'node:url';
 import { claimSingletonOwner, handoffSingletonOwner, readSingletonOwner, releaseSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
 import { scrubLoaderVars } from '../runtime/agent/orchestrator/tools/env-scrub.mjs';
+import { rotateBoundedLog, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../lib/mixdog-debug.cjs';
 
 function logLine(path, line) {
   try {
@@ -56,6 +57,19 @@ function delay(ms) {
 }
 
 const TRANSIENT_MEMORY_RPC_BACKOFF_MS = 400;
+// A child that dies during startup with one of these signatures is a hard,
+// deterministic failure (bad entry path, syntax/require error) — never a
+// transient owner-lock race. Surface it fast instead of burning the ready-wait.
+function looksLikeStartupCrash(text) {
+  // Only genuinely deterministic loader/parse failures. Runtime errors like
+  // TypeError/ReferenceError can be transient init races — matching them would
+  // poison crashState and cache a hard failure for a recoverable spawn.
+  return /Cannot find module|MODULE_NOT_FOUND|ERR_MODULE_NOT_FOUND|SyntaxError/i.test(String(text || ''));
+}
+// Once a spawn crashes deterministically, short-circuit re-forks for this
+// window so a persistent crash-loop returns the cached reason immediately
+// instead of paying spawn+ready-wait on every call.
+const MEMORY_CRASH_COOLDOWN_MS = Math.max(0, Number(process.env.MIXDOG_MEMORY_CRASH_COOLDOWN_MS) || 30_000);
 
 function isConnResetLikeError(err) {
   const code = String(err?.code || '');
@@ -67,7 +81,7 @@ function isConnResetLikeError(err) {
 
 function isMemoryWorkerNotReadyError(err) {
   const msg = String(err?.message || err || '');
-  return /memory worker exited before ready|memory worker ready timeout|memory runtime did not become ready|memory worker degraded/i.test(msg);
+  return /memory worker exited before ready|memory worker ready timeout|memory runtime did not become ready|memory worker degraded|memory worker draining/i.test(msg);
 }
 
 function isTransientMemoryRpcError(err) {
@@ -141,6 +155,9 @@ export function createStandaloneMemoryRuntime({
   if (!dataDir) throw new Error('memory runtime dataDir is required');
 
   const logPath = join(dataDir, 'memory-runtime-proxy.log');
+  // One-shot bound at own-process boot: this runtime may never pass through
+  // the channels-worker rotation path, so cap the log writer-side.
+  rotateBoundedLog(logPath, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES);
   const ownerPath = join(dataDir, 'memory-runtime-owner.json');
   const singletonEnabled = process.env.MIXDOG_MEMORY_SINGLETON !== '0';
   const idleTtlMs = Math.max(0, Number(process.env.MIXDOG_MEMORY_IDLE_TTL_MS) || 10 * 60_000);
@@ -148,9 +165,68 @@ export function createStandaloneMemoryRuntime({
   let startPromise = null;
   let child = null;
   let nextCallId = 1;
+  let crashState = null; // { reason, at } — cached deterministic spawn crash
+  // Port we have registered this proxy pid with (so the shared daemon can
+  // reap itself promptly once every client deregisters). Re-registers when
+  // the daemon respawns on a new port.
+  let registeredWithPort = null;
+
+  async function ensureClientRegistered(port) {
+    // Returns the port the pending RPC should target. When an internal respawn
+    // happens the daemon moves to a fresh port, so the caller MUST use the
+    // returned value rather than the port it captured before registering.
+    if (!port || registeredWithPort === port) return port;
+    // The register RPC is provably side-effect-free from the caller's point of
+    // view: a refused/reset connection means the daemon never received it, and
+    // a draining 503 means it refused it. So a register-phase transient is ALWAYS
+    // safe to recover from by respawning a fresh daemon and retrying — even for a
+    // pending WRITE RPC. We do that respawn-and-retry HERE, before the write RPC
+    // is ever attempted, rather than leaning on the outer retry (which must not
+    // blanket-retry refused/reset on the write RPC itself).
+    let curPort = port;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await requestJson({
+          port: curPort,
+          method: 'POST',
+          path: '/client/register',
+          body: { clientPid: process.pid },
+          timeoutMs: 2000,
+        });
+        registeredWithPort = curPort;
+        return curPort;
+      } catch (err) {
+        // Benign failures (e.g. request timeout against a busy-but-live daemon)
+        // are not fatal: registration is best-effort and the idle TTL backstops
+        // a missed register. Only recover from genuine "daemon is gone/dying".
+        if (!isTransientMemoryRpcError(err)) return curPort;
+        if (attempt >= 3) throw err;
+        invalidateMemoryRuntimeAfterTransient(err);
+        await delay(TRANSIENT_MEMORY_RPC_BACKOFF_MS);
+        const started = await start();
+        curPort = started.port;
+      }
+    }
+  }
+
+  async function deregisterClient() {
+    const port = registeredWithPort || portCache;
+    registeredWithPort = null;
+    if (!port) return;
+    try {
+      await requestJson({
+        port,
+        method: 'POST',
+        path: '/client/deregister',
+        body: { clientPid: process.pid },
+        timeoutMs: 1500,
+      });
+    } catch { /* best-effort; sweep + idle TTL reap us anyway */ }
+  }
 
   function invalidateMemoryRuntimeAfterTransient(err) {
     portCache = null;
+    registeredWithPort = null;
     if (!isMemoryWorkerNotReadyError(err)) return;
     startPromise = null;
     const proc = child;
@@ -244,25 +320,61 @@ export function createStandaloneMemoryRuntime({
   async function start() {
     if (portCache) {
       const port = await findLivePort();
-      if (port) return { running: true, port, mode: 'http-proxy' };
+      if (port) { crashState = null; return { running: true, port, mode: 'http-proxy' }; }
       portCache = null;
     }
     const existing = await findLivePort();
-    if (existing) return { running: true, port: existing, mode: 'http-proxy' };
+    if (existing) { crashState = null; return { running: true, port: existing, mode: 'http-proxy' }; }
+    // Persistent crash-loop guard: no live daemon and a recent deterministic
+    // spawn crash → fail fast with the cached reason, don't re-fork per call.
+    // But a healthy singleton owner may be mid-boot and not yet advertising a
+    // port; probe/await it before trusting cached crashState so a recovering
+    // daemon isn't handed a stale hard failure.
+    if (crashState && Date.now() - crashState.at < MEMORY_CRASH_COOLDOWN_MS) {
+      if (singletonEnabled) {
+        const owner = readSingletonOwner(ownerPath);
+        if (owner.alive) {
+          const live = await waitForPort(15_000);
+          crashState = null;
+          return { running: true, port: live, mode: 'http-proxy' };
+        }
+      }
+      throw new Error(crashState.reason);
+    }
     if (startPromise) {
       const port = await startPromise;
       return { running: true, port, mode: 'http-proxy' };
     }
 
     startPromise = (async () => {
-      const claim = claimOwner();
+      let claim = claimOwner();
       if (!claim.owned) {
-        const owner = readSingletonOwner(ownerPath);
-        if (owner.alive) {
-          const live = await waitForPort(30_000);
-          return live;
+        // Another owner holds the singleton. If it is live AND serving a
+        // healthy port, use it. If it is live but NOT healthy (a daemon that is
+        // draining/shutting down never revives — see getDraining/health in
+        // lib/http-router.mjs), poll: reclaim the instant the old owner exits so
+        // a quick restart still ends with a fresh, working daemon instead of
+        // binding to the dying one and failing the pending RPC.
+        const deadline = Date.now() + 30_000;
+        while (Date.now() < deadline) {
+          const livePort = await findLivePort({ allowStarting: true });
+          if (livePort) {
+            try {
+              const health = await requestJson({ port: livePort, path: '/health', timeoutMs: 1500 });
+              if (health?.status === 'ok') return livePort;
+            } catch { /* dying/unreachable — fall through to reclaim */ }
+          }
+          const reclaim = claimOwner();
+          if (reclaim.owned) { claim = reclaim; break; }
+          await delay(150);
+        }
+        if (!claim.owned) {
+          const owner = readSingletonOwner(ownerPath);
+          if (owner.alive) throw new Error('memory runtime did not become ready');
+          releaseOwnerIfSelf();
+          claim = claimOwner();
+          if (!claim.owned) throw new Error('memory runtime did not become ready');
         }
-        releaseOwnerIfSelf();
       }
 
       const daemonEnv = { ...process.env };
@@ -309,14 +421,18 @@ export function createStandaloneMemoryRuntime({
           meta: { cwd, launcherPid: process.pid },
         });
       }
+      let stderrTail = '';
       child.stderr?.on('data', chunk => {
-        const text = String(chunk || '').trimEnd();
-        if (text) logLine(logPath, text);
+        const text = String(chunk || '');
+        const trimmed = text.trimEnd();
+        if (trimmed) logLine(logPath, trimmed);
+        stderrTail = (stderrTail + text).slice(-4000);
       });
       child.on('exit', () => {
         if (singletonEnabled && childPid) releaseSingletonOwner(ownerPath, childPid);
         if (child?.pid === childPid) child = null;
         portCache = null;
+        registeredWithPort = null;
       });
 
       const ready = new Promise((resolveReady, rejectReady) => {
@@ -332,24 +448,37 @@ export function createStandaloneMemoryRuntime({
         });
         child.once('exit', (code, signal) => {
           clearTimeout(timer);
-          rejectReady(new Error(`memory worker exited before ready (${signal || code || 'unknown'})`));
+          const tail = stderrTail.trim().split('\n').slice(-8).join('\n');
+          const detail = tail ? `: ${tail}` : '';
+          const err = new Error(`memory worker exited before ready (${signal || code || 'unknown'})${detail}`);
+          err.stderrTail = tail;
+          rejectReady(err);
         });
       });
 
       try {
         await ready;
       } catch (err) {
+        // A deterministic startup crash (bad entry path -> MODULE_NOT_FOUND,
+        // syntax/require errors) is not an owner-lock race: cache the reason
+        // for the cooldown window and fail immediately with the stderr tail
+        // instead of burning waitForPort() on a child that will never publish.
+        const msg = String(err?.message || err || '');
+        if (looksLikeStartupCrash(err?.stderrTail || msg)) {
+          crashState = { reason: msg, at: Date.now() };
+          throw err;
+        }
         // Loser fallback: two proxies (TUI host vs channels worker) can race to
         // fork; the child that lost the owner-lock exits before ready. Instead
         // of propagating "exited before ready" (which would surface as no
         // daemon), wait for the WINNER's daemon to publish a live port and use
         // it. Only rethrow if no live daemon appears in the window.
-        const msg = String(err?.message || err || '');
         const raceLoss = /exited before ready|degraded|ready timeout|owner lock|lock/i.test(msg);
         if (!raceLoss) throw err;
         return await waitForPort(30_000);
       }
       const port = await waitForPort(15_000);
+      crashState = null;
       try { child.disconnect?.(); } catch {}
       try { child.unref?.(); } catch {}
       try { child.stderr?.unref?.(); } catch {}
@@ -367,7 +496,11 @@ export function createStandaloneMemoryRuntime({
     const callId = `mem_${process.pid}_${nextCallId++}`;
     return await withTransientMemoryRpcRetry(async () => {
       await start();
-      const port = portCache || await findLivePort({ allowStarting: true });
+      let port = portCache || await findLivePort({ allowStarting: true });
+      if (!port) throw new Error('memory runtime is not available');
+      // ensureClientRegistered may respawn onto a fresh daemon/port; target the
+      // port it hands back so the RPC and registration always hit the same one.
+      port = await ensureClientRegistered(port);
       if (!port) throw new Error('memory runtime is not available');
       return await requestJson({
         port,
@@ -383,7 +516,9 @@ export function createStandaloneMemoryRuntime({
   async function buildSessionCoreMemoryPayload(sessionCwd) {
     return await withTransientMemoryRpcRetry(async () => {
       await start();
-      const port = portCache || await findLivePort({ allowStarting: true });
+      let port = portCache || await findLivePort({ allowStarting: true });
+      if (!port) throw new Error('memory runtime is not available');
+      port = await ensureClientRegistered(port);
       if (!port) throw new Error('memory runtime is not available');
       return await requestJson({
         port,
@@ -396,8 +531,10 @@ export function createStandaloneMemoryRuntime({
   }
 
   async function stop() {
-    // Detach only. The daemon owns its own idle lifetime; CLI shutdown must not
-    // tear it down out from under another tab.
+    // Deregister this client so a shared daemon can reap itself within the
+    // seconds-scale client grace once no clients remain, then detach. We never
+    // hard-kill the daemon here — another tab/session may still be using it.
+    await deregisterClient();
     try { child?.disconnect?.(); } catch {}
     try { child?.unref?.(); } catch {}
     child = null;