mixdog 0.9.22 → 0.9.24

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -38,6 +38,24 @@ function parsePositivePid(value) {
 function getTerminalLeadPid() {
   return parsePositivePid(process.env.MIXDOG_SUPERVISOR_PID) ?? process.pid;
 }
+// Daemon pointer-owner override. The machine-global daemon is spawned once, so
+// its intrinsic terminalLeadPid pins to the FIRST spawner. When the routing
+// pointer moves (a TUI claims the bridge / rebinds its transcript) the daemon
+// calls setOwnerContext({leadPid,cwd}) so active-instance.json owner fields
+// track the CURRENT bound TUI — statusline/webhook/memory resolve the pointer
+// TUI (and its session-cwd), not the spawner.
+let _ownerContextOverride = null;
+function setOwnerContext(ctx) {
+  const leadPid = parsePositivePid(ctx?.leadPid);
+  const next = leadPid ? { leadPid, cwd: ctx?.cwd ?? null } : null;
+  const changed = JSON.stringify(next) !== JSON.stringify(_ownerContextOverride);
+  _ownerContextOverride = next;
+  // Synchronously re-advertise so external readers (statusline/webhook/memory)
+  // see the new owner/cwd immediately, not on the next incidental refresh.
+  if (changed) {
+    try { refreshActiveInstance(makeInstanceId(), {}); } catch {}
+  }
+}
 function getServerPid() {
   return parsePositivePid(process.env.MIXDOG_SERVER_PID) ?? (process.env.MIXDOG_WORKER_MODE === "1" ? null : process.pid);
 }
@@ -57,7 +75,6 @@ function isPidAlive(pid) {
     return e?.code === "EPERM";
   }
 }
-const UI_HEARTBEAT_STALE_MS = 5 * 60 * 1e3;
 function activeInstanceStaleReason(state) {
   const ownerPid = getActiveOwnerPid(state);
   if (!isPidAlive(ownerPid)) return `owner PID ${ownerPid ?? "unknown"} is dead`;
@@ -67,39 +84,16 @@ function activeInstanceStaleReason(state) {
   if (workerPid && !isPidAlive(workerPid)) return `worker PID ${workerPid} is dead`;
   const serverPid = parsePositivePid(state?.server_pid);
   if (serverPid && !isPidAlive(serverPid)) return `server PID ${serverPid} is dead`;
-  // Zombie-Lead repro (2026-07-02): a Lead's owner/channels/worker/server
-  // PIDs can all still be alive (process not killed) while the TUI's render
-  // loop is dead in the water — no signal ever fires, so pid-only staleness
-  // never trips. If the TUI is heartbeating (field present), treat a stale
-  // heartbeat as stale ownership too. Backward-compat: state written by an
-  // older/non-TUI process (or before the first heartbeat tick) simply omits
-  // ui_heartbeat_at, so this branch is a no-op and pid-only judgment stands.
-  const uiHeartbeatAt = Number(state?.ui_heartbeat_at);
-  if (Number.isFinite(uiHeartbeatAt) && uiHeartbeatAt > 0) {
-    const age = Date.now() - uiHeartbeatAt;
-    if (age > UI_HEARTBEAT_STALE_MS) {
-      return `ui heartbeat stale (${Math.round(age / 1000)}s since last tick)`;
-    }
-  }
+  // NOTE: ownership is no longer decided here — the machine-global channels
+  // daemon (singleton-owner lock in src/standalone) is the authority. This
+  // PID-death check only marks a metadata advert whose owning process is gone so
+  // refreshActiveInstance can avoid preserving its owner fields. The former
+  // ui_heartbeat_at staleness branch was removed: its false-stale eviction was
+  // the Discord-flapping root cause.
   return null;
 }
-// Called from src/tui on a 30s timer while the render loop is alive. Only
-// touches ui_heartbeat_at (and updatedAt) so it never races/clobbers the
-// channels worker's own refreshActiveInstance() writes.
-function touchUiHeartbeat(instanceId) {
-  ensureRuntimeDirs();
-  try {
-    updateJsonAtomicSync(ACTIVE_INSTANCE_FILE, (curRaw) => {
-      if (!curRaw) return undefined;
-      if (instanceId && curRaw.instanceId !== instanceId) return undefined;
-      return { ...curRaw, ui_heartbeat_at: Date.now(), updatedAt: Date.now() };
-    }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate', timeoutMs: 0 });
-  } catch { /* best-effort try-once (timeoutMs:0): on lock contention we skip
-               this tick without ever blocking the render loop on Atomics.wait;
-               the next 30s tick catches up. */ }
-}
 function buildRuntimeIdentity() {
-  const terminalLeadPid = getTerminalLeadPid();
+  const terminalLeadPid = _ownerContextOverride?.leadPid ?? getTerminalLeadPid();
   const serverPid = getServerPid();
   return {
     ownerLeadPid: terminalLeadPid,
@@ -108,6 +102,7 @@ function buildRuntimeIdentity() {
     server_pid: serverPid,
     worker_pid: process.pid,
     ...process.env.MIXDOG_WORKER_MODE === "1" ? { channels_pid: process.pid } : {},
+    ...(_ownerContextOverride?.cwd ? { sessionCwd: _ownerContextOverride.cwd } : {}),
   };
 }
 function getTurnEndPath(instanceId) {
@@ -140,71 +135,11 @@ function readActiveInstance() {
     state = readJsonFile(ACTIVE_INSTANCE_FILE, null);
     if (!state) return null;
   }
-  const staleReason = activeInstanceStaleReason(state);
-  if (staleReason) {
-    // Owner is dead — but the file may carry process-independent runtime
-    // state (memory_port, pg_*) that next callers want to preserve. Wiping
-    // the whole file forced the next refresh to rebuild from {} and drop
-    // memory_port, which broke the scheduler and MCP memory lookup
-    // until the memory worker re-advertised. Instead, clear only the
-    // owner-identity fields and keep the rest as a stale-but-useful prev
-    // for the next refresh. refreshActiveInstance still treats the
-    // returned state as "no live owner" via getActiveOwnerPid downstream.
-    const {
-      pinned: _stalePinned,
-      instanceId: _staleId,
-      ownerLeadPid: _staleOwner,
-      terminalLeadPid: _staleTerm,
-      supervisor_pid: _staleSup,
-      server_pid: _staleServer,
-      worker_pid: _staleWorker,
-      channels_pid: _staleChannels,
-      supervisor_started_at: _staleStart,
-      server_started_at: _staleServerStart,
-      httpPort: _staleHttpPort,
-      backendReady: _staleBackendReady,
-      turnEndFile: _staleTurnEnd,
-      statusFile: _staleStatus,
-    } = state ?? {};
-    const ownerFieldsAlreadyEmpty = _staleId === undefined
-      && _staleOwner === undefined
-      && _staleTerm === undefined
-      && _staleSup === undefined;
-    if (!ownerFieldsAlreadyEmpty) {
-      process.stderr.write(`mixdog: stale active-instance.json (${staleReason}), clearing owner fields\n`);
-      try {
-        updateJsonAtomicSync(ACTIVE_INSTANCE_FILE, (curRaw) => {
-          if (!curRaw) return undefined;
-          const liveReason = activeInstanceStaleReason(curRaw);
-          if (!liveReason) return undefined;
-          const {
-            pinned: _stalePinned2,
-            instanceId: _staleId2,
-            ownerLeadPid: _staleOwner2,
-            terminalLeadPid: _staleTerm2,
-            supervisor_pid: _staleSup2,
-            server_pid: _staleServer2,
-            worker_pid: _staleWorker2,
-            channels_pid: _staleChannels2,
-            supervisor_started_at: _staleStart2,
-            server_started_at: _staleServerStart2,
-            httpPort: _staleHttpPort2,
-            backendReady: _staleBackendReady2,
-            turnEndFile: _staleTurnEnd2,
-            statusFile: _staleStatus2,
-            ...stableRestLocked
-          } = curRaw ?? {};
-          const ownerEmpty = _staleId2 === undefined
-            && _staleOwner2 === undefined
-            && _staleTerm2 === undefined
-            && _staleSup2 === undefined;
-          if (ownerEmpty) return undefined;
-          return { ...stableRestLocked, updatedAt: Date.now() };
-        }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' });
-      } catch {}
-    }
-    return null;
-  }
+  // Pure metadata-advert read: ownership is the OS seat lock now, so this no
+  // longer evicts a "stale" owner (the false-stale ui_heartbeat eviction was
+  // the Discord-flapping root cause). A crashed holder auto-releases the seat;
+  // its leftover advert is harmless and refreshActiveInstance's own
+  // preservation logic decides which fields to carry forward.
   return state;
 }
 function writeActiveInstance(state) {
@@ -401,22 +336,6 @@ function refreshActiveInstance(instanceId, meta, options) {
         }
       }
     }
-    // Headless worker-owned seat: THIS process is the channels worker AND no
-    // distinct terminal lead owns the seat (ownerLeadPid resolves to our own
-    // pid). A worker never runs the TUI render loop, so it owns no heartbeat —
-    // it must NOT keep refreshing a ui_heartbeat_at it does not own. An
-    // inherited value (written by a prior TUI session, carried forward in
-    // prevRest) would otherwise be perpetually renewed here and falsely mask a
-    // dead render loop, so DROP it and let pid-only judgment stand.
-    // When a distinct terminal lead owns the seat (ownerLeadPid !== our pid),
-    // this branch is a no-op: the TUI's own heartbeat is carried forward
-    // untouched, so a stale (zombie) render loop still evicts the seat even
-    // while the worker pid is alive.
-    const workerOwnsSeat = process.env.MIXDOG_WORKER_MODE === "1"
-      && identity.ownerLeadPid === process.pid;
-    if (workerOwnsSeat) {
-      delete next.ui_heartbeat_at;
-    }
     return { ...preservedExtra, ...next };
   }, writeOpts);
 }
@@ -572,6 +491,6 @@ export {
   probeActiveOwner,
   refreshActiveInstance,
   releaseOwnedChannelLocks,
-  touchUiHeartbeat,
+  setOwnerContext,
   writeServerPid
 };

package/src/runtime/channels/lib/session-discovery.mjs

@@ -44,10 +44,11 @@ function getParentPid(pid) {
       // which fires per transcript watchDebounce tick, so without these flags users
       // see a powershell.exe console window pop in/out repeatedly during
       // any chat activity — including while the config UI is loading.
+      // NO `-WindowStyle Hidden` CLI switch: windowsHide already covers it,
+      // and the token triggers Defender's PowhidSubExec false positive.
       const out2 = execFileSync("powershell.exe", [
         "-NoProfile",
         "-NonInteractive",
-        "-WindowStyle", "Hidden",
         "-Command",
         `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").ParentProcessId`
       ], {

package/src/runtime/channels/lib/tool-dispatch.mjs

@@ -23,10 +23,10 @@ function createToolDispatch({
     setChannelBridgeActive,
     writeBridgeState,
     stopServerTyping,
-    claimBridgeOwnership,
     notifyRemoteAcquired,
     refreshBridgeOwnership,
     bindPersistedTranscriptIfAny,
+    rebindCurrentTranscript,
     stopOwnedRuntime,
     reloadRuntimeConfig,
   } = lifecycle;
@@ -50,19 +50,13 @@ function createToolDispatch({
             setChannelBridgeActive(active);
             writeBridgeState(active);
             if (active) {
-              // Claim the seat only when we are NOT already the owner — a
-              // genuine /remote takeover or re-occupy after being superseded.
-              // When this session already owns the seat (e.g. the boot-time
-              // activate that fires right after start() claimed after READY),
-              // skip the redundant claim so boot performs ONE claim, not a
-              // remote-start + re-activate double claim (the latter forced a
-              // double reconnect). refreshBridgeOwnership below still re-pins
-              // the forwarder binding onto THIS session either way.
+              // Daemon model: this runtime is the unconditional bridge owner
+              // (getOwned() is always true), so activate never needs to claim a
+              // seat or pre-notify — the not-connected -> connected transition
+              // inside startOwnedRuntime fires notifyRemoteAcquired exactly once.
+              // refreshBridgeOwnership still re-pins the forwarder binding onto
+              // THIS session.
               if (getOwned?.() !== true) {
-                claimBridgeOwnership(wasActive ? "re-activate takeover" : "bridge activated");
-                // Genuine acquire transition (we were NOT the owner) — tell the
-                // parent to flip remote ON. Not fired when we already own the
-                // seat, so an idempotent re-activate never re-notifies.
                 notifyRemoteAcquired?.();
               }
               try {
@@ -104,6 +98,16 @@ function createToolDispatch({
             result = { content: [{ type: "text", text: `config reloaded — schedules, webhooks, events${agentReloadMsg} re-registered` }] };
             break;
           }
+        case "rebind_current_transcript": {
+            // Lead-pushed repoint to the transcript it just created/rebound.
+            // Best-effort + idempotent: absent channelId or path => no-op; a
+            // bind failure is swallowed by the outer try so lead paths never
+            // throw. Same binding path as the inbound steal.
+            const transcriptPath = typeof args.transcriptPath === "string" ? args.transcriptPath.trim() : "";
+            if (transcriptPath) await rebindCurrentTranscript(transcriptPath);
+            result = { content: [{ type: "text", text: `transcript rebind ${transcriptPath ? "pushed" : "skipped (no path)"}` }] };
+            break;
+        }
         // memory — handled by memory-service.mjs MCP
         default:
             result = {
@@ -132,7 +136,10 @@ function createToolDispatch({
     // Debounce: only forward when ≥250 ms have elapsed since the last forward,
     // to avoid one HTTP roundtrip per tool call on rapid-fire sequences.
     const now = Date.now();
-    if (now - _lastForwardMs >= 250) {
+    // The transcript rebind op must repoint the forwarder BEFORE any flush;
+    // running the pre-flush first would send stale-transcript text ahead of the
+    // rebind. Skip the pre-flush for it so rebinding always precedes forwarding.
+    if (toolName !== 'rebind_current_transcript' && now - _lastForwardMs >= 250) {
       _lastForwardMs = now;
       await forwarder.forwardNewText();
     }
@@ -140,6 +147,7 @@ function createToolDispatch({
       // Remote-owner startup: ensure this owner's backend is connected.
       for (let i = 0; i < 2 && !getBridgeRuntimeConnected(); i++) {
         try {
+          // Auto-connect this owner's backend (daemon singleton — no seat claim).
           await refreshBridgeOwnership();
         } catch {
         }

package/src/runtime/channels/lib/tool-format.mjs

@@ -5,6 +5,7 @@ import {
   isExplorerSurface,
   isMemorySurface,
   normalizeToolName,
+  stripToolPrefix,
 } from "../../shared/tool-surface.mjs";
 
 // Texts that should never be forwarded to Discord (Claude's internal status lines)
@@ -23,7 +24,11 @@ const HIDDEN_TOOLS = /* @__PURE__ */ new Set([
   "TaskCreate",
   "TaskUpdate",
   "TaskList",
-  "TaskGet"
+  "TaskGet",
+  // Channel-plumbing tools — internal bridge/transcript wiring; never
+  // meaningful to channel readers ("Rebind Current Transcript", etc).
+  "activate_channel_bridge",
+  "rebind_current_transcript"
 ]);
 
 /** Check if a tool name is recall_memory */
@@ -40,7 +45,7 @@ function isMemoryFile(filePath) {
 }
 /** Check if a tool should be hidden */
 function isHidden(name) {
-  if (HIDDEN_TOOLS.has(name)) return true;
+  if (HIDDEN_TOOLS.has(name) || HIDDEN_TOOLS.has(stripToolPrefix(name))) return true;
   if (formatToolSurface(name, {}).label === "Memory") return false;
   if (name === "reply" || name === "fetch") return true;
   return false;

package/src/runtime/channels/lib/worker-main.mjs

@@ -324,14 +324,7 @@ const {
   logOwnership,
   currentOwnerState,
   getBridgeOwnershipSnapshot,
-  claimBridgeOwnership,
-  startOwnerHeartbeat,
-  stopOwnerHeartbeat,
-} = createOwnerHeartbeat({
-  getInstanceId: () => INSTANCE_ID,
-  readActiveInstance,
-  refreshActiveInstance,
-});
+} = createOwnerHeartbeat();
 // ── Owned-runtime lifecycle ─────────────────────────────────────────────────
 // Extracted -> lib/owned-runtime.mjs. Owns its own start/stop/refresh in-flight
 // flags + ownership timer + memory-drain timer; shares config/backend/
@@ -360,13 +353,11 @@ const {
   instanceId: INSTANCE_ID,
   TERMINAL_LEAD_PID,
   forwarder,
+  sendNotifyToParent,
   scheduler,
   statusState,
   logOwnership,
   currentOwnerState,
-  claimBridgeOwnership,
-  startOwnerHeartbeat,
-  stopOwnerHeartbeat,
   bindPersistedTranscriptIfAny,
   cancelPendingTranscriptRearm,
   schedulePendingTranscriptRearm,
@@ -634,10 +625,38 @@ const {
     setChannelBridgeActive: (v) => { channelBridgeActive = v; },
     writeBridgeState,
     stopServerTyping,
-    claimBridgeOwnership,
     notifyRemoteAcquired,
     refreshBridgeOwnership,
     bindPersistedTranscriptIfAny,
+    // Lead-pushed repoint: bind the exact transcript the lead just created
+    // (auto-acquire / newSession / resume / clear) instead of waiting for the
+    // next inbound parent-chain steal. Idempotent + best-effort: same binding
+    // path as the inbound steal (rebindTranscriptContext -> applyTranscriptBinding).
+    rebindCurrentTranscript: async (transcriptPath) => {
+      const cleanPath = typeof transcriptPath === "string" ? transcriptPath.trim() : "";
+      if (!cleanPath) return;
+      const channelId = statusState.read().channelId || config.channelId;
+      if (!channelId) return;
+      // Fail-closed: a malformed / not-yet-on-disk path must NEVER fall through
+      // to rebindTranscriptContext's discovery loop (which would mutate the
+      // binding onto a different session). Only an existing regular file binds;
+      // otherwise log + return so the current binding is left untouched.
+      let exists = false;
+      try { exists = fs.statSync(cleanPath).isFile(); } catch { exists = false; }
+      if (!exists) {
+        process.stderr.write(`mixdog: rebind_current_transcript: ignoring non-existent path ${cleanPath}\n`);
+        return;
+      }
+      // Idempotent: already bound to this exact transcript => no-op. In
+      // particular do NOT re-run recoverUnsyncedTail, which is only meaningful
+      // when the binding actually changes.
+      if (forwarder.hasBinding() && sameResolvedPath(forwarder.transcriptPath, cleanPath)) return;
+      // Binding changed: same path as the inbound steal's applyTranscriptBinding.
+      applyTranscriptBinding(channelId, cleanPath, {
+        persistStatus: true,
+        recoverUnsyncedTail: true,
+      });
+    },
     stopOwnedRuntime,
     reloadRuntimeConfig,
   },
@@ -679,21 +698,13 @@ async function init(_sharedMcp) {
 async function start() {
   channelBridgeActive = true;
   writeBridgeState(true);
-  // Opt-in remote, single-owner, last-wins, MAKE-BEFORE-BREAK. Do NOT claim the
-  // seat up front: connect our own gateway first and claim only after it reports
-  // READY (inside startOwnedRuntime, claimAfterReady). Until then the previous
-  // owner keeps serving, so a boot causes no send/receive gap. This is also the
-  // SINGLE boot claim — the old "remote start" pre-claim + "re-activate
-  // takeover" second claim (double reconnect) is gone.
+  // Daemon model: this runtime is the machine-global singleton bridge owner
+  // (enforced by the standalone daemon's singleton-owner lock), so there is no
+  // seat to claim and no contender to make-before-break against. Just connect
+  // the owned runtime and bind the persisted transcript.
   const _bindingReadyStart = Date.now();
   try {
-    // Boot claim intent (published by the parent via env before this fork):
-    //   explicit (/remote, --remote) -> last-wins force-takeover.
-    //   auto (config/delayed autoStart) -> claim-if-vacant: take the seat only
-    //   when no live owner holds it, otherwise back off silently (no claim, no
-    //   acquire notify) so a live owner is never stolen.
-    const autoStartClaim = process.env.MIXDOG_REMOTE_INTENT === 'auto';
-    await startOwnedRuntime({ restoreBinding: true, claimAfterReady: true, claimIfVacant: autoStartClaim });
+    await startOwnedRuntime({ restoreBinding: true });
     bindingReadyStatus = "resolved";
     dropTrace("bindingReady.resolve", { elapsedMs: Date.now() - _bindingReadyStart, status: bindingReadyStatus });
     _bindingReadyResolve(true);
@@ -702,10 +713,8 @@ async function start() {
     dropTrace("bindingReady.reject", { elapsedMs: Date.now() - _bindingReadyStart, status: bindingReadyStatus, err: String(e) });
     _bindingReadyResolve(e);
   }
-  // Ownership timer: keep checking whether a newer remote session has taken
-  // over (last-wins) so a superseded owner disconnects promptly. Normally
-  // already armed by startOwnedRuntime before connect(); this is the fallback
-  // for a start path that aborted pre-connect (idempotent).
+  // No-op under the daemon model (kept for call-site stability): there is no
+  // ownership timer — the singleton daemon guarantees exactly one owner.
   armBridgeOwnershipTimer();
   // Hot-reload config on file change (schedules/webhooks/events).
   if (!_configWatcher) {
@@ -745,7 +754,10 @@ async function stop() {
   }
 }
 // ── IPC worker mode ──────────────────────────────────────────────
-if (_isWorkerMode && process.send) {
+// Skipped under the machine-global daemon (MIXDOG_CHANNEL_DAEMON=1): the
+// daemon entry (src/standalone/channel-daemon.mjs) drives start()/stop() and
+// its own HTTP+SSE transport instead of the parent node-IPC call/notify loop.
+if (_isWorkerMode && process.send && process.env.MIXDOG_CHANNEL_DAEMON !== '1') {
   runWorkerIpc({
     start,
     stop,

package/src/runtime/memory/index.mjs

@@ -134,6 +134,10 @@ const RUNTIME_ROOT = process.env.MIXDOG_RUNTIME_ROOT
 
 let _periodicAdvertiseInstalled = false
 let _periodicAdvertiseTimer = null
+// Single module-level advertise retry chain. A newer advertiseMemoryPort call
+// cancels the older chain so a delayed retry never replays a stale boundPort.
+let _advertiseRetryTimer = null
+let _advertiseGeneration = 0
 // Track the most recently advertised port so the periodic tick re-reads it
 // every interval. Without this the setInterval closure binds the FIRST port
 // (the upstream we proxied to) and keeps re-advertising the dead upstream
@@ -248,7 +252,14 @@ function deregisterClient(clientPid) {
 
 function advertiseMemoryPort(boundPort, attempt = 0) {
   if (!Number.isFinite(boundPort) || boundPort <= 0) return
-  _currentAdvertisedPort = boundPort
+  // A fresh top-level advertise (attempt 0) supersedes any pending retry chain:
+  // last write wins, so a delayed retry never clobbers a newer boundPort.
+  if (attempt === 0) {
+    _currentAdvertisedPort = boundPort
+    _advertiseGeneration++
+    if (_advertiseRetryTimer) { try { clearTimeout(_advertiseRetryTimer) } catch {} ; _advertiseRetryTimer = null }
+  }
+  const generation = _advertiseGeneration
   if (!_periodicAdvertiseInstalled) {
     _periodicAdvertiseInstalled = true
     _periodicAdvertiseTimer = setInterval(() => {
@@ -284,12 +295,24 @@ function advertiseMemoryPort(boundPort, attempt = 0) {
         updatedAt: Date.now(),
       }
       return next
-    }, { compact: true, fsyncDir: true, renameFallback: 'truncate' })
+    }, { compact: true, fsyncDir: true, renameFallback: 'truncate', timeoutMs: 1000 })
+    if (generation === _advertiseGeneration) _advertiseRetryTimer = null
   } catch (e) {
-    const transient = e?.code === 'EPERM' || e?.code === 'EBUSY' || e?.code === 'EACCES'
-    if (transient && attempt < 3) {
-      const retryTimer = setTimeout(() => advertiseMemoryPort(boundPort, attempt + 1), 50 * (attempt + 1))
-      retryTimer.unref?.()
+    // Boot path must not serially block on the default 8s lock wait: use a short
+    // lock timeout and treat lock contention/timeout as transient so pg_port /
+    // memory_port still eventually publish via unref'd, backed-off bg retries.
+    const transient =
+      e?.code === 'EPERM' || e?.code === 'EBUSY' || e?.code === 'EACCES' ||
+      e?.code === 'ELOCKTIMEOUT' || e?.code === 'ELOCKCONTENDED'
+    if (transient && attempt < 5 && generation === _advertiseGeneration) {
+      const delay = Math.min(2000, 50 * 2 ** attempt)
+      // Fire-time generation re-check: even if clearTimeout was missed, a
+      // retry from a superseded chain must never republish an old boundPort.
+      _advertiseRetryTimer = setTimeout(() => {
+        if (generation !== _advertiseGeneration) return
+        advertiseMemoryPort(boundPort, attempt + 1)
+      }, delay)
+      _advertiseRetryTimer.unref?.()
       return
     }
     __mixdogMemoryLog(`[memory-service] active-instance memory_port advertise failed: ${e?.message || e}\n`)
@@ -454,10 +477,23 @@ async function _initStore() {
   if (dimsResolved) {
     primeEmbeddingDims(dimsResolved)
     assertSecondaryPgAttachable()
+    // Start embedding + kiwi warmup NOW so they run on their worker threads
+    // during the PG ensure I/O-wait window below: openDatabase spawns/awaits
+    // Postgres (I/O-bound, not CPU), so overlapping warmup there is safe and
+    // lands a cold boot's first recall dense instead of lexical-fallback.
+    // Both are fire-and-forget; the boot-complete fireDeferred/initKoMorph edge
+    // stays an idempotent no-op fallback. schedule() respects canStart
+    // (secondary/env-disabled skip → fireDeferred no-op); kiwi skips secondary.
+    _embeddingWarmup.schedule(EMBEDDING_META_PATH, metaKey)
+    memoryProfile('embedding:warmup:fire')
+    _embeddingWarmup.fireDeferred()
+    if (!memorySecondaryMode()) {
+      memoryProfile('ko-morph:warmup:fire')
+      initKoMorph(DATA_DIR, __mixdogMemoryLog).catch(() => {})
+    }
     const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
     memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
-    _embeddingWarmup.schedule(EMBEDDING_META_PATH, metaKey)
   } else {
     if (!embeddingWarmupCanStart()) {
       throw new Error('memory-service: embedding dims unavailable while warmup is disabled')
@@ -469,6 +505,12 @@ async function _initStore() {
     memoryProfile('embedding:cold-warmup:done', { ms: (performance.now() - warmupStartedAt).toFixed(1) })
     dimsResolved = Number(getEmbeddingDims())
     assertSecondaryPgAttachable()
+    // Embedding is already warm (awaited above); still fire kiwi during the PG
+    // ensure I/O-wait so the first recall's FTS path is morph-aware too.
+    if (!memorySecondaryMode()) {
+      memoryProfile('ko-morph:warmup:fire')
+      initKoMorph(DATA_DIR, __mixdogMemoryLog).catch(() => {})
+    }
     const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
     memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
@@ -798,6 +840,11 @@ export async function stop() {
       try { clearInterval(_periodicAdvertiseTimer) } catch {}
       _periodicAdvertiseTimer = null
     }
+    if (_advertiseRetryTimer) {
+      try { clearTimeout(_advertiseRetryTimer) } catch {}
+      _advertiseRetryTimer = null
+    }
+    _advertiseGeneration++
     _periodicAdvertiseInstalled = false
     _currentAdvertisedPort = null
     _embeddingWarmup.reset()

package/src/runtime/memory/lib/embedding-warmup.mjs

@@ -16,11 +16,16 @@ export function createEmbeddingWarmup({
   log = () => {},
 }) {
   let _pending = null
+  // Fired latch: an init() retry after the early (PG-wait-edge) fire must not
+  // re-schedule and run the warmup twice (double ONNX session create +
+  // double embedding-meta persist). reset() clears it for true re-inits.
+  let _fired = false
 
   // Queue the warmup; fireDeferred() runs it once boot completes. Re-queuing
   // overwrites any prior pending closure (matches the original single-slot
   // module var). MIXDOG_EMBED_WARMUP=0 (checked via canStart) disables it.
   function schedule(metaPath, metaKey) {
+    if (_fired) return
     if (!canStart()) {
       // Silent skip here previously made "warmup never ran" boots
       // indistinguishable from failed warmups. One line, boot-edge only.
@@ -50,11 +55,13 @@ export function createEmbeddingWarmup({
     const fire = _pending
     if (!fire) return
     _pending = null
+    _fired = true
     fire()
   }
 
   function reset() {
     _pending = null
+    _fired = false
   }
 
   return { schedule, fireDeferred, reset }