mixdog 0.9.22 → 0.9.24

package/src/runtime/channels/lib/owned-runtime.mjs

@@ -9,8 +9,6 @@ import {
   refreshActiveInstance,
   releaseOwnedChannelLocks,
   clearActiveInstance,
-  probeActiveOwner,
-  RUNTIME_ROOT,
 } from "./runtime-paths.mjs";
 // Owned-runtime lifecycle extracted from channels/index.mjs (behavior-
 // preserving): bridge-ownership claim/refresh/loss, backend connect/disconnect,
@@ -33,13 +31,11 @@ export function createOwnedRuntime({
   instanceId,
   TERMINAL_LEAD_PID,
   forwarder,
+  sendNotifyToParent,
   scheduler,
   statusState,
   logOwnership,
   currentOwnerState,
-  claimBridgeOwnership,
-  startOwnerHeartbeat,
-  stopOwnerHeartbeat,
   bindPersistedTranscriptIfAny,
   cancelPendingTranscriptRearm,
   schedulePendingTranscriptRearm,
@@ -51,51 +47,19 @@ export function createOwnedRuntime({
   let bridgeRuntimeStarting = false;
   let _ownedRuntimeStopRequested = false;
   let bridgeOwnershipRefreshInFlight = null;
-  let bridgeOwnershipTimer = null;
   let _memoryDrainTimer = null;
-  // Event-driven ownership signal: an fs.watch on the runtime dir fires the
-  // ownership refresh the instant active-instance.json changes (a newer owner
-  // claims, or the owner releases/clears it), instead of waiting up to 3s for
-  // the poll tick. This shrinks the double-owner window on takeover (the old
-  // owner observes owned=false and tears down in ms) and signals ownership
-  // loss to contenders immediately on release. The 3s timer stays as fallback.
-  let activeInstanceWatcher = null;
-  let _activeInstanceWatchDebounce = null;
-  function armActiveInstanceWatcher() {
-    if (activeInstanceWatcher) return;
-    try {
-      activeInstanceWatcher = fs.watch(RUNTIME_ROOT, { persistent: false }, (_event, filename) => {
-        if (filename && filename !== 'active-instance.json') return;
-        // Coalesce the burst of events an atomic rename/truncate emits.
-        if (_activeInstanceWatchDebounce) return;
-        _activeInstanceWatchDebounce = setTimeout(() => {
-          _activeInstanceWatchDebounce = null;
-          refreshBridgeOwnershipSafe();
-        }, 50);
-        _activeInstanceWatchDebounce.unref?.();
-      });
-      // fs.watch emits 'error' (and an unhandled one CRASHES the worker) when
-      // the watched dir is removed or the handle is invalidated (common on
-      // Windows). Close the dead handle and fall back to the 3s poll, which is
-      // still armed — the event signal is a latency optimization, never the
-      // sole ownership mechanism.
-      activeInstanceWatcher.on('error', (err) => {
-        process.stderr.write(`[ownership] active-instance watch error, falling back to poll: ${err?.message || err}\n`);
-        clearActiveInstanceWatcher();
-      });
-      activeInstanceWatcher.unref?.();
-    } catch { activeInstanceWatcher = null; }
-  }
-  function clearActiveInstanceWatcher() {
-    if (_activeInstanceWatchDebounce) { clearTimeout(_activeInstanceWatchDebounce); _activeInstanceWatchDebounce = null; }
-    if (activeInstanceWatcher) { try { activeInstanceWatcher.close(); } catch {} activeInstanceWatcher = null; }
-  }
+  // Promise that resolves when the current startOwnedRuntime() run fully
+  // settles (bridgeRuntimeStarting -> false). reloadRuntimeConfig awaits this
+  // before issuing a restart so a backend swap that lands mid-start is not
+  // dropped by startOwnedRuntime's in-flight guard (lost-restart race).
+  let _inFlightStart = null;
+  // Daemon model: the machine-global channels daemon (singleton-owner lock in
+  // src/standalone) guarantees exactly one runtime per machine, so this process
+  // is the unconditional bridge owner. The OS seat lock is retired — no takeover
+  // handler, no vacant-reacquire poll, no cross-process ownership-loss detection.
   function clearBridgeOwnershipTimer() {
-    if (bridgeOwnershipTimer) {
-      clearInterval(bridgeOwnershipTimer);
-      bridgeOwnershipTimer = null;
-    }
-    clearActiveInstanceWatcher();
+    // No ownership timer under the daemon model; kept as a no-op so the worker
+    // teardown call site stays unchanged.
   }
 function shouldStartEventPipelineRuntime() {
   return getConfig().webhook?.enabled === true || (Array.isArray(getConfig().events?.rules) && getConfig().events.rules.length > 0);
@@ -207,6 +171,15 @@ async function startOwnedRuntime(options = {}) {
   if (!getChannelBridgeActive()) return;
   bridgeRuntimeStarting = true;
   _ownedRuntimeStopRequested = false;
+  let _settleStart;
+  _inFlightStart = new Promise((r) => { _settleStart = r; });
+  const settleInFlightStart = () => {
+    bridgeRuntimeStarting = false;
+    _inFlightStart = null;
+    const done = _settleStart;
+    _settleStart = null;
+    done?.();
+  };
   // Capture the getBackend() instance that THIS start operation will connect. A
   // reloadRuntimeConfig() hot-swap can replace the global `getBackend()` while this
   // start is still awaiting connect(); using the captured instance for both
@@ -214,79 +187,19 @@ async function startOwnedRuntime(options = {}) {
   // getBackend() WE started (not the freshly-swapped one), closing the
   // both-backends-live window.
   const startingBackend = getBackend();
-  const claimAfterReady = options.claimAfterReady === true;
-  // Auto-start intent: claim the seat ONLY if it is vacant/stale (never steal a
-  // live owner). Threaded from worker start() (MIXDOG_REMOTE_INTENT=auto).
-  const claimIfVacant = options.claimIfVacant === true;
-  // Single-holder correctness: the seat is claimed BEFORE getBackend().connect(),
-  // never after. The old make-before-break (claim-after-ready) boot left two
-  // gateways connected and contending during the multi-second connect window;
-  // claiming first makes the previous owner observe owned=false on its next
-  // tick and drain+disconnect, so at most one gateway ever serves.
-  //   - boot (claimAfterReady): last-wins acquire — this new remote session
-  //     takes the seat outright.
-  //   - refresh/owned-path: CAS onlyIfOwned — abort fast if the seat moved.
-  // backendReady=false marks the partial state until getBackend().connect() succeeds.
-  // Wrapped so ANY throw in the pre-connect claim (lock contention/error)
-  // resets bridgeRuntimeStarting — otherwise a transient lock error would
-  // leave it stuck true and permanently block every future ownership attempt.
+  // Daemon model: this runtime is the singleton bridge owner (enforced by the
+  // standalone daemon's singleton-owner lock), so there is no seat to claim and
+  // no cross-process contender to back off from. Just advertise metadata
+  // (memory_port/pg_*/channelId/... preserved inside refreshActiveInstance);
+  // active-instance.json is a pure advert. Wrapped so any throw resets
+  // bridgeRuntimeStarting.
   try {
-    if (claimAfterReady) {
-      if (claimIfVacant) {
-        // Auto-start claim-if-vacant. Probe first: a live owner other than us
-        // holds the seat -> back off SILENTLY (no claim, no acquire notify) so
-        // this session stays non-remote. Then claim atomically via the
-        // onlyIfVacant CAS (guards the probe->write TOCTOU: a live owner landing
-        // in that gap aborts the write, leaving the seat untouched).
-        const probe = probeActiveOwner();
-        if (probe.status === 'live' && probe.state?.instanceId && probe.state.instanceId !== instanceId) {
-          bridgeRuntimeStarting = false;
-          logOwnership("autostart backoff (live owner holds seat)");
-          return;
-        }
-        const casResult = refreshActiveInstance(instanceId, { backendReady: false }, { onlyIfVacant: true, timeoutMs: 0 });
-        if (casResult?.instanceId !== instanceId) {
-          bridgeRuntimeStarting = false;
-          logOwnership("autostart backoff (seat claimed by newer owner)");
-          return;
-        }
-        logOwnership("boot claim (pre-connect, claim-if-vacant)");
-      } else {
-        refreshActiveInstance(instanceId, { backendReady: false });
-        logOwnership("boot claim (pre-connect, last-wins)");
-      }
-    } else {
-      // Try-once (timeoutMs:0): a refresh-path re-acquire must never block on
-      // the active-instance lock. Contention throws → caught below and treated
-      // as "seat busy, abort this attempt"; the next 3s tick retries.
-      const casResult = refreshActiveInstance(instanceId, { backendReady: false }, { onlyIfOwned: true, timeoutMs: 0 });
-      // A successful CAS write always sets instanceId to ours; any other result
-      // (aborted write returning the stale/foreign/missing prior state) means the
-      // seat was not ours to claim — abort here rather than relying on the timer.
-      if (casResult?.instanceId !== instanceId) {
-        bridgeRuntimeStarting = false;
-        return;
-      }
-    }
-    // A newer session can claim between our write and this read. If we no longer
-    // own the seat, abort fast WITHOUT starting heartbeat/getBackend()/scheduler/
-    // webhook/ngrok — ancillary runtime starts only past a confirmed-owned claim.
-    if (!currentOwnerState().owned) {
-      bridgeRuntimeStarting = false;
-      return;
-    }
+    refreshActiveInstance(instanceId, { backendReady: false });
   } catch (e) {
-    bridgeRuntimeStarting = false;
-    process.stderr.write(`mixdog: pre-connect seat claim aborted (${e instanceof Error ? e.message : String(e)})\n`);
+    settleInFlightStart();
+    process.stderr.write(`mixdog: pre-connect metadata advert aborted (${e instanceof Error ? e.message : String(e)})\n`);
     return;
   }
-  // Arm ownership-loss detection BEFORE getBackend().connect() so a session that is
-  // superseded during the (multi-second) connect window is torn down: the 3s
-  // tick observes a newer owner and flips _ownedRuntimeStopRequested, and
-  // bailIfStopRequested below disconnects the getBackend() WE connected.
-  armBridgeOwnershipTimer();
-  // Heartbeat is ownership-gated; safe to arm now that we hold the seat.
-  startOwnerHeartbeat();
   // Periodic buffer drain: replays memory-buffer/entry-*/ingest-*.json once the
   // memory service publishes its port. Idempotent + reentrancy-guarded inside
   // drainBuffer(); unref'd so it never holds the worker open.
@@ -304,7 +217,6 @@ async function startOwnedRuntime(options = {}) {
   const bailIfStopRequested = async () => {
     if (!_ownedRuntimeStopRequested) return false;
     try { await startingBackend.disconnect(); } catch {}
-    try { stopOwnerHeartbeat(); } catch {}
     try { releaseOwnedChannelLocks(instanceId); } catch {}
     try { clearActiveInstance(instanceId); } catch {}
     setBridgeRuntimeConnected(false);
@@ -329,36 +241,13 @@ async function startOwnedRuntime(options = {}) {
       if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
       return;
     }
-    // Post-connect ownership confirm (CAS). The seat was claimed BEFORE
-    // connect; a newer session may have superseded us during the connect
-    // window (the 3s tick would already be tearing us down). onlyIfOwned:
-    // never re-steal here. If the CAS aborts we LOST the seat — disconnect the
-    // getBackend() WE connected and mark the bridge runtime not connected (do NOT
-    // clear active-instance; the newer owner holds it).
-    let ownConfirm;
-    try {
-      ownConfirm = refreshActiveInstance(instanceId, { backendReady: true }, { onlyIfOwned: true });
-    } catch { ownConfirm = null; }
-    if (ownConfirm?.instanceId !== instanceId) {
-      try { await startingBackend.disconnect(); } catch {}
-      try { stopOwnerHeartbeat(); } catch {}
-      try { releaseOwnedChannelLocks(instanceId); } catch {}
-      if (_memoryDrainTimer) { clearInterval(_memoryDrainTimer); _memoryDrainTimer = null; }
-      setBridgeRuntimeConnected(false);
-      cancelPendingTranscriptRearm();
-      try { forwarder.stopWatch(); } catch {}
-      if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
-      notifyRemoteSuperseded();
-      return;
-    }
+    // Advertise backend readiness (metadata advert).
+    try { refreshActiveInstance(instanceId, { backendReady: true }); } catch {}
     setBridgeRuntimeConnected(true);
-    // Fresh confirmed ownership — tell the parent it holds the seat so it flips
-    // remote ON. Reached ONLY on a not-connected -> connected transition (the
-    // top-of-fn early-return skips already-connected re-ticks), so this fires
-    // exactly once per acquire and covers EVERY win path, not just boot:
-    //   - explicit/auto boot claim (claimAfterReady),
-    //   - the deferred claim when a bridge timer's refreshBridgeOwnership()
-    //     claims a seat vacated by a departing owner (finding 1).
+    // Fresh confirmed connection — tell the parent to flip remote ON. Reached
+    // ONLY on a not-connected -> connected transition (the top-of-fn
+    // early-return skips already-connected re-ticks), so this fires exactly once
+    // per connect and covers EVERY start path (boot + reload restart + activate).
     // The parent's acquired handler is idempotent (no-op when already remote),
     // so notifying post-connect — never pre-connect — means a connect FAILURE
     // below leaves the parent non-remote instead of stuck remote-with-no-bridge
@@ -404,13 +293,15 @@ async function startOwnedRuntime(options = {}) {
     try { forwarder.stopWatch(); } catch {}
     if (bindPersistedTranscriptTask) await bindPersistedTranscriptTask;
     // Roll back partial owner-side state advertised before connect() ran:
-    // heartbeat and active-instance entry.
-    try { stopOwnerHeartbeat(); } catch {}
+    // disconnect the backend WE started (a post-connect startup step may have
+    // thrown while the gateway is live), then release the channel locks + clear
+    // the active-instance advert.
+    try { await startingBackend.disconnect(); } catch {}
     try { releaseOwnedChannelLocks(instanceId); } catch {}
     try { clearActiveInstance(instanceId); } catch {}
     if (_memoryDrainTimer) { clearInterval(_memoryDrainTimer); _memoryDrainTimer = null; }
   } finally {
-    bridgeRuntimeStarting = false;
+    settleInFlightStart();
   }
 }
 async function stopOwnedRuntime(reason) {
@@ -437,7 +328,6 @@ async function stopOwnedRuntime(reason) {
   // and the drain/retry timers stay live after ownership is dropped, leaking a
   // file handle + timers for the rest of the process lifetime.
   try { forwarder.stopWatch(); } catch {}
-  stopOwnerHeartbeat();
   if (_memoryDrainTimer) { clearInterval(_memoryDrainTimer); _memoryDrainTimer = null; }
   scheduler.stop();
   stopSnapshotWriter();
@@ -463,18 +353,9 @@ async function stopOwnedRuntime(reason) {
 function refreshBridgeOwnershipSafe(options = {}) {
   refreshBridgeOwnership(options).catch(err => process.stderr.write(`[channels] refreshBridgeOwnership rejected: ${err?.message || err}\n`));
 }
-// Ownership-loss / re-acquire detection timer. Armed BEFORE getBackend().connect()
-// (from startOwnedRuntime) so a session superseded during the connect window is
-// torn down promptly, and re-armed idempotently on every start path.
-function armBridgeOwnershipTimer() {
-  if (bridgeOwnershipTimer) return;
-  bridgeOwnershipTimer = setInterval(() => {
-    refreshBridgeOwnershipSafe();
-  }, 3e3);
-  bridgeOwnershipTimer.unref?.();
-  // Arm the event-driven signal alongside the poll fallback.
-  armActiveInstanceWatcher();
-}
+// Daemon model: no ownership timer or takeover handler. Kept as a no-op so the
+// worker start() call site stays unchanged.
+function armBridgeOwnershipTimer() {}
 // Guarded IPC send to the parent: no-ops when there is no channel or it is
 // already disconnected, and swallows both the synchronous throw and the async
 // error-callback path of ERR_IPC_CHANNEL_CLOSED (channel closing between the
@@ -489,20 +370,16 @@ function sendToParent(message) {
     process.stderr.write(`[channels] parent IPC send threw: ${err?.message || err}\n`);
   }
 }
-// Tell the parent session that this worker LOST the bridge seat to a newer
-// remote session (last-wins). The parent flips its remote mode OFF entirely —
-// exactly one session holds remote; losers fully release, no handover.
-function notifyRemoteSuperseded() {
-  sendToParent({ type: 'notify', method: 'notifications/mixdog/remote', params: { state: 'superseded' } });
-}
-// Symmetric to notifyRemoteSuperseded: tell the parent session this worker
-// ACQUIRED the bridge seat so it flips remote mode ON (badge/transcript writer).
-// Guarded by process.send so a manually-forked worker with no IPC parent is a
-// no-op instead of crashing. Callers fire this only on a genuine claim
-// transition (boot make-before-break, activate when not already owned) — never
-// on a heartbeat refresh — so the parent's idempotent handler sees it once.
+// Tell the parent session this worker ACQUIRED the bridge so it flips remote
+// mode ON (badge/transcript writer). Callers fire this only on a genuine
+// not-connected -> connected transition — never on a refresh — so the parent's
+// idempotent handler sees it once. Cross-process supersede is a transport-level
+// concern (daemon), not emitted here.
 function notifyRemoteAcquired() {
-  sendToParent({ type: 'notify', method: 'notifications/mixdog/remote', params: { state: 'acquired' } });
+  // Sink-aware path so the daemon replays this to every TUI (the transport
+  // sticky-caches 'acquired'). Raw sendToParent would reach only the node-IPC
+  // spawner and be ignored.
+  sendNotifyToParent('notifications/mixdog/remote', { state: 'acquired' });
 }
 async function refreshBridgeOwnership(options = {}) {
   // Coalesce concurrent callers onto the in-flight refresh so getBackend() tool
@@ -510,56 +387,15 @@ async function refreshBridgeOwnership(options = {}) {
   // instead of returning early and observing spurious auto-connect failure.
   if (bridgeOwnershipRefreshInFlight) return bridgeOwnershipRefreshInFlight;
   bridgeOwnershipRefreshInFlight = (async () => {
-    // Opt-in remote, single-owner, last-wins. Only a remote session with an
-    // active bridge participates. If this instance is the active owner (its
-    // instanceId is the one advertised in active-instance.json) it ensures
-    // the owned runtime is up. If a newer remote session has since claimed
-    // ownership (last-wins overwrite), this instance is no longer owner and
-    // quietly tears its getBackend() down on the next tick. No proxy, no steal.
+    // Daemon model: this runtime is the unconditional bridge owner, so refresh
+    // just keeps the owned runtime in sync with channelBridgeActive.
     if (!getChannelBridgeActive()) {
       if (getBridgeRuntimeConnected()) await stopOwnedRuntime("bridge inactive");
       return;
     }
-    // Non-blocking ownership probe (read-only, no lock): distinguishes a live
-    // owner from a genuinely empty/stale seat from an INDETERMINATE read (a
-    // concurrent atomic rename yields partial content). "Locked/unreadable =
-    // busy/unknown owner, never claimable" — skip the tick on 'unknown' so we
-    // never claim a seat we merely failed to read (double-owner guard).
-    const probe = probeActiveOwner();
-    if (probe.status === 'unknown') return;
-    const owned = probe.status === 'live' && probe.state?.instanceId === instanceId;
-    if (owned) {
-      // Try-once CAS refresh (timeoutMs:0): on lock contention treat as busy
-      // and skip the metadata touch — never block the tick. We still own, so
-      // ensure/keep the owned runtime up.
-      try { refreshActiveInstance(instanceId, undefined, { onlyIfOwned: true, timeoutMs: 0 }); } catch {}
-      await startOwnedRuntime(options);
-      return;
-    }
-    if (probe.status === 'live' && probe.state.instanceId && probe.state.instanceId !== instanceId) {
-      // A different live remote session holds the seat (last-wins: we lost).
-      // Go quiet (disconnect if connected) and tell the parent to drop remote
-      // mode entirely (single-holder, no handover). Notify UNCONDITIONALLY —
-      // a loser whose getBackend() never connected must still drop its Remote
-      // indicator; the parent handler is idempotent.
-      // Also cover the STARTING phase: a worker stuck in getBackend().connect() must
-      // get _ownedRuntimeStopRequested set (stopOwnedRuntime does this while
-      // bridgeRuntimeStarting) so bailIfStopRequested tears it down promptly
-      // once connect() resolves — otherwise the superseded connect lingers.
-      if (getBridgeRuntimeConnected() || bridgeRuntimeStarting) {
-        await stopOwnedRuntime("ownership lost (newer remote session)");
-      }
-      notifyRemoteSuperseded();
-      return;
-    }
-    // Empty (absent) or stale (dead owner) seat — claim it. Try-once
-    // (timeoutMs:0): a contended lock means a concurrent claimant is mid-write,
-    // so treat as busy and skip this tick rather than block.
-    let claimed = false;
-    try { claimed = claimBridgeOwnership("no active owner", { timeoutMs: 0 }); } catch { claimed = false; }
-    if (claimed) {
-      await startOwnedRuntime(options);
-    }
+    // Active -> ensure the owned runtime is up (idempotent; early-returns when
+    // already connected).
+    await startOwnedRuntime(options);
   })();
   try {
     return await bridgeOwnershipRefreshInFlight;
@@ -584,6 +420,12 @@ async function reloadRuntimeConfig() {
   if (backendChanged) {
     const shouldRestart = getBridgeRuntimeConnected() || bridgeRuntimeStarting;
     if (shouldRestart) await stopOwnedRuntime("getBackend() getConfig() changed");
+    // A start that was in flight when stopOwnedRuntime landed was signalled to
+    // bail (and disconnects the OLD backend it was connecting). Wait for it to
+    // FULLY settle before issuing the fresh start below — otherwise
+    // startOwnedRuntime's `if (bridgeRuntimeStarting) return` guard would drop
+    // the restart and the NEW backend would never connect (lost-restart race).
+    if (_inFlightStart) { try { await _inFlightStart; } catch {} }
     setBackend(nextBackend);
     // The persisted routing channelId belongs to the OLD getBackend() (e.g. a
     // Discord snowflake) and is meaningless for the new one — sending to it
@@ -603,6 +445,9 @@ async function reloadRuntimeConfig() {
         state.transcriptPath = "";
       });
     } catch {}
+    // stopOwnedRuntime above tore the owned runtime down; a same-session reload
+    // reconnects the NEW backend here. The in-flight start (if any) has already
+    // settled above, so this start is not dropped by the in-flight guard.
     if (shouldRestart) refreshBridgeOwnershipSafe({ restoreBinding: false });
   } else if (nextBackend !== previousBackend) {
     try { await nextBackend.disconnect?.(); } catch {}
@@ -622,6 +467,5 @@ async function reloadRuntimeConfig() {
     armBridgeOwnershipTimer,
     clearBridgeOwnershipTimer,
     notifyRemoteAcquired,
-    notifyRemoteSuperseded,
   };
 }

package/src/runtime/channels/lib/owner-heartbeat.mjs

@@ -1,16 +1,11 @@
-// Bridge ownership snapshot + owner heartbeat cluster. Extracted verbatim from
-// channels/index.mjs (behavior-preserving). Self-contained: owns its own
-// heartbeat timer + last-note dedup state, and depends only on the
-// active-instance read/refresh primitives + identity, threaded as injected
-// deps so the module reads live file-level references at call time.
-function createOwnerHeartbeat({
-  getInstanceId,
-  readActiveInstance,
-  refreshActiveInstance,
-  OWNER_HEARTBEAT_INTERVAL_MS = 5e3,
-}) {
+// Bridge ownership snapshot + ownership logging. Under the machine-global
+// channels daemon (singleton-owner lock in src/standalone) there is exactly one
+// runtime per machine, so this process is the unconditional bridge owner — the
+// OS seat lock and its file heartbeat / last-wins CAS are retired.
+// active-instance.json is now a pure metadata advert; it is no longer read to
+// decide ownership.
+function createOwnerHeartbeat() {
   let lastOwnershipNote = "";
-  let ownerHeartbeatTimer = null;
 
   function logOwnership(note) {
     if (lastOwnershipNote === note) return;
@@ -19,65 +14,17 @@ function createOwnerHeartbeat({
 `);
   }
   function currentOwnerState() {
-    const active = readActiveInstance();
-    return {
-      active,
-      // Strict last-wins: this process owns the bridge ONLY when active-instance
-      // names exactly this INSTANCE_ID. A newer remote session that claims the
-      // seat overwrites instanceId, so the old owner immediately reads owned=false
-      // and disconnects on its next refresh tick. No PID/terminal fallback —
-      // that used to let a co-terminal worker wrongly self-claim.
-      owned: active?.instanceId === getInstanceId()
-    };
+    // Daemon singleton: this runtime always owns the bridge.
+    return { owned: true };
   }
   function getBridgeOwnershipSnapshot() {
     return currentOwnerState();
   }
-  function claimBridgeOwnership(reason, options = {}) {
-    // Returns true only when THIS instance actually holds the seat after the
-    // write. With options.timeoutMs:0 (try-once) a contended lock throws
-    // ELOCKCONTENDED — the caller catches it and treats the seat as busy.
-    const refreshOpts = Number.isFinite(options.timeoutMs) ? { timeoutMs: options.timeoutMs } : undefined;
-    const res = refreshActiveInstance(getInstanceId(), undefined, refreshOpts);
-    const claimed = res?.instanceId === getInstanceId();
-    if (claimed) logOwnership(`claimed owner (${reason})`);
-    return claimed;
-  }
-  function startOwnerHeartbeat() {
-    if (ownerHeartbeatTimer) return;
-    ownerHeartbeatTimer = setInterval(() => {
-      try {
-        // Last-wins guard: only refresh the seat if we STILL own it. If a newer
-        // remote session claimed active-instance.json since our last tick, do
-        // NOT overwrite it back — that would re-steal ownership and cause
-        // ping-pong / double backend connections. The bridgeOwnershipTimer's
-        // refreshBridgeOwnership() will observe owned=false and disconnect us.
-        // onlyIfOwned: re-checks ownership INSIDE the file lock so a newer
-        // owner claiming the seat between currentOwnerState() and the locked
-        // write is never overwritten (see refreshActiveInstance CAS guard).
-        // Try-once (timeoutMs:0): the heartbeat must never block on the
-        // active-instance lock. On contention refreshActiveInstance throws and
-        // we simply skip this tick — the next tick catches up.
-        if (currentOwnerState().owned) refreshActiveInstance(getInstanceId(), undefined, { onlyIfOwned: true, timeoutMs: 0 });
-      } catch (e) {
-        process.stderr.write(`[ownership] heartbeat refresh failed: ${e instanceof Error ? e.message : String(e)}\n`);
-      }
-    }, OWNER_HEARTBEAT_INTERVAL_MS);
-    ownerHeartbeatTimer.unref?.();
-  }
-  function stopOwnerHeartbeat() {
-    if (!ownerHeartbeatTimer) return;
-    clearInterval(ownerHeartbeatTimer);
-    ownerHeartbeatTimer = null;
-  }
 
   return {
     logOwnership,
     currentOwnerState,
     getBridgeOwnershipSnapshot,
-    claimBridgeOwnership,
-    startOwnerHeartbeat,
-    stopOwnerHeartbeat,
   };
 }
 

package/src/runtime/channels/lib/parent-bridge.mjs

@@ -14,6 +14,16 @@ function normalizeChannelNotifyParams(method, params) {
   return params;
 }
 
+// Pluggable notify sink. Under the per-TUI fork model notifies flow over
+// node-IPC to the parent (process.send). Under the machine-global daemon there
+// is no IPC parent: the daemon entry installs a sink that routes each notify to
+// the CORRECT attached TUI over the transport's SSE fan-out (targeted, never
+// broadcast). When a sink is installed it fully replaces the process.send path.
+let _notifySink = null;
+function setChannelNotifySink(fn) {
+  _notifySink = typeof fn === 'function' ? fn : null;
+}
+
 function createParentBridge({ getInstanceId }) {
   function sendNotifyToParent(method, params) {
     // CC channel schema requires meta: Record<string,string> (channelNotification.ts).
@@ -22,6 +32,11 @@ function createParentBridge({ getInstanceId }) {
     // silent_to_agent stays boolean — an internal routing flag the daemon
     // router / agentNotify consume (=== true) before the CC zod boundary.
     const outParams = normalizeChannelNotifyParams(method, params);
+    if (_notifySink) {
+      try { _notifySink(method, outParams); }
+      catch (err) { try { process.stderr.write(`mixdog channels: notify sink failed: ${err && err.message || err}\n`); } catch {} }
+      return;
+    }
     if (!process.send) {
       try { process.stderr.write(`mixdog channels: notify dropped (no IPC channel): ${method}\n`); } catch {}
       return;
@@ -85,4 +100,4 @@ function createParentBridge({ getInstanceId }) {
   };
 }
 
-export { createParentBridge, normalizeChannelNotifyParams };
+export { createParentBridge, normalizeChannelNotifyParams, setChannelNotifySink };