moshcode 0.39.0 → 0.41.0

package/README.md

@@ -43,11 +43,14 @@ or miss one that does. A test fails the build when it drifts.
 | `moshcode login` | account | authenticate with app.moshcode.sh |
 | `moshcode whoami` | account | show the logged-in account |
 | `moshcode logout` | account | clear the logged-in account |
+| `moshcode save` | account | save this machine's pit settings to your account |
+| `moshcode load` | account | bring your saved pit settings onto this machine |
 | `moshcode console` | account | serve or connect to the browser terminal |
 | `moshcode dns` | hosting | resolve Moshpit names on this machine |
 | `moshcode doh` | hosting | run the DNS-over-HTTPS resolver |
 | `moshcode site` <br>`serve` | hosting | install web-server config for a Moshpit name |
 | `moshcode template` <br>`templates` | hosting | scaffold a stack for a Moshpit-hosted service |
+| `moshcode games` <br>`game` `arcade` | arcade | the moshcode arcade — six games, no menus |
 | `moshcode pwd` <br>`where` | system | show the current directory and git context |
 | `moshcode engines` | engines | list engines and installation status |
 | `moshcode tools` | tools | list workflow tools and installation status |
@@ -579,6 +582,93 @@ event, and publishes it to the displayed relays. Both flows leave the final
 confirmation in the browser. If the pit is remote or headless, `/post` prints
 the composer URL instead.
 
+## The arcade (`/games`)
+
+Six games, in the pit or straight from a shell. There are no menus, no options
+screens and no difficulty prompts — `/games tetris` is already playing.
+
+```sh
+moshcode games                # the cabinet (pit: /games)
+moshcode games tetris         # play one   (pit: /games tetris)
+moshcode games --json         # the roster, for a machine
+```
+
+```
+  TETRIS       score 1200 · lines 12
+  ┌────────────────────────────────┐
+  │ · · · · ████· · · ·   NEXT     │
+  │ · · · · ████· · · ·            │
+  │ · · · · · · · · · ·   ████████ │
+  │ · · · · · · · · · ·            │
+  │ · · · ████· · · · ·   LVL 2    │
+  │ ████████████· ██████           │
+  └────────────────────────────────┘
+  ← → move · ↑ rotate · ↓ drop one · space slam · q quit
+```
+
+| game | |
+|---|---|
+| `tetris` | stack the bricks, clear the lines, outrun gravity |
+| `snake` | eat, grow, and try not to eat yourself |
+| `pacman` | eat the dots, dodge the ghosts, `✳` makes them edible |
+| `tictactoe` | three in a row against an opponent that cannot be beaten |
+| `chess` | full rules — castling, en passant, promotion — and it plays back |
+| `hangman` | six wrong letters and you are done for |
+
+Every one of them works the same way: arrows move, `q` quits, `r` starts
+another, and the controls are written along the bottom of the game itself. Each
+draws in place rather than on the alternate screen, so the board you finished on
+stays in your scrollback.
+
+Playing needs a real terminal, because they read single keypresses — `moshcode
+games` on its own lists them anywhere, including a pipe.
+
+## Settings sync (`/save` and `/load`)
+
+Your pit becomes yours by accretion — a dozen aliases, herd rules you tuned until
+the roster stopped lying to you. All of it lives in `~/.moshcode` on one machine,
+which is why every new laptop, container and droplet used to feel like someone
+else's prompt.
+
+`/save` pushes that configuration to your `app.moshcode.sh` account. `/load`
+brings it down onto any machine you have run `/login` on.
+
+```sh
+moshcode save                 # push this machine's settings (pit: /save)
+moshcode save --dry-run       # what would go up, and stop
+
+# on the new box
+moshcode login
+moshcode load                 # pull them down (pit: /load)
+moshcode load --dry-run       # the per-file plan, changing nothing
+```
+
+What syncs is an allowlist, not a directory walk:
+
+| file | what it is |
+|---|---|
+| `~/.moshcode/aliases.json` | your pit aliases (`/alias`) |
+| `~/.moshcode/herd/rules.json` | herd state-detection overrides |
+
+What never syncs, by name: `credentials.json` (the account token this very
+feature authenticates with), `herd/sessions.json` (live state pinned to one tmux
+server), `sync.json`, and the `pkg/` binary cache. Engine configuration
+(`~/.claude.json` and friends) is deliberately left alone — those files carry
+provider API keys.
+
+Nothing is overwritten quietly:
+
+- Each save is a numbered **revision**. `/save` sends the revision it last agreed
+  on, and the app refuses the write if another machine has saved since — you get
+  told, with `/load` and `/save --force` as the two ways out.
+- `/load` refuses to replace a settings file you edited since this machine last
+  synced, and names it. `--force` overrides.
+- The last ten revisions are kept. See them, and which machine each came from, at
+  [app.moshcode.sh/settings/sync](https://app.moshcode.sh/settings/sync) — where
+  you can also promote an older revision or delete the lot.
+
+Both verbs take `--json`, so a provisioning script can act on the result.
+
 ## Browser terminal (`moshcode console`)
 
 A real terminal in the browser — arrow keys, history, full-screen TUIs — because

package/bin/moshcode.mjs

@@ -22,10 +22,12 @@ import { describeUninstall, uninstallPlan } from "../src/uninstall.mjs";
 import { mcpCommand, pluginCommand, skillCommand } from "../src/integrations.mjs";
 import { stocksCommand } from "../src/advisor.mjs";
 import { cryptoCommand } from "../src/crypto.mjs";
+import { gamesCommand } from "../src/games.mjs";
 import { canOpenBrowser, openBrowser } from "../src/open-url.mjs";
 import { locate, tilde } from "../src/pwd.mjs";
 import { createPrd, listPrds, authoringPrompt } from "../src/prd.mjs";
 import { loginAuto, whoami, logout } from "../src/auth.mjs";
+import { loadCommand, saveCommand } from "../src/settings-sync.mjs";
 import { tui } from "../src/tui.mjs";
 import { consoleCommand } from "../src/console.mjs";
 import { herdCommand, herdStart, splitDetachArgs } from "../src/herd-cli.mjs";
@@ -397,6 +399,11 @@ async function main() {
     if (code) process.exitCode = code;
     return;
   }
+  if (cmd === "games" || cmd === "game" || cmd === "arcade") {
+    const code = await gamesCommand(rest);
+    if (code) process.exitCode = code;
+    return;
+  }
   if (cmd === "console") {
     const code = await consoleCommand(rest);
     if (code) process.exitCode = code;
@@ -609,6 +616,8 @@ async function main() {
     return;
   }
   if (cmd === "logout") { logout(); return; }
+  if (cmd === "save") { process.exitCode = await saveCommand(rest); return; }
+  if (cmd === "load") { process.exitCode = await loadCommand(rest); return; }
   if (cmd === "run") {
     let max = 3, dryRun = false;
     let optionsEnded = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "type": "module",
   "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {

package/prd/0010-cloud-settings-sync.md

@@ -0,0 +1,132 @@
+---
+openprd: "0.2"
+id: "0010"
+title: "Sync the pit's settings to your moshcode.sh account"
+status: Draft
+authors:
+  - anthony@profullstack.com
+created: 2026-08-11
+updated: 2026-08-11
+repo: https://github.com/moshcoder/moshcode
+discussion:
+implementation: src/settings-sync.mjs · apps/pwa/src/routes/settings-sync.mjs
+tags: account, settings, sync
+supersedes:
+superseded-by:
+---
+
+## Problem
+
+A pit becomes yours by accretion. You add `/alias set gs "git status"`, then a
+dozen more; you tune the herd's rules until it stops calling a working agent
+blocked. None of it is in a repo, none of it is in a dotfile anyone syncs, and
+all of it lives in `~/.moshcode` on exactly one machine.
+
+So the second machine is a stranger. A new laptop, a fresh container, a droplet
+you SSH into to babysit an agent, a reinstall after a disk swap — each one starts
+from nothing, and the muscle memory built at the first prompt does not work at
+the second. People already log in to `app.moshcode.sh` (`/login`) for approvals,
+notifications and the session mirror, so the account that could hold this
+configuration is already there and already paired with every machine.
+
+## Goals
+
+- Moving to a new machine costs `/login` and `/load`, not an afternoon of
+  remembering what you had.
+- A person can see what is stored on their account, and delete it, from the web.
+- Nobody is ever surprised by a settings overwrite — not from another machine,
+  and not over their own uncommitted edits.
+- No credential, key or token is ever part of what syncs, and that fact is
+  enforced by a test rather than by care.
+
+## Non-Goals
+
+- Continuous or background sync. Settings are edited by a person at a moment they
+  can name; a daemon that pushes silently is a daemon that overwrites silently.
+- Syncing engine configuration (`~/.claude.json`, `~/.codex`, MCP registrations).
+  Those files carry provider API keys and are owned by other tools' schemas.
+- Syncing machine state: live herd sessions, the package cache, shell history.
+  None of it means anything on a different box.
+- Merging. Two divergent settings files are resolved by a person choosing one,
+  not by a three-way merge of someone's aliases.
+
+## Users
+
+- **The multi-machine moshcoder** — laptop, desktop, a dev box, and a container
+  per project. Wants the same prompt everywhere.
+- **The reinstaller** — new OS, same person. Wants their aliases back.
+- **The team lead** — one account, several machines, and a strong preference for
+  never explaining to a colleague why their aliases disappeared.
+
+## Requirements
+
+- R1 [P0] `/save` (and `moshcode save`) uploads this machine's pit settings to the
+  logged-in account. `/load` (`moshcode load`) brings them back down.
+- R2 [P0] What syncs is an allowlist, not a directory walk: `aliases.json` and
+  `herd/rules.json` today. `credentials.json`, `herd/sessions.json`, `sync.json`
+  and `pkg/` are named as never-synced and asserted in tests.
+- R3 [P0] Each save is a numbered revision. `/save` sends the revision it last
+  agreed on and the app refuses the write if the account has moved past it, so
+  two machines cannot silently erase one another.
+- R4 [P0] `/load` refuses to overwrite a settings file that changed locally since
+  the last sync, and names the file. `--force` overrides; `--dry-run` shows the
+  per-file plan and writes nothing.
+- R5 [P0] Every path in a downloaded snapshot is re-checked against the allowlist
+  before anything is written. A snapshot is data from the network, and an
+  unchecked path in it makes `/load` a remote write primitive.
+- R6 [P1] The app keeps the last ten revisions, shows them at
+  `/settings/sync` with the machine and time each came from, and can promote an
+  older one to current.
+- R7 [P1] `--json` on both verbs, so a provisioning script can act on the result.
+- R8 [P1] A snapshot records which engines and tools the source machine had
+  installed. `/load` names the missing ones as a suggestion; it never installs.
+- R9 [P2] Not logged in, session expired, nothing saved yet, conflict: each is a
+  sentence naming the command that resolves it (`/login`, `/save`, `/load`,
+  `--force`).
+
+## UX Notes
+
+```
+mosh ▸ /save
+  ✓ saved 2 files to you@example.com (revision 3)
+     aliases.json  pit aliases
+     herd/rules.json  herd state rules
+     on another machine: `/login` then `/load`
+
+mosh ▸ /load                       # on the new box
+  loaded revision 3 from dev — 2 files written
+     added    aliases.json
+     added    herd/rules.json
+     that machine also had codex, gh — `/install <name>` to match it
+
+mosh ▸ /load                       # after editing aliases locally
+  1 local file changed since this machine last synced:
+     aliases.json
+     `/save` to keep them, `/load --force` to replace them, `/load --dry-run` to see the difference
+```
+
+The pit never blocks on this: both verbs are one request and some printing, so
+readline keeps the prompt. `~/.moshcode/sync.json` remembers the revision and a
+per-file digest — that digest is what separates "someone else saved" from "you
+edited this five minutes ago", which want opposite answers.
+
+## Success Metrics
+
+- A fresh machine reaches a familiar prompt in two commands (`/login`, `/load`).
+- Zero settings-loss reports: every destructive path is either refused or
+  recoverable from `/settings/sync`.
+- No credential ever appears in a stored snapshot (asserted, not audited).
+
+## Risks & Open Questions
+
+- **Scope creep into secrets.** The most-requested next file will be an engine
+  config that holds an API key. Holding the line — settings, never credentials —
+  is what keeps `/load` safe to run on a machine you share.
+- **Ten revisions is a guess.** Cheap to raise; it exists so a bad `/save` from
+  the wrong machine is recoverable at all.
+- **A snapshot version bump.** Handled by refusing to read a newer snapshot and
+  naming `moshcode upgrade`, rather than by guessing at a shape this build has
+  never seen.
+- **Should `/load` be able to pick a revision?** The app stores ten and the web
+  page can promote one, which covers recovery without adding a flag that takes a
+  number. Open if people ask for `--revision`.

package/prd/README.md

@@ -25,4 +25,5 @@ Start one with `moshcode prd "<idea>"` (TUI: `/prd`).
 | [0007](0007-profullstack-site-init.md) | Generate batteries-included Profullstack sites for Moshpit names | Draft |
 | [0008](0008-ticker-research-and-plugin-marketplace.md) | Bring equity research into the pit, and ship the pit's slash commands as a plugin | Draft |
 | [0009](0009-persistent-agent-runtime.md) | Keep the herd alive — a persistent runtime, semantic agent state, and one control surface for humans and agents | Accepted |
+| [0010](0010-cloud-settings-sync.md) | Sync the pit's settings to your moshcode.sh account | Draft |
 <!-- PRD-INDEX:END -->

package/src/cli-schema.mjs

@@ -24,6 +24,7 @@ export const COMMAND_GROUPS = [
   { key: "tools", title: "tools" },
   { key: "extend", title: "extend" },
   { key: "script", title: "script" },
+  { key: "arcade", title: "arcade" },
   { key: "account", title: "account" },
   { key: "hosting", title: "hosting" },
   { key: "system", title: "system" },
@@ -278,6 +279,43 @@ export const CORE_CLI_COMMANDS = [
     synopsis: [["moshcode logout", ""]],
     seeAlso: ["login"],
   },
+  {
+    name: "save",
+    group: "account",
+    description: "save this machine's pit settings to your account",
+    synopsis: [["moshcode save [--dry-run] [--force] [--json]", ""]],
+    flags: [
+      ["--dry-run", "list what would be saved and stop", ""],
+      ["--force", "save even if another machine saved after this one last synced", ""],
+      ["--json", "machine-readable result", ""],
+    ],
+    examples: [
+      ["moshcode save", "push aliases + herd rules to app.moshcode.sh"],
+      ["moshcode save --dry-run", "what would go up"],
+    ],
+    seeAlso: ["load", "login", "alias"],
+    note: "aliases (~/.moshcode/aliases.json) and herd rules (~/.moshcode/herd/rules.json). "
+      + "credentials, live herd state and the package cache are never included. "
+      + "each save is a numbered revision; the last ten are kept at app.moshcode.sh/settings/sync.",
+  },
+  {
+    name: "load",
+    group: "account",
+    description: "bring your saved pit settings onto this machine",
+    synopsis: [["moshcode load [--dry-run] [--force] [--json]", ""]],
+    flags: [
+      ["--dry-run", "show the per-file plan and change nothing", ""],
+      ["--force", "overwrite local settings that changed since the last sync", ""],
+      ["--json", "machine-readable result", ""],
+    ],
+    examples: [
+      ["moshcode load", "on a new machine, right after moshcode login"],
+      ["moshcode load --dry-run", "which files would change"],
+    ],
+    seeAlso: ["save", "login", "alias"],
+    note: "refuses rather than overwriting a local file you edited since the last sync — "
+      + "`moshcode save` to keep it, or --force to replace it.",
+  },
   {
     name: "console",
     group: "account",
@@ -355,6 +393,27 @@ export const CORE_CLI_COMMANDS = [
     seeAlso: ["site"],
   },
   { name: "templates", aliasOf: "template", description: "alias for template" },
+  {
+    name: "games",
+    group: "arcade",
+    description: "the moshcode arcade — six games, no menus",
+    synopsis: [
+      ["moshcode games", "the cabinet, and what each one is"],
+      ["moshcode games <game>", "play it, right here in the terminal"],
+    ],
+    flags: [["--json", "the roster, machine-readable", ""]],
+    examples: [
+      ["moshcode games", "what is in the arcade"],
+      ["moshcode games tetris", ""],
+      ["moshcode games chess", "real rules, and it plays back"],
+      ["moshcode games pacman", "dots, ghosts, three lives"],
+    ],
+    seeAlso: ["help"],
+    note: "every game works the same way: arrows move, q quits, r starts another. "
+      + "Playing needs a real terminal because they read single keypresses — `moshcode games` on its own lists them anywhere.",
+  },
+  { name: "game", aliasOf: "games", description: "alias for games" },
+  { name: "arcade", aliasOf: "games", description: "alias for games" },
   {
     name: "pwd",
     group: "system",
@@ -870,6 +929,8 @@ export const PIT_COMMANDS = [
     description: "crypto market data from advis0r.com" },
   { name: "plugin", aliases: ["plugins"], args: "<verb> [name]", cli: "plugin",
     description: "install moshcode's slash commands into Claude Code" },
+  { name: "games", aliases: ["game", "arcade", "play"], args: "[game]", cli: "games",
+    description: "the arcade — tetris, snake, pac-man, tic-tac-toe, chess, hangman" },
   { name: "socials", aliases: ["social"], pitOnly: true,
     description: "list social networks available for posting" },
   { name: "post", args: '<social> "message"', pitOnly: true,
@@ -891,6 +952,10 @@ export const PIT_COMMANDS = [
   { name: "whoami", cli: "whoami", description: "who this machine is logged in as" },
   // Dispatched since forever and missing from /help until now.
   { name: "logout", cli: "logout", description: "clear the logged-in account" },
+  { name: "save", args: "[--dry-run] [--force]", cli: "save",
+    description: "save this pit's settings to your moshcode.sh account" },
+  { name: "load", args: "[--dry-run] [--force]", cli: "load",
+    description: "bring your saved settings onto this machine" },
   { name: "pwd", aliases: ["where"], cli: "pwd",
     description: "show the current dir + git repo/branch/origin" },
   { name: "shell", aliases: ["sh"], args: "[cmd]", pitOnly: true,

package/src/dns-system.mjs

@@ -274,7 +274,8 @@ export function requiredPort(platform, preferred = 5354) {
 /* ------------------------------------------------------- running the plan */
 
 import { spawn } from "node:child_process";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import dgram from "node:dgram";
+import { mkdir, open, readFile, rm, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir, tmpdir } from "node:os";
@@ -367,17 +368,132 @@ export async function daemonStatus(path = pidfilePath()) {
 }
 
 /**
- * Start the bridge detached, so the shell that launched it can exit.
+ * Where a daemon that died on startup left its reason.
  *
- * Not a systemd unit / launchd job / Windows service yet, which means it does
+ * Next to the pidfile, because the two answer halves of the same question and
+ * a person debugging one wants the other in the same directory.
+ */
+export function daemonLogPath(path = pidfilePath()) {
+  return join(dirname(path), "moshpit-dns.log");
+}
+
+/**
+ * How long to wait for the bridge to answer before reporting it unproven.
+ *
+ * Generous on purpose, and it costs nothing in the case that matters: a daemon
+ * that dies resolves the race on its `exit` event immediately, so this bounds
+ * only the "alive but has not answered yet" case. The bridge binds *after* it
+ * fetches the ending list, which against the live registry is ~3s on a fast
+ * link — a tighter deadline would print a warning about healthy bridges on
+ * every slow connection.
+ */
+export const READY_TIMEOUT_MS = 8000;
+const POLL_MS = 150;
+const LOG_TAIL_LINES = 20;
+
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/** A minimal A query. Only the reply matters here, never what it says. */
+function encodeQuery(name, id) {
+  const labels = String(name).split(".").filter(Boolean);
+  const head = Buffer.alloc(12);
+  head.writeUInt16BE(id, 0);
+  head.writeUInt16BE(0x0100, 2); // standard query, recursion desired
+  head.writeUInt16BE(1, 4); // one question
+  const tail = Buffer.alloc(4);
+  tail.writeUInt16BE(1, 0); // A
+  tail.writeUInt16BE(1, 2); // IN
+  return Buffer.concat([
+    head,
+    ...labels.map((label) => {
+      const bytes = Buffer.from(label, "ascii");
+      return Buffer.concat([Buffer.from([bytes.length]), bytes]);
+    }),
+    Buffer.from([0]),
+    tail,
+  ]);
+}
+
+/**
+ * Is something serving DNS on this port?
+ *
+ * Any well-formed reply counts, including NXDOMAIN and SERVFAIL. The question
+ * is whether the resolver is up, and a bridge whose upstreams are unreachable
+ * is still a bridge that started — conflating the two would turn a bad network
+ * into a failed start.
+ */
+export function probeResolver({ host = "127.0.0.1", port, name = "a.eggs", timeoutMs = 500 } = {}) {
+  return new Promise((resolve) => {
+    const socket = dgram.createSocket("udp4");
+    const id = Math.floor(Math.random() * 65536);
+    let done = false;
+    const finish = (answered) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      try {
+        socket.close();
+      } catch {
+        // Already closed by the error that brought us here.
+      }
+      resolve(answered);
+    };
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    socket.once("error", () => finish(false));
+    socket.on("message", (msg) => finish(msg.length >= 2 && msg.readUInt16BE(0) === id));
+    socket.send(encodeQuery(name, id), port, host, (err) => {
+      if (err) finish(false);
+    });
+  });
+}
+
+async function readLogTail(path, lines = LOG_TAIL_LINES) {
+  const text = await readFile(path, "utf8").catch(() => "");
+  const trimmed = text.trimEnd();
+  return trimmed ? trimmed.split("\n").slice(-lines).join("\n") : "";
+}
+
+/**
+ * Start the bridge detached, so the shell that launched it can exit — and do
+ * not claim it started until it has proved it is there.
+ *
+ * The old version spawned with `stdio: "ignore"`, wrote the pidfile from
+ * `child.pid`, and returned `started: true` in the same tick. Both halves of
+ * that were wrong on any machine where the daemon dies on startup. `enable`
+ * printed `ok bridge started (pid N)` for a process that was already gone, then
+ * installed catch-all routing — `Domains=~.` — pointing every lookup on the box
+ * at a port with nothing behind it. The failure took the machine's whole
+ * resolver down and left no way to find out why, because the one stream the
+ * daemon wrote its reason to had been routed to /dev/null. A node that is not
+ * on root's PATH, a port it cannot bind, a half-written install: all of them
+ * arrived as the same confident success line.
+ *
+ * So: stdout and stderr go to a file, an early exit is a failed start that
+ * reports what the daemon said, and the pidfile is written only once the
+ * process is still there — never for one that is not, which is what made
+ * `daemonStatus` report a stale pid as a crash that had never happened.
+ *
+ * Still not a systemd unit / launchd job / Windows service, which means it does
  * not survive a reboot. `moshcode dns status` says so plainly rather than
  * letting someone discover it when their names stop resolving.
  */
-export async function startDaemon({ port, registryBase, path = pidfilePath(), entry, proxy = null }) {
+export async function startDaemon({
+  port,
+  registryBase,
+  path = pidfilePath(),
+  entry,
+  proxy = null,
+  host = "127.0.0.1",
+  logPath = null,
+  readyTimeoutMs = READY_TIMEOUT_MS,
+  probe = probeResolver,
+  sleep = defaultSleep,
+}) {
   const existing = await daemonStatus(path);
   if (existing.running) return { started: false, pid: existing.pid, alreadyRunning: true };
 
   await mkdir(dirname(path), { recursive: true });
+  const log = logPath || daemonLogPath(path);
   const args = [entry, "dns", "start", "--port", String(port)];
   if (registryBase) args.push("--registry", registryBase);
   // Passed at spawn time because it is what the resolver answers with, not
@@ -385,10 +501,64 @@ export async function startDaemon({ port, registryBase, path = pidfilePath(), en
   // short of restarting it, which is why `enable` decides this before starting.
   if (proxy) args.push("--proxy", proxy);
 
-  const child = spawn(process.execPath, args, { detached: true, stdio: "ignore" });
+  // Truncated rather than appended: the only question this file ever answers is
+  // "why did the run I just did fail", and a previous crash above this run's
+  // output is how that question gets answered wrong.
+  await writeFile(log, "");
+  const handle = await open(log, "a");
+  let child;
+  try {
+    child = spawn(process.execPath, args, { detached: true, stdio: ["ignore", handle.fd, handle.fd] });
+  } finally {
+    // The child holds its own duplicate of the descriptor from spawn onward.
+    await handle.close();
+  }
+
+  // `error` covers the spawn itself failing — execPath gone, not executable —
+  // which never reaches `exit` at all.
+  const died = new Promise((resolve) => {
+    child.once("error", (error) => resolve({ reason: error.message }));
+    child.once("exit", (code, signal) => resolve({
+      reason: signal ? `killed by ${signal}` : `exited ${code} before it could serve`,
+      code,
+      signal,
+    }));
+  });
+
+  let gone = null;
+  let verified = false;
+  const deadline = Date.now() + readyTimeoutMs;
+  while (Date.now() < deadline) {
+    gone = await Promise.race([died, sleep(POLL_MS).then(() => null)]);
+    if (gone) break;
+    if (await probe({ host, port })) {
+      verified = true;
+      break;
+    }
+  }
+
   child.unref();
+
+  if (gone) {
+    // No pidfile for a process that is not there. Writing one anyway is what
+    // made the next `enable` believe a bridge was running and skip starting one.
+    await rm(path, { force: true });
+    return {
+      started: false,
+      alreadyRunning: false,
+      pid: null,
+      error: gone.reason,
+      log: await readLogTail(log),
+      logPath: log,
+    };
+  }
+
   await writeFile(path, `${child.pid}\n`);
-  return { started: true, pid: child.pid, alreadyRunning: false };
+  // `verified: false` is a process that is alive but had not answered by the
+  // deadline — a slow registry fetch on a slow link, most often. Reported as
+  // what it is rather than rounded up to success or down to failure: killing a
+  // bridge that was merely still waking up would be the worse mistake.
+  return { started: true, pid: child.pid, alreadyRunning: false, verified, logPath: log };
 }
 
 export async function stopDaemon(path = pidfilePath()) {

package/src/dns.mjs

@@ -2892,11 +2892,43 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
         // too rather than pinning the answer to one family.
         proxy: proxyAddress ? (proxyAddress.v4 || proxyAddress.v6) : null,
       });
+    // The routing this is about to install is catch-all — every lookup on the
+    // machine, not just Moshpit ones — so a bridge that did not come up is not
+    // a degraded feature, it is the machine's resolver pointed at nothing.
+    // Refused here, before the drop-in is written, because the alternative was
+    // discovering it from a box that could no longer resolve its own package
+    // mirror. Nothing has been changed at this point except the restore point,
+    // which is removed on the way out.
+    if (!started.reused && !started.alreadyRunning && !started.started) {
+      out(`  FAIL bridge did not start on ${DEFAULT_HOST}:${wanted} — ${started.error}`);
+      if (started.log) {
+        out("");
+        for (const line of started.log.split("\n")) out(`       ${line}`);
+      }
+      out("");
+      out("Refusing to route this machine's DNS at a bridge that is not running.");
+      out("Nothing has been changed.");
+      if (started.logPath) out(`  the daemon's output is at ${started.logPath}`);
+      out(`  to watch it start in the foreground:  moshcode dns start --port ${wanted}`);
+      if (recorded2.ok) await applyPlan({ steps: [{ kind: "remove", path: manifestFile, why: "the switch never happened" }] });
+      return 1;
+    }
     out(started.reused
       ? `  ok   using the bridge already on ${DEFAULT_HOST}:${wanted} (pid ${reusing.pid || "?"}) — not starting a second one`
       : started.alreadyRunning
         ? `  ok   bridge already running (pid ${started.pid})`
-        : `  ok   bridge started on ${DEFAULT_HOST}:${wanted} (pid ${started.pid})`);
+        : started.verified === true
+          ? `  ok   bridge started on ${DEFAULT_HOST}:${wanted} (pid ${started.pid}) — answering`
+          : `  ok   bridge started on ${DEFAULT_HOST}:${wanted} (pid ${started.pid})`);
+    // Alive, but it had not answered a query by the deadline. Said out loud
+    // rather than swallowed: if the routing below fails to verify, this line is
+    // the reason, and it is cheaper to read it here than to derive it later.
+    // Strictly `false`, never merely absent: a starter that does not report on
+    // verification has not failed it, and rounding the two together would print
+    // a warning about every bridge that was started by something else.
+    if (started.started && started.verified === false) {
+      out(`  --   it has not answered a query yet — still starting, or it will not serve`);
+    }
 
     const outcome = await applyWith(plan, {
       verify: () => verify({ moshpit: moshpitProbe }),