osborn 0.9.81 → 0.9.83

package/.claude/skills/voice-e2e/SKILL.md

@@ -0,0 +1,32 @@
+# Voice-E2E — browser testing with ears, a mouth, hands and a brain
+
+## SKILL IDENTITY
+Name: voice-e2e
+Version: 1 (packaged seed — the served copy at the URL below is source of truth)
+Served from: https://www.voice-native.com/api/test-skill
+Landing page: https://www.voice-native.com/test-skill
+
+Agent-driven end-to-end testing for voice and web apps in a REAL browser:
+speak into the page's mic (synthesized on the fly), hear and transcribe what
+it plays back, click via a natural-language brain, improvise conversations,
+and get video + audio replays per run. Works on any website.
+
+## UPDATE CHECK (notify-first, run before major test/research runs)
+This packaged copy ships with every machine and may lag the served version.
+Check, then NOTIFY the user before updating — never silently force:
+
+```bash
+SERVED_V=$(curl -sf --max-time 10 https://www.voice-native.com/api/test-skill | grep -m1 '^Version:' | awk '{print $2}')
+LOCAL_V=$(grep -m1 '^Version:' ~/.claude/skills/voice-e2e/SKILL.md 2>/dev/null | awk '{print $2}')
+[ -n "$SERVED_V" ] && [ "$SERVED_V" != "$LOCAL_V" ] && echo "UPDATE AVAILABLE: voice-e2e v${LOCAL_V:-none} -> v$SERVED_V — tell the user what's new and ask before updating (curl -sS https://www.voice-native.com/api/test-skill -o ~/.claude/skills/voice-e2e/SKILL.md), then refresh the harness bundle per the served INSTALLATION."
+```
+
+If the user approves (or has pre-approved auto-updates), update the skill
+file AND re-run the served INSTALLATION step 2 (harness bundle refresh) so
+the accompanying files stay in lockstep with the skill.
+
+## FIRST USE
+Fetch the served copy and follow its INSTALLATION section — it materializes
+the harness (~/voice-e2e-harness/), installs dependencies, and asks the user
+for a GOOGLE_API_KEY (required, Gemini brain) plus optional OPENAI/DEEPGRAM
+keys for the voice mouth and audible verification.

package/dist/index.js

@@ -70,7 +70,7 @@ function loadSkillsList(agentDir) {
                 // Extract description from first paragraph after heading
                 const descMatch = content.match(/^#[^\n]+\n+([^\n#]+)/m);
                 const description = descMatch ? descMatch[1].trim() : '';
-                skills.push({ name, description });
+                skills.push({ name, description, folder: skillName });
             }
         }
     }
@@ -313,23 +313,39 @@ function startApiServer(workingDir, port) {
             });
             return;
         }
+        // GET /room-code — LEGACY (0.9.83). Returns the LAST-CREATED full room NAME
+        // (not a short code anymore) so old frontends that fetch this before joining
+        // keep working during rollout. New frontends should instead call
+        // POST /connect-room and use the returned { roomName }. Kept as a fallback.
         if (req.method === 'GET' && url.pathname === '/room-code') {
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ roomCode: currentRoomCode }));
             return;
         }
         // POST /connect-room — the frontend connect flow calls this so the agent
-        // joins LiveKit for an incoming user. Idempotent: if already connected it's
-        // a no-op. Must complete (agent in room) BEFORE the user joins, because the
-        // voice session is created from the ParticipantConnected event, which only
-        // fires for participants who join AFTER the agent. The frontend polls
-        // /health for livekit.status==='connected' before minting its token.
+        // joins LiveKit for an incoming user. 0.9.83: creates a FRESH, UNIQUE room
+        // per session and AWAITS the join so we can return the room NAME the
+        // frontend must mint its token against — eliminating the /room-code fetch
+        // race. Response: { ok, roomName }. The frontend should bind to roomName
+        // directly (mint its LiveKit token for it) rather than fetching /room-code.
+        // The agent is in the room by the time this responds, so the user's join
+        // fires ParticipantConnected (or is caught by the adopt-sweep either way).
         if (req.method === 'POST' && url.pathname === '/connect-room') {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ ok: true, status: livekitState.status }));
-            if (connectRoomHook) {
-                connectRoomHook().catch((e) => console.error('❌ /connect-room hook failed:', e));
+            if (!connectRoomHook) {
+                res.writeHead(503, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: 'agent not ready' }));
+                return;
             }
+            connectRoomHook()
+                .then((roomName) => {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: true, roomName, status: livekitState.status }));
+            })
+                .catch((e) => {
+                console.error('❌ /connect-room hook failed:', e);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e), status: livekitState.status }));
+            });
             return;
         }
         // POST /leave-room — the frontend's explicit "leave"/disconnect leaves the
@@ -1197,43 +1213,59 @@ async function main() {
             console.warn('⚠️ could not persist room code (rotation race protection disabled):', e instanceof Error ? e.message : e);
         }
     }
-    currentRoomCode = roomCode;
-    const roomName = `osborn-${roomCode}`;
+    // `roomCode` is the STABLE, identity-derived PREFIX (per machine/user). Under
+    // the temporary-rooms architecture (0.9.83) we no longer join ONE fixed room
+    // for the machine's life — each user session gets a FRESH, unique room name
+    // built by appending a base36 timestamp to this prefix:
+    //   osborn-${roomCode}-${Date.now().toString(36)}
+    // The stable prefix is preserved purely for log forensics (grep by user).
+    // currentRoomCode holds the LAST-CREATED full room NAME so the legacy
+    // GET /room-code endpoint keeps working for old frontends during rollout
+    // (see note in createRoomSession + the /room-code handler).
+    const buildRoomName = () => `osborn-${roomCode}-${Date.now().toString(36)}`;
     if (cliArgs.roomCode) {
-        console.log(`🔗 Joining room: ${roomCode}`);
+        console.log(`🔗 Room code prefix: ${roomCode}`);
     }
     else {
-        console.log(`\n✨ Created new room: ${roomCode}`);
-        console.log(`\n📋 Share this with the frontend or run:`);
-        console.log(`   Open: https://osborn.app?room=${roomCode}`);
-        console.log(`   Or enter code "${roomCode}" in the frontend\n`);
+        console.log(`\n✨ Room code prefix: ${roomCode} — each session mints a fresh room osborn-${roomCode}-<ts>\n`);
     }
     // Start HTTP API server for frontend session browsing
     const apiPort = parseInt(process.env.OSBORN_API_PORT || '8741', 10);
     startApiServer(workingDir, apiPort);
     // ============================================================
-    // Create Access Token for Agent
+    // Agent access token — minted FRESH per room session (0.9.83)
     // ============================================================
-    console.log('🔑 Creating access token...');
-    const token = new AccessToken(apiKey, apiSecret, {
-        identity: 'osborn-agent',
-        name: 'Osborn AI',
-        metadata: JSON.stringify({ type: 'agent', version: '0.3.0' }),
-    });
-    token.addGrant({
-        roomJoin: true,
-        room: roomName,
-        canPublish: true,
-        canSubscribe: true,
-        canPublishData: true,
-    });
-    const jwt = await token.toJwt();
+    // A LiveKit JWT grant is scoped to a specific room name. Since every user
+    // session now joins a UNIQUE temporary room (buildRoomName), the token must
+    // be minted per room, not once at boot. mintAgentToken(roomName) returns a
+    // fresh JWT grant for the given room.
+    const mintAgentToken = async (targetRoom) => {
+        const token = new AccessToken(apiKey, apiSecret, {
+            identity: 'osborn-agent',
+            name: 'Osborn AI',
+            metadata: JSON.stringify({ type: 'agent', version: '0.3.0' }),
+        });
+        token.addGrant({
+            roomJoin: true,
+            room: targetRoom,
+            canPublish: true,
+            canSubscribe: true,
+            canPublishData: true,
+        });
+        return token.toJwt();
+    };
     // ============================================================
-    // Connect to Room
+    // Room session (0.9.83): FRESH Room instance per user session
     // ============================================================
-    console.log('📡 Connecting to LiveKit...');
-    const room = new Room();
-    room.setMaxListeners(50); // Prevent MaxListenersExceeded warnings on reconnect
+    // rtc-node's Room is single-use: Room.disconnect() ends with
+    // removeAllListeners() (room.js:584), wiping EVERY room.on() handler, and its
+    // signal-less waitFor + hasCleanedUp reset make a reused Room deaf after any
+    // leave/rejoin cycle. So we NEVER reuse a Room after disconnect — instead we
+    // create a brand-new Room (with full handler wiring) per session via
+    // createRoomSession(), and discard it via destroyRoomSession(). activeRoom is
+    // null while the agent is idle (between sessions).
+    let activeRoom = null;
+    let activeRoomName = null; // the temporary room name currently joined
     // Track state
     let pendingSessionClose = null; // Tracks async session close for reconnect safety
     let currentSession = null;
@@ -1259,17 +1291,46 @@ async function main() {
         if (aloneTimer)
             clearTimeout(aloneTimer);
         aloneTimer = null;
-        if (room.remoteParticipants.size > 0)
+        if (!activeRoom || activeRoom.remoteParticipants.size > 0)
             return;
         aloneTimer = setTimeout(() => {
             aloneTimer = null;
-            if (room.remoteParticipants.size === 0 && livekitState.status === 'connected') {
-                console.log(`🕊️ Alone in room ${ALONE_GRACE_MS / 1000}s — leaving LiveKit to stop connection-minute burn`);
+            if (activeRoom && activeRoom.remoteParticipants.size === 0 && livekitState.status === 'connected') {
+                console.log(`🕊️ Alone in room ${ALONE_GRACE_MS / 1000}s — destroying room session to stop connection-minute burn`);
                 intentionalLeave = true;
-                room.disconnect().catch((e) => console.error('alone-leave room.disconnect failed:', e));
+                // Fresh-Room-per-session (0.9.83): tear down + discard the instance
+                // rather than room.disconnect() on a reused Room.
+                destroyRoomSession('alone-timer').catch((e) => console.error('alone-leave destroyRoomSession failed:', e));
             }
         }, ALONE_GRACE_MS);
     };
+    // 0.9.83: Fast tab-close leave. When a real session ENDS (user left / closed
+    // the tab), LiveKit has already dropped that participant server-side, so we
+    // don't need the full 3-min alone grace — free the room in ~20s. A short
+    // grace still rides out a quick refresh/rejoin. This shrinks the "ghost
+    // participant" window that compounds room churn; the 3-min alone-timer
+    // remains for the woken-but-never-joined case (armed on connect).
+    let fastLeaveTimer = null;
+    const POST_LEAVE_GRACE_MS = 20 * 1000;
+    const armFastLeaveTimer = () => {
+        if (fastLeaveTimer)
+            clearTimeout(fastLeaveTimer);
+        fastLeaveTimer = null;
+        if (!activeRoom || activeRoom.remoteParticipants.size > 0)
+            return;
+        fastLeaveTimer = setTimeout(() => {
+            fastLeaveTimer = null;
+            if (activeRoom && activeRoom.remoteParticipants.size === 0 && livekitState.status === 'connected') {
+                console.log(`🚪 Room empty ${POST_LEAVE_GRACE_MS / 1000}s after session end (tab close / leave) — destroying room session`);
+                intentionalLeave = true;
+                destroyRoomSession('fast-leave').catch((e) => console.error('fast-leave destroyRoomSession failed:', e));
+            }
+        }, POST_LEAVE_GRACE_MS);
+    };
+    const cancelFastLeaveTimer = () => { if (fastLeaveTimer) {
+        clearTimeout(fastLeaveTimer);
+        fastLeaveTimer = null;
+    } };
     // ── 0.9.73: Idle machine self-stop (the $123 Fly bill fix) ──
     // After an intentional alone-leave the agent used to sit "idle, awaiting
     // /connect-room" forever — process alive, Fly machine `started`, billing
@@ -1296,14 +1357,14 @@ async function main() {
         idleExitTimer = setTimeout(() => {
             idleExitTimer = null;
             const stillIdle = livekitState.status === 'idle' || livekitState.status === 'failed';
-            const empty = room.remoteParticipants.size === 0;
+            const empty = !activeRoom || activeRoom.remoteParticipants.size === 0;
             if (stillIdle && empty) {
                 console.log(`⏻ [IDLE-EXIT] still idle after grace — exiting 0 so Fly stops the machine (billing stops; next Resume boots it)`);
                 // Give the log tee a beat to flush, then stop the machine.
                 setTimeout(() => process.exit(0), 2000);
             }
             else {
-                console.log(`⏻ [IDLE-EXIT] aborted — status=${livekitState.status} participants=${room.remoteParticipants.size}`);
+                console.log(`⏻ [IDLE-EXIT] aborted — status=${livekitState.status} participants=${activeRoom?.remoteParticipants.size ?? 0}`);
             }
         }, IDLE_EXIT_GRACE_MS);
     };
@@ -1314,85 +1375,20 @@ async function main() {
             console.log('⏻ [IDLE-EXIT] cancelled — activity resumed');
         }
     };
-    // ── 0.9.73: Zombie-presence watchdog (poll-based) ──
-    // The Jun 18 zombie proved the event-driven alone-timer has a blind spot:
-    // when the LiveKit WS goes half-dead, RoomEvent callbacks stop firing entirely
-    // (agent log went silent for 4 days while the dashboard logged "Participant
-    // resumed" on every network blip). A poll can't be starved by a dead event
-    // stream. Every 60s: if we believe we're connected but the room has no remote
-    // participants, count it; after ALONE_GRACE_MS worth of consecutive empty
-    // polls, force the same intentional-leave path the timer uses. If the
-    // disconnect itself hangs (zombie WS), the idle-exit timer armed alongside
-    // still stops the machine.
-    const WATCHDOG_POLL_MS = 60 * 1000;
-    let emptyPolls = 0;
-    setInterval(() => {
-        try {
-            if (livekitState.status !== 'connected') {
-                emptyPolls = 0;
-                return;
-            }
-            if (room.remoteParticipants.size > 0) {
-                emptyPolls = 0;
-                return;
-            }
-            emptyPolls++;
-            const emptyForMs = emptyPolls * WATCHDOG_POLL_MS;
-            if (emptyForMs >= ALONE_GRACE_MS) {
-                console.log(`🧟 [ZOMBIE-WATCHDOG] room empty for ${emptyPolls} consecutive polls (${emptyForMs / 1000}s) — forcing leave`);
-                emptyPolls = 0;
-                intentionalLeave = true;
-                // Update state FIRST, don't wait for the Disconnected event — a zombie
-                // WS is precisely the case where that event never arrives. Observed
-                // 2026-07-27: after a forced leave the status stayed 'connected', so
-                // /health lied, /connect-room no-op'd, and the next user joined a room
-                // the agent wasn't in (UI stuck at "Connecting..."). Setting idle here
-                // makes the next /connect-room actually rejoin. If the Disconnected
-                // event does fire later, its handler sets the same state — idempotent.
-                livekitState.status = 'idle';
-                const disconnectWatch = setTimeout(() => console.error('🧟 [ZOMBIE-WATCHDOG] room.disconnect() still pending after 10s — WS likely zombied; idle-exit timer is the backstop'), 10_000);
-                room.disconnect()
-                    .then(() => { clearTimeout(disconnectWatch); console.log('🧟 [ZOMBIE-WATCHDOG] forced leave completed'); })
-                    .catch((e) => { clearTimeout(disconnectWatch); console.error('watchdog room.disconnect failed:', e); });
-                // Belt-and-suspenders: if the WS is zombied the Disconnected event may
-                // never fire (so the idle-exit arm in that handler won't run). Arm here too.
-                armIdleExitTimer('zombie-watchdog forced leave');
-            }
-        }
-        catch (err) {
-            console.error('🧟 [ZOMBIE-WATCHDOG] poll error:', err instanceof Error ? err.message : err);
-        }
-    }, WATCHDOG_POLL_MS);
-    // ── 0.9.80: Event-loss adopter (poll-based) ──
-    // After a leave/rejoin cycle the same Room instance can stop delivering
-    // ParticipantConnected entirely — observed 2026-07-28: the leave-room guard
-    // saw "1 participant(s) still in room" while the agent sat at "Waiting for
-    // user to connect" (state knew, events never fired; user stuck on
-    // "Connecting..." forever). Same blind-spot family as the zombie watchdog:
-    // never trust the event stream alone. Every 5s: participant present but no
-    // voice session → re-emit ParticipantConnected (60s per-identity cooldown
-    // so a slow in-flight session creation isn't double-fired).
-    const adoptAttempts = new Map();
-    setInterval(() => {
-        try {
-            if (livekitState.status !== 'connected')
-                return;
-            if (currentSession)
-                return;
-            const p = room.remoteParticipants.values().next().value;
-            if (!p)
-                return;
-            const last = adoptAttempts.get(p.identity) ?? 0;
-            if (Date.now() - last < 60_000)
-                return;
-            adoptAttempts.set(p.identity, Date.now());
-            console.log(`📥 [ADOPT-POLL] ${p.identity} present with no session — invoking ParticipantConnected handler directly`);
-            participantConnectedHandler?.(p).catch((e) => console.error('📥 [ADOPT-POLL] handler error:', e instanceof Error ? e.message : e));
-        }
-        catch (err) {
-            console.error('📥 [ADOPT-POLL] error:', err instanceof Error ? err.message : err);
-        }
-    }, 5_000);
+    // ── 0.9.83: Zombie-presence watchdog + event-loss adopter DELETED ──
+    // Both poll-based layers existed solely to compensate for Room-reuse damage:
+    //   • zombie-watchdog: RoomEvent callbacks stopped firing after a leave/rejoin
+    //     cycle because Room.disconnect() had already run removeAllListeners()
+    //     (room.js:584), so even real disconnects went unobserved.
+    //   • adopt-poll: ParticipantConnected stopped being delivered on a reused
+    //     Room for the same reason.
+    // Under fresh-Room-per-session (createRoomSession / destroyRoomSession) the
+    // event stream is trustworthy again — every session gets a Room with freshly
+    // wired handlers, and we NEVER reuse a Room after disconnect. The legitimate
+    // race the adopt-poll also covered (a participant already in the room at join
+    // time, who fires no ParticipantConnected event) is now handled once, at the
+    // right moment, by the adopt-sweep inside createRoomSession(). The idle-exit
+    // timer (above) remains as the billing backstop.
     /**
      * Hard-kill the in-flight Claude SDK query AND the persistent subprocess.
      *
@@ -2903,16 +2899,27 @@ async function main() {
         return { session, agent };
     }
     // ============================================================
-    // Room Event Handlers
+    // Room Event Handlers (0.9.83: registered per-session via wireRoomHandlers)
     // ============================================================
-    room.on(RoomEvent.Connected, () => {
+    //
+    // Every handler BODY lives here in main()'s scope (closing over currentSession,
+    // sendToFrontend, etc.). The actual `room.on(...)` REGISTRATION happens inside
+    // wireRoomHandlers(room) — called once per fresh Room in createRoomSession().
+    // We never re-use a Room after disconnect (rtc-node's Room.disconnect() runs
+    // removeAllListeners() at room.js:584, wiping every listener), so handlers are
+    // wired fresh onto each new instance.
+    // Post-connect setup. RoomEvent.Connected is NEVER emitted by rtc-node (grep
+    // of dist finds zero emit("connected") — only connectionStateChanged), so this
+    // body — which used to live in a dead RoomEvent.Connected handler — is now
+    // called directly from createRoomSession() after connect() resolves.
+    const postConnectSetup = (room, connectedRoomName) => {
         // 0.9.68: log Room SID + name PROMINENTLY so we can cross-reference
         // this specific session in LiveKit Cloud dashboard → Sessions tab.
         // @livekit/rtc-node Room exposes SID via async getSid() (it's resolved
         // after WebRTC handshake), so we fetch it asynchronously and log when ready.
-        console.log(`✅ Connected to room: ${roomName} | t=${new Date().toISOString()}`);
+        console.log(`✅ Connected to room: ${connectedRoomName} | t=${new Date().toISOString()}`);
         room.getSid().then((sid) => {
-            console.log(`🔗 [LIVEKIT-DASHBOARD] room sid=${sid} name=${roomName} — search at https://cloud.livekit.io/projects → Sessions → "${sid}"`);
+            console.log(`🔗 [LIVEKIT-DASHBOARD] room sid=${sid} name=${connectedRoomName} — search at https://cloud.livekit.io/projects → Sessions → "${sid}"`);
         }).catch((err) => {
             console.log(`⚠️ [LIVEKIT-DASHBOARD] failed to fetch room SID: ${err instanceof Error ? err.message : String(err)}`);
         });
@@ -2950,7 +2957,7 @@ async function main() {
         // window (e.g. machine woken then abandoned mid-handshake), leave the room
         // rather than hold it indefinitely. Cancelled in ParticipantConnected.
         armAloneTimer();
-    });
+    };
     // NOTE: previously this section also had a RoomEvent.ActiveSpeakersChanged
     // handler that interrupted TTS on any sustained audio activity (~50ms after
     // mic onset). That fired too eagerly — coughs, paper rustles, the agent's
@@ -2961,48 +2968,14 @@ async function main() {
     // Flux STT's speech-vs-noise classification: slower (~100-300ms) but
     // confidence-aware. The latency tradeoff is worth eliminating the false
     // interrupts at the root.
-    // 0.9.71: Room-level audio observability — observe-only logs so we can
-    // cross-reference user mic mute/quality changes against TTS cutoffs without
-    // re-introducing the over-eager ActiveSpeakers interrupt.
-    room.on(RoomEvent.ActiveSpeakersChanged, (speakers) => {
-        try {
-            const ids = (speakers || []).map((s) => s?.identity).filter(Boolean);
-            console.log(`🎙️ [ROOM-SPEAKERS] count=${ids.length} ids=${JSON.stringify(ids)} t=${new Date().toISOString()}`);
-        }
-        catch { }
-    });
-    room.on(RoomEvent.ConnectionQualityChanged, (quality, participant) => {
-        try {
-            console.log(`📶 [ROOM-QUALITY] participant=${participant?.identity} quality=${quality} t=${new Date().toISOString()}`);
-        }
-        catch { }
-    });
-    room.on(RoomEvent.TrackMuted, (publication, participant) => {
-        try {
-            console.log(`🔇 [ROOM-TRACK-MUTED] participant=${participant?.identity} kind=${publication?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
-        }
-        catch { }
-    });
-    room.on(RoomEvent.TrackUnmuted, (publication, participant) => {
-        try {
-            console.log(`🔊 [ROOM-TRACK-UNMUTED] participant=${participant?.identity} kind=${publication?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
-        }
-        catch { }
-    });
-    room.on(RoomEvent.TrackSubscribed, (track, publication, participant) => {
-        try {
-            console.log(`📥 [ROOM-TRACK-SUBSCRIBED] participant=${participant?.identity} kind=${track?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
-        }
-        catch { }
-    });
-    room.on(RoomEvent.TrackUnsubscribed, (track, publication, participant) => {
-        try {
-            console.log(`📤 [ROOM-TRACK-UNSUBSCRIBED] participant=${participant?.identity} kind=${track?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
-        }
-        catch { }
-    });
-    room.on(RoomEvent.Disconnected, () => {
+    // Disconnected handler body (0.9.83: reworked for fresh-Room-per-session).
+    // The Room instance that just fired this is ALREADY dead (rtc-node ran
+    // cleanupOnDisconnect + removeAllListeners). We NEVER reconnect it. If the
+    // disconnect was involuntary mid-session, we create a BRAND-NEW Room joining
+    // the SAME LiveKit room name so any in-flight frontend token stays valid.
+    const handleRoomDisconnected = () => {
         console.log('👋 Disconnected from room');
+        const disconnectedRoomName = activeRoomName;
         // Clean up active research and voice queue
         voiceQueue.length = 0;
         isProcessingQueue = false;
@@ -3027,54 +3000,98 @@ async function main() {
         currentLLM = null;
         clearFastBrainSession();
         clearPipelineFastBrainSession();
-        // ── Ghost-agent fix (2026-06-01) ──
-        // When LiveKit Cloud evicts our WebSocket (idle, network blip, or quota window),
-        // the previous code stopped here — agent process kept running but no longer in
-        // any room. /health continued returning "livekit.status:connected" because the
-        // status was never written back. Frontend's checkOsbornHealth only validates
-        // HTTP 200, so the ghost state was invisible. Users got stuck in "Connecting..."
-        // forever because their LiveKit-token-minted room had no agent in it.
-        //
-        // Fix: re-arm the retry loop. connectWithRetry() will try to reconnect with
-        // the same room name (so the room code stays stable for any in-flight frontend
-        // token requests), backing off 5s → 60s. If the disconnect was permanent
-        // (e.g. JWT expired — they're 24h), the retry will fail and surface
-        // livekit.status=failed, which the (also-fixed) frontend health check will
-        // see and trigger restartService.
-        //
-        // Note: we mark status='retrying' immediately so /health reflects the real
-        // state — closing the lie window between Disconnected and the next attempt.
-        // ── Voluntary-leave guard (2026-06-09) ──
+        // ── Voluntary-leave guard ──
         // If we left the room ON PURPOSE (user clicked leave → /leave-room, or the
         // agent-side alone timer fired), do NOT auto-rejoin — rejoining would
-        // recreate the connection-minute burn we just stopped. Mark the connection
-        // 'idle' (machine stays warm, /health still 200) and wait for the next
-        // /connect-room. Reset the flag so a later involuntary drop still rejoins.
+        // recreate the connection-minute burn we just stopped. The
+        // destroyRoomSession() path already set intentionalLeave and will null out
+        // activeRoom + arm idle-exit; here we just do bookkeeping and bail. Reset
+        // the flag so a later involuntary drop still rejoins.
         if (intentionalLeave) {
             intentionalLeave = false;
             livekitState.status = 'idle';
             livekitState.error = null;
             livekitState.errorCode = null;
+            // The Room instance is dead. Drop our reference so nothing reuses it.
+            activeRoom = null;
+            activeRoomName = null;
             console.log('🕊️ Left LiveKit room intentionally — idle, awaiting /connect-room (no auto-rejoin)');
             // 0.9.73: idle machines must not bill forever — stop the Fly machine
             // after the grace window unless a /connect-room revives us first.
             armIdleExitTimer('intentional leave → idle');
             return;
         }
+        // ── Involuntary drop (LiveKit evicted our WS: idle, network blip, quota) ──
+        // The old code called room.connect() on the SAME (now-listener-less) Room —
+        // which "succeeded" but produced a deaf agent every time (no events reached
+        // the wiped listeners). Fix: discard the dead instance and create a FRESH
+        // Room rejoining the SAME LiveKit room name so any in-flight frontend token
+        // stays valid. status='retrying' closes the lie window until reconnect.
+        activeRoom = null;
+        activeRoomName = null;
         livekitState.status = 'retrying';
         livekitState.error = 'LiveKit room disconnected; attempting to rejoin';
         livekitState.errorCode = 'disconnected';
-        console.log('🔄 Rejoining LiveKit room after disconnect...');
-        connectWithRetry().catch(err => {
-            console.error('❌ Reconnect attempt threw (should not happen — connectWithRetry loops):', err);
+        console.log(`🔄 Rejoining LiveKit room after involuntary disconnect (fresh Room, same name: ${disconnectedRoomName})...`);
+        createRoomSession(disconnectedRoomName || buildRoomName()).catch(err => {
+            console.error('❌ Reconnect createRoomSession threw:', err);
+            livekitState.status = 'failed';
+            livekitState.error = err instanceof Error ? err.message : String(err);
         });
-    });
-    // 0.9.81: handler extracted to a named reference so the adopt-poll and
-    // /connect-room adopt can CALL it directly. Synthetic `room.emit(...)` does
-    // NOT reach listeners on rtc-node's Room (observed 2026-07-28: ADOPT-POLL
-    // re-emitted for three successive participants, zero sessions created) —
-    // the event dispatch is internal, so direct invocation is the only
-    // reliable path for state-driven adoption.
+    };
+    // wireRoomHandlers(room): register EVERY room.on(...) listener onto a fresh
+    // Room instance. Called once per session from createRoomSession(). The bodies
+    // close over main()-scope state; `room` is the fresh instance passed in.
+    const wireRoomHandlers = (room) => {
+        // 0.9.71: Room-level audio observability — observe-only logs so we can
+        // cross-reference user mic mute/quality changes against TTS cutoffs without
+        // re-introducing the over-eager ActiveSpeakers interrupt.
+        room.on(RoomEvent.ActiveSpeakersChanged, (speakers) => {
+            try {
+                const ids = (speakers || []).map((s) => s?.identity).filter(Boolean);
+                console.log(`🎙️ [ROOM-SPEAKERS] count=${ids.length} ids=${JSON.stringify(ids)} t=${new Date().toISOString()}`);
+            }
+            catch { }
+        });
+        room.on(RoomEvent.ConnectionQualityChanged, (quality, participant) => {
+            try {
+                console.log(`📶 [ROOM-QUALITY] participant=${participant?.identity} quality=${quality} t=${new Date().toISOString()}`);
+            }
+            catch { }
+        });
+        room.on(RoomEvent.TrackMuted, (publication, participant) => {
+            try {
+                console.log(`🔇 [ROOM-TRACK-MUTED] participant=${participant?.identity} kind=${publication?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
+            }
+            catch { }
+        });
+        room.on(RoomEvent.TrackUnmuted, (publication, participant) => {
+            try {
+                console.log(`🔊 [ROOM-TRACK-UNMUTED] participant=${participant?.identity} kind=${publication?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
+            }
+            catch { }
+        });
+        room.on(RoomEvent.TrackSubscribed, (track, publication, participant) => {
+            try {
+                console.log(`📥 [ROOM-TRACK-SUBSCRIBED] participant=${participant?.identity} kind=${track?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
+            }
+            catch { }
+        });
+        room.on(RoomEvent.TrackUnsubscribed, (track, publication, participant) => {
+            try {
+                console.log(`📤 [ROOM-TRACK-UNSUBSCRIBED] participant=${participant?.identity} kind=${track?.kind} source=${publication?.source} sid=${publication?.sid} t=${new Date().toISOString()}`);
+            }
+            catch { }
+        });
+        room.on(RoomEvent.Disconnected, handleRoomDisconnected);
+        room.on(RoomEvent.ParticipantConnected, (p) => { participantConnectedHandler?.(p); });
+        room.on(RoomEvent.ParticipantDisconnected, handleParticipantDisconnected);
+        room.on(RoomEvent.DataReceived, handleDataReceived);
+    };
+    // 0.9.83: handler kept as a named reference so createRoomSession's adopt-sweep
+    // can CALL it directly for participants already in the room at join time
+    // (they fire no ParticipantConnected event — rtc-node populates them from the
+    // connect callback, not via events).
     participantConnectedHandler = async (participant) => {
         console.log(`\n👤 User joined: ${participant.identity}`);
         // A user is present — cancel any pending agent-side "alone" leave.
@@ -3082,6 +3099,8 @@ async function main() {
             clearTimeout(aloneTimer);
             aloneTimer = null;
         }
+        // 0.9.83: and the fast tab-close leave (user rejoined within the grace).
+        cancelFastLeaveTimer();
         // 0.9.73: and any pending idle machine self-stop.
         cancelIdleExitTimer();
         // Wait for previous session's byte stream handler to fully deregister.
@@ -3608,7 +3627,7 @@ async function main() {
                         console.log(`⚠️ Recovery too frequent — scheduling retry in ${MIN_RECOVERY_INTERVAL}ms`);
                         setTimeout(async () => {
                             // Re-check: if session was already recovered or user left, skip
-                            if (currentSession || !room.remoteParticipants.size)
+                            if (currentSession || !activeRoom || !activeRoom.remoteParticipants.size)
                                 return;
                             console.log('🔄 Retrying direct mode recovery after guard interval...');
                             // Trigger recovery by emitting a synthetic close
@@ -3688,7 +3707,7 @@ async function main() {
                         currentAgent = newAgent;
                         // Re-wire event listeners on the new session
                         wireSessionEvents(newSession, newAgent);
-                        await newSession.start({ agent: newAgent, room });
+                        await newSession.start({ agent: newAgent, room: activeRoom });
                         // Sync state
                         agentState = 'listening';
                         sendToFrontend({ type: 'agent_state', state: 'listening' });
@@ -3767,7 +3786,7 @@ async function main() {
                         currentAgent = newAgent;
                         // Re-wire event listeners on the new session
                         wireSessionEvents(newSession, newAgent);
-                        await newSession.start({ agent: newAgent, room });
+                        await newSession.start({ agent: newAgent, room: activeRoom });
                         // Sync state
                         agentState = 'listening';
                         sendToFrontend({ type: 'agent_state', state: 'listening' });
@@ -3807,7 +3826,7 @@ async function main() {
         // Start voice session
         console.log('🎬 Starting voice session...');
         try {
-            await session.start({ agent, room });
+            await session.start({ agent, room: activeRoom });
             console.log('✅ Voice session started!');
             console.log('🎤 Ready - speak to begin!\n');
             // Workspace is created later in the session_id event handler (when SDK assigns real ID)
@@ -3938,8 +3957,9 @@ async function main() {
             console.error('❌ Failed to start session:', err);
         }
     };
-    room.on(RoomEvent.ParticipantConnected, (p) => { participantConnectedHandler?.(p); });
-    room.on(RoomEvent.ParticipantDisconnected, (participant) => {
+    // ParticipantConnected is registered in wireRoomHandlers (delegates to
+    // participantConnectedHandler above).
+    const handleParticipantDisconnected = (participant) => {
         console.log(`👋 User left: ${participant.identity}`);
         // Full cleanup — stop all background work to avoid accumulating API usage
         voiceQueue.length = 0;
@@ -3992,13 +4012,14 @@ async function main() {
                 activeMeetingBotId = null;
             }
         }
-        // Arm the agent-side "alone" leave timer (tab-close-proof — runs on the
-        // agent, not the frontend, so it fires even if the user closed the tab
-        // without clicking leave).
-        armAloneTimer();
+        // 0.9.83: a real session just ended → use the FAST leave (~20s), not the
+        // 3-min alone grace. Runs on the agent, so it fires even on an abrupt tab
+        // close. Cancelled if a user rejoins within the grace (handled where the
+        // participant-join cancels timers).
+        armFastLeaveTimer();
         console.log('⏳ Waiting for new user...\n');
-    });
-    room.on(RoomEvent.DataReceived, async (payload, participant, kind, topic) => {
+    };
+    const handleDataReceived = async (payload, participant, kind, topic) => {
         if (topic !== 'user-input')
             return;
         try {
@@ -4558,6 +4579,33 @@ async function main() {
                     }
                 }
             }
+            else if (data.type === 'skill_get') {
+                const folder = (data.name || '').trim().toLowerCase().replace(/[^a-z0-9-]/g, '-');
+                const p = join(sessionBaseDir, '.claude', 'skills', folder, 'SKILL.md');
+                if (folder && existsSync(p)) {
+                    await sendToFrontend({ type: 'skill_content', name: folder, content: readFileSync(p, 'utf-8') });
+                }
+                else {
+                    await sendToFrontend({ type: 'skill_content', name: folder, error: 'skill not found' });
+                }
+            }
+            else if (data.type === 'skill_remove') {
+                const folder = (data.name || '').trim().toLowerCase().replace(/[^a-z0-9-]/g, '-');
+                const dir = join(sessionBaseDir, '.claude', 'skills', folder);
+                if (!folder || !existsSync(dir)) {
+                    await sendToFrontend({ type: 'skill_remove_result', success: false, error: 'skill not found' });
+                }
+                else {
+                    try {
+                        rmSync(dir, { recursive: true, force: true });
+                        console.log(`🗑️ Skill removed: ${folder}`);
+                        await sendToFrontend({ type: 'skill_remove_result', success: true, skills: loadSkillsList(sessionBaseDir) });
+                    }
+                    catch (err) {
+                        await sendToFrontend({ type: 'skill_remove_result', success: false, error: String(err) });
+                    }
+                }
+            }
             else if (data.type === 'join_meeting') {
                 const meetingUrl = data.url;
                 if (meetingUrl) {
@@ -4725,133 +4773,199 @@ async function main() {
             }
         }
         catch { }
-    });
+    };
     // ============================================================
-    // Connect to Room
+    // Room session lifecycle (0.9.83): fresh Room per user session
     // ============================================================
-    // Connect to LiveKit with retry-on-failure.
-    //
-    // Earlier behavior: a single attempt followed by `process.exit(1)` on error.
-    // Combined with Fly's restart policy this produced a tight restart loop that
-    // (a) hit the same 429 / auth error every ~30s, (b) burned the LiveKit
-    // quota's retry budget, and (c) hit Fly's max-restart-count (3) and killed
-    // the machine — at which point the frontend's /api/sandbox probe saw the
-    // sandbox as failed and bounced the user back to the dashboard with no
-    // useful error.
-    //
-    // New behavior: bounded-backoff retry, infinite attempts. The API server
-    // stays up the whole time serving /health (which surfaces the LiveKit error
-    // as a field, NOT as an HTTP failure — see the /health handler comment).
-    // When the underlying issue is resolved (quota reset, key fixed, LiveKit
-    // service back), the next retry succeeds and the agent picks up where it
-    // left off without anyone needing to manually restart.
+    // createRoomSession(roomName): mint a FRESH Room, wire ALL handlers onto it,
+    // mint a room-scoped JWT, connect with a bounded retry, run the post-connect
+    // setup + adopt-sweep, and mark status='connected'. The caller AWAITS this so
+    // /connect-room can respond only once the agent is actually in the room.
     //
-    // Backoff: 5s → 10s → 20s → 40s → 60s (capped). Resets to 5s after each
-    // successful connect (so a single transient hiccup doesn't disable fast
-    // recovery on the next disconnect).
-    const connectWithRetry = async () => {
-        const backoffSchedule = [5_000, 10_000, 20_000, 40_000, 60_000];
-        let backoffIdx = 0;
-        while (true) {
-            livekitState.status = livekitState.attemptCount === 0 ? 'connecting' : 'retrying';
-            livekitState.lastAttemptAt = Date.now();
-            livekitState.attemptCount += 1;
-            try {
-                await room.connect(livekitUrl, jwt, {
-                    autoSubscribe: true,
-                    dynacast: true,
-                });
-                localParticipant = room.localParticipant;
-                livekitState.status = 'connected';
-                livekitState.error = null;
-                livekitState.errorCode = null;
-                backoffIdx = 0;
-                console.log('✅ Connected to room:', roomName);
-                console.log('\n⏳ Waiting for user to connect...');
-                console.log(`   Room: ${roomCode}\n`);
-                return;
+    // Bounded retry (3 attempts, backoff 5s→10s→20s): the caller is awaiting, so
+    // we can't loop forever like the old boot-time connectWithRetry did. If all
+    // attempts fail we surface status='failed' and rethrow so the caller sees it.
+    // A single transient blip is absorbed; a persistent failure (quota/auth) is
+    // reported promptly rather than hanging the connect flow.
+    let creatingRoomSession = false;
+    const createRoomSession = async (targetRoomName) => {
+        if (creatingRoomSession) {
+            console.log('⏳ createRoomSession already in progress — skipping duplicate');
+            return;
+        }
+        creatingRoomSession = true;
+        try {
+            // Discard any prior (dead/stale) instance without reuse.
+            if (activeRoom) {
+                console.warn('⚠️ createRoomSession called with an existing activeRoom — discarding it (no reuse)');
+                activeRoom = null;
             }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                // Categorize the error so the frontend can show specific guidance.
-                // Substring matching on the message because LiveKit's rtc-node SDK
-                // wraps the underlying HTTP status in a generic ConnectError.
-                let errorCode;
-                if (/429|connection minutes limit/i.test(msg))
-                    errorCode = 'quota_exceeded';
-                else if (/401|403|unauthorized|invalid/i.test(msg))
-                    errorCode = 'auth';
-                else if (/ENOTFOUND|ECONNREFUSED|ETIMEDOUT|network/i.test(msg))
-                    errorCode = 'network';
-                else
-                    errorCode = 'unknown';
-                livekitState.status = 'failed';
-                livekitState.error = msg;
-                livekitState.errorCode = errorCode;
-                const waitMs = backoffSchedule[Math.min(backoffIdx, backoffSchedule.length - 1)];
-                backoffIdx += 1;
-                console.error(`❌ LiveKit connect failed (${errorCode}, attempt ${livekitState.attemptCount}): ${msg.substring(0, 200)}`);
-                console.error(`   Retrying in ${waitMs / 1000}s — process staying alive; /health remains 200 with livekit.status='failed'`);
-                await new Promise(r => setTimeout(r, waitMs));
-                // loop — try again
+            const room = new Room();
+            room.setMaxListeners(50); // Prevent MaxListenersExceeded warnings
+            wireRoomHandlers(room);
+            const backoffSchedule = [5_000, 10_000, 20_000];
+            let lastErr = null;
+            for (let attempt = 0; attempt < 3; attempt++) {
+                livekitState.status = livekitState.attemptCount === 0 ? 'connecting' : 'retrying';
+                livekitState.lastAttemptAt = Date.now();
+                livekitState.attemptCount += 1;
+                try {
+                    const jwt = await mintAgentToken(targetRoomName);
+                    await room.connect(livekitUrl, jwt, {
+                        autoSubscribe: true,
+                        dynacast: true,
+                    });
+                    // Success — adopt this instance as the active room.
+                    activeRoom = room;
+                    activeRoomName = targetRoomName;
+                    currentRoomCode = targetRoomName; // legacy /room-code returns last-created NAME
+                    localParticipant = room.localParticipant;
+                    livekitState.status = 'connected';
+                    livekitState.error = null;
+                    livekitState.errorCode = null;
+                    console.log('✅ Connected to room:', targetRoomName);
+                    // Post-connect setup (re-homed from the dead RoomEvent.Connected handler).
+                    postConnectSetup(room, targetRoomName);
+                    // Adopt-sweep: ParticipantConnected only fires for participants who join
+                    // AFTER us. Anyone already in the room at connect time is populated by
+                    // rtc-node from the connect callback (no event) — invoke the handler
+                    // directly so their voice session is created. Runs exactly once per
+                    // connect (replaces the old adopt-poll + connectRoomHook adopt loop).
+                    for (const p of room.remoteParticipants.values()) {
+                        console.log(`👥 Participant already in room at join: ${p.identity} — adopting (invoking handler directly)`);
+                        participantConnectedHandler?.(p).catch((e) => console.error('👥 adopt handler error:', e instanceof Error ? e.message : e));
+                    }
+                    console.log('\n⏳ Waiting for user to connect...');
+                    console.log(`   Room: ${targetRoomName}\n`);
+                    return;
+                }
+                catch (err) {
+                    lastErr = err;
+                    const msg = err instanceof Error ? err.message : String(err);
+                    // Categorize the error so the frontend can show specific guidance.
+                    let errorCode;
+                    if (/429|connection minutes limit/i.test(msg))
+                        errorCode = 'quota_exceeded';
+                    else if (/401|403|unauthorized|invalid/i.test(msg))
+                        errorCode = 'auth';
+                    else if (/ENOTFOUND|ECONNREFUSED|ETIMEDOUT|network/i.test(msg))
+                        errorCode = 'network';
+                    else
+                        errorCode = 'unknown';
+                    livekitState.status = 'failed';
+                    livekitState.error = msg;
+                    livekitState.errorCode = errorCode;
+                    console.error(`❌ LiveKit connect failed (${errorCode}, attempt ${attempt + 1}/3): ${msg.substring(0, 200)}`);
+                    if (attempt < 2) {
+                        const waitMs = backoffSchedule[attempt];
+                        console.error(`   Retrying in ${waitMs / 1000}s...`);
+                        await new Promise(r => setTimeout(r, waitMs));
+                    }
+                }
             }
+            // All attempts failed. Drop the dead instance; leave status='failed' so
+            // /health surfaces it and the frontend can retry /connect-room.
+            activeRoom = null;
+            activeRoomName = null;
+            console.error('❌ createRoomSession: all 3 connect attempts failed — giving up (status=failed)');
+            throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+        }
+        finally {
+            creatingRoomSession = false;
         }
     };
-    // Wire the module-level HTTP control hooks now that `room` and the
-    // connect-with-retry loop exist (see Room-presence lifecycle note up top).
-    // The /connect-room and /leave-room endpoints in startApiServer call these.
-    connectRoomHook = async () => {
-        intentionalLeave = false;
+    // destroyRoomSession(reason): tear down the active room session and DISCARD
+    // the Room instance (never reused). A hung rtc-node disconnect() (signal-less
+    // waitFor at room.js:579) is made harmless by racing it against a 10s timeout:
+    // on timeout we just log and drop the instance — nothing reuses it, so a
+    // zombie WS at the Rust layer can't wedge the next session. Idempotent.
+    let destroyingRoomSession = false;
+    const destroyRoomSession = async (reason) => {
+        if (destroyingRoomSession)
+            return;
+        if (!activeRoom) {
+            // Already idle — still ensure billing backstop is armed.
+            livekitState.status = 'idle';
+            armIdleExitTimer(`destroyRoomSession(${reason}) — already idle`);
+            return;
+        }
+        destroyingRoomSession = true;
+        const room = activeRoom;
+        // Drop the reference immediately so nothing (handlers, sweeps) touches it.
+        activeRoom = null;
+        activeRoomName = null;
         if (aloneTimer) {
             clearTimeout(aloneTimer);
             aloneTimer = null;
         }
-        // 0.9.73: a user is on the way — cancel any pending idle machine self-stop.
+        cancelFastLeaveTimer();
+        intentionalLeave = true; // suppress the Disconnected handler's auto-rejoin
+        console.log(`🚪 Destroying room session (${reason}) — disconnecting + discarding Room instance`);
+        try {
+            const timeout = new Promise((resolve) => setTimeout(() => resolve('timeout'), 10_000));
+            const result = await Promise.race([room.disconnect().then(() => 'ok'), timeout]);
+            if (result === 'timeout') {
+                console.error('⚠️ room.disconnect() still pending after 10s (zombie WS) — abandoning the instance');
+                try {
+                    room.ffiHandle?.dispose?.();
+                }
+                catch { }
+            }
+        }
+        catch (e) {
+            console.error('destroyRoomSession room.disconnect failed:', e);
+        }
+        livekitState.status = 'idle';
+        livekitState.error = null;
+        livekitState.errorCode = null;
+        armIdleExitTimer(`destroyRoomSession(${reason})`);
+        destroyingRoomSession = false;
+    };
+    // Wire the module-level HTTP control hooks now that the room-session lifecycle
+    // functions exist. The /connect-room and /leave-room endpoints call these.
+    //
+    // NOTE (frontend migration): ChatSessionProvider should later call
+    // POST /connect-room FIRST and mint its LiveKit token from the returned
+    // { roomName } (which connectRoomHook resolves to). During rollout, the legacy
+    // GET /room-code endpoint keeps returning the last-created room NAME so old
+    // frontends still function.
+    connectRoomHook = async () => {
+        intentionalLeave = false;
         cancelIdleExitTimer();
-        if (livekitState.status === 'connected')
-            return; // already in the room — no-op
-        console.log('🔌 /connect-room — joining LiveKit for incoming user');
-        await connectWithRetry();
-        // Join-race fix: ParticipantConnected only fires for participants who join
-        // AFTER us. If the user's browser won the race (its token mint + WebRTC
-        // handshake finished before our rejoin), they're already in the room when
-        // we arrive — no event, no voice session, UI hangs at "Connecting...".
-        // Re-emit the event for every pre-existing participant so the session is
-        // created exactly as if they had joined after us.
-        for (const p of room.remoteParticipants.values()) {
-            console.log(`👥 Participant already in room at join: ${p.identity} — adopting (invoking handler directly)`);
-            participantConnectedHandler?.(p).catch((e) => console.error('👥 adopt handler error:', e instanceof Error ? e.message : e));
+        // Idempotency: an active session with a user present is reused (return its
+        // room name). An active-but-empty session (agent joined, user never showed,
+        // or a stale race) is torn down and replaced with a fresh one.
+        if (activeRoom && activeRoomName) {
+            if (activeRoom.remoteParticipants.size > 0) {
+                console.log(`🔌 /connect-room — already connected with a user present, reusing ${activeRoomName}`);
+                return activeRoomName;
+            }
+            console.log('🔌 /connect-room — active room is empty; tearing down + creating fresh');
+            await destroyRoomSession('connect-room replacing empty session');
         }
+        const targetRoomName = buildRoomName();
+        console.log(`🔌 /connect-room — creating fresh room session: ${targetRoomName}`);
+        await createRoomSession(targetRoomName);
+        return targetRoomName;
     };
-    // 0.9.73: explicit frontend leave should also start the idle-exit countdown —
-    // the user is done; the machine shouldn't idle-bill waiting for a maybe-return.
-    // (leaveRoomHook sets intentionalLeave → Disconnected handler arms it, but
-    //  arm here too in case the disconnect event is swallowed by a zombie WS.)
     leaveRoomHook = async (reason) => {
         if (aloneTimer) {
             clearTimeout(aloneTimer);
             aloneTimer = null;
         }
-        if (livekitState.status !== 'connected')
+        if (!activeRoom)
             return; // already out — no-op
         // Never abandon a user who is CURRENTLY in the room. Stale/racing
         // leave-room calls (a previous client's teardown landing after a new
         // client joined) were kicking the agent out mid-adopt, stranding the new
         // user on "Connecting..." (observed 2026-07-28). The alone-timer handles
         // the real departure when they actually leave.
-        if (room.remoteParticipants.size > 0) {
-            console.log(`🛑 /leave-room ignored (${reason}) — ${room.remoteParticipants.size} participant(s) still in room`);
+        if (activeRoom.remoteParticipants.size > 0) {
+            console.log(`🛑 /leave-room ignored (${reason}) — ${activeRoom.remoteParticipants.size} participant(s) still in room`);
             return;
         }
-        intentionalLeave = true;
-        console.log(`🚪 Leaving LiveKit room (${reason}) — stops connection-minute burn`);
-        armIdleExitTimer(`explicit leave (${reason})`);
-        try {
-            await room.disconnect();
-        }
-        catch (e) {
-            console.error('leave-room room.disconnect failed:', e);
-        }
+        console.log(`🚪 /leave-room (${reason}) — destroying room session`);
+        await destroyRoomSession(`explicit leave (${reason})`);
     };
     // bug-reporter skill hook — forwards a validated bug payload to the frontend
     // via the LiveKit data channel. Frontend (which holds the Supabase keys for
@@ -4887,18 +5001,19 @@ async function main() {
             },
         }).catch((e) => console.error('❌ bugReportHook sendToFrontend failed:', e));
     };
-    // Fire and forget; the retry loop keeps the process alive on its own (so
-    // we don't need the explicit `new Promise(() => {})` keepalive anymore).
-    // Errors that escape the retry loop should never happen, but if they do,
-    // log them rather than crash.
-    connectWithRetry().catch(err => {
-        console.error('❌ Unrecoverable error in LiveKit retry loop (should not happen):', err);
-        livekitState.status = 'failed';
-        livekitState.error = err instanceof Error ? err.message : String(err);
-        livekitState.errorCode = 'unrecoverable';
-    });
+    // 0.9.83: boot IDLE — do NOT eager-connect to LiveKit at startup. Under the
+    // fresh-Room-per-session model there is no persistent room to join at boot;
+    // the agent only joins when a user arrives via POST /connect-room (which
+    // awaits createRoomSession). This also removes the old boot-time
+    // connectWithRetry() eager connect entirely. The idle-exit timer is armed so
+    // a machine that boots but never receives a /connect-room still stops itself
+    // (billing protection) instead of idling forever.
+    livekitState.status = 'idle';
+    console.log('🟢 Agent booted — idle, awaiting POST /connect-room to join LiveKit');
+    armIdleExitTimer('boot idle (no session yet)');
     // Keep main() alive forever — without this the await chain ends and Node
-    // exits 0, which Fly treats as a clean shutdown.
+    // exits 0, which Fly treats as a clean shutdown. The HTTP API server + timers
+    // keep the process responsive.
     await new Promise(() => { });
 }
 // Run

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.81",
+  "version": "0.9.83",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {