sensorium-mcp 3.1.2 → 3.1.3-board.10

package/dist/tools/wait/poll-loop.js

@@ -18,14 +18,16 @@ import { readFile, rename, unlink } from "node:fs/promises";
 import { join } from "node:path";
 import { checkMaintenanceFlag, writeActivityHeartbeat, writeThreadHeartbeatSync, } from "../../data/file-storage.js";
 import { onMaintenanceSignal, markMaintenanceObserved, clearMaintenanceObserved, } from "../../services/maintenance-signal.js";
-import { getEffectiveAgentType, getEffectiveAutonomousMode, } from "../../services/thread-config.service.js";
+import { getEffectiveAutonomousMode } from "../../services/thread-config.service.js";
 import { peekThreadMessages } from "../../services/dispatcher/index.js";
 import { log } from "../../lib/logger.js";
 import { getShortReminder, buildMaintenanceResponse } from "../response-builders.js";
 import { ThreadState } from "../../services/thread-lifecycle.service.js";
-import { PENDING_TASKS_DIR, markTaskConsumed } from "../../services/process.service.js";
-import { isWorkerInGrace } from "../../services/worker-cleanup.service.js";
-import { isSessionSuperseded, reconcileThreadOwnership } from "../../sessions/mcp-registry.js";
+import { PENDING_TASKS_DIR } from "../../services/process.service.js";
+import { Optional } from "../../data/optional.js";
+import { markWorkerTaskConsumed } from "../../data/memory/worker-lifecycle.repository.js";
+import { takeWorkerDeathNotice } from "../../services/passive-notice.service.js";
+import { isSessionSuperseded, markThreadWaiting, reconcileThreadOwnership, unmarkThreadWaiting, } from "../../sessions/mcp-registry.js";
 import { handleReactionOnly } from "./reaction-handler.js";
 import { checkForDueTasks } from "./task-handler.js";
 import { processIncomingMessages, handlePollTimeout } from "./message-processing.js";
@@ -39,42 +41,105 @@ import { maybeAutoForwardFinalText } from "./auto-forward.js";
 // close. The set is shared with self-update (ACK-gated port close) and lives in
 // maintenance-signal.ts; this loop owns clearing it because the poll loop is the
 // only place that reads the flag continuously.
+// unref'd like every other background timer here (index.ts, orchestrator,
+// dispatcher poller, spawn-exit-watcher): clearing a stale flag must never be the
+// handle that keeps a process alive. The server's transport handles own its
+// lifetime; without this, merely IMPORTING this module pins the event loop open.
 setInterval(() => {
     if (checkMaintenanceFlag() === null) {
         clearMaintenanceObserved();
     }
-}, 30_000);
+}, 30_000).unref();
 // ---------------------------------------------------------------------------
 // Pending-task file helper
 // ---------------------------------------------------------------------------
 /**
  * Check for a pending task file written by send_message_to_thread.
- * If one exists, atomically consume it and return a ToolResult.
+ * If one exists, atomically consume it and return the ToolResult carrying it.
  * The file now contains pre-formatted structured messages (one-shot or
  * manager-worker), so we pass the content through as-is.
- * Returns null when no pending task is available.
+ * Empty when no pending task is available.
+ *
+ * `db` is here for one write: this is the single place a task is consumed, so it is
+ * the single place that records the consumption durably. A thread that read its work
+ * must still read as having read it in the NEXT server process — see
+ * `markWorkerTaskConsumed`.
+ *
+ * ## Ordering: the claim and the content, never apart
+ *
+ * The steps are rename → read → RECORD → unlink → deliver, and a failure at the
+ * record leaves the `.processing` file for the next poll to ADOPT. That order is
+ * forced, in the shape inc E3a settled for the passive-notice store: nothing that
+ * makes the briefing unrecoverable may happen before the consumption fact is
+ * durable.
+ *
+ * The order used to be rename → read → UNLINK → record, and the record sits under
+ * the catch below. One failing SQLite write therefore returned empty with the
+ * mailbox AND the `.processing` file gone and no row written: a transient DB error
+ * permanently deleted a worker's briefing — the one thing a card worker cannot work
+ * without. The in-memory Set this column replaced had no such path, because it could
+ * not fail.
+ *
+ * Adoption is what makes the rename reversible, and it is required rather than
+ * decorative: nothing else in this codebase ever comes back for a `.processing`
+ * file. `deletePendingTaskMailbox` is the only other code that knows that name, and
+ * it only DELETES, at retirement — so "leave it behind on failure" is a remedy only
+ * once some path returns for it, and this is that path.
+ *
+ * On a failed record the task stays queued and the worker polls again in 2s; it is
+ * never "neither the task nor the record". Delivery is NOT conditional on the
+ * database being writable in the sense that matters: a blip costs a poll interval,
+ * not the briefing.
+ *
+ * What adoption pays for is duplicate DELIVERY, never loss, and the cost lands on the
+ * WORKER rather than on this column: it receives the same briefing twice and may ACT
+ * twice. Three states reach that — the unlink failed, the process died between the
+ * commit and the unlink, two pollers adopted one stranded file. The column is unmoved
+ * in all three, because `markWorkerTaskConsumed` keeps the FIRST timestamp.
+ *
+ * The number of extra deliveries is not one. A TRANSIENT unlink failure costs exactly
+ * one: the next poll adopts the file, delivers it, and unlinks it. An unlink that can
+ * NEVER succeed — file held open, permissions revoked — leaves a `.processing` that
+ * the fast pre-check counts as pending work on every poll, so the same briefing goes
+ * out every 2s for the life of this wait call, where the old order lost it exactly
+ * once. What keeps that narrow is the step before it: the write that recorded the
+ * consumption already succeeded, so a filesystem that cannot unlink the file it just
+ * let us rename and read is already misbehaving.
  */
-async function consumePendingTask(threadId) {
+async function consumePendingTask(db, threadId) {
     const pendingTaskPath = join(PENDING_TASKS_DIR, `${threadId}.txt`);
-    // Fast pre-check to avoid unnecessary rename attempts every 2s
-    if (!existsSync(pendingTaskPath))
-        return null;
+    const claimedPath = pendingTaskPath + ".processing";
+    // Fast pre-check to avoid unnecessary rename attempts every 2s. A `.processing`
+    // file counts as pending work: it is an unfinished consumption, not litter.
+    if (!existsSync(pendingTaskPath) && !existsSync(claimedPath))
+        return Optional.empty();
     try {
-        const tmpPath = pendingTaskPath + ".processing";
-        await rename(pendingTaskPath, tmpPath);
-        const taskContent = (await readFile(tmpPath, "utf-8")).trim();
+        // The rename is the claim, and it is atomic between this loop's two arms and
+        // between racing sessions. A `.processing` that is already there is a claim an
+        // earlier pass took and did not finish: adopt it rather than renaming onto it.
+        if (existsSync(pendingTaskPath))
+            await rename(pendingTaskPath, claimedPath);
+        const taskContent = (await readFile(claimedPath, "utf-8")).trim();
+        // Record the consumption durably, so the worker-exit handler never respawns a
+        // worker that already did work — including after a server restart, which the
+        // in-memory Set this replaces could not survive, and across which the exit
+        // watcher still observes a worker that outlived it. Also guards against the
+        // duplicate posts a late mailbox append used to cause by recreating the file.
+        //
+        // BEFORE the unlink: a throw here returns empty with the content still sitting in
+        // `.processing`, which the next poll adopts. After the unlink, the same throw
+        // would have deleted the briefing outright.
+        markWorkerTaskConsumed(db, threadId, Date.now());
         try {
-            await unlink(tmpPath);
+            await unlink(claimedPath);
         }
         catch {
-            /* ignore cleanup errors */
+            /* ignore cleanup errors — the fact is already durable, so a surviving
+               .processing costs re-delivery and never the task; the ordering note above
+               says how much re-delivery */
         }
-        // Mark this thread's task as consumed so the worker-exit handler never
-        // respawns a worker that already did work (guards against duplicate posts
-        // when a late mailbox append recreates the pending-task file).
-        markTaskConsumed(threadId);
         log.info(`[wait] Injecting pending task for thread ${threadId} (${taskContent.length} chars)`);
-        return {
+        return Optional.of({
             content: [
                 {
                     type: "text",
@@ -83,14 +148,34 @@ async function consumePendingTask(threadId) {
                         `<<< END CROSS-THREAD MESSAGE >>>`,
                 },
             ],
-        };
+        });
     }
     catch (err) {
         if (err?.code !== "ENOENT")
             log.warn(`[wait] Pending task read failed: ${err}`);
-        return null; // File doesn't exist or read error
+        // The file is gone, unreadable, or the consumption could not be recorded. In the
+        // last case the claimed `.processing` file still holds the task and the next poll
+        // adopts it, so returning empty costs a poll interval and not the briefing.
+        return Optional.empty();
     }
 }
+/** A worker's death notice, delivered as its own inbox message — the way the
+ *  worker's reply would have arrived. One per wait call, oldest first. */
+function consumeDeathNotice(db, threadId) {
+    return takeWorkerDeathNotice(db, threadId).map((notice) => {
+        log.info(`[wait] Delivering a worker death notice to thread ${threadId}`);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `<<< CROSS-THREAD MESSAGE >>>
+${notice.text}
+<<< END CROSS-THREAD MESSAGE >>>`,
+                },
+            ],
+        };
+    });
+}
 // ---------------------------------------------------------------------------
 // Handler
 // ---------------------------------------------------------------------------
@@ -126,13 +211,7 @@ export async function handleWaitForInstructions(args, ctx, extra) {
     }
     const callNumber = ++state.waitCallCount;
     const timeoutMs = WAIT_TIMEOUT_MINUTES * 60 * 1000;
-    // Codex CLI enforces a hard ~120s tool-call timeout and does not handle
-    // SSE keepalive progress notifications. Cap the loop to 90s so we always
-    // return a valid response before the Codex client gives up.
-    const agentType = getEffectiveAgentType(effectiveThreadId);
-    const isShortTimeoutClient = agentType === "codex" || agentType === "openai_codex";
-    const effectiveTimeoutMs = isShortTimeoutClient ? 90_000 : timeoutMs;
-    const deadline = Date.now() + effectiveTimeoutMs;
+    const deadline = Date.now() + timeoutMs;
     // ── Pending task injection (pre-loop check) ────────────────────────────
     // If start_thread or send_message_to_thread wrote a task file for this
     // thread, deliver it immediately — but only if this session is still active.
@@ -152,9 +231,12 @@ export async function handleWaitForInstructions(args, ctx, extra) {
             ],
         };
     }
-    const preLoopTask = await consumePendingTask(effectiveThreadId);
-    if (preLoopTask)
-        return preLoopTask;
+    const preLoopTask = await consumePendingTask(getMemoryDb(), effectiveThreadId);
+    if (preLoopTask.has())
+        return preLoopTask.get();
+    const preLoopDeath = consumeDeathNotice(getMemoryDb(), effectiveThreadId);
+    if (preLoopDeath.has())
+        return preLoopDeath.get();
     // Poll the dispatcher's per-thread file instead of calling getUpdates
     // directly. This avoids 409 conflicts between concurrent instances.
     const POLL_INTERVAL_MS = 2000;
@@ -173,245 +255,263 @@ export async function handleWaitForInstructions(args, ctx, extra) {
     // echoing requestId there fails to match, the keepalive never resets its
     // timeout, and the call dies at ~60s. Echo the client's token when present.
     const progressToken = extra._meta?.progressToken ?? extra.requestId;
-    while (Date.now() < deadline) {
-        try {
-            // Bail out if this session has been superseded by a newer session for the
-            // same thread. Without this, a zombie session races the active one for
-            // messages — consuming them but responding with degraded/stale context.
-            const currentSid = ctx.getMcpSessionId?.();
-            if (isSessionSuperseded(currentSid, effectiveThreadId)) {
-                log.warn(`[wait] Session ${currentSid?.slice(0, 8)}… superseded for thread ${effectiveThreadId} — terminating poll loop.`);
-                state.lastToolCallAt = Date.now();
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: "Session terminated — a newer session is now active for this thread. Do not call wait_for_instructions again.",
-                        },
-                    ],
-                };
-            }
-            // Bail out if the MCP transport signalled abort (client disconnected).
-            if (extra.signal.aborted) {
-                log.info(`[wait] Signal aborted for session ${currentSid?.slice(0, 8)}… thread ${effectiveThreadId} — client disconnected.`);
-                state.lastToolCallAt = Date.now();
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: "Client disconnected. Call wait_for_instructions again to resume.",
-                        },
-                    ],
-                };
-            }
-            // Bail out if the thread has been archived — graceful shutdown without kill.
-            if (Date.now() - lastArchivedCheck >= ARCHIVED_CHECK_INTERVAL_MS) {
-                lastArchivedCheck = Date.now();
-                // TTL grace window: the worker crossed its TTL and is winding down, but
-                // its MCP socket is deliberately kept open so it can finish THIS turn and
-                // deliver its final result before the cleanup service tears it down. This
-                // returns to the worker so it can still act (send its result) — a soft
-                // "finish then terminate" signal, not a hard stop.
-                if (isWorkerInGrace(effectiveThreadId)) {
-                    log.info(`[wait] Thread ${effectiveThreadId} is in TTL grace — instructing worker to finish and deliver its final result.`);
+    // ── Park mark ───────────────────────────────────────────────────────────
+    // From here until this call returns, the worker is PARKED: it is not working,
+    // it is waiting on us. The TTL sweep reads this to tell a working worker
+    // (defer teardown) from a parked one (tear down — parked is not work). Marked
+    // AFTER the pre-loop task consumption, which returns without ever waiting.
+    //
+    // The mark is filed under THIS call's owner identity (the same `preSid` the
+    // reconcile above just claimed ownership with), so a superseded session's
+    // residual mark can never speak for the replacement that owns the thread now.
+    //
+    // The returned key is released verbatim below — never recomputed, since a
+    // mid-wait token change would resolve to a different key and leak the mark.
+    //
+    // The unmark MUST be in a `finally`: every exit path — message delivered,
+    // superseded, aborted, grace, archived, maintenance, timeout — has to release
+    // it, or a worker that resumed working would still read as parked.
+    const parkKey = markThreadWaiting(effectiveThreadId, preSid);
+    try {
+        while (Date.now() < deadline) {
+            try {
+                // Bail out if this session has been superseded by a newer session for the
+                // same thread. Without this, a zombie session races the active one for
+                // messages — consuming them but responding with degraded/stale context.
+                const currentSid = ctx.getMcpSessionId?.();
+                if (isSessionSuperseded(currentSid, effectiveThreadId)) {
+                    log.warn(`[wait] Session ${currentSid?.slice(0, 8)}… superseded for thread ${effectiveThreadId} — terminating poll loop.`);
                     state.lastToolCallAt = Date.now();
                     return {
                         content: [
                             {
                                 type: "text",
-                                text: "This session is being archived. Finish your current task, send your final result to the orchestrator (send_message_to_thread), then terminate. Ignore any further orchestrator messages and do not call wait_for_instructions again.",
+                                text: "Session terminated — a newer session is now active for this thread. Do not call wait_for_instructions again.",
                             },
                         ],
                     };
                 }
-                const threadState = ctx.threadLifecycle.getThreadState(getMemoryDb(), effectiveThreadId);
-                if (threadState === ThreadState.Archived || threadState === ThreadState.Expired) {
-                    log.info(`[wait] Thread ${effectiveThreadId} is ${threadState} — instructing agent to exit.`);
+                // Bail out if the MCP transport signalled abort (client disconnected).
+                if (extra.signal.aborted) {
+                    log.info(`[wait] Signal aborted for session ${currentSid?.slice(0, 8)}… thread ${effectiveThreadId} — client disconnected.`);
                     state.lastToolCallAt = Date.now();
                     return {
                         content: [
                             {
                                 type: "text",
-                                text: "Session terminated. Thread has been archived. Do not call wait_for_instructions again — exit immediately.",
+                                text: "Client disconnected. Call wait_for_instructions again to resume.",
                             },
                         ],
                     };
                 }
-            }
-            // Check for pending update — tell agent to poll the supervisor's /ready
-            // endpoint over plain HTTP. CRITICAL: Do NOT tell agents to call any MCP tool
-            // on sensorium-mcp here — the server is about to die. buildMaintenanceResponse
-            // hands back a PowerShell poll loop against the supervisor (survives the
-            // restart), with an external sleep as the last-resort fallback.
-            const maintenanceInfo = checkMaintenanceFlag();
-            if (maintenanceInfo) {
-                log.info(`[wait] Maintenance flag detected: ${maintenanceInfo}`);
-                // Record that this thread observed maintenance. This both (a) fires the
-                // Telegram notification once per thread across all wait_for_instructions
-                // calls, and (b) tells self-update this agent has backed off so the port
-                // close can proceed (ACK-gated). markMaintenanceObserved returns true only
-                // on the first observation this cycle.
-                const tgKey = effectiveThreadId ?? 0;
-                if (markMaintenanceObserved(tgKey)) {
-                    let version = "unknown";
-                    try {
-                        version = JSON.parse(maintenanceInfo).version ?? version;
+                // Bail out if the thread has been archived — graceful shutdown without kill.
+                if (Date.now() - lastArchivedCheck >= ARCHIVED_CHECK_INTERVAL_MS) {
+                    lastArchivedCheck = Date.now();
+                    const threadState = ctx.threadLifecycle.getThreadState(getMemoryDb(), effectiveThreadId);
+                    if (threadState === ThreadState.Archived || threadState === ThreadState.Expired) {
+                        log.info(`[wait] Thread ${effectiveThreadId} is ${threadState} — instructing agent to exit.`);
+                        state.lastToolCallAt = Date.now();
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: "Session terminated. Thread has been archived. Do not call wait_for_instructions again — exit immediately.",
+                                },
+                            ],
+                        };
                     }
-                    catch {
-                        /* not JSON or missing field */
+                }
+                // Check for pending update — tell agent to poll the supervisor's /ready
+                // endpoint over plain HTTP. CRITICAL: Do NOT tell agents to call any MCP tool
+                // on sensorium-mcp here — the server is about to die. buildMaintenanceResponse
+                // hands back a PowerShell poll loop against the supervisor (survives the
+                // restart), with an external sleep as the last-resort fallback.
+                const maintenanceInfo = checkMaintenanceFlag();
+                if (maintenanceInfo) {
+                    log.info(`[wait] Maintenance flag detected: ${maintenanceInfo}`);
+                    // Record that this thread observed maintenance. This both (a) fires the
+                    // Telegram notification once per thread across all wait_for_instructions
+                    // calls, and (b) tells self-update this agent has backed off so the port
+                    // close can proceed (ACK-gated). markMaintenanceObserved returns true only
+                    // on the first observation this cycle.
+                    const tgKey = effectiveThreadId ?? 0;
+                    if (markMaintenanceObserved(tgKey)) {
+                        let version = "unknown";
+                        try {
+                            version = JSON.parse(maintenanceInfo).version ?? version;
+                        }
+                        catch {
+                            /* not JSON or missing field */
+                        }
+                        telegram
+                            .sendMessage(telegramChatId, `\u26A0\uFE0F Server update: v${version} deploying. Agent sessions will reconnect after update.`, undefined, effectiveThreadId)
+                            .catch((err) => {
+                            log.warn(`[poll] Maintenance notification failed for thread ${effectiveThreadId}: ${err instanceof Error ? err.message : err}`);
+                        });
                     }
-                    telegram
-                        .sendMessage(telegramChatId, `\u26A0\uFE0F Server update: v${version} deploying. Agent sessions will reconnect after update.`, undefined, effectiveThreadId)
-                        .catch((err) => {
-                        log.warn(`[poll] Maintenance notification failed for thread ${effectiveThreadId}: ${err instanceof Error ? err.message : err}`);
-                    });
+                    return buildMaintenanceResponse(effectiveThreadId, getShortReminder(effectiveThreadId, state.sessionStartedAt));
                 }
-                return buildMaintenanceResponse(effectiveThreadId, getShortReminder(effectiveThreadId, state.sessionStartedAt));
-            }
-            // Peek first (non-destructive) to avoid consuming messages when the
-            // SSE connection may be dead.
-            const peeked = peekThreadMessages(effectiveThreadId);
-            if (peeked.length > 0) {
-                return processIncomingMessages(effectiveThreadId, peeked.length, ctx, extra);
-            }
-            // ── Reaction-only wake-up ───────────────────────────────────────
-            // Guard: don't consume the reaction file if the SSE connection is
-            // already dead — readPendingReaction() is destructive (read + delete).
-            // Without this check the reaction is eaten but never delivered.
-            if (!extra.signal.aborted &&
-                !isSessionSuperseded(ctx.getMcpSessionId?.(), effectiveThreadId)) {
-                const reactionResult = await handleReactionOnly({
-                    telegram,
-                    getMemoryDb,
-                    effectiveThreadId,
-                    sessionStartedAt: state.sessionStartedAt,
-                    autonomousMode: getEffectiveAutonomousMode(effectiveThreadId),
-                });
-                if (reactionResult)
-                    return reactionResult;
-            }
-            // ── Pending task injection (in-loop) ─────────────────────────────────────────
-            // Check for tasks sent via send_message_to_thread while we're already
-            // polling.  Without this, messages arrive only on the NEXT
-            // wait_for_instructions call, causing a "no instructions" gap.
-            if (!extra.signal.aborted &&
-                !isSessionSuperseded(ctx.getMcpSessionId?.(), effectiveThreadId)) {
-                const inLoopTask = await consumePendingTask(effectiveThreadId);
-                if (inLoopTask)
-                    return inLoopTask;
-            }
-            // Check scheduled tasks every ~60s during idle polling.
-            if (effectiveThreadId !== undefined && Date.now() - lastScheduleCheck >= 60_000) {
-                lastScheduleCheck = Date.now();
-                const taskResult = checkForDueTasks(ctx, effectiveThreadId);
-                if (taskResult)
-                    return taskResult;
-            }
-            // ── In-loop drive activation check (every 30 min) ──────────────────
-            // Without this, the drive only fires on poll TIMEOUT (every 2h default).
-            // Checking inside the loop ensures consistent activation during long polls.
-            if (effectiveThreadId !== undefined &&
-                getEffectiveAutonomousMode(effectiveThreadId) &&
-                Date.now() - lastDriveCheck >= DRIVE_CHECK_INTERVAL_MS) {
-                lastDriveCheck = Date.now();
-                runAutoConsolidation({
-                    state,
-                    effectiveThreadId,
-                    getMemoryDb,
-                    apiKey: config.OPENAI_API_KEY || undefined,
-                    config,
-                    memoryRefresh: "",
-                    scheduleHint: "",
-                });
-                const driveResult = checkDriveActivation({
-                    state,
-                    effectiveThreadId,
-                    getMemoryDb,
-                    apiKey: config.OPENAI_API_KEY || undefined,
-                    config,
-                    memoryRefresh: "",
-                    scheduleHint: "",
-                });
-                if (driveResult)
-                    return driveResult;
-            }
-            // No messages yet — sleep briefly and check again.
-            // Send SSE keepalive to prevent silent connection death during long polls.
-            if (Date.now() - lastKeepalive >= SSE_KEEPALIVE_INTERVAL_MS) {
-                lastKeepalive = Date.now();
-                state.lastToolCallAt = Date.now();
-                try {
-                    await extra.sendNotification({
-                        method: "notifications/progress",
-                        params: {
-                            progressToken,
-                            progress: 0,
-                            total: 0,
-                        },
+                // Peek first (non-destructive) to avoid consuming messages when the
+                // SSE connection may be dead.
+                const peeked = peekThreadMessages(effectiveThreadId);
+                if (peeked.length > 0) {
+                    return processIncomingMessages(effectiveThreadId, peeked.length, ctx, extra);
+                }
+                // ── Reaction-only wake-up ───────────────────────────────────────
+                // Guard: don't consume the reaction file if the SSE connection is
+                // already dead — readPendingReaction() is destructive (read + delete).
+                // Without this check the reaction is eaten but never delivered.
+                if (!extra.signal.aborted &&
+                    !isSessionSuperseded(ctx.getMcpSessionId?.(), effectiveThreadId)) {
+                    const reactionResult = await handleReactionOnly({
+                        telegram,
+                        getMemoryDb,
+                        effectiveThreadId,
+                        sessionStartedAt: state.sessionStartedAt,
+                        autonomousMode: getEffectiveAutonomousMode(effectiveThreadId),
                     });
+                    if (reactionResult)
+                        return reactionResult;
                 }
-                catch {
-                    // If notification fails, the SSE stream is already dead.
-                    // Return immediately so the agent can reconnect.
-                    log.warn(`[wait] SSE keepalive failed — connection dead. Returning early.`);
-                    state.lastToolCallAt = Date.now();
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: "The connection was interrupted. Please call wait_for_instructions again immediately to resume polling.",
-                            },
-                        ],
-                    };
+                // ── Pending task injection (in-loop) ─────────────────────────────────────────
+                // Check for tasks sent via send_message_to_thread while we're already
+                // polling.  Without this, messages arrive only on the NEXT
+                // wait_for_instructions call, causing a "no instructions" gap.
+                if (!extra.signal.aborted &&
+                    !isSessionSuperseded(ctx.getMcpSessionId?.(), effectiveThreadId)) {
+                    const inLoopTask = await consumePendingTask(ctx.getMemoryDb(), effectiveThreadId);
+                    if (inLoopTask.has())
+                        return inLoopTask.get();
+                    const inLoopDeath = consumeDeathNotice(ctx.getMemoryDb(), effectiveThreadId);
+                    if (inLoopDeath.has())
+                        return inLoopDeath.get();
                 }
-            }
-            await new Promise((resolve) => {
-                let resolved = false;
-                let unsubMaintenance = null;
-                const done = () => {
-                    if (!resolved) {
-                        resolved = true;
-                        clearTimeout(timer);
-                        unsubMaintenance?.();
-                        resolve();
-                    }
-                };
-                const timer = setTimeout(done, POLL_INTERVAL_MS);
-                // Wake up immediately if the maintenance flag is written — don't wait
-                // for the next 2s tick, which could be too late if killServer() follows
-                // immediately after the flag is written.
-                unsubMaintenance = onMaintenanceSignal(done);
-                if (!extra.signal.aborted) {
-                    extra.signal.addEventListener("abort", done, { once: true });
+                // Check scheduled tasks every ~60s during idle polling.
+                if (effectiveThreadId !== undefined && Date.now() - lastScheduleCheck >= 60_000) {
+                    lastScheduleCheck = Date.now();
+                    const taskResult = checkForDueTasks(ctx, effectiveThreadId);
+                    if (taskResult)
+                        return taskResult;
                 }
-                else {
-                    done();
+                // ── In-loop drive activation check (every 30 min) ──────────────────
+                // Without this, the drive only fires on poll TIMEOUT (every 2h default).
+                // Checking inside the loop ensures consistent activation during long polls.
+                if (effectiveThreadId !== undefined &&
+                    getEffectiveAutonomousMode(effectiveThreadId) &&
+                    Date.now() - lastDriveCheck >= DRIVE_CHECK_INTERVAL_MS) {
+                    lastDriveCheck = Date.now();
+                    runAutoConsolidation({
+                        state,
+                        effectiveThreadId,
+                        getMemoryDb,
+                        apiKey: config.OPENAI_API_KEY || undefined,
+                        config,
+                        memoryRefresh: "",
+                        scheduleHint: "",
+                    });
+                    const driveResult = checkDriveActivation({
+                        state,
+                        effectiveThreadId,
+                        getMemoryDb,
+                        apiKey: config.OPENAI_API_KEY || undefined,
+                        config,
+                        memoryRefresh: "",
+                        scheduleHint: "",
+                    });
+                    if (driveResult)
+                        return driveResult;
                 }
-            });
-            writeActivityHeartbeat();
-            if (effectiveThreadId !== undefined) {
-                writeThreadHeartbeatSync(effectiveThreadId);
-                // Update thread_registry.lastActiveAt periodically (not on every poll
-                // iteration — every 60s is enough for reconnect detection).
-                if (Date.now() - lastRegistryUpdate > 60_000) {
-                    lastRegistryUpdate = Date.now();
+                // No messages yet — sleep briefly and check again.
+                // Send SSE keepalive to prevent silent connection death during long polls.
+                if (Date.now() - lastKeepalive >= SSE_KEEPALIVE_INTERVAL_MS) {
+                    lastKeepalive = Date.now();
+                    state.lastToolCallAt = Date.now();
                     try {
-                        ctx.threadLifecycle.touchThread(getMemoryDb(), effectiveThreadId, {
-                            lastActiveAt: new Date().toISOString(),
+                        await extra.sendNotification({
+                            method: "notifications/progress",
+                            params: {
+                                progressToken,
+                                progress: 0,
+                                total: 0,
+                            },
                         });
                     }
-                    catch (err) {
-                        log.debug(`[poll] Heartbeat update failed for thread ${effectiveThreadId}: ${err instanceof Error ? err.message : err}`);
+                    catch {
+                        // If notification fails, the SSE stream is already dead.
+                        // Return immediately so the agent can reconnect.
+                        log.warn(`[wait] SSE keepalive failed — connection dead. Returning early.`);
+                        state.lastToolCallAt = Date.now();
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: "The connection was interrupted. Please call wait_for_instructions again immediately to resume polling.",
+                                },
+                            ],
+                        };
+                    }
+                }
+                await new Promise((resolve) => {
+                    let resolved = false;
+                    // A no-op until onMaintenanceSignal hands back the real unsubscribe below:
+                    // `done` closes over this before the subscription exists, and a done() that
+                    // fires first has nothing to unsubscribe.
+                    let unsubMaintenance = () => { };
+                    const done = () => {
+                        if (!resolved) {
+                            resolved = true;
+                            clearTimeout(timer);
+                            unsubMaintenance();
+                            resolve();
+                        }
+                    };
+                    const timer = setTimeout(done, POLL_INTERVAL_MS);
+                    // Wake up immediately if the maintenance flag is written — don't wait
+                    // for the next 2s tick, which could be too late if killServer() follows
+                    // immediately after the flag is written.
+                    unsubMaintenance = onMaintenanceSignal(done);
+                    if (!extra.signal.aborted) {
+                        extra.signal.addEventListener("abort", done, { once: true });
+                    }
+                    else {
+                        done();
+                    }
+                });
+                // A transport can close while the two-second poll sleep is resolving.
+                // Do not let that retired session write one final heartbeat: it would
+                // mask the dead agent from keeper until the next liveness check.
+                if (extra.signal.aborted ||
+                    isSessionSuperseded(ctx.getMcpSessionId?.(), effectiveThreadId)) {
+                    continue;
+                }
+                writeActivityHeartbeat();
+                if (effectiveThreadId !== undefined) {
+                    writeThreadHeartbeatSync(effectiveThreadId);
+                    // Update thread_registry.lastActiveAt periodically (not on every poll
+                    // iteration — every 60s is enough for reconnect detection).
+                    if (Date.now() - lastRegistryUpdate > 60_000) {
+                        lastRegistryUpdate = Date.now();
+                        try {
+                            ctx.threadLifecycle.touchThread(getMemoryDb(), effectiveThreadId, {
+                                lastActiveAt: new Date().toISOString(),
+                            });
+                        }
+                        catch (err) {
+                            log.debug(`[poll] Heartbeat update failed for thread ${effectiveThreadId}: ${err instanceof Error ? err.message : err}`);
+                        }
                     }
                 }
             }
+            catch (loopErr) {
+                log.error(`Poll loop error: ${loopErr instanceof Error ? loopErr.message : String(loopErr)}`);
+                continue;
+            }
         }
-        catch (loopErr) {
-            log.error(`Poll loop error: ${loopErr instanceof Error ? loopErr.message : String(loopErr)}`);
-            continue;
-        }
+        // Timeout elapsed with no actionable message.
+        return handlePollTimeout(effectiveThreadId, callNumber, ctx);
+    }
+    finally {
+        unmarkThreadWaiting(effectiveThreadId, parkKey);
     }
-    // Timeout elapsed with no actionable message.
-    return handlePollTimeout(effectiveThreadId, callNumber, ctx);
 }
 //# sourceMappingURL=poll-loop.js.map