Gateway fixes (#134889), package 10: the gateway process, clients that fall behind, credentials and settings, Desktop session lists and history, and messaging order #140719

Part of #134889, the post-merge fixes for the unified gateway (#106742). This package collects 41 open findings in 5 lanes, most of them reported on Oct 17 after package 9 opened. None of them is in another package, none touches work another open package is changing, and none needs a maintainer decision. It's written to run unattended. Each lane is one kind of fix in one part of the code, so the lanes can run in parallel and sub-agents can fan out inside each lane. Start with GW-17 in lane 1 (bot messages acknowledged and lost) and RT-43 in lane 4 (a conversation stuck for good).

Sibling packages: #139158 (package 1, classic CLI) · #139160 (package 2, session creation, model picks and credentials) · #139161 (package 3, Ink TUI and Desktop) · #139162 (package 4, bots, cron and Kanban; closed, done) · #139523 (package 5, plugins and config the gateway reads once; closed, done) · #139574 (package 6, gateway, TUI and Desktop startup; closed, done) · #140138 (package 7, ACP, session writes and resume, bots, and Desktop capabilities; closed, done) · #140208 (package 8, deleted and older sessions, silent failures, commands, profile isolation and Desktop display; closed, done) · #140337 (package 9, detach and lost connections, Ink and Desktop leftovers, classic CLI leftovers, Windows, and new regressions; closed, done).

Direction: follow #106742

Every fix in this package must honor the vision and direction of the one-gateway PR, #106742 (feat/unified-gateway-runtime, merged to main on Oct 14). Read its description before starting, and put this section in the brief of every sub-agent you spawn.

• One gateway owns every local session: one FIFO, one durable queue, one writer. Fix the gateway path. Don't bring back a client-side agent, a local fallback, or a second writer to state.db.
• Clients only read and submit. A missing capability gets a gateway handler or a named refusal, not client-side state.
• Keep the contract: queued admissions survive an owner restart and run FIFO exactly once; a started admission that loses its owner becomes interrupted and is never replayed automatically; a retry reuses the original admission identity and payload.
• Profile, provider, generation and revision boundaries hold on every transport.
• Design calls are yours to make. Pick the option that best fits this design, and write the choice and the reason in the PR body. Stop and ask on Tracking: one gateway owns every local session (#106742) — post-merge fixes #134889 only when every option would break one of the rules above.

Working rules

• Branch from current main. 🟡 rows haven't been reproduced: reproduce on main first. A row that doesn't reproduce gets no commit; put the evidence (file:line, the probe test) in the lane's PR body and say so on Tracking: one gateway owns every local session (#106742) — post-merge fixes #134889.
• Written for unattended runs: don't wait for answers. When a row leaves a choice open, decide by the Direction section above and record why in the PR body. If a row turns out to need a maintainer decision, or to change code another open package is changing, skip it and say so on Tracking: one gateway owns every local session (#106742) — post-merge fixes #134889 instead of guessing.
• Rows marked "not triaged yet" (PLG-13, KB-7, RT-45) or "suspected" / "probable" (CLI-38, RT-38) need the cause confirmed first. Write the probe, and fix only what it shows.
• Lanes touch different code, so they can run in parallel in separate worktrees. Open one PR per lane (split a lane if it grows), each with a failing test first.
• Sub-agents: one per row works, up to ten at once. Rows in the same lane share files, so tell each sub-agent which function or clause it owns, then assemble the lane's commits on one branch.
• Name the row ID in each PR (Refs #134889 (GW-17)) and reference this issue. Fixes is fine for a row's own bug report (e.g. Fixes #140564), never for Tracking: one gateway owns every local session (#106742) — post-merge fixes #134889.
• An open PR from an outside contributor doesn't cover a row. Every outside PR listed below allows maintainer edits. Review it. If it's right, finish it on the contributor's branch, or salvage it: cherry-pick their commit unchanged (git cherry-pick -x) so they stay its author, and add your work on top. Use Co-authored-by only for code you rebuilt rather than reused. If it's wrong or stale, fix the row fresh and say why on that PR, then close it with a credit note.
• A fix not run against what it targets (the Desktop app, a gateway serving several profiles, a real bot platform, macOS launchd, an install upgraded from an older version) uses Refs, not Fixes, and the PR says what still needs a live retest.
• Steps, evidence and code locations are in the triage comments linked in each row and under each section of the tracker's open findings.

Findings

Done (Oct 18): all seven lane PRs are merged to main (#140967, #140968, #140969, #140970, #140971, #140972, #140973). Fixed rows are in the tracker's Fixed on main continuation. @dokterdok's round-2 review fixes for lanes 1, 2, 3a, 3b and 5 did not go in with the lanes; they are on fix/pkg10-followups-main, not yet on main.

Status: 🟡 static read or user report, not reproduced yet · 🟢 fixed on main · ⚪ not reproduced or closed on main

Lane 1: The gateway process: restart, idle exit, parked profiles and managed workers

What the owning gateway does around its own lifetime and the profiles it serves. GW-14 is the macOS launchd relaunch after a downgrade stop (gateway/runtime_downgrade_exit.py), GW-15 counts /bg, /btw and preview side agents as owner work (gateway/session_tui_side.py), GW-16 is idle exit on a multiplexed gateway (gateway/run_idle_exit.py), and GW-17 is a parked secondary profile acknowledging messages it never admits; build on GW-12's notice (#140232, merged). PLG-13 is built-in tools registering into the launch home only, so other profiles get none. KB-6 and KB-7 are managed-worker identity and admission timing. T23's cause is known (a lock-order deadlock inside logging, found in #140230's CI run); fix the ordering, not the timeout.

Lane 2: Clients that fall behind, reconnect or wait

One fix type: a client that misses events, sees a slow reply or reconnects must recover from the gateway, not fail the turn. GW-18 is tui_gateway/ws.py running one request at a time per connection; CLI-35 and CLI-37 are the classic CLI and Kanban client treating a replay gap or a full event queue as a lost connection; ACP-19 refuses from a stale cached snapshot; RT-37 is Desktop retrying SESSION_NOT_OWNED with no backoff; LC-23 and LC-24 are the API session door (an overflow reset that collides with the door's restore, and missing tool frames on chat/stream). The classic CLI's files are shared with #139158: package 1's #140675 changes _resubscribe in hermes_cli/gateway_connection.py, so CLI-35 must not edit that function.

Lane 3: Credentials, grants and per-session settings that don't stick

A setting, key or grant that a session or profile should keep is dropped or never applied. LC-20 is launch secrets released while a /branch child still uses them (release_launch_secrets); #140264 was meant for package 8, which closed without it. CLI-36 is /model --once (a one-turn override on the admission, not a shared-session switch), MP-16 a reasoning pick on a profile-following Bot Chat, CLI-39 the Docker backend's per-session cwd, CMD-2 the gateway refusing /voice tts by name (the classic CLI's own /voice is #139158's T1; leave it). CFG-11 is a managed worker's first "Always" approval. PLG-12, DB-5 and DB-6 are grants for secondary-profile and profile-registry routes; fix DB-5 and DB-6 together. PLG-12 has three outside PRs: pick the best, credit the others when closing them.

Lane 4: Desktop session lists, history and identity across compression

One cluster: a session must keep one identity, and its full history, across compression, rewind, adoption and paging. RT-39 (resume shows only the summary) and RT-44 (a rewind above a compaction boundary empties the transcript) are the history half; LC-22 (rename and archive of a cold compressed session) and CLI-38 (subagents lost when compression rotates the session id) the identity half; RT-41 (pre-cutover Desktop sessions can't be resumed), RT-42 (paged all-profiles list), RT-43 (ws_orphan_reap mid-turn), RT-36 (deleted sessions come back; read the attached logs and retest on a build with #140191 first), RT-38 (Bots tab after update) and RT-45 ("All profiles" switched off at boot) are the session-list half. #140450 for RT-39 also edits Desktop slash-session-commands.ts, gateway/session_controls.py and gateway/session_tui_ops.py, which package 3's #140382 changes; take only its display-history fix.

Lane 5: Messaging order and Bot Chat

One fix type: what arrives in a chat runs in arrival order through the durable FIFO, exactly once, on the conversation it was sent to. MSG-23 (media staged before admission), MSG-25 (a message sent right before /new), MSG-26 (one-at-a-time platforms stall on a busy burst) and MSG-27 (slash commands skip the FIFO) are ordering; MSG-24 is a cancelled media capture that leaks its lease; MSG-21 and MSG-22 are Bot Chat creation and adoption, and share one outside PR (#140471), so fix them together. These need a real bot platform for the live retest; the unit tests use the existing adapter fixtures.

Not in this package

• Overlap with work in an open package: CLI-34 (its fix and fix(cli): re-supply the launch key when the classic CLI resumes a session #140348 change _resubscribe, which package 1's fix(cli): a /resume or /sessions switch subscribes the session it lands on (CLI lane 1, salvage #138700) #140675 is changing); RT-40 (Desktop /undo and /retry after a lost reply, the same handler as package 3's T12, under review in fix(gateway,desktop): /undo and /retry mid-reply say to stop first; editing an interrupted message replaces it #140382).
• Out of this cutover's scope: DB-7 (Desktop in URL, Cloud or SSH mode talks to standalone hermes serve; outside PR fix(gateway): replay missed events and prompts after a legacy reconnect #140456). Whether this tracker takes it needs a maintainer call.
• Need a maintainer decision, or someone is already on it: the rows package 9 listed (GW-1, GW-10, F1, T7, MSG-15, MP-13, ACP-7, T22, TUI-14, TUI-16, CLI-9, T9, MP-12, RT-21, KB-2).
• These rows stay on Tracking: one gateway owns every local session (#106742) — post-merge fixes #134889.

Done when

Every row has a merged PR, a live-check result, or a note on #134889 that it doesn't reproduce on main.