Go-Standalone spawn hardening: never park the window on a failed spawn

[aarontrowbridge]

Important

Problem

The Go-Standalone flow clears the fleet attach poll before spawning the local server. If the spawn fails — exactly what happened on 2026-09-03 when the vendored binary crashed on a drifted local DB — the window is left dead: no poll, no server, no banner, unrecoverable without a reload. And the failure surfaces as a generic "failed to start within 30 s" that hides the actual cause.

Approach

Keep the attach poll alive until the local server is actually healthy; on spawn failure, restore polling and re-offer with backoff. Recognize the known crash signature (a local-DB schema/migration failure) in the spawn error path and surface it with the journal self-heal fix inline instead of the generic timeout message.

Approaches Considered

• Fix the ordering + surface the known failure signature (chosen) — mechanical, addresses the exact observed death mode.
• Full local-DB pre-flight health check before spawn — more proactive but depends on the guarded-binary work tracked in ops hardening: swap must archive the outgoing binary; refuse non-release candidates; smoke needs a soak; finish fleet-status systemd port on erlich #776; deferred there.
• Leave it and rely on the "window reload reattaches" folklore — that folklore is the bug.

Scope

In: poll lifetime relative to spawn success; failure-path recovery (resume polling, re-offer with backoff); error-path diagnosis for the known DB-crash signature with the self-heal remediation shown inline.
Out: shipping guarded binaries / migration guards in the vendored client (#776 comment owns that); the hub-side wedge (#775); any change to the offer cadence while the hub is merely slow (that is #777's attach-budget territory).

Assumptions / Open Qs

• Assumed the self-heal is a safe, sanctioned operation on the client (it is the Aug-30-era medicine; if it requires user confirmation, the inline fix should ask).
• Open: backoff ceiling for re-offers — dev's judgment; must not resurrect the "offer fires once per window lifetime" behavior.

---

Acceptance Criteria

1. A failed Go-Standalone spawn never leaves the window without either a running local server or an active attach poll — no dead state.
2. After a failed spawn, the fleet offer re-appears (with backoff) while the hub remains down, and a recovered hub reattaches automatically.
3. A local-DB migration crash during spawn surfaces the actual cause with the journal self-heal remediation offered inline, not the generic timeout message.
4. A successful spawn still stops the attach poll exactly once, with no duplicate polls or double-offered banners.
5. Existing Go-Standalone success behavior is unchanged.

Key Decisions

• The poll stop moves to after the local server reports healthy; failure paths always restore it.
• The known crash signature is matched from the spawn error output (the migration-failure message), not from timing or retries.
• The re-offer mechanism replaces the one-shot notified flag; its backoff is per-window and resets on any successful attach.

Constraints & Invariants

• Never auto-run the self-heal without user confirmation — it rewrites local session data.
• Do not touch the hub probe budget or the SSE liveness override (fleet client: first-attach probe timeout (1500 ms) makes attach impossible on high-RTT links (plane wifi) — SSE override only covers post-attach #777's lane).

Prior Art / Patterns

- The journal self-heal is the erlich Aug-30 medicine, documented in the brainstorm ledger (§2 row 9) and referenced in the #776 comment. - Vault: `sessions/session-20260903-fleet-improvements-brainstorm.md` §6 row C carries the code anchors.

Source

• Durable record: vault-aaron/sessions/session-20260903-fleet-improvements-brainstorm.md §3.3 + §3.4 + §6
• Evidence: vault-aaron/sessions/session-20260903-hub-wedge-forensics.md §4 client-side note
• Related: ops hardening: swap must archive the outgoing binary; refuse non-release candidates; smoke needs a soak; finish fleet-status systemd port on erlich #776 (ops hardening), fleet client: first-attach probe timeout (1500 ms) makes attach impossible on high-RTT links (plane wifi) — SSE override only covers post-attach #777 (first-attach probe)

Notes

• Part of the 2026-09-03 handoff bundle (C of E). Mechanical; implement immediately after filing alongside A.

[aarontrowbridge]

Live hit during testing (2026-09-04 ~14:50): Go Standalone wrote a BROKEN config. After clicking Go Standalone (window reload, fleet posture active), ~/.amico/ops/fleet/fleet.json → role: standalone but the settings write produced opencodeBinary: "" and opencodePort: 0 — the preserve-previous-values logic wrote empty strings instead of the prior values (guard path + 4096). The subsequent standalone spawn had no valid binary config. Adds to this issue's scope: the Go-Standalone settings write must preserve-or-fail loudly, never write empty.