From 268c156d7f3f5a5b7b137bd0c852414afbb2fe2b Mon Sep 17 00:00:00 2001
From: TerrifiedBug <35064668+TerrifiedBug@users.noreply.github.com>
Date: Sun, 23 Aug 2026 08:35:42 +0000
Subject: [PATCH] fix: a daemon spawn either becomes a daemon or says why (#68)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Installing 0.12.2 on a host whose omp session held the poll lock produced 83
permanent Telegram topics, five seconds apart, and stopping the bridge did not
help. Three defects compounded.

**The spawn could never work.** `ensureDaemon` launched `process.execPath`, and
inside the omp binary that is *omp* — a compiled Bun executable that ignores a
script argument and boots an interactive agent session. Proof: `omp daemon.ts`
and `omp /nonexistent/xyz.ts` write byte-identical output. So `daemon.ts` never
ran from an omp host; every "spawn" was a fresh session that claimed a topic
during plugin activation and exited. `return "spawned"` was a lie.

The runtime is now resolved by name and the host binary counts only when it
really is a runtime. No runtime, no spawn — because launching something that
cannot parse the entrypoint is the same silent no-op in a different costume.

**Nothing recorded the decline.** `runDaemon` correctly exits when another
process owns the poll lock, and writes no `daemon.json` (by design — that file
must always name the live poller). But `ensureDaemon` read only that file, so
"no daemon" and "a daemon is unnecessary" were indistinguishable, and every
caller re-ran the same experiment. The lock is a local file: it is now read
before spawning, and a live foreign owner returns the new `declined`. Ordering
is deliberate — the stale-version kill still happens first, or a daemon holding
its own lock would be immortal. Both existing callers already do the right thing
with `declined`: the session polls for itself.

**And the blast radius was unbounded.** A process launched to be the daemon is
not a conversation, so it now refuses to claim a topic when the launcher marks
it. Belt and braces: the marker costs nothing and being wrong cost 83 topics.

Separately, the same incident exposed why `/cleanup` could not clear the mess it
exists for. `claimThread` was an unserialised read-modify-write over a whole
file, through a *shared* `threads.json.tmp` that two writers could both rename —
so concurrent claims silently lost rows. A burst that created 16 topics recorded
15. The registry is the only index of topics that exists (the Bot API cannot list
them), so a lost row is a topic nobody can ever find again: 15 of the 83 had to
be recovered by sweeping id ranges by hand. Writes are now per-process and
serialised on the same `linkClaim` primitive the poll lock uses, bounded so a
crashed holder cannot wedge startup and self-healing by age.

Every test was checked against the old code first: reverting the lock precheck
turns "declines instead of spawning" red, and reverting the write path turns
"concurrent claims all persist" red.

bun run check: 300 pass, 0 fail.
---
 src/api.ts         |   9 ++-
 src/daemon.test.ts | 137 ++++++++++++++++++++++++++++++++++++++++++++-
 src/daemon.ts      |  85 ++++++++++++++++++++++++++--
 src/index.ts       |   7 +++
 src/topics.test.ts |  50 +++++++++++++++++
 src/topics.ts      |  75 ++++++++++++++++++++++---
 6 files changed, 346 insertions(+), 17 deletions(-)

diff --git a/src/api.ts b/src/api.ts
index e316651..d90951d 100644
--- a/src/api.ts
+++ b/src/api.ts
@@ -309,7 +309,14 @@ function lockFresh(lockPath: string, freshMs: number): boolean {
  * not a racy read-then-write — decides the single winner, and the target is
  * populated the instant it appears (no empty mid-write window).
  */
-function linkClaim(target: string, pid: number, content: string = String(pid)): boolean {
+/**
+ * Create `target` atomically, or report that somebody else already has.
+ *
+ * Exported so the thread registry can serialise its read-modify-write on the
+ * same primitive the poll lock uses (#68): two writers racing a shared
+ * `threads.json.tmp` published each other's file and silently lost claims.
+ */
+export function linkClaim(target: string, pid: number, content: string = String(pid)): boolean {
   const temp = `${target}.${pid}.${randomBytes(6).toString("hex")}`;
   writeFileSync(temp, content, { mode: 0o600 });
   try {
diff --git a/src/daemon.test.ts b/src/daemon.test.ts
index 2bec333..c026b92 100644
--- a/src/daemon.test.ts
+++ b/src/daemon.test.ts
@@ -3,7 +3,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { defaultAccess, saveAccess, statePath } from "./access";
-import { daemonDisableReason, ensureDaemon, readDaemonState } from "./daemon";
+import { daemonDisableReason, ensureDaemon, type EnsureDaemonOptions, readDaemonState, resolveRuntime } from "./daemon";
 
 const previousStateDir = process.env.OMP_TELEGRAM_STATE_DIR;
 const previousToken = process.env.TELEGRAM_BOT_TOKEN;
@@ -82,3 +82,138 @@ describe("daemon upgrades", () => {
     expect(readDaemonState()).toEqual({ pid: 9876, version: "0.2.0", startedAt: 1 });
   });
 });
+
+describe("daemon spawn preconditions (#68)", () => {
+  const enable = (): void => {
+    saveAccess({ ...defaultAccess(), enabled: true, topicsChat: "42" });
+    process.env.TELEGRAM_BOT_TOKEN = "token";
+  };
+  const spy = () => {
+    const calls: Array<{ executable: string; env?: NodeJS.ProcessEnv }> = [];
+    return {
+      calls,
+      spawn: ((executable, _args, options) => {
+        calls.push({ executable, env: options.env });
+        return { once: () => undefined, unref: () => {} };
+      }) as NonNullable<EnsureDaemonOptions["spawn"]>,
+    };
+  };
+
+  test("declines instead of spawning when another live process owns the poll lock", () => {
+    // The whole defect. Before the fix this spawned a child to discover the
+    // lock was taken, and because the child was `omp <script>` it became a
+    // session that claimed a permanent Telegram topic before exiting. Measured
+    // cost on one host: 83 topics.
+    enable();
+    const s = spy();
+    const result = ensureDaemon(() => {}, {
+      spawn: s.spawn,
+      runtime: () => "/usr/bin/bun",
+      lockOwner: () => ({ pid: 4242, startedAt: 1, name: "conductor" }),
+      alive: (pid) => pid === 4242,
+    });
+    expect(result).toBe("declined");
+    expect(s.calls).toEqual([]);
+  });
+
+  test("spawns when the lock holder is dead — a stale lock must not wedge it shut", () => {
+    enable();
+    const s = spy();
+    const result = ensureDaemon(() => {}, {
+      spawn: s.spawn,
+      runtime: () => "/usr/bin/bun",
+      lockOwner: () => ({ pid: 4242, startedAt: 1 }),
+      alive: () => false,
+    });
+    expect(result).toBe("spawned");
+    expect(s.calls).toHaveLength(1);
+  });
+
+  test("our own lock is not foreign", () => {
+    enable();
+    const s = spy();
+    expect(
+      ensureDaemon(() => {}, {
+        spawn: s.spawn,
+        runtime: () => "/usr/bin/bun",
+        lockOwner: () => ({ pid: process.pid, startedAt: 1 }),
+        alive: () => true,
+      }),
+    ).toBe("spawned");
+  });
+
+  test("declines rather than launching something that cannot run daemon.ts", () => {
+    // `process.execPath` inside the omp binary is omp itself, which ignores a
+    // script argument and boots an agent session. A spawn that cannot become a
+    // daemon must not be reported as one.
+    enable();
+    const s = spy();
+    const warnings: string[] = [];
+    const result = ensureDaemon((m) => warnings.push(m), {
+      spawn: s.spawn,
+      runtime: () => undefined,
+      lockOwner: () => undefined,
+    });
+    expect(result).toBe("declined");
+    expect(s.calls).toEqual([]);
+    expect(warnings.join(" ")).toContain("no bun/node runtime");
+  });
+
+  test("launches the resolved runtime, never process.execPath, and marks the child", () => {
+    enable();
+    const s = spy();
+    expect(
+      ensureDaemon(() => {}, { spawn: s.spawn, runtime: () => "/opt/bun/bin/bun", lockOwner: () => undefined }),
+    ).toBe("spawned");
+    expect(s.calls[0]?.executable).toBe("/opt/bun/bin/bun");
+    // The marker is the blast-radius cap: a child that somehow boots as a
+    // session still refuses to claim a topic.
+    expect(s.calls[0]?.env?.OMP_TELEGRAM_DAEMON_CHILD).toBe("1");
+  });
+
+  test("a stale-version daemon is still stopped before the lock is consulted", () => {
+    // Ordering matters: if the lock were checked first, a stale-version daemon
+    // holding its own lock would be immortal.
+    enable();
+    writeFileSync(statePath("daemon.json"), JSON.stringify({ pid: 9876, version: "0.1.1", startedAt: 1 }));
+    const s = spy();
+    let running = true;
+    const killed: number[] = [];
+    const result = ensureDaemon(() => {}, {
+      version: "0.2.0",
+      spawn: s.spawn,
+      runtime: () => "/usr/bin/bun",
+      lockOwner: () => undefined,
+      alive: () => running,
+      kill: (pid) => {
+        killed.push(pid);
+        running = false;
+      },
+    });
+    expect(killed).toEqual([9876]);
+    expect(result).toBe("spawned");
+  });
+});
+
+describe("resolveRuntime (#68)", () => {
+  test("rejects a host binary that only looks like a launcher", () => {
+    // The bug in one assertion: omp is not a runtime, so it must never be
+    // returned even though it is `process.execPath`.
+    expect(resolveRuntime({ PATH: "" }, "/root/.local/bin/omp")).toBeUndefined();
+  });
+
+  test("uses the host runtime when the host IS one", () => {
+    expect(resolveRuntime({ PATH: "" }, "/usr/local/bin/bun")).toBe("/usr/local/bin/bun");
+    expect(resolveRuntime({ PATH: "" }, "/usr/bin/node")).toBe("/usr/bin/node");
+  });
+
+  test("finds bun on PATH when the host is not a runtime", () => {
+    const bin = mkdtempSync(join(tmpdir(), "omp-tg-runtime-"));
+    try {
+      writeFileSync(join(bin, "bun"), "#!/bin/sh\n", { mode: 0o755 });
+      expect(resolveRuntime({ PATH: bin }, "/root/.local/bin/omp")).toBe(join(bin, "bun"));
+    } finally {
+      rmSync(bin, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/src/daemon.ts b/src/daemon.ts
index b8be93d..010887a 100644
--- a/src/daemon.ts
+++ b/src/daemon.ts
@@ -8,7 +8,7 @@ import {
   statSync,
   writeFileSync,
 } from "node:fs";
-import { join } from "node:path";
+import { delimiter, join } from "node:path";
 import {
   type Access,
   canAnswerPrompt,
@@ -18,7 +18,7 @@ import {
   resolveToken,
   statePath,
 } from "./access";
-import { acquireLock, type Logger, Poller, releaseLock, startLockHeartbeat, tg, webhookConflictHint } from "./api";
+import { acquireLock, type LockOwner, type Logger, Poller, readLockOwner, releaseLock, startLockHeartbeat, tg, webhookConflictHint } from "./api";
 import { type BridgeHost, ensureControlTopic, handleUpdate, syncBotCommands } from "./bridge";
 import { SpawnController } from "./control";
 import { TelegramPromptController } from "./prompts";
@@ -90,7 +90,7 @@ interface SpawnedDaemon {
 type SpawnDaemon = (
   executable: string,
   args: string[],
-  options: { detached: true; stdio: ["ignore", number, number] },
+  options: { detached: true; stdio: ["ignore", number, number]; env: NodeJS.ProcessEnv },
 ) => SpawnedDaemon;
 
 export interface EnsureDaemonOptions {
@@ -100,13 +100,63 @@ export interface EnsureDaemonOptions {
   sleep?: (ms: number) => void;
   now?: () => number;
   version?: string;
+  /** Resolves the JS runtime to launch the daemon with. Injected for tests. */
+  runtime?: () => string | undefined;
+  /** Reads the poll lock's owner without acquiring it. Injected for tests. */
+  lockOwner?: (lockPath: string) => LockOwner | undefined;
 }
 
-/** Ensure one current-version daemon is alive when topics-only routing permits it. */
+/** A path whose basename is a JS runtime that can execute a script argument. */
+const RUNTIME_NAME = /(?:^|\/)(?:bun|node)(?:-[\d.]+)?$/;
+
+/**
+ * The runtime that can actually execute `daemon.ts`.
+ *
+ * NOT `process.execPath` (#68). When this plugin is hosted inside the omp
+ * binary, `execPath` is *omp* — a compiled Bun executable that ignores a script
+ * argument and boots an interactive agent session instead. `omp daemon.ts` and
+ * `omp /nonexistent.ts` produce byte-identical output, so the daemon never ran;
+ * every "spawn" was a fresh session that claimed a Telegram topic and exited.
+ *
+ * So the runtime is resolved by name, and when there is none we refuse to spawn
+ * rather than launch something that cannot become a daemon.
+ */
+export function resolveRuntime(env: NodeJS.ProcessEnv = process.env, self: string = process.execPath): string | undefined {
+  // `self` counts only when it IS a runtime. Inside omp it is the agent, which
+  // is the whole bug.
+  if (RUNTIME_NAME.test(self)) return self;
+  // Otherwise resolve `bun` by name: this package ships unbuilt TypeScript, so
+  // Bun is the runtime that can execute it. `node` cannot, and is not a
+  // fallback — a spawn that cannot parse the entrypoint is the same silent
+  // no-op in a different costume.
+  for (const dir of (env.PATH ?? "").split(delimiter)) {
+    if (dir === "") continue;
+    const candidate = join(dir, "bun");
+    try {
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
+      // absent or unreadable: keep looking
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Ensure one current-version daemon is alive when topics-only routing permits it.
+ *
+ * Returns `"declined"` when a daemon is neither possible nor needed: another
+ * process already owns the poll lock (an interactive session polls for itself),
+ * or no JS runtime can execute `daemon.ts`. Both are steady states, not
+ * failures, and both must be decided *here* — before spawning (#68). The old
+ * code spawned a child to find out, and since the child was `omp <script>` it
+ * became a session that claimed a Telegram topic before discovering it should
+ * exit. Each caller then re-ran the same experiment, one permanent topic at a
+ * time, forever.
+ */
 export function ensureDaemon(
   warn: (message: string) => void,
   options: EnsureDaemonOptions = {},
-): "alive" | "spawned" | "disabled" | "failed" {
+): "alive" | "spawned" | "disabled" | "declined" | "failed" {
   const reason = daemonDisableReason(loadAccess(warn), resolveToken());
   if (reason) return "disabled";
 
@@ -115,6 +165,8 @@ export function ensureDaemon(
   const sleep = options.sleep ?? ((ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms));
   const now = options.now ?? Date.now;
   const version = options.version ?? packageVersion();
+  const runtime = options.runtime ?? resolveRuntime;
+  const lockOwner = options.lockOwner ?? readLockOwner;
   const spawnDaemon: SpawnDaemon = options.spawn ?? ((executable, args, spawnOptions) => spawn(executable, args, spawnOptions));
   const current = readDaemonState();
   if (current && daemonAlive(current, alive)) {
@@ -133,13 +185,34 @@ export function ensureDaemon(
     }
   }
 
+  // Read the lock; never spawn to discover it. A live foreign owner means
+  // something is already polling, and `runDaemon` would exit immediately —
+  // which is exactly the no-op that used to cost a topic per call. Checked
+  // AFTER the upgrade path above, so stopping a stale-version daemon still
+  // happens and its released lock is observed on the next call.
+  const owner = lockOwner(statePath("bot.lock"));
+  if (owner !== undefined && owner.pid !== process.pid && alive(owner.pid)) {
+    return "declined";
+  }
+
+  // No runtime, no spawn. Launching the host binary here is what produced the
+  // loop: it cannot run `daemon.ts` and silently becomes a session instead.
+  const executable = runtime();
+  if (executable === undefined) {
+    warn("no bun/node runtime on PATH to run the telegram daemon; inbound relies on a polling session");
+    return "declined";
+  }
+
   ensureStateDir();
   rotateDaemonLog();
   const logFd = openSync(statePath("daemon.log"), "a", 0o600);
   try {
-    const child = spawnDaemon(process.execPath, [join(import.meta.dirname, "daemon.ts")], {
+    const child = spawnDaemon(executable, [join(import.meta.dirname, "daemon.ts")], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
+      // Declares what this child is, so a process that somehow boots as a
+      // session instead of a daemon still cannot claim a topic (#68).
+      env: { ...process.env, OMP_TELEGRAM_DAEMON_CHILD: "1" },
     });
     child.once("error", (err) => warn(`daemon process failed: ${String(err)}`));
     child.unref();
diff --git a/src/index.ts b/src/index.ts
index ce960f6..4ae19a1 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -966,6 +966,13 @@ export default function telegramExtension(pi: ExtensionAPI): void {
    */
   async function ensureTopic(ctx?: ExtensionContext): Promise<void> {
     if (!access.topicsChat || !token || ownTopic) return;
+    // Blast-radius cap (#68): a process launched to BE the daemon is not a
+    // conversation and must never own a human-visible topic. `ensureDaemon` now
+    // refuses to launch anything that cannot run `daemon.ts`, so this should be
+    // unreachable — it is here because the cost of being wrong was 83 permanent
+    // topics, and a marker the launcher sets is cheaper than trusting that the
+    // launcher is always right.
+    if (process.env.OMP_TELEGRAM_DAEMON_CHILD === "1") return;
     // DM host with forum-topic mode provably off: skip creation (createForumTopic
     // would just fail) and run untopiced with an actionable hint. Only an explicit
     // false blocks — undefined (older server / field absent) still attempts create.
diff --git a/src/topics.test.ts b/src/topics.test.ts
index c17c521..b665e3d 100644
--- a/src/topics.test.ts
+++ b/src/topics.test.ts
@@ -288,3 +288,53 @@ describe("purgeRouteDir", () => {
     expect(() => purgeRouteDir(999)).not.toThrow();
   });
 });
+
+describe("registry writes survive concurrency (#68)", () => {
+  const entry = (pid: number): ThreadEntry => ({ pid, cwd: `/w/${pid}`, name: "conductor", claimedAt: 1_000 + pid });
+
+  test("concurrent claims from separate processes all persist", async () => {
+    // The measured failure: a burst that created 16 topics recorded 15 rows.
+    // Whole-file writes make every claim a read-modify-write, so unserialised
+    // the last writer wins and the rows in between are lost — and a topic whose
+    // row is lost is invisible to /cleanup forever, because the registry is the
+    // only index that exists. Losing the index is worse than losing the topic.
+    const runner = join(dir, "claim.ts");
+    writeFileSync(
+      runner,
+      `import { claimThread } from ${JSON.stringify(join(import.meta.dirname, "topics.ts"))};\n` +
+        `claimThread("42", Number(process.argv[2]), { pid: Number(process.argv[2]), cwd: "/w", name: "conductor", claimedAt: 1 });\n`,
+    );
+    const ids = [7001, 7002, 7003, 7004, 7005, 7006, 7007, 7008];
+    await Promise.all(
+      ids.map((id) =>
+        Bun.spawn([process.execPath, runner, String(id)], {
+          env: { ...process.env, OMP_TELEGRAM_STATE_DIR: dir },
+          stdout: "ignore",
+          stderr: "ignore",
+        }).exited,
+      ),
+    );
+    const got = Object.keys(loadRegistry().threads).map(Number).sort((a, b) => a - b);
+    expect(got).toEqual(ids);
+  });
+
+  test("a lock left by a dead process does not wedge the registry shut", () => {
+    // Self-healing by age. A mutation lock is held for microseconds, so one
+    // that is seconds old belonged to a process that died holding it.
+    const lock = `${statePath("threads.json")}.lock`;
+    writeFileSync(lock, "999999");
+    const old = new Date(Date.now() - 60_000);
+    utimesSync(lock, old, old);
+    claimThread("42", 8001, entry(8001));
+    expect(Object.keys(loadRegistry().threads)).toEqual(["8001"]);
+  });
+
+  test("the temp file is per-process, so two writers cannot publish each other's", () => {
+    // It was a shared `threads.json.tmp`: both writers wrote that one path and
+    // both renamed it, so one could publish the other's half-written file.
+    claimThread("42", 8002, entry(8002));
+    const leftovers = readdirSync(dir).filter((f) => f.startsWith("threads.json.tmp"));
+    expect(leftovers).toEqual([]);
+    expect(loadRegistry().threads["8002"]?.pid).toBe(8002);
+  });
+});
diff --git a/src/topics.ts b/src/topics.ts
index 40f86de..3b7ee38 100644
--- a/src/topics.ts
+++ b/src/topics.ts
@@ -22,7 +22,7 @@ import {
 } from "node:fs";
 import { basename, join } from "node:path";
 import { ensureStateDir, statePath } from "./access";
-import type { Logger, TgMessage } from "./api";
+import { linkClaim, type Logger, type TgMessage } from "./api";
 
 /** A session's claim on one forum topic. Keyed in the registry by thread id. */
 export interface ThreadEntry {
@@ -113,21 +113,78 @@ export function loadRegistry(warn?: (msg: string) => void): ThreadRegistry {
   }
 }
 
-/** Atomically persist threads.json (tmp write mode 0600 + rename). Mirrors saveAccess. */
+/**
+ * Atomically persist threads.json.
+ *
+ * The temp name carries this process's pid (#68). It used to be a shared
+ * `threads.json.tmp`: two writers wrote the same path and both renamed it, so
+ * one could publish the other's half-written file. `saveDaemonState` already
+ * spelled this correctly; this did not.
+ */
 export function saveRegistry(r: ThreadRegistry): void {
   ensureStateDir();
   const file = statePath("threads.json");
-  const tmp = `${file}.tmp`;
-  writeFileSync(tmp, JSON.stringify(r, null, 2) + "\n", { mode: 0o600 });
-  renameSync(tmp, file);
+  const tmp = `${file}.tmp-${process.pid}`;
+  try {
+    writeFileSync(tmp, JSON.stringify(r, null, 2) + "\n", { mode: 0o600 });
+    renameSync(tmp, file);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+
+/** How long a registry mutation waits for a concurrent one before giving up. */
+const REGISTRY_MUTATE_WAIT_MS = 2_000;
+/** A mutation lock older than this belonged to a process that died holding it. */
+const REGISTRY_MUTATE_STALE_MS = 5_000;
+
+/**
+ * Serialise one read-modify-write of threads.json across processes.
+ *
+ * Whole-file writes make every mutation a read-modify-write, and this package
+ * runs many of them concurrently — one per omp session. Unserialised, the last
+ * writer wins and every claim recorded in between is lost. Measured (#68): a
+ * burst that created 16 topics recorded 15 rows, and the topics whose rows were
+ * lost became permanently invisible to `/cleanup`, which can only see the
+ * registry. Losing the *index* to a topic is worse than losing the topic.
+ *
+ * Bounded and self-healing: a caller that cannot take the lock in
+ * {@link REGISTRY_MUTATE_WAIT_MS} proceeds anyway — a lost update is bad, a
+ * session that hangs on startup is worse — and a lock left by a dead process is
+ * broken by age.
+ */
+function withRegistryLock<T>(mutate: () => T): T {
+  const lock = `${statePath("threads.json")}.lock`;
+  const deadline = Date.now() + REGISTRY_MUTATE_WAIT_MS;
+  let held = false;
+  while (Date.now() < deadline) {
+    if (linkClaim(lock, process.pid)) {
+      held = true;
+      break;
+    }
+    try {
+      if (Date.now() - statSync(lock).mtimeMs > REGISTRY_MUTATE_STALE_MS) rmSync(lock, { force: true });
+    } catch {
+      // vanished between the claim and the stat: next iteration claims it
+    }
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+  }
+  try {
+    return mutate();
+  } finally {
+    if (held) rmSync(lock, { force: true });
+  }
 }
 
 /** Read-modify-write a topic claim: records the chat and the owning session. */
 export function claimThread(chatId: string, threadId: number, entry: ThreadEntry, warn?: (msg: string) => void): void {
-  const r = loadRegistry(warn);
-  r.chatId = chatId;
-  r.threads[String(threadId)] = entry;
-  saveRegistry(r);
+  withRegistryLock(() => {
+    const r = loadRegistry(warn);
+    r.chatId = chatId;
+    r.threads[String(threadId)] = entry;
+    saveRegistry(r);
+  });
 }
 
 /**