fix(proxy): survive a reload instead of cutting the response

CHANGELOG.md

@@ -2,8 +2,22 @@
 
 ## [Unreleased]
 
+### Changed
+
+- **`CACHE_FIX_REQUIRE_HOP=1` now covers the relayed `/v1/messages` route, not just the two `CONNECT` paths.** With the variable set and no chain hop reachable, that route previously dialled `api.anthropic.com` directly — carrying the caller's API key past the boundary the variable exists to enforce, while the `CONNECT` paths correctly refused. It now answers `502` instead, matching them. This is a new user-visible outcome on the primary route: an operator who sets the variable, configures no fallbacks and has no reachable proxy will see requests refused where they previously succeeded, which is what the flag asks for. Unset (the default) nothing changes. Hosts exempted by `NO_PROXY` stay exempt — that is an operator saying "this one is direct on purpose". Three egress sites still do not consult the variable: `storageAgent()`, the update-channel probe, and `fallbackToOrigin()`. The first two issue our own requests and carry no client headers. The third forwards the client's headers verbatim to `downloads.claude.ai` on the opt-in download-rewrite path — it is enumerated here rather than claimed harmless.
+
 ### Fixed
 
+- **A refused fd-3 handover no longer makes the proxy claim it handed the socket on.** `inheritedSocket` was computed from "handover was attempted", not "handover succeeded", so a proxy that was refused fd 3 and fell back to binding its own port still advertised an inherited socket. On `SIGTERM` it then spawned a successor pointed at the same unservable descriptor and exited `75` — telling the supervisor a successor holds the socket — while the port it actually served was released with nobody on it. Exits `0` now, spawns nothing, and leaves no orphan.
+
+- **A dead log reader no longer kills the supervisor or the relay.** The proxy gained an EPIPE swallower after a measured 27-minute outage; the launcher's holder and the gap relay share the same pipe and never got one, so the same killed reader took down the process whose whole job is to put the proxy back. Both now install stream `'error'` listeners, as does the proxy in reverse mode, where its own guard had been attached only when forward mode was active. The interactive wrapper deliberately keeps the old behaviour — a foreground producer whose consumer dies should end.
+
+- **A failed `SIGUSR2` handover recovers instead of leaving the port unowned.** `spawn()` reports fork-pressure failures (`EAGAIN`) as an asynchronous `'error'`, which was unhandled — an uncaughtException that killed the holder after it had already killed its standby. The holder now leaves only once the successor has actually started, and both failure routes restore the standby and re-arm the restart ladder.
+
+- **The gap relay no longer surrenders a live socket on a transient error, and refuses to start blind.** Its server-error handler exited on *any* error, including an accept-time `EMFILE` on a socket it was still serving — the moment the address is most needed. It now keeps the socket when still listening. Separately, the standby refused to arm if `CACHE_FIX_STANDBY_PARENT` was missing rather than silently falling back to `process.ppid`, which compares 1 against 1 for ever and holds a listening socket that answers nothing.
+
+- **`openssl` is bounded.** Certificate minting shelled out with no timeout, inside `startProxy()` before the proxy listens and while holding the CA-generation lock, so one wedged call stalled every sibling waiting on that lock.
+
 - **`--remote-control` no longer clobbers another component's `NODE_EXTRA_CA_CERTS`.** That variable takes exactly one file, so on a host where something else also MITMs `api.anthropic.com` (a corporate agent, an account-pinning proxy) the last writer won and every other CA was silently untrusted — measured breaking Remote Control inbound. The launcher now publishes its own CA to `${CLAUDE_CONFIG_DIR:-~/.claude}/ca-trust.d/ccf.pem` (own filename only, never a sibling's, rewritten every launch, atomically via temp + `rename`) and reads a merged `ca-trust.pem` if one exists. It never writes the merged bundle: merging needs ambient corporate-root discovery, which is environment-specific and belongs outside this repo. The bundle is used only when node, handed that file, actually verifies our proxy's leaf — a bundle that is damaged or predates our publish is worse than none, since it makes the client distrust the very proxy it is routed through. On a host with no other MITM and no bundle, behavior is byte-identical to before. Both paths are fixed names under the config dir with no env override: they are two halves of one rendezvous, so a knob on either half alone would let a participant drop out of the contract while appearing to implement it. See [Coexisting with another MITM](README.md#coexisting-with-another-mitm-on-the-same-machine-ca-trustd).
 
 - **The `ca-trust.pem` guard now ASKS node's loader instead of predicting it.** The previous guard modelled the loader in a regex — base64 quanta, padding position, dash runs in markers, which of ten whitespace characters openssl tolerates. It took five review rounds and was still wrong in *both* directions on a real bundle: it accepted one node loads nothing from (overlapping `BEGIN` markers on one line, measured 0 certificates loaded and a failed handshake) and refused one node loads fine (a non-certificate block whose body contains a line-start `-----BEGIN ` line, measured 1 certificate and a successful handshake). The rule it was reaching for is not expressible from outside: an identical tear is recovered or fatal depending only on whether its truncated body happens to be complete DER, which is a question about bytes no parser can answer. The launcher now spawns a child with `NODE_EXTRA_CA_CERTS` set from birth, has it stand up a TLS server holding our leaf, and connects to it — the same thing the session will do. One spawn, ~25 ms over a bare `node -e ''` (measured, 40 interleaved pairs: 17.3 ms bare, 42.4 ms probed) — ~8% of a ~520 ms launch, of which ~493 ms is the proxy coming up, and very nearly all of the CA work. Once per launch, on a path that already forks node for the proxy. Deliberately a handshake rather than `tls.getCACertificates`, which does not exist before node v22.15 while this package declares `engines: >=18`: on those runtimes an API probe cannot answer at all, and a guard that returns "cannot tell" on every ordinary host is not a guard. Three outcomes now, never two — `ok`, `not ok`, and `unknown` for a probe that could not be run, because answering "unusable" when you could not ask drops every corporate root on a machine whose bundle was fine. And a refused merge no longer costs the other publishers their CAs: the launcher rebuilds from the `ca-trust.d/` files that still work, measured on this box (ours plus one peer): 1 certificate under the old fallback versus 2 under the rebuild, and 1 versus 3 on a three-publisher host — one certificate per surviving publisher. The decision lives in `bin/ca-trust.mjs` so the tests drive the shipped code: it was previously inline in a top-level script with a hand-copied twin in the test file, and mutating the real one left the entire suite green.