claude
bf2587c7fa
The double-wait on the offload seam is real and is fixed. Pair.Complete passed the caller's context to the workstation unchanged, so a remote that accepted the connection and then hung consumed the whole turn budget. The fallback then ran on an already-expired context and returned the deadline error rather than an answer, which means the turn broke on the workstation being slow. docs/offload.md rules that out explicitly. remoteBudget gives the remote at most half of a deadline that exists. A context with no deadline is untouched, because there the configured workstation.timeout is the intended bound and shortening it silently would change the operator's setting. Two check-then-close races, same shape. Pair.Stop and worker.Server.Close each let two concurrent callers see an open channel, and the second close panics. A shutdown racing a signal handler took the process down the one way a clean shutdown exists to prevent. Both are sync.Once now, which is what Stop's Idempotent comment already claimed. Load names the environment variables it could not resolve, in file order, once each. The agent refuted the brief on that last point and is right. Making an unresolved fatal contradicts a decision already in the tree: deployconfig_test.go parses the real deploy/mavend.json and documents that telegram.env is gitignored and absent in CI, so unset expands to empty on purpose. None of the three references is a socket path, and telegramsink.New already refuses an empty token. Fatal would turn the suite red and delete a working not-configured state. internal/update needed nothing. worker.Server already waits for in-flight connections and already recovers a panic per dispatch. (V-581)