Harden mesh dispatch against silent failures ...

Three structural improvements to prevent future silent drops:

1. Add else-warning in on_message() dispatch chain — any unhandled proto
   message kind now logs a WARNING in production instead of being silently
   swallowed. This would have made the work_pool_update miss immediately visible.

2. Fix on_ready to use getattr(message, kind) — same safe extraction pattern
   now applied consistently to all dispatch branches. Prevents Bug 1 class
   from recurring if _on_mesh_ready ever starts using the argument.

3. Remove redundant _health_thread_started boolean from send_health() guard —
   _start_health_stream() already gates on thread.is_alive(), so the outer
   boolean was a stale fast-path that could mislead future readers back into
   the original thread-restart bug.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix node disconnect: health stream restart, policy dispatch, work_pool routing ...

Three bugs causing nodes to drop offline and stay offline after disconnect:

1. on_policy passed full ServerMessage instead of sub-message — caused
   Dispatch Error: mode on every connection (AgentNode._on_policy_update
   accesses policy.mode directly)

2. _health_thread_started never reset in close() — health stream could not
   restart after reconnect, so hub watchdog eventually timed out the node

3. work_pool_update had no dispatch case in on_message() — _handle_work_pool
   was dead code, causing hub to flood nodes with unclaimed task updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix Windows agent offline issues: Added run_loop.bat wrapper and fixed Sandbox policy handshake

Fix thread-unsafe sequence counter causing heapq comparison crash ...

The _send_seq += 1 approach had a race condition: two threads calling
send() simultaneously could load the same counter value, producing two
queue items with identical (priority, seq) tuples. heapq then compares
the third element (protobuf message), which crashes with TypeError.

Replace with itertools.count() whose next() is GIL-atomic in CPython —
each call is a single C-level operation that cannot be interrupted mid-
increment. Also fix the legacy fallback path in LiveNodeRecord.send_message
and remove the duplicate 'import queue' in node_registry.py.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix PriorityQueue crash when protobuf messages are compared as tiebreakers ...

Python's heapq compares all tuple elements if earlier ones are equal.
Using timestamp as the second key means two rapidly queued messages at
the same millisecond trigger comparison of the protobuf message objects,
which don't support '<'. Replace timestamp with a monotonic sequence
counter so the message object is never reached in the comparison.

Fixes: Reader thread FATAL exception: '<' not supported between instances
of 'ClientTaskMessage' and 'ClientTaskMessage'

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add token self-recovery to survive auth failures without SSH access ...

- GrpcMeshTransport: on handshake rejection, calls /api/v1/agent/token-sync
  using stable secret_key to fetch fresh invite_token and retries handshake.
  Persists recovered token to all known config file locations.
- agent_update.py: new /token-sync endpoint (auth: hub SECRET_KEY header).
- node.py: wire hub_http_url + secret_key into GrpcMeshTransport constructor.
- reinstall_windows_agent.ps1: idempotent all-in-one reinstall script —
  kills competing python processes, disables ghost startup bat, syncs config,
  optionally updates token, re-registers task with RestartCount=3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix integration tests, deadlocks, and race conditions in coworker flow

refactor done

half done refactoring