fix(notifier): prevent hung-reconnect wedge (arm timeout/abort before connect)

[jbiskur]

Problem

The control-plane's internal pathways pump (and the data-pathways worker fleet) can silently wedge: the fetch loop stops consuming events while the pulse emitter keeps reporting "alive", recoverable only by a full process restart. Most recently this took the prod control-plane down for ~14h (2026-06-08T19:40Z) — every PUT /pathways/:id 500'd because waitForPathwayToBeProcessed timed out on the self-loop write.

Root cause

FlowcoreNotifier.waitWebSocket() awaited notificationClient.connect() before arming the re-poll timeout and abort listener:

await this.notificationClient.connect()              // unbounded — no timeout/abort
this.timer = setTimeout(() => this.eventResolver?.(), 20000)  // armed only AFTER connect resolves
signal?.addEventListener("abort", () => this.eventResolver?.())
await promise

When a reconnect hangs (half-open / black-holed socket), connect() never resolves: the 20s re-poll timer is never armed, abort is never wired, and the finally never runs → the main loop blocks forever. The startMainLoop self-heal (#74) only catches thrown errors, so a hang is invisible to it.

Fix

Arm the timeout + abort listener before connect(), and race connect() against the resolution promise so a hung connect can't block. A hung connect now resolves the wait at timeoutMs; the loop re-polls (catching up any backlog) and attempts a fresh connect each cycle, auto-recovering to push/WS mode the moment a connect succeeds. A connect rejection still surfaces, preserving the main-loop self-heal. No sticky poll-mode state.

Tests

test/tests/notifier.test.ts:

• case 9 — hung connect() must not wedge: wait() resolves via the pre-armed timeout (fails on pre-fix code).
• case 10 — retries while degraded, then returns to WS mode on reconnect.
• Cases 1–8 unchanged and green.

Full suite: 12 passed / 57 steps. deno fmt/lint/check clean.

🤖 Generated with Claude Code