Prevent destructive WhatsApp reconnects: 408/515 guards, socket and send bounds, version cache, zombie cleanup #54

Incident class and rationale

Production fork Neup123/evolution-api v5.5.3, pinned baileys@7.0.0-rc14, already carries QR re-pairing fix #53. A normal keep-alive watchdog 408 (connectionLost/timedOut, roughly 35s inbound silence) can be mistaken for logout if upstream evolution-foundation#2501's blanket no-reconnect rule is copied. That destroys paired credentials and forces another QR scan (including instances with very large message histories). Other failure modes are a trailing 401 after a 515 restart, zombie deleteInstance() cleanup halted by a dead socket, concurrent sockets fighting over the same credentials (440), unbounded send waits, and stale WA Web versions causing 408 retry loops.

Scoped corrections (one draft PR)

1. Evolution connection lifecycle — FAFAzin/VENDORA work in evolution-foundation/evolution-api#2501 discussion: terminate on 408 only if credentials are not registered; reconnect registered sessions. Add full-jitter exponential retry (cap 60s, reset on open, 515 immediate), dispose old socket/listeners before makeWASocket to prevent 440 conflicts, and bound sendMessage/relayMessage waits via withSendTimeout (60s default, EVOLUTION_SEND_TIMEOUT_MS override). Do not copy fix: logout instance evolution-foundation/evolution-api#2501's blanket 408 exclusion or unrelated logout-reliability changes.
2. Upstream #2509, issue Bug report & fix for Evolution API WAMonitoringService — stream:error 515 kills healthy instances evolution-foundation/evolution-api#2498: a 401/loggedOut within 30 seconds of CB:stream:error 515 reconnects rather than wiping a healthy session; outside grace period genuine logout remains terminal.
3. Upstream #2520: deleteInstance() catches logout exceptions and always reaches remove.instance so zombies can be purged. Upstream PR fix(instance.controller): emit remove.instance even when logout fails (zombie cleanup) evolution-foundation/evolution-api#2520 is currently merged, but this fork lacks the fix.
4. chaeulso/baileys, WhiskeySockets/Baileys#2777: maintain monotonic WA Web version selection, including a persisted last-known-good cache. Regenerate the single patches/baileys+7.0.0-rc14.patch on top of fix(baileys): restore rc14 QR companion re-pairing after production LOGOUT #53's fix(docker): pin Node.js to patched 24.22.1 for October 2026 CVEs evolution-foundation/evolution-api#2765/Update generate_database.sh evolution-foundation/evolution-api#2602/fix(meta): validate and preserve Coexistence webhook batches evolution-foundation/evolution-api#2749 hunks, leave pin unchanged. Optional #2784 only if cleanly separable, otherwise omit and document.

Removal / upstream tracking

• Drop the 408 rule, jitter/reconnect, one-socket policy, and send timeout individually only after an Evolution 2.3.x release contains verified equivalent semantics; never adopt fix: logout instance evolution-foundation/evolution-api#2501's unconditional 408 terminal rule.
• Drop the 515→401 guard once an Evolution 2.3.x release carries upstream fix(baileys): prevent healthy instances from being killed after stream:error 515 evolution-foundation/evolution-api#2509 (or equivalent) and preserves the 30s grace.
• Drop the zombie-delete workaround when the deployed Evolution 2.3.x line actually contains fix(instance.controller): emit remove.instance even when logout fails (zombie cleanup) evolution-foundation/evolution-api#2520; a merge to upstream develop alone does not prove the fork has it.
• Remove the Baileys feat(baileys): add sendPollVote and sendEventResponse endpoints evolution-foundation/evolution-api#2777 patch hunks when a compatible stable Baileys release is explicitly upgraded and regression-tested. Preserve fix(baileys): restore rc14 QR companion re-pairing after production LOGOUT #53's independent QR pairing hunks until those also land.

Verification gate before merge

• Clean npm ci with patch-package --error-on-fail visibly applying baileys@7.0.0-rc14.
• npm run build; compiled output and patched library greps for all guards/helpers and existing companion_reg_refresh.
• Run tsx test/connection-recovery.test.ts, tsx test/socket-watchdog.test.ts, and tsx test/disconnection-fields.test.ts.
• Report actual PR CI checks or clearly state none; do not merge/deploy until required runtime verification has passed.