@openchambery/web 2.1.8-beta.9 → 2.1.9-beta.1

package/dist/index.html

@@ -552,7 +552,7 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-BjL5V6ie.js"></script>
+    <script type="module" crossorigin src="/assets/main-DAHeBbJJ.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-C8w0nlKy.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-3ad3yzM7.js">
@@ -572,8 +572,8 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-kRMttlcP.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-CRWwlAOU.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-OjoeiMbd.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-5NAbSrPI.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-CdGit3gf.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html

@@ -74,7 +74,7 @@
       }
     </style>
 
-    <script type="module" crossorigin src="/assets/miniChat-CHCwBkzu.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-DEIx3C4R.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-C8w0nlKy.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-3ad3yzM7.js">
@@ -94,8 +94,8 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-kRMttlcP.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-CRWwlAOU.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-OjoeiMbd.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-5NAbSrPI.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-CdGit3gf.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html

@@ -63,7 +63,7 @@
       })();
     </script>
 
-    <script type="module" crossorigin src="/assets/mobile-CG3SgbAO.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-DmNNI21w.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-C8w0nlKy.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-3ad3yzM7.js">
@@ -83,8 +83,8 @@
     <link rel="modulepreload" crossorigin href="/assets/terminalApi-kRMttlcP.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-CRWwlAOU.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-OjoeiMbd.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-5NAbSrPI.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-CdGit3gf.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "2.1.8-beta.9",
+  "version": "2.1.9-beta.1",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/index.js

@@ -1822,19 +1822,6 @@ async function main(options = {}) {
     // Re-evaluate the relay lifecycle after pairing/device changes (a revoked or
     // redeemed device can flip relay demand on or off).
     reconcileRelay: () => (relayServiceInstance ? relayServiceInstance.reconcile() : Promise.resolve()),
-    // Canonical endpoints the host relay currently uses (primary first).
-    // Pairing-session requests from paired desktop clients may carry a relayUrl
-    // only when it matches one of these (an echo of an advertised endpoint,
-    // never a re-point or an extension).
-    getEffectiveRelayUrls: async () => {
-      if (!relayServiceInstance) return [];
-      try {
-        const status = await relayServiceInstance.getStatus();
-        return Array.isArray(status?.relayUrls) ? status.relayUrls : [];
-      } catch {
-        return [];
-      }
-    },
     // Every configured relay endpoint as a pairing candidate (multi-relay),
     // for the connection-candidates refresh.
     getRelayPairingCandidates: async () => {

package/server/lib/assistants/DOCUMENTATION.md

@@ -1,5 +1,16 @@
 # Assistants Module
 
+## Transient contact errors
+
+Contact-turn failures are delivered through `openchamber:contact-turn-end` only,
+never inserted into the durable contact transcript. The store rejects `status:error`
+writes and atomically deletes legacy error messages and their parts during startup;
+a cleanup failure rolls back and fails startup instead of exposing partial history.
+User messages and already-published valid replies/cards remain intact. Live clients
+show temporary error feedback until a newer message arrives; reconnect/restart does
+not recover errors. Errors do not become list previews, unread counts, or LLM memory.
+Worker-card execution status remains part of the card's authoritative state.
+
 ## Avatar identity
 
 `avatarSeed` is an optional nonempty string (maximum 256 characters) on create
@@ -141,7 +152,7 @@ and keep their existing error result handling.
 - The model is prompted to announce its next action and report verified milestones during execution, then give a short final outcome. Public messages share the existing SSE, durable contact rows, and turn-global indices across web, desktop, VS Code, hosted mobile, and Capacitor. No timer narration, tool logs, progress widgets, or synthetic chat messages are added. Timing of model-authored milestones remains model policy; the transport guarantees immediate delivery once an explicit public record arrives.
 - Completion notifications use the latest spoken message, keeping earlier progress out of the final notification body. Transcript persistence reconciles by stable bubble IDs and adds only remaining messages.
 - Tool results remain model context for every tool. The outcome projector uses assistant-authored text only. Terminal operations retain the mutation stop gate, followed by a tools-disabled completion on the same provider/model to communicate the actual result. A failed/empty summary surfaces a turn error; a completed side effect stays committed and is never replayed by that summary pass.
-- Reset summaries receive only the successful reset tool result, excluding prior messages and attachments. The service retains one model-generated confirmation and discards pre-reset output for that turn. Existing structured failure rows retain diagnostics for recovery; the UI renders those as separate error feedback, outside assistant speech bubbles.
+- Reset summaries receive only the successful reset tool result, excluding prior messages and attachments. The service retains one model-generated confirmation and discards pre-reset output for that turn. Failures emit temporary live error feedback outside assistant speech bubbles, without a persisted failure row.
 
 - Protocol correction never replays rejected assistant prose into model history: simulated User/Assistant turns and tool-result records are rejected as fabricated evidence. Known rejected coding calls cannot be skipped with a subsequent `complete` declaration; the model must issue actual calls or report a blocker. Corrections remain bounded and exhaustion is an error, not a completion.
 
@@ -178,7 +189,7 @@ and keep their existing error result handling.
 - Worker sessions stamp `metadata.openchamber.assigned` (`from: 'contact'`, `assistantID`, `name`). They must **not** use `openchamber.assistant.assistantID` — that marker hides archived Assistant bindings from Chat.
 - `AssistantDTO.assignedSessionIDs` lists in-flight (`busy`/`question`) watches for assigned worker sessions. Session-card busy stays on the card; it does **not** drive the list green dot.
 - **Contact active turn (server authoritative):** process-local metadata tracks admission → `queued` → `running` → settled (removed). `AssistantDTO.working` is true only while that assistant has an unsettled contact turn. `AssistantDTO.activeContactTurn` is `{ turnID, messageID, status: 'queued'|'running', admittedAt }` or `null` so APP restart / reconnect can rehydrate list green dots and the contact 3-dot row from the snapshot HTTP GET. Spoken bubbles and cards persist to SQLite as soon as they publish (`done:true` / `onCard`) so another device or APP restart can GET them while the turn is still running. Token-level SSE deltas remain live paint only. A server process restart clears in-memory activity (no permanent green; tools are not auto-rerun) but already-published bubbles/cards stay in the transcript. Per-assistant lanes isolate turns across assistants/runtimes. Stale `contact-turn-end` for an older `turnID` must not clear a newer active turn.
-- **List latest-message preview (server authoritative):** every `AssistantDTO` path (`snapshot` / `create` / `update` / other `output` rows) carries `latestMessagePreview: { messageID, ordinal, createdAt, role: 'user'|'assistant', text, fallbackKind: 'image'|'file'|'session'|'assistant'|'schedule'|null } | null`. Source is the contact transcript only (not `defaultPrompt` / `updatedAt`). Order is the same keyset as contact pages: newest `(ordinal DESC, message_id DESC)`. Visible roles are `user`, `assistant`, and `peer` (peer maps to `role: 'user'` because inbound DMs are user-visible). Internal assigned-session settle markers (`oc.settle.*`) are excluded in the SQL candidate probe (and again in `buildContactMessagePreview`). Durable error bubbles keep their real body text. Plain text is sanitized and capped at `CONTACT_PREVIEW_MAX_CHARS` (500) with no data-URL/base64 bodies. File-only rows set `fallbackKind` `image`/`file`; pure cards set `session`/`assistant`/`schedule`. Empty transcript → `null`. **Snapshot cost:** one prepared statement reused per assistant (`assistant_id` + indexed `ORDER BY ordinal DESC, message_id DESC LIMIT candidateLimit`, catalog ≤100) collecting only those bounded candidates, then **one** parts `IN` query — not a window/`ROW_NUMBER` over full multi-assistant history and not HTTP N+1. SQL already drops pure settle tails so they cannot exhaust the LIMIT and hide an older real bubble; remaining non-preview empty rows may still consume a candidate slot within that same LIMIT. Admission, assistant completion, peer DM, card insert, wipe, and clear-memory already bump domain revision / `openchamber:assistants-changed`; clients re-GET snapshot for the new preview. Clear-memory keeps transcript rows so the preview still reflects the last bubble; clear-history / reset remove rows so the preview becomes the wipe confirm (or `null` after a full unbounded wipe with no remaining user).
+- **List latest-message preview (server authoritative):** every `AssistantDTO` path (`snapshot` / `create` / `update` / other `output` rows) carries `latestMessagePreview: { messageID, ordinal, createdAt, role: 'user'|'assistant', text, fallbackKind: 'image'|'file'|'session'|'assistant'|'schedule'|null } | null`. Source is the contact transcript only (not `defaultPrompt` / `updatedAt`). Order is the same keyset as contact pages: newest `(ordinal DESC, message_id DESC)`. Visible roles are `user`, `assistant`, and `peer` (peer maps to `role: 'user'` because inbound DMs are user-visible). Internal assigned-session settle markers (`oc.settle.*`) are excluded in the SQL candidate probe (and again in `buildContactMessagePreview`). Transient errors are never stored and cannot replace the preview. Plain text is sanitized and capped at `CONTACT_PREVIEW_MAX_CHARS` (500) with no data-URL/base64 bodies. File-only rows set `fallbackKind` `image`/`file`; pure cards set `session`/`assistant`/`schedule`. Empty transcript → `null`. **Snapshot cost:** one prepared statement reused per assistant (`assistant_id` + indexed `ORDER BY ordinal DESC, message_id DESC LIMIT candidateLimit`, catalog ≤100) collecting only those bounded candidates, then **one** parts `IN` query — not a window/`ROW_NUMBER` over full multi-assistant history and not HTTP N+1. SQL already drops pure settle tails so they cannot exhaust the LIMIT and hide an older real bubble; remaining non-preview empty rows may still consume a candidate slot within that same LIMIT. Admission, assistant completion, peer DM, card insert, wipe, and clear-memory already bump domain revision / `openchamber:assistants-changed`; clients re-GET snapshot for the new preview. Clear-memory keeps transcript rows so the preview still reflects the last bubble; clear-history / reset remove rows so the preview becomes the wipe confirm (or `null` after a full unbounded wipe with no remaining user).
 - No registered project → clear `project_required` (ask the user to configure a project). Never fall back to managed assistant-workspaces.
 - Assign must not go through the peer DM channel.
 - `assignWork` (service) resolves the worker model via the connected catalog (`capabilities.input.image` preferred), forwards tool `variant` (cross-model drops contact variant), passes AbortSignal into create/prompt/delete/catalog, and supplies `lookupMessage` over real SDK exact lookup (`v2.session.message` → `session.message` → bounded `message.list`). Ambiguous prompt admission returns `prompt_ambiguous` with `sessionID`/`messageID` and does **not** delete the worker; the contact-turn assign gate retains that identity so a same-args retry reuses the session and cannot blind-create another worker this turn.

package/server/lib/assistants/contact-attachments.http.test.js

@@ -256,7 +256,7 @@ describe('contact attachments real HTTP (core-routes + assistants routes)', () =
 });
 
 describe('contact attachment materialize failure terminal settle', () => {
-  it('deleting bytes after admit causes durable error, working=false, next turn ok', async () => {
+  it('deleting bytes after admit causes transient error, working=false, next turn ok', async () => {
     const directory = mkRoot();
     closers.push(async () => fsp.rm(directory, { recursive: true, force: true }).catch(() => {}));
 
@@ -339,7 +339,7 @@ describe('contact attachment materialize failure terminal settle', () => {
     expect(snap.activeContactTurn).toBeNull();
 
     const page = service.contactMessages(assistant.id, { limit: 20 });
-    expect(page.messages.some((m) => m.status === 'error' || (m.role === 'assistant' && m.text))).toBe(true);
+    expect(page.messages.some((m) => m.status === 'error' || (m.role === 'assistant' && m.text))).toBe(false);
     const pageJson = JSON.stringify(page);
     expect(pageJson).not.toMatch(/data:image\/png;base64,[A-Za-z0-9+/]{40,}/);
 

package/server/lib/assistants/contact-store.js

@@ -107,6 +107,15 @@ export function ensureContactSchema(db) {
   // only counts assistant tails that belong to this delivery.
   if (!watchColumns.has('message_id')) db.exec('ALTER TABLE assistant_contact_watch ADD COLUMN message_id TEXT');
   // Attachment table ownership lives in contact-attachments.ensureContactAttachmentSchema.
+  // Errors are live feedback, not history. Remove legacy rows and their bodies atomically.
+  db.transaction(() => {
+    db.exec(`
+      DELETE FROM assistant_contact_part WHERE message_id IN (
+        SELECT message_id FROM assistant_contact_message WHERE status = 'error'
+      );
+      DELETE FROM assistant_contact_message WHERE status = 'error';
+    `);
+  })();
 }
 
 /** Current contact transcript generation for one assistant (default 0). */
@@ -719,7 +728,7 @@ export function sanitizeContactPreviewText(text, maxChars = CONTACT_PREVIEW_MAX_
  * Build AssistantDTO.latestMessagePreview from one hydrated contact message.
  * Returns null when the row is not list-visible (internal settle-only, empty,
  * unsupported role). Peer inbox rows map to role `user` (user-visible DM).
- * Visible error bubbles keep real body text. Cards/files set fallbackKind.
+ * Cards/files set fallbackKind. Error feedback never enters persisted previews.
  */
 export function buildContactMessagePreview(message) {
   if (!message || typeof message !== 'object') return null;
@@ -1003,6 +1012,7 @@ export function insertContactMessage(db, {
   fromAssistantID = null,
   fromAssistantName = null,
 }) {
+  if (status === 'error') return;
   db.prepare(
     'INSERT INTO assistant_contact_message(message_id,assistant_id,role,turn_id,bubble_index,created_at,ordinal,status,from_assistant_id,from_assistant_name) VALUES (?,?,?,?,?,?,?,?,?,?)',
   ).run(messageID, assistantID, role, turnID, bubbleIndex, createdAt, ordinal, status, fromAssistantID, fromAssistantName);

package/server/lib/assistants/contact-store.test.js

@@ -120,7 +120,7 @@ describe('contact LLM history trim', () => {
       { role: 'assistant', content: 'keep-assistant' },
       { role: 'assistant', content: expect.stringContaining('\"sessionID\":\"ses_1\"') },
     ]);
-    expect(listContactMessages(db, assistantID, { limit: 50 }).messages).toHaveLength(5);
+    expect(listContactMessages(db, assistantID, { limit: 50 }).messages).toHaveLength(4);
     db.close();
   });
 
@@ -549,21 +549,40 @@ describe('contact latest message preview', () => {
     db.close();
   });
 
-  it('keeps durable error body text as the preview', () => {
+  it('never stores error rows or replaces the latest message preview with an error', () => {
     const db = openDb();
     const assistantID = 'asst_preview_err';
-    insert(db, assistantID, { role: 'user', text: 'hi' });
+    const user = insert(db, assistantID, { role: 'user', text: 'hi' });
     const err = insert(db, assistantID, {
       role: 'assistant',
       text: 'No connected model',
       status: 'error',
     });
     expect(getLatestContactMessagePreview(db, assistantID)).toMatchObject({
-      messageID: err.messageID,
-      role: 'assistant',
-      text: 'No connected model',
+      messageID: user.messageID,
+      role: 'user',
+      text: 'hi',
       fallbackKind: null,
     });
+    expect(db.prepare('SELECT * FROM assistant_contact_message WHERE message_id=?').get(err.messageID)).toBeUndefined();
+    expect(db.prepare('SELECT * FROM assistant_contact_part WHERE message_id=?').all(err.messageID)).toEqual([]);
+    db.close();
+  });
+
+  it('atomically purges legacy error messages and parts on startup', () => {
+    const db = openDb();
+    const user = insert(db, 'legacy', { role: 'user', text: 'keep' });
+    const legacy = insert(db, 'legacy', { role: 'assistant', text: 'old failure' });
+    db.prepare("UPDATE assistant_contact_message SET status='error' WHERE message_id=?").run(legacy.messageID);
+    db.exec(`CREATE TRIGGER fail_error_cleanup BEFORE DELETE ON assistant_contact_message
+      WHEN OLD.status = 'error' BEGIN SELECT RAISE(ABORT, 'cleanup failed'); END;`);
+    expect(() => ensureContactSchema(db)).toThrow('cleanup failed');
+    expect(db.prepare('SELECT * FROM assistant_contact_part WHERE message_id=?').all(legacy.messageID)).toHaveLength(1);
+    db.exec('DROP TRIGGER fail_error_cleanup');
+    ensureContactSchema(db);
+    ensureContactSchema(db);
+    expect(listContactMessages(db, 'legacy').messages.map((message) => message.messageID)).toEqual([user.messageID]);
+    expect(db.prepare('SELECT * FROM assistant_contact_part WHERE message_id=?').all(legacy.messageID)).toEqual([]);
     db.close();
   });
 
@@ -718,7 +737,7 @@ describe('contact latest message preview', () => {
 });
 
 describe('contact read watermark / unread', () => {
-  it('counts only complete/error assistant and peer replies; ignores user and settle-only', () => {
+  it('counts complete assistant and peer replies; ignores errors, user and settle-only', () => {
     expect(isContactVisiblePart({ type: 'text', text: 'hi' })).toBe(true);
     expect(isContactVisiblePart({ type: 'text', text: '  ' })).toBe(false);
     expect(isContactVisiblePart({ type: 'text', text: CONTACT_SETTLE_TEXT.complete })).toBe(false);
@@ -793,7 +812,7 @@ describe('contact read watermark / unread', () => {
     insert(db, assistantID, { role: 'peer', text: 'p1', fromAssistantID: 'other', fromAssistantName: 'Peer' });
     insert(db, assistantID, { role: 'assistant', text: 'failed', status: 'error' });
     // No watermark → all countable unread.
-    expect(countContactUnread(db, assistantID)).toBe(3);
+    expect(countContactUnread(db, assistantID)).toBe(2);
     db.close();
   });
 

package/server/lib/assistants/service.js

@@ -1423,31 +1423,6 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
       throw error;
     }
   };
-  /** Durable failure bubble so APP restart can recover error without SSE. */
-  const persistContactTurnFailure = (assistantID, { userMessageID, turnID, error }) => {
-    const detail = typeof error === 'string' && error.trim() ? error.trim() : 'upstream_error';
-    const failureID = `${userMessageID}:error`;
-    if (getContactMessage(db, failureID)) return;
-    db.exec('BEGIN IMMEDIATE');
-    try {
-      insertContactMessage(db, {
-        messageID: failureID,
-        assistantID,
-        role: 'assistant',
-        turnID,
-        bubbleIndex: 0,
-        createdAt: now(),
-        ordinal: nextContactOrdinal(db, assistantID),
-        status: 'error',
-        parts: [{ type: 'text', text: detail }],
-      });
-      bump();
-      db.exec('COMMIT');
-    } catch (writeError) {
-      db.exec('ROLLBACK');
-      throw writeError;
-    }
-  };
   const contactBubbleMessageID = (userMessageID, bubbleIndex) => `${userMessageID}:bubble:${bubbleIndex + 1}`;
   const contactCardMessageID = (userMessageID, index) => `${userMessageID}:card:${index + 1}`;
 
@@ -2695,7 +2670,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     const messageID = scheduledRun ? `scheduled_${assistantID}_${scheduledRun.id}` : assignedSessionResumeMessageID(assistantID, sessionID, status, updatedAt);
     const capturedAssistant = scheduledRun ? output(row) : null;
     const turnID = messageID;
-    // Idempotent: same watch status already resumed (bubbles or durable error).
+    // Idempotent: same watch status already resumed with published output.
     if (
       getContactMessage(db, `${messageID}:bubble:1`)
       || getContactMessage(db, `${messageID}:error`)
@@ -2966,16 +2941,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
           ].filter((card, index, list) => list.findIndex((item) => contactCardIdentity(item) === contactCardIdentity(card)) === index);
         if (bubbles.length === 0 && cards.length === 0) {
           const detail = 'Assistant returned no text';
-          try {
-            persistContactTurnFailure(assistantID, {
-              userMessageID: messageID,
-              turnID,
-              error: detail,
-            });
-            settleActiveContactTurn(assistantID, turnID);
-          } catch {
-            settleActiveContactTurn(assistantID, turnID, { bumpRevision: true });
-          }
+          settleActiveContactTurn(assistantID, turnID, { bumpRevision: true });
           emitContactTurnEvent('openchamber:contact-turn-end', {
             assistantID,
             turnID,
@@ -3021,16 +2987,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
           ? error.message.trim()
           : (error?.code || 'upstream_error');
         const statusCode = error?.code === 'no_provider' ? 'no_provider' : (error?.code || 'upstream_error');
-        try {
-          persistContactTurnFailure(assistantID, {
-            userMessageID: messageID,
-            turnID,
-            error: detail,
-          });
-          settleActiveContactTurn(assistantID, turnID);
-        } catch {
-          settleActiveContactTurn(assistantID, turnID, { bumpRevision: true });
-        }
+        settleActiveContactTurn(assistantID, turnID, { bumpRevision: true });
         emitContactTurnEvent('openchamber:contact-turn-end', {
           assistantID,
           turnID,
@@ -3182,7 +3139,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
         };
         const modelContext = await loadContactModelContext(controller.signal);
         try {
-          // Materialize inside turn try so failures durable-error + settle working.
+          // Materialize inside turn try so failures emit live feedback and settle working.
           // DB/UI keep descriptors; harness + assign get execution-time data URLs under budget.
           const executionHistory = await materializeContactHistory(
             db,
@@ -3340,16 +3297,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
             ].filter((card, index, list) => list.findIndex((item) => contactCardIdentity(item) === contactCardIdentity(card)) === index);
           if (bubbles.length === 0 && cards.length === 0) {
             const detail = 'Assistant returned no text';
-            try {
-              persistContactTurnFailure(row.assistant_id, {
-                userMessageID: messageID,
-                turnID,
-                error: detail,
-              });
-              settleActiveContactTurn(row.assistant_id, turnID);
-            } catch {
-              settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
-            }
+            settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
             emitContactTurnEvent('openchamber:contact-turn-end', {
               assistantID: row.assistant_id,
               turnID,
@@ -3409,16 +3357,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
             ? error.message.trim()
             : (error?.code || 'upstream_error');
           const statusCode = error?.code === 'no_provider' ? 'no_provider' : (error?.code || 'upstream_error');
-          try {
-            persistContactTurnFailure(row.assistant_id, {
-              userMessageID: messageID,
-              turnID,
-              error: detail,
-            });
-            settleActiveContactTurn(row.assistant_id, turnID);
-          } catch {
-            settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
-          }
+          settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
           emitContactTurnEvent('openchamber:contact-turn-end', {
             assistantID: row.assistant_id,
             turnID,

package/server/lib/assistants/service.test.js

@@ -4230,8 +4230,11 @@ describe('assistants service', () => {
     service.close();
   });
 
-  it('persists a durable contact error bubble so query recovery works without SSE', async () => {
-    const service = setup(root(), {}, {
+  it('delivers contact errors without persisting a transcript message', async () => {
+    const directory = root();
+    const events = [];
+    const service = setup(directory, {}, {
+      onContactTurnEvent: (event) => events.push(event),
       runContactTurn: async () => {
         const error = new Error('No connected model');
         error.code = 'no_provider';
@@ -4247,10 +4250,23 @@ describe('assistants service', () => {
     const page = service.contactMessages(assistant.id);
     expect(page.messages.map((message) => ({ role: message.role, status: message.status, text: message.text }))).toEqual([
       { role: 'user', status: 'complete', text: 'hi' },
-      { role: 'assistant', status: 'error', text: 'No connected model' },
     ]);
     expect(service.snapshot().assistants[0]).toMatchObject({ working: false, activeContactTurn: null });
+    expect(events).toContainEqual(expect.objectContaining({
+      type: 'openchamber:contact-turn-end',
+      properties: expect.objectContaining({ status: 'error', error: 'No connected model' }),
+    }));
     service.close();
+    const restarted = setup(directory, {}, {
+      runContactTurn: async () => ({ text: 'ok', bubbles: ['ok'] }),
+    });
+    expect(restarted.contactMessages(assistant.id).messages.map((message) => message.text)).toEqual(['hi']);
+    await restarted.send(assistant.id, {
+      messageID: 'after_failure', parts: [{ type: 'text', text: 'again' }],
+    });
+    await restarted.whenContactTurnSettled('after_failure');
+    expect(restarted.contactMessages(assistant.id).messages.map((message) => message.text)).toEqual(['hi', 'again', 'ok']);
+    restarted.close();
   });
 
   it('bumps revision when queued contact turn becomes running', async () => {
@@ -4395,10 +4411,9 @@ describe('assistants service', () => {
       && event.properties?.status === 'error'
       && event.properties?.turnID === 'client_no_provider'
     ))).toBe(true);
-    // User row stays; durable error bubble enables query recovery without SSE.
+    // User row stays; error feedback is delivered only through the live event.
     expect(service.contactMessages(assistant.id).messages.map((message) => ({ role: message.role, status: message.status }))).toEqual([
       { role: 'user', status: 'complete' },
-      { role: 'assistant', status: 'error' },
     ]);
     service.close();
   });

package/server/lib/opencode/DOCUMENTATION.md

@@ -414,7 +414,7 @@ When adding or changing Host HTTP APIs that mobile/desktop clients reach over Pr
    - `GET /api/passkeys`
    - `DELETE /api/passkeys/:id`
    - `POST /api/auth/reset`
-    - `POST /api/client-auth/pairing/sessions`: accepts an optional `relayUrl` when Relay is included. An owner UI session or the local `desktop-local` shell client may set a custom endpoint (other client bearers receive HTTP 403). Canonical form is `ws://`/`wss://` scheme/host/path: userinfo is rejected (HTTP 400); query and fragment are stripped and are not part of endpoint identity. The Host persists the switch and reconnects its control connection before returning the pairing-v2 Relay candidate; an `OPENCHAMBER_RELAY_URL` override stays authoritative.
+     - `POST /api/client-auth/pairing/sessions`: accepts an optional `relayUrl` when Relay is included. An owner UI session, local `desktop-local` shell, or paired `desktop` operator may select a custom endpoint, including through Relay. Other client kinds cannot create pairing sessions. Canonical form is `ws://`/`wss://` scheme/host/path: userinfo is rejected (HTTP 400); query and fragment are stripped and are not part of endpoint identity. The Host adds a new endpoint without replacing existing endpoints before returning the pairing-v2 Relay candidate; an `OPENCHAMBER_RELAY_URL` override stays authoritative. The remote-host dialog permits custom endpoint editing unless that override locks it; remote selections are not saved as local-host preferences.
     - `GET /api/client-auth/pairing/transports`: returns direct transport availability. `relayAvailable` is true for desktop and SSH-managed remote hosts (`OPENCHAMBER_RUNTIME=desktop|ssh-remote`); local `dev` / `web` / ordinary CLI servers report false and omit Relay URL fields so the create-device dialog never defaults to Anywhere or probes the relay.
    - `GET /connect`
    - `POST /api/system/probe-url`

package/server/lib/opencode/core-routes.js

@@ -395,7 +395,6 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     // [] when relay status is unavailable. Gates remote-bearer pairing requests
     // that carry a relayUrl: paired desktops may only use an endpoint the host
     // already has (echo of any configured endpoint, never a re-point).
-    getEffectiveRelayUrls = async () => [],
     // Candidates for EVERY configured relay endpoint (multi-relay), or null /
     // a non-array when only the single-endpoint accessor is available. Feeds
     // the connection-candidates refresh so paired devices learn the full
@@ -897,19 +896,8 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
       if (req.body?.relayUrl !== undefined && !requestedRelayUrl) {
         return res.status(400).json({ error: 'Relay URL must use ws:// or wss://' });
       }
-      // Changing the Host Relay endpoint set is an owner-UI or local
-      // desktop-shell action. Paired desktop operators reach this handler too,
-      // but may only name an endpoint the host already uses — anything else
-      // would re-point (or extend) the Host relay from a remote bearer.
-      if (requestedRelayUrl !== undefined && authContext?.type === 'client') {
-        const actingClient = authContext.client || await clientRecordFromAuthContext(authContext);
-        if (actingClient?.clientKind !== 'desktop-local') {
-          const effectiveRelayUrls = await getEffectiveRelayUrls();
-          if (!Array.isArray(effectiveRelayUrls) || !effectiveRelayUrls.includes(requestedRelayUrl)) {
-            return res.status(403).json({ error: 'Only the owner UI session can set a custom Relay endpoint' });
-          }
-        }
-      }
+      // The create-auth gate grants paired desktop operators the same pairing
+      // endpoint selection as the owner, including adding a new Relay endpoint.
       const candidates = await pairingServerCandidates(req, {
         preferredServerUrl: req.body?.serverUrl,
         includeRelay: typeof req.body?.includeRelay === 'boolean' ? req.body.includeRelay : undefined,

package/server/lib/opencode/core-routes.test.js

@@ -990,12 +990,10 @@ describe('core-routes', () => {
     expect(dependencies.clientPairingRuntime.createPairingSession).not.toHaveBeenCalled();
   });
 
-  it('forbids paired desktop clients from re-pointing the Relay endpoint when pairing', async () => {
-    const getRelayPairingCandidate = vi.fn();
-    const getEffectiveRelayUrls = vi.fn(async () => ['wss://relay.example/ws']);
+  it('lets paired desktop clients select a new Relay endpoint when pairing', async () => {
+    const getRelayPairingCandidate = vi.fn(async ({ relayUrl }) => ({ type: 'relay', relayUrl }));
     const { app, dependencies } = createPairingRouteApp({
       getRelayPairingCandidate,
-      getEffectiveRelayUrls,
       uiAuthController: {
         resolveAuthContext: vi.fn(async () => ({
           type: 'client',
@@ -1020,11 +1018,11 @@ describe('core-routes', () => {
 
     await request(app)
       .post('/api/client-auth/pairing/sessions')
-      .send({ includeRelay: true, relayUrl: 'wss://attacker.example/ws' })
-      .expect(403, { error: 'Only the owner UI session can set a custom Relay endpoint' });
+      .send({ includeRelay: true, relayUrl: 'wss://custom-relay.example/ws' })
+      .expect(201);
 
-    expect(getRelayPairingCandidate).not.toHaveBeenCalled();
-    expect(dependencies.clientPairingRuntime.createPairingSession).not.toHaveBeenCalled();
+    expect(getRelayPairingCandidate).toHaveBeenCalledWith({ ensureEnabled: true, relayUrl: 'wss://custom-relay.example/ws' });
+    expect(dependencies.clientPairingRuntime.createPairingSession).toHaveBeenCalledWith(expect.objectContaining({ usesRelay: true, createdByClientId: 'remote-desktop-1' }));
   });
 
   it('lets paired desktop clients echo the current Relay endpoint when pairing', async () => {
@@ -1035,10 +1033,8 @@ describe('core-routes', () => {
       hostEncPubJwk: { kty: 'EC', crv: 'P-256', x: 'aaa', y: 'bbb' },
       priority: 30,
     }));
-    const getEffectiveRelayUrls = vi.fn(async () => ['wss://relay.example/ws', 'wss://relay2.example/ws']);
     const { app } = createPairingRouteApp({
       getRelayPairingCandidate,
-      getEffectiveRelayUrls,
       uiAuthController: {
         resolveAuthContext: vi.fn(async () => ({
           type: 'client',

package/server/lib/relay/DOCUMENTATION.md

@@ -19,7 +19,7 @@ Traffic is modeled as three stacked layers. The relay understands only Layer 1;
 ## Entrypoints and structure
 
 Host side (`packages/web/server/lib/relay/`):
-- `service.js` — thin entrypoint: relay config (enabled flag + endpoints), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`, `POST /api/openchamber/relay/endpoints`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. **Multi-relay:** `settings.privateRelay = { enabled, relayUrl, extraRelayUrls }` — the host dials EVERY configured endpoint simultaneously with one identity (same serverId); clients treat `serverId + relayUrl` as the instance identity, so the same machine exposed via two domains appears as two separately named instances. The primary (`relayUrl`) owns push registration and stays the default pairing candidate. A pairing link created for an endpoint the host does not have yet APPENDS it as an extra endpoint (owner request only) instead of replacing the primary, so devices paired over the old domain keep working. `POST /relay/endpoints` (owner session / `desktop-local` only) replaces the extra-endpoint list wholesale and starts/stops host connections incrementally. Paired desktops may pair over any CONFIGURED endpoint but can never add one. Host lifecycle is gated by `isRelayHostRuntime()` (`desktop` or `ssh-remote`): other runtimes (`bun run dev`, `dev:web:hmr`, ordinary CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, `/relay/endpoints`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` unless it is already `ssh-remote`, so a leftover desktop env cannot open the host-control socket. On host runtimes, started from `packages/web/server/index.js` when demand/opt-in enables the relay. Desktop auto-clears `privateRelay.enabled` when demand drops; `ssh-remote` keeps an explicit opt-in (e.g. `openchamber serve --relay-host`) sticky until disabled. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session or the local `desktop-local` shell client; `/relay/enable` follows its API auth gate. `derivePushSendUrlFromRelayUrl` maps a canonical Relay `wss://`/`ws://` URL to the same host's `https://`/`http://` `/v1/push/send` path (register is `/v1/push/register-token`); `OPENCHAMBER_PUSH_RELAY_URL` on the Host overrides that derivation. The isolated Push process lives in `packages/relay-server/src/push/` and does not share Layer 1 credentials or tunnel state.
+- `service.js` — thin entrypoint: relay config (enabled flag + endpoints), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`, `POST /api/openchamber/relay/endpoints`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. **Multi-relay:** `settings.privateRelay = { enabled, relayUrl, extraRelayUrls }` — the host dials EVERY configured endpoint simultaneously with one identity (same serverId); clients treat `serverId + relayUrl` as the instance identity, so the same machine exposed via two domains appears as two separately named instances. The primary (`relayUrl`) owns push registration and stays the default pairing candidate. A pairing link created for an endpoint the host does not have yet APPENDS it as an extra endpoint instead of replacing the primary, so devices paired over the old domain keep working. `POST /relay/endpoints` (owner session / `desktop-local` only) replaces the extra-endpoint list wholesale and starts/stops host connections incrementally. Paired desktop operators may also add an endpoint through pairing creation. Host lifecycle is gated by `isRelayHostRuntime()` (`desktop` or `ssh-remote`): other runtimes (`bun run dev`, `dev:web:hmr`, ordinary CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, `/relay/endpoints`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` unless it is already `ssh-remote`, so a leftover desktop env cannot open the host-control socket. On host runtimes, started from `packages/web/server/index.js` when demand/opt-in enables the relay. Desktop auto-clears `privateRelay.enabled` when demand drops; `ssh-remote` keeps an explicit opt-in (e.g. `openchamber serve --relay-host`) sticky until disabled. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session, local `desktop-local` shell client, or paired `desktop` operator; `/relay/enable` follows its API auth gate. `derivePushSendUrlFromRelayUrl` maps a canonical Relay `wss://`/`ws://` URL to the same host's `https://`/`http://` `/v1/push/send` path (register is `/v1/push/register-token`); `OPENCHAMBER_PUSH_RELAY_URL` on the Host overrides that derivation. The isolated Push process lives in `packages/relay-server/src/push/` and does not share Layer 1 credentials or tunnel state.
 - `identity.js` — the host's stable identity: the long-lived signing keypair (shared with the push relay, defines the routing id) plus a long-lived encryption keypair (the E2EE trust anchor). Reused across restarts; never rotated implicitly.
 - `signing-key.js` — storage/derivation of the signing keypair and the routing id, shared with the notifications runtime. Canonical public JWK hashing matches `packages/relay-server/src/push/crypto.js`.
 - `host-client.js` — the long-lived connection manager: one outbound control connection to the relay, a per-client data connection for each connected device, reconnect/backoff, and the E2EE responder handshake per connection. Control reconnect backoff does not reset on WebSocket `open`; `consecutiveFailures` clears only after the control socket stays up for `controlStableMs` (15s default), so an open-then-drop loop backs off to 30s instead of retrying every 1s.
@@ -61,7 +61,7 @@ See also `packages/web/server/lib/opencode/DOCUMENTATION.md` (“Catalog / OpenC
 ## Authentication model
 
 - The tunnel is **transport only**. The OpenChamber server still authenticates every tunneled request exactly as it authenticates a direct remote client. The relay path grants reachability, not authorization.
-- A paired **desktop** client is a device-fleet operator: through the tunnel it can create pairing links, list every paired device, and revoke other devices (parity with the SSH attach flow, where the connecting desktop authenticates as the operator). Mobile (and any other) paired clients stay scoped to their own record. Re-pointing the Host relay endpoint set from a remote bearer remains forbidden — a paired desktop may name any endpoint the host already has, but adding/removing endpoints (including `relayUrl` in pairing requests for a new domain) is an owner-UI / local-desktop-shell action.
+- A paired **desktop** client is a device-fleet operator: through the tunnel it can create pairing links using existing or custom Relay endpoints, list every paired device, and revoke other devices (parity with the SSH attach flow). Pairing with a new endpoint appends it without replacing existing endpoints. Wholesale endpoint-list replacement/removal remains an owner-UI / local-desktop-shell action. Mobile (and any other) paired clients stay scoped to their own record.
 - Clients carry their normal credential. HTTP and SSE requests authenticate with the client's bearer token (a header). **WebSocket upgrades cannot send headers**, so they authenticate with a short-lived URL-scoped token minted beforehand and passed as a query parameter. This asymmetry is important when adding new WebSocket features (see the skill).
 - Desktop switch preflight calls `/auth/session` with the saved bearer over a pinned tunnel before adopting it. `/health` and cached reachability badges provide transport information only. Failed or timed-out probes close their temporary tunnel and preserve the active runtime; successful switch probes transfer ownership of the authenticated tunnel to the runtime.
 - The host authenticates itself to the relay with a signed handshake using its long-lived signing key.

package/server/lib/session-index/DOCUMENTATION.md

@@ -100,6 +100,9 @@ consume further pages within a small page budget so the newest-20 **active**
 window can still fill; exhausting the budget before the window is full is an
 explicit partial result (`hasMore` stays true). `replaceDirectory` /
 event-ingest upsert keep active-only rows (archived clears the summary and pin).
+An envelope without a next cursor is exhausted even when the final page is full.
+After exhaustion, `hasMore` is true only when visible root sessions overflow the
+20-row index window; child, archived, and system rows do not create a Show-more hint.
 It publishes an in-memory revision after every externally observable index or
 synchronization-state change. A successful empty directory refresh remains in
 the snapshot so another client can use it as a worktree-topology recovery hint.

package/server/lib/session-index/sync-runtime.js

@@ -225,8 +225,9 @@ export const createSessionIndexSyncRuntime = ({
           continue;
         }
 
-        // No next token: bare-array / terminal page.
-        if (!pageFull) {
+        // An envelope without a next token is authoritative exhaustion, even
+        // when its terminal page is full. Bare arrays still use the page size.
+        if (isEnvelope || !pageFull) {
           upstreamHasMore = false;
           break;
         }
@@ -254,9 +255,13 @@ export const createSessionIndexSyncRuntime = ({
 
       // Root + system filters before filling the active-20 capacity.
       const active = [];
+      let hasOverflowSessions = false;
       for (const session of projected) {
         if (!isRootActiveCandidate(session)) continue;
-        if (active.length >= SESSION_LIMIT) break;
+        if (active.length >= SESSION_LIMIT) {
+          hasOverflowSessions = true;
+          break;
+        }
         active.push(session);
       }
 
@@ -268,7 +273,7 @@ export const createSessionIndexSyncRuntime = ({
         directory: task.directory,
         sessions: active,
         cursor: cursorNumber,
-        hasMore: upstreamHasMore || hitPageBudget || active.length === SESSION_LIMIT,
+        hasMore: upstreamHasMore || hitPageBudget || hasOverflowSessions,
         fullSync: true,
         now: now(),
       });