thinkpool-pair 0.7.169 → 0.7.171

package/account.mjs

@@ -116,17 +116,170 @@ export async function runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) {
   await new Promise(() => {})
 }
 
-// Exchange the stored refresh token for a live session + authed client.
+// A promise that resolves after ms, never keeping the loop alive on its own.
+const sleep = (ms) => new Promise((r) => { const t = setTimeout(r, ms); t.unref?.() })
+
+// Reject a promise if it doesn't settle within ms — so a wedged realtime socket can't
+// freeze a Supabase call (and the tick that awaits it) forever (the 2026-07-08 wedge:
+// a tick hung on a half-open socket, the re-entrancy guard stuck true, the claim
+// heartbeat stopped, and the bridge stood by against its own 564s-stale row).
+export function withTimeout(promise, ms, label = 'op') {
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms); t.unref?.()
+    Promise.resolve(promise).then((v) => { clearTimeout(t); resolve(v) }, (e) => { clearTimeout(t); reject(e) })
+  })
+}
+
+// Decode a JWT's `exp` (unix seconds) WITHOUT verifying — used only to decide whether the
+// saved access token is fresh enough to skip a refresh. 0 on any parse failure (→ refresh).
+function jwtExpSeconds(token) {
+  try {
+    const seg = String(token).split('.')[1]
+    const json = Buffer.from(seg.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8')
+    const exp = JSON.parse(json)?.exp
+    return typeof exp === 'number' ? exp : 0
+  } catch { return 0 }
+}
+
+// F1 predicate (pure, testable): is the saved access token still worth adopting WITHOUT a
+// refresh? True iff we have an access token whose expiry (from the persisted expires_at, or
+// decoded from the JWT) is more than marginSec ahead of now. Skipping the refresh here is
+// one fewer rotation → one fewer race window / mid-rotation brick.
+export function savedTokenStillValid(saved, nowSec = Math.floor(Date.now() / 1000), marginSec = 300) {
+  if (!saved?.access_token) return false
+  const expSec = saved.expires_at || jwtExpSeconds(saved.access_token)
+  return !!expSec && (expSec - nowSec) > marginSec
+}
+
+// ── cross-process refresh serialization (F3) ────────────────────────────────
+// Two bridges refreshing ONE refresh token outside Supabase's short reuse window makes
+// Supabase revoke the entire token FAMILY — every future refresh then fails permanently
+// until a fresh login. A short-lived lock file serializes the actual network refresh
+// across processes; a lock older than staleMs is stale (holder crashed mid-refresh) and
+// is taken over. fs errors fail-OPEN (return true) — a lock we can't manage must never
+// block a genuine refresh. Exported for the test harness.
+const REFRESH_LOCK = path.join(os.homedir(), '.thinkpool-pair', 'refresh.lock')
+export function acquireRefreshLock(lockPath = REFRESH_LOCK, staleMs = 30_000) {
+  try { fs.mkdirSync(path.dirname(lockPath), { recursive: true }) } catch { /* noop */ }
+  for (let i = 0; i < 2; i++) {
+    try {
+      const fd = fs.openSync(lockPath, 'wx')   // atomic create-exclusive
+      fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() })); fs.closeSync(fd)
+      return true
+    } catch (e) {
+      if (e.code !== 'EEXIST') return true       // unmanageable → fail open
+      let age = Infinity
+      try { age = Date.now() - (JSON.parse(fs.readFileSync(lockPath, 'utf8'))?.at || 0) } catch { age = Infinity }
+      if (age < staleMs) return false            // a live refresh holds it → back off
+      try { fs.rmSync(lockPath, { force: true }) } catch { return true }   // stale → drop + retry
+    }
+  }
+  return false
+}
+export function releaseRefreshLock(lockPath = REFRESH_LOCK) { try { fs.rmSync(lockPath, { force: true }) } catch { /* noop */ } }
+
+// Build an authed session from a saved {access_token, refresh_token} WITHOUT rotating the
+// refresh token. setSession validates the access token (getUser — no rotation) when it is
+// still valid; callers only ever adopt a FRESH token, so it never falls through to a refresh.
+async function adoptSavedSession(sb, saved) {
+  if (!saved?.access_token || !saved?.refresh_token) return null
+  try {
+    const { data, error } = await sb.auth.setSession({ access_token: saved.access_token, refresh_token: saved.refresh_token })
+    if (error || !data?.session) return null
+    return data.session
+  } catch { return null }
+}
+
+// One refresh, serialized across processes + adopting a sibling's rotation (F3). Steps:
+//   • auth.json already holds a DIFFERENT refresh token than the one we carry → a sibling
+//     (or a re-mint) rotated: ADOPT the disk pair instead of refreshing again.
+//   • else take the refresh lock; if a sibling holds it, wait briefly and adopt THEIR
+//     rotated result rather than racing a second rotation (which revokes the family).
+//   • under the lock, re-read disk once more, then refreshSession → saveAuth.
+// Deps are injectable for the test harness. Returns { session, adopted } or null.
+export async function refreshAccountSession(sb, holdRefreshToken, deps = {}) {
+  const { load = loadAuth, save = saveAuth, acquire = acquireRefreshLock, release = releaseRefreshLock, wait = sleep } = deps
+  const adoptIfRotated = async (rt) => {
+    const d = load()
+    if (d?.refresh_token && rt && d.refresh_token !== rt) {
+      const s = await adoptSavedSession(sb, d)
+      if (s) return { session: s, adopted: true }
+    }
+    return null
+  }
+  let adopted = await adoptIfRotated(holdRefreshToken)
+  if (adopted) return adopted
+  const rt0 = load()?.refresh_token || holdRefreshToken
+  if (!rt0) return null
+  let locked = acquire()
+  if (!locked) {
+    // A sibling is mid-refresh. Wait for it to finish and adopt its rotated pair rather
+    // than firing a competing rotation (the family-revoke race).
+    for (let i = 0; i < 20; i++) {
+      await wait(250)
+      adopted = await adoptIfRotated(rt0)
+      if (adopted) return adopted
+      if (acquire()) { locked = true; break }
+    }
+    if (!locked) return null   // couldn't get the lock or adopt — caller retries later
+  }
+  try {
+    adopted = await adoptIfRotated(rt0)   // re-check under the lock (sibling may have just finished)
+    if (adopted) return adopted
+    const rt = load()?.refresh_token || rt0
+    const { data, error } = await sb.auth.refreshSession({ refresh_token: rt })
+    if (error || !data?.session) return null
+    save(data.session)   // atomic (auth-store) — never a torn token file
+    return { session: data.session, adopted: false }
+  } finally { if (locked) release() }
+}
+
+// Exchange the stored credentials for a live session + authed client.
 export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
   const a = loadAuth()
   if (!a?.refresh_token) return null
   const sb = createClient(SUPABASE_URL, SUPABASE_ANON, { auth: { persistSession: false, autoRefreshToken: false } })
-  try {
-    const { data, error } = await sb.auth.refreshSession({ refresh_token: a.refresh_token })
-    if (error || !data?.session) return null
-    saveAuth(data.session)   // rotate the refresh token
-    return { sb, session: data.session }
-  } catch { return null }
+  // F1: skip the refresh entirely when the saved access token is still comfortably valid
+  // (>5 min to expiry). Every gratuitous startup rotation is a race window — and, killed
+  // mid-rotation, a login-brick. Adopt the saved pair; scheduleTokenRefresh rotates near
+  // expiry as it already does.
+  if (savedTokenStillValid(a)) {
+    const s = await adoptSavedSession(sb, a)
+    if (s) return { sb, session: s }
+  }
+  // Near-expiry / missing / invalid access token → do a serialized rotation (F3).
+  const r = await refreshAccountSession(sb, a.refresh_token)
+  if (!r?.session) return null
+  return { sb, session: r.session }
+}
+
+// F2: startup refresh can fail transiently (offline, a sibling mid-rotation, a wedged
+// socket). Retry IN-PROCESS with backoff — NEVER exit(1), because launchd KeepAlive would
+// respawn us within seconds and each respawn hammers the refresh path (the 16× crash
+// storm). authedClient re-reads auth.json every attempt, so a re-mint or a sibling's
+// rotation is picked up on the next try. Returns null ONLY when there is no saved login
+// at all (genuinely not linked) — the caller then stands down CLEANLY (exit 0, no respawn).
+// Deps injectable for the test harness.
+export async function authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, opts = {}) {
+  const { attempt = authedClient, load = loadAuth, wait = sleep, onRetry = null, maxAttempts = Infinity, baseMs = 15_000, capMs = 300_000 } = opts
+  let delay = baseMs
+  for (let n = 1; n <= maxAttempts; n++) {
+    const a = await attempt(SUPABASE_URL, SUPABASE_ANON)
+    if (a) return a
+    if (!load()?.refresh_token) return null   // not linked — caller says `login`, exits 0
+    if (n >= maxAttempts) break
+    onRetry?.(delay, n)
+    await wait(delay)
+    delay = Math.min(delay * 2, capMs)
+  }
+  return null
+}
+
+// Pure predicate (2026-07-08): the claim/heartbeat loop is "wedged" when no successful
+// claim has landed in ≥ quietMsThreshold (default 40s = ~2 missed 15s ticks). Extracted so
+// the watchdog's trigger is unit-testable without a live socket.
+export function claimLoopWedged({ lastClaimOkAt, now, quietMsThreshold = 40_000 }) {
+  return (now - lastClaimOkAt) >= quietMsThreshold
 }
 
 // ── keep the account JWT fresh (presence keepalive) ─────────────────────────
@@ -143,7 +296,7 @@ export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
 //   skewMs  — refresh this far ahead of expiry (default 90s)
 //   forceMs — fixed interval override (test hook: TP_TOKEN_REFRESH_FORCE_MS)
 //   retryMs — backoff after a transient failure (offline / rotation race)
-export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000, forceMs = 0, retryMs = 30_000 }) {
+export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000, forceMs = 0, retryMs = 30_000, refresh = refreshAccountSession }) {
   let timer = null
   let cur = session
   let cancelled = false
@@ -162,9 +315,12 @@ export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000
   async function tick() {
     if (cancelled) return
     try {
-      const { data, error } = await sb.auth.refreshSession({ refresh_token: cur.refresh_token })
-      if (error || !data?.session) throw error || new Error('no session')
-      cur = data.session
+      // Serialized refresh (F3): re-reads auth.json and adopts a sibling's rotated pair
+      // instead of blindly refreshing with our in-memory `cur.refresh_token` — the old
+      // tick retried with a stale token it held and could lose the family to a race.
+      const r = await refresh(sb, cur.refresh_token)
+      if (!r?.session) throw new Error('no session')
+      cur = r.session
       // Hand the fresh token to the live realtime socket so the presence
       // connection stays authed across the swap (no drop, no rejoin needed).
       try { sb.realtime?.setAuth?.(cur.access_token) } catch { /* noop */ }
@@ -196,17 +352,22 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.error('\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    `npx thinkpool-pair <ROOM>`.\n')
     process.exit(0)
   }
-  const auth = await authedClient(SUPABASE_URL, SUPABASE_ANON)
+  // F2: NEVER exit(1) on a refresh failure. The old code exited 1 here, and launchd
+  // KeepAlive respawned us within seconds → refresh again → the 16× crash storm (and,
+  // worse, hammering the refresh path burns rotations and can revoke the token family).
+  // Instead retry IN-PROCESS with backoff, re-reading auth.json each time so a headless
+  // re-mint or a sibling's rotation is picked up without a restart. Do NOT delete
+  // auth.json — a transient failure must never wipe a still-valid login (2026-06-17).
+  const auth = await authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, {
+    onRetry: (delay) => process.stderr.write(`\n  ◇ Couldn't refresh your account session yet (offline, or another bridge is mid-rotation) — retrying in ${Math.round(delay / 1000)}s. Saved login left in place.\n`),
+  })
   if (!auth) {
     releaseSingleton()
-    // Do NOT delete auth.json here. A refresh can fail transiently (offline) or
-    // lose a refresh-token rotation race with another bridge sharing this login —
-    // wiping the file on that destroys a still-valid login. Leave it: only an
-    // explicit `login` should ever replace the token (saveAuth overwrites it).
-    // (2026-06-17: a second account supervisor raced the token and the old
-    // clearAuth() here deleted a live Pro login mid-session.)
-    console.error('\n  ◇ Couldn\'t refresh your account session (offline, or another bridge\n    may be using this login). Your saved login was left in place.\n    If this keeps happening, re-link:  npx thinkpool-pair login\n')
-    process.exit(1)
+    // Reached ONLY when there is no saved login at all (not linked). Stand down CLEANLY
+    // with exit 0: launchd KeepAlive has SuccessfulExit=false, so exit 0 is NOT respawned
+    // — no crash storm for the "never logged in" case. The user links with `login`.
+    console.error('\n  ◇ Not linked to a ThinkPool account on this machine.\n    Link it:  npx thinkpool-pair login\n')
+    process.exit(0)
   }
   const { sb, session } = auth
   const email = session.user?.email || 'your account'
@@ -422,7 +583,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
-  await new Promise((res) => acct.subscribe((st) => { if (st === 'SUBSCRIBED') { pushPresence(); res() } }))
+  await new Promise((res) => acct.subscribe((st) => {
+    if (st === 'SUBSCRIBED') { pushPresence(); res() }
+    else if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
+      // Realtime dropped (the 2026-07-08 `realtime CLOSED` blip). The socket normally
+      // auto-reconnects, but nudge it so presence — and the claim heartbeat that shares
+      // this client — recover instead of the loop standing by against its own stale row.
+      // The callback stays wired for the channel's life, so later rejoins re-fire it.
+      try { sb.realtime?.connect?.() } catch { /* noop */ }
+    }
+  }))
 
   // Keep the account JWT fresh so the presence socket never gets deauthed at
   // expiry (the 2026-06-17 "No bridge connected while sessions run" bug). On each
@@ -451,9 +621,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const BRIDGE_ID = randomUUID()
   let claimHeld = false
   let standbyHost = null
+  // Wall-clock of the last SUCCESSFUL claim RPC. The heartbeat watchdog (below) uses it to
+  // detect a wedged loop and self-heal — the 2026-07-08 outage stood by against its OWN
+  // 564s-stale row because the tick had frozen and the heartbeat simply stopped.
+  let lastClaimOkAt = Date.now()
   const refreshClaim = async () => {
     try {
-      const { data } = await sb.rpc('claim_bridge', { p_bridge_id: BRIDGE_ID, p_hostname: machine })
+      // Time-box the RPC: a half-open realtime socket must not freeze the heartbeat (and
+      // the tick that awaits it) forever. On timeout we throw → keep the prior held state.
+      const { data } = await withTimeout(sb.rpc('claim_bridge', { p_bridge_id: BRIDGE_ID, p_hostname: machine }), 10_000, 'claim_bridge')
+      lastClaimOkAt = Date.now()
       const c = Array.isArray(data) ? data[0] : data
       const held = !!c?.held
       const host = c?.holder_host || '?'
@@ -578,12 +755,20 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // awaits a code_sessions query before children.set(), so two overlapping runs can
   // both see children.has(room) false and DOUBLE-SPAWN a 2nd bridge for one room
   // (two bridges per room = the CASCADE-delete / ghost-terminal hazard). Serialize.
-  let ticking = false
+  // SELF-HEALING guard (2026-07-08): a plain boolean stuck `true` was the wedge — a tick
+  // that hung on a half-open socket never ran its `finally`, so `ticking` stayed true and
+  // every later tick returned early forever (heartbeat dead, own row goes 564s stale). Use
+  // a start-timestamp instead: a prior run older than 60s is presumed wedged and we proceed
+  // anyway (the timed-out awaits inside now guarantee it eventually unwinds).
+  let tickingSince = 0
   const tick = async () => {
-    if (ticking) return
-    ticking = true
-    try { await tickBody() } finally { ticking = false }
+    const now = Date.now()
+    if (tickingSince && now - tickingSince < 60_000) return   // a genuine in-flight tick
+    tickingSince = now
+    try { await tickBody() } finally { if (tickingSince === now) tickingSince = 0 }
   }
+  // Expose for the watchdog to force-unwedge the guard after a reconnect.
+  const clearTickGuard = () => { tickingSince = 0 }
   const tickBody = async () => {
     // Hold the account claim before serving anything (cross-machine guard). When
     // standing by, make sure we're serving nothing and wait for the next tick.
@@ -778,6 +963,24 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const iv = setInterval(tick, 15000)
   const updateTimers = []   // auto-update poll/apply timers — cleared in stop() so none fire post-exit
   let stopping = false
+
+  // ── claim/heartbeat watchdog (2026-07-08) ──────────────────────────────────
+  // The 15s tick carries the claim heartbeat. If anything inside a tick wedged (a half-open
+  // realtime socket), the heartbeat stopped, our own claim row went stale, and — because a
+  // same-host holder is never displaced by itself — the bridge stood by FOREVER against its
+  // own ghost (the 564s-stale-own-hostname outage). This timer runs on its OWN interval so a
+  // wedged tick can't starve it: when the claim has been quiet ≥2 ticks it nudges realtime
+  // to reconnect, force-clears the re-entrancy guard, and re-issues the heartbeat directly
+  // (claim_bridge is a plain HTTP RPC — it recovers even while the socket is still flapping).
+  const heartbeatWatch = setInterval(async () => {
+    if (stopping) return
+    if (!claimLoopWedged({ lastClaimOkAt, now: Date.now() })) return
+    console.log(`claim_watchdog sup=${SUP_ID} quiet_ms=${Date.now() - lastClaimOkAt} — reconnecting realtime + re-claiming`)
+    try { sb.realtime?.connect?.() } catch { /* noop */ }
+    clearTickGuard()   // unwedge the guard so the next scheduled tick can run
+    try { await refreshClaim(); pushPresence() } catch { /* the next tick retries */ }
+  }, 20_000)
+  heartbeatWatch.unref?.()
   // restart-vs-stop is the ONLY difference in exit code: a web "restart" sets this so
   // we exit non-zero (every supervisor respawns); a normal stop/shutdown exits 0.
   const stop = (sig) => {
@@ -787,6 +990,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     // ── supervisor stand-down logging (cascade brg-instrument) ─────────────────
     console.log(`supervisor_stop sup=${SUP_ID} reason=${sig || 'unknown'} restarting=${restarting} children=${children.size}`)
     clearInterval(iv)
+    clearInterval(heartbeatWatch)
     for (const t of updateTimers) { try { clearInterval(t) } catch { /* noop */ } }   // clearInterval clears Timeouts too
     keepFresh.cancel()
     releaseSingleton()

package/auth-store.mjs

@@ -22,14 +22,32 @@ function ensureDir() { try { fs.mkdirSync(DIR, { recursive: true }) } catch { /*
 export function saveAuth(session) {
   if (!session?.refresh_token) return
   ensureDir()
+  const payload = JSON.stringify({
+    refresh_token: session.refresh_token,
+    access_token: session.access_token || null,
+    // Unix SECONDS. Lets the bridge adopt the saved access token WITHOUT a refresh while
+    // it's still comfortably valid (account.mjs F1) — every skipped rotation is one fewer
+    // race window (and one fewer chance to be killed mid-rotation and brick the login).
+    expires_at: session.expires_at || null,
+    email: session.user?.email || session.email || null,
+    savedAt: Date.now(),
+  })
+  // ATOMIC write (2026-07-08): a crash/kill/kickstart mid-write must never leave a
+  // truncated auth.json — an unparseable token file reads as "not linked" and bricks the
+  // saved login (three bridge outages in two days, one from a restart landing mid-rotation).
+  // Write a sibling temp file, fsync it to disk, then rename OVER auth.json — rename is
+  // atomic on one filesystem, so any concurrent reader sees the whole old file or the whole
+  // new one, never a half-written token. This does NOT undo Supabase's server-side rotation
+  // (that invalidates the old token the instant refreshSession returns) — the frequency of
+  // rotation is cut by F1/F3 in account.mjs; this guarantees the file itself is never torn.
+  const tmp = `${AUTH}.tmp.${process.pid}.${Date.now()}`
   try {
-    fs.writeFileSync(AUTH, JSON.stringify({
-      refresh_token: session.refresh_token,
-      access_token: session.access_token || null,
-      email: session.user?.email || session.email || null,
-      savedAt: Date.now(),
-    }), { mode: 0o600 })
-  } catch { /* noop */ }
+    const fd = fs.openSync(tmp, 'w', 0o600)
+    try { fs.writeSync(fd, payload); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+    fs.renameSync(tmp, AUTH)
+  } catch {
+    try { fs.rmSync(tmp, { force: true }) } catch { /* noop */ }
+  }
 }
 export function loadAuth() { try { return JSON.parse(fs.readFileSync(AUTH, 'utf8')) } catch { return null } }
 export function clearAuth() { try { fs.unlinkSync(AUTH) } catch { /* noop */ } }

package/bridge.mjs

@@ -92,7 +92,7 @@ const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine } from './event-id.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP } from './event-id.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
@@ -987,6 +987,13 @@ const announce = () => {
     // host (e.g. openrouter.ai). Older web clients ignore unknown fields.
     provider: PROVIDER_INFO.provider,
     providerBaseUrl: PROVIDER_INFO.baseUrl || undefined,
+    // ctxCarry: this bridge re-feeds a plain-text recap of the visible chat into the
+    // FRESH session after a provider switch (the 2026-07-08 context-carry work —
+    // openStructured carryRecap → pendingRecap → sendTurn). The UI reads it as
+    // bridgeInfo.ctxCarry to word the switch warning honestly: WITH carry the agent
+    // "rejoins from a recap of this chat"; WITHOUT it (older bridge, flag absent) it
+    // "starts blank". Additive top-level boolean; older clients ignore the unknown key.
+    ctxCarry: true,
     // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), used by the
     // dashboard to seal a provider's API key so it reaches the bridge without ever
     // crossing the wire in the clear. Computed once (the keypair is stable).
@@ -1222,8 +1229,19 @@ const handleManifest = async (box, file, term) => {
   let m
   try { m = JSON.parse(fs.readFileSync(full, 'utf8')) } catch { return }
   if (!m?.slug) return
-  const readB64 = (p) => { try { return p && fs.readFileSync(p).toString('base64') } catch { return null } }
-  const readTxt = (p) => { try { return p && fs.readFileSync(p, 'utf8') } catch { return null } }
+  // 2026-07-07: these used to swallow read errors silently — a transient
+  // unreadable file (race with the render script, permissions, mid-write)
+  // meant the manifest still POSTed with that field missing, and nothing
+  // anywhere logged why. Surface it on stderr so a blank mockup pane in the
+  // room has a breadcrumb on the host side instead of just vanishing.
+  const readB64 = (p) => {
+    try { return p && fs.readFileSync(p).toString('base64') }
+    catch (e) { if (p) process.stderr.write(`\n  ◇ mockup asset unreadable: ${p} (${e?.code || e?.message || e})\n`); return null }
+  }
+  const readTxt = (p) => {
+    try { return p && fs.readFileSync(p, 'utf8') }
+    catch (e) { if (p) process.stderr.write(`\n  ◇ mockup asset unreadable: ${p} (${e?.code || e?.message || e})\n`); return null }
+  }
   const cid = randomUUID()
   try {
     const mockupHeaders = { 'Content-Type': 'application/json' }
@@ -1505,7 +1523,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider }) {
+function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap }) {
   if (sessions.has(id)) return
   // spawnedBy: set when this lane was Dispatched (spawn_terminal). Restored from the
   // session store so the Ensemble flag survives a bridge restart (else a respin
@@ -2019,6 +2037,13 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
       }
     : null
   entry.deferred = !!defer   // a lazily-booted idle terminal — the background warmer will boot it
+  // Context-carry (2026-07-08): a non-resumable re-open (provider switch / non-resumable
+  // restart) hands the FRESH session a plain-text recap of the visible log as its first
+  // input, so the agent picks up the work instead of starting blank mid-conversation. Held
+  // here (transient — NOT in sessionData, a re-restart re-derives it from the log) and fired
+  // on the init `system` event (see onEvent) — a sendTurn before the input stream is consumed
+  // is silently lost (the 2026-07-02 auto-resume bug). Empty string → nothing to carry.
+  entry.pendingRecap = (typeof carryRecap === 'string' && carryRecap.trim()) ? carryRecap : null
   entry.session = startClaudeSession({
     cwd: cwd || process.cwd(), model, resume, mode, rolePrompt,
     // Live ROOM NOW tail appended to every turn's <system-reminder>: sibling lanes
@@ -2162,6 +2187,18 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         try { entry.session?.sendTurn('continue') } catch { /* not resumable — stays idle, user can continue manually */ }
         process.stderr.write(`\n  ◆ auto-resumed interrupted turn (${id.slice(0, 8)}) — sent continue.\n`)
       }
+      // Context-carry (2026-07-08): a lane re-opened WITHOUT an SDK resume (provider switch,
+      // non-resumable restart) starts blank. Fire the text-layer recap as its first turn the
+      // instant the session is live — same init-`system` gate as auto-resume above, for the
+      // same reason (a sendTurn into an unconsumed input stream is lost). Fires once. If a
+      // human turn arrived first, the code-turn handler already consumed + cleared it
+      // (prepended to that turn), so this no-ops. Spec: docs/specs/2026-07-08-provider-switch-context-carry.md.
+      if (evt.kind === 'system' && entry.pendingRecap) {
+        const recap = entry.pendingRecap
+        entry.pendingRecap = null
+        try { entry.session?.sendTurn(recap) } catch { /* not live — stays idle, user can continue manually */ }
+        process.stderr.write(`\n  ◆ carried ${recap.length}c context recap into fresh session (${id.slice(0, 8)}) after provider/restore switch.\n`)
+      }
       // A background-warmed terminal is now live — free its warmer slot so the next queued
       // idle terminal starts booting.
       if (evt.kind === 'system' && entry.warming) warmComplete(entry)
@@ -2331,6 +2368,13 @@ function respawnStructured(id, provider) {
   if (!s) return false
   // Capture the lane's identity for re-open (NOT resume — fresh SDK session).
   const { model, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
+  // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
+  // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
+  // (before teardown) and hand it to the fresh session as its first turn so the agent
+  // continues the work instead of re-greeting (the 109d22e1 "first message in my lane" bug).
+  // Flow lanes are exempt: they re-dispatch from their own artifacts + role prompt, not a
+  // chat recap, and their protocol (FLOW_DONE / FLOW_REVIEW sentinels) must not be perturbed.
+  const carryRecap = flowSessionId ? null : buildRecapFromLog(log, RECAP_CAP)
   // Teardown WITHOUT the close side effects. drainPending denies any in-flight
   // permission cards (the switch aborts the current turn, same as /model mid-turn).
   drainPending(s)
@@ -2341,7 +2385,7 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt })
+  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt, carryRecap })
   return true
 }
 
@@ -2643,6 +2687,7 @@ channel
       return
     }
     if (/^\/clear\s*$/.test(text)) {
+      s.pendingRecap = null   // /clear means forget context — drop any un-fired carry recap
       s.session.sendTurn(text)
       s.log = []; s.seq = makeSeqCounter(0); bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
       flushSession(room, payload.term, { sessionId: s.session?.sessionId || null, log: [] })
@@ -2670,7 +2715,13 @@ channel
     // its cap. The slash controls above (/model, /clear, /compact) are intentionally exempt:
     // they let a user manage or REDUCE spend even when capped. Legible refusal, no silent stall.
     if (await budgetBlocked(s, payload.term)) return
-    s.session.sendTurn(text)
+    // Context-carry (2026-07-08) point 4: a real human turn arrived BEFORE the post-switch/
+    // restore recap fired on init-`system`. Prepend the recap to THIS turn (one turn, not two
+    // — a separate recap turn would race + double-fire) and clear the flag so the init handler
+    // no-ops. The visible `you` echo is unchanged; the recap is context for the agent only.
+    let sendText = text
+    if (s.pendingRecap) { sendText = `${s.pendingRecap}\n\n--- the person's next message ---\n${text}`; s.pendingRecap = null }
+    s.session.sendTurn(sendText)
     echoYou()
     // Pool-order fix (2026-07-02): emit the "dispatched to agent" marker HERE, right after
     // the @pool you-line, so it inherits the NEXT seq (seqable('pool') is true) and orders
@@ -2873,6 +2924,17 @@ channel
             if (re && !rec.flowSessionId && canResume(rec) && restoredTurnOpen(rec.log || [])) {
               re.pendingAutoResume = true
             }
+            // Context-carry (2026-07-08): the SAME mid-turn case but the SDK context CANNOT
+            // resume (canResume false — a stale/expired session). A bare "continue" would land
+            // in a blank backend, so instead carry a plain-text recap of the visible log as the
+            // first turn — the interrupted work resumes WITH its history. Mid-turn only
+            // (restoredTurnOpen): we never arm an unprompted turn on an idle restored lane (its
+            // transcript stays visible; the person starts their next request fresh). If the
+            // person types before this recap fires, the code-turn handler prepends it instead.
+            // Flow lanes re-dispatch separately (excluded above).
+            else if (re && !rec.flowSessionId && !canResume(rec) && restoredTurnOpen(rec.log || [])) {
+              re.pendingRecap = buildRecapFromLog(rec.log || [], RECAP_CAP)
+            }
           }
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
           // (autoAgent set, no attachedCmd) the web's `?new=1` flow opens the first

package/claude-session.mjs

@@ -660,15 +660,11 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // documented override. opts.env REPLACES the child env, so spread the inherited one.
   opts.env = { ...(env || process.env), CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION: '1' }
 
-  // Before the SDK replays this transcript, heal any cross-provider tool blocks
-  // it left behind (e.g. a room that ran on Z.ai GLM, now back on anthropic).
-  // Anthropic 400s on a `server_tool_use` block carrying a foreign id/name, which
-  // wedges the room on every send. Reclassifying those to plain `tool_use` clears
-  // it; idempotent + no-op on clean transcripts. See transcript-sanitize.mjs.
-  if (resume) {
-    const healed = sanitizeSession(cwd || process.cwd(), resume)
-    if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} malformed tool block(s) in the transcript before resume.\n`)
-  }
+  // Transcript healing lives at the TRUE resume point — see runQuery, right before
+  // query() is (re)built. The old factory-time heal was gated on the closure constant
+  // `resume`, so it ran only on the first open; a `/model` switch or a restart re-points
+  // the live `sessionId` and re-enters runQuery, resuming a transcript that was never
+  // re-healed (finding FBL-1). Healing inside runQuery covers EVERY resume path.
 
   // One-shot Haiku fallback suggestion. Runs on the SAME subscription auth as the room
   // (opts.env carries the OAuth — no API key needed), but as a BARE model call: no
@@ -719,6 +715,18 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     const onParentAbort = () => { try { myAc.abort() } catch { /* noop */ } }
     ac.signal.addEventListener('abort', onParentAbort, { once: true })
     try {
+      // Heal the transcript we're about to REPLAY — at the true resume point, keyed on the
+      // LIVE `sessionId` (not the factory-time `resume` constant). `sessionId` mutates:
+      // recreateForSwitch re-points it to persistedSessionId and the restart / bad-resume
+      // forks re-point it too, each re-entering runQuery. A `/model` switch (or restart) that
+      // resumed a corrupted transcript — a dangling tool_use / tool_result-in-assistant left
+      // by an aborted mid-tool turn — used to hit an Anthropic 400 (H42 class) and wedge the
+      // lane on every send (finding FBL-1). sanitizeSession is idempotent + a no-op on clean
+      // transcripts, so healing before EVERY resume is free. See transcript-sanitize.mjs.
+      if (sessionId) {
+        const healed = sanitizeSession(cwd || process.cwd(), sessionId)
+        if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} malformed tool block(s) in the transcript before resume.\n`)
+      }
       q = query({ prompt: input.stream, options: { ...opts, abortController: myAc, ...(sessionId ? { resume: sessionId } : {}) } })
       for await (const m of q) {
         if (closed) break
@@ -756,7 +764,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             // Cold-start timing — the init system message is when the terminal is
             // usable, so spawn→here IS the latency the user waits on. One line per
             // open. Compare a normal open vs one with TP_MCP_STRICT=1 to read off how
-            // many ms the host MCP servers cost. (resume opens also pay sanitizeSession.)
+            // many ms the host MCP servers cost. (each resume also pays a sanitizeSession heal — see runQuery.)
             if (!readyLogged) {
               readyLogged = true
               process.stderr.write(`\n  ◆ session ready in ${Date.now() - spawnT0}ms — MCP ${process.env.TP_MCP_STRICT === '1' ? 'OFF' : 'on'}${resume ? ', resume' : ', fresh'}.\n`)

package/event-id.mjs

@@ -248,3 +248,68 @@ export function usageReportLine (sessionModel, logEvents) {
   const turns = `${sum.turns} turn${sum.turns === 1 ? '' : 's'}`
   return `usage · ${turns} · ${perStr}${total}${cost} · tokens + cost only (no plan/rate-limit meters)`
 }
+
+// Default hard cap for the context-carry recap (chars of transcript body, framing extra).
+export const RECAP_CAP = 20000
+
+// Context-carry recap for a lane whose SDK memory CAN'T be resumed (a cross-provider
+// switch, or a bridge-restart restore where canResume() is false). Such a lane re-opens
+// under the SAME id with the visible transcript replayed but a FRESH, blank backend — so
+// the agent starts amnesiac mid-conversation (the 2026-07-08 lane 109d22e1 "this is the
+// first message in my lane" incident). Raw SDK resume can't cross a provider (signed
+// thinking blocks + provider-specific tool_use records get rejected by a foreign backend),
+// so we carry the conversation at the TEXT layer instead: synthesize a plain-text recap
+// from the saved log — the people's turns (`you`) + the assistant's own text replies
+// (`assistant` text blocks; thinking + tool_use are dropped, they don't survive a backend
+// hop and are noise) — newest-weighted under a hard char cap, framed so the agent RESUMES
+// rather than re-greets. Pure + import-safe (unit-tested in bridge/recap.test.mjs).
+//
+// capReplayEvents lesson (rooms died once on a multi-MB replay): the char cap keeps this
+// bounded in prose form too — an unbounded recap would be the same bug wearing a text hat.
+export function buildRecapFromLog(log, cap = RECAP_CAP) {
+  if (!Array.isArray(log) || !log.length) return ''
+  const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
+  if (!budget) return ''
+  // Flatten the log to speaker-labelled turns, in order. `you` = a person in the room;
+  // `assistant` = this agent's own earlier reply (its text blocks only).
+  const turns = []
+  for (const e of log) {
+    if (!e || typeof e !== 'object') continue
+    if (e.kind === 'you') {
+      const t = String(e.text || '').trim()
+      if (t) turns.push({ who: 'PERSON', text: t })
+    } else if (e.kind === 'assistant') {
+      const t = (Array.isArray(e.blocks) ? e.blocks : [])
+        .filter((b) => b && b.type === 'text' && typeof b.text === 'string' && b.text.trim())
+        .map((b) => b.text.trim())
+        .join('\n')
+      if (t) turns.push({ who: 'YOU', text: t })
+    }
+  }
+  if (!turns.length) return ''
+  // Newest-weighted: walk from the end, keep whole turns until the char budget is spent,
+  // then restore chronological order. A single newest turn bigger than the whole budget is
+  // still kept (truncated) so the LIVE task is never dropped to the cap.
+  const kept = []
+  let used = 0
+  let omitted = false
+  for (let i = turns.length - 1; i >= 0; i--) {
+    let line = `${turns[i].who}: ${turns[i].text}`
+    if (used + line.length > budget) {
+      if (kept.length) { omitted = true; break }   // older turns exist but won't fit → note + stop
+      line = line.slice(0, budget)                  // newest turn alone overflows → clip, still include
+    }
+    kept.push(line)
+    used += line.length
+  }
+  kept.reverse()
+  const body = (omitted ? ['[…earlier messages omitted for length…]'] : []).concat(kept).join('\n\n')
+  return [
+    '[CONTEXT CARRY — you are RESUMING a live conversation after a model/provider switch]',
+    "Your session memory was reset by the switch, but this lane's conversation continued and the people already saw everything below. Do NOT re-greet, do NOT re-introduce yourself, and do NOT re-answer anything you already completed. Read the recap, then continue the work exactly where it left off. The LAST PERSON message with no completed answer below is your live task — pick it up.",
+    '',
+    '--- conversation so far (oldest → newest) ---',
+    body,
+    '--- end recap ---',
+  ].join('\n')
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.169",
+  "version": "0.7.171",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -232,6 +232,61 @@ function verifyDarwinReload(lbl, file, version) {
   return false
 }
 
+// F4 — every io.thinkpool.pair.* label currently LOADED in the launchd/systemd domain,
+// plus any label with a plist/unit still on disk (loaded or not). Pure enumeration so the
+// sweep below is testable in isolation. `keepLabel` is the label we're about to (re)install
+// — its own bootout+bootstrap is the caller's job, so the sweep leaves it alone.
+export function existingServiceLabels(platform = process.platform, { fsMod = fs } = {}) {
+  const labels = new Set()
+  try {
+    if (platform === 'darwin') {
+      try {
+        const out = execSync(`launchctl print gui/$(id -u) 2>/dev/null | grep -oE 'io\\.thinkpool\\.pair\\.[A-Za-z0-9_]+' | sort -u`, { encoding: 'utf8', shell: '/bin/bash' })
+        for (const l of out.split('\n')) { const t = l.trim(); if (t) labels.add(t) }
+      } catch { /* nothing loaded */ }
+      try {
+        const dir = path.join(os.homedir(), 'Library', 'LaunchAgents')
+        for (const f of fsMod.readdirSync(dir)) { const m = f.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.plist$/); if (m) labels.add(m[1]) }
+      } catch { /* no dir */ }
+    } else if (platform === 'linux') {
+      try {
+        const out = execSync(`systemctl --user list-unit-files 'io.thinkpool.pair.*' --no-legend 2>/dev/null | awk '{print $1}'`, { encoding: 'utf8', shell: '/bin/bash' })
+        for (const l of out.split('\n')) { const t = l.trim().replace(/\.service$/, ''); if (t) labels.add(t) }
+      } catch { /* none */ }
+      try {
+        const dir = path.join(os.homedir(), '.config', 'systemd', 'user')
+        for (const f of fsMod.readdirSync(dir)) { const m = f.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.service$/); if (m) labels.add(m[1]) }
+      } catch { /* no dir */ }
+    }
+  } catch { /* best-effort */ }
+  return [...labels]
+}
+
+// F4 — before (re)installing, sweep EVERY pre-existing thinkpool-pair service EXCEPT the one
+// we're about to install (which the install path bootout+bootstraps itself). Today's outage
+// trigger was an uninstall/reinstall leaving TWO account services live, both heart-beating,
+// racing the saved login. Idempotent + best-effort; never throws. Also reaps orphaned ROOM
+// CHILD bridges (the proven verifyDarwinReload pattern — the uppercase-room guard never
+// matches the no-arg menu or the supervisor, so the live account bridge is never touched).
+export function sweepExistingServices(keepLabel, platform = process.platform) {
+  for (const lbl of existingServiceLabels(platform)) {
+    if (lbl === keepLabel) continue
+    try {
+      if (platform === 'darwin') {
+        execSync(`launchctl bootout gui/$(id -u)/${lbl} 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' })
+        try { fs.rmSync(path.join(os.homedir(), 'Library', 'LaunchAgents', `${lbl}.plist`), { force: true }) } catch { /* noop */ }
+      } else if (platform === 'linux') {
+        execSync(`systemctl --user disable --now ${lbl}.service 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' })
+      }
+      process.stderr.write(`  ◆ swept stale service ${lbl}\n`)
+    } catch { /* best-effort */ }
+  }
+  // Reap orphaned ROOM child bridges only — safe (never the supervisor / interactive menu).
+  if (platform !== 'win32') {
+    try { execSync(`pkill -9 -f 'thinkpool-pair/bridge.mjs [A-Z0-9]' 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' }) } catch { /* noop */ }
+  }
+}
+
 // staleProof defaults ON for every real install: even a FIRST install can be launched from
 // a stale npx cache (the launcher itself is npx-resolved), so without the cache-wiping
 // wrapper a fresh `install-service` could pin a stale build just like the update path did.
@@ -240,6 +295,10 @@ function verifyDarwinReload(lbl, file, version) {
 // so its unit tests assert the pure pinned shape.
 export function installService(room, cmdArgs = [], { autoUpdate = false, version = VERSION, staleProof = true } = {}) {
   const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate, version, staleProof })
+  // F4: clear every OTHER pre-existing pair service first, so only the one we install remains
+  // (the "two account services live" storm trigger). Our own label is bootout+bootstrapped
+  // by a.post below, so keep it.
+  try { sweepExistingServices(label(room), process.platform) } catch { /* best-effort */ }
   fs.mkdirSync(a.logDir, { recursive: true })
   fs.mkdirSync(path.dirname(a.file), { recursive: true })
   fs.writeFileSync(a.file, a.content)