thinkpool-pair 0.7.170 → 0.7.172

package/account.mjs

@@ -116,17 +116,170 @@ export async function runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) {
   await new Promise(() => {})
 }
 
-// Exchange the stored refresh token for a live session + authed client.
+// A promise that resolves after ms, never keeping the loop alive on its own.
+const sleep = (ms) => new Promise((r) => { const t = setTimeout(r, ms); t.unref?.() })
+
+// Reject a promise if it doesn't settle within ms — so a wedged realtime socket can't
+// freeze a Supabase call (and the tick that awaits it) forever (the 2026-07-08 wedge:
+// a tick hung on a half-open socket, the re-entrancy guard stuck true, the claim
+// heartbeat stopped, and the bridge stood by against its own 564s-stale row).
+export function withTimeout(promise, ms, label = 'op') {
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms); t.unref?.()
+    Promise.resolve(promise).then((v) => { clearTimeout(t); resolve(v) }, (e) => { clearTimeout(t); reject(e) })
+  })
+}
+
+// Decode a JWT's `exp` (unix seconds) WITHOUT verifying — used only to decide whether the
+// saved access token is fresh enough to skip a refresh. 0 on any parse failure (→ refresh).
+function jwtExpSeconds(token) {
+  try {
+    const seg = String(token).split('.')[1]
+    const json = Buffer.from(seg.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8')
+    const exp = JSON.parse(json)?.exp
+    return typeof exp === 'number' ? exp : 0
+  } catch { return 0 }
+}
+
+// F1 predicate (pure, testable): is the saved access token still worth adopting WITHOUT a
+// refresh? True iff we have an access token whose expiry (from the persisted expires_at, or
+// decoded from the JWT) is more than marginSec ahead of now. Skipping the refresh here is
+// one fewer rotation → one fewer race window / mid-rotation brick.
+export function savedTokenStillValid(saved, nowSec = Math.floor(Date.now() / 1000), marginSec = 300) {
+  if (!saved?.access_token) return false
+  const expSec = saved.expires_at || jwtExpSeconds(saved.access_token)
+  return !!expSec && (expSec - nowSec) > marginSec
+}
+
+// ── cross-process refresh serialization (F3) ────────────────────────────────
+// Two bridges refreshing ONE refresh token outside Supabase's short reuse window makes
+// Supabase revoke the entire token FAMILY — every future refresh then fails permanently
+// until a fresh login. A short-lived lock file serializes the actual network refresh
+// across processes; a lock older than staleMs is stale (holder crashed mid-refresh) and
+// is taken over. fs errors fail-OPEN (return true) — a lock we can't manage must never
+// block a genuine refresh. Exported for the test harness.
+const REFRESH_LOCK = path.join(os.homedir(), '.thinkpool-pair', 'refresh.lock')
+export function acquireRefreshLock(lockPath = REFRESH_LOCK, staleMs = 30_000) {
+  try { fs.mkdirSync(path.dirname(lockPath), { recursive: true }) } catch { /* noop */ }
+  for (let i = 0; i < 2; i++) {
+    try {
+      const fd = fs.openSync(lockPath, 'wx')   // atomic create-exclusive
+      fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() })); fs.closeSync(fd)
+      return true
+    } catch (e) {
+      if (e.code !== 'EEXIST') return true       // unmanageable → fail open
+      let age = Infinity
+      try { age = Date.now() - (JSON.parse(fs.readFileSync(lockPath, 'utf8'))?.at || 0) } catch { age = Infinity }
+      if (age < staleMs) return false            // a live refresh holds it → back off
+      try { fs.rmSync(lockPath, { force: true }) } catch { return true }   // stale → drop + retry
+    }
+  }
+  return false
+}
+export function releaseRefreshLock(lockPath = REFRESH_LOCK) { try { fs.rmSync(lockPath, { force: true }) } catch { /* noop */ } }
+
+// Build an authed session from a saved {access_token, refresh_token} WITHOUT rotating the
+// refresh token. setSession validates the access token (getUser — no rotation) when it is
+// still valid; callers only ever adopt a FRESH token, so it never falls through to a refresh.
+async function adoptSavedSession(sb, saved) {
+  if (!saved?.access_token || !saved?.refresh_token) return null
+  try {
+    const { data, error } = await sb.auth.setSession({ access_token: saved.access_token, refresh_token: saved.refresh_token })
+    if (error || !data?.session) return null
+    return data.session
+  } catch { return null }
+}
+
+// One refresh, serialized across processes + adopting a sibling's rotation (F3). Steps:
+//   • auth.json already holds a DIFFERENT refresh token than the one we carry → a sibling
+//     (or a re-mint) rotated: ADOPT the disk pair instead of refreshing again.
+//   • else take the refresh lock; if a sibling holds it, wait briefly and adopt THEIR
+//     rotated result rather than racing a second rotation (which revokes the family).
+//   • under the lock, re-read disk once more, then refreshSession → saveAuth.
+// Deps are injectable for the test harness. Returns { session, adopted } or null.
+export async function refreshAccountSession(sb, holdRefreshToken, deps = {}) {
+  const { load = loadAuth, save = saveAuth, acquire = acquireRefreshLock, release = releaseRefreshLock, wait = sleep } = deps
+  const adoptIfRotated = async (rt) => {
+    const d = load()
+    if (d?.refresh_token && rt && d.refresh_token !== rt) {
+      const s = await adoptSavedSession(sb, d)
+      if (s) return { session: s, adopted: true }
+    }
+    return null
+  }
+  let adopted = await adoptIfRotated(holdRefreshToken)
+  if (adopted) return adopted
+  const rt0 = load()?.refresh_token || holdRefreshToken
+  if (!rt0) return null
+  let locked = acquire()
+  if (!locked) {
+    // A sibling is mid-refresh. Wait for it to finish and adopt its rotated pair rather
+    // than firing a competing rotation (the family-revoke race).
+    for (let i = 0; i < 20; i++) {
+      await wait(250)
+      adopted = await adoptIfRotated(rt0)
+      if (adopted) return adopted
+      if (acquire()) { locked = true; break }
+    }
+    if (!locked) return null   // couldn't get the lock or adopt — caller retries later
+  }
+  try {
+    adopted = await adoptIfRotated(rt0)   // re-check under the lock (sibling may have just finished)
+    if (adopted) return adopted
+    const rt = load()?.refresh_token || rt0
+    const { data, error } = await sb.auth.refreshSession({ refresh_token: rt })
+    if (error || !data?.session) return null
+    save(data.session)   // atomic (auth-store) — never a torn token file
+    return { session: data.session, adopted: false }
+  } finally { if (locked) release() }
+}
+
+// Exchange the stored credentials for a live session + authed client.
 export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
   const a = loadAuth()
   if (!a?.refresh_token) return null
   const sb = createClient(SUPABASE_URL, SUPABASE_ANON, { auth: { persistSession: false, autoRefreshToken: false } })
-  try {
-    const { data, error } = await sb.auth.refreshSession({ refresh_token: a.refresh_token })
-    if (error || !data?.session) return null
-    saveAuth(data.session)   // rotate the refresh token
-    return { sb, session: data.session }
-  } catch { return null }
+  // F1: skip the refresh entirely when the saved access token is still comfortably valid
+  // (>5 min to expiry). Every gratuitous startup rotation is a race window — and, killed
+  // mid-rotation, a login-brick. Adopt the saved pair; scheduleTokenRefresh rotates near
+  // expiry as it already does.
+  if (savedTokenStillValid(a)) {
+    const s = await adoptSavedSession(sb, a)
+    if (s) return { sb, session: s }
+  }
+  // Near-expiry / missing / invalid access token → do a serialized rotation (F3).
+  const r = await refreshAccountSession(sb, a.refresh_token)
+  if (!r?.session) return null
+  return { sb, session: r.session }
+}
+
+// F2: startup refresh can fail transiently (offline, a sibling mid-rotation, a wedged
+// socket). Retry IN-PROCESS with backoff — NEVER exit(1), because launchd KeepAlive would
+// respawn us within seconds and each respawn hammers the refresh path (the 16× crash
+// storm). authedClient re-reads auth.json every attempt, so a re-mint or a sibling's
+// rotation is picked up on the next try. Returns null ONLY when there is no saved login
+// at all (genuinely not linked) — the caller then stands down CLEANLY (exit 0, no respawn).
+// Deps injectable for the test harness.
+export async function authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, opts = {}) {
+  const { attempt = authedClient, load = loadAuth, wait = sleep, onRetry = null, maxAttempts = Infinity, baseMs = 15_000, capMs = 300_000 } = opts
+  let delay = baseMs
+  for (let n = 1; n <= maxAttempts; n++) {
+    const a = await attempt(SUPABASE_URL, SUPABASE_ANON)
+    if (a) return a
+    if (!load()?.refresh_token) return null   // not linked — caller says `login`, exits 0
+    if (n >= maxAttempts) break
+    onRetry?.(delay, n)
+    await wait(delay)
+    delay = Math.min(delay * 2, capMs)
+  }
+  return null
+}
+
+// Pure predicate (2026-07-08): the claim/heartbeat loop is "wedged" when no successful
+// claim has landed in ≥ quietMsThreshold (default 40s = ~2 missed 15s ticks). Extracted so
+// the watchdog's trigger is unit-testable without a live socket.
+export function claimLoopWedged({ lastClaimOkAt, now, quietMsThreshold = 40_000 }) {
+  return (now - lastClaimOkAt) >= quietMsThreshold
 }
 
 // ── keep the account JWT fresh (presence keepalive) ─────────────────────────
@@ -143,7 +296,7 @@ export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
 //   skewMs  — refresh this far ahead of expiry (default 90s)
 //   forceMs — fixed interval override (test hook: TP_TOKEN_REFRESH_FORCE_MS)
 //   retryMs — backoff after a transient failure (offline / rotation race)
-export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000, forceMs = 0, retryMs = 30_000 }) {
+export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000, forceMs = 0, retryMs = 30_000, refresh = refreshAccountSession }) {
   let timer = null
   let cur = session
   let cancelled = false
@@ -162,9 +315,12 @@ export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000
   async function tick() {
     if (cancelled) return
     try {
-      const { data, error } = await sb.auth.refreshSession({ refresh_token: cur.refresh_token })
-      if (error || !data?.session) throw error || new Error('no session')
-      cur = data.session
+      // Serialized refresh (F3): re-reads auth.json and adopts a sibling's rotated pair
+      // instead of blindly refreshing with our in-memory `cur.refresh_token` — the old
+      // tick retried with a stale token it held and could lose the family to a race.
+      const r = await refresh(sb, cur.refresh_token)
+      if (!r?.session) throw new Error('no session')
+      cur = r.session
       // Hand the fresh token to the live realtime socket so the presence
       // connection stays authed across the swap (no drop, no rejoin needed).
       try { sb.realtime?.setAuth?.(cur.access_token) } catch { /* noop */ }
@@ -196,17 +352,22 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.error('\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    `npx thinkpool-pair <ROOM>`.\n')
     process.exit(0)
   }
-  const auth = await authedClient(SUPABASE_URL, SUPABASE_ANON)
+  // F2: NEVER exit(1) on a refresh failure. The old code exited 1 here, and launchd
+  // KeepAlive respawned us within seconds → refresh again → the 16× crash storm (and,
+  // worse, hammering the refresh path burns rotations and can revoke the token family).
+  // Instead retry IN-PROCESS with backoff, re-reading auth.json each time so a headless
+  // re-mint or a sibling's rotation is picked up without a restart. Do NOT delete
+  // auth.json — a transient failure must never wipe a still-valid login (2026-06-17).
+  const auth = await authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, {
+    onRetry: (delay) => process.stderr.write(`\n  ◇ Couldn't refresh your account session yet (offline, or another bridge is mid-rotation) — retrying in ${Math.round(delay / 1000)}s. Saved login left in place.\n`),
+  })
   if (!auth) {
     releaseSingleton()
-    // Do NOT delete auth.json here. A refresh can fail transiently (offline) or
-    // lose a refresh-token rotation race with another bridge sharing this login —
-    // wiping the file on that destroys a still-valid login. Leave it: only an
-    // explicit `login` should ever replace the token (saveAuth overwrites it).
-    // (2026-06-17: a second account supervisor raced the token and the old
-    // clearAuth() here deleted a live Pro login mid-session.)
-    console.error('\n  ◇ Couldn\'t refresh your account session (offline, or another bridge\n    may be using this login). Your saved login was left in place.\n    If this keeps happening, re-link:  npx thinkpool-pair login\n')
-    process.exit(1)
+    // Reached ONLY when there is no saved login at all (not linked). Stand down CLEANLY
+    // with exit 0: launchd KeepAlive has SuccessfulExit=false, so exit 0 is NOT respawned
+    // — no crash storm for the "never logged in" case. The user links with `login`.
+    console.error('\n  ◇ Not linked to a ThinkPool account on this machine.\n    Link it:  npx thinkpool-pair login\n')
+    process.exit(0)
   }
   const { sb, session } = auth
   const email = session.user?.email || 'your account'
@@ -422,7 +583,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
-  await new Promise((res) => acct.subscribe((st) => { if (st === 'SUBSCRIBED') { pushPresence(); res() } }))
+  await new Promise((res) => acct.subscribe((st) => {
+    if (st === 'SUBSCRIBED') { pushPresence(); res() }
+    else if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
+      // Realtime dropped (the 2026-07-08 `realtime CLOSED` blip). The socket normally
+      // auto-reconnects, but nudge it so presence — and the claim heartbeat that shares
+      // this client — recover instead of the loop standing by against its own stale row.
+      // The callback stays wired for the channel's life, so later rejoins re-fire it.
+      try { sb.realtime?.connect?.() } catch { /* noop */ }
+    }
+  }))
 
   // Keep the account JWT fresh so the presence socket never gets deauthed at
   // expiry (the 2026-06-17 "No bridge connected while sessions run" bug). On each
@@ -451,9 +621,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const BRIDGE_ID = randomUUID()
   let claimHeld = false
   let standbyHost = null
+  // Wall-clock of the last SUCCESSFUL claim RPC. The heartbeat watchdog (below) uses it to
+  // detect a wedged loop and self-heal — the 2026-07-08 outage stood by against its OWN
+  // 564s-stale row because the tick had frozen and the heartbeat simply stopped.
+  let lastClaimOkAt = Date.now()
   const refreshClaim = async () => {
     try {
-      const { data } = await sb.rpc('claim_bridge', { p_bridge_id: BRIDGE_ID, p_hostname: machine })
+      // Time-box the RPC: a half-open realtime socket must not freeze the heartbeat (and
+      // the tick that awaits it) forever. On timeout we throw → keep the prior held state.
+      const { data } = await withTimeout(sb.rpc('claim_bridge', { p_bridge_id: BRIDGE_ID, p_hostname: machine }), 10_000, 'claim_bridge')
+      lastClaimOkAt = Date.now()
       const c = Array.isArray(data) ? data[0] : data
       const held = !!c?.held
       const host = c?.holder_host || '?'
@@ -578,12 +755,20 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // awaits a code_sessions query before children.set(), so two overlapping runs can
   // both see children.has(room) false and DOUBLE-SPAWN a 2nd bridge for one room
   // (two bridges per room = the CASCADE-delete / ghost-terminal hazard). Serialize.
-  let ticking = false
+  // SELF-HEALING guard (2026-07-08): a plain boolean stuck `true` was the wedge — a tick
+  // that hung on a half-open socket never ran its `finally`, so `ticking` stayed true and
+  // every later tick returned early forever (heartbeat dead, own row goes 564s stale). Use
+  // a start-timestamp instead: a prior run older than 60s is presumed wedged and we proceed
+  // anyway (the timed-out awaits inside now guarantee it eventually unwinds).
+  let tickingSince = 0
   const tick = async () => {
-    if (ticking) return
-    ticking = true
-    try { await tickBody() } finally { ticking = false }
+    const now = Date.now()
+    if (tickingSince && now - tickingSince < 60_000) return   // a genuine in-flight tick
+    tickingSince = now
+    try { await tickBody() } finally { if (tickingSince === now) tickingSince = 0 }
   }
+  // Expose for the watchdog to force-unwedge the guard after a reconnect.
+  const clearTickGuard = () => { tickingSince = 0 }
   const tickBody = async () => {
     // Hold the account claim before serving anything (cross-machine guard). When
     // standing by, make sure we're serving nothing and wait for the next tick.
@@ -778,6 +963,24 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const iv = setInterval(tick, 15000)
   const updateTimers = []   // auto-update poll/apply timers — cleared in stop() so none fire post-exit
   let stopping = false
+
+  // ── claim/heartbeat watchdog (2026-07-08) ──────────────────────────────────
+  // The 15s tick carries the claim heartbeat. If anything inside a tick wedged (a half-open
+  // realtime socket), the heartbeat stopped, our own claim row went stale, and — because a
+  // same-host holder is never displaced by itself — the bridge stood by FOREVER against its
+  // own ghost (the 564s-stale-own-hostname outage). This timer runs on its OWN interval so a
+  // wedged tick can't starve it: when the claim has been quiet ≥2 ticks it nudges realtime
+  // to reconnect, force-clears the re-entrancy guard, and re-issues the heartbeat directly
+  // (claim_bridge is a plain HTTP RPC — it recovers even while the socket is still flapping).
+  const heartbeatWatch = setInterval(async () => {
+    if (stopping) return
+    if (!claimLoopWedged({ lastClaimOkAt, now: Date.now() })) return
+    console.log(`claim_watchdog sup=${SUP_ID} quiet_ms=${Date.now() - lastClaimOkAt} — reconnecting realtime + re-claiming`)
+    try { sb.realtime?.connect?.() } catch { /* noop */ }
+    clearTickGuard()   // unwedge the guard so the next scheduled tick can run
+    try { await refreshClaim(); pushPresence() } catch { /* the next tick retries */ }
+  }, 20_000)
+  heartbeatWatch.unref?.()
   // restart-vs-stop is the ONLY difference in exit code: a web "restart" sets this so
   // we exit non-zero (every supervisor respawns); a normal stop/shutdown exits 0.
   const stop = (sig) => {
@@ -787,6 +990,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     // ── supervisor stand-down logging (cascade brg-instrument) ─────────────────
     console.log(`supervisor_stop sup=${SUP_ID} reason=${sig || 'unknown'} restarting=${restarting} children=${children.size}`)
     clearInterval(iv)
+    clearInterval(heartbeatWatch)
     for (const t of updateTimers) { try { clearInterval(t) } catch { /* noop */ } }   // clearInterval clears Timeouts too
     keepFresh.cancel()
     releaseSingleton()

package/auth-store.mjs

@@ -22,14 +22,32 @@ function ensureDir() { try { fs.mkdirSync(DIR, { recursive: true }) } catch { /*
 export function saveAuth(session) {
   if (!session?.refresh_token) return
   ensureDir()
+  const payload = JSON.stringify({
+    refresh_token: session.refresh_token,
+    access_token: session.access_token || null,
+    // Unix SECONDS. Lets the bridge adopt the saved access token WITHOUT a refresh while
+    // it's still comfortably valid (account.mjs F1) — every skipped rotation is one fewer
+    // race window (and one fewer chance to be killed mid-rotation and brick the login).
+    expires_at: session.expires_at || null,
+    email: session.user?.email || session.email || null,
+    savedAt: Date.now(),
+  })
+  // ATOMIC write (2026-07-08): a crash/kill/kickstart mid-write must never leave a
+  // truncated auth.json — an unparseable token file reads as "not linked" and bricks the
+  // saved login (three bridge outages in two days, one from a restart landing mid-rotation).
+  // Write a sibling temp file, fsync it to disk, then rename OVER auth.json — rename is
+  // atomic on one filesystem, so any concurrent reader sees the whole old file or the whole
+  // new one, never a half-written token. This does NOT undo Supabase's server-side rotation
+  // (that invalidates the old token the instant refreshSession returns) — the frequency of
+  // rotation is cut by F1/F3 in account.mjs; this guarantees the file itself is never torn.
+  const tmp = `${AUTH}.tmp.${process.pid}.${Date.now()}`
   try {
-    fs.writeFileSync(AUTH, JSON.stringify({
-      refresh_token: session.refresh_token,
-      access_token: session.access_token || null,
-      email: session.user?.email || session.email || null,
-      savedAt: Date.now(),
-    }), { mode: 0o600 })
-  } catch { /* noop */ }
+    const fd = fs.openSync(tmp, 'w', 0o600)
+    try { fs.writeSync(fd, payload); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+    fs.renameSync(tmp, AUTH)
+  } catch {
+    try { fs.rmSync(tmp, { force: true }) } catch { /* noop */ }
+  }
 }
 export function loadAuth() { try { return JSON.parse(fs.readFileSync(AUTH, 'utf8')) } catch { return null } }
 export function clearAuth() { try { fs.unlinkSync(AUTH) } catch { /* noop */ } }

package/bridge.mjs

@@ -92,7 +92,7 @@ const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine } from './event-id.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP } from './event-id.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
@@ -987,6 +987,13 @@ const announce = () => {
     // host (e.g. openrouter.ai). Older web clients ignore unknown fields.
     provider: PROVIDER_INFO.provider,
     providerBaseUrl: PROVIDER_INFO.baseUrl || undefined,
+    // ctxCarry: this bridge re-feeds a plain-text recap of the visible chat into the
+    // FRESH session after a provider switch (the 2026-07-08 context-carry work —
+    // openStructured carryRecap → pendingRecap → sendTurn). The UI reads it as
+    // bridgeInfo.ctxCarry to word the switch warning honestly: WITH carry the agent
+    // "rejoins from a recap of this chat"; WITHOUT it (older bridge, flag absent) it
+    // "starts blank". Additive top-level boolean; older clients ignore the unknown key.
+    ctxCarry: true,
     // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), used by the
     // dashboard to seal a provider's API key so it reaches the bridge without ever
     // crossing the wire in the clear. Computed once (the keypair is stable).
@@ -1222,8 +1229,19 @@ const handleManifest = async (box, file, term) => {
   let m
   try { m = JSON.parse(fs.readFileSync(full, 'utf8')) } catch { return }
   if (!m?.slug) return
-  const readB64 = (p) => { try { return p && fs.readFileSync(p).toString('base64') } catch { return null } }
-  const readTxt = (p) => { try { return p && fs.readFileSync(p, 'utf8') } catch { return null } }
+  // 2026-07-07: these used to swallow read errors silently — a transient
+  // unreadable file (race with the render script, permissions, mid-write)
+  // meant the manifest still POSTed with that field missing, and nothing
+  // anywhere logged why. Surface it on stderr so a blank mockup pane in the
+  // room has a breadcrumb on the host side instead of just vanishing.
+  const readB64 = (p) => {
+    try { return p && fs.readFileSync(p).toString('base64') }
+    catch (e) { if (p) process.stderr.write(`\n  ◇ mockup asset unreadable: ${p} (${e?.code || e?.message || e})\n`); return null }
+  }
+  const readTxt = (p) => {
+    try { return p && fs.readFileSync(p, 'utf8') }
+    catch (e) { if (p) process.stderr.write(`\n  ◇ mockup asset unreadable: ${p} (${e?.code || e?.message || e})\n`); return null }
+  }
   const cid = randomUUID()
   try {
     const mockupHeaders = { 'Content-Type': 'application/json' }
@@ -1505,7 +1523,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider }) {
+function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap }) {
   if (sessions.has(id)) return
   // spawnedBy: set when this lane was Dispatched (spawn_terminal). Restored from the
   // session store so the Ensemble flag survives a bridge restart (else a respin
@@ -2019,6 +2037,13 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
       }
     : null
   entry.deferred = !!defer   // a lazily-booted idle terminal — the background warmer will boot it
+  // Context-carry (2026-07-08): a non-resumable re-open (provider switch / non-resumable
+  // restart) hands the FRESH session a plain-text recap of the visible log as its first
+  // input, so the agent picks up the work instead of starting blank mid-conversation. Held
+  // here (transient — NOT in sessionData, a re-restart re-derives it from the log) and fired
+  // on the init `system` event (see onEvent) — a sendTurn before the input stream is consumed
+  // is silently lost (the 2026-07-02 auto-resume bug). Empty string → nothing to carry.
+  entry.pendingRecap = (typeof carryRecap === 'string' && carryRecap.trim()) ? carryRecap : null
   entry.session = startClaudeSession({
     cwd: cwd || process.cwd(), model, resume, mode, rolePrompt,
     // Live ROOM NOW tail appended to every turn's <system-reminder>: sibling lanes
@@ -2162,6 +2187,18 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         try { entry.session?.sendTurn('continue') } catch { /* not resumable — stays idle, user can continue manually */ }
         process.stderr.write(`\n  ◆ auto-resumed interrupted turn (${id.slice(0, 8)}) — sent continue.\n`)
       }
+      // Context-carry (2026-07-08): a lane re-opened WITHOUT an SDK resume (provider switch,
+      // non-resumable restart) starts blank. Fire the text-layer recap as its first turn the
+      // instant the session is live — same init-`system` gate as auto-resume above, for the
+      // same reason (a sendTurn into an unconsumed input stream is lost). Fires once. If a
+      // human turn arrived first, the code-turn handler already consumed + cleared it
+      // (prepended to that turn), so this no-ops. Spec: docs/specs/2026-07-08-provider-switch-context-carry.md.
+      if (evt.kind === 'system' && entry.pendingRecap) {
+        const recap = entry.pendingRecap
+        entry.pendingRecap = null
+        try { entry.session?.sendTurn(recap) } catch { /* not live — stays idle, user can continue manually */ }
+        process.stderr.write(`\n  ◆ carried ${recap.length}c context recap into fresh session (${id.slice(0, 8)}) after provider/restore switch.\n`)
+      }
       // A background-warmed terminal is now live — free its warmer slot so the next queued
       // idle terminal starts booting.
       if (evt.kind === 'system' && entry.warming) warmComplete(entry)
@@ -2331,6 +2368,13 @@ function respawnStructured(id, provider) {
   if (!s) return false
   // Capture the lane's identity for re-open (NOT resume — fresh SDK session).
   const { model, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
+  // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
+  // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
+  // (before teardown) and hand it to the fresh session as its first turn so the agent
+  // continues the work instead of re-greeting (the 109d22e1 "first message in my lane" bug).
+  // Flow lanes are exempt: they re-dispatch from their own artifacts + role prompt, not a
+  // chat recap, and their protocol (FLOW_DONE / FLOW_REVIEW sentinels) must not be perturbed.
+  const carryRecap = flowSessionId ? null : buildRecapFromLog(log, RECAP_CAP)
   // Teardown WITHOUT the close side effects. drainPending denies any in-flight
   // permission cards (the switch aborts the current turn, same as /model mid-turn).
   drainPending(s)
@@ -2341,7 +2385,7 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt })
+  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt, carryRecap })
   return true
 }
 
@@ -2643,6 +2687,7 @@ channel
       return
     }
     if (/^\/clear\s*$/.test(text)) {
+      s.pendingRecap = null   // /clear means forget context — drop any un-fired carry recap
       s.session.sendTurn(text)
       s.log = []; s.seq = makeSeqCounter(0); bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
       flushSession(room, payload.term, { sessionId: s.session?.sessionId || null, log: [] })
@@ -2670,7 +2715,13 @@ channel
     // its cap. The slash controls above (/model, /clear, /compact) are intentionally exempt:
     // they let a user manage or REDUCE spend even when capped. Legible refusal, no silent stall.
     if (await budgetBlocked(s, payload.term)) return
-    s.session.sendTurn(text)
+    // Context-carry (2026-07-08) point 4: a real human turn arrived BEFORE the post-switch/
+    // restore recap fired on init-`system`. Prepend the recap to THIS turn (one turn, not two
+    // — a separate recap turn would race + double-fire) and clear the flag so the init handler
+    // no-ops. The visible `you` echo is unchanged; the recap is context for the agent only.
+    let sendText = text
+    if (s.pendingRecap) { sendText = `${s.pendingRecap}\n\n--- the person's next message ---\n${text}`; s.pendingRecap = null }
+    s.session.sendTurn(sendText)
     echoYou()
     // Pool-order fix (2026-07-02): emit the "dispatched to agent" marker HERE, right after
     // the @pool you-line, so it inherits the NEXT seq (seqable('pool') is true) and orders
@@ -2873,6 +2924,17 @@ channel
             if (re && !rec.flowSessionId && canResume(rec) && restoredTurnOpen(rec.log || [])) {
               re.pendingAutoResume = true
             }
+            // Context-carry (2026-07-08): the SAME mid-turn case but the SDK context CANNOT
+            // resume (canResume false — a stale/expired session). A bare "continue" would land
+            // in a blank backend, so instead carry a plain-text recap of the visible log as the
+            // first turn — the interrupted work resumes WITH its history. Mid-turn only
+            // (restoredTurnOpen): we never arm an unprompted turn on an idle restored lane (its
+            // transcript stays visible; the person starts their next request fresh). If the
+            // person types before this recap fires, the code-turn handler prepends it instead.
+            // Flow lanes re-dispatch separately (excluded above).
+            else if (re && !rec.flowSessionId && !canResume(rec) && restoredTurnOpen(rec.log || [])) {
+              re.pendingRecap = buildRecapFromLog(rec.log || [], RECAP_CAP)
+            }
           }
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
           // (autoAgent set, no attachedCmd) the web's `?new=1` flow opens the first

package/claude-session.mjs

@@ -13,11 +13,30 @@
    ───────────────────────────────────────────────────────────── */
 
 import { randomUUID } from 'node:crypto'
+import { createRequire } from 'node:module'
+import { readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
 import { query } from '@anthropic-ai/claude-agent-sdk'
 import { sanitizeSession } from './transcript-sanitize.mjs'
 import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
 import { crossPostNeedsCard } from './cross-terminal.mjs'
 import { correctContext } from './context-windows.mjs'
+import { stallDecision, stallEvent } from './turn-stall.mjs'
+
+// The caret-pulled SDK's real version (^0.3.x auto-upgrades on restart). Resolved
+// once at import by walking up from the package entry to its own package.json.
+// Named in the [SDK-REGRESSION] guard below so a silent gate-change is attributable.
+const SDK_VERSION = (() => {
+  try {
+    const req = createRequire(import.meta.url)
+    let d = dirname(req.resolve('@anthropic-ai/claude-agent-sdk'))
+    for (let i = 0; i < 8; i++) {
+      try { const p = JSON.parse(readFileSync(join(d, 'package.json'), 'utf8')); if (p.name === '@anthropic-ai/claude-agent-sdk') return p.version } catch { /* keep walking */ }
+      const up = dirname(d); if (up === d) break; d = up
+    }
+  } catch { /* unresolved */ }
+  return 'unknown'
+})()
 
 // ── risk classification — the accent/danger tier of the permission card ──
 // low (read-only) · medium (writes/runs) · network (leaves the machine) ·
@@ -73,6 +92,44 @@ export function autoAllow({ toolName, input, mode = 'default', alwaysAllow = new
   )
 }
 
+// AskUserQuestion answer path — pure mapping from the room's requestPermission
+// result to the PreToolUse decision fed back to the model. The card handler
+// denies (PreToolUse can't inject a tool_result) and puts the human's pick in
+// the deny reason, which IS what the model receives. Exported so the feedback
+// contract is locked in a unit test (mock requestPermission → this output).
+// `decision` is the requestPermission return: 'answer:<pick>' when the person
+// selected, anything else (including '' / dismissal / a broken path) is treated
+// as "no selection".
+export function askUserQuestionHookOutput(decision) {
+  const ans = (typeof decision === 'string' && decision.startsWith('answer:')) ? decision.slice(7) : ''
+  return {
+    continue: true,
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: ans
+        ? `The user answered in the ThinkPool room — ${ans}. Treat this as their selection and continue; do not call AskUserQuestion again for the same question.`
+        : 'The user dismissed the question in the ThinkPool room without selecting. Ask in plain prose, or proceed with a sensible default.',
+    },
+  }
+}
+
+// Regression guard for the AskUserQuestion gate. SDK 0.3.173 enabled the tool
+// unconditionally; a later bump in the 0.3.185→0.3.204 window flipped it to require
+// a `canUseTool` callback, and the ^0.3.x caret silently killed the feature on a
+// routine restart (2026-07-08). The bridge DOES pass canUseTool, so the SDK's init
+// `tools[]` MUST advertise AskUserQuestion — checked against the real init message
+// the live session already receives (no boot-time probe: cold-CLI init is flaky).
+// If the message carries a tools[] that lacks AskUserQuestion → return the loud
+// [SDK-REGRESSION] reason (logged + surfaced in the room). If it carries no tools[]
+// (older/other SDK message shape) → fail OPEN (null), never a false alarm. Pure +
+// exported so both branches are locked by a unit test.
+export function askUserQuestionRegression(tools, version) {
+  if (!Array.isArray(tools)) return null
+  if (tools.includes('AskUserQuestion')) return null
+  return `[SDK-REGRESSION] agent SDK v${version || 'unknown'} init tools[] is missing 'AskUserQuestion' — the multiple-choice question card is disabled. A caret SDK bump likely changed the canUseTool gate; pin a known-good SDK in bridge/package.json + republish.`
+}
+
 // ── input stream — a generator we keep open and feed turns into ──
 function makeInputStream() {
   const queue = []
@@ -183,6 +240,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   const spawnT0 = Date.now()
   let readyLogged = false
   let modelsSent = false   // one-shot: emit the SDK's supported-model list on first init
+  let sdkToolsChecked = false   // one-shot: run the AskUserQuestion regression guard on the first init carrying tools[]
   let q = null            // the live Query — control requests (interrupt /
                           // setPermissionMode) route through it once streaming.
   // The session is CREATED in the caller's chosen mode (not hard-coded default):
@@ -223,8 +281,10 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // 3+ min) or abort silently with no `result`. Track turn liveness + last event
   // time; if an active turn goes quiet past STALL_MS, emit one `stalled` chrome
   // event so the room can stop showing a frozen "working" forever. Cleared on the
-  // next event / `result`. Refs: TS SDK #44, claude-code #38905.
-  const STALL_MS = Math.max(30000, parseInt(process.env.TP_STALL_MS, 10) || 120000)
+  // next event / `result`. Refs: TS SDK #44, claude-code #38905. The decision layer
+  // (stallDecision/stallEvent, above) is pure + unit-tested; this owns the state +
+  // side effects. 90s status default (2026-07-08 hardening: the 529-overload hang).
+  const STALL_MS = Math.max(30000, parseInt(process.env.TP_STALL_MS, 10) || 90000)
   let turnActive = false          // true between a sent turn and its `result`
   let lastEvtTs = Date.now()      // wall-clock of the most recent emitted event
   let stalledSent = false         // one `stalled` per stall, not a storm
@@ -240,12 +300,16 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   let restartCount = 0
   let restartTimer = null   // the pending auto-restart backoff — cancelled by end()
   // Force-stop a true wedge (item 3): no result, no error, just silence past
-  // FORCE_STOP_MS. Clears turnActive so between-turns updates unblock, and
-  // surfaces a recoverable error. The wedged loop is left in place (a hung
-  // native call can't be safely restarted mid-flight); if it later throws,
-  // the catch self-heals.
+  // FORCE_STOP_MS. As of the 2026-07-08 hardening we no longer just surface an error
+  // and leave the hung loop in place — retryStalledTurn ABORTS the wedged SDK call (via
+  // its AbortController, the same unblock path abort()/recreateForSwitch use) and
+  // AUTO-RETRIES the turn ONCE, preserving the prompt. If that one retry ALSO stalls
+  // past FORCE_STOP_MS, we fall back to the old behavior: force-stop + "send again".
+  // stallRetried bounds it to a single auto-retry per turn (reset on each new turn /
+  // settled result), so a sustained upstream outage can't thundering-herd retries.
   const FORCE_STOP_MS = Math.max(STALL_MS * 3, parseInt(process.env.TP_FORCE_STOP_MS, 10) || 300000)
   let forceStopped = false
+  let stallRetried = false        // one auto-retry per turn (the abort+re-run path below)
   // Waiting on a HUMAN decision (permission card / plan gate / AskUserQuestion)
   // is NOT a wedge — the turn is correctly idle until the person answers. Every
   // interactive gate goes through requestPermission, so wrap it once to bump a
@@ -288,22 +352,29 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   let sugTimer = null             // pending fallback timer
   const SUGGEST_FALLBACK_MS = Math.max(1200, parseInt(process.env.TP_SUGGEST_FALLBACK_MS, 10) || 2500)
 
-  const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
+  // emitRaw forwards an event WITHOUT stamping lastEvtTs — used for the watchdog's OWN
+  // synthetic status/error events, which are not SDK activity and must not reset the
+  // silence clock (else the 5-min abort would measure from our 90s status emit, not from
+  // the last real SDK event). emit() is the normal path: it stamps liveness + clears the
+  // one-shot stall flag on any real event other than a `stalled` re-emit.
+  const emitRaw = (evt) => { try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
+  const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; emitRaw(evt) }
   const stallTimer = setInterval(() => {
-    if (!turnActive || awaitingUser > 0) return   // awaiting a human decision ≠ wedged
     const quiet = Date.now() - lastEvtTs
-    if (quiet > FORCE_STOP_MS && !forceStopped) {
-      // True wedge — no result, no error, just silence. Unblocks between-turns
-      // updates + surfaces a recoverable error. The wedged loop is left alone.
-      forceStopped = true
-      turnActive = false
-      emit({ kind: 'error', message: `agent went silent for ${Math.round(quiet / 1000)}s — force-stopped the turn; send again to resume`, recoverable: true })
-      return
-    }
-    if (!stalledSent && quiet > STALL_MS) {
-      stalledSent = true
-      emit({ kind: 'stalled', sinceMs: quiet })
-    }
+    const action = stallDecision({ turnActive, awaitingUser, quietMs: quiet, stallMs: STALL_MS, forceStopMs: FORCE_STOP_MS, stalledSent, stallRetried })
+    if (action === 'none') return
+    // ALWAYS surface — a stall is never swallowed. emitRaw so this synthetic event
+    // doesn't reset the silence clock (see emitRaw above).
+    const ev = stallEvent(action, quiet)
+    if (ev) emitRaw(ev)
+    if (action === 'status') { stalledSent = true; return }
+    if (action === 'retry') { forceStopped = true; retryStalledTurn(quiet); return }
+    // 'giveup' — the one auto-retry ALSO stalled past FORCE_STOP_MS. Fall back to the
+    // pre-2026-07-08 behavior: force-stop the turn so between-turns updates unblock, and
+    // let the human resend. The wedged loop is left in place; if it later throws, the
+    // catch self-heals.
+    forceStopped = true
+    turnActive = false
   }, 5000)
   stallTimer.unref?.()
 
@@ -527,17 +598,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       let decision = ''
       try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'ask', questions: toolInput?.questions || [] }) ?? '' }
       catch { decision = '' }
-      const ans = (typeof decision === 'string' && decision.startsWith('answer:')) ? decision.slice(7) : ''
-      return {
-        continue: true,
-        hookSpecificOutput: {
-          hookEventName: 'PreToolUse',
-          permissionDecision: 'deny',
-          permissionDecisionReason: ans
-            ? `The user answered in the ThinkPool room — ${ans}. Treat this as their selection and continue; do not call AskUserQuestion again for the same question.`
-            : 'The user dismissed the question in the ThinkPool room without selecting. Ask in plain prose, or proceed with a sensible default.',
-        },
-      }
+      return askUserQuestionHookOutput(decision)
     }
     const risk = classifyRisk(toolName, toolInput)
     // "Don't ask again" is keyed by tool + risk tier, so allowing medium Bash
@@ -574,6 +635,21 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     abortController: ac,
     permissionMode: mode,
     hooks: { PreToolUse: [{ hooks: [preTool] }] },
+    // Enable AskUserQuestion (the agent's multiple-choice card) in EVERY mode.
+    // The CLI only adds AskUserQuestion / EnterPlanMode / ExitPlanMode to a
+    // session's toolset when the host declares it can service an interactive
+    // permission — i.e. when a `canUseTool` callback is present. Without it the
+    // tool is absent and the model gets "AskUserQuestion exists but is not
+    // enabled in this context", so the room's card handler above was dead code.
+    // Its PRESENCE is the whole point: in bypassPermissions this callback is
+    // shadowed (never invoked — bypass auto-approves before it, per the SDK's
+    // CLAUDE_SDK_CAN_USE_TOOL_SHADOWED warning), and in gated modes the
+    // PreToolUse hook runs first and stays authoritative (a hook deny — which is
+    // exactly how the AskUserQuestion card feeds its answer back — short-circuits
+    // canUseTool). So the human-gate holds in all modes: an ask-card always waits
+    // for a person via requestPermission inside the hook. This allow is a no-op
+    // relative to the hook, never a second gate that could override a denial.
+    canUseTool: async (_toolName, input) => ({ behavior: 'allow', updatedInput: input }),
     // Load the host's REAL Claude environment — user + project + local settings —
     // so custom slash commands (.claude/commands/*.md), CLAUDE.md and agents work
     // in the room exactly as in the user's own CLI. The Agent SDK isolates by
@@ -780,6 +856,19 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             // correct it). opts.model reflects what the session will actually run, so trust it.
             curModel = opts.model || m.model || model || curModel
             emit({ kind: 'system', sessionId, model: opts.model || m.model || model || null, commands: Array.isArray(m.slash_commands) ? m.slash_commands : undefined })
+            // AskUserQuestion regression guard — the init message carries the session's
+            // real tool list. If a caret SDK bump silently dropped AskUserQuestion from
+            // it (the 2026-07-08 outage), surface it loudly instead of a dead card. One-
+            // shot per session (resumed sessions replay init messages). Fails open when
+            // the message shape carries no tools[].
+            if (!sdkToolsChecked && Array.isArray(m.tools)) {
+              sdkToolsChecked = true
+              const regression = askUserQuestionRegression(m.tools, SDK_VERSION)
+              if (regression) {
+                process.stderr.write(`\n  ⚠⚠ ${regression}\n`)
+                emit({ kind: 'error', message: regression })
+              }
+            }
             // Dynamic model list — ask the SDK for its OWN supported models and surface
             // them to the room so the /model picker renders live options (incl. new
             // models like Fable) instead of a hardcoded three-item list. Fire-and-forget:
@@ -875,6 +964,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             // drops refills every cycle past RESTART_MAX) — and marks this session id durably
             // persisted so a later model-switch re-create can safely resume it.
             forceStopped = false
+            stallRetried = false   // a turn settled → the next turn gets a fresh auto-retry budget
             // Ground-truth the model from THIS turn's modelUsage (the models actually billed
             // this turn), not the init/system messages — a RESUMED session REPLAYS the prior
             // transcript's init messages, so curModel got polluted back to the pre-switch model
@@ -991,12 +1081,43 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     sessionId = persistedSessionId
     if (!closed) runQuery()                                 // relaunch on opts.model + resume
   }
+  // Abort a wedged turn (no event, no throw — the SDK's `for await` blocked inside an
+  // internal retry, e.g. an Anthropic 529-overload window) and re-run it ONCE, preserving
+  // the prompt. Mirrors recreateForSwitch's teardown-then-relaunch (abort qAc → swap the
+  // input stream → await the dying query's disposal so the two processes never race on the
+  // session file lock → resume the durable id) and then RE-PUSHES lastTurnText so the turn
+  // continues instead of being lost. The stall error was already surfaced by the watchdog
+  // (emitRaw of stallEvent('retry', …)); this adds a 'note' once the fresh turn is armed.
+  // Bounded to one call per turn by stallRetried (set in the interval before we're called).
+  const retryStalledTurn = async (quietMs) => {
+    if (closed) return
+    stallRetried = true
+    const wasActive = turnActive
+    const replay = wasActive ? lastTurnText : null
+    turnActive = false                                     // unblock between-turns updates while we tear down
+    const dying = qDone
+    const oldInput = input
+    input = makeInputStream()                              // fresh stream for the relaunched query
+    if (qAc) { try { qAc.abort() } catch { /* noop */ } }  // unblock the wedged for-await → its catch disposes the process
+    try { oldInput.end() } catch { /* noop */ }
+    try { await dying } catch { /* noop */ }               // wait until the old query is actually dead (avoids the lock race)
+    await sleep(300)                                       // brief lock-release margin
+    sessionId = persistedSessionId                         // resume the durably-persisted id (recreateForSwitch invariant)
+    if (closed) return
+    runQuery()
+    if (replay != null) {
+      turnActive = true; lastEvtTs = Date.now(); stalledSent = false   // re-arm liveness for the retried turn
+      // Match sendTurn's block shape: a slash command goes clean; a normal turn keeps the reminder.
+      input.push(/^\s*\//.test(replay) ? [{ type: 'text', text: replay }] : [{ type: 'text', text: replay }, { type: 'text', text: roomReminder() }])
+      emitRaw({ kind: 'note', text: 'retrying the stalled turn on a fresh connection' })
+    }
+  }
   if (!lazy) runQuery()
 
   return {
     // A lazy (restored-idle) session cold-boots the query on its first turn. input.push
     // is queue-backed, so the pushed turn buffers and runs once the query is ready.
-    sendTurn(text) { if (!closed) { if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false;
+    sendTurn(text) { if (!closed) { if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; stallRetried = false; forceStopped = false;
       const t = String(text)
       // SDK 0.3.198 only recognizes a slash command (/compact, /clear, custom /cmds) when the
       // user message is a SINGLE text block. Appending the per-turn ROOM NOW <system-reminder>

package/event-id.mjs

@@ -248,3 +248,68 @@ export function usageReportLine (sessionModel, logEvents) {
   const turns = `${sum.turns} turn${sum.turns === 1 ? '' : 's'}`
   return `usage · ${turns} · ${perStr}${total}${cost} · tokens + cost only (no plan/rate-limit meters)`
 }
+
+// Default hard cap for the context-carry recap (chars of transcript body, framing extra).
+export const RECAP_CAP = 20000
+
+// Context-carry recap for a lane whose SDK memory CAN'T be resumed (a cross-provider
+// switch, or a bridge-restart restore where canResume() is false). Such a lane re-opens
+// under the SAME id with the visible transcript replayed but a FRESH, blank backend — so
+// the agent starts amnesiac mid-conversation (the 2026-07-08 lane 109d22e1 "this is the
+// first message in my lane" incident). Raw SDK resume can't cross a provider (signed
+// thinking blocks + provider-specific tool_use records get rejected by a foreign backend),
+// so we carry the conversation at the TEXT layer instead: synthesize a plain-text recap
+// from the saved log — the people's turns (`you`) + the assistant's own text replies
+// (`assistant` text blocks; thinking + tool_use are dropped, they don't survive a backend
+// hop and are noise) — newest-weighted under a hard char cap, framed so the agent RESUMES
+// rather than re-greets. Pure + import-safe (unit-tested in bridge/recap.test.mjs).
+//
+// capReplayEvents lesson (rooms died once on a multi-MB replay): the char cap keeps this
+// bounded in prose form too — an unbounded recap would be the same bug wearing a text hat.
+export function buildRecapFromLog(log, cap = RECAP_CAP) {
+  if (!Array.isArray(log) || !log.length) return ''
+  const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
+  if (!budget) return ''
+  // Flatten the log to speaker-labelled turns, in order. `you` = a person in the room;
+  // `assistant` = this agent's own earlier reply (its text blocks only).
+  const turns = []
+  for (const e of log) {
+    if (!e || typeof e !== 'object') continue
+    if (e.kind === 'you') {
+      const t = String(e.text || '').trim()
+      if (t) turns.push({ who: 'PERSON', text: t })
+    } else if (e.kind === 'assistant') {
+      const t = (Array.isArray(e.blocks) ? e.blocks : [])
+        .filter((b) => b && b.type === 'text' && typeof b.text === 'string' && b.text.trim())
+        .map((b) => b.text.trim())
+        .join('\n')
+      if (t) turns.push({ who: 'YOU', text: t })
+    }
+  }
+  if (!turns.length) return ''
+  // Newest-weighted: walk from the end, keep whole turns until the char budget is spent,
+  // then restore chronological order. A single newest turn bigger than the whole budget is
+  // still kept (truncated) so the LIVE task is never dropped to the cap.
+  const kept = []
+  let used = 0
+  let omitted = false
+  for (let i = turns.length - 1; i >= 0; i--) {
+    let line = `${turns[i].who}: ${turns[i].text}`
+    if (used + line.length > budget) {
+      if (kept.length) { omitted = true; break }   // older turns exist but won't fit → note + stop
+      line = line.slice(0, budget)                  // newest turn alone overflows → clip, still include
+    }
+    kept.push(line)
+    used += line.length
+  }
+  kept.reverse()
+  const body = (omitted ? ['[…earlier messages omitted for length…]'] : []).concat(kept).join('\n\n')
+  return [
+    '[CONTEXT CARRY — you are RESUMING a live conversation after a model/provider switch]',
+    "Your session memory was reset by the switch, but this lane's conversation continued and the people already saw everything below. Do NOT re-greet, do NOT re-introduce yourself, and do NOT re-answer anything you already completed. Read the recap, then continue the work exactly where it left off. The LAST PERSON message with no completed answer below is your live task — pick it up.",
+    '',
+    '--- conversation so far (oldest → newest) ---',
+    body,
+    '--- end recap ---',
+  ].join('\n')
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.170",
+  "version": "0.7.172",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
     "byok-detect.mjs",
     "context-windows.mjs",
     "claude-session.mjs",
+    "turn-stall.mjs",
     "update-gate.mjs",
     "event-id.mjs",
     "transcript-sanitize.mjs",

package/service.mjs

@@ -232,6 +232,61 @@ function verifyDarwinReload(lbl, file, version) {
   return false
 }
 
+// F4 — every io.thinkpool.pair.* label currently LOADED in the launchd/systemd domain,
+// plus any label with a plist/unit still on disk (loaded or not). Pure enumeration so the
+// sweep below is testable in isolation. `keepLabel` is the label we're about to (re)install
+// — its own bootout+bootstrap is the caller's job, so the sweep leaves it alone.
+export function existingServiceLabels(platform = process.platform, { fsMod = fs } = {}) {
+  const labels = new Set()
+  try {
+    if (platform === 'darwin') {
+      try {
+        const out = execSync(`launchctl print gui/$(id -u) 2>/dev/null | grep -oE 'io\\.thinkpool\\.pair\\.[A-Za-z0-9_]+' | sort -u`, { encoding: 'utf8', shell: '/bin/bash' })
+        for (const l of out.split('\n')) { const t = l.trim(); if (t) labels.add(t) }
+      } catch { /* nothing loaded */ }
+      try {
+        const dir = path.join(os.homedir(), 'Library', 'LaunchAgents')
+        for (const f of fsMod.readdirSync(dir)) { const m = f.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.plist$/); if (m) labels.add(m[1]) }
+      } catch { /* no dir */ }
+    } else if (platform === 'linux') {
+      try {
+        const out = execSync(`systemctl --user list-unit-files 'io.thinkpool.pair.*' --no-legend 2>/dev/null | awk '{print $1}'`, { encoding: 'utf8', shell: '/bin/bash' })
+        for (const l of out.split('\n')) { const t = l.trim().replace(/\.service$/, ''); if (t) labels.add(t) }
+      } catch { /* none */ }
+      try {
+        const dir = path.join(os.homedir(), '.config', 'systemd', 'user')
+        for (const f of fsMod.readdirSync(dir)) { const m = f.match(/^(io\.thinkpool\.pair\.[A-Za-z0-9_]+)\.service$/); if (m) labels.add(m[1]) }
+      } catch { /* no dir */ }
+    }
+  } catch { /* best-effort */ }
+  return [...labels]
+}
+
+// F4 — before (re)installing, sweep EVERY pre-existing thinkpool-pair service EXCEPT the one
+// we're about to install (which the install path bootout+bootstraps itself). Today's outage
+// trigger was an uninstall/reinstall leaving TWO account services live, both heart-beating,
+// racing the saved login. Idempotent + best-effort; never throws. Also reaps orphaned ROOM
+// CHILD bridges (the proven verifyDarwinReload pattern — the uppercase-room guard never
+// matches the no-arg menu or the supervisor, so the live account bridge is never touched).
+export function sweepExistingServices(keepLabel, platform = process.platform) {
+  for (const lbl of existingServiceLabels(platform)) {
+    if (lbl === keepLabel) continue
+    try {
+      if (platform === 'darwin') {
+        execSync(`launchctl bootout gui/$(id -u)/${lbl} 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' })
+        try { fs.rmSync(path.join(os.homedir(), 'Library', 'LaunchAgents', `${lbl}.plist`), { force: true }) } catch { /* noop */ }
+      } else if (platform === 'linux') {
+        execSync(`systemctl --user disable --now ${lbl}.service 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' })
+      }
+      process.stderr.write(`  ◆ swept stale service ${lbl}\n`)
+    } catch { /* best-effort */ }
+  }
+  // Reap orphaned ROOM child bridges only — safe (never the supervisor / interactive menu).
+  if (platform !== 'win32') {
+    try { execSync(`pkill -9 -f 'thinkpool-pair/bridge.mjs [A-Z0-9]' 2>/dev/null || true`, { stdio: 'ignore', shell: '/bin/bash' }) } catch { /* noop */ }
+  }
+}
+
 // staleProof defaults ON for every real install: even a FIRST install can be launched from
 // a stale npx cache (the launcher itself is npx-resolved), so without the cache-wiping
 // wrapper a fresh `install-service` could pin a stale build just like the update path did.
@@ -240,6 +295,10 @@ function verifyDarwinReload(lbl, file, version) {
 // so its unit tests assert the pure pinned shape.
 export function installService(room, cmdArgs = [], { autoUpdate = false, version = VERSION, staleProof = true } = {}) {
   const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate, version, staleProof })
+  // F4: clear every OTHER pre-existing pair service first, so only the one we install remains
+  // (the "two account services live" storm trigger). Our own label is bootout+bootstrapped
+  // by a.post below, so keep it.
+  try { sweepExistingServices(label(room), process.platform) } catch { /* best-effort */ }
   fs.mkdirSync(a.logDir, { recursive: true })
   fs.mkdirSync(path.dirname(a.file), { recursive: true })
   fs.writeFileSync(a.file, a.content)

package/turn-stall.mjs

@@ -0,0 +1,43 @@
+/* ─────────────────────────────────────────────────────────────
+   turn-stall.mjs — the pure decision layer for the structured-turn stall watchdog.
+
+   A structured turn can stall with the SDK's `for await` blocked INSIDE an internal retry
+   — no event, no throw — so claude-session's catch never runs and nothing reaches the room.
+   The 2026-07-08 incident: an Anthropic 529-overload window hung a turn for 14 minutes with
+   zero output until it was aborted by hand. The watchdog in claude-session.mjs turns that
+   silent wedge into a visible status, then an abort + one auto-retry, then a force-stop.
+
+   These two functions are the DECISION layer (when to act / what to say). They're pure — no
+   SDK, no clock, no I/O — so the stateful loop injects state in and they unit-test against a
+   fake clock with zero deps (bridge/test-turn-stall-watchdog.mjs). Same shape + spirit as
+   account.mjs's claimLoopWedged / withTimeout. Kept in their OWN module (no SDK import) so the
+   test needs neither the agent SDK nor auth. The loop owns the flags + the abort/re-push side
+   effects; this only says WHAT to do.
+   ───────────────────────────────────────────────────────────── */
+
+// Decide the watchdog action for an ACTIVE turn gone quiet (quietMs = ms since the last
+// emitted SDK event). Idle (no turn) or awaiting a HUMAN decision (permission card / plan
+// gate / AskUserQuestion) is never a wedge — the turn is correctly idle until the person
+// answers. Timeline:
+//   quietMs > stallMs (90s)      → 'status'  — surface a "still retrying (Ns)" banner, ONCE
+//   quietMs > forceStopMs (5min) → 'retry'   — abort the hung call, re-run the turn ONCE
+//   quietMs > forceStopMs again  → 'giveup'  — the one retry also stalled: force-stop, resend
+export function stallDecision({ turnActive, awaitingUser, quietMs, stallMs, forceStopMs, stalledSent, stallRetried }) {
+  if (!turnActive || awaitingUser > 0) return 'none'
+  if (quietMs > forceStopMs) return stallRetried ? 'giveup' : 'retry'
+  if (!stalledSent && quietMs > stallMs) return 'status'
+  return 'none'
+}
+
+// The room-facing event for a watchdog action (pure → the exact wording is unit-tested).
+// 'status' rides the transient `stalled` chrome event (broadcast, never persisted); 'retry'
+// and 'giveup' ride `error` (recoverable) so the stall is ALWAYS surfaced, never swallowed.
+export function stallEvent(action, quietMs) {
+  const s = Math.round(quietMs / 1000)
+  switch (action) {
+    case 'status': return { kind: 'stalled', sinceMs: quietMs, retrying: true, message: `model call stalled — still retrying (${s}s)` }
+    case 'retry':  return { kind: 'error', recoverable: true, message: `model call stalled ${s}s with no response (upstream overload) — aborting the hung call and retrying the turn once` }
+    case 'giveup': return { kind: 'error', recoverable: true, message: `agent went silent for ${s}s — the retry also stalled; force-stopped the turn, send again to resume` }
+    default:       return null
+  }
+}