thinkpool-pair 0.7.185 → 0.7.187

package/bridge.mjs

@@ -94,8 +94,8 @@ const flowRedispatch = new Map()
 const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
-import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP } from './event-id.mjs'
+import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage } from './session-store.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
 import { planMeterLine } from './plan-meters.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 
@@ -929,10 +929,23 @@ const defendFrame = (event, payload) => {
   if (Array.isArray(p.events)) {
     p.events = p.events.map((e) => boundEventForBroadcast(e, 100000))
     // …and if a frame is STILL over the limit, drop the OLDEST events until it fits —
-    // keep the newest so the client's seqHi still advances to current. classifyReplay
-    // accepts the resulting seq jump; older events are covered by the DB transcript snapshot.
-    let guard = 0
-    while (p.events.length > 1 && JSON.stringify(p).length > FRAME_SOFT_LIMIT && guard++ < 10000) p.events.shift()
+    // keep the newest so the client's seqHi still advances to current.
+    //
+    // C-RG1 (2026-07-10): STAMP what we dropped. This used to end with "classifyReplay
+    // accepts the resulting seq jump; older events are covered by the DB transcript
+    // snapshot" — both halves were wrong. classifyReplay accepting the jump IS the bug
+    // (the client leapt over a hole it couldn't see, and its "load earlier" gate only
+    // detects a LEADING gap, never a middle one). And the tx: snapshot never covered
+    // this; the durable JSONL archive does. So say what we trimmed and let the client
+    // fetch it back. Events dropped here were about to be broadcast, so by construction
+    // they're in the archive — the stamp is always recoverable. Raise, never lower: the
+    // send site may have already stamped a chunk-cap trim below this one.
+    let guard = 0, dropped = 0
+    while (p.events.length > 1 && JSON.stringify(p).length > FRAME_SOFT_LIMIT && guard++ < 10000) { p.events.shift(); dropped++ }
+    if (dropped) {
+      const lo = firstSeq(p.events)
+      if (typeof lo === 'number') p.trimmedBefore = Math.max(p.trimmedBefore ?? 0, lo)
+    }
   }
   return p
 }
@@ -2702,17 +2715,30 @@ channel
       // Chunk the tail into ORDERED under-budget frames (A): the full log on a fresh reload
       // (empty cursor) is multi-MB and a single frame would be dropped by Realtime, freezing
       // the terminal. chunkReplayEvents splits it so nothing in the recent window is lost;
-      // classifyReplay applies the chunks in arrival order. Older history beyond the chunk
-      // budget is covered by the client's DB transcript snapshot.
+      // classifyReplay applies the chunks in arrival order.
+      //
+      // C-RG1 (2026-07-10): chunkReplayEvents keeps only the newest REPLAY_MAX_CHUNKS —
+      // a fat lane (measured: 1.7MB / 12 chunks) drops its OLDEST chunks. That hole used
+      // to travel unannounced; the client absorbed the seq jump and could never fetch the
+      // missing stretch back (its "load earlier" gate only sees a LEADING gap). Tell it.
+      // `cursor` is what the client holds — an `ahead` reset replay is a full rebuild, so
+      // it holds nothing (0). The floor keeps a fresh lane whose first turn lands at seq>1
+      // from being stamped (the 2026-07-02 phantom-pill regression).
+      const chunks = chunkReplayEvents(tail)
+      const cursor = ahead ? 0 : from
+      const trimmedBefore = trimmedBeforeSeq(firstSeq(chunks[0] || []), cursor, s.archiveOldestSeq)
       // Attach the terminal's last usage/ctx meter to the FIRST replay chunk. usage is
       // chrome (filtered out of `events` by both bridge + client), so without this a
       // (re)joiner's ctx meter is empty ("—") until the terminal's next turn. The client
       // applies `payload.lastUsage` in its code-replay handler (which is `to`-targeted, so
       // only the joiner gets it). Gated on `.ctx` — a suppressed meter (correctContext
       // nulled it for an unknown non-Claude model) replays nothing, never a misleading %.
+      // trimmedBefore rides the FIRST (oldest) chunk only — the later chunks are contiguous
+      // with it, so a stamp there would read as a second, phantom gap. Same rule as
+      // lastUsage above and hasMore on history-page below.
       let firstChunk = true
-      for (const events of chunkReplayEvents(tail)) {
-        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}), ...(firstChunk && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}) })
+      for (const events of chunks) {
+        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}), ...(firstChunk && trimmedBefore != null ? { trimmedBefore } : {}), ...(firstChunk && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}) })
         firstChunk = false
       }
     }
@@ -2735,6 +2761,13 @@ channel
   .on('broadcast', { event: 'history-page-request' }, ({ payload }) => {
     const id = payload?.term
     if (!id) return
+    // Multi-bridge rooms (Max's two Macs; the account-supervisor path): only the bridge
+    // that HOLDS this terminal may answer. A foreign bridge used to reply with an empty
+    // page — the client reads the first empty page as "no older history", clears the gap
+    // and kills the load-earlier pill, so recoverable history reads as gone. Targeting
+    // (payload.host) is honoured too, matching term-open / file-put / code-open / flow-*,
+    // but no client stamps it yet — ownership is what actually closes the race.
+    if (!servesHistoryPage({ payloadHost: payload?.host, bridgeName: name, hasSession: sessions.has(id), hasArchive: hasDurableArchive(room, id) })) return
     const { events, hasMore } = readDurablePage(room, id, Number(payload?.beforeSeq) || null, 200)
     const to = payload?.to ?? null
     if (!events.length) { bcast('history-page', { to, term: id, events: [], hasMore: false }); return }
@@ -2830,7 +2863,15 @@ channel
     if (/^\/clear\s*$/.test(text)) {
       s.pendingRecap = null   // /clear means forget context — drop any un-fired carry recap
       s.session.sendTurn(text)
-      s.log = []; s.seq = makeSeqCounter(0); bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
+      // The seq reset is load-bearing on BOTH ends: the client's clear handler sets
+      // seqHi = 0 (room.jsx), so the counter must restart with it. The durable archive
+      // is append-only and keeps the pre-clear era under colliding seqs — session-store's
+      // epochStart() confines every read to the newest era, so the archive never splices
+      // two conversations. Drop the cached floor with it: the next pushLog re-seeds
+      // archiveOldestSeq from the FIRST post-clear event (the new epoch's floor), instead
+      // of leaving a stale pre-clear floor to mis-aim trimmedBeforeSeq's phantom-pill guard.
+      s.log = []; s.seq = makeSeqCounter(0); s.archiveOldestSeq = null
+      bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
       flushSession(room, payload.term, { sessionId: s.session?.sessionId || null, log: [] })
       ctlLine('context cleared. You can continue with these answers in mind.')
       return

package/event-id.mjs

@@ -139,6 +139,39 @@ export function chunkReplayEvents(events, budget = REPLAY_BYTE_BUDGET, maxChunks
   return chunksRev.reverse().map((c) => c.reverse())
 }
 
+// ── C-RG1/C-RG4 (2026-07-10): the bridge stamps what it trimmed. ──────────────
+// chunkReplayEvents keeps only the newest maxChunks — on a fat lane the OLDEST chunks
+// are dropped. Until now that hole was unannounced: classifyReplay accepted the seq
+// jump, seqHi leapt past it, and because the client's "load earlier" gate compares its
+// OLDEST loaded seq against the archive floor, a hole in the MIDDLE (client holds
+// 1..50 ∪ 900..2000) never surfaced a pill and was unrecoverable — silently, forever.
+//
+// The bridge is the only party that knows. Return the lowest seq we are ACTUALLY
+// sending when events below it were withheld AND are recoverable from the durable
+// JSONL archive; null when nothing was withheld.
+//
+// Floor-aware on purpose. The seq counter is per-SESSION, not per-terminal, so a fresh
+// lane's first turn legitimately lands at seq > 1 — stamping that would resurrect the
+// 2026-07-02 phantom "load earlier" pill (a button that fetches nothing). `cursor` is
+// what the client already holds (0 = nothing, and an `ahead` cursor-reset replay must
+// pass 0). `archiveOldestSeq` is the durable floor (bridge.mjs entry.archiveOldestSeq).
+// Anything at or below max(cursor, floor-1) is not missing: either the client has it,
+// or the archive never had it and no affordance could ever fetch it.
+export function trimmedBeforeSeq(sentFromSeq, cursor = 0, archiveOldestSeq = null) {
+  if (typeof sentFromSeq !== 'number') return null
+  const floor = typeof archiveOldestSeq === 'number' ? archiveOldestSeq : 1
+  const known = Math.max(cursor || 0, floor - 1)
+  return sentFromSeq > known + 1 ? sentFromSeq : null
+}
+
+// The lowest transcript seq in an event list (nulls sort out). Chrome events are
+// seq-less (NO_SEQ_KINDS) and must not anchor the stamp.
+export function firstSeq(events) {
+  if (!Array.isArray(events)) return null
+  for (const e of events) if (e && typeof e.seq === 'number') return e.seq
+  return null
+}
+
 // Bound a SINGLE event so it can never overflow a broadcast frame on its own. The worst
 // offenders are tool_results carrying inline base64 IMAGES (a 592KB screenshot block) —
 // these can't ride a size-capped Realtime broadcast at all (live OR replay). Truncate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.185",
+  "version": "0.7.187",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/session-store.mjs

@@ -115,17 +115,75 @@ export function seedDurableEvents(room, id, events) {
   } catch { /* noop */ }
 }
 
-// The archive FLOOR: the lowest transcript seq durably stored for this terminal.
-// The client compares its oldest loaded seq against this — only OFFER "load earlier"
-// when there genuinely are older events in the archive (vs a fresh lane whose first
-// turn happens to land at seq > 1, or an evicted-but-unarchived gap). null = no archive.
+// Does this bridge hold a durable archive for `id`? The capability half of the
+// history-page-request guard (a foreign bridge in a multi-bridge room has no file).
+export function hasDurableArchive(room, id) {
+  try { return !!room && !!id && fs.existsSync(eventsLog(room, id)) } catch { return false }
+}
+
+// Should THIS bridge answer a history-page-request? (pure — tested in test-history-ab.mjs)
+//
+// Two independent gates, both required:
+//  · `payloadHost` — the same targeting guard every other broadcast handler carries
+//    (term-open, file-put, code-open, flow-*): a targeted request is for ONE machine.
+//  · ownership — no client build to date STAMPS a host on this event, so targeting
+//    alone leaves an untargeted request answerable by every bridge in the room. The
+//    bridge that doesn't serve the terminal has no archive, replies
+//    `{ events: [], hasMore: false }`, and the client reads that first empty page as
+//    "no older history" — the load-earlier pill dies and recoverable history looks
+//    gone. Only the bridge that actually HOLDS the terminal may speak: a live session,
+//    or (a closed lane whose transcript is still on screen) its durable archive.
+export function servesHistoryPage({ payloadHost, bridgeName, hasSession, hasArchive }) {
+  if (payloadHost && payloadHost !== bridgeName) return false
+  return !!(hasSession || hasArchive)
+}
+
+// ── Epochs: /clear resets the per-session seq counter (bridge.mjs) but the durable
+// archive is append-only and keeps every era. So one file can hold seq 1..500 (pre-clear)
+// followed by seq 1..30 (post-clear) — colliding keys. `findIndex(e.seq >= beforeSeq)`
+// then anchors in the WRONG era and a page splices two conversations together.
+//
+// A seq that does not strictly increase over its predecessor is, by construction, a
+// counter reset: within one bridge run the counter only climbs, and a restart reseeds it
+// from maxSeq(restored log). So the last regression marks the start of the CURRENT epoch,
+// and only that epoch is pageable. Everything older is a conversation the user explicitly
+// cleared — surfacing it under colliding seqs would be wrong twice over.
+//
+// This is read-side only: it needs no migration and fixes archives already on disk
+// (every user's, right now) as well as ones written from here on.
+function epochStart(all) {
+  let start = 0, last = -Infinity
+  for (let i = 0; i < all.length; i++) {
+    const s = all[i]?.seq
+    if (typeof s !== 'number') continue
+    if (s <= last) { start = i; last = s; continue }   // counter went backwards → new era
+    last = s
+  }
+  return start
+}
+
+function readArchive(room, id) {
+  const f = eventsLog(room, id)
+  if (!fs.existsSync(f)) return null
+  const all = []
+  for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
+    if (!line) continue
+    try { all.push(JSON.parse(line)) } catch { /* skip a torn line */ }
+  }
+  return all
+}
+
+// The archive FLOOR: the lowest transcript seq durably stored for this terminal *in the
+// current epoch*. The client compares its oldest loaded seq against this — only OFFER
+// "load earlier" when there genuinely are older events in the archive (vs a fresh lane
+// whose first turn happens to land at seq > 1, or an evicted-but-unarchived gap).
+// null = no archive.
 export function readDurableOldestSeq(room, id) {
   try {
-    const f = eventsLog(room, id)
-    if (!fs.existsSync(f)) return null
-    for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
-      if (!line) continue
-      try { const e = JSON.parse(line); if (e && e.seq != null) return e.seq } catch { /* skip torn line */ }
+    const all = readArchive(room, id)
+    if (!all) return null
+    for (let i = epochStart(all); i < all.length; i++) {
+      if (all[i] && all[i].seq != null) return all[i].seq
     }
     return null
   } catch { return null }
@@ -134,22 +192,19 @@ export function readDurableOldestSeq(room, id) {
 // Read a backward page: events with transcript seq < beforeSeq (newest `limit` of
 // them, no-seq chrome interleaved by file order preserved). Returns { events, hasMore }.
 // beforeSeq null → the newest `limit` events (the tail). hasMore = there is older still.
+// Never reads below the current epoch — see epochStart.
 export function readDurablePage(room, id, beforeSeq, limit = 200) {
   try {
-    const f = eventsLog(room, id)
-    if (!fs.existsSync(f)) return { events: [], hasMore: false }
-    const all = []
-    for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
-      if (!line) continue
-      try { all.push(JSON.parse(line)) } catch { /* skip a torn line */ }
-    }
+    const all = readArchive(room, id)
+    if (!all) return { events: [], hasMore: false }
+    const from = epochStart(all)
     let bound = all.length
     if (beforeSeq != null) {
-      const i = all.findIndex((e) => e && e.seq != null && e.seq >= beforeSeq)
+      const i = all.findIndex((e, idx) => idx >= from && e && e.seq != null && e.seq >= beforeSeq)
       if (i >= 0) bound = i
     }
-    const start = Math.max(0, bound - limit)
-    return { events: all.slice(start, bound), hasMore: start > 0 }
+    const start = Math.max(from, bound - limit)
+    return { events: all.slice(start, Math.max(start, bound)), hasMore: start > from }
   } catch { return { events: [], hasMore: false } }
 }