thinkpool-pair 0.7.245 → 0.7.247

package/hermes-session.mjs

@@ -6,6 +6,7 @@ import { randomUUID } from 'node:crypto'
 import { AcpClient } from './acp-client.mjs'
 import { HermesEventMapper, hermesToolFor } from './hermes-event-mapper.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
+import { hermesExactInventory, hermesPolicyEnv, hermesRoleFor } from './hermes-policy.mjs'
 import { startCodexMcpHttp } from './codex-mcp-http.mjs'
 import { classifyRisk } from './claude-session.mjs'
 
@@ -44,7 +45,7 @@ export function startHermesSession({
   cwd, model, resume, env = process.env, mode = 'default', onEvent, requestPermission,
   roomContext, terminalRolePrompt, rolePrompt, mcpServers, requiredMcpTools = [], prepareCwd = null,
   command = HERMES_COMMAND, args = ['acp'], clientFactory = createAcpClient,
-  mcpHttpFactory = startCodexMcpHttp, lazy = false,
+  mcpHttpFactory = startCodexMcpHttp, lazy = false, hermesRole = null,
 } = {}) {
   let activeCwd = cwd
   const requestedModel = model || null
@@ -68,6 +69,7 @@ export function startHermesSession({
   let resuming = false
   let inventoryProbe = null
   let modelSwitchPending = false
+  const policyRole = hermesRole || hermesRoleFor({})
 
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
 
@@ -101,7 +103,14 @@ export function startHermesSession({
   async function probeMcpTools() {
     const required = [...new Set((Array.isArray(requiredMcpTools) ? requiredMcpTools : [])
       .map((name) => String(name || '').trim()).filter(Boolean))]
-    if (!required.length) return []
+    // Direct runtime tests and unscoped upstream callers have no bridge role
+    // contract to prove. Every bridge-created Hermes lane supplies its required
+    // MCP list; only those lanes enter the exact-inventory transaction.
+    if (!required.length) return { inventory: '', missing: [], forbidden: [] }
+    const exact = hermesExactInventory(policyRole, { mcpTools: required })
+    const allowedBuiltins = exact.builtinTools
+    const requiredBuiltins = exact.requiredBuiltinTools
+    const expectedMcp = exact.mcpTools
     const chunks = []
     inventoryProbe = chunks
     try {
@@ -112,7 +121,32 @@ export function startHermesSession({
       }, 30_000)
     } finally { inventoryProbe = null }
     const inventory = chunks.join('')
-    return required.filter((name) => !inventory.includes(`mcp__thinkpool__${name}`))
+    const has = (name) => new RegExp(`(?:^|[^a-z0-9_])${name}(?:$|[^a-z0-9_])`, 'i').test(inventory)
+    const mcpNames = [...inventory.matchAll(/\bmcp(?:__|_)[a-z0-9_]+/gi)].map((item) => item[0])
+    const expectedMcpNames = new Set(expectedMcp.flatMap((name) => [`mcp__thinkpool__${name}`, `mcp_thinkpool_${name}`]))
+    const unexpectedMcp = [...new Set(mcpNames.filter((name) => !expectedMcpNames.has(name)))]
+    // This is a zero-inference ACP inventory command. It proves the complete
+    // role schema (required built-ins plus exactly this lane's ThinkPool MCP
+    // set). Optional provider/browser capabilities may be absent, but any
+    // presented builtin outside the role allowlist is still a hard failure.
+    return {
+      inventory,
+      missing: [
+        ...requiredBuiltins.filter((name) => !has(name)),
+        ...expectedMcp.filter((name) => !has(`mcp__thinkpool__${name}`) && !has(`mcp_thinkpool_${name}`)),
+      ],
+      forbidden: [
+        ...exact.allBuiltinTools.filter((name) => !allowedBuiltins.includes(name) && has(name)),
+        ...unexpectedMcp,
+      ],
+    }
+  }
+
+  async function assertMcpReadiness() {
+    const probe = await probeMcpTools()
+    if (!probe.missing.length && !probe.forbidden.length) return probe
+    const details = [probe.missing.length ? `missing ${probe.missing.join(', ')}` : '', probe.forbidden.length ? `forbidden ${probe.forbidden.join(', ')}` : ''].filter(Boolean).join('; ')
+    throw new Error(`Hermes ThinkPool MCP readiness failed; ${details}`)
   }
 
   async function boot() {
@@ -126,18 +160,25 @@ export function startHermesSession({
       }
       const thinkpool = mcpServers?.thinkpool
       if (thinkpool && !mcpHttp) mcpHttp = await mcpHttpFactory({ sdkServer: thinkpool })
-      const childEnv = hermesChildEnv(env)
+      let childEnv = hermesChildEnv(env)
+      let launchCommand = command
+      let launchArgs = args
       // The bridge advertises Hermes only after this probe, but lazy lanes may
       // boot much later. Re-check immediately before every real ACP process so
       // a removed/changed delegation hook cannot ride a stale startup verdict.
       if (command === HERMES_COMMAND && clientFactory === createAcpClient) {
-        const profile = probeHermesRuntime({ command, env: childEnv })
+        const profile = probeHermesRuntime({ command, env: childEnv, strictBootstrap: true })
         if (!profile.available) throw new Error(`Hermes profile safety check failed: ${profile.reason || 'runtime unavailable'}`)
+        // The executable is the installed venv Python, never the mutable
+        // profile wrapper. HERMES_HOME is the probe-verified isolated profile.
+        launchCommand = profile.python
+        launchArgs = [profile.bootstrap]
+        childEnv = { ...childEnv, HERMES_HOME: profile.profile, THINKPOOL_HERMES_ACP_POLICY: hermesPolicyEnv(policyRole, { mcpTools: requiredMcpTools }) }
       }
       let retired = false
       retireClient = () => { retired = true }
       client = clientFactory({
-        command, args, cwd: activeCwd, env: childEnv,
+        command: launchCommand, args: launchArgs, cwd: activeCwd, env: childEnv,
         onNotification,
         onRequest,
         onStderr: (text) => { stderrTail = (stderrTail + text).slice(-2000) },
@@ -175,7 +216,8 @@ export function startHermesSession({
       } else state = await client.request('session/new', params, 30_000)
       if (!sessionId) sessionId = state?.sessionId || null
       if (!sessionId) throw new Error('Hermes ACP did not return a session id')
-      let missingMcpTools = await probeMcpTools()
+      let toolProbe = await probeMcpTools()
+      let missingMcpTools = toolProbe.missing
       // Hermes treats ACP-provided MCP registration as non-fatal. A transient
       // first connection can therefore leave an otherwise healthy session with
       // only built-in tools. Re-running the released resume lifecycle retries
@@ -186,10 +228,12 @@ export function startHermesSession({
           resuming = true
           state = await client.request('session/resume', { ...params, sessionId }, 30_000)
         } finally { resuming = false }
-        missingMcpTools = await probeMcpTools()
+        toolProbe = await probeMcpTools()
+        missingMcpTools = toolProbe.missing
       }
-      if (missingMcpTools.length) {
-        throw new Error(`Hermes ThinkPool MCP readiness failed; missing ${missingMcpTools.join(', ')}`)
+      if (missingMcpTools.length || toolProbe.forbidden.length) {
+        const details = [missingMcpTools.length ? `missing ${missingMcpTools.join(', ')}` : '', toolProbe.forbidden.length ? `forbidden ${toolProbe.forbidden.join(', ')}` : ''].filter(Boolean).join('; ')
+        throw new Error(`Hermes ThinkPool MCP readiness failed; ${details}`)
       }
       const serverModel = state?.models?.currentModelId || null
       activeModel = requestedModel || serverModel || activeModel
@@ -197,8 +241,9 @@ export function startHermesSession({
       // ACP catalog. Acknowledge that model BEFORE publishing the initial system/
       // models events; otherwise the worker runs the requested model while the UI
       // and persisted resume record lie that it still uses the profile default.
-      if (requestedModel && requestedModel !== serverModel) {
+      if (requestedModel) {
         await client.request('session/set_model', { sessionId, modelId: activeModel })
+        await assertMcpReadiness()
       }
       const publishedModels = state?.models
         ? { ...state.models, currentModelId: activeModel }
@@ -209,7 +254,7 @@ export function startHermesSession({
       if (state?.modes?.availableModes?.some((item) => item.id === acpMode) && state.modes.currentModeId !== acpMode) {
         await client.request('session/set_mode', { sessionId, modeId: acpMode })
       }
-      emit({ kind: 'capabilities', runtime: 'hermes', protocol: 'acp', protocolVersion: initialized?.protocolVersion, capabilities: initialized?.agentCapabilities || {}, models: modelList(state?.models), flow: false })
+      emit({ kind: 'capabilities', runtime: 'hermes', protocol: 'acp', protocolVersion: initialized?.protocolVersion, capabilities: initialized?.agentCapabilities || {}, models: modelList(state?.models), flow: command === HERMES_COMMAND && clientFactory === createAcpClient })
     })().catch((error) => {
       crashed = true
       client?.end()
@@ -328,7 +373,11 @@ export function startHermesSession({
       if (!nextModel || turnActive || modelSwitchPending) return false
       const requested = String(nextModel)
       modelSwitchPending = true
-      void boot().then(() => client.request('session/set_model', { sessionId, modelId: requested })).then(() => {
+      void boot().then(() => client.request('session/set_model', { sessionId, modelId: requested })).then(async () => {
+        // 0.18.2 reconstructs state.agent during set_model.  The bootstrap
+        // re-registers its MCP; this independent zero-inference /tools check is
+        // the transaction's acknowledgement boundary.
+        await assertMcpReadiness()
         if (ended) return
         activeModel = requested
         if (mapper) mapper.model = activeModel

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.245",
+  "version": "0.7.247",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -9,6 +9,8 @@
   "files": [
     "bridge.mjs",
     "sdk-smoke.mjs",
+    "sdk-admission.mjs",
+    "sdk-admission.mjs",
     "launcher.mjs",
     "byok-detect.mjs",
     "context-windows.mjs",
@@ -22,6 +24,8 @@
     "codex-event-mapper.mjs",
     "acp-client.mjs",
     "hermes-session.mjs",
+    "hermes-policy.mjs",
+    "hermes-acp-bootstrap.py",
     "hermes-event-mapper.mjs",
     "hermes-probe.mjs",
     "hermes-setup.mjs",
@@ -54,6 +58,7 @@
     "viewport.mjs",
     "design-edit.mjs",
     "flow-review.mjs",
+    "review-check.mjs",
     "flow-review-gate.mjs",
     "flow-review-reflect.mjs",
     "flow-assembly.mjs",

package/review-check.mjs

@@ -0,0 +1,155 @@
+// Fixed, bridge-owned review checks. Models receive only { target, checkId }.
+// This is host execution parity with Claude/Codex Flow, not a malicious-code sandbox.
+import fs from 'node:fs'
+import fsp from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { spawn } from 'node:child_process'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+
+const execFileAsync = promisify(execFile)
+
+const CHECKS = Object.freeze({
+  'node-test': ['node', ['--test']], 'npm-test': ['npm', ['test']],
+  'npm-build': ['npm', ['run', 'build']], pytest: ['pytest', []],
+  'cargo-test': ['cargo', ['test']], 'go-test': ['go', ['test', './...']],
+})
+const OUTPUT_CAP = 512 * 1024
+
+export function reviewCheckCommand(checkId) {
+  if (!Object.hasOwn(CHECKS, checkId)) throw new Error('unapproved review check')
+  const [command, args] = CHECKS[checkId]
+  return { command, args: [...args] }
+}
+
+export async function reviewCheckEnv(env = process.env, root = null) {
+  root ||= await fsp.mkdtemp(path.join(os.tmpdir(), 'tp-review-env-'))
+  const keptPath = env.PATH || process.env.PATH || ''
+  const home = path.join(root, 'home')
+  const npmCache = path.join(root, 'npm-cache')
+  const tmp = path.join(root, 'tmp')
+  await Promise.all([fsp.mkdir(home, { recursive: true }), fsp.mkdir(npmCache, { recursive: true }), fsp.mkdir(tmp, { recursive: true })])
+  return { PATH: keptPath, HOME: home, TMPDIR: path.join(root, 'tmp'), npm_config_cache: npmCache, npm_config_userconfig: path.join(home, '.npmrc'), GIT_CONFIG_NOSYSTEM: '1' }
+}
+
+export function validateReviewTarget(target, snapshots) {
+  if (typeof target !== 'string' || !/^[a-z0-9-]{1,64}$/.test(target)) throw new Error('invalid reviewed target')
+  const snapshot = (Array.isArray(snapshots) ? snapshots : []).find((item) => item?.taskKey === target)
+  if (!snapshot || !/^[0-9a-f]{40}$/i.test(snapshot.sha) || !path.isAbsolute(snapshot.cwd || '')) throw new Error('reviewed target is not pinned')
+  return snapshot
+}
+
+export function validateReviewPath(filePath) {
+  if (typeof filePath !== 'string' || !filePath || filePath.length > 512 || path.posix.isAbsolute(filePath)) throw new Error('invalid review path')
+  const normalized = path.posix.normalize(filePath)
+  if (normalized === '.' || normalized === '..' || normalized.startsWith('../') || normalized.split('/').some((part) => !part || part === '.')) throw new Error('invalid review path')
+  return normalized
+}
+
+// Read the pinned Git blob, never the reviewer worktree.  git ls-tree refuses
+// directories and symlinks before git show is allowed to materialize bytes.
+export async function readReviewFile({ target, filePath, snapshots, maxBytes = 512 * 1024 } = {}) {
+  const snapshot = validateReviewTarget(target, snapshots)
+  const normalized = validateReviewPath(filePath)
+  const cap = Number.isInteger(maxBytes) && maxBytes > 0 && maxBytes <= 512 * 1024 ? maxBytes : 512 * 1024
+  const listed = await execFileAsync('git', ['-C', snapshot.cwd, 'ls-tree', '-z', snapshot.sha, '--', normalized], { encoding: 'buffer', maxBuffer: 1024 * 1024 })
+  const record = Buffer.from(listed.stdout).toString('utf8').split('\0').filter(Boolean)[0] || ''
+  const match = /^(100[0-7]{3}) blob ([0-9a-f]{40})\t(.+)$/.exec(record)
+  if (!match || match[3] !== normalized) throw new Error('review file is not a pinned regular file')
+  const shown = await execFileAsync('git', ['-C', snapshot.cwd, 'show', `${snapshot.sha}:${normalized}`], { encoding: 'buffer', maxBuffer: cap + 1 })
+  const bytes = Buffer.from(shown.stdout)
+  if (bytes.length > cap) throw new Error('review file exceeds byte limit')
+  return { target, sha: snapshot.sha, path: normalized, content: bytes.toString('utf8'), bytes: bytes.length }
+}
+
+function boundedPush(parts, value) {
+  const text = String(value || '')
+  parts.push(text)
+  let total = parts.reduce((n, part) => n + part.length, 0)
+  while (total > OUTPUT_CAP && parts.length) total -= parts.shift().length
+}
+
+export async function killTree(child, signal = 'SIGTERM', { platform = process.platform, spawnImpl = spawn, taskkillTimeoutMs = 1_000 } = {}) {
+  if (!child?.pid) return true
+  if (platform === 'win32' && signal === 'SIGKILL') {
+    // Windows has no process-group equivalent.  This is trusted-host parity,
+    // not unescapable process-tree isolation. taskkill itself can hang on a
+    // hostile/broken host, so race it: cleanup remains best-effort and the
+    // review request always settles.
+    return await new Promise((resolve) => {
+      let done = false
+      let timer = null
+      const finish = (ok) => {
+        if (done) return
+        done = true
+        if (timer) clearTimeout(timer)
+        resolve(ok)
+      }
+      try {
+        const taskkill = spawnImpl('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true })
+        taskkill.once('close', (code) => finish(code === 0))
+        taskkill.once('error', () => finish(false))
+        timer = setTimeout(() => { try { taskkill.kill?.() } catch {} finish(false) }, taskkillTimeoutMs)
+      } catch { finish(false) }
+    })
+  }
+  try { platform === 'win32' ? child.kill(signal) : process.kill(-child.pid, signal); return true } catch { try { return child.kill(signal) } catch { return false } }
+}
+
+export function runProcess(command, args, { cwd, env, timeoutMs = 120_000, killGraceMs = 250 } = {}) {
+  return new Promise((resolve) => {
+    const stdout = [], stderr = []
+    let timedOut = false
+    let settled = false
+    let child
+    let timer = null
+    let forceTimer = null
+    let settleTimer = null
+    const settle = (code) => {
+      if (settled) return
+      settled = true
+      if (timer) clearTimeout(timer)
+      if (forceTimer) clearTimeout(forceTimer)
+      if (settleTimer) clearTimeout(settleTimer)
+      resolve({ exitCode: Number.isInteger(code) ? code : null, stdout: stdout.join('').slice(-OUTPUT_CAP), stderr: stderr.join('').slice(-OUTPUT_CAP), timedOut })
+    }
+    try { child = spawn(command, args, { cwd, env, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] }) }
+    catch (error) { stderr.push(String(error?.message || error)); settle(null); return }
+    child.stdout.on('data', (value) => boundedPush(stdout, value))
+    child.stderr.on('data', (value) => boundedPush(stderr, value))
+    timer = setTimeout(() => {
+      timedOut = true; void killTree(child)
+      forceTimer = setTimeout(async () => {
+        if (!await killTree(child, 'SIGKILL')) boundedPush(stderr, 'review check cleanup could not confirm process-tree termination')
+        // SIGKILL is unconditional on POSIX, but a platform/process failure must
+        // not leave the MCP call pending forever. A second best-effort kill then
+        // settles the caller; the scratch finally block can run.
+        settleTimer = setTimeout(() => {
+          void killTree(child, 'SIGKILL')
+          boundedPush(stderr, 'review check process did not report close after forced termination')
+          settle(null)
+        }, 1_000)
+      }, killGraceMs)
+    }, timeoutMs)
+    child.once('error', (error) => boundedPush(stderr, error?.message || error))
+    child.once('close', (code) => settle(code))
+  })
+}
+
+export async function runReviewCheck({ target, checkId, snapshots, env = process.env, tmpdir = os.tmpdir(), timeoutMs } = {}) {
+  const snapshot = validateReviewTarget(target, snapshots)
+  const archiveDir = await fsp.mkdtemp(path.join(tmpdir, 'tp-review-'))
+  const archive = path.join(archiveDir, 'source.tar')
+  const scratch = path.join(archiveDir, 'tree')
+  try {
+    await fsp.mkdir(scratch)
+    const archiveResult = await runProcess('git', ['-C', snapshot.cwd, 'archive', '--format=tar', `--output=${archive}`, snapshot.sha], { env: await reviewCheckEnv(env, archiveDir), timeoutMs: 15_000 })
+    if (archiveResult.exitCode !== 0 || archiveResult.timedOut) return { pass: false, target, sha: snapshot.sha, command: ['git', 'archive'], exitCode: archiveResult.exitCode, ...archiveResult }
+    const extract = await runProcess('tar', ['-xf', archive, '-C', scratch], { env: await reviewCheckEnv(env, archiveDir), timeoutMs: 15_000 })
+    if (extract.exitCode !== 0 || extract.timedOut) return { pass: false, target, sha: snapshot.sha, command: ['tar', '-xf'], exitCode: extract.exitCode, ...extract }
+    const spec = reviewCheckCommand(checkId)
+    const result = await runProcess(spec.command, spec.args, { cwd: scratch, env: await reviewCheckEnv(env, archiveDir), timeoutMs })
+    return { pass: result.exitCode === 0 && !result.timedOut, target, sha: snapshot.sha, command: [spec.command, ...spec.args], ...result }
+  } finally { await fsp.rm(archiveDir, { recursive: true, force: true }) }
+}

package/runtime-registry.mjs

@@ -13,7 +13,7 @@ const RUNTIMES = Object.freeze({
   }),
   hermes: Object.freeze({
     id: 'hermes', command: 'thinkpool', label: 'Hermes Agent', protocol: 'acp',
-    structured: true, flow: false, canSteer: true, images: true, nativeModelCatalog: true, catalogRequiresSession: true, effortControl: false, defaultMode: 'default',
+    structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, catalogRequiresSession: true, effortControl: false, defaultMode: 'default',
     modes: Object.freeze(['default', 'acceptEdits']),
     beta: true,
   }),

package/sdk-admission.mjs

@@ -0,0 +1,9 @@
+// SDK checks protect agent-serving room processes only. Account/service commands
+// remain available so an operator can inspect or repair a bad SDK installation.
+export function requiresSdkAdmission(argv) {
+  return Boolean(argv?.[0]) && argv[0] !== 'verify-sdk'
+}
+
+export function sdkSmokePassed(output) {
+  return /^SMOKE:PASS:[^:\n]+(?:\n|$)/.test(String(output || ''))
+}

package/session-store.mjs

@@ -11,6 +11,7 @@
 import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
+import { SPAWN } from './cross-terminal.mjs'
 
 // TP_PAIR_ROOT override exists for tests + sandboxes so they never touch the real
 // ~/.thinkpool-pair store. Read LIVE per call (not captured at module load) so a test
@@ -35,9 +36,51 @@ const archiveDir = (room) => path.join(dir(room), '.archive')
 // Only resume the live SDK context for recent sessions — an expired session id
 // fails ("No conversation found"); past this window we restore transcript only.
 const RESUME_MAX_AGE_MS = 12 * 60 * 60 * 1000
-const KEEP = 8   // newest N UNNAMED session files per room (named are immune — see prune)
+// A live snapshot exists precisely so a live structured lane can survive a bridge
+// restart. Keep every lane the bridge can admit. Explicitly closed lanes move to
+// .archive/, so closed/history retention stays separate from this live set.
+export const LIVE_SESSION_MAX = SPAWN.machineMax
 
-function ensureDir(room) { try { fs.mkdirSync(dir(room), { recursive: true }) } catch { /* noop */ } }
+function ensureDir(room) { fs.mkdirSync(dir(room), { recursive: true }) }
+
+// Commit a replacement through a sibling file so a restart never observes a torn
+// final record. The temp file is fsynced before the same-directory rename: readers
+// see the complete previous value or the complete replacement, never a half-write.
+// This is shared by session JSON plus the restart-critical names and PTY metadata.
+let tempSerial = 0
+let beforeAtomicRenameForTest = null
+function atomicCommit(file, contents) {
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.tmp.${process.pid}.${Date.now()}.${tempSerial++}`)
+  let fd = null
+  try {
+    fd = fs.openSync(tmp, 'wx', 0o600)
+    // fs.writeSync may legally write fewer bytes than requested. Never fsync and
+    // promote a partial temp file over the last good snapshot.
+    const bytes = Buffer.from(contents)
+    for (let offset = 0; offset < bytes.length;) {
+      const written = fs.writeSync(fd, bytes, offset, bytes.length - offset)
+      if (written <= 0) throw new Error(`short write while committing ${file}`)
+      offset += written
+    }
+    fs.fsyncSync(fd)
+    fs.closeSync(fd); fd = null
+    beforeAtomicRenameForTest?.({ file, tmp })
+    fs.renameSync(tmp, file)
+    return true
+  } catch (error) {
+    try { if (fd != null) fs.closeSync(fd) } catch { /* best effort */ }
+    try { fs.rmSync(tmp, { force: true }) } catch { /* best effort */ }
+    throw error
+  }
+}
+// Direct persistence tests inject a crash-equivalent immediately before rename.
+// Production never configures this hook.
+export function setAtomicCommitHookForTest(hook) {
+  beforeAtomicRenameForTest = typeof hook === 'function' ? hook : null
+}
+function persistenceError(action, file, error) {
+  console.error(`[thinkpool-pair session-store] ${action} failed for ${file}: ${error?.message || error}`)
+}
 // Move a session file into <room>/.archive/ instead of unlinking it. Archived files
 // are OUTSIDE the readdirSync(dir) path loadAll/listRecs read, so a bridge restart
 // never resurrects them — but they survive on disk for manual recovery. This is the
@@ -50,7 +93,11 @@ function archive(room, file) {
     const base = path.basename(file)
     const dst = path.join(archiveDir(room), `${base}.${Date.now()}`)
     fs.renameSync(file, dst)
-  } catch { /* noop */ }
+    return true
+  } catch (error) {
+    persistenceError('archive session snapshot', file, error)
+    return false
+  }
 }
 function listRecs(room) {
   try {
@@ -65,7 +112,12 @@ function listRecs(room) {
           // truncated log's first event ts drifts far from real creation. Load-time only.
           try { const s = fs.statSync(p); r._bt = s.birthtimeMs || s.mtimeMs || 0 } catch { r._bt = 0 }
           return r
-        } catch { return null }
+        } catch (error) {
+          // Keep the damaged file in place for recovery; never silently make a
+          // restart look like a deliberately closed lane.
+          persistenceError('parse session snapshot', p, error)
+          return null
+        }
       })
       .filter(Boolean)
   } catch { return [] }
@@ -80,8 +132,8 @@ function prune(room) {
     // Only UNNAMED sessions are eligible for prune. A named terminal is deliberate
     // user intent (a project) and must never be silently destroyed by churn.
     const prunable = files.filter((x) => { const id = namedId(x.p); return !id || !names[id] })
-    prunable.slice(KEEP).forEach((x) => archive(room, x.p))
-  } catch { /* noop */ }
+    prunable.slice(LIVE_SESSION_MAX).forEach((x) => archive(room, x.p))
+  } catch (error) { persistenceError('prune live session snapshots', dir(room), error) }
 }
 
 // ── Durable append-only event log (unbounded history; the <id>.json snapshot is
@@ -210,14 +262,23 @@ export function readDurablePage(room, id, beforeSeq, limit = 200) {
 
 const timers = new Map()
 function write(room, id, data) {
-  try { ensureDir(room); fs.writeFileSync(path.join(dir(room), `${id}.json`), JSON.stringify({ ...data, id, savedAt: Date.now() })); prune(room) } catch { /* noop */ }
+  const file = path.join(dir(room), `${id}.json`)
+  try {
+    ensureDir(room)
+    atomicCommit(file, JSON.stringify({ ...data, id, savedAt: Date.now() }))
+    prune(room)
+    return true
+  } catch (error) {
+    persistenceError('write session snapshot', file, error)
+    return false
+  }
 }
 // Debounced — events arrive in bursts; one write per ~1.5s is plenty.
 export function saveSession(room, id, data) {
   clearTimeout(timers.get(id))
   timers.set(id, setTimeout(() => write(room, id, data), 1500))
 }
-export function flushSession(room, id, data) { clearTimeout(timers.get(id)); write(room, id, data) }
+export function flushSession(room, id, data) { clearTimeout(timers.get(id)); return write(room, id, data) }
 // User-initiated close: cancel any pending debounced save and move the on-disk
 // record to .archive/ so a later loadAll() (bridge restart) can't resurrect a
 // closed terminal — but the transcript stays recoverable. PTY ids never have an
@@ -225,7 +286,8 @@ export function flushSession(room, id, data) { clearTimeout(timers.get(id)); wri
 export function deleteSession(room, id) {
   clearTimeout(timers.get(id)); timers.delete(id)
   const p = path.join(dir(room), `${id}.json`)
-  try { if (fs.existsSync(p)) archive(room, p) } catch { /* noop */ }
+  try { return !fs.existsSync(p) || archive(room, p) }
+  catch (error) { persistenceError('archive closed session snapshot', p, error); return false }
 }
 
 // Most-recently-saved structured session for the room (drives attached restore).
@@ -240,7 +302,7 @@ export function canResume(rec) {
 // EVERY saved session for the room, oldest→newest (so tabs reappear in order).
 // Drives resume-ALL on a bridge restart — without this only the latest session
 // came back and every backgrounded terminal died on restart despite its state
-// sitting on disk. Bounded by KEEP (prune keeps the newest 8).
+// sitting on disk. Bounded by LIVE_SESSION_MAX, exactly the admission capacity.
 export function loadAll(room) {
   return listRecs(room).sort((a, b) => (a.savedAt || 0) - (b.savedAt || 0))
 }
@@ -254,7 +316,9 @@ export function loadPtyId(room) {
   try { return fs.readFileSync(ptyFile(room), 'utf8').trim() || null } catch { return null }
 }
 export function savePtyId(room, id) {
-  try { ensureDir(room); fs.writeFileSync(ptyFile(room), String(id)) } catch { /* noop */ }
+  const file = ptyFile(room)
+  try { ensureDir(room); atomicCommit(file, String(id)); return true }
+  catch (error) { persistenceError('write PTY id', file, error); return false }
 }
 
 // Per-room terminal display names (terminal id -> label), set via the web's
@@ -265,8 +329,15 @@ export function savePtyId(room, id) {
 // (NOT *.json) so it never lands in listRecs/loadAll.
 const namesFile = (room) => path.join(dir(room), '.names')
 export function loadNames(room) {
-  try { return JSON.parse(fs.readFileSync(namesFile(room), 'utf8')) || {} } catch { return {} }
+  const file = namesFile(room)
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')) || {} }
+  catch (error) {
+    if (error?.code !== 'ENOENT') persistenceError('parse terminal names', file, error)
+    return {}
+  }
 }
 export function saveNames(room, names) {
-  try { ensureDir(room); fs.writeFileSync(namesFile(room), JSON.stringify(names || {})) } catch { /* noop */ }
+  const file = namesFile(room)
+  try { ensureDir(room); atomicCommit(file, JSON.stringify(names || {})); return true }
+  catch (error) { persistenceError('write terminal names', file, error); return false }
 }