thinkpool-pair 0.7.284 → 0.7.286

package/account.mjs

@@ -22,6 +22,7 @@ import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 import { installedAgentCommands } from './agent-detect.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
+import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -431,8 +432,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // relays peek/post requests between a local room child and the partner's supervisor.
   // Spec: docs/specs/2026-06-30-cross-room-pair-bus.md
   const roomPartner = new Map()   // room -> the OTHER participant's uid (the pair partner), for 2-person rooms
-  const pairChannels = new Map()  // partnerUid -> { channel, key } (one bus per distinct partner)
-  const busWaiters = new Map()    // nonce -> { mode:'first'|'collect', resolve, timer, acc? } for OUR outbound bus requests
+  const pairChannels = new Map()  // partnerUid -> { channel, key, status } (one bus per distinct partner)
   const postBucket = new Map()    // partnerUid -> { count, resetAt } inbound cross-room-post rate limit (runaway-cost backstop)
   const POST_BUCKET = { max: 6, windowMs: 60_000 }   // ≤6 inbound cross-room posts / partner / minute
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
@@ -706,34 +706,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
 
   // ── pair-bus plumbing (function declarations hoist, so order here is free) ──
-  // Resolve one of OUR outbound bus requests. 'first' resolves on the first reply
-  // (peek/post — a single partner answers); 'collect' accumulates every reply within
-  // the window (list — several partners may each answer) and resolves when it closes.
-  const resolveBus = (payload) => {
-    if (!payload?.nonce) return
-    const w = busWaiters.get(payload.nonce)
-    if (!w) return
-    if (w.mode === 'collect') { w.acc.push(payload); return }
-    clearTimeout(w.timer); busWaiters.delete(payload.nonce); w.resolve(payload)
-  }
-  const busSendAll = (event, payload) => {
-    let sent = 0
-    for (const { channel } of pairChannels.values()) { try { channel.send({ type: 'broadcast', event, payload }); sent++ } catch { /* channel down */ } }
-    return sent
+  const pairBus = createPairBusBroker({ channels: pairChannels, randomId: randomUUID })
+  const resolveBus = (payload) => pairBus.resolve(payload)
+  const busRequestFirst = (event, payload, timeoutMs) => pairBus.requestFirst(event, payload, timeoutMs)
+  const busRequestCollect = (event, payload, windowMs) => pairBus.requestCollect(event, payload, windowMs)
+  const authorizedPairRooms = async (sourceRoom) => {
+    try {
+      const listed = await withTimeout(sb.rpc('list_pair_rooms', { p_code: sourceRoom }), 2500, 'paired-room roster')
+      if (listed?.error || !Array.isArray(listed?.data)) return { verified: false, rooms: [] }
+      return { verified: true, rooms: listed.data }
+    } catch { return { verified: false, rooms: [] } }
   }
-  const busRequestFirst = (event, payload, timeoutMs) => new Promise((resolve) => {
-    const nonce = randomUUID()
-    if (!busSendAll(event, { ...payload, nonce })) return resolve(null)
-    const timer = setTimeout(() => { busWaiters.delete(nonce); resolve(null) }, timeoutMs); timer.unref?.()
-    busWaiters.set(nonce, { mode: 'first', resolve, timer })
-  })
-  const busRequestCollect = (event, payload, windowMs) => new Promise((resolve) => {
-    const nonce = randomUUID()
-    if (!busSendAll(event, { ...payload, nonce })) return resolve([])
-    const acc = []
-    const timer = setTimeout(() => { busWaiters.delete(nonce); resolve(acc) }, windowMs); timer.unref?.()
-    busWaiters.set(nonce, { mode: 'collect', acc, resolve, timer })
-  })
   // Inbound cross-room-post rate limit, per partner (a partner's agent posting into
   // MY rooms spends MY tokens — the runaway-cost backstop, on top of the per-turn cap).
   const allowInboundPost = (partnerUid) => {
@@ -787,15 +770,19 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     if (!partnerUid || pairChannels.has(partnerUid)) return
     const topic = pairTopic(key); if (!topic) return
     const ch = sb.channel(topic, { config: { private: true, broadcast: { self: false } } })
+    const entry = { channel: ch, key, status: PAIR_BUS_STATUS.JOINING }
     ch.on('broadcast', { event: 'peer-list-req' }, ({ payload }) => onPeerListReq(partnerUid, ch, payload))
       .on('broadcast', { event: 'peer-list-res' }, ({ payload }) => resolveBus(payload))
       .on('broadcast', { event: 'peer-peek-req' }, ({ payload }) => onPeerPeekReq(partnerUid, ch, payload))
       .on('broadcast', { event: 'peer-peek-res' }, ({ payload }) => resolveBus(payload))
       .on('broadcast', { event: 'peer-post-req' }, ({ payload }) => onPeerPostReq(partnerUid, ch, payload))
       .on('broadcast', { event: 'peer-post-res' }, ({ payload }) => resolveBus(payload))
-      .subscribe()
-    pairChannels.set(partnerUid, { channel: ch, key })
-    process.stderr.write(`\n  ◆ pair bus open — cross-machine Ensemble reach with your partner.\n`)
+      .subscribe((status) => {
+        entry.status = pairBusStatusFromRealtime(status)
+        if (status === 'SUBSCRIBED') process.stderr.write(`\n  ◆ pair bus subscribed — cross-machine Ensemble reach with your partner.\n`)
+        else if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') process.stderr.write(`\n  ◇ pair bus ${status.toLowerCase().replace('_', ' ')} — partner sessions are offline until it reconnects.\n`)
+      })
+    pairChannels.set(partnerUid, entry)
   }
   // Forward a local child's cross-room request to the bus (Tier 2 peek / Tier 3 post)
   // when the target room is NOT served on this machine. Used inside the child handler.
@@ -923,11 +910,15 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           ;(async () => {
             if (process.env.TP_CROSSROOM_OFF === '1') { try { child.send({ t: 'pair-list-res', reqId: m.reqId, rooms: [], error: 'Cross-session reach is turned off on this bridge.' }) } catch { /* child gone */ } return }
             const local = [...children.keys()].filter((r) => r !== room).map((r) => ({ code: r, name: roomNames.get(r) || null }))
-            let remote = []
-            if (process.env.TP_PAIRBUS_OFF !== '1' && pairChannels.size) {
-              const replies = await busRequestCollect('peer-list-req', {}, 1200)
-              remote = replies.flatMap((p) => (Array.isArray(p?.rooms) ? p.rooms : []))
+            let authorized = []; let replies = []
+            if (process.env.TP_PAIRBUS_OFF !== '1') {
+              const result = await Promise.all([
+                authorizedPairRooms(room),
+                pairChannels.size ? busRequestCollect('peer-list-req', {}, 1200) : Promise.resolve([]),
+              ])
+              authorized = result[0].rooms; replies = result[1]
             }
+            const remote = mergePairRoomRoster({ authorized, replies, myUid: session.user.id, localCodes: children.keys() })
             try { child.send({ t: 'pair-list-res', reqId: m.reqId, rooms: [...local, ...remote] }) } catch { /* child gone */ }
           })()
         }
@@ -946,7 +937,14 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
               return
             }
             // REMOTE target — ask the pair bus(es).
-            if (process.env.TP_PAIRBUS_OFF === '1' || !pairChannels.size) return reply({ error: `Session ${target} is not running on this machine, and no pair bus is open to reach it.` })
+            if (process.env.TP_PAIRBUS_OFF === '1') return reply({ error: 'Cross-session reach is turned off on this bridge.' })
+            const [authorized, live] = await Promise.all([
+              authorizedPairRooms(room),
+              pairChannels.size ? busRequestCollect('peer-list-req', {}, 800) : Promise.resolve([]),
+            ])
+            if (authorized.verified && !authorized.rooms.some((r) => r?.code === target && r?.owner_id !== session.user.id)) return reply({ error: `Room ${target} is not shared with this pair.` })
+            if (!pairChannels.size) return reply({ error: authorized.verified ? `Room ${target} is paired with you, but its host bridge is offline.` : `Session ${target} is not running on this machine, and no pair bus is open to reach it.` })
+            if (!live.some((p) => p?.rooms?.some((r) => r?.code === target))) return reply({ error: `Room ${target} is paired with you, but its host bridge is offline.` })
             const res = await busPeek(target, m.terminal, m.lines)
             if (!res) return reply({ error: `Room ${target} did not respond — it may be offline, or not shared with you.` })
             reply({ text: res.text, error: res.error })
@@ -966,8 +964,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
               catch { pairPending.delete(reqId); reply({ error: `Could not reach session ${target}.` }) }
               return
             }
-            // REMOTE target — over the pair bus.
-            if (!pairChannels.size) return reply({ error: `Room ${target} is not on this machine, and no pair bus is open to reach it.` })
+            // REMOTE target — prove the partner's bridge is currently answering
+            // before starting a 180s human-approval wait. The DB-backed roster may
+            // legitimately list an offline paired room; reachability comes from the bus.
+            const [authorized, live] = await Promise.all([
+              authorizedPairRooms(room),
+              pairChannels.size ? busRequestCollect('peer-list-req', {}, 1200) : Promise.resolve([]),
+            ])
+            if (authorized.verified && !authorized.rooms.some((r) => r?.code === target && r?.owner_id !== session.user.id)) return reply({ error: `Room ${target} is not shared with this pair.` })
+            if (!pairChannels.size) return reply({ error: authorized.verified ? `Room ${target} is paired with you, but its host bridge is offline.` : `Room ${target} is not on this machine, and no pair bus is open to reach it.` })
+            if (!live.some((p) => p?.rooms?.some((r) => r?.code === target))) return reply({ error: `Room ${target} is paired with you, but its host bridge is offline — no recipient approval card can be raised yet.` })
             const res = await busPost(target, m.terminal, m.text, room, m.fromTerminalName)
             if (!res) return reply({ error: `Room ${target} did not respond to the hand-off in time.` })
             reply({ ok: res.ok, ref: res.ref, error: res.error })
@@ -1101,6 +1107,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     keepFresh.cancel()
     releaseSingleton()
     for (const c of children.values()) { try { c.kill(sig || 'SIGTERM') } catch { /* noop */ } }
+    pairBus.close()
     for (const { channel } of pairChannels.values()) { try { sb.removeChannel(channel) } catch { /* noop */ } }   // tear down pair buses (Tier 2/3)
     // Flush the presence LEAVE before exiting so the dashboard flips to
     // "not connected" in realtime (don't fire-and-forget the untrack).

package/bridge.mjs

@@ -113,7 +113,7 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
+import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { turnInFlight } from './update-gate.mjs'
@@ -929,6 +929,37 @@ const terms = new Map()
 // PTY `terms` map so none of the byte-relay code paths (flush, resize,
 // pty-in, scrollback) ever touch them. id → { session, cmd, log, pending }.
 const sessions = new Map()
+
+// One monotonically increasing authority per bridge process. Realtime preserves
+// messages best-effort, not total order across a reconnect; clients use this to
+// reject a late snapshot from an older channel while bridge_id distinguishes a
+// real process restart (where the counter intentionally begins again).
+let announceRev = 0
+
+function syncStructuredTurn(entry, now = Date.now()) {
+  const busy = entry?.session?.turnActive ?? false
+  const changed = busy !== entry?._busyAnn
+  if (!changed) return false
+  if (busy) {
+    entry._turnRev = (Number(entry._turnRev) || 0) + 1
+    entry._turnStart = now
+  }
+  entry._busyAnn = busy
+  return true
+}
+
+function beginStructuredTurn(entry, now = Date.now()) {
+  if (entry?._busyAnn === true) return false
+  entry._turnRev = (Number(entry._turnRev) || 0) + 1
+  entry._turnStart = now
+  entry._busyAnn = true
+  return true
+}
+
+function stampStructuredTurn(entry, event) {
+  if (event && event.turnRev == null && Number(entry?._turnRev) > 0) event.turnRev = entry._turnRev
+  return event
+}
 let attachedId = null
 let shuttingDown = false
 
@@ -1058,8 +1089,9 @@ const announce = () => {
   // (name-only, NEVER key/baseUrl) so a cross-device viewer can badge a lane opened
   // on a custom provider without the owner's account-channel registry.
   const provNames = providerNameMap()
+  const rev = ++announceRev
   return bcast('bridge', {
-    v: 2, name, bridge_id: BRIDGE_ID, repo: repoLabel, branch: readBranch(),
+    v: 2, name, bridge_id: BRIDGE_ID, rev, repo: repoLabel, branch: readBranch(),
     // sdkWarn: the auto-pulled agent SDK failed its boot compatibility smoke test —
     // surfaced so the room can show a banner (turns may misbehave; pin a good SDK).
     ...(sdkStatus.ok === false ? { sdkWarn: `${sdkStatus.version}: ${sdkStatus.reason}` } : {}),
@@ -1130,7 +1162,7 @@ const announce = () => {
       // laneStatusOf: authoritative busy/idle + last-action timestamp/age +
       // STUCK/BLOCKED alert. The bridge owns the turn and permission state, so
       // every roster consumer reads one status instead of reconstructing it.
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, ...laneStatusOf(s), ...(s.session?.turnActive && s._turnStart ? { turnStartedAt: s._turnStart } : {}), hasTranscript: s.log.length > 0, commands: s.commands, mode: s.mode || undefined, effort: s.effort || undefined, name: termNames[id] || undefined, model: s.model || undefined, capabilities: { ...structuredRuntimeMetadata(s.runtime || 'claude'), modes: structuredModesForLane(s.runtime || 'claude', s) }, ...(s.runtime === 'codex' ? { approvalPolicy: codexConfigForMode(s.mode).approvalPolicy, models: s.models || [], canSteer: s.session?.canSteer ?? false } : s.runtime === 'hermes' ? { models: s.models || [], canSteer: s.session?.canSteer ?? false } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.sideParent ? { sideParent: s.sideParent, sideTask: s.sideTask || undefined, sideHandback: !!s.sideHandback } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, ...laneStatusOf(s), turnRev: Number(s._turnRev) || 0, ...(s.session?.turnActive && s._turnStart ? { turnStartedAt: s._turnStart } : {}), hasTranscript: s.log.length > 0, commands: s.commands, mode: s.mode || undefined, effort: s.effort || undefined, name: termNames[id] || undefined, model: s.model || undefined, capabilities: { ...structuredRuntimeMetadata(s.runtime || 'claude'), modes: structuredModesForLane(s.runtime || 'claude', s) }, ...(s.runtime === 'codex' ? { approvalPolicy: codexConfigForMode(s.mode).approvalPolicy, models: s.models || [], canSteer: s.session?.canSteer ?? false } : s.runtime === 'hermes' ? { models: s.models || [], canSteer: s.session?.canSteer ?? false } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.sideParent ? { sideParent: s.sideParent, sideTask: s.sideTask || undefined, sideHandback: !!s.sideHandback } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
         // provider: the registered LLM-provider this lane runs on, NAME-ONLY {id,name}
         // (NEVER the key or baseUrl). Additive; older clients ignore it. Omitted for the
         // built-in/default Claude path (no badge). Makes the lane's provider badge +
@@ -1684,6 +1716,7 @@ function pushLog(entry, evt) {
   // every old user message stacks at the TOP of the timeline (room XE3IQ, 2026-06-25).
   // A real ts makes ordering wall-clock — immune to eviction AND /clear seq resets.
   // stampEvent is idempotent, so the callers that already stamp are unaffected.
+  stampStructuredTurn(entry, evt)
   stampEvent(evt)
   entry.lastActionAt = evt.ts
   entry.lastEvent = evt
@@ -1818,6 +1851,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     // order (not readdir/filesystem order). Legacy recs (no openedAt) derive it from the
     // first transcript event ts, so even the first post-fix restart is ordered right.
     openedAt: openedAt || (Array.isArray(log) ? (log.find((e) => e?.ts)?.ts || 0) : 0) || Date.now() }
+  entry._turnRev = entry.log.reduce((max, event) => Math.max(max, Number(event?.turnRev) || 0), 0)
   entry.interruptedRecap = restoredTurnOpen(entry.log) ? buildRecapFromLog(entry.log, RECAP_CAP) : null
   // Slice 3 — a permission card left unanswered past the grace window pushes
   // "<lane> — needs you: <what>"; answering it anywhere retracts the banner
@@ -2272,7 +2306,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           if (target === room) return okText('That is this room — use read_terminal for terminals in your own room.')
           entry.pairPeekCount = (entry.pairPeekCount || 0) + 1
           if (entry.pairPeekCount > CROSSROOM.peekPerTurnCap) return okText(`Cross-session read limit reached for this turn (${CROSSROOM.peekPerTurnCap}). Continue with what you have.`)
-          const res = await pairRequest('pair-peek-req', { targetRoom: target, terminal: args?.terminal, lines: args?.lines })
+          const res = await pairRequest('pair-peek-req', { targetRoom: target, terminal: args?.terminal, lines: args?.lines }, CROSSROOM_BUS.busTimeoutMs + 2_000)
           if (res?.error) return okText(res.error)
           return okText(res?.text || `Room ${target} returned nothing.`)
         },
@@ -2841,6 +2875,8 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // replay-union dedupes ONLY by cid, and SDK events carry none — without an
       // id, an event that arrives both live AND in a reconnect replay renders
       // twice (the 2026-06-19 duplicate-message bug). See event-id.mjs.
+      const busyChanged = syncStructuredTurn(entry)
+      stampStructuredTurn(entry, evt)
       stampEvent(evt)
       const stalledChanged = evt.kind === 'stalled' ? !entry.stalled : !!entry.stalled
       entry.stalled = evt.kind === 'stalled'
@@ -2856,10 +2892,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // The RISING edge is also where a turn's wall clock starts — the only place the
       // bridge sees "this lane just began working". `result`/`error` reads it to decide
       // whether the turn was long enough that nobody was watching (Slice 3).
-      { const busyNow = entry.session?.turnActive ?? false
-        const busyChanged = busyNow !== entry._busyAnn
-        if (busyChanged) { if (busyNow) entry._turnStart = Date.now(); entry._busyAnn = busyNow }
-        if (busyChanged || stalledChanged) announce() }
+      if (busyChanged || stalledChanged) announce()
       // App Server steering is opt-in and can fall back to exec at runtime. Keep
       // the roster capability authoritative so the browser never immediate-sends
       // into an exec-only turn and loses its shared queue.
@@ -3909,7 +3942,12 @@ channel
     const nativeImages = s.runtime === 'codex' || s.runtime === 'hermes'
       ? await waitForNativeImages(payload.files, { updir: UPDIR })
       : []
+    // Sample the runtime before dispatch so a missed prior falling edge cannot
+    // make this genuinely new turn inherit the previous turn's revision.
+    syncStructuredTurn(s)
     const accepted = s.session.sendTurn(sendText, nativeImages.length ? { images: nativeImages } : undefined)
+    if (accepted === false) syncStructuredTurn(s)
+    else beginStructuredTurn(s)
     echoYou()
     if (accepted === false) {
       // A runtime that did not accept a turn must still close the optimistic

package/codex-session.mjs

@@ -33,6 +33,7 @@ import { startCodexMcpHttp } from './codex-mcp-http.mjs'
 import { CODEX_THINKPOOL_FIRST_TURN_PREAMBLE, buildThinkPoolTurnGuidance, createRoomContextSelector, usesFullThinkPoolReminder } from './thinkpool-room-prompt.mjs'
 import { questionAnswerResponse } from './question-response.mjs'
 import { codexReviewTarget, isCodexCompactCommand } from './codex-commands.mjs'
+import { createCumulativeEventRelay } from './cumulative-event-relay.mjs'
 
 const DEFAULT_SANDBOX = 'workspace-write'
 const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write', 'danger-full-access'])
@@ -402,8 +403,9 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   let chain = Promise.resolve()
   const queue = []
 
+  const relayEvent = createCumulativeEventRelay((event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } })
   const mapper = new CodexEventMapper({
-    onEvent,
+    onEvent: relayEvent,
     model: model || null,
     usageSnapshotForSession: (id) => {
       const snapshot = readCodexThreadUsage(id)
@@ -425,10 +427,10 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   }
   const emitTurnBoundary = (event) => {
     turnActive = false
-    try { onEvent?.(event) } catch { /* noop */ }
+    relayEvent(event)
   }
 
-  const note = (text) => { try { onEvent?.({ kind: 'note', text }) } catch { /* noop */ } }
+  const note = (text) => relayEvent({ kind: 'note', text })
 
   const closeAppServerTurn = (turnId = activeTurnId) => {
     const id = String(turnId || '')
@@ -472,7 +474,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         activeForm: step || '',
         status: status === 'inProgress' ? 'in_progress' : status === 'completed' ? 'completed' : 'pending',
       })).filter((todo) => todo.content)
-      try { onEvent?.({ kind: 'assistant', blocks: [{ type: 'tool_use', id: `codex-plan:${params.turnId || 'active'}`, name: 'TodoWrite', input: { todos } }], parentToolUseId: null }) } catch { /* noop */ }
+      relayEvent({ kind: 'assistant', blocks: [{ type: 'tool_use', id: `codex-plan:${params.turnId || 'active'}`, name: 'TodoWrite', input: { todos } }], parentToolUseId: null })
       return
     }
     if (method === 'item/agentMessage/delta') {
@@ -484,7 +486,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       // Cumulative transient snapshot. The bridge broadcasts this chrome event
       // without assigning transcript seq/archive rows; room.jsx replaces the
       // stable cid in place. item/completed emits one durable assistant row.
-      try { onEvent?.({ kind: 'assistant_stream', cid: state.cid, text: state.text, itemId, streaming: true }) } catch { /* noop */ }
+      relayEvent({ kind: 'assistant_stream', cid: state.cid, text: state.text, itemId, streaming: true })
       return
     }
     if (method === 'item/started' || method === 'item/completed') {
@@ -496,7 +498,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         if (raw.type === 'agentMessage' && streamedAgentItems.has(raw.id)) {
           const state = streamedAgentItems.get(raw.id)
           streamedAgentItems.delete(raw.id)
-          try { onEvent?.({ kind: 'assistant', blocks: [{ type: 'text', text: raw.text || state.text }], parentToolUseId: null, replacesCid: state.cid }) } catch { /* noop */ }
+          relayEvent({ kind: 'assistant', blocks: [{ type: 'text', text: raw.text || state.text }], parentToolUseId: null, replacesCid: state.cid })
           return
         }
       }
@@ -639,7 +641,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       // than leaving a replay-less streaming shell behind.
       for (const state of streamedAgentItems.values()) {
         if (!state.text) continue
-        try { onEvent?.({ kind: 'assistant', blocks: [{ type: 'text', text: state.text }], parentToolUseId: null, replacesCid: state.cid }) } catch { /* noop */ }
+        relayEvent({ kind: 'assistant', blocks: [{ type: 'text', text: state.text }], parentToolUseId: null, replacesCid: state.cid })
       }
       activeTurnId = null
       turnActive = false
@@ -683,7 +685,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     } finally {
       for (const state of streamedAgentItems.values()) {
         if (!state.text) continue
-        try { onEvent?.({ kind: 'assistant', blocks: [{ type: 'text', text: state.text }], parentToolUseId: null, replacesCid: state.cid }) } catch { /* noop */ }
+        relayEvent({ kind: 'assistant', blocks: [{ type: 'text', text: state.text }], parentToolUseId: null, replacesCid: state.cid })
       }
       activeTurnId = null
       turnActive = false
@@ -817,7 +819,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       if (!turnActive && queue.length === 0 && !appServerThreadReady && !child) {
         const gate = typeof admitStart === 'function' ? admitStart() : { ok: true }
         if (gate?.ok === false) {
-          try { onEvent?.({ kind: 'error', message: gate.reason || 'Host memory is critically low. This Codex runtime was not started.', recoverable: true }) } catch { /* noop */ }
+          relayEvent({ kind: 'error', message: gate.reason || 'Host memory is critically low. This Codex runtime was not started.', recoverable: true })
           return false
         }
       }
@@ -848,7 +850,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
               queue.push({ text, options, promptIndex, forceFullReminder: thisTurnForceFull })
               if (!turnActive && queue.length === 1) pump()
             } else {
-              try { onEvent?.({ kind: 'error', message: 'Codex steering delivery is uncertain; the message was not replayed automatically.', recoverable: true }) } catch { /* noop */ }
+              relayEvent({ kind: 'error', message: 'Codex steering delivery is uncertain; the message was not replayed automatically.', recoverable: true })
             }
           })
         return true
@@ -884,6 +886,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     end() {
       ended = true
       turnActive = false
+      relayEvent.cancel()
       queue.length = 0
       closeAppServerTurn(activeTurnId)
       if (child) { try { child.kill() } catch { /* noop */ } }
@@ -912,7 +915,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     setEffort(nextEffort) {
       if (turnActive || !EFFORT_LEVELS.has(nextEffort)) return false
       activeEffort = nextEffort
-      try { onEvent?.({ kind: 'effort', level: activeEffort }) } catch { /* noop */ }
+      relayEvent({ kind: 'effort', level: activeEffort })
       return true
     },
     clearContext() {

package/cross-terminal.mjs

@@ -644,7 +644,7 @@ export const formatPairRoster = (rooms, { thisRoom, error } = {}) => {
   // `host` is set for a Tier-2 cross-MACHINE room (it lives on a partner's Mac,
   // reached over the pair bus); a same-machine Tier-1 room has none. Rendering the
   // host tells the agent (and the people) which rooms are "over there".
-  const rows = list.map((r) => `- ${r.code}${r.name ? ` · "${r.name}"` : ''}${r.host ? ` · on ${r.host}` : ''}`)
+  const rows = list.map((r) => `- ${r.code}${r.name ? ` · "${r.name}"` : ''}${r.host ? ` · on ${r.host}` : ''}${r.online === false ? ' · partner bridge offline' : ''}`)
   return `Your other ThinkPool Code sessions (call read_session with a room code to look inside one):\n${rows.join('\n')}`
 }
 

package/cumulative-event-relay.mjs

@@ -0,0 +1,48 @@
+// Cumulative provider snapshots are replace-in-place UI state, not transcript
+// facts. Deliver the first immediately and coalesce a burst to its latest frame;
+// any durable event flushes the pending snapshot first to preserve wire order.
+export function createCumulativeEventRelay(emit, waitMs = 150) {
+  let lastSentAt = 0
+  let pending = null
+  let timer = null
+
+  const send = (event) => {
+    lastSentAt = Date.now()
+    emit(event)
+  }
+  const flush = () => {
+    if (timer) clearTimeout(timer)
+    timer = null
+    if (!pending) return
+    const event = pending
+    pending = null
+    send(event)
+  }
+  const relay = (event) => {
+    if (event?.kind !== 'assistant_stream') {
+      flush()
+      emit(event)
+      return
+    }
+    const remaining = waitMs - (Date.now() - lastSentAt)
+    if (!lastSentAt || remaining <= 0) {
+      pending = null
+      if (timer) clearTimeout(timer)
+      timer = null
+      send(event)
+      return
+    }
+    pending = event
+    if (!timer) {
+      timer = setTimeout(flush, remaining)
+      timer.unref?.()
+    }
+  }
+  relay.flush = flush
+  relay.cancel = () => {
+    if (timer) clearTimeout(timer)
+    timer = null
+    pending = null
+  }
+  return relay
+}

package/hermes-session.mjs

@@ -11,6 +11,7 @@ import { startCodexMcpHttp } from './codex-mcp-http.mjs'
 import { autoAllow, classifyRisk } from './claude-session.mjs'
 import { crossPostNeedsCard } from './cross-terminal.mjs'
 import { buildThinkPoolTurnGuidance, createRoomContextSelector, usesFullThinkPoolReminder } from './thinkpool-room-prompt.mjs'
+import { createCumulativeEventRelay } from './cumulative-event-relay.mjs'
 
 export const HERMES_COMMAND = 'thinkpool'
 export const HERMES_ACP_PROTOCOL_VERSION = 1
@@ -112,7 +113,7 @@ export function startHermesSession({
       ? 'dont_ask'
       : 'default'
 
-  const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
+  const emit = createCumulativeEventRelay((event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } })
 
   const thinkpoolPeerTool = (name) => {
     const lower = String(name || '').toLowerCase()
@@ -598,6 +599,7 @@ export function startHermesSession({
     end() {
       ended = true
       turnActive = false
+      emit.cancel()
       queuedTurns.length = 0
       queueDrainPending = false
       if (sessionId && client?.alive) void client.request('session/close', { sessionId }, 1500).catch(() => {}).finally(() => client?.end())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.284",
+  "version": "0.7.286",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -27,6 +27,7 @@
     "codex-mcp-http.mjs",
     "lane-worktree.mjs",
     "codex-event-mapper.mjs",
+    "cumulative-event-relay.mjs",
     "codex-commands.mjs",
     "acp-client.mjs",
     "hermes-session.mjs",
@@ -54,6 +55,7 @@
     "session-store.mjs",
     "side-lane.mjs",
     "cross-terminal.mjs",
+    "pair-bus.mjs",
     "lane-lifecycle.mjs",
     "interrupted-resume.mjs",
     "dispatch-lease.mjs",

package/pair-bus.mjs

@@ -0,0 +1,98 @@
+// Deterministic request broker for the cross-machine pair bus.
+//
+// Supabase channel.send() is asynchronous and a channel is not usable until its
+// subscription callback reports SUBSCRIBED. Keeping those facts in one tested
+// primitive prevents a joining/dead channel from impersonating a reachable peer
+// and prevents a fast reply from arriving before its waiter exists.
+
+export const PAIR_BUS_STATUS = Object.freeze({
+  JOINING: 'joining',
+  SUBSCRIBED: 'subscribed',
+  ERROR: 'error',
+  CLOSED: 'closed',
+})
+
+export const pairBusStatusFromRealtime = (status) => {
+  if (status === 'SUBSCRIBED') return PAIR_BUS_STATUS.SUBSCRIBED
+  if (status === 'CLOSED') return PAIR_BUS_STATUS.CLOSED
+  if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') return PAIR_BUS_STATUS.ERROR
+  return PAIR_BUS_STATUS.JOINING
+}
+
+export const subscribedPairChannels = (channels) =>
+  [...(channels?.values?.() || [])].filter((entry) =>
+    entry?.status === PAIR_BUS_STATUS.SUBSCRIBED && entry?.channel?.send)
+
+export async function sendPairBroadcast (channels, event, payload) {
+  const results = await Promise.all(subscribedPairChannels(channels).map(async ({ channel }) => {
+    try { return (await channel.send({ type: 'broadcast', event, payload })) === 'ok' }
+    catch { return false }
+  }))
+  return results.filter(Boolean).length
+}
+
+export function createPairBusBroker ({ channels, randomId, setTimer = setTimeout, clearTimer = clearTimeout } = {}) {
+  if (!channels?.values || typeof randomId !== 'function') throw new TypeError('channels and randomId are required')
+  const waiters = new Map()
+
+  const resolve = (payload) => {
+    if (!payload?.nonce) return false
+    const waiter = waiters.get(payload.nonce)
+    if (!waiter) return false
+    if (waiter.mode === 'collect') { waiter.acc.push(payload); return true }
+    clearTimer(waiter.timer); waiters.delete(payload.nonce); waiter.finish(payload)
+    return true
+  }
+
+  const requestFirst = (event, payload = {}, timeoutMs) => new Promise((finish) => {
+    const nonce = randomId()
+    const timer = setTimer(() => { waiters.delete(nonce); finish(null) }, timeoutMs)
+    timer?.unref?.()
+    waiters.set(nonce, { mode: 'first', finish, timer })
+    void sendPairBroadcast(channels, event, { ...payload, nonce }).then((sent) => {
+      if (sent || !waiters.has(nonce)) return
+      clearTimer(timer); waiters.delete(nonce); finish(null)
+    })
+  })
+
+  const requestCollect = (event, payload = {}, windowMs) => new Promise((finish) => {
+    const nonce = randomId()
+    const acc = []
+    const timer = setTimer(() => { waiters.delete(nonce); finish(acc) }, windowMs)
+    timer?.unref?.()
+    waiters.set(nonce, { mode: 'collect', acc, finish, timer })
+    void sendPairBroadcast(channels, event, { ...payload, nonce }).then((sent) => {
+      if (sent || !waiters.has(nonce)) return
+      clearTimer(timer); waiters.delete(nonce); finish(acc)
+    })
+  })
+
+  const close = () => {
+    for (const [nonce, waiter] of waiters) {
+      clearTimer(waiter.timer)
+      waiter.finish(waiter.mode === 'collect' ? waiter.acc : null)
+      waiters.delete(nonce)
+    }
+  }
+
+  return Object.freeze({ resolve, requestFirst, requestCollect, close, pendingCount: () => waiters.size })
+}
+
+// The database is the authorization/discovery source; bus replies are the live
+// reachability source. Paired rooms remain visible while their host bridge is
+// offline and become online only when that host actually answers on the bus.
+export function mergePairRoomRoster ({ authorized = [], replies = [], myUid, localCodes = [] } = {}) {
+  const local = new Set(localCodes)
+  const rooms = new Map()
+  for (const row of authorized) {
+    if (!row?.code || row.owner_id === myUid || local.has(row.code)) continue
+    rooms.set(row.code, { code: row.code, name: row.name || null, online: false })
+  }
+  for (const reply of replies) {
+    for (const row of Array.isArray(reply?.rooms) ? reply.rooms : []) {
+      if (!row?.code || local.has(row.code)) continue
+      rooms.set(row.code, { code: row.code, name: row.name || rooms.get(row.code)?.name || null, host: row.host || null, online: true })
+    }
+  }
+  return [...rooms.values()]
+}