thinkpool-pair 0.7.343 → 0.7.345

package/account.mjs

@@ -504,6 +504,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
   let applyingUpdate = false
+  const restartProbes = new Map() // nonce -> { pending rooms, ok, timer, resolve }
   const warned = new Set()
   const refused = new Map()   // room -> reason ('home'|'none'|'dir-gone'): owned but NOT served, announced in presence so the web shows a precise "attach this session" card instead of spinning
 
@@ -1064,6 +1065,18 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           void applyIfIdle()
         }
         else if (m.t === 'busy') { childIdle.set(room, false); childBetween.set(room, false) }
+        else if (m.t === 'restart-probe-result') {
+          const probe = restartProbes.get(m.nonce)
+          if (!probe || !probe.pending.has(room) || children.get(room) !== child) return
+          probe.pending.delete(room)
+          probe.ok = probe.ok && m.between === true
+          childBetween.set(room, m.between === true)
+          if (!probe.pending.size) {
+            clearTimeout(probe.timer)
+            restartProbes.delete(m.nonce)
+            probe.resolve(probe.ok)
+          }
+        }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
         // ── Thinkpool Ensemble cross-ROOM routing ──────────────────────────────
         // `room` here is the room that sent the message (this closure is per-child).
@@ -1312,9 +1325,44 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Restart the account bridge to apply a pending update ONLY when it's safe: every
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
+  function confirmChildrenBetweenTurns(timeoutMs = 2500) {
+    const targets = [...children.entries()]
+    if (!targets.length) return Promise.resolve(true)
+    const nonce = randomUUID()
+    return new Promise((resolve) => {
+      const probe = { pending: new Set(targets.map(([room]) => room)), ok: true, resolve, timer: null }
+      probe.timer = setTimeout(() => {
+        restartProbes.delete(nonce)
+        resolve(false)
+      }, timeoutMs)
+      probe.timer.unref?.()
+      restartProbes.set(nonce, probe)
+      for (const [room, child] of targets) {
+        try { child.send({ t: 'restart-probe', nonce }) }
+        catch {
+          probe.pending.delete(room)
+          probe.ok = false
+        }
+      }
+      if (!probe.pending.size) {
+        clearTimeout(probe.timer)
+        restartProbes.delete(nonce)
+        resolve(probe.ok)
+      }
+    })
+  }
+
   async function applyIfIdle() {
     if (applyingUpdate || !isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
     applyingUpdate = true
+    // The 5s heartbeat is a dashboard signal, not an atomic restart barrier. Re-read
+    // every child at the destructive edge so a turn that began after the last sample
+    // vetoes the update instead of becoming an interrupted recovery.
+    if (!await confirmChildrenBetweenTurns()) {
+      applyingUpdate = false
+      process.stderr.write('\n  ◆ bridge update still queued — an agent became active before the restart boundary.\n')
+      return
+    }
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
     try {
       const svc = await import('./service.mjs')

package/bridge.mjs

@@ -108,6 +108,7 @@ import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from
 // Spec: docs/specs/2026-06-30-flow-build-s4-clean-redispatch.md
 import { prepareRedispatch, redispatchKey } from './flow-redispatch.mjs'
 import { sanitizeSession } from './transcript-sanitize.mjs'
+import { boundStructuredLog, STRUCTURED_LOG_BYTE_CAP } from './event-bounds.mjs'
 import { executeFlowRevert } from './flow-host-revert.mjs'
 // ACCEPTED LIMITATION — this registry is in-memory only. A bridge restart in the window between
 // a flow-revert kill and the next dispatch wave loses the pending resume record, so the task
@@ -742,6 +743,33 @@ function readBranch() {
 const UPDIR = path.join(os.tmpdir(), 'thinkpool-pair', room)
 const FILE_MAX_BYTES = 25 * 1024 * 1024   // must match web FILE_MB + bucket file_size_limit (25 MB) — see src/pages/code/code-constants.js
 const safeName = (n) => String(n || 'file').replace(/[^a-zA-Z0-9._-]/g, '_').slice(-80)
+const roomAttachmentStorageUrl = (storagePath) => {
+  const value = String(storagePath || '')
+  const prefix = `code/${room}/`
+  if (!value.startsWith(prefix) || value.includes('..') || value.split('/').some((part) => !part)) return null
+  return `${SUPABASE_URL}/storage/v1/object/authenticated/session-attachments/${value.split('/').map(encodeURIComponent).join('/')}`
+}
+const fetchRoomAttachment = async (payload) => {
+  const authenticated = codeAuthToken && roomAttachmentStorageUrl(payload?.path)
+  const candidates = [
+    { url: payload?.url, headers: undefined },
+    ...(authenticated ? [{ url: authenticated, headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } }] : []),
+  ].filter((candidate) => candidate.url)
+  let lastError = new Error('no attachment source')
+  for (let attempt = 0; attempt < 3; attempt++) {
+    for (const candidate of candidates) {
+      try {
+        const response = await fetch(candidate.url, { headers: candidate.headers })
+        if (!response.ok) throw new Error(`HTTP ${response.status}`)
+        return Buffer.from(await response.arrayBuffer())
+      } catch (error) {
+        lastError = error
+      }
+    }
+    if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, 250 * (attempt + 1)))
+  }
+  throw lastError
+}
 
 const supabase = createClient(SUPABASE_URL, SUPABASE_ANON, {
   realtime: { params: { eventsPerSecond: 60 } },
@@ -2129,12 +2157,11 @@ function pushLog(entry, evt) {
   // filters out (system/thinking_tokens/effort) ride the log seq-less so they don't
   // hole the client's applied sequence. See event-id.mjs NO_SEQ_KINDS.
   if (entry.seq && seqable(evt)) evt.seq = entry.seq.next()
-  entry.log.push(evt)
   // Durable, UNBOUNDED archive (powers "load earlier history"): append the transcript
-  // event before the in-memory cap evicts it. Only seqable kinds — chrome/thinking noise
-  // is skipped. entry.id/entry.room are stamped in openStructured; a PTY entry (no id)
-  // is a no-op. This is the single place every new event passes through, so nothing is
-  // missed and reloaded events (which don't ride pushLog) never double-append.
+  // event in full before the bounded replay copy enters memory. Only seqable kinds —
+  // chrome/thinking noise is skipped. entry.id/entry.room are stamped in
+  // openStructured; a PTY entry (no id) is a no-op. This is the single place every new
+  // event passes through, so nothing is missed and reloaded events never double-append.
   if (entry.id && seqable(evt)) {
     appendDurableEvents(entry.room, entry.id, [evt])
     // First archived event sets the floor for a fresh lane (no seed ran). Lets the
@@ -2142,7 +2169,17 @@ function pushLog(entry, evt) {
     // above this floor — a new lane's first turn at seq>1 is NOT older-history.
     if (entry.archiveOldestSeq == null) entry.archiveOldestSeq = evt.seq
   }
-  if (entry.log.length > STRUCTURED_LOG_MAX) entry.log.shift()
+  // The rolling replay log is also the restart snapshot. Keep it browser-sized here,
+  // not only at broadcast time: otherwise one giant tool result is copied into every
+  // debounced snapshot and turns a bridge restart into tens of MB of synchronous JSON
+  // parsing/writing. The complete event remains in the append-only JSONL archive above.
+  const replayEvent = boundEventForBroadcast(evt)
+  entry.log.push(replayEvent)
+  entry.logBytes = (entry.logBytes || 0) + JSON.stringify(replayEvent).length + 1
+  while (entry.log.length > STRUCTURED_LOG_MAX || (entry.log.length > 1 && entry.logBytes > STRUCTURED_LOG_BYTE_CAP)) {
+    const removed = entry.log.shift()
+    entry.logBytes -= JSON.stringify(removed).length + 1
+  }
   return evt
 }
 
@@ -2230,7 +2267,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     ? spawnDepth
     : (sideParent || (spawnedBy && !String(spawnedBy).startsWith('flow:')) ? 1 : 0)
   const initialHop = Number.isInteger(hop) && hop >= 0 ? hop : structuralDepth
-  const entry = { cmd: runtime, runtime, kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: commandCatalogForRuntime(runtime, commands), mode, effort, models: runtime === 'codex' ? codexModels : runtime === 'hermes' ? (Array.isArray(models) && models.length ? models : hostHermesModels) : undefined,
+  const restoredRawLog = Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : []
+  const restoredLog = boundStructuredLog(restoredRawLog)
+  const restoredOffset = restoredRawLog.length - restoredLog.length
+  const entry = { cmd: runtime, runtime, kind: 'structured', log: restoredLog, pending: new Map(), session: null, recovered: false, commands: commandCatalogForRuntime(runtime, commands), mode, effort, models: runtime === 'codex' ? codexModels : runtime === 'hermes' ? (Array.isArray(models) && models.length ? models : hostHermesModels) : undefined,
     // model: truthful active-model label — now the SAME `laneModel` the SDK is given, so the
     // chip cannot disagree with the wire. When this lane runs on a custom (non-anthropic)
     // registered provider the SDK id is impersonated (see the onEvent guard below), so
@@ -2255,7 +2295,12 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     // Stable creation order — persisted so a bridge restart restores tabs in the SAME
     // order (not readdir/filesystem order). Legacy recs (no openedAt) derive it from the
     // first transcript event ts, so even the first post-fix restart is ordered right.
-    openedAt: openedAt || (Array.isArray(log) ? (log.find((e) => e?.ts)?.ts || 0) : 0) || Date.now() }
+    openedAt: openedAt || (Array.isArray(log) ? (log.find((e) => e?.ts)?.ts || 0) : 0) || Date.now(),
+    // A legacy bridge may have persisted raw multi-megabyte events. The restored
+    // in-memory copy is already bounded; rewrite that compact form only after the
+    // room has announced ready so migration cannot extend the loading screen.
+    snapshotNeedsCompaction: restoredOffset > 0 || restoredLog.some((event, index) => event !== restoredRawLog[index + restoredOffset]),
+    logBytes: restoredLog.reduce((bytes, event) => bytes + JSON.stringify(event).length + 1, 0) }
   entry._turnRev = entry.log.reduce((max, event) => Math.max(max, Number(event?.turnRev) || 0), 0)
   const restoredBoundary = [...entry.log].reverse().find((event) => event?.kind === 'result' && Number(event?.turnRev) > 0)
   entry._settledTurnRev = Number(restoredBoundary?.turnRev) || null
@@ -4356,9 +4401,7 @@ channel
       try {
         const fp = canonicalRoomFilePath(payload, { updir: UPDIR })
         if (!fp) throw new Error('invalid attachment metadata')
-        const r = await fetch(payload.url)
-        if (!r.ok) throw new Error(`HTTP ${r.status}`)
-        const buf = Buffer.from(await r.arrayBuffer())
+        const buf = await fetchRoomAttachment(payload)
         if (buf.length > FILE_MAX_BYTES) throw new Error('file too large')
         fs.mkdirSync(UPDIR, { recursive: true })
         fs.writeFileSync(fp, buf)
@@ -4533,7 +4576,7 @@ channel
       // two conversations. Drop the cached floor with it: the next pushLog re-seeds
       // archiveOldestSeq from the FIRST post-clear event (the new epoch's floor), instead
       // of leaving a stale pre-clear floor to mis-aim trimmedBeforeSeq's phantom-pill guard.
-      s.log = []; s.seq = makeSeqCounter(0); s.archiveOldestSeq = null
+      s.log = []; s.logBytes = 0; s.seq = makeSeqCounter(0); s.archiveOldestSeq = null
       bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
       flushSession(room, payload.term, { sessionId: s.session?.sessionId || null, log: [] })
       ctlLine('context cleared. You can continue with these answers in mind.')
@@ -4798,6 +4841,7 @@ channel
       realtimeHealthy = true; brokenSince = 0
       trackPresence({ name, role: 'bridge', bridge_id: BRIDGE_ID, started_at: BRIDGE_STARTED_AT })
       const startCmd = attachedCmd || autoAgent   // autoAgent: account-mode auto-open (headless)
+      const interruptedRecoveries = []
       if (startCmd && !terms.size && !sessions.size) {
         // Claude + structured mode → Agent SDK session; everything else → PTY.
         // On restart, restore EVERY saved structured session for this room (not
@@ -4851,9 +4895,8 @@ channel
             // Every interrupted role resumes exactly once. Flow lanes do not have a
             // startup redispatch path; excluding them here stranded conductors/builders.
             if (re && wasInterrupted) {
-              const recovery = recoverInterruptedTurn(re, { resumable, recap: recoveryRecap })
-              if (recovery === 'sent') process.stderr.write(`\n  ◆ auto-resumed interrupted Codex turn (${rec.id.slice(0, 8)}) — sent continue.\n`)
-              else if (recovery === 'recap-sent') process.stderr.write(`\n  ◆ resumed interrupted Codex turn (${rec.id.slice(0, 8)}) with a fresh context recap.\n`)
+              re.pendingInterruptedRecovery = { resumable, recap: recoveryRecap }
+              interruptedRecoveries.push(re)
             }
           }
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
@@ -4888,6 +4931,31 @@ channel
       if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
         try { process.send({ t: 'room-ready', room, bridgeId: BRIDGE_ID }) } catch { /* supervisor exited */ }
       }
+      // The room is usable before any runtime processes cold-boot. Stagger interrupted
+      // resumes so several Codex/Claude MCP handshakes cannot stampede the same host and
+      // starve the loopback MCP server. A person speaking during the delay cancels that
+      // lane's stale auto-continue via supersedeInterruptedResume().
+      interruptedRecoveries.forEach((entry, index) => {
+        const timer = setTimeout(() => {
+          const pending = entry.pendingInterruptedRecovery
+          entry.pendingInterruptedRecovery = null
+          if (!pending || sessions.get(entry.id) !== entry) return
+          const recovery = recoverInterruptedTurn(entry, pending)
+          if (recovery === 'sent') process.stderr.write(`\n  ◆ auto-resumed interrupted Codex turn (${entry.id.slice(0, 8)}) — sent continue.\n`)
+          else if (recovery === 'recap-sent') process.stderr.write(`\n  ◆ resumed interrupted Codex turn (${entry.id.slice(0, 8)}) with a fresh context recap.\n`)
+        }, 1000 + index * 5000)
+        timer.unref?.()
+      })
+      // Compact legacy oversized snapshots after readiness. Each entry already holds the
+      // bounded form, so this writes the small replacement without keeping the dashboard
+      // or room bootstrap behind fsyncs.
+      setImmediate(() => {
+        for (const entry of sessions.values()) {
+          if (!entry.snapshotNeedsCompaction) continue
+          entry.snapshotNeedsCompaction = false
+          try { entry.flush?.() } catch { /* keep the prior recoverable snapshot */ }
+        }
+      })
       process.stderr.write(headless
         ? `\n  ◆ thinkpool — relaying room ${room} (headless). Open terminals from the web UI.\n\n`
         : `\n  ◆ thinkpool — sharing "${attachedCmd}"${continuing ? ' (continuing your latest session)' : ''} into room ${room}.  Open the web UI and you're both in.\n\n`)
@@ -5411,6 +5479,9 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     if (!m) return
     if (m.t === 'update-available') surfaceUpdate(m.version)
     else if (m.t === 'agent-visibility-changed') void announce()
+    else if (m.t === 'restart-probe') {
+      try { process.send({ t: 'restart-probe-result', nonce: m.nonce, between: betweenTurns() }) } catch { /* parent is leaving */ }
+    }
     // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
     // it so our authed writes (code-mockup) never go stale on a long session (L16).
     else if (m.t === 'token') {

package/codex-mcp-http.mjs

@@ -26,19 +26,24 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
   // Keep exactly one active child session per lane. A new initialize atomically
   // retires the old server+transport before receiving its own isolated instance.
   let active = null
+  let handoffChain = Promise.resolve()
 
-  const retireActive = async () => {
+  const retireActive = () => {
     const current = active
     active = null
-    if (!current) return
-    await Promise.allSettled([
+    if (!current) return Promise.resolve()
+    // Detach first, then clean up in the background. In production an App
+    // Server MCP transport remained stuck in close while its watchdog fallback
+    // was already waiting to initialize `codex exec`; awaiting this cleanup
+    // consumed the replacement client's entire 30-second handshake budget.
+    return Promise.allSettled([
       current.instance.close(),
       current.transport.close(),
     ])
   }
 
   const beginSession = async () => {
-    await retireActive()
+    void retireActive()
     const next = createSessionServer()
     const instance = next?.instance
     if (!instance?.connect) throw new TypeError('Codex MCP session factory did not return an SDK MCP server instance')
@@ -48,6 +53,12 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
     return active
   }
 
+  const serializeHandoff = (task) => {
+    const run = handoffChain.then(task, task)
+    handoffChain = run.catch(() => {})
+    return run
+  }
+
   const server = http.createServer(async (req, res) => {
     if (req.url !== secretPath) {
       res.writeHead(404).end('not found')
@@ -61,7 +72,14 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
           res.writeHead(400).end('missing session')
           return
         }
-        target = await beginSession()
+        // Serialize replacement initialize requests through their response
+        // boundary. This removes the window where two simultaneous children
+        // both observe no active session and orphan each other's transport.
+        await serializeHandoff(async () => {
+          target = await beginSession()
+          await target.transport.handleRequest(req, res)
+        })
+        return
       } else if (!target?.transport?.sessionId || sessionId !== target.transport.sessionId) {
         res.writeHead(404).end('session not found')
         return
@@ -88,11 +106,24 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
   let closed = false
   return {
     url,
+    async handoff() {
+      if (closed) return
+      await serializeHandoff(async () => { void retireActive() })
+    },
     async close() {
       if (closed) return
       closed = true
+      const closing = retireActive()
+      // A retired SDK server may itself be wedged. Closing the loopback listener
+      // must not keep the bridge process alive indefinitely on shutdown.
       await Promise.allSettled([
-        retireActive(),
+        Promise.race([
+          closing,
+          new Promise((resolve) => {
+            const timer = setTimeout(resolve, 1000)
+            timer.unref?.()
+          }),
+        ]),
         new Promise((resolve) => server.close(resolve)),
       ])
     },

package/codex-session.mjs

@@ -303,6 +303,19 @@ export function buildCodexExecArgs({ sessionId, model, effort, sandbox, approval
   return args
 }
 
+// `codex exec` can fail before it has created or resumed a native turn when a
+// required MCP client loses the App Server -> exec handoff race. Retrying is
+// safe only when stderr proves session initialization failed AND the JSONL
+// stream contains no turn/item activity. A silent process or a generic exit is
+// delivery-uncertain and must never replay the person's prompt automatically.
+export function codexExecFailedBeforeTurn({ stderr = '', eventTypes = [] } = {}) {
+  const types = Array.isArray(eventTypes) ? eventTypes.map((type) => String(type || '')) : []
+  if (types.some((type) => type && type !== 'thread.started')) return false
+  const message = String(stderr || '')
+  return /timed out handshaking with MCP server/i.test(message)
+    || (/thread\/resume failed/i.test(message) && /failed to initialize session/i.test(message))
+}
+
 const CODEX_DESTRUCTIVE = /\brm\s+\S|\brmdir\s+\S|\bgit\s+(push\s+(-f|--force)|reset\s+--hard|clean\s+-[a-z]*f)|\bdrop\s+(table|database)\b|\b(mkfs|dd)\b|\bsudo\b|>\s*\/dev\/|\bchmod\s+-R|\bchown\s+-R|\bkillall\b|\btruncate\b/i
 
 export function codexApprovalCard(method, params = {}, item = null) {
@@ -423,6 +436,10 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   let stallRetried = false
   let stallRetryRequested = false
   let stallGiveupRequested = false
+  // True only while the current logical attempt is still in bridge-owned
+  // bootstrap. It flips before writing a turn/start request or spawning exec.
+  // Absence of provider output is not proof that a prompt was not delivered.
+  let stallReplaySafe = true
   let awaitingUser = 0
   let stallTimer = null
   let activeModel = model || null
@@ -489,6 +506,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     stalledSent = false
     stallRetryRequested = false
     stallGiveupRequested = false
+    stallReplaySafe = true
     if (!retry) stallRetried = false
   }
 
@@ -742,6 +760,17 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     })
     if (action === 'none') return
 
+    // Do not emit the generic "retrying the turn" copy when native delivery is
+    // already uncertain; that would promise the exact unsafe action we refuse.
+    if (action === 'retry' && !stallReplaySafe) {
+      stallGiveupRequested = true
+      stallRetryRequested = false
+      emitRaw({ kind: 'error', recoverable: true, message: 'Codex stopped responding after the turn began. The transport was stopped, but the prompt was not replayed automatically.' })
+      emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: undefined, denials: 0, resultText: null })
+      stopStalledTransport({ force: true })
+      return
+    }
+
     const event = stallEvent(action, quietMs)
     if (event) emitRaw(event)
     if (action === 'status') {
@@ -782,6 +811,9 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     mapper.setUsageBaseline(sessionId ? readCodexThreadUsage(sessionId) : null)
     turnActive = true
     try {
+      // startTurn writes the prompt-bearing RPC. From this edge onward delivery
+      // is at least uncertain, even if the response or first event never lands.
+      stallReplaySafe = false
       activeTurnId = await appServer.startTurn({
         threadId: sessionId,
         input: prompt,
@@ -850,6 +882,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     mapper.setUsageBaseline(sessionId ? readCodexThreadUsage(sessionId) : null)
     turnActive = true
     try {
+      stallReplaySafe = false
       const started = await appServer.startReview({ threadId: sessionId, target: codexReviewTarget(commandText) })
       activeTurnId = started?.turn?.id || started?.turnId
       if (!activeTurnId) throw new Error('Codex review/start returned no turn id')
@@ -903,6 +936,11 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     let peer
     try { peer = await ensureMcpHttp() }
     catch (e) { note(`Thinkpool peer tools unavailable: ${e?.message || e}`) }
+    // Detach any App Server-owned MCP session before exec initializes its own.
+    // Cleanup of the old transport is deliberately asynchronous so a wedged
+    // close cannot consume Codex's 30-second required-MCP handshake window.
+    try { await peer?.handoff?.() }
+    catch (e) { note(`Thinkpool peer handoff failed: ${e?.message || e}`) }
     const args = buildCodexExecArgs({
       sessionId: turnNo === 0 ? null : sessionId,
       model: activeModel,
@@ -928,15 +966,18 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       if (stdinFd != null) opts.stdio = [stdinFd, 'pipe', 'pipe']
 
       turnActive = true
+      stallReplaySafe = false
       child = spawnImpl('codex', args, opts)
       if (stdinFd != null) { try { fs.closeSync(stdinFd) } catch { /* child owns its duplicated fd */ } }
 
+      const nativeEventTypes = []
       const rl = readline.createInterface({ input: child.stdout, crlfDelay: Infinity })
       rl.on('line', (line) => {
         if (!line.trim()) return
         let ev
         try { ev = JSON.parse(line) } catch { return /* non-JSON progress line */
         }
+        nativeEventTypes.push(ev.type)
         if (ev.type === 'thread.started' && ev.thread_id) sessionId = sessionId || ev.thread_id
         if (ev.type === 'turn.completed' || ev.type === 'turn.failed') {
           sawTerminalResult = true
@@ -955,22 +996,30 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         settled = true
         child = null
         turnActive = false
-        if ((stallRetryRequested || stallGiveupRequested) && !sawTerminalResult && !aborted) {
+        const failureMessage = `codex exec exited ${code}${stderrTail ? ': ' + stderrTail.trim().slice(-300) : ''}`
+        const preTurnInitFailure = code !== 0 && code != null && !sawTerminalResult && codexExecFailedBeforeTurn({
+          stderr: stderrTail,
+          eventTypes: nativeEventTypes,
+        })
+        if (preTurnInitFailure && !aborted && !stallGiveupRequested) {
+          resolve({ preTurnInitFailure: true, message: failureMessage })
+          return
+        } else if ((stallRetryRequested || stallGiveupRequested) && !sawTerminalResult && !aborted) {
           // Watchdog interruption: pump either replays once or has already
           // published the terminal giveup boundary.
         } else if (aborted && !sawTerminalResult) {
           emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: undefined, denials: 0, resultText: null })
         } else if (!aborted && !sawTerminalResult && code !== 0 && code != null) {
-          emitTurnBoundary({ kind: 'error', message: `codex exec exited ${code}${stderrTail ? ': ' + stderrTail.trim().slice(-300) : ''}`, recoverable: true })
+          emitTurnBoundary({ kind: 'error', message: failureMessage, recoverable: true })
         }
-        resolve()
+        resolve({ preTurnInitFailure: false })
       }
       child.on('error', (e) => {
         if (settled) return
         settled = true
         child = null
         if (!stallRetryRequested && !stallGiveupRequested) emitTurnBoundary({ kind: 'error', message: `codex failed to start: ${e.message}`, recoverable: true })
-        resolve()
+        resolve({ preTurnInitFailure: false })
       })
       child.on('close', finish)
     })
@@ -999,6 +1048,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       })
       const review = /^\s*\/review(?:\s|$)/i.test(String(next.text || ''))
       let retryAttempt = false
+      let execInitRetryUsed = false
       while (!ended && !aborted && !stallGiveupRequested) {
         const usedAppServer = review
           ? await runAppServerReview(next.text)
@@ -1017,7 +1067,16 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
               armTurnLiveness({ retry: true })
               emitRaw({ kind: 'note', text: 'retrying the stalled turn on a fresh connection' })
             }
-            await runExec(prompt, next.options)
+            const outcome = await runExec(prompt, next.options)
+            if (outcome?.preTurnInitFailure) {
+              if (!execInitRetryUsed && !ended && !aborted && !stallGiveupRequested) {
+                execInitRetryUsed = true
+                armTurnLiveness({ retry: true })
+                emitRaw({ kind: 'note', text: 'Codex initialization failed before the turn started; retrying once with a fresh ThinkPool connection.' })
+                continue
+              }
+              emitTurnBoundary({ kind: 'error', message: outcome.message, recoverable: true })
+            }
           }
         }
         if (stallRetryRequested && !retryAttempt && !stallGiveupRequested && !ended && !aborted) {

package/event-bounds.mjs

@@ -4,6 +4,9 @@
    replay frame or tx: seed row into a multi-megabyte hydration dependency. */
 
 export const STRUCTURED_EVENT_CAP = 80000
+// 14 × the 150KB replay-frame budget: the largest complete rolling window the
+// transport can deliver without trimming. Older events remain in the JSONL archive.
+export const STRUCTURED_LOG_BYTE_CAP = 2100000
 
 const sizeOf = (value) => {
   try { return JSON.stringify(value).length } catch { return Infinity }
@@ -94,3 +97,21 @@ export function boundStructuredEvent(event, cap = STRUCTURED_EVENT_CAP) {
   identity._notice = 'Large tool payload truncated for fast transcript hydration'
   return identity
 }
+
+export function boundStructuredLog(events, {
+  eventCap = STRUCTURED_EVENT_CAP,
+  byteCap = STRUCTURED_LOG_BYTE_CAP,
+  countCap = 2000,
+} = {}) {
+  if (!Array.isArray(events) || !events.length) return []
+  const bounded = events.slice(-countCap).map((event) => boundStructuredEvent(event, eventCap))
+  let bytes = 0
+  let start = bounded.length
+  while (start > 0) {
+    const size = sizeOf(bounded[start - 1]) + 1
+    if (start < bounded.length && bytes + size > byteCap) break
+    bytes += size
+    start--
+  }
+  return start === 0 ? bounded : bounded.slice(start)
+}

package/interrupted-resume.mjs

@@ -86,7 +86,10 @@ export function recoverMissingResumeOnce(entry, { message, recap = '', reopen }
 // cold Claude/Codex runtime can trigger its init event and enqueue a stale second
 // `continue` behind the person's actual request.
 export function supersedeInterruptedResume(entry) {
-  if (!entry?.pendingAutoResume) return false
+  if (!entry) return false
+  const queued = !!entry.pendingInterruptedRecovery
+  entry.pendingInterruptedRecovery = null
+  if (!entry.pendingAutoResume) return queued
   entry.pendingAutoResume = false
   return true
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.343",
+  "version": "0.7.345",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {

package/session-store.mjs

@@ -12,6 +12,7 @@ import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
 import { SPAWN } from './cross-terminal.mjs'
+import { boundStructuredLog } from './event-bounds.mjs'
 
 // TP_PAIR_ROOT override exists for tests + sandboxes so they never touch the real
 // ~/.thinkpool-pair store. Read LIVE per call (not captured at module load) so a test
@@ -265,7 +266,8 @@ function write(room, id, data) {
   const file = path.join(dir(room), `${id}.json`)
   try {
     ensureDir(room)
-    atomicCommit(file, JSON.stringify({ ...data, id, savedAt: Date.now() }))
+    const log = Array.isArray(data?.log) ? boundStructuredLog(data.log) : data?.log
+    atomicCommit(file, JSON.stringify({ ...data, ...(log ? { log } : {}), id, savedAt: Date.now() }))
     prune(room)
     return true
   } catch (error) {