make the agent sidecar the writer of record for chat output

officer's registration socket silently drops sends when it isn't OPEN
(sidecar/connect.ts:send — no queue, no error, no return value). the agent pushed
raw parser events over that socket and officer translated and persisted them, so
everything a turn produced while officer was restarting went nowhere: the turn kept
running, the output was gone, and a reconnecting client replayed a log that simply
had no rows for those seconds. stage 1 kept the agent alive across a restart; this
is what makes its output survive one too.

move the translation and the write into the sidecar:

- turn-stream.ts is the stateful ChatEvent -> browser-message translator lifted out
  of websocket.ts (delta buffering, flush before tool:start and result). pure and
  synchronous, so it is unit tested — 12 tests, 100% lines.
- session-log.ts commits each message to chat_session_events and only then hands it
  to officer, with its cursor id attached. per-session promise chain: translation is
  synchronous and therefore in arrival order, and only the commit is queued, so
  cursor ids are assigned in the order events actually happened. a delta that
  overtook the assistant:text in front of it would make the client commit its stream
  buffer at the wrong point, so deltas go through the same queue even though they are
  never written.
- claude:event on the wire becomes claude:message: a finished browser-facing message
  plus its seq. officer relays it verbatim and folds it into the in-memory session
  for sync:messages. it no longer builds or persists chat messages for this harness.

gap detection, which is what the durable log is for. chat_session_events.id is a
global bigserial, so two consecutive events of one session are not consecutive ids
and a client cannot tell a contiguous replay from one with a hole in it. each durable
message now carries prevSeq — the cursor of the previous message in the same session —
which is inside the persisted payload, so it survives replay. useChat compares it
against the cursor it holds before advancing, and surfaces a visible marker on a
mismatch: a conversation that silently skips a tool call or half an answer reads as
the assistant having done something inexplicable. only checked once a cursor exists,
because opening a session from history legitimately starts mid-chain (events are swept
after 7 days, the transcript is not).

a failed write delivers live with no seq, so the client sees the message but does not
advance past something it cannot replay, and the next successful write chains from the
cursor the client still holds.

pipeline steps pass durable: false. their sessionKey is a throwaway uuid no browser
will ever replay and the job's own event log is its record, so writing those rows only
grows the table.

opencode still goes through officer's createEventHandler, now labelled as such. that
is the sidecars-opencode branch.

this fixes R4 from CLAUDE_SIDECAR_ISOLATION.md. R3 and R5 already worked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/chat/websocket.ts

@@ -1,6 +1,6 @@
 import type { ServerWebSocket } from 'bun';
 import { randomUUID } from 'crypto';
-import type { ClientMessage, ServerMessage, Message, ChatEvent } from './types';
+import type { ClientMessage, ServerMessage, Message, ChatEvent, TurnMessage, UserSession } from './types';
 import { sessionManager } from './session-manager';
 import { sendClaudeCodeStreaming } from '@@/channels/send-claude-code';
 import { sendOpenCodeStreaming } from '@@/channels/send-opencode';
@@ -165,6 +165,82 @@ export function close(ws: ServerWebSocket<WSData>): void {
   }
 }
 
+// ── Claude Code: relay, don't rebuild ──
+
+// The agent sidecar owns Claude's turn output end to end — it translates the parser stream, commits each
+// message to chat_session_events and hands us a finished message plus its cursor id. Officer relays it.
+// That is what makes a restart survivable: the durable record no longer travels over the socket between
+// the two processes, so if this one is down the output is already written and the client replays it.
+//
+// Officer keeps only the in-memory transcript, which exists to answer a `resume` with sync:messages —
+// Claude's own transcript is the real record — so it is folded from the same messages, not rebuilt.
+function foldIntoSession(session: UserSession, msg: TurnMessage, model: string): void {
+  switch (msg.type) {
+    case 'assistant:delta':
+      session.streamBuffer += msg.text;
+      break;
+
+    case 'assistant:text':
+      session.messages.push({ id: randomUUID(), timestamp: Date.now(), role: 'assistant', text: msg.text, model });
+      session.meta.messageCount += 1;
+      session.streamBuffer = '';
+      break;
+
+    case 'tool:start':
+      session.messages.push({
+        id: randomUUID(),
+        timestamp: Date.now(),
+        role: 'tool',
+        toolCallId: msg.toolCallId,
+        toolName: msg.toolName,
+        toolInput: msg.toolInput,
+      });
+      session.meta.messageCount += 1;
+      break;
+
+    case 'tool:result':
+      for (let i = session.messages.length - 1; i >= 0; i--) {
+        const m = session.messages[i]!;
+        if (m.role === 'tool' && m.toolCallId === msg.toolCallId) {
+          m.output = msg.output;
+          m.isError = msg.isError;
+          break;
+        }
+      }
+      break;
+
+    case 'result': {
+      session.isGenerating = false;
+      session.meta.cost.inputTokens += msg.cost.inputTokens;
+      session.meta.cost.outputTokens += msg.cost.outputTokens;
+      session.meta.cost.totalUSD += msg.cost.totalUSD;
+      session.meta.updatedAt = Date.now();
+      // The turn's cost belongs to the assistant message it paid for (as it did when officer built these).
+      const last = session.messages[session.messages.length - 1];
+      if (last?.role === 'assistant' && !last.cost) last.cost = msg.cost;
+      break;
+    }
+
+    case 'error':
+    case 'stopped':
+      session.isGenerating = false;
+      break;
+  }
+}
+
+function createClaudeMessageHandler(sessionId: string, model: string) {
+  return (msg: TurnMessage, seq?: number): void => {
+    const session = sessionManager.getSession(sessionId);
+    if (!session) return;
+    foldIntoSession(session, msg, model);
+    sendToClient(session.ws as ServerWebSocket<WSData> | null, msg, seq);
+  };
+}
+
+// ── OpenCode: officer still translates and persists ──
+
+// Unchanged from before the split, and still correct for OpenCode: that sidecar reports raw ChatEvents,
+// so officer does the translation and owns the durable write. Moving it is the `sidecars-opencode` branch.
 function createEventHandler(sessionId: string, model: string, cwd: string) {
   return async (event: ChatEvent): Promise<void> => {
     const session = sessionManager.getSession(sessionId);
@@ -298,13 +374,23 @@ function createEventHandler(sessionId: string, model: string, cwd: string) {
 
       case 'task:started': {
         // Background task launched (run_in_background / Monitor). Independent of turn state.
-        await emitToSession(sessionId, { type: 'task:started', taskId: event.taskId, description: event.description, taskType: event.taskType });
+        await emitToSession(sessionId, {
+          type: 'task:started',
+          taskId: event.taskId,
+          description: event.description,
+          taskType: event.taskType,
+        });
         break;
       }
 
       case 'task:notification': {
         // Background task finished — arrives AFTER the turn's 'result'; the whole point of the fix.
-        await emitToSession(sessionId, { type: 'task:notification', taskId: event.taskId, status: event.status, summary: event.summary });
+        await emitToSession(sessionId, {
+          type: 'task:notification',
+          taskId: event.taskId,
+          status: event.status,
+          summary: event.summary,
+        });
         break;
       }
     }
@@ -401,7 +487,7 @@ async function handleClaudeCodeChat(
 
   session.isGenerating = true;
 
-  const onEvent = createEventHandler(sessionId, model, cwd);
+  const onMessage = createClaudeMessageHandler(sessionId, model);
 
   try {
     if (!session._claudeKill) {
@@ -416,7 +502,7 @@ async function handleClaudeCodeChat(
         cwd,
         model,
         resumeSessionId: msg.resumeSessionId,
-        onEvent,
+        onMessage,
       });
       session.piProcess = sessionId as any;
       session._claudeKill = handle.kill;