fix: stabilize session switching and pin the repaired pb-mapper SDK

[acking-you]

Summary

Opening a session resumed it with its complete history before fetching paginated history again. Real histories produced 25–37 MB single-frame responses, exceeding the client's old 16 MiB frame limit and surfacing only app-server connection closed. Resume now requests the existing excludeTurns option; one reproduced response shrank to about 2.2 KiB.

• Use metadata-only resume in the bridge and host service, and serialize connection replacement per service (crates/pocket-codex-bridge/src/engine/app_session.rs:226, :1255; crates/pocket-codex-host-svc/src/resume.rs:103).

• Align the WebSocket frame limit with the existing 64 MiB message limit, preserve close reasons, and keep successfully sent RPC response timeouts from closing the shared connection. Transport/write failures still close it (crates/pocket-codex-codex/src/client.rs:112, :389).

• Discard superseded UI loads, including A→B→A races, before they issue more work or overwrite the current session (apps/flutter/lib/src/screens/app_session_screen.dart:1386).

• Serialize relay credential operations per account. After renewal failure, confirm that the old credential is absent before minting a replacement; transient errors must not split an account across namespaces (crates/pocket-codex-backend/src/credentials.rs:85, :129).

• Use https://github.com/acking-you/pb-mapper, branch pocket-codex, for the SDK. Cargo.lock pins all five SDK packages to merged fix f0ed4271de962b8759d11171bcf901aa6df458cc, including TCP_NODELAY and bounded connection setup; builds no longer wait for a registry release.

Investigation evidence, regression coverage, reproduction instructions, and validation limits are recorded in docs/session-switching-stability.md:1.

Type of change

• fix — bug fix
• deps — consume the fixed SDK from its dedicated Git branch

Userspace impact

• No CLI, on-disk layout, wire-schema, or FRB API changes.

excludeTurns is already supported by the pinned Codex protocol. No migration is required. Backend renewal errors now preserve the existing namespace instead of eagerly issuing another credential.

Tested

• cargo fmt --check with the complete first-party package list from AGENTS.md
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --locked — 309 passed, 7 ignored before the SDK source change; the final Git dependency passes the full workspace CI. Its additional macOS rerun was stopped during compilation to protect disk space.
• fvm flutter pub get
• dart format --output=none --set-exit-if-changed lib test integration_test
• fvm flutter analyze — no issues
• fvm flutter test — 457 passed, 3 skipped
• Backend tests against an isolated real relay — 13 passed; renewal fault injection confirms no replacement namespace after a lost renewal connection
• Combined bridge/pb-mapper build: 300 session switches on one WebSocket through a local relay, zero disconnects; median 13.8 ms, P95 45.5 ms, maximum 63.3 ms

Regressions cover oversized frames, late RPC responses, shared-connection survival after a response timeout, transport errors, and stale UI resume/history results. FRB regeneration is not needed because its public API is unchanged.

Linked issues

Companion pb-mapper PR: acking-you/pb-mapper#10

Sync checklist

• Public additions have doc comments; no undocumented production unwrap() / expect() added.
• No formatting, lint, or rewrite commands were run against deps/.
• Roadmap milestone updates are not applicable to this bug fix.

Validation limits and rollout

The combined benchmark used isolated historical fixtures and warm local caches, not a public-network deployment. The original desktop process also became unresponsive during investigation; its separate stall remains unattributed. Existing desktop/backend/relay processes have not been upgraded by this PR.

The SDK fixes are already merged and pushed to the dedicated pocket-codex branch. Ordinary --locked builds use the recorded Git commit; updating the branch does not silently update application builds. Future SDK fixes are adopted with cargo update -p pb-mapper followed by regression checks and a committed lockfile. Cargo also regenerated existing Windows/socket dependency edges without changing their package versions.

The earlier 300-switch soak used temporary local overrides of these same fixed SDK sources. The final Git dependency configuration passed the full Rust/Flutter CI, macOS workspace Clippy, and the local Flutter suite. The additional macOS full test rerun was stopped during compilation when disk space became critical; the repository debug cache was then cleaned. No macOS test completion is claimed for that rerun.

The Claude review workflow exhausted its 20-turn execution budget and posted no findings. This review-service failure is separate from the successful build/test CI; no review approval is claimed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T07:18:19.662428Z	df89c30	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.