fix(persistence): isolate durable stream commits from HTTP

[drewstone]

Change

Isolate streamed chat persistence in a bounded worker, behind BRIDGE_ASYNC_DURABLE_WRITES=on (default off). Every backend on the shared chat route uses the same path.

• Preserve SQLite WAL synchronous=FULL; group queued writes with per-request savepoints.
• Bound pending inputs to 128 requests / 32 MiB and await commits before exposing deltas, checkpoints, or terminal state.
• Drain accepted writes at shutdown; reject queue exhaustion and persistence failures explicitly.
• Preserve lifetime errors and native cancellation cleanup ownership across asynchronous settlement.

Evidence

Three live bridge main threads were sampled in fsync on their sessions.sqlite-wal descriptors. The streaming path performed two FULL commits per delta. This patch addresses that measured cause.

On fixed head f9e91c85efd75f7a5b09aeb9330e6d710b5d3d2b:

• Typecheck passes.
• Nine affected suites: 242 passed, 0 failed, 0 skipped.
• Runtime consumer: 1 passed.
• Real HTTP health fixture remains responsive while an actual SQLite write lock holds the worker. Pending output stays hidden; reopening recovers 17 events and the terminal checkpoint.
• Actual chat endpoint returns and replays persisted output without another backend invocation.
• Independent reviewer reran 7 new tests: 7 passed; 8 blocked-WAL health samples, maximum 23.651 ms.
• Independent review reproduced a lifetime/cancellation race, confirmed its correction, and approved this exact head.
• Real pre-commit and pre-push hooks pass, including trace-contract tests.

Review artifacts are retained privately under /mnt/traces/discovery-portfolio-20260928/bridge-async-review-20260929/.

Boundaries and rollout

This is not deployed and no active bridge was restarted. No model spend, package publishing, or dependency changes.

Admission, retained-session controls, raw frame writes, terminal raw fsync, and span-file writes retain synchronous paths. The fixture proves streamed-WAL isolation; it does not establish fleet-wide HDD responsiveness or end-to-end native capture improvement.

Enable first on an idle canary after its jobs settle; verify admission, replay, cancellation, health, and native capture before expanding.

The configured npm run review command was attempted but unavailable: the installed dotfiles hook runner rejects the named review command and accepts only pre-commit/pre-push. Independent source review is recorded separately; no hook was bypassed.

[tangletools]

✅ Auto-approved PR — f9e91c85

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-09-29T23:55:55Z}