A part move that fails after the state change leaves an empty fresh part and drops input #740

Written-by: Dev (via HugoXK)

What happened

parts.js moveOn mutates the Bot's state (segments, sessionId / room.sessions, the question card), saves, then sets job.moved = true, and only afterwards sends the handoff package to the fresh Session and forwards the input it carried. Two failure windows lose work:

• If rt.save() rejects (another window holds the state lock, the disk is full), the state already points at the fresh Session in memory. The finalizer sees job.moved === false and forwards the carried messages to currentOf(job) — which is now the fresh part, with no handoff package, no transcript and no in-place checkpoint. The chat opens on a blank part and the old history is not reachable from it.
• If ensureCapabilities, resolveAgent, the handoff followup or the flush throws after job.moved = true, the finalizer returns without forwarding: the fresh part stays current and empty, and the stopped turn's input and the old inbox messages are dropped.

Also switchBeforeStep returns { kind: 'reject' } even when startSwitch returned early (no place, another switch, read-only). DSH has already taken the step's messages out of the inbox, so they are lost, and entry.switched = true suppresses the turn's routing.

Expected

A failed move must not produce an empty current part and must not drop input. Send the handoff package to the fresh Session first; only then flip the Bot's pointer and save (restoring the old state if the save fails); mark the move done only after the carried input was forwarded, so the existing finalizer can hand it on. If no switch actually starts, continue the step instead of rejecting its messages.

Change scope

core/src/host/parts.js (moveOn, startSwitch, switchBeforeStep), core/test/session-identity.test.js (or a new focused case) + docs/subsystems/core-host.md.