fix(store): harden JSON-file conversation store — atomic write race (#502) + list shape-guard (#501)

[TYRMars]

Summary

Two related robustness fixes to packages/store/src/json-file.ts (the default JSON-file conversation store, which also backs @jarvis/observability and @jarvis/learning).

#502 — silent data loss on concurrent writes

atomicWrite derived its staging file solely from the target path (`${filePath}.tmp`), so all concurrent writers of one row shared one .tmp. Writer B truncates/rewrites A's tmp; whoever renames first consumes it, and the second rename hits ENOENT and drops that writer's turn silently. Reachable without a second socket — POST /v1/conversations/:id/messages and .../messages/stream have no in-flight guard and both catch-and-ignore the save failure, so a double-submit / retry / two tabs on one conversation loses a whole turn with nothing shown to the user.

Fix: stage to a per-write unique tmp — `${filePath}.${process.pid}.${randomUUID()}.tmp` — so each writer's rename is independent and last-write-wins holds cleanly; remove the tmp in a finally so a failed write / lost race leaves no litter.

#501 — one foreign .json permanently 500s GET /v1/conversations

list() blind-cast every parsed .json in the base dir to OnDiskConversation and dereferenced stored.messages.length with no shape guard and no per-file try/catch. A foreign-but-well-formed JSON object (e.g. JsonFileWorkspaceStore's workspaces.json flushed into the same dir, a truncated-but-parseable row, or a ..-partitioned foreign row) parses fine, has no messages array, and throws a TypeError that escapes list() and permanently 500s the endpoint — the sidebar goes empty and stays empty.

Fix: validate before dereferencing (skip when id isn't a string or messages isn't an array) and wrap the per-file body in try/catch, matching the tolerance activity-store and observability/json-file already have.

Testing

• New packages/store/src/atomic-write.test.ts: 12 writers race one target → no ENOENT, final file is exactly one full payload (no torn write), no litter. Plus a single-writer exact-contents check.
• New case in store.test.ts: list() skips workspaces.json, a wrong-shape row, and a top-level array without throwing; the real conversation still lists.
• store.test.ts JSON-file contract suite: 20/20 pass.
• pnpm --filter @jarvis/store typecheck clean; eslint clean on changed files.

Note: the SQLite-backend tests in this package fail to load in this environment because better-sqlite3's native binding couldn't be built (offline). Those failures are pre-existing and unrelated to this change.

Closes #502, #501.

🤖 Generated with Claude Code