sessions: persist to disk, prune, track client liveness, accept UE_LOGFMT (#1014)HEADmain

Branch started as a sessions-service overhaul (persistence, client liveness, UE_LOGFMT intake) and grew to pick up adjacent infrastructure work: an early-startup log backlog, a hardened `MemoryArena`, the `zen trace serve` viewer gaining a counter view + compact timeline + tabbed callsite panel, defensive fixes in the third-party `tourist` trace parser, a series of allocation reductions across the HTTP and compact-binary hot paths, and a new `zen sessions` CLI command tree.

## Sessions service

**Persistence.** Each session lives on disk under `<DataRoot>/sessions/<id>/` as `info.cb` (metadata) plus `log.bin` (length-prefixed CbObject log records). On startup the service scans that directory and loads prior sessions as ended sessions, preloading the tail of each log so historical views work after a restart. `SessionLog` is noexcept-constructed and falls back to a disabled state on disk errors, so a bad disk can't take down `RegisterSession`. `GetSession` falls back to the ended-sessions list (fixes historical log fetches over HTTP). `LoadTail` counts only successfully-parsed records.

**Pruning.** Periodic cleanup task drops ended sessions once any of three caps is exceeded: age (default 1 year), count (default 1000), or total on-disk footprint (default 50 MiB). Runs 30 s after startup, hourly thereafter. Active sessions never pruned; disk removal and directory stat happen outside the exclusive lock so a slow filesystem can't stall lookups.

**Client liveness.** Sessions carry a `ProcessHandle` for the client-reported pid, captured at registration time so Windows pid recycling can't produce false positives. A 30 s asio timer probes liveness and ends dead sessions through the normal remove path, producing a synthetic `Session ended: process exited (...)` line persisted to `log.bin`. Windows decodes common NTSTATUS exit codes to human names (Ctrl-C, access violation, stack overflow, ...); POSIX stays at plain `process exited`. Clients auto-fill `ClientPid` only for local targets (unix socket / loopback); the server defensively accepts pids only from `IsLocalMachineRequest()` peers. zenserver also reports its own pid when registering its self-session, so it shows up with a real pid in the dashboard and `zen sessions ls`.

**Synthetic end-of-session line.** `RemoveSession` takes an optional reason; before the session moves to the ended list it appends an Info-level `Session ended[: reason]` entry through the normal log path (released outside `m_Lock`). Current reasons: `client request` (HTTP DELETE), `server shutdown` (self-session), `process exited (...)` (liveness).

**UE_LOGFMT structured entries.** `POST /sessions/{id}/log` now accepts `{level, logger, format, fields}` alongside the existing `{level, logger, message}` shape. New `logtemplate.{h,cpp}` implements UE's `StructuredLog.cpp` template grammar (field paths with `.name` / `[N]`, `{{`/`}}` escapes, `$text` / `$format` / `$locformat` object conventions, bounded recursion). Renders to a displayable message at intake while persisting raw format + fields so a future UI can drill into fields without another schema bump. Hot path is zero-alloc — renders into `ExtendableStringBuilder<256>` using stack-buffered `Oid::ToString` / `IoHash::ToHexString` overloads. UI shows a `{…}` marker with the raw template + JSON-pretty fields on hover.

**Parent sessions.** `SessionInfo` gains `parent_session_id`; hub-managed storage server child processes inherit the hub's session id via `--parent-session=<id>`. `ZEN_SESSIONS_URL` env var becomes a fallback for `--sessions-url` / config when neither is provided. The in-process session log sink is disabled when a remote sessions target is configured (logs flow through `SessionsServiceClient` instead). The sessions UI groups child sessions under their parent (collapsible/expandable, sorts as a unit, supports nesting).

**Platform reporting.** `SessionInfo` gains `Platform`, flowed end-to-end: client auto-fills via `GetRuntimePlatformName()`, server persists in `info.cb` (`plat`) and emits on GET. UI renders as a SimpleIcons-style inline SVG (windows / macOS / iOS / linux / wine / android / playstation / xbox / nintendo) with case-insensitive alias resolution (Win32/Win64, PS4/PS5, XSX/XSS, NintendoSwitch, iPhone/iPad, Darwin/OSX). Unknown values fall back to text; sorting runs on the underlying string.

**WebSocket log streaming.** Sessions UI moves from 2 s polling to a WebSocket push model. New `WsSubscriber` has a stable id + helper methods. UI caps the log-line DOM at 5 000 entries with a shared cursor-regression helper, factored out of two call sites. Per-broadcast allocations trimmed on the push path; fixed a stack overrun in the WS log broadcast hex-id buffer.

**Log memory.** `LogEntry::Level` is now `logging::LogLevel` (1 byte) instead of `std::string` (~32 B) — saves ~310 KB per full 10 k-entry deque and eliminates a per-message allocation in the in-proc sink. On-disk format writes an int32 and accepts either int or legacy string on read. `LogEntry` strings now live in a `MemoryArena`; logger names are interned across the deque. `SessionLog::Append` and `WriteSessionInfoFile` drop their `UniqueBuffer` round-trip and write `CbObject::GetView()` straight through `BasicFile` / `SafeWriteFile`. Multi-entry `POST /log` batched under one lock + one push.

**In-proc log timestamps.** `InProcSessionLogSink::TimePointToDateTime` previously preserved only whole seconds, so every in-proc entry rendered at `.000` ms in the dashboard and `zen sessions tail`. It now adds the sub-second part (nanoseconds → 100 ns ticks) to keep ms precision end-to-end.

**UI.** Side "Session Details" panel is gone — its info is inline in the table (appname, mode, platform, id, timestamps, this/log pills, active dot). Bottom panel is a tabbed `Log | Metadata` view with a right-side "Session Information" panel beside metadata; log-only controls (filter, newest-first, follow, log-level filter, expand/collapse) hide when Metadata is active, polling keeps running across tab switches. Wide-mode toggle fills the viewport edge-to-edge. Log lines show the logger category; timestamps render in 24 h with zero-padded fields regardless of locale. Sessions list defaults to All / 10 per page / created-desc, gains click-to-sort headers on the full dataset, a header filter box, and a pager aligned to the table's right edge. Duplicate auto-injected `<h1>Sessions</h1>` removed.

## `zen sessions` CLI

New command tree on the `zen` client for inspecting the sessions service from the terminal:

- **`zen sessions ls`** — lists sessions (active first, ended next; newest-first within each group) with id, status, app/mode, pid, created, duration, and log count. Supports `--status active|ended|all` (default `all`).
- **`zen sessions status`** — prints the sessions service summary: self id, active / ended counts, and the read/write/delete/list/request/bad-request counters from `/stats/sessions`.
- **`zen sessions tail [session]`** — tails a session's log. With no argument it tails zenserver's own session (resolved via `/sessions/list`'s `self_id`); an explicit 24-hex id targets any session, including ended ones (historical replay). `--lines N` (default 50, 0 = all buffered) trims the initial dump client-side. `--follow` prefers a WebSocket push subscription on `/sessions/ws` for sub-second latency; on upgrade failure (older server, blocked port, unix-socket transport) it falls back to HTTP cursor polling at `--interval-ms` (default 500), with sleeps chunked to 50 ms so Ctrl-C reacts quickly. Output matches `zen::logging::FullFormatter` (`[YY-MM-DD HH:MM:SS.mmm] [lvl] [logger] message`); on a TTY the level is colored and the logger is bold, with continuation lines indented under the message column using the *visible* prefix width. 404 surfaces as `(session ended)` and connection errors as `(server gone)` — both clean exits, so stopping the server mid-tail no longer prints a stack trace.
- **`zen sessions ui`** — opens `<host>/dashboard/?page=sessions` in the user's default browser. Rejects unix-socket hosts.

A small `ZenServiceClient::IsUnixSocket()` helper now wraps the unix-socket check used by `ui`, `sessions tail` (WS path), and `sessions ui`.

## Logging

`BacklogSink` captures early-startup log entries in a fixed-capacity ring so late-attached sinks (session sink, file sink) can replay them. Detaches from the broadcast list when disabled; backed by destructor-only cleanup (no `unique_ptr` indirection per entry). Tuned defaults so the backlog covers typical bring-up without unbounded growth.

## `zen trace serve` viewer

- Compact timeline mode for high-density views.
- New `TRACE_INT_VALUE` / `TRACE_FLOAT_VALUE` counter trace points + a counters page in the viewer.
- Callsite tables collapsed into a single tabbed panel.
- Lossless `Oid <-> Guid` bridge for trace session ids; trace `SessionId` plumbed through.
- `tourist` parser hardening: bounds-check `BufferStream::read`, validate `Type::info_size` before `patch()`, convert `parse_important_aux` to a loop (avoids deep recursion), widen `ParserPool` index to `uint32`, bounds-check field offsets in the dispatcher, pin `Types::parse` buffer up-front.

## `MemoryArena`

Configurable chunk size, inline chunk list, oversize requests routed to truly-dedicated chunks (no slack waste, no fragmentation when one allocation is much larger than the chunk).

## Allocation cleanups across hot paths

- `zenhttp::HttpRequestRouter::HandleRequest` and `FormatPackageMessageInternal`: drop heap allocations.
- Compact-binary validation: `eastl::fixed_vector` + `eastl::sort`; eliminate `std::vector` churn.
- `zenserverprocess`: trim transient allocations in spawn paths.
- Sessions HTTP intake / broadcast: drop transient `std::string` allocs.

1 files changed, 79 insertions, 29 deletions

diff --git a/src/zenserver/frontend/html/theme.js b/src/zenserver/frontend/html/theme.js
index 52ca116ab..7382d3ea0 100644
--- a/src/zenserver/frontend/html/theme.js
+++ b/src/zenserver/frontend/html/theme.js
@@ -4,18 +4,25 @@
 // Persists choice in localStorage. Applies data-theme attribute on <html>.
 
 (function() {
-	var KEY = 'zen-theme';
-
-	function getStored() {
-		try { return localStorage.getItem(KEY); } catch (e) { return null; }
+	// Wrap localStorage so a single key's get/set/clear all swallow the
+	// SecurityError that fires in private-mode / cookies-disabled browsers.
+	// `clear` removes the key entirely (used for theme to reset to system
+	// preference); `set` stores the raw value passed (callers serialize).
+	function safeStorage(key) {
+		return {
+			get: function() {
+				try { return localStorage.getItem(key); } catch (e) { return null; }
+			},
+			set: function(value) {
+				try { localStorage.setItem(key, value); } catch (e) {}
+			},
+			clear: function() {
+				try { localStorage.removeItem(key); } catch (e) {}
+			},
+		};
 	}
 
-	function setStored(value) {
-		try {
-			if (value) localStorage.setItem(KEY, value);
-			else localStorage.removeItem(KEY);
-		} catch (e) {}
-	}
+	var themeStore = safeStorage('zen-theme');
 
 	function apply(theme) {
 		if (theme)
@@ -30,32 +37,53 @@
 	}
 
 	// Apply stored preference immediately (before paint)
-	var stored = getStored();
-	apply(stored);
+	apply(themeStore.get());
+
+	// Wide-mode preference: persisted across sessions, applied before paint
+	// so the layout doesn't flash at the default width on reload. Lifts the
+	// 1400px #container cap and the body's horizontal padding so the main
+	// content fills the viewport edge-to-edge.
+	var wideStore = safeStorage('zen-wide');
+	function getWide() { return wideStore.get() === 'true'; }
+	function setWide(value) {
+		if (value) wideStore.set('true');
+		else wideStore.clear();
+	}
+	function applyWide(wide) {
+		if (wide) document.documentElement.setAttribute('data-wide', 'true');
+		else document.documentElement.removeAttribute('data-wide');
+	}
+	applyWide(getWide());
+
+	// Double-chevron SVGs for the wide toggle — outward when content is
+	// narrow (click to fill the viewport), inward when wide (click to snap
+	// back to the 1400px cap). currentColor so button styles tint it.
+	var ICON_WIDEN = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="8 6 2 12 8 18"/><polyline points="16 6 22 12 16 18"/></svg>';
+	var ICON_NARROW = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="4 6 10 12 4 18"/><polyline points="20 6 14 12 20 18"/></svg>';
 
 	// Create toggle button once DOM is ready
 	function createToggle() {
 		var btn = document.createElement('button');
 		btn.id = 'zen_theme_toggle';
+		btn.className = 'zen-floating-toggle';
 		btn.title = 'Toggle theme';
 
 		function updateIcon() {
-			var effective = getEffective(getStored());
+			var effective = getEffective(themeStore.get());
 			// Show sun in dark mode (click to go light), moon in light mode (click to go dark)
 			btn.textContent = effective === 'dark' ? '\u2600' : '\u263E';
 
-			var isManual = getStored() != null;
+			var isManual = themeStore.get() != null;
 			btn.title = isManual
 				? 'Theme: ' + effective + ' (click to change, double-click for system)'
 				: 'Theme: system (click to change)';
 		}
 
 		btn.addEventListener('click', function() {
-			var current = getStored();
-			var effective = getEffective(current);
+			var effective = getEffective(themeStore.get());
 			// Toggle to the opposite
 			var next = effective === 'dark' ? 'light' : 'dark';
-			setStored(next);
+			themeStore.set(next);
 			apply(next);
 			updateIcon();
 		});
@@ -63,26 +91,26 @@
 		btn.addEventListener('dblclick', function(e) {
 			e.preventDefault();
 			// Reset to system preference
-			setStored(null);
+			themeStore.clear();
 			apply(null);
 			updateIcon();
 		});
 
 		// Update icon when system preference changes
 		window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', function() {
-			if (!getStored()) updateIcon();
+			if (!themeStore.get()) updateIcon();
 		});
 
 		updateIcon();
 		document.body.appendChild(btn);
 
 		// WebSocket pause/play toggle
-		var WS_KEY = 'zen-ws-paused';
+		var wsStore = safeStorage('zen-ws-paused');
 		var wsBtn = document.createElement('button');
 		wsBtn.id = 'zen_ws_toggle';
+		wsBtn.className = 'zen-floating-toggle';
 
-		var initialPaused = false;
-		try { initialPaused = localStorage.getItem(WS_KEY) === 'true'; } catch (e) {}
+		var initialPaused = wsStore.get() === 'true';
 
 		function updateWsIcon(paused) {
 			wsBtn.dataset.paused = paused ? 'true' : 'false';
@@ -92,21 +120,43 @@
 
 		updateWsIcon(initialPaused);
 
-		// Fire initial event so pages pick up persisted state
-		document.addEventListener('DOMContentLoaded', function() {
-			if (initialPaused) {
-				document.dispatchEvent(new CustomEvent('zen-ws-toggle', { detail: { paused: true } }));
-			}
-		});
+		// No initial event is dispatched: createToggle runs at (or after)
+		// DOMContentLoaded, so any listener gated on DOMContentLoaded would
+		// not fire. Page scripts read localStorage('zen-ws-paused') directly
+		// for their initial paused state and subscribe to zen-ws-toggle for
+		// subsequent transitions.
 
 		wsBtn.addEventListener('click', function() {
 			var paused = wsBtn.dataset.paused !== 'true';
-			try { localStorage.setItem(WS_KEY, paused ? 'true' : 'false'); } catch (e) {}
+			wsStore.set(paused ? 'true' : 'false');
 			updateWsIcon(paused);
 			document.dispatchEvent(new CustomEvent('zen-ws-toggle', { detail: { paused: paused } }));
 		});
 
 		document.body.appendChild(wsBtn);
+
+		// Wide-mode toggle. Sits to the left of the pause and theme toggles.
+		var wideBtn = document.createElement('button');
+		wideBtn.id = 'zen_wide_toggle';
+		wideBtn.className = 'zen-floating-toggle';
+
+		function updateWideIcon(wide) {
+			wideBtn.dataset.wide = wide ? 'true' : 'false';
+			wideBtn.innerHTML = wide ? ICON_NARROW : ICON_WIDEN;
+			wideBtn.title = wide ? 'Narrow the main content' : 'Fill the viewport width';
+			wideBtn.setAttribute('aria-label', wide ? 'Narrow content' : 'Widen content');
+		}
+
+		updateWideIcon(getWide());
+
+		wideBtn.addEventListener('click', function() {
+			var wide = !getWide();
+			setWide(wide);
+			applyWide(wide);
+			updateWideIcon(wide);
+		});
+
+		document.body.appendChild(wideBtn);
 	}
 
 	if (document.readyState === 'loading')