Ran 8 rounds of adversarial review against the previous commit's session
bootstrap / contract loading / spawn ordering paths. Each round surfaced
real correctness gaps; this commit lands the fixes for all of them.

Hardening summary by file:

src/mcp/serve.ts
- Fail closed on unreachable Nexus at startup instead of silently
  downgrading to local stores (would otherwise split-brain writes with
  the TUI).
- Retry Nexus session lookup with exponential backoff before declaring
  the record missing, to absorb the TUI → Nexus mirror race.
- Accept topology-only session records (legacy / grove_create_session
  tool) with a loud WARN by DEFAULT; opt into strict `config`-only mode
  via GROVE_MCP_STRICT_CONTRACT=1. Prevents backcompat breakage while
  giving ops a knob to tighten enforcement.
- Exit the process when a session ID is set but Nexus returns no record
  at all (vs a topology-only record); the old code path kept writing to
  orphan VFS paths.

src/mcp/serve-http.ts
- Lazily resolve session-scoped deps per incoming HTTP request instead
  of baking sessionId into stores at process boot. serve-http.ts is
  started before the interactive session exists, so the previous static
  scoping was always wrong for fresh clients.
- Invalidate MCP sessions whose bound grove sessionId no longer matches
  the current one so a grove session switch doesn't leave long-lived
  HTTP clients writing under the prior scope.
- Reject new mutating MCP initialization in Nexus bootstrap mode (no
  grove session yet) with 503 SESSION_NOT_READY. Bootstrap-scoped
  McpServers would capture unscoped stores for their entire lifetime.
- Differentiate "file missing" (valid pre-session state) from "file
  unreadable/corrupt" via SessionStateReadError, and only invalidate
  live sessions after a SUCCESSFUL read. Atomic writes on the TUI side
  (tmp + rename) and a read-error-tolerant handler keep concurrent
  session switches from tearing down in-flight requests.
- Update the current-session.json mtime cache only AFTER a successful
  parse; a torn-write read no longer poisons the cache.
- Mirror the strict/weak contract policy from serve.ts.

src/tui/spawn-manager.ts
- Serialize codex MCP registration through a per-session promise chain
  on the SpawnManager instance. Parallel role spawns in the same session
  previously raced remove+add on the single global "grove" entry.
- Use stable "grove" MCP name (not per-session) to avoid leaking stale
  entries and persisted secrets in ~/.codex/config.toml over time.
  Sweep any legacy `grove-*` entries on first spawn.
- Replace execSync shell strings with spawnSync argv arrays in the
  codex mcp add/remove path so paths with spaces / shell metacharacters
  can't break the command.
- Only cache successful registrations; a failed first attempt clears
  the cache so the next spawn retries.
- Probe `codex --version` once and skip registration entirely when
  codex is not installed (claude path reads .acpxrc.json directly).
- writeMcpConfig swallows codex-registration errors softly so claude
  roles aren't blocked, but spawn() re-calls ensureCodexMcpRegistered
  with the real error propagated when the role is specifically codex.

src/tui/nexus-provider.ts
- Expose `mode = "nexus" as const` as a public discriminator so callers
  can distinguish Nexus from local providers without peeking at
  protected fields.
- Await the Nexus session mirror in createSession and retry a few
  times; on final failure, archive the just-created local/server
  session so repeated retries don't accumulate orphan active records.
  Throws so the TUI can surface the error instead of returning a
  broken session id.

src/tui/screens/screen-manager.tsx
- Refuse the synthetic-UUID fallback on Nexus session-creation failures
  (uses the new provider.mode discriminator); the stdio MCP server now
  fails closed when the session record is missing, so a fabricated ID
  would immediately crash every spawned agent.
- Write .grove/current-session.json on BOTH new-session and resume
  paths so the HTTP MCP server's session scoping stays fresh across
  restarts and resumes.
- Atomic writes via temp-file + rename so concurrent readers in
  serve-http.ts never observe truncated JSON during a session switch.

src/cli/main.tui-dispatch.test.ts
- Pre-existing flake: bun cold-start of main.ts exceeds the hardcoded
  2s kill deadline on warm machines. Bumped inner timeout to 5s and the
  outer bun:test timeout to 15s so the race finishes cleanly.

Test coverage: `bun test` → 4878 pass, 0 fail. `bun x tsc --noEmit`
clean. `bun x biome check` clean on changed files.

Lands the safe subset of the sibling WIP that was in the worktree
alongside the Nexus/MCP fixes. Two themes:

1. Debug log hygiene
   - src/tui/debug-log.ts: add `ENABLED` gate keyed off GROVE_DEBUG=1
     so the unconditional `/tmp/grove-debug.log` writes in hot paths
     become no-ops in normal operation. Before: every NexusHandoffStore
     read/write and every NexusContributionStore put/list wrote a
     timestamped line. After: only when GROVE_DEBUG=1 is set.
   - src/nexus/nexus-handoff-store.ts: replace 6× inlined
     `appendFileSync("/tmp/grove-debug.log", ...)` blocks with calls
     to the shared `debugLog()` helper. Net -53 lines of boilerplate
     and one consistent gate instead of six unguarded writes.
   - src/nexus/nexus-contribution-store.ts: same cleanup; net -22
     lines. Reuses the existing `manifestPath` local rather than
     recomputing it inside the log.

2. contributeOperation handoff fan-out improvements
   - src/core/operations/contribute.ts: the `createMany` fast path
     already existed; the per-input fallback was serial and swallowed
     every error silently. Switch the fallback to `Promise.allSettled`
     so N downstream handoffs pay 1×RTT instead of N×RTT, and
     surface per-failure reasons via `console.warn` so operators can
     diagnose routing gaps instead of noticing handoffs missing from
     the UI without any log trail. The best-effort semantics are
     preserved: a failure does not abort the contribution that was
     already committed.
   - src/core/operations/contribute.test.ts: add a describe block
     exercising the serial (fallback) path with an injected faulty
     handoff store. Verifies (a) the contribution is still durably
     persisted when every handoff create throws and (b) a single
     `console.warn` fires for the failed batch.

3. Doc-only clarifications
   - src/local/sqlite-store.ts: extend the `putWithCowrite` JSDoc to
     spell out the duck-type capability contract used by
     contributeOperation's `writeAtomic` selector.
   - src/local/sqlite-handoff-store.ts: matching comment on
     `insertSync` pointing at the same selector rule.

Explicitly NOT included in this commit (separate issue to follow):
`src/core/operations/bounty.ts` and `src/core/operations/bounty.test.ts`.
Three codex adversarial-review rounds flagged the new compensation
pattern there (settle-before-pay corruption + post-commit reservation
rollback + post-commit claim release). Those fixes need a saga /
outbox / reconciler design decision, not a mechanical change, so
they stay in the worktree until the design is resolved.

Test coverage: `bun test` (with NEXUS env) → 4878 pass, 0 fail.
`bun x tsc --noEmit` clean. `bun x biome check` clean on changed files.