[quickbeard]

Deleting a sandbox while one of its sessions was open crashed the window to the fatal "Something went wrong" screen with Error: Invalid server route. And because the desktop restores the last active route on launch, every relaunch crashed again until the persisted URL happened to change.

Cause

requireServerKey throws when the route segment is missing or does not round-trip:

export function requireServerKey(segment: string | undefined) {
  const key = decode64(segment)
  if (!key || base64Encode(key) !== segment) throw new Error("Invalid server route")
  ...
}

Both route call sites ran it during render — one inside a createMemo, one as a JSX prop — so the throw escaped a reactive computation and took the whole renderer down.

And the param does go missing in ordinary use: removing a server navigates away (tabs.removeServer → navigate("/")), and the route's params clear before its subtree unmounts. That is exactly the delete-a-sandbox path.

Fix

serverKeyFromRoute is a non-throwing variant; requireServerKey is now defined in terms of it and kept for callers that want the throw. The two route components use the non-throwing one.

Rendering nothing turned out not to be enough on its own: a /server/… route that cannot mount its providers leaves the shell half-built and then fails further down in the command registry (reg.options is not a function, in a tight loop). So an unreadable key redirects home rather than sitting on a route that can never render.

Verified against the running app

I drove the real desktop app over the DevTools protocol rather than reasoning about it:

• Before: booting on a route whose server key is unreadable → fatal error screen.
• After: the "Invalid server route" throw is gone entirely.
• The realistic case — a valid key for a server that no longer exists, which is what a deleted sandbox leaves behind — now recovers to a valid route with crashed: false and zero renderer errors.

Also in this PR: a lone sandbox job briefly announced itself as "Waiting for another sandbox…" before starting. The status now starts as running when nothing (that is not already superseded) is ahead of it in the queue, with a test pinning it.

Scope

This is an upstream bug of the same class as the project-avatar-state.ts guard already in DIVERGENCES.md — any removal, restart, or crash of a sidecar server drops its key while routes and tabs still point at it. A new divergence row records the guard and warns against "simplifying" the route back to requireServerKey.

Tests: packages/app 675 pass, packages/codev-sandbox 146 pass (1 new), packages/desktop 96 pass; bun typecheck clean in all three.

🤖 Generated with Claude Code