Follow-up review of the pairing path and a second pass over seeding:

- `isPersistedServerRuntimeStateLive` reported non-positive pids as live.
  `process.kill` reads 0 and -1 as signal-group targets rather than
  process lookups, so neither throws and both were caught by the "it
  didn't throw, so it's running" branch. A truncated or hand-edited file
  recording either would be believed forever — the dev candidate wins the
  devUrl preference, so it also outranks a genuinely live server
  elsewhere and mints tokens into a database nothing reads. Rejected in
  the schema and re-checked at the call site; the errno cast is now a
  guard, since an out-of-range pid throws a TypeError with no `code`.
- `pairing url --json` emitted warnings on stdout ahead of the payload.
  The probe reads both state directories, so a corrupt file in the one
  *not* in use broke JSON for any consumer piping it; the quiet-logs
  layer was only applied around the issuing step that runs after. Verified
  with a crafted fixture: stdout is now valid JSON.
- Turns copied in the `pending` state were left unsettled. Same defect as
  the `running` case fixed previously — a user message accepted before its
  provider turn started, which only that thread's next message would ever
  clear.
- The source was read across a dozen implicit transactions while the
  installed app may be writing to it, so a project could vanish between
  the query that selected it and the copy that read its row. One deferred
  read transaction pins every query to a single snapshot.
- `--from` and `--to` resolving to the same directory is now refused. Not
  for the data loss it appears to be (the source reads a pre-transaction
  snapshot, so the rows come back — verified in both journal modes), but
  because the event log, the cursors, and everything outside the caps do
  not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>