merge_from_source aborts mid-loop on a merge error, silently dropping the remaining rooms

[sanity]

Found while reviewing #587.

Rooms::merge_from_source iterates other.map and uses ? on a fallible ChatRoomStateV1::merge in two places — the adopt-incoming branch (before self.map.insert) and the already-present branch. Either error returns Err from the whole function. The caller logs and continues, so every room later in the iteration order is never inserted. other.map is a HashMap, so which rooms are lost is arbitrary and unstable between runs.

Two consequences:

1. Silent partial hydration. The user sees a subset of their rooms with no error surfaced, and which subset varies run to run.
2. Those rooms become vacant slots, and a vacant slot is exactly where the Lost IDs and rooms to River Update across two nodes. #527 generation-rank check does not run — merge_from_source compares ranks only if let Some(existing) = self.map.get(&vk). So a legacy generation's copy is adopted with no rank check, and reconcile_room_present's diverged-identity branch then CAS-writes that older identity over the current one.

Reachability needs self.map non-empty at merge time with a matching-self_sk room, so the already-present branch is taken rather than Entry::Vacant — e.g. the user creates or joins a room before the current delegate's ListResponse lands, or any reconnect pass.

Suggested fix

Per-room isolation: log the failing room and continue, rather than aborting the whole merge. That matches the precedent in do_save_rooms_to_delegate, which deliberately accumulates per-key errors and keeps going so one room's failure cannot skip the others.

Wants a test that a merge error on one room does not prevent the remaining rooms from being inserted.

[AI-assisted - Claude]

[sanity]

Confirming the reachability argument, because I initially got this wrong in review and the mistake is instructive.

I claimed merge_from_source's only loop exit on a populated map was the identity-conflict KeepLocal branch. That came from grepping for continue, which finds three exits. It misses the two that matter: bare ? on the fallible ChatRoomStateV1::merge, which returns Err from the whole function rather than skipping one room.

• adopt-incoming branch — fires before self.map.insert(vk, room_data), so that room is not inserted either
• already-present, matching-self_sk branch

hydrate_loaded_rooms logs and continues, so every room later in other.map's iteration order is silently never inserted — and other.map is a HashMap, so which ones is arbitrary and unstable between runs.

That makes this a clean counterexample to "every listed slot parsed implies no vacancy in ROOMS": all those rooms parsed fine and counted as materialised. They then become vacant slots, which is exactly where the #527 rank check does not run, so a legacy generation's copy is adopted unranked and reconcile_room_present's diverged-identity branch CAS-writes the older identity over the current one.

Worth pairing with #590 when either is fixed: both are ways ROOMS ends up disagreeing with what the current delegate holds, and both are made materially worse by anything that turns the #345 recovery on.

[AI-assisted - Claude]