pwn 0.5.781 → 0.5.783

data/etc/default_cron/session_cleanup.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# PWN managed default: session_cleanup v6
+# PWN managed default: session_cleanup v9
 # No provider calls or broad store GC. Unsummarized candidates are backed up first.
 require 'pwn'
 require 'json'
@@ -12,7 +12,7 @@ require 'securerandom'
 module PWN
   # Provenance-based session cleanup, shared by seeded cron payloads.
   module SessionCleanup
-    VERSION = 6
+    VERSION = 9
 
     def self.classify(path, id)
       return :unknown unless path == File.join(PWN::Sessions.sessions_dir, "#{id}.jsonl")
@@ -100,7 +100,7 @@ module PWN
 
     # Fingerprints include inode identity and nanosecond timestamps, not bodies.
     def self.snapshot(path)
-      [path, path.sub(/\.jsonl\z/, '.meta.json')].to_h do |file|
+      [path, PWN::Sessions.support_path(kind: :metadata, session_id: File.basename(path, '.jsonl'))].to_h do |file|
         raise 'Refusing symlink' if File.symlink?(file)
         next [File.basename(file), nil] unless File.exist?(file)
 
@@ -138,7 +138,7 @@ module PWN
       expected.each do |name, record|
         next unless record
 
-        source = File.join(File.dirname(path), name)
+        source = name.end_with?('.meta.json') ? PWN::Sessions.support_path(kind: :metadata, session_id: File.basename(name, '.meta.json')) : File.join(File.dirname(path), name)
         bytes = File.binread(source)
         raise 'Changed before backup' unless Digest::SHA256.hexdigest(bytes) == record[:sha256]
 
@@ -149,7 +149,278 @@ module PWN
       publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
     end
 
+    # Only stores with a cooperating permanent writer lock are auto-remediated.
+    # Other attributed errors remain explicit operator work, never broad GC.
+    def self.invalid_dependencies(id, references = nil)
+      (references || PWN::Sessions.dependency_index)[:invalid_records].select { |row| row[:owners].include?(id) }
+    end
+
+    def self.remediable?(id, references = nil)
+      rows = invalid_dependencies(id, references)
+      !rows.empty? && rows.all? do |row|
+        relative = row[:path].delete_prefix("#{File.join(Dir.home, '.pwn')}/")
+        supported = (relative == 'learning.jsonl' && row[:locator].is_a?(Integer)) ||
+                    (%w[memory.json memory.archive.json mistakes.json].include?(relative) && row[:locator].is_a?(String))
+        row[:owners] == [id] && supported
+      end
+    end
+
+    def self.cleanup_state(path, id, references = nil)
+      state = classify(path, id)
+      return state if state == :unknown
+
+      status = PWN::Sessions.retention_status(session_id: id, references: references)
+      return :invalid_dependency unless status[:dependency_errors].empty?
+
+      state
+    end
+
+    def self.with_dependency_lock(id)
+      rows = invalid_dependencies(id)
+      raise 'Unresolved dependency remediation' unless rows.empty? || remediable?(id)
+
+      # Lock even absent stores: a concurrent writer can introduce the first
+      # reference between the final index and unlink. These inodes are permanent.
+      root = File.join(Dir.home, '.pwn')
+      paths = %w[.learning-write.lock memory.json.write.lock mistakes.json.write.lock].map { |name| File.join(root, name) }.sort
+      locks = []
+      begin
+        paths.each do |path|
+          lock = File.open(path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) # rubocop:disable Style/FileOpen -- closed together in ensure
+          locks << lock
+          raise 'Dependency writer active' unless lock.flock(File::LOCK_EX | File::LOCK_NB)
+        end
+        yield
+      ensure
+        locks.reverse_each(&:close)
+      end
+    end
+
+    def self.remove_invalid_dependencies(id, result)
+      rows = invalid_dependencies(id)
+      return if rows.empty?
+
+      raise 'Dependency remediation changed' unless remediable?(id)
+
+      rows.group_by { |row| row[:path] }.each do |path, entries|
+        bytes = File.binread(path)
+        hash = Digest::SHA256.hexdigest(bytes)
+        raise 'Dependency changed' unless entries.all? { |row| row[:sha256] == hash }
+
+        backup_path = File.join(result[:archive_dir], "dependency-#{SecureRandom.hex(8)}.jsonl")
+        publish(backup_path, bytes)
+        raise 'Dependency backup failed' unless Digest::SHA256.file(backup_path).hexdigest == hash
+
+        locators = entries.map { |row| row[:locator] }
+        updated = if path.end_with?('.jsonl')
+                    bytes.lines.each_with_index.reject { |_, index| locators.include?(index) }.map(&:first).join
+                  else
+                    map = JSON.parse(bytes)
+                    raise 'Dependency map changed' unless map.is_a?(Hash) && locators.all? { |key| map.key?(key) }
+
+                    locators.each { |key| map.delete(key) }
+                    JSON.pretty_generate(map)
+                  end
+        removal = { session_id: id, path: path, backup: backup_path, sha256: hash,
+                    updated_sha256: Digest::SHA256.hexdigest(updated), locators: locators, state: 'prepared' }
+        (result[:dependency_removals] ||= []) << removal
+        publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
+        raise 'Dependency changed after backup' unless File.binread(path) == bytes
+
+        publish(path, updated)
+        # Compare exact bytes even when JSON emits non-ASCII UTF-8 text.
+        raise 'Dependency write verification failed' unless File.binread(path) == updated.b
+
+        removal[:state] = 'committed'
+        publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
+      end
+    end
+
+    # The command and bundled cron use this exact maintenance transaction.
+    # Legacy writers block all mutations, including evidence migration.
+    # One permanent inode serializes CLI, curses and cron maintenance writers.
+    # Read-only previews never acquire a writer lock or create lock files.
+    def self.with_maintenance_lock(dry_run:)
+      return yield if dry_run
+
+      root = PWN::Sessions.sessions_dir
+      raise IOError, 'Unsafe session maintenance directory' unless File.realpath(root) == File.expand_path(root)
+
+      path = File.join(root, '.maintenance.lock')
+      owner = Thread.current[:pwn_session_maintenance_lock]
+      return yield if owner && owner[:pid] == Process.pid && owner[:thread] == Thread.current && owner[:path] == path && !owner[:file].closed?
+
+      File.open(path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |file|
+        raise IOError, 'Session maintenance already running; wait for its result before retrying' unless file.flock(File::LOCK_EX | File::LOCK_NB)
+
+        begin
+          Thread.current[:pwn_session_maintenance_lock] = { pid: Process.pid, thread: Thread.current, path: path, file: file }
+          yield
+        ensure
+          Thread.current[:pwn_session_maintenance_lock] = owner
+        end
+      end
+    end
+
+    def self.maintain(dry_run: false, current_session_id: nil, proc_root: '/proc')
+      with_maintenance_lock(dry_run: dry_run) do
+        maintenance_transaction(dry_run: dry_run, current_session_id: current_session_id, proc_root: proc_root)
+      end
+    end
+
+    def self.maintenance_transaction(dry_run:, current_session_id:, proc_root:)
+      preflight = sweep(dry_run: true, current_session_id: current_session_id, proc_root: proc_root)
+      blocked = !preflight[:legacy_owners].empty? || Array(preflight[:unresolved_store_remediation]).any?
+      unless dry_run || blocked
+        # Private metadata-only preflight survives an interrupted migration.
+        backup(File.join(PWN::Sessions.sessions_dir, 'inventory.jsonl'), {}, preflight)
+        ledger = File.join(preflight[:archive_dir], 'maintenance.json')
+        publish(ledger, JSON.pretty_generate(state: 'prepared', inventory: preflight))
+        blocked = !legacy_owners(proc_root).empty?
+      end
+      migration = PWN::AI::Agent::Learning.migrate_evidence(dry_run: dry_run || blocked)
+      result = if dry_run || blocked
+                 preflight
+               else
+                 sweep(dry_run: false, current_session_id: current_session_id, proc_root: proc_root)
+               end
+      result[:dry_run] = dry_run
+      result[:apply_blocked] = true if blocked
+      result[:evidence_migration] = migration
+      result[:remaining_sessions] = Dir.glob(File.join(PWN::Sessions.sessions_dir, '*.jsonl')).length
+      result[:visible_sessions] = PWN::Sessions.list.length
+      if ledger
+        result[:maintenance_ledger] = ledger
+        publish(ledger, JSON.pretty_generate(state: blocked ? 'blocked' : 'committed', inventory: preflight, result: result))
+      end
+      result
+    end
+
+    # Explicit offline layout migration: never a cron side effect. Stop schedulers
+    # and all writers first; old binaries cannot understand the new layout.
+    # Transcript files never move. Temporary writer remnants are recoverable.
+    def self.reorganize(dry_run: true, writers_stopped: false, proc_root: '/proc')
+      raise ArgumentError, 'All writers and schedulers must be stopped' unless dry_run || writers_stopped
+
+      with_maintenance_lock(dry_run: dry_run) do
+        root = PWN::Sessions.sessions_dir
+        plan = Dir.children(root).sort.filter_map do |name|
+          target = case name
+                   when /\A\d{8}_\d{6}_[a-f0-9]{8}\.meta\.json\z/ then File.join('support', 'metadata', name)
+                   when /\A\..+\.cleanup\.lock\z/ then File.join('support', 'leases', name)
+                   when /\A\.activity-owner-\d+-\d+\.lock\z/ then File.join('support', 'owners', name)
+                   when /\A\d{8}_\d{6}_[a-f0-9]{8}\.jsonl\.\d+\.tmp\z/ then nil
+                   else next
+                   end
+          source = File.join(root, name)
+          raise IOError, 'Unsafe layout source' unless File.file?(source) && !File.symlink?(source)
+
+          { source: source, target: target && File.join(root, target), sha256: Digest::SHA256.file(source).hexdigest,
+            inode: File.stat(source).ino, temporary: target.nil? }
+        end
+        # Existing trace paths may be immutable finding/artifact anchors. Keep
+        # those exact paths; new traces use compact storage after the marker.
+        retained_support = Dir.glob(File.join(root, '*', 'trace.jsonl'))
+        references = PWN::Sessions.dependency_index
+        raise IOError, 'Uncertain evidence anchors prevent layout migration' unless references[:errors].empty?
+
+        plan.reject! do |row|
+          next false unless row[:source].end_with?('.meta.json')
+
+          id = File.basename(row[:source], '.meta.json')
+          anchored = !references[:dependencies].fetch(id, []).empty? || !references[:session_errors].fetch(id, []).empty?
+          retained_support << row[:source] if anchored
+          anchored
+        end
+        result = { state: 'planned', records: plan, retained_support: retained_support, transcripts: Dir.glob(File.join(root, '*.jsonl')).length }
+        next result if dry_run
+
+        raise IOError, 'Legacy writers remain active' unless legacy_owners(proc_root).empty?
+
+        handles = []
+        begin
+          locks = Dir.glob(File.join(root, 'support', '{leases,owners}', '.*.lock'))
+          locks.each do |path|
+            file = File.open(path, File::RDWR | File::NOFOLLOW) # rubocop:disable Style/FileOpen -- transaction owns all handles
+            handles << file
+            locked = file.flock(File::LOCK_EX | File::LOCK_NB)
+            own_marker = File.basename(path).start_with?(".activity-owner-#{Process.pid}-")
+            raise IOError, 'Session writers are active' unless locked || own_marker
+          end
+          plan.reject! do |row|
+            next false unless row[:source].end_with?('.lock')
+
+            # The migration caller can own its capability marker; leave it in
+            # place, not a replacement inode. Other held markers block migration.
+            file = File.open(row[:source], File::RDWR | File::NOFOLLOW) # rubocop:disable Style/FileOpen -- transaction holds every lock through commit
+            handles << file
+            locked = file.flock(File::LOCK_EX | File::LOCK_NB)
+            own_marker = File.basename(row[:source]).start_with?(".activity-owner-#{Process.pid}-")
+            raise IOError, 'Session writers are active' unless locked || own_marker
+
+            !locked
+          end
+          backup(File.join(root, 'layout.jsonl'), {}, result)
+          ledger = File.join(result[:archive_dir], 'layout.json')
+          result[:state] = 'prepared'
+          publish(ledger, JSON.pretty_generate(result))
+          # Back up every byte before the first move, including abandoned temp
+          # output. Do not infer that a temp is safe merely from its age/PID.
+          plan.each_with_index do |row, index|
+            raise IOError, 'Layout source changed' unless File.stat(row[:source]).ino == row[:inode] && Digest::SHA256.file(row[:source]).hexdigest == row[:sha256]
+            raise IOError, 'Layout destination exists' if row[:target] && (File.exist?(row[:target]) || File.symlink?(row[:target]))
+
+            row[:backup] = File.join(result[:archive_dir], "layout-#{index}.bin")
+            publish(row[:backup], File.binread(row[:source]))
+            raise IOError, 'Layout backup mismatch' unless Digest::SHA256.file(row[:backup]).hexdigest == row[:sha256]
+          end
+          publish(ledger, JSON.pretty_generate(result))
+          plan.each do |row|
+            raise IOError, 'Layout source changed' unless Digest::SHA256.file(row[:source]).hexdigest == row[:sha256]
+
+            if row[:temporary]
+              File.unlink(row[:source])
+            else
+              FileUtils.mkdir_p(File.dirname(row[:target]), mode: 0o700)
+              raise IOError, 'Unsafe layout destination' unless File.realpath(File.dirname(row[:target])) == File.expand_path(File.dirname(row[:target]))
+
+              File.rename(row[:source], row[:target])
+              raise IOError, 'Layout move mismatch' unless File.stat(row[:target]).ino == row[:inode] && Digest::SHA256.file(row[:target]).hexdigest == row[:sha256]
+            end
+            row[:moved] = true
+            publish(ledger, JSON.pretty_generate(result))
+          end
+          publish(File.join(root, '.layout-v2'), "2\n")
+          result[:state] = 'committed'
+          publish(ledger, JSON.pretty_generate(result))
+          result
+        ensure
+          handles.each(&:close)
+        end
+      end
+    end
+
+    def self.summary(result)
+      { version: VERSION, dry_run: result[:dry_run], apply_blocked: result[:apply_blocked] == true,
+        scanned: result[:scanned], candidates: result[:candidate_ids].length, deleted: result[:deleted_ids].length,
+        remaining: result[:remaining_sessions], visible: result[:visible_sessions], skipped: result[:skipped],
+        evidence_migration: result[:evidence_migration], archive_dir: result[:archive_dir],
+        unresolved_dependency_stores: result[:dependency_errors] || [], legacy_owners: result[:legacy_owners] }
+    end
+
     def self.run(dry_run: true, current_session_id: nil, proc_root: '/proc', approved_candidates: nil)
+      return sweep(dry_run: dry_run, current_session_id: current_session_id, proc_root: proc_root, approved_candidates: approved_candidates) if approved_candidates
+
+      maintain(dry_run: dry_run, current_session_id: current_session_id, proc_root: proc_root)
+    end
+
+    def self.sweep(dry_run: true, current_session_id: nil, proc_root: '/proc', approved_candidates: nil)
+      with_maintenance_lock(dry_run: dry_run) do
+        sweep_transaction(dry_run: dry_run, current_session_id: current_session_id, proc_root: proc_root, approved_candidates: approved_candidates)
+      end
+    end
+
+    def self.sweep_transaction(dry_run:, current_session_id:, proc_root:, approved_candidates:)
       raise 'Session cleanup requires the updated Sessions activity API; load the updated source or deploy it before running this helper' unless PWN::Sessions.respond_to?(:activate)
 
       root = PWN::Sessions.sessions_dir
@@ -158,26 +429,41 @@ module PWN
       current = current_session_id || (PWN::Env.dig(:ai, :session_id) if defined?(PWN::Env))
       legacy = legacy_owners(proc_root)
       result = { version: VERSION, dry_run: dry_run, scanned: 0, unnamed: 0, candidate_ids: [], deleted_ids: [], records: [], skipped: Hash.new(0), legacy_owners: legacy }
-      unless pins_known?
+      references = PWN::Sessions.dependency_index
+      unless references[:errors].empty?
         result[:skipped][:unknown_pins] = 1
-        result[:dependency_errors] = PWN::Sessions.dependency_index[:errors]
-        return result
+        result[:dependency_errors] = references[:errors]
+        result[:unresolved_store_remediation] = references[:errors]
       end
-      dependencies = PWN::Sessions.dependency_index[:dependencies]
-      pins = referenced_session_ids
+      result[:diagnostics] = references.fetch(:diagnostics, [])
+      dependencies = references[:dependencies]
+      pins = dependencies.keys
       Dir.glob(File.join(root, '*.jsonl')).each do |path|
         id = File.basename(path, '.jsonl')
         result[:scanned] += 1
-        state = classify(path, id)
-        record = PWN::Sessions.title_status(session_id: id).merge(id: id, classification: state, dependencies: dependencies.fetch(id, []))
+        state = cleanup_state(path, id, references)
+        record = PWN::Sessions.retention_status(session_id: id, references: references).merge(id: id, classification: state, dependencies: dependencies.fetch(id, []))
         result[:records] << record
-        unless state == :unnamed
+        unless references[:errors].empty?
+          record[:skip] = :unknown_pins
+          next
+        end
+        unless %i[unnamed invalid_dependency].include?(state)
           result[:skipped][state] += 1
           next
         end
+        if state == :invalid_dependency && (!remediable?(id, references) || pins.include?(id))
+          record[:skip] = :unresolved_dependency_remediation
+          result[:skipped][:unresolved_dependency_remediation] += 1
+          next
+        end
         expected = snapshot(path)
+        expected_dependencies = invalid_dependencies(id, references)
+        record[:dependency_records] = expected_dependencies
         record[:files] = expected
-        if approved_candidates && approved_candidates[id] != expected
+        approval = approved_candidates && approved_candidates[id]
+        approved = approval.is_a?(Hash) && approval.key?(:files) ? approval[:files] == expected && approval[:dependency_records] == expected_dependencies : approval == expected && expected_dependencies.empty?
+        if approved_candidates && !approved
           record[:skip] = :not_approved_or_changed
           result[:skipped][:not_approved_or_changed] += 1
           next
@@ -204,7 +490,7 @@ module PWN
           next
         end
         # Never unlink lock files: waiters must keep sharing the same inode.
-        lock_path = File.join(root, ".#{id}.cleanup.lock")
+        lock_path = PWN::Sessions.support_path(kind: :lease, session_id: id)
         raise 'Refusing symlinked cleanup lock' if File.symlink?(lock_path)
 
         File.open(lock_path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lock|
@@ -213,34 +499,39 @@ module PWN
             record[:skip] = :locked
             next
           end
-          File.open(path, File::RDONLY | File::NOFOLLOW) do |transcript|
-            unless transcript.flock(File::LOCK_EX | File::LOCK_NB)
-              result[:skipped][:locked] += 1
-              record[:skip] = :locked
-              next
+          with_dependency_lock(id) do
+            File.open(path, File::RDONLY | File::NOFOLLOW) do |transcript|
+              unless transcript.flock(File::LOCK_EX | File::LOCK_NB)
+                result[:skipped][:locked] += 1
+                record[:skip] = :locked
+                next
+              end
+              # Activation and deletion serialize on the same per-session inode.
+              # Legacy ownership uncertainty still requires operator migration.
+              unless File.identical?(transcript, path) && cleanup_state(path, id) == state && invalid_dependencies(id) == expected_dependencies && snapshot(path) == expected && legacy_owners(proc_root).empty? && pins_known? && !referenced_session_ids.include?(id)
+                result[:skipped][:changed] += 1
+                record[:skip] = :changed
+                next
+              end
+              backup(path, expected, result)
+              unless snapshot(path) == expected && cleanup_state(path, id) == state && invalid_dependencies(id) == expected_dependencies && legacy_owners(proc_root).empty? && pins_known? && !referenced_session_ids.include?(id)
+                result[:skipped][:changed] += 1
+                record[:skip] = :changed
+                next
+              end
+              # Only verified, archived, unreferenced unsummarized sessions;
+              # current and all known reference pins checked above.
+              # The normal delete API's age pin is deliberately bypassed here.
+              remove_invalid_dependencies(id, result)
+              raise 'Dependencies changed after remediation' unless pins_known? && !referenced_session_ids.include?(id) && invalid_dependencies(id).empty? && snapshot(path) == expected
+
+              PWN::Sessions.delete(session_id: id, current_session_id: current, force: true, cleanup_lock: lock)
+              raise 'Deletion did not remove both session records' if File.exist?(path) || File.exist?(PWN::Sessions.support_path(kind: :metadata, session_id: id))
+
+              result[:deleted_ids] << id
+              record[:deleted] = true
+              publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
             end
-            # Activation and deletion serialize on the same per-session inode.
-            # Legacy ownership uncertainty still requires operator migration.
-            unless File.identical?(transcript, path) && classify(path, id) == :unnamed && snapshot(path) == expected && legacy_owners(proc_root).empty? && pins_known? && !referenced_session_ids.include?(id)
-              result[:skipped][:changed] += 1
-              record[:skip] = :changed
-              next
-            end
-            backup(path, expected, result)
-            unless snapshot(path) == expected && classify(path, id) == :unnamed && legacy_owners(proc_root).empty? && pins_known? && !referenced_session_ids.include?(id)
-              result[:skipped][:changed] += 1
-              record[:skip] = :changed
-              next
-            end
-            # Only verified, archived, unreferenced unsummarized sessions;
-            # current and all known reference pins checked above.
-            # The normal delete API's age pin is deliberately bypassed here.
-            PWN::Sessions.delete(session_id: id, current_session_id: current, force: true, cleanup_lock: lock)
-            raise 'Deletion did not remove both session records' if File.exist?(path) || File.exist?(path.sub(/\.jsonl\z/, '.meta.json'))
-
-            result[:deleted_ids] << id
-            record[:deleted] = true
-            publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
           end
         end
       rescue StandardError => e
@@ -250,11 +541,13 @@ module PWN
       publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result)) if result[:archive_dir]
       result
     end
+
+    private_class_method :with_maintenance_lock, :maintenance_transaction, :sweep_transaction
   end
 end
 
 if $PROGRAM_NAME == __FILE__
   raise 'Use --dry-run or --apply' unless ARGV.length == 1 && %w[--dry-run --apply].include?(ARGV.first)
 
-  puts JSON.generate(PWN::SessionCleanup.run(dry_run: ARGV.first == '--dry-run'))
+  puts JSON.generate(PWN::SessionCleanup.summary(PWN::SessionCleanup.maintain(dry_run: ARGV.first == '--dry-run')))
 end

data/lib/pwn/ai/agent/curriculum.rb

@@ -229,9 +229,9 @@ module PWN
           commit  = opts.key?(:commit) ? opts[:commit] : true
           cutoff  = Time.now.utc - (since_h * 3_600)
 
-          # PWN::Sessions.list is arity-0 (no kwargs). Cap/sort after the call.
+          # Offline evidence discovery must include sessions hidden from operator lists.
           sids = if PWN::Sessions.respond_to?(:list)
-                   Array(PWN::Sessions.list)
+                   Array(PWN::Sessions.list(include_hidden: true))
                      .sort_by { |s| s.is_a?(Hash) ? s[:mtime].to_s : '' }
                      .reverse
                      .first(limit * 2)

data/lib/pwn/ai/agent/learning.rb

@@ -262,7 +262,9 @@ module PWN
 
         private_class_method def self.evidence_write(opts = {})
           path = opts[:path]
-          body = opts[:body]
+          # Verification is byte equality, not Ruby's encoding-sensitive text equality.
+          # Retag a copy only: do not transcode, normalize or scrub evidence/backups.
+          body = opts[:body].b
           dir = File.dirname(path)
           ancestor = dir
           ancestor = File.dirname(ancestor) until File.exist?(ancestor) || File.symlink?(ancestor)
@@ -332,7 +334,8 @@ module PWN
         # Reentrant across note_outcome -> pruning; flock serializes cooperating processes.
         private_class_method def self.learning_lock
           key = :pwn_learning_write_lock
-          return nil if Thread.current[key]
+          owner = Thread.current[key]
+          return nil if owner.is_a?(Hash) && owner[:pid] == Process.pid && owner[:thread] == Thread.current && !owner[:file].closed?
 
           root = File.dirname(LEARNING_FILE)
           FileUtils.mkdir_p(root, mode: 0o700)
@@ -340,9 +343,9 @@ module PWN
           raise IOError, 'Unsafe learning lock' if File.symlink?(path) || File.realpath(root) != File.expand_path(root)
 
           # Ownership transfers to the caller's ensure/learning_unlock.
-          file = File.open(path, File::RDWR | File::CREAT, 0o600) # rubocop:disable Style/FileOpen
+          file = File.open(path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) # rubocop:disable Style/FileOpen
           file.flock(File::LOCK_EX)
-          Thread.current[key] = file
+          Thread.current[key] = { pid: Process.pid, thread: Thread.current, file: file }
           file
         end
 
@@ -1250,6 +1253,8 @@ module PWN
         # stays high-signal.
 
         public_class_method def self.consolidate(opts = {})
+          return PWN::Memory.transaction(path: PWN::Memory::MEMORY_FILE) { consolidate(opts) } unless PWN::Memory.transaction_owned?(path: PWN::Memory::MEMORY_FILE)
+
           cap = opts[:max_entries] || MAX_MEMORY_ENTRIES
           return { removed: 0 } unless defined?(PWN::Memory)
 
@@ -2221,6 +2226,8 @@ module PWN
         # after upgrading; subsequent writes never produce these.
 
         public_class_method def self.purge_noise
+          return PWN::Memory.transaction(path: PWN::Memory::MEMORY_FILE) { purge_noise } unless PWN::Memory.transaction_owned?(path: PWN::Memory::MEMORY_FILE)
+
           return { removed: 0 } unless defined?(PWN::Memory)
 
           mem = nil

data/lib/pwn/ai/agent/mistakes.rb

@@ -63,15 +63,18 @@ module PWN
           FileUtils.mkdir_p(File.dirname(MISTAKES_FILE))
           return {} unless File.exist?(MISTAKES_FILE)
 
-          JSON.parse(File.read(MISTAKES_FILE), symbolize_names: true)
-        rescue StandardError
-          {}
+          store = JSON.parse(File.read(MISTAKES_FILE), symbolize_names: true)
+          raise IOError, 'Invalid mistakes map' unless store.is_a?(Hash)
+
+          store
         end
 
         # Supported Method Parameters::
         # PWN::AI::Agent::Mistakes.save(store: hash)
 
         public_class_method def self.save(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { save(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           store = opts[:store] ||= {}
           FileUtils.mkdir_p(File.dirname(MISTAKES_FILE))
           atomic_write(path: MISTAKES_FILE, body: JSON.pretty_generate(store))
@@ -195,6 +198,8 @@ module PWN
         # the caller (Loop.run) can drive cross-session repeat detection.
 
         public_class_method def self.record(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { record(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           tool  = opts[:tool].to_s
           error = opts[:error].to_s
           return nil if tool.empty? || error.strip.empty?
@@ -272,6 +277,8 @@ module PWN
         # )
 
         public_class_method def self.resolve(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { resolve(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           sig = opts[:signature].to_s
           fix = opts[:fix].to_s
           raise 'ERROR: signature is required' if sig.empty?
@@ -416,6 +423,8 @@ module PWN
         }.freeze
 
         public_class_method def self.extinguish!(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { extinguish!(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           sig = opts[:signature].to_s
           return nil if sig.empty?
 
@@ -457,6 +466,8 @@ module PWN
         # Auto-resolve parked items that already have a known extinguish recipe
         # so the operator inbox does not keep scars the loop can close itself.
         public_class_method def self.extinguish_parked!(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { extinguish_parked!(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           limit = (opts[:limit] || 20).to_i
           dry = opts[:dry_run] ? true : false
           rows = load.values.select do |m|
@@ -495,6 +506,8 @@ module PWN
         end
 
         public_class_method def self.park(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { park(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           sig = opts[:signature].to_s
           raise 'ERROR: signature is required' if sig.empty?
 
@@ -692,6 +705,8 @@ module PWN
         end
 
         public_class_method def self.note_hint_outcome(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { note_hint_outcome(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           sig = (opts[:signature] || signature(tool: opts[:tool], error: opts[:error])).to_s
           return nil if sig.empty?
 
@@ -777,6 +792,8 @@ module PWN
         # drop after Memory already holds mistake_fix_<sig>.
 
         public_class_method def self.lean!(opts = {})
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { lean!(opts) } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           dry = opts[:dry_run] ? true : false
           max_resolved = (opts[:max_resolved_kept] || MAX_RESOLVED_KEPT).to_i
           min_age = (opts[:resolved_min_age_days] || RESOLVED_MIN_AGE_DAYS).to_f
@@ -878,6 +895,8 @@ module PWN
         # PWN::AI::Agent::Mistakes.reset
 
         public_class_method def self.reset
+          return PWN::Memory.transaction(path: MISTAKES_FILE) { reset } unless PWN::Memory.transaction_owned?(path: MISTAKES_FILE)
+
           FileUtils.rm_f(MISTAKES_FILE)
           {}
         end

data/lib/pwn/ai/agent/tools/sessions.rb

@@ -52,23 +52,23 @@ PWN::AI::Agent::Registry.register(
   toolset: 'sessions',
   schema: {
     name: 'sessions_list',
-    description: 'List every pwn-ai session transcript in ~/.pwn/sessions ' \
-                 '(id, title, path, size, mtime, lines, dependencies, dependency_errors) newest-first. ' \
+    description: 'List the current active session and valid summarized or dependency-backed pwn-ai sessions in ~/.pwn/sessions ' \
+                 'as paginated concise rows (id, title, mtime, dependencies), oldest-first, with total and global diagnostics. ' \
                  'dependencies lists files referencing this session through structured links, not prose mentions. ' \
                  'Use to discover a session_id for learning_reflect / ' \
                  'learning_distill_skill / sessions_view.',
     parameters: {
       type: 'object',
       properties: {
-        limit: { type: 'integer', default: 25, description: 'Max sessions to return (newest first).' }
+        limit: { type: 'integer', default: 25, description: 'Max sessions to return (oldest first).' },
+        offset: { type: 'integer', description: 'Number of retained sessions to skip; omitted selects newest page. Current active session is also included.' }
       },
       required: []
     }
   },
   check: -> { defined?(PWN::Sessions) },
   handler: lambda { |args|
-    limit = (args[:limit] || 25).to_i
-    PWN::Sessions.list.sort_by { |s| s[:mtime].to_s }.reverse.first(limit)
+    PWN::Sessions.catalog(limit: args[:limit] || 25, offset: args[:offset], current_session_id: Thread.current[:pwn_session_id])
   }
 )
 
@@ -152,7 +152,7 @@ PWN::AI::Agent::Registry.register(
   },
   check: -> { defined?(PWN::Sessions) },
   handler: lambda { |_args|
-    listing = PWN::Sessions.list
+    listing = PWN::Sessions.list(include_hidden: true)
     PWN::Sessions.stats.merge(
       disk_bytes: listing.sum { |s| s[:size].to_i },
       dir: PWN::Sessions.sessions_dir

data/lib/pwn/ai/http_retry.rb

@@ -31,6 +31,9 @@ module PWN
       # Resolve provider defaults from the active request without mutating Env.
       public_class_method def self.provider_config(opts = {})
         engine = opts[:engine]
+        title_config = Thread.current[:pwn_session_title_config]
+        return title_config[engine] if title_config
+
         owner = Thread.current[:pwn_request_runtime]
         return owner.provider_config(engine) if owner.respond_to?(:provider_config)