@askexenow/exe-os 0.9.407 → 0.9.409

package/dist/{chunk-RGPEUXOE.js → chunk-4MK6LOD6.js}

@@ -278,11 +278,13 @@ function assessObservedAt(raw, now) {
   return ok;
 }
 var HEX_SHA = /^[0-9a-f]{7,64}$/i;
+var ACCOUNTABILITY_PURPOSES = /* @__PURE__ */ new Set(["verdict", "routing_verdict"]);
 function assessAttribution(raw, purpose, context = {}) {
   if (raw === void 0 || raw === null || raw === "") {
+    const purposeLabel = purpose === "routing_verdict" ? "close" : purpose;
     return deny(
       "attribution_missing",
-      `this ${purpose} requires attribution: which agent produced it, with which model, and when the evidence was observed`
+      `this ${purposeLabel} requires attribution: which agent produced it, with which model, and when the evidence was observed`
     );
   }
   let attribution = raw;
@@ -306,10 +308,10 @@ function assessAttribution(raw, purpose, context = {}) {
       `"${agent}" is a role, not an identity. Records attributed to "admin" are exactly why past verdicts cannot be traced to anyone \u2014 name the actual agent`
     );
   }
-  if (purpose === "verdict" && isUnresolvedIdentity(agent)) {
+  if (ACCOUNTABILITY_PURPOSES.has(purpose) && isUnresolvedIdentity(agent)) {
     return deny(
       "attribution_agent_placeholder",
-      `"${agent}" is the identity resolver's fallback, not an agent \u2014 it is what a call from the launchd daemon carries when there is no active-agent marker, no tmux session and no AGENT_ID. A verdict signed with it is signed by nobody. Pass the real employee name of whoever made this call`
+      `"${agent}" is the identity resolver's fallback, not an agent \u2014 it is what a call from the launchd daemon carries when there is no active-agent marker, no tmux session and no AGENT_ID. A ${purpose === "verdict" ? "verdict" : "close"} signed with it is signed by nobody. Pass the real employee name of whoever made this call`
     );
   }
   const modelResult = assessModel(attribution.model, { allowAutomation: context.allowAutomation === true });
@@ -359,6 +361,10 @@ function assessAttribution(raw, purpose, context = {}) {
 }
 
 // src/shared/verification-artifact.ts
+var GITHUB_ISSUE_URL_RE = /^https:\/\/github\.com\/AskExe\/[a-zA-Z0-9._-]+\/issues\/[1-9][0-9]*$/;
+function isValidGithubIssueUrl(value) {
+  return typeof value === "string" && GITHUB_ISSUE_URL_RE.test(value);
+}
 var VERIFIER_BACKED_DISPOSITIONS = /* @__PURE__ */ new Set(["not_a_defect", "superseded"]);
 var MIN_DISPOSITION_REASON_CHARS = 40;
 var MIN_WONTFIX_REASON_CHARS = 120;
@@ -620,6 +626,24 @@ function assessOpsTranscript(artifact, context) {
   return ok2;
 }
 function assessDisposition(disposition, input) {
+  if (disposition === "migrated") {
+    if (str3(input.status) !== "closed") {
+      return deny2(
+        "migrated_requires_closed",
+        `disposition='migrated' is only valid with status='closed' (got status='${str3(input.status) || "undefined"}'). 'migrated' records where the bug went, not that it was fixed \u2014 pass status='closed', not 'fixed'.`
+      );
+    }
+    if (!isValidGithubIssueUrl(input.github_issue_url)) {
+      return input.github_issue_url === void 0 || input.github_issue_url === null || input.github_issue_url === "" ? deny2(
+        "github_issue_url_missing",
+        "closing with disposition='migrated' requires github_issue_url \u2014 the GitHub Issue this bug was moved to"
+      ) : deny2(
+        "github_issue_url_invalid",
+        "github_issue_url must be a URL of the form https://github.com/AskExe/<repo>/issues/<n>"
+      );
+    }
+    return ok2;
+  }
   const reason = str3(input.disposition_reason).replace(/\s+/g, " ");
   if (!reason) {
     return deny2(

package/dist/{chunk-ZB34E2OV.js → chunk-4O7OUBEX.js}

@@ -1,6 +1,6 @@
 import {
   isCrdtSyncEnabled
-} from "./chunk-BER2YLZT.js";
+} from "./chunk-BPBEJD7U.js";
 import {
   compress,
   decompress
@@ -8,14 +8,14 @@ import {
 import {
   orgMembershipsPath,
   orgModeActive
-} from "./chunk-MLIRYXZ2.js";
+} from "./chunk-K7DAE2HO.js";
 import {
   activeRecipientPubKeys,
   grantsPath,
   isGrantsMacPrimed,
   primeGrantsMacKey,
   warnActiveMonitoringOnce
-} from "./chunk-DDAOY3DL.js";
+} from "./chunk-TCV3WA5I.js";
 import {
   assertGateAndGrantsColocated
 } from "./chunk-NPXIS2RY.js";
@@ -25,7 +25,7 @@ import {
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-SPHPROWZ.js";
+} from "./chunk-F5ZRHLG5.js";
 import {
   isTransientDaemonTransportError,
   retryOnDaemonTransportError
@@ -36,17 +36,17 @@ import {
   encryptSyncBlob,
   initSyncCrypto,
   isSyncCryptoInitialized
-} from "./chunk-4MQDDFRN.js";
+} from "./chunk-OFT5KSBM.js";
 import {
   getClient,
   isGenuineCorruptionError,
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 import {
   loadDeviceId
-} from "./chunk-QHQW3VHV.js";
+} from "./chunk-DIKLSAJE.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -72,7 +72,7 @@ var _lastSealOrgMode = null;
 async function getSyncCipher() {
   if (_resolved) return _resolved;
   if (!orgModeActive()) {
-    const mod = await import("./founder-monitor-envelope-JYFWXZQ4.js");
+    const mod = await import("./founder-monitor-envelope-TLOC4UYG.js");
     _monitoredWriter = mod.encryptMonitoredSyncBlob;
     _founderModuleLinked = true;
   }
@@ -1283,7 +1283,7 @@ async function cloudSync(config, options) {
           })
         };
         if (shouldUseCrdtMergeForCloudSync()) {
-          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-GE6DVV2F.js");
+          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-IX43KVQ3.js");
           initCrdtDoc();
           importExistingMemories(
             pullResult.records.map((rec) => ({
@@ -1844,7 +1844,7 @@ async function cloudSync(config, options) {
     const artifactResult = { pushed: 0, frozen: false, remaining: 0 };
     if (!shouldSkip("artifacts")) {
       try {
-        const { flushArtifactBackups } = await import("./artifact-backup-4GCKVN3V.js");
+        const { flushArtifactBackups } = await import("./artifact-backup-6O4FNYPS.js");
         const flushed = await flushArtifactBackups(cloudArtifactTransport(config));
         artifactResult.pushed = flushed.pushed;
         artifactResult.frozen = flushed.frozen;

package/dist/{chunk-Z5ERWCOL.js → chunk-4Q7H3TO7.js}

@@ -6,7 +6,7 @@ import {
   baseAgentName,
   getEmployee,
   loadEmployeesSync
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 
 // src/lib/project-name.ts
 import { execSync } from "child_process";

package/dist/{chunk-YTP6L76N.js → chunk-4RQ62XXK.js}

@@ -1,17 +1,17 @@
 import {
   isExeSession,
   strictSessionScopeFilter
-} from "./chunk-7VSPHUIB.js";
+} from "./chunk-XAGIZVYI.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-RHEIOXVL.js";
+} from "./chunk-SA66WRBT.js";
 import {
   getProjectName
-} from "./chunk-Z5ERWCOL.js";
+} from "./chunk-4Q7H3TO7.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 import {
   loadConfigSync
 } from "./chunk-MMS2HBRT.js";
@@ -260,7 +260,7 @@ function createRealDeps(getClient) {
       });
     },
     createReviewForOrphan: async (task) => {
-      const { createReviewForCompletedTask } = await import("./tasks-review-EAOT3SKK.js");
+      const { createReviewForCompletedTask } = await import("./tasks-review-APRNSHMQ.js");
       const cwd = process.cwd();
       await createReviewForCompletedTask(
         task,

package/dist/{chunk-VDSAXP3N.js → chunk-4S6H2NWS.js}

@@ -11,11 +11,11 @@ import {
 } from "./chunk-SO7KTH3Q.js";
 import {
   RUNTIME_TABLE
-} from "./chunk-3VW5ZP2F.js";
+} from "./chunk-UWGQNJIE.js";
 import {
   getMasterKey,
   setMasterKey
-} from "./chunk-NF7JS7XW.js";
+} from "./chunk-KIJRAZWR.js";
 import {
   WINDOWS_UNSUPPORTED_EXIT,
   isWSL,
@@ -1210,9 +1210,9 @@ async function runSetupWizard(opts = {}) {
         rtChoice = await askOrEnv("Choose your AI runtime [1]: ", "EXE_RUNTIME", "1");
       }
       const rtMap = {
-        "1": { runtime: "claude", defaultModel: "claude-sonnet-5" },
+        "1": { runtime: "claude", defaultModel: "claude-opus-5.5" },
         "2": { runtime: "codex", defaultModel: RUNTIME_TABLE.codex.defaultModel },
-        "3": { runtime: "opencode", defaultModel: "anthropic/claude-sonnet-5" }
+        "3": { runtime: "opencode", defaultModel: "anthropic/claude-opus-5-5" }
       };
       const selected = rtMap[rtChoice.trim()] ?? rtMap["1"];
       const chosenModel = selected.defaultModel;

package/dist/{chunk-DXZRXNIC.js → chunk-4W7Y67B5.js}

@@ -1,7 +1,7 @@
 import {
   completeReminder,
   formatAmbiguousReminder
-} from "./chunk-VFUMCL6H.js";
+} from "./chunk-W2VDJKTB.js";
 
 // src/mcp/tools/complete-reminder.ts
 import { z } from "zod";

package/dist/{chunk-SS3FTK77.js → chunk-52Z435PH.js}

@@ -1,6 +1,6 @@
 import {
   extractSemanticText
-} from "./chunk-77EIMVAX.js";
+} from "./chunk-5N34MMKS.js";
 import {
   detectError
 } from "./chunk-G2M7WQ2M.js";
@@ -9,10 +9,13 @@ import {
 } from "./chunk-5MOYSU5A.js";
 import {
   redactSecrets
-} from "./chunk-T4IDLAZM.js";
+} from "./chunk-BYP3DOUU.js";
+import {
+  resolveExeSession
+} from "./chunk-XAGIZVYI.js";
 import {
   getProjectName
-} from "./chunk-Z5ERWCOL.js";
+} from "./chunk-4Q7H3TO7.js";
 
 // src/lib/post-tool-memory.ts
 var NON_INGESTIBLE_TOOLS = /* @__PURE__ */ new Set([
@@ -59,6 +62,7 @@ Output: ${outputPreview}`;
     projectName,
     toolName: data.tool_name
   });
+  const sessionScope = resolveExeSession() ?? void 0;
   return {
     raw_text: contextualizedRawText,
     agent_id: agent.agentId,
@@ -68,6 +72,7 @@ Output: ${outputPreview}`;
     session_id: data.session_id,
     has_error: hasError,
     timestamp,
+    ...sessionScope ? { session_scope: sessionScope } : {},
     ...meta?.subagentAgentType ? { subagent_agent_type: meta.subagentAgentType } : {},
     trajectory: JSON.stringify({
       input: toolInputStr,

package/dist/{chunk-77EIMVAX.js → chunk-5N34MMKS.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-T4IDLAZM.js";
+} from "./chunk-BYP3DOUU.js";
 import {
   isExeMcpTool,
   stripExeMcpPrefix

package/dist/{chunk-UMLDPQ24.js → chunk-6EY6OFBC.js}

@@ -1,14 +1,14 @@
 import {
   deactivateBehavior,
   listBehaviors
-} from "./chunk-SPHPROWZ.js";
+} from "./chunk-F5ZRHLG5.js";
 import {
   IdentityConflictError,
   IdentityLockError,
   getIdentity,
   mutateIdentity,
   withIdentityLock
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 
 // src/lib/behavior-promotion.ts
 var PROMOTED_SECTION_HEADING = "## Promoted lessons (permanent \u2014 promoted from behaviours)";

package/dist/{chunk-IMI5ZAOA.js → chunk-6JLVCMKH.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-ZGRLIQLE.js → chunk-6RRPVE5O.js}

@@ -1,15 +1,15 @@
 import {
   derivePartnerSealIdentityFromMaster
-} from "./chunk-CP6XE35Z.js";
+} from "./chunk-BHDDDNC6.js";
 import {
   derivePartnerSignIdentityFromMaster,
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   ed25519PublicKeyFromRaw
-} from "./chunk-ERIXGUSV.js";
+} from "./chunk-GPWXUU3L.js";
 import {
   getMasterKey
-} from "./chunk-NF7JS7XW.js";
+} from "./chunk-KIJRAZWR.js";
 
 // src/lib/org-key-epoch.ts
 import crypto, { sign as edSign, verify as edVerify } from "crypto";

package/dist/{chunk-6SJ4SKWZ.js → chunk-6TB7UXCA.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 
 // src/lib/boot-generation.ts
 var SYNC_META_KEY = "daemon_boot_generation";

package/dist/{chunk-342ZBEDI.js → chunk-6ZW6BRI4.js}

@@ -1,9 +1,9 @@
 import {
   getActiveAgent
-} from "./chunk-FEJK36FV.js";
+} from "./chunk-OISOA6NX.js";
 import {
   loadEmployeesSync
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 import {
   resolveMcpHttpPort
 } from "./chunk-B6TI3TZT.js";

package/dist/{chunk-5QJEJA5H.js → chunk-7I6KVKFF.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-EVMOKRBC.js";
 import {
   registerDaemonScopedQueryChokepoint
-} from "./chunk-KZSBPAEJ.js";
+} from "./chunk-QPMKVSHU.js";
 import {
   orgPartnerModeActive,
   requireOrgPartnerBinding,
   resolveOrgPartnerBindings,
   resolvePartnerIdentities,
   rosterKeyLookupFor
-} from "./chunk-6GBGKSNQ.js";
+} from "./chunk-WYNIWJRN.js";
 import {
   createDerivedSeqStore,
   createMailboxOpener,
@@ -20,7 +20,7 @@ import {
   isConsentMacPrimed,
   primeTaskOriginMarkerKey,
   scopedQueryChokepointStatus
-} from "./chunk-TRZXFWRO.js";
+} from "./chunk-DACRR362.js";
 import {
   flushMailboxOutbox
 } from "./chunk-3FGBBJYM.js";

package/dist/{chunk-4SLKFUA7.js → chunk-7LTAA55U.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 import {
   loadConfigSync
 } from "./chunk-MMS2HBRT.js";
@@ -136,6 +136,10 @@ var MODEL_PRICING = {
   // per 1M tokens. cacheRead = input * 0.1, cacheWrite = input * 1.25,
   // matching every other entry in this table.
   "claude-sonnet-5": { input: 2 / 1e6, output: 10 / 1e6, cacheRead: 0.2 / 1e6, cacheWrite: 2.5 / 1e6 },
+  // Opus 5.5 (newest, platform default since 2026-09-30): tier assumption —
+  // same Opus tier as Opus 5 ($5/$25). Confirm against Anthropic's published
+  // pricing once 5.5 pricing is public.
+  "claude-opus-5-5": { input: 5 / 1e6, output: 25 / 1e6, cacheRead: 0.5 / 1e6, cacheWrite: 6.25 / 1e6 },
   "claude-opus-5": { input: 5 / 1e6, output: 25 / 1e6, cacheRead: 0.5 / 1e6, cacheWrite: 6.25 / 1e6 },
   "claude-fable-5": { input: 10 / 1e6, output: 50 / 1e6, cacheRead: 1 / 1e6, cacheWrite: 12.5 / 1e6 },
   // Opus 4.5+ ($5/$25 — Anthropic price drop from original Opus 4)

package/dist/{chunk-FKANX6A7.js → chunk-7P2TDFZL.js}

@@ -1,7 +1,7 @@
 import {
   checkLicense,
   loadLicense
-} from "./chunk-QHQW3VHV.js";
+} from "./chunk-DIKLSAJE.js";
 
 // src/lib/license-gate.ts
 var _cachedLicense = null;

package/dist/{chunk-SLJDYBLE.js → chunk-7R7KDRKV.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-HPDR3EL7.js";
+} from "./chunk-3MDUKF3N.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-NRLJOV7M.js → chunk-7YX73K2R.js}

@@ -1,3 +1,7 @@
+import {
+  LockTimeoutError,
+  withLock
+} from "./chunk-5WA4DG2A.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -37,6 +41,26 @@ function projectScopedDefShadows(cwd, agentName) {
 
 // src/lib/subagent-spawn-ledger.ts
 var LEDGER_DIR = path2.join(EXE_AI_DIR, "session-cache");
+var LEDGER_LOCK_GIVE_UP_MS = 1500;
+function ledgerLockDir(file) {
+  return `${file}.lock`;
+}
+async function withLedgerLock(file, fn) {
+  try {
+    mkdirSync(LEDGER_DIR, { recursive: true });
+  } catch {
+  }
+  try {
+    return await withLock(ledgerLockDir(file), fn, { giveUpAfterMs: LEDGER_LOCK_GIVE_UP_MS });
+  } catch (err) {
+    if (err instanceof LockTimeoutError) {
+      process.stderr.write(`[subagent-ledger] lock timeout, skipping this write: ${file}
+`);
+      return void 0;
+    }
+    throw err;
+  }
+}
 var SPAWN_LEDGER_TTL_MS = 6 * 60 * 60 * 1e3;
 var MAX_ENTRIES_PER_SESSION = 200;
 function ledgerPath(sessionId) {
@@ -76,37 +100,38 @@ function isLive(entry, now) {
   const ts = Date.parse(entry.ts);
   return Number.isFinite(ts) && now - ts >= 0 && now - ts <= SPAWN_LEDGER_TTL_MS;
 }
-function recordSubagentSpawn(sessionId, agentType, bindable = true) {
+async function recordSubagentSpawn(sessionId, agentType, bindable = true) {
   try {
     const file = ledgerPath(sessionId);
     const type = agentType.trim().toLowerCase();
     if (!file || !type) return;
-    mkdirSync(LEDGER_DIR, { recursive: true });
-    const now = Date.now();
-    let entries;
-    try {
-      entries = readEntries(file).filter((e) => isLive(e, now));
-    } catch (err) {
-      if (isUnreadableLedger(err)) {
-        process.stderr.write(
-          `[subagent-ledger] not recording a spawn: ${file} exists but could not be read (${err instanceof Error ? err.message : String(err)}); rewriting it would drop the entries already in it.
+    await withLedgerLock(file, () => {
+      const now = Date.now();
+      let entries;
+      try {
+        entries = readEntries(file).filter((e) => isLive(e, now));
+      } catch (err) {
+        if (isUnreadableLedger(err)) {
+          process.stderr.write(
+            `[subagent-ledger] not recording a spawn: ${file} exists but could not be read (${err instanceof Error ? err.message : String(err)}); rewriting it would drop the entries already in it.
 `
-        );
-        return;
+          );
+          return;
+        }
+        throw err;
       }
-      throw err;
-    }
-    entries.push({
-      session_id: sessionId,
-      agent_type: type,
-      ts: new Date(now).toISOString(),
-      bindable
+      entries.push({
+        session_id: sessionId,
+        agent_type: type,
+        ts: new Date(now).toISOString(),
+        bindable
+      });
+      writeFileSync(file, JSON.stringify(entries.slice(-MAX_ENTRIES_PER_SESSION)));
     });
-    writeFileSync(file, JSON.stringify(entries.slice(-MAX_ENTRIES_PER_SESSION)));
   } catch {
   }
 }
-function recordSpawnFromPreToolPayload(payload) {
+async function recordSpawnFromPreToolPayload(payload) {
   if (!payload || typeof payload !== "object") return false;
   const p = payload;
   if (p.tool_name !== "Task" && p.tool_name !== "Agent") return false;
@@ -117,7 +142,7 @@ function recordSpawnFromPreToolPayload(payload) {
   if (typeof sub !== "string" || sub.trim().length === 0) return false;
   const cwd = typeof p.cwd === "string" && p.cwd.trim().length > 0 ? p.cwd.trim() : null;
   const bindable = !projectScopedDefShadows(cwd, sub.trim());
-  recordSubagentSpawn(sessionId, sub, bindable);
+  await recordSubagentSpawn(sessionId, sub, bindable);
   return true;
 }
 function hasLiveSubagentSpawn(sessionId, agentType) {
@@ -150,57 +175,71 @@ function lastSubagentSpawnAt(sessionId) {
     return null;
   }
 }
-function tryMarkSubagentBriefInjected(sessionId, agentType, agentInstanceId) {
+async function tryMarkSubagentBriefInjected(sessionId, agentType, agentInstanceId) {
   try {
     const file = ledgerPath(sessionId);
     const type = agentType.trim().toLowerCase();
     if (!file || !type) return false;
-    const now = Date.now();
-    const raw = sessionId;
-    const entries = readEntries(file).filter((e) => isLive(e, now));
-    const instanceId = typeof agentInstanceId === "string" && agentInstanceId.trim().length > 0 ? agentInstanceId.trim() : void 0;
-    const alreadyInjected = entries.some((e) => e.session_id === raw && e.agent_type === type && e.brief_injected_at && (instanceId === void 0 || e.brief_injected_agent_id === instanceId));
-    if (alreadyInjected) return false;
-    const entry = entries.find((e) => e.session_id === raw && e.agent_type === type && e.bindable === true && !e.brief_injected_at);
-    if (!entry) return false;
-    entry.brief_injected_at = new Date(now).toISOString();
-    if (instanceId) entry.brief_injected_agent_id = instanceId;
-    writeFileSync(file, JSON.stringify(entries));
-    return true;
+    const result = await withLedgerLock(file, () => {
+      const now = Date.now();
+      const raw = sessionId;
+      const entries = readEntries(file).filter((e) => isLive(e, now));
+      const instanceId = typeof agentInstanceId === "string" && agentInstanceId.trim().length > 0 ? agentInstanceId.trim() : void 0;
+      const alreadyInjected = entries.some((e) => e.session_id === raw && e.agent_type === type && e.brief_injected_at && (instanceId === void 0 || e.brief_injected_agent_id === instanceId));
+      if (alreadyInjected) return false;
+      const entry = entries.find((e) => e.session_id === raw && e.agent_type === type && e.bindable === true && !e.brief_injected_at);
+      if (!entry) return false;
+      entry.brief_injected_at = new Date(now).toISOString();
+      if (instanceId) entry.brief_injected_agent_id = instanceId;
+      writeFileSync(file, JSON.stringify(entries));
+      return true;
+    });
+    return result ?? false;
   } catch {
     return false;
   }
 }
-function clearSubagentSpawn(sessionId, agentType) {
+function findStoppingEntryIndex(entries, type, sessionId, agentInstanceId) {
+  const instanceId = typeof agentInstanceId === "string" && agentInstanceId.trim().length > 0 ? agentInstanceId.trim() : void 0;
+  if (instanceId === void 0) {
+    return entries.findIndex((e) => e.agent_type === type && e.session_id === sessionId);
+  }
+  const exact = entries.findIndex((e) => e.agent_type === type && e.session_id === sessionId && e.brief_injected_agent_id === instanceId);
+  if (exact >= 0) return exact;
+  return entries.findIndex((e) => e.agent_type === type && e.session_id === sessionId && e.brief_injected_agent_id === void 0);
+}
+async function clearSubagentSpawn(sessionId, agentType, agentInstanceId) {
   try {
     const file = ledgerPath(sessionId);
     const type = agentType.trim().toLowerCase();
     if (!file || !type) return;
-    const now = Date.now();
-    const raw = sessionId;
-    let entries;
-    try {
-      entries = readEntries(file).filter((e) => isLive(e, now));
-    } catch (err) {
-      if (isUnreadableLedger(err)) {
-        process.stderr.write(
-          `[subagent-ledger] not clearing a spawn: ${file} exists but could not be read (${err instanceof Error ? err.message : String(err)}); an unreadable ledger is not an empty one and must not be deleted.
+    await withLedgerLock(file, () => {
+      const now = Date.now();
+      const raw = sessionId;
+      let entries;
+      try {
+        entries = readEntries(file).filter((e) => isLive(e, now));
+      } catch (err) {
+        if (isUnreadableLedger(err)) {
+          process.stderr.write(
+            `[subagent-ledger] not clearing a spawn: ${file} exists but could not be read (${err instanceof Error ? err.message : String(err)}); an unreadable ledger is not an empty one and must not be deleted.
 `
-        );
-        return;
+          );
+          return;
+        }
+        throw err;
       }
-      throw err;
-    }
-    const idx = entries.findIndex((e) => e.agent_type === type && e.session_id === raw);
-    if (idx >= 0) entries.splice(idx, 1);
-    if (entries.length === 0) {
-      try {
-        unlinkSync(file);
-      } catch {
+      const idx = findStoppingEntryIndex(entries, type, raw, agentInstanceId);
+      if (idx >= 0) entries.splice(idx, 1);
+      if (entries.length === 0) {
+        try {
+          unlinkSync(file);
+        } catch {
+        }
+      } else {
+        writeFileSync(file, JSON.stringify(entries));
       }
-    } else {
-      writeFileSync(file, JSON.stringify(entries));
-    }
+    });
   } catch {
   }
 }