@code-yeongyu/senpi 2026.10.10-10 → 2026.10.10-12

package/dist/modes/rpc/session-command-router.js

@@ -8,6 +8,7 @@ import { RPC_ERROR_INVALID_LAUNCH_PROFILE, RPC_ERROR_INVALID_SESSION_CONTEXT, RP
 import { runWithSessionAttribution } from "./session-attribution.js";
 import { createRpcSessionBinding } from "./session-binding.js";
 import { readDrainVerdicts } from "./session-drain.js";
+import { dispatchSessionBinding, sessionHeldCheck } from "./session-held.js";
 import { RpcSessionRegistryError } from "./session-registry.js";
 import { releaseSession } from "./session-release.js";
 import { selectSweepEvictions } from "./session-sweep.js";
@@ -250,20 +251,14 @@ export class SessionCommandRouter {
         }
         if (!command.sessionId)
             return error(command.id, command.type, RPC_ERROR_MISSING_SESSION_ID);
+        const sessionId = command.sessionId;
         try {
-            this.registry.getForCommand(command.sessionId, command.type);
-            const binding = this.bindings.get(command.sessionId);
-            if (!binding)
-                return error(command.id, command.type, RPC_ERROR_UNKNOWN_SESSION);
-            // A prompt's preflight runs on the session's loop and can outlive the client's request deadline on a
-            // starved host; acknowledging receipt first lets the client wait it out (senpi#2871).
-            if (command.type === "prompt")
-                this.acknowledgePrompt(command.id, command.sessionId);
-            await binding.handle(command);
+            const entry = this.registry.getForCommand(sessionId, command.type);
+            await dispatchSessionBinding(command, entry, this.bindings.get(sessionId), () => this.acknowledgePrompt(command.id, sessionId), (observedStarts) => this.registry.holderPids?.(observedStarts) ?? Promise.resolve([]));
             return undefined;
         }
         catch (cause) {
-            return error(command.id, command.type, this.code(cause));
+            return error(command.id, command.type, this.code(cause), this.detail(cause));
         }
     }
     async dispose() {
@@ -483,7 +478,9 @@ export class SessionCommandRouter {
         if (retryFallbackError)
             return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${retryFallbackError}`);
         let opened;
+        const assertSessionNotHeld = sessionHeldCheck((observedStarts) => this.registry.holderPids?.(observedStarts) ?? Promise.resolve([]));
         try {
+            await assertSessionNotHeld(command.sessionPath);
             opened = await this.registry.openSession({
                 cwd: command.cwd ?? this.defaults.cwd,
                 sessionPath: command.sessionPath,
@@ -506,6 +503,10 @@ export class SessionCommandRouter {
             { retainOnDisconnect: command.retain_on_disconnect === true });
             const openedSession = opened;
             const entry = this.registry.getForCommand(openedSession.sessionId, "open_session");
+            const state = entry.worker?.snapshot?.state;
+            // The runtime has now published its own lease. Recheck before attaching or replying,
+            // so an opener racing the initial lookup is rolled back rather than admitted.
+            await assertSessionNotHeld(entry.runtime?.session.sessionFile ?? state?.sessionFile ?? entry.sessionPath, entry.runtime?.session.sessionId ?? state?.sessionId ?? entry.durableSessionId);
             this.writer.setSessionKind(openedSession.sessionId, entry.kind);
             this.writer.setSessionMedia(openedSession.sessionId, toolMediaPersister(() => liveToolMediaScope(entry)));
             if (owner !== undefined) {
@@ -567,8 +568,8 @@ export class SessionCommandRouter {
                 this.releaseOwnerAttachment(owner, openedSession.sessionId);
                 await this.releaseOwnedSession(openedSession.sessionId);
             }
-            const state = entry.worker?.snapshot?.state ?? (entry.runtime ? buildRpcSessionState(entry.runtime.session) : undefined);
-            if (!state)
+            const replyState = entry.worker?.snapshot?.state ?? (entry.runtime ? buildRpcSessionState(entry.runtime.session) : undefined);
+            if (!replyState)
                 throw new Error("Session state was not created");
             this.writer.enqueue(opened.sessionId, {
                 id: command.id,
@@ -577,7 +578,7 @@ export class SessionCommandRouter {
                 success: true,
                 data: {
                     sessionId: opened.sessionId,
-                    state,
+                    state: replyState,
                     ...(opened.attached ? { attached: true } : {}),
                 },
             });
@@ -586,7 +587,10 @@ export class SessionCommandRouter {
         catch (cause) {
             if (opened) {
                 try {
-                    await this.registry.close(opened.sessionId);
+                    if (opened.attached)
+                        await this.releaseOwnedSession(opened.sessionId);
+                    else
+                        await this.registry.close(opened.sessionId);
                 }
                 catch {
                     /* The open rollback has already removed the entry. */

package/dist/modes/rpc/session-held.d.ts

@@ -0,0 +1,8 @@
+import type { RpcInboundRecord } from "./rpc-types.ts";
+import type { RpcSessionBinding } from "./session-binding.ts";
+import { type RpcSessionEntry } from "./session-registry-types.ts";
+/** Fresh leases at each boundary; daemon identity resolution is lazy and scoped to one command. */
+export declare function sessionHeldCheck(resolveDaemonPids?: (observedStarts: ReadonlyMap<number, number | undefined>) => Promise<readonly number[]>): (sessionFile: string | undefined, sessionId?: string) => Promise<void>;
+/** The session-command admission boundary shared by in-process and worker hosts. */
+export declare function dispatchSessionBinding(command: RpcInboundRecord, entry: RpcSessionEntry, binding: RpcSessionBinding | undefined, acknowledgePrompt: () => void, daemonPids?: (observedStarts: ReadonlyMap<number, number | undefined>) => Promise<readonly number[]>): Promise<void>;
+//# sourceMappingURL=session-held.d.ts.map

package/dist/modes/rpc/session-held.js

@@ -0,0 +1,127 @@
+import { execFile } from "node:child_process";
+import { readProcessStartMs } from "../../core/extensions/builtin/terminal/process-start-probe.js";
+import { foreignSessionHolders } from "../../core/foreign-session-holders.js";
+import { processStartTimeMs } from "../app-server/daemon/process.js";
+import { RPC_ERROR_SESSION_HELD } from "./rpc-types.js";
+import { RpcSessionRegistryError } from "./session-registry-types.js";
+// Admission is conservative: a new command must pass the guard unless it is explicitly
+// a read or a control needed to finish/cancel an already-admitted turn.
+const READ_ONLY_OR_CONTROL = new Set([
+    "get_state",
+    "get_steering_messages",
+    "get_follow_up_messages",
+    "get_available_models",
+    "get_available_thinking_levels",
+    "get_fast_mode",
+    "get_session_stats",
+    "get_fork_messages",
+    "get_entries",
+    "get_tree",
+    "get_last_assistant_text",
+    "get_messages",
+    "get_media",
+    "get_commands",
+    "get_loaded_surfaces",
+    "get_auth_providers",
+    "get_provider_accounts",
+    "memory_report",
+    "export_html",
+    "export_jsonl",
+    "abort",
+    "interrupt",
+    "abort_compaction",
+    "abort_branch_summary",
+    "abort_retry",
+    "abort_bash",
+    "clear_queue",
+    "check_reload_veto",
+    "cleanup_bash_output",
+    "set_client_info",
+    "extension_ui_response",
+    "extension_ui_progress",
+]);
+/** One bounded identity snapshot for all foreign PIDs, never one subprocess per lease. */
+function readProcessStarts() {
+    const windows = process.platform === "win32";
+    const command = windows ? "powershell.exe" : "ps";
+    const args = windows
+        ? [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            'Get-CimInstance Win32_Process -ErrorAction Stop | ForEach-Object { if ($null -ne $_.CreationDate) { "{0} {1}" -f $_.ProcessId, $_.CreationDate.ToUniversalTime().ToString("o") } }',
+        ]
+        : ["-axo", "pid=,lstart="];
+    return new Promise((resolve) => {
+        execFile(command, args, {
+            timeout: windows ? 5_000 : 1_000,
+            maxBuffer: 4 * 1024 * 1024,
+            windowsHide: true,
+            ...(windows ? {} : { env: { ...process.env, LC_ALL: "C", LANG: "C" } }),
+        }, (error, stdout) => {
+            if (error)
+                return resolve(undefined);
+            const starts = new Map();
+            for (const line of stdout.split("\n")) {
+                const row = /^\s*(\d+)\s+(.+)$/.exec(line);
+                if (!row)
+                    continue;
+                const start = processStartTimeMs(row[2]);
+                if (start !== undefined)
+                    starts.set(Number(row[1]), start);
+            }
+            resolve(starts);
+        });
+    });
+}
+/** Fresh leases at each boundary; daemon identity resolution is lazy and scoped to one command. */
+export function sessionHeldCheck(resolveDaemonPids) {
+    let daemonPids;
+    let processStarts;
+    const pidStarts = new Map();
+    const observedStarts = new Map();
+    return async (sessionFile, sessionId) => {
+        const holders = await foreignSessionHolders(sessionFile, sessionId, {
+            readProcessStartMs: (pid) => {
+                let probe = pidStarts.get(pid);
+                if (!probe) {
+                    probe = (async () => {
+                        if (process.platform !== "linux")
+                            processStarts ??= readProcessStarts();
+                        const starts = await processStarts;
+                        const start = starts?.get(pid) ?? (await readProcessStartMs(pid));
+                        observedStarts.set(pid, start);
+                        return start;
+                    })();
+                    pidStarts.set(pid, probe);
+                }
+                return probe;
+            },
+        });
+        if (holders.length === 0)
+            return;
+        daemonPids ??= resolveDaemonPids?.(observedStarts) ?? Promise.resolve([]);
+        const family = await daemonPids;
+        const foreign = holders.filter((holder) => !family.includes(holder.pid));
+        if (foreign.length > 0)
+            throw new RpcSessionRegistryError(RPC_ERROR_SESSION_HELD, undefined, {
+                holders: foreign.map(({ pid, cwd }) => ({ pid, ...(cwd === undefined ? {} : { cwd }) })),
+            });
+    };
+}
+/** The session-command admission boundary shared by in-process and worker hosts. */
+export async function dispatchSessionBinding(command, entry, binding, acknowledgePrompt, daemonPids) {
+    if (!binding)
+        throw new RpcSessionRegistryError("unknown_session");
+    if (!READ_ONLY_OR_CONTROL.has(command.type)) {
+        const assertSessionNotHeld = sessionHeldCheck(daemonPids);
+        const state = entry.worker?.snapshot?.state;
+        await assertSessionNotHeld(entry.runtime?.session.sessionFile ?? state?.sessionFile ?? entry.sessionPath, entry.runtime?.session.sessionId ?? state?.sessionId ?? entry.durableSessionId);
+        if ("sessionPath" in command)
+            await assertSessionNotHeld(command.sessionPath);
+    }
+    if (command.type === "prompt")
+        acknowledgePrompt();
+    await binding.handle(command);
+}
+//# sourceMappingURL=session-held.js.map

package/dist/modes/rpc/session-registry-types.d.ts

@@ -63,7 +63,7 @@ export interface RpcSessionEntry {
     closeStarted?: boolean;
 }
 export declare class RpcSessionRegistryError extends Error {
-    readonly code: "unknown_session" | "session_closing" | "session_path_in_use" | "session_id_in_use" | "session_reservation_limit" | "invalid_path" | "invalid_session_id" | "open_failed";
+    readonly code: "unknown_session" | "session_closing" | "session_path_in_use" | "session_held" | "session_id_in_use" | "session_reservation_limit" | "invalid_path" | "invalid_session_id" | "open_failed";
     /** Machine-readable context for the wire (`errorData`): who holds a path, when to retry. */
     readonly detail?: Readonly<Record<string, unknown>>;
     constructor(code: RpcSessionRegistryError["code"], reason?: string, detail?: Readonly<Record<string, unknown>>);

package/dist/modes/rpc/session-registry.d.ts

@@ -15,6 +15,8 @@ export declare class RpcSessionRegistry {
     constructor(options: RpcSessionRegistryOptions);
     /** Number of live entries, including ones still opening or closing. */
     get size(): number;
+    /** Daemon-family identities come from the endpoint's claims and generation registry. */
+    holderPids(observedStarts?: ReadonlyMap<number, number | undefined>): Promise<readonly number[]>;
     openSession(requested: RpcSessionLaunchProfile, options?: RpcSessionOpenOptions): Promise<OpenRpcSession>;
     /**
      * Read-only lookup with no state transitions or attachment accounting.

package/dist/modes/rpc/session-registry.js

@@ -56,6 +56,10 @@ export class RpcSessionRegistry {
     get size() {
         return this.entries.size;
     }
+    /** Daemon-family identities come from the endpoint's claims and generation registry. */
+    holderPids(observedStarts) {
+        return this.options.pathReservations?.holderPids?.(observedStarts) ?? Promise.resolve([]);
+    }
     async openSession(requested, options) {
         this.validateProfile(requested);
         const profile = resolveMovedProfile(requested);

package/dist/modes/rpc/session-worker-client.d.ts

@@ -9,10 +9,10 @@ import type { RpcSessionLaunchProfile } from "./session-registry.ts";
 import type { SessionWriteGrant, WorkerSnapshot } from "./session-worker-protocol.ts";
 /** Lifecycle hooks the owning registry installs on every worker it allocates. */
 export interface SessionWorkerCallbacks {
-    reserve: (path: string) => SessionWriteGrant;
+    reserve: (path: string) => SessionWriteGrant | Promise<SessionWriteGrant>;
     /** Every snapshot republishes which paths this worker still writes. */
-    reconcile: (livePaths: readonly string[]) => void;
-    exit: () => void;
+    reconcile: (livePaths: readonly string[]) => void | Promise<void>;
+    exit: () => void | Promise<void>;
     failure: (error: string) => void;
 }
 export declare class SessionWorkerClient {

package/dist/modes/rpc/session-worker-client.js

@@ -24,7 +24,7 @@ export class SessionWorkerClient {
         this.listeners = new Set();
         this.cancelUiPending = false;
         this.callbacks = callbacks;
-        this.exited = new Promise((resolve) => {
+        this.exited = new Promise((resolve, reject) => {
             this.worker.once("exit", () => {
                 if (!this.stopped && !this.closeTimer)
                     this.fail("session_worker_exited");
@@ -34,9 +34,16 @@ export class SessionWorkerClient {
                 this.requests.close(new Error("session_worker_exited"));
                 void this.webviewBroker?.dispose();
                 this.listeners.clear();
-                callbacks.exit();
-                this.publishTerminalFailure();
-                resolve();
+                const released = callbacks.exit();
+                if (released)
+                    void released.then(() => {
+                        this.publishTerminalFailure();
+                        resolve();
+                    }, reject);
+                else {
+                    this.publishTerminalFailure();
+                    resolve();
+                }
             });
         });
         this.worker.on("message", (message) => this.receive(message));
@@ -141,18 +148,24 @@ export class SessionWorkerClient {
             case "ready":
             case "result": {
                 this.requests.receive(message);
+                if (this.snapshot)
+                    void Promise.resolve(this.callbacks.reconcile(this.snapshot.liveSessionPaths)).catch(() => this.fail("session_claim_reconcile_failed"));
                 return;
             }
             case "reserve":
-                acknowledgeGrant(message.signal, this.callbacks.reserve(message.path));
+                void Promise.resolve(this.callbacks.reserve(message.path)).then((grant) => acknowledgeGrant(message.signal, this.stopped ? "conflict" : grant), () => acknowledgeGrant(message.signal, "conflict"));
                 return;
             case "snapshot":
                 this.snapshot = message.snapshot;
-                this.callbacks.reconcile(message.snapshot.liveSessionPaths);
-                acknowledge(message.signal, true);
-                if (message.settled)
-                    for (const listener of [...this.listeners])
-                        listener();
+                void Promise.resolve(this.callbacks.reconcile(message.snapshot.liveSessionPaths)).then(() => {
+                    acknowledge(message.signal, !this.stopped);
+                    if (message.settled)
+                        for (const listener of [...this.listeners])
+                            listener();
+                }, () => {
+                    acknowledge(message.signal, false);
+                    this.fail("session_claim_reconcile_failed");
+                });
                 return;
             case "control_done":
                 this.cancelUiPending = false;
@@ -167,7 +180,6 @@ export class SessionWorkerClient {
                 // Identity and activity commit before publication; clients may attach or disconnect on that event.
                 if (message.snapshot) {
                     this.snapshot = message.snapshot;
-                    this.callbacks.reconcile(message.snapshot.liveSessionPaths);
                 }
                 else if (this.snapshot)
                     this.snapshot = {
@@ -183,7 +195,7 @@ export class SessionWorkerClient {
                     }
                     return writer.waitForSessionBackpressure(sessionId);
                 };
-                const consumed = message.connection === undefined ? enqueue() : writer.withConnection(message.connection, enqueue);
+                const consumed = Promise.resolve(message.snapshot ? this.callbacks.reconcile(message.snapshot.liveSessionPaths) : undefined).then(() => message.connection === undefined ? enqueue() : writer.withConnection(message.connection, enqueue));
                 void consumed.then(() => acknowledge(message.signal, true), (cause) => {
                     acknowledge(message.signal, false);
                     this.fail(cause instanceof Error ? cause.message : String(cause));

package/dist/modes/rpc/worker-session-claims.d.ts

@@ -0,0 +1,15 @@
+import type { SessionPathOwner, SessionPathReservations } from "./host-reservations.ts";
+/** Claims precede write grants; native exit also removes claims whose publication is still pending. */
+export declare class WorkerSessionClaims {
+    private readonly reservations;
+    private readonly paths;
+    private readonly releases;
+    private closed;
+    constructor(reservations: SessionPathReservations | undefined);
+    claim(path: string, attached?: boolean): Promise<SessionPathOwner | undefined>;
+    setAttached(attached: boolean): void;
+    reconcile(livePaths: readonly string[], attached: boolean): void;
+    private release;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=worker-session-claims.d.ts.map

package/dist/modes/rpc/worker-session-claims.js

@@ -0,0 +1,61 @@
+import { RpcSessionRegistryError } from "./session-registry-types.js";
+/** Claims precede write grants; native exit also removes claims whose publication is still pending. */
+export class WorkerSessionClaims {
+    constructor(reservations) {
+        this.paths = new Map();
+        this.releases = new Set();
+        this.closed = false;
+        this.reservations = reservations;
+    }
+    async claim(path, attached = true) {
+        if (this.closed)
+            throw new RpcSessionRegistryError("session_closing");
+        if (!this.reservations)
+            return undefined;
+        const previous = this.paths.get(path);
+        if (previous)
+            return previous.ownership;
+        const record = { ownership: this.reservations.claim(path, attached), attached };
+        this.paths.set(path, record);
+        const owner = await record.ownership;
+        if (owner && this.paths.get(path) === record)
+            this.paths.delete(path);
+        return owner;
+    }
+    setAttached(attached) {
+        for (const [path, record] of this.paths) {
+            if (record.attached === attached)
+                continue;
+            record.attached = attached;
+            void record.ownership.then((owner) => {
+                if (!owner && this.paths.get(path) === record)
+                    this.reservations?.setAttached(path, record.attached);
+            });
+        }
+    }
+    reconcile(livePaths, attached) {
+        const live = new Set(livePaths);
+        for (const path of this.paths.keys())
+            if (!live.has(path))
+                void this.release(path);
+        this.setAttached(attached);
+    }
+    release(path) {
+        const record = this.paths.get(path);
+        if (!record)
+            return Promise.resolve();
+        this.paths.delete(path);
+        const removal = record.ownership.then(async (owner) => {
+            if (!owner)
+                await this.reservations?.release(path);
+        });
+        this.releases.add(removal);
+        void removal.then(() => this.releases.delete(removal), () => this.releases.delete(removal));
+        return removal;
+    }
+    async close() {
+        this.closed = true;
+        await Promise.all([...this.paths.keys()].map((path) => this.release(path)).concat([...this.releases]));
+    }
+}
+//# sourceMappingURL=worker-session-claims.js.map

package/dist/modes/rpc/worker-session-registry.d.ts

@@ -1,4 +1,5 @@
 import type { CliRuntimeConfiguration } from "../../main.ts";
+import { type SessionPathReservations as DaemonPathReservations } from "./host-reservations.ts";
 import { type OpenRpcSession, type RpcSessionEntry, type RpcSessionLaunchProfile, type RpcSessionOpenOptions, type RpcSessionRow } from "./session-registry.ts";
 import { SessionWorkerClient } from "./session-worker-client.ts";
 type SessionWorkerCallbacks = ConstructorParameters<typeof SessionWorkerClient>[0];
@@ -8,11 +9,13 @@ export interface WorkerSessionRegistryOptions {
     readonly now: () => number;
     /** Production builds the real worker; a caller may supply one to drive a lifecycle path deterministically. */
     readonly createWorker?: (callbacks: SessionWorkerCallbacks) => SessionWorkerClient;
+    readonly pathReservations?: DaemonPathReservations;
 }
 /** Transport-side lifecycle owner. Caller paths are never inspected on this event loop. */
 export declare class WorkerSessionRegistry {
     private readonly entries;
     private readonly reservations;
+    private readonly claims;
     private serial;
     readonly closeGraceMs: number;
     private readonly now;
@@ -20,6 +23,7 @@ export declare class WorkerSessionRegistry {
     private readonly createWorker;
     constructor(options: WorkerSessionRegistryOptions);
     get size(): number;
+    holderPids(observedStarts?: ReadonlyMap<number, number | undefined>): Promise<readonly number[]>;
     openSession(profile: RpcSessionLaunchProfile, options?: RpcSessionOpenOptions): Promise<OpenRpcSession>;
     peek(handle: string): RpcSessionEntry | undefined;
     getForCommand(handle: string, command: string): RpcSessionEntry;

package/dist/modes/rpc/worker-session-registry.js

@@ -1,16 +1,20 @@
 import { isAbsolute } from "node:path";
 import { ProviderScope } from "@earendil-works/pi-ai/node/provider-scope";
 import { assertValidSessionId } from "../../core/session-manager.js";
+import { SESSION_PATH_RETRY_AFTER_MS, } from "./host-reservations.js";
 import { refreshesSessionActivity } from "./session-command-activity.js";
 import { RESERVATION_DENIAL_CODES, SessionPathReservations, } from "./session-path-reservations.js";
 import { frozenProfile, RpcSessionRegistryError, sessionIdentity, } from "./session-registry.js";
+import { releaseWithinGrace } from "./session-teardown.js";
 import { SessionWorkerClient } from "./session-worker-client.js";
 import { SESSION_WORKER_LIMITS, typedWorkerRefusal } from "./session-worker-protocol.js";
+import { WorkerSessionClaims } from "./worker-session-claims.js";
 /** Transport-side lifecycle owner. Caller paths are never inspected on this event loop. */
 export class WorkerSessionRegistry {
     constructor(options) {
         this.entries = new Map();
         this.reservations = new SessionPathReservations();
+        this.claims = new Map();
         this.serial = 0;
         this.options = options;
         this.closeGraceMs = options.closeGraceMs;
@@ -20,6 +24,9 @@ export class WorkerSessionRegistry {
     get size() {
         return this.entries.size;
     }
+    holderPids(observedStarts) {
+        return this.options.pathReservations?.holderPids?.(observedStarts) ?? Promise.resolve([]);
+    }
     async openSession(profile, options) {
         if (!isAbsolute(profile.cwd) || (profile.sessionPath !== undefined && !isAbsolute(profile.sessionPath)))
             throw new RpcSessionRegistryError("invalid_path");
@@ -57,6 +64,8 @@ export class WorkerSessionRegistry {
         if (this.size >= SESSION_WORKER_LIMITS.workers)
             throw new Error("too_many_sessions");
         const handle = `rpc-${++this.serial}`;
+        const claims = new WorkerSessionClaims(this.options.pathReservations);
+        this.claims.set(handle, claims);
         const storedProfile = frozenProfile(profile);
         const entry = {
             state: "opening",
@@ -80,10 +89,16 @@ export class WorkerSessionRegistry {
             exit: () => {
                 if (this.entries.get(handle) !== entry)
                     return;
-                entry.state = "closed";
-                this.entries.delete(handle);
-                this.reservations.releaseAll(handle);
-                entry.closeResolve?.();
+                const finish = () => {
+                    if (this.entries.get(handle) !== entry)
+                        return;
+                    entry.state = "closed";
+                    this.entries.delete(handle);
+                    this.claims.delete(handle);
+                    this.reservations.releaseAll(handle);
+                    entry.closeResolve?.();
+                };
+                return releaseWithinGrace({ closeGraceMs: this.closeGraceMs, releaseReservation: () => claims.close() }, handle, entry.reservationKey ?? handle).then(finish);
             },
             failure: (error) => {
                 // The open below only learns that its entry left `opening`, never why. Without this the
@@ -105,7 +120,13 @@ export class WorkerSessionRegistry {
                 worker.quarantine();
                 return attached;
             }
-            const grant = this.reserve(handle, path);
+            const predecessor = await claims.claim(path);
+            if (predecessor)
+                throw new RpcSessionRegistryError("session_path_in_use", undefined, {
+                    owner: predecessor,
+                    retry_after_ms: SESSION_PATH_RETRY_AFTER_MS,
+                });
+            const grant = await this.reserve(handle, path);
             if (grant !== "granted")
                 throw new RpcSessionRegistryError(RESERVATION_DENIAL_CODES[grant]);
             entry.reservationKey = path;
@@ -163,6 +184,9 @@ export class WorkerSessionRegistry {
         // attachments; only an explicit close or eviction reaches the worker.
         if (options?.detach && entry.retainOnDisconnect) {
             entry.attachments = 0;
+            entry.detachedAt ??= this.now();
+            if (!entry.worker?.busy)
+                this.claims.get(handle)?.setAttached(false);
             return entry;
         }
         entry.state = "closing";
@@ -253,6 +277,7 @@ export class WorkerSessionRegistry {
         }
         const result = this.openResult(owner, entry);
         entry.attachments++;
+        this.claims.get(owner)?.setAttached(true);
         // Retention is a property of the live session: any attach may ask for it, and
         // no attach may revoke it for the clients that already rely on it.
         if (options?.retainOnDisconnect)
@@ -264,7 +289,7 @@ export class WorkerSessionRegistry {
     reservationCount(handle) {
         return this.reservations.count(handle);
     }
-    reserve(handle, path) {
+    async reserve(handle, path) {
         const entry = this.entries.get(handle);
         if (!entry)
             return "conflict";
@@ -272,7 +297,16 @@ export class WorkerSessionRegistry {
             return "granted";
         if (entry.state !== "opening" && entry.state !== "open")
             return "conflict";
-        return this.reservations.reserve(handle, path, this.liveWorkerPaths(entry));
+        const grant = this.reservations.reserve(handle, path, this.liveWorkerPaths(entry));
+        if (grant !== "granted")
+            return grant;
+        const owner = await this.claims.get(handle)?.claim(path, entry.attachments > 0 || entry.worker?.busy === true);
+        if (owner || this.entries.get(handle) !== entry || (entry.state !== "opening" && entry.state !== "open")) {
+            const live = this.liveWorkerPaths(entry);
+            this.reservations.reconcile(handle, live ?? { livePaths: [], sessionPath: entry.reservationKey });
+            return "conflict";
+        }
+        return "granted";
     }
     /**
      * Releases the grants a worker's latest snapshot no longer claims.
@@ -281,12 +315,21 @@ export class WorkerSessionRegistry {
      * quarantined keeps every grant until its real exit, because a worker stuck in a
      * syscall can still be writing a path it can no longer report.
      */
-    reconcile(handle, livePaths) {
+    async reconcile(handle, livePaths) {
         const entry = this.entries.get(handle);
         if (entry?.state !== "open")
             return;
         const sessionPath = entry.worker?.snapshot?.sessionPath;
+        const attached = entry.attachments > 0 || entry.worker?.busy === true;
+        if (sessionPath) {
+            const owner = await this.claims.get(handle)?.claim(sessionPath, attached);
+            if (owner)
+                throw new RpcSessionRegistryError("session_path_in_use");
+            if (this.entries.get(handle) !== entry || entry.state !== "open")
+                return;
+        }
         this.reservations.reconcile(handle, { livePaths, sessionPath });
+        this.claims.get(handle)?.reconcile(sessionPath ? [...livePaths, sessionPath] : livePaths, attached);
         if (!sessionPath)
             return;
         entry.reservationKey = sessionPath;

package/dist/utils/shell.d.ts

@@ -1,3 +1,4 @@
+import { type WindowsProcessRow } from "@earendil-works/pi-agent-core/node";
 /** Family of a resolved shell executable, used to pick invocation arguments. */
 export type ShellKind = "bash" | "sh" | "cmd" | "powershell";
 export interface ShellConfig {
@@ -63,7 +64,10 @@ export declare function killTrackedDetachedChildren(): void;
  */
 export declare function windowsTaskkillCandidates(env?: NodeJS.ProcessEnv): string[];
 /**
- * Kill a process and all its children on Windows via `taskkill /T`.
+ * Kill a process and its descendants on Windows: one process listing (bounded by `TASKKILL_TIMEOUT_MS`)
+ * decides the tree, a process counting as a child only when it started at or after the parent it names,
+ * and `taskkill /F` ends each pid by name. `/T` would also adopt an unrelated older process through a
+ * recycled parent pid (senpi#2999); it is used only when no listing can be read.
  *
  * Synchronous on purpose. Shutdown paths call `killTrackedDetachedChildren()` and then
  * `process.exit()` in the same tick (`emergencyTerminalExit()`), so neither an
@@ -78,7 +82,7 @@ export declare function windowsTaskkillCandidates(env?: NodeJS.ProcessEnv): stri
  * Nothing in-process can walk a Windows process tree without an external tool, so this
  * still beats leaving the whole tree running.
  */
-export declare function killWindowsProcessTree(pid: number, taskkillPaths?: string[]): void;
+export declare function killWindowsProcessTree(pid: number, taskkillPaths?: string[], listProcesses?: () => readonly WindowsProcessRow[] | undefined): void;
 /**
  * Kill a process and all its children (cross-platform)
  */