@code-yeongyu/senpi 2026.10.19-2 → 2026.10.20-1

package/dist/core/extensions/builtin/anthropic-subscription/options.js

@@ -2,25 +2,11 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { CONFIG_DIR_NAME, getAgentDir } from "../../../../config.js";
 import { PROJECT_RULES_END_MARKER, PROJECT_RULES_HEADING, PROJECT_RULES_REGION_END_MARKER, PROJECT_RULES_REGION_START_MARKER, PROJECT_RULES_START_MARKER, } from "../rules/rules/constants.js";
+import { plannedContextWindow, sdkModelId } from "./context-window.js";
 import { presetAppendDeprecationGuidance } from "./guidance.js";
-import { longContextAvailable } from "./long-context.js";
 import { loadAnthropicSubscriptionProviderSettingsFromDisk, resolveCompactionOwner, resolveSystemPromptMode, } from "./settings.js";
 import { loadOverrideSystemPrompt, resolveCustomSystemPrompt } from "./system-prompt.js";
 import { BUILTIN_SDK_TOOLS, canUseTool, HOST_TOOL_DENIAL_HOOKS } from "./tools.js";
-/** Claude Code's default window when a request does not ask for the long context (its `A68`). */
-export const CLAUDE_CODE_DEFAULT_CONTEXT_WINDOW = 200_000;
-/**
- * The model id Claude Code is given. A subscription (OAuth) session ignores `options.betas` ("Custom
- * betas are only available for API key users"); the `[1m]` suffix is Claude Code's own way to ask for
- * the 1M window, and it then sends `context-1m-2025-08-07` on the wire. A model above the default
- * window gets the suffix while the account has not refused it, so the window senpi plans against is
- * the window the request gets (senpi#3408).
- */
-export function sdkModelId(model) {
-    return model.contextWindow > CLAUDE_CODE_DEFAULT_CONTEXT_WINDOW && longContextAvailable()
-        ? `${model.id}[1m]`
-        : model.id;
-}
 const ADAPTIVE_THINKING_MODEL_MARKERS = [
     "opus-4-6",
     "opus-4.6",
@@ -241,8 +227,14 @@ export function buildAnthropicSubscriptionQueryOptions(input) {
     // Claude Code's per-turn token-budget reminder changes the prompt every turn and defeats
     // prompt-cache reuse; senpi's compaction carries its own budget reminder. The auth lane
     // layers this over the subprocess environment it builds.
+    // With DISABLE_COMPACT set, Claude Code takes CLAUDE_CODE_MAX_CONTEXT_TOKENS over every model rule of
+    // its own, so it plans the window senpi plans (senpi#3801), and its native compaction stays off.
     if (senpiOwnsCompaction)
-        queryOptions.env = { CLAUDE_CODE_TOTAL_TOKENS_REMINDER: "off" };
+        queryOptions.env = {
+            CLAUDE_CODE_TOTAL_TOKENS_REMINDER: "off",
+            CLAUDE_CODE_MAX_CONTEXT_TOKENS: String(plannedContextWindow(input.model)),
+            DISABLE_COMPACT: "1",
+        };
     if (input.pathToClaudeCodeExecutable)
         queryOptions.pathToClaudeCodeExecutable = input.pathToClaudeCodeExecutable;
     if (toolLessRequest)

package/dist/core/extensions/builtin/anthropic-subscription/session-registry-wiring.js

@@ -1,7 +1,7 @@
 import { convertToLlm } from "../../../messages.js";
 import { ANTHROPIC_SUBSCRIPTION_PROVIDER_ID } from "./account-management.js";
 import { restoreColdSeedCalibration } from "./cold-seed-budget.js";
-import { sdkModelId } from "./options.js";
+import { sdkModelId } from "./context-window.js";
 import { BINDING_ENTRY_TYPE, BINDING_MARKER, bindingFromStoredBranch, invalidationReasonFromBranch, storedBindingFromBinding, storedBindingFromEntry, } from "./session-binding.js";
 import { deleteStoredBinding, readStoredBinding, writeStoredBinding } from "./session-binding-store.js";
 import { AssistantCommitBoundary, assistantContentHash, isResidentAssistant, isTerminalFailure, } from "./session-commit-boundary.js";

package/dist/core/extensions/builtin/anthropic-subscription/session-sync.js

@@ -117,6 +117,9 @@ export function configFingerprint(options, context, authLane, accountName) {
             // A refused 1M window must restart the resident process at the standard one (senpi#3408). Only
             // the refusal state is hashed: a live model switch reaches the process through setModel.
             longContextRefused: !longContextAvailable(),
+            // Claude Code reads its window once at spawn, so a switch to a model planned at another window
+            // restarts the resident process at that window instead of keeping the old one (senpi#3801).
+            contextWindow: options.env?.CLAUDE_CODE_MAX_CONTEXT_TOKENS,
             extraArgs: options.extraArgs,
             pathToClaudeCodeExecutable: options.pathToClaudeCodeExecutable,
             includePartialMessages: options.includePartialMessages,

package/dist/core/extensions/builtin/terminal/lease-file.d.ts

@@ -34,6 +34,7 @@ type LockState = {
 } | {
     readonly state: "held";
     readonly holder?: ReclaimLockHolder;
+    readonly unproven?: true;
 } | {
     readonly state: "stale";
     readonly raw: string;

package/dist/core/extensions/builtin/terminal/lease-file.js

@@ -131,9 +131,11 @@ export async function reclaimLockState(lock, probes = {}) {
     if (!(probes.isProcessAlive ?? pidAlive)(holder.pid))
         return { state: "stale", raw };
     const observed = await (probes.readProcessStartMs ?? defaultReadProcessStartMs)(holder.pid).catch(() => undefined);
-    if (observed === undefined || sameProcessStart(holder.processStartedAtMs, observed))
-        return { state: "held", holder };
-    return { state: "stale", raw };
+    // An unreadable start time cannot tell the holder from a process wearing its reused pid: held, but
+    // `unproven`, so a caller with positive evidence of the holder's death may still reclaim it.
+    if (observed === undefined)
+        return { state: "held", holder, unproven: true };
+    return sameProcessStart(holder.processStartedAtMs, observed) ? { state: "held", holder } : { state: "stale", raw };
 }
 /** Remove a stale lock only if it still holds `raw`; a lock someone took meanwhile is put back. */
 export async function breakStaleLock(lock, raw) {

package/dist/core/foreign-session-holders.d.ts

@@ -1,7 +1,6 @@
-import { type LockProbes } from "./extensions/builtin/terminal/lease-file.ts";
-import { type SessionHolder } from "./session-holders.ts";
+import { type SessionHolder, type SessionHolderProbes } from "./session-holders.ts";
 /** Fresh lease evidence for each admission; a clean exit or stale identity clears the next retry. */
-export declare function foreignSessionHolders(sessionFile: string | undefined, sessionId?: string, probes?: LockProbes): Promise<SessionHolder[]>;
+export declare function foreignSessionHolders(sessionFile: string | undefined, sessionId?: string, probes?: SessionHolderProbes): Promise<SessionHolder[]>;
 /** One terminal-safe line; cwd can contain newlines or escape sequences. */
 export declare function sessionHolderWarning(sessionFile: string | undefined, sessionId?: string): Promise<string | undefined>;
 //# sourceMappingURL=foreign-session-holders.d.ts.map

package/dist/core/provider-failure.d.ts

@@ -10,6 +10,8 @@ export interface ProviderFailure {
     readonly provider: string;
     readonly httpStatus?: number;
     readonly code?: string;
+    /** When the limit lifts (epoch ms), for a `quota` or `rate_limit` failure whose provider named it. */
+    readonly resetsAt?: number;
     readonly reason: string;
     readonly action: string;
 }

package/dist/core/provider-failure.js

@@ -26,12 +26,15 @@ export function describeProviderFailure(diagnostic, provider) {
             action: "retry once; if it repeats, switch the model or report the code",
         }
         : ACTIONS[category];
+    const resetsAt = diagnostic?.resetsAt;
     return {
         category,
         provider,
         ...(diagnostic?.httpStatus === undefined ? {} : { httpStatus: diagnostic.httpStatus }),
         ...(diagnostic?.code === undefined ? {} : { code: diagnostic.code }),
+        ...(resetsAt === undefined ? {} : { resetsAt }),
         ...detail,
+        ...(resetsAt === undefined ? {} : { reason: `${detail.reason} until ${new Date(resetsAt).toISOString()}` }),
     };
 }
 /**

package/dist/core/reserved-keywords.js

@@ -5,7 +5,7 @@ const NOT_AFTER_IDENTIFIER = String.raw `(?<![A-Za-z0-9][-_.]|[/\\])`;
 const NOT_BEFORE_PATH = String.raw `(?![-_.]?[A-Za-z0-9]*[/\\])`;
 // The name must end its own word (`ulw-plan-refactor`, `ulw-plan.md` do not count); a chained
 // skill word may follow if it, too, ends there (`mass ulw-loop`).
-const SEGMENT_END = String.raw `(?![-_.]?[A-Za-z0-9])`;
+const SEGMENT_END = "(?![-_.]?[A-Za-z0-9])";
 const NOT_INTO_IDENTIFIER = String.raw `(?![-_](?!(?:loop|plan|research|execute|mass)${SEGMENT_END})[A-Za-z0-9]|\.[A-Za-z0-9])`;
 const keywordPattern = (body) => new RegExp(String.raw `${NOT_AFTER_IDENTIFIER}\b${body}\b${NOT_INTO_IDENTIFIER}${NOT_BEFORE_PATH}`, "gi");
 const RESERVED_KEYWORD_PATTERNS = [

package/dist/core/session-hold-errors.d.ts

@@ -8,6 +8,8 @@ export interface SessionHolder {
 export interface SessionHolderEndpoint {
     readonly host_socket?: string;
     readonly host_instance: string;
+    /** The daemon directory of that generation; kept in the holder record only, never reported. */
+    readonly host_daemon_dir?: string;
 }
 export declare class SessionHeldError extends Error {
     readonly code: "ESESSIONHELD";

package/dist/core/session-holder-records.d.ts

@@ -0,0 +1,21 @@
+import { type LockProbes } from "./extensions/builtin/terminal/lease-file.ts";
+import type { SessionHolder } from "./session-hold-errors.ts";
+/** The host generation a holder record names, as written by `holdSessionFile`. */
+export interface HolderGeneration {
+    readonly host_instance?: string;
+    readonly host_daemon_dir?: string;
+}
+export interface SessionHolderProbes extends LockProbes {
+    /**
+     * Positive evidence that the holder's host generation has ended. Asked only about a holder whose pid
+     * is alive but whose start time cannot be compared, so a reused pid is not mistaken for it forever.
+     */
+    readonly holderEnded?: (generation: HolderGeneration) => Promise<boolean>;
+}
+/**
+ * `fenceSession` advances the session file's write fence (senpi#3652). A holder released on `holderEnded` may only be
+ * frozen, so it is released only after the fence moved: if it resumes, its writes are refused. Without a fence, or when
+ * it cannot be written, the holder stands.
+ */
+export declare function liveHolders(dir: string, probes?: SessionHolderProbes, fenceSession?: () => Promise<void>): Promise<SessionHolder[]>;
+//# sourceMappingURL=session-holder-records.d.ts.map

package/dist/core/session-holder-records.js

@@ -0,0 +1,76 @@
+/**
+ * Reading the holder records of one session: which processes hold it right now. A record of a dead or
+ * reused pid is reclaimed on the way, and so is one whose pid is alive but unprovable once the caller
+ * has positive evidence that its host generation ended (senpi#3658).
+ */
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { breakStaleLock, readLeaseText, reclaimLockState, } from "./extensions/builtin/terminal/lease-file.js";
+const HOLDER_RECORD = /^\d+\.json$/;
+function parseCwd(raw) {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || !("cwd" in parsed))
+        return undefined;
+    return typeof parsed.cwd === "string" ? parsed.cwd : undefined;
+}
+async function fenced(fenceSession) {
+    if (fenceSession === undefined)
+        return false;
+    return fenceSession().then(() => true, () => false);
+}
+function holderGeneration(parsed) {
+    if (typeof parsed !== "object" || parsed === null)
+        return {};
+    return {
+        ...("host_instance" in parsed && typeof parsed.host_instance === "string"
+            ? { host_instance: parsed.host_instance }
+            : {}),
+        ...("host_daemon_dir" in parsed && typeof parsed.host_daemon_dir === "string"
+            ? { host_daemon_dir: parsed.host_daemon_dir }
+            : {}),
+    };
+}
+/**
+ * `fenceSession` advances the session file's write fence (senpi#3652). A holder released on `holderEnded` may only be
+ * frozen, so it is released only after the fence moved: if it resumes, its writes are refused. Without a fence, or when
+ * it cannot be written, the holder stands.
+ */
+export async function liveHolders(dir, probes = {}, fenceSession) {
+    const holders = [];
+    for (const name of await readdir(dir)) {
+        if (!HOLDER_RECORD.test(name))
+            continue;
+        const path = join(dir, name);
+        const before = await readLeaseText(path);
+        const state = await reclaimLockState(path, probes);
+        if (state.state === "stale")
+            await breakStaleLock(path, state.raw);
+        if (state.state !== "held" || state.holder === undefined)
+            continue;
+        const raw = await readLeaseText(path);
+        // Never publish endpoint labels from a record replaced during the identity probe.
+        const stable = raw !== undefined && raw === before;
+        const parsed = stable ? JSON.parse(raw) : undefined;
+        if (stable &&
+            state.unproven === true &&
+            (await probes.holderEnded?.(holderGeneration(parsed))) === true &&
+            (await fenced(fenceSession))) {
+            await breakStaleLock(path, raw);
+            continue;
+        }
+        const endpoint = typeof parsed === "object" &&
+            parsed !== null &&
+            "host_instance" in parsed &&
+            typeof parsed.host_instance === "string"
+            ? {
+                host_instance: parsed.host_instance,
+                ...("host_socket" in parsed && typeof parsed.host_socket === "string"
+                    ? { host_socket: parsed.host_socket }
+                    : {}),
+            }
+            : {};
+        holders.push({ pid: state.holder.pid, cwd: stable ? parseCwd(raw) : undefined, ...endpoint });
+    }
+    return holders;
+}
+//# sourceMappingURL=session-holder-records.js.map

package/dist/core/session-holders.d.ts

@@ -1,6 +1,6 @@
-import { type LockProbes } from "./extensions/builtin/terminal/lease-file.ts";
 import { SessionHeldError, type SessionHolder, type SessionHolderEndpoint, SessionMovedError, SessionMovingError } from "./session-hold-errors.ts";
-export { SessionHeldError, type SessionHolder, SessionMovedError, SessionMovingError };
+import { type HolderGeneration, type SessionHolderProbes } from "./session-holder-records.ts";
+export { type HolderGeneration, SessionHeldError, type SessionHolder, type SessionHolderProbes, SessionMovedError, SessionMovingError, };
 export interface SessionHold {
     release(): void;
 }
@@ -18,7 +18,7 @@ export declare function holdSessionFile(sessionFile: string, sessionId: string,
  * Live processes that have `sessionFile` open right now (stale records of dead or reused pids are
  * reclaimed on the way). A caller about to start another writer uses it to wait instead of racing one.
  */
-export declare function liveSessionHolders(sessionFile: string, sessionId: string, probes?: LockProbes): Promise<SessionHolder[]>;
+export declare function liveSessionHolders(sessionFile: string, sessionId: string, probes?: SessionHolderProbes): Promise<SessionHolder[]>;
 /**
  * Runs `move` holding the session's move lock, after proving no live process holds the session.
  * Waits up to `waitMs` for a concurrent move to finish, then fails with `SessionMovingError`.

package/dist/core/session-holders.js

@@ -1,13 +1,14 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { readdir } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { resolveMovedPath } from "./extensions/builtin/moved-path-guard/resolve.js";
 import { breakStaleLock, errorCode, publishExclusive, readLeaseText, reclaimLockState, unlinkIfPresent, } from "./extensions/builtin/terminal/lease-file.js";
 import { ownProcessStartedAtMs, processBootAtMs } from "./extensions/builtin/terminal/process-identity.js";
 import { SessionHeldError, SessionMovedError, SessionMovingError, } from "./session-hold-errors.js";
+import { liveHolders } from "./session-holder-records.js";
 import { encodedSessionId } from "./session-sidecar-store.js";
-export { SessionHeldError, SessionMovedError, SessionMovingError };
+import { advanceSessionFence } from "./session-write-fence.js";
+export { SessionHeldError, SessionMovedError, SessionMovingError, };
 /**
  * Cross-process ownership of a session file. Every process that has a session open publishes a holder
  * record `<sessionDir>/session-holders/<id>/<pid>.json` carrying its process identity; moving the session
@@ -19,7 +20,6 @@ export { SessionHeldError, SessionMovedError, SessionMovingError };
  */
 const HOLDERS_DIR = "session-holders";
 const MOVE_LOCK = "move.lock";
-const HOLDER_RECORD = /^\d+\.json$/;
 // A move rewrites one file and a few sidecars; a lock older than this belongs to a mover that died.
 const MOVE_LOCK_STALE_MS = 30_000;
 const DEFAULT_MOVE_LOCK_WAIT_MS = 5_000;
@@ -108,12 +108,6 @@ function parsePid(raw) {
         throw error;
     }
 }
-function parseCwd(raw) {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null || !("cwd" in parsed))
-        return undefined;
-    return typeof parsed.cwd === "string" ? parsed.cwd : undefined;
-}
 /**
  * Publishes this process as a holder of `sessionFile` until `release()`. Throws `SessionMovingError`
  * while another process is moving the session, and `SessionMovedError` when a session that was read
@@ -169,44 +163,13 @@ function publishHolderRecord(dir, record, content) {
         }
     }
 }
-async function liveHolders(dir, probes = {}) {
-    const holders = [];
-    for (const name of await readdir(dir)) {
-        if (!HOLDER_RECORD.test(name))
-            continue;
-        const path = join(dir, name);
-        const before = await readLeaseText(path);
-        const state = await reclaimLockState(path, probes);
-        if (state.state === "stale")
-            await breakStaleLock(path, state.raw);
-        if (state.state !== "held" || state.holder === undefined)
-            continue;
-        const raw = await readLeaseText(path);
-        // Never publish endpoint labels from a record replaced during the identity probe.
-        const stable = raw !== undefined && raw === before;
-        const parsed = stable ? JSON.parse(raw) : undefined;
-        const endpoint = typeof parsed === "object" &&
-            parsed !== null &&
-            "host_instance" in parsed &&
-            typeof parsed.host_instance === "string"
-            ? {
-                host_instance: parsed.host_instance,
-                ...("host_socket" in parsed && typeof parsed.host_socket === "string"
-                    ? { host_socket: parsed.host_socket }
-                    : {}),
-            }
-            : {};
-        holders.push({ pid: state.holder.pid, cwd: stable ? parseCwd(raw) : undefined, ...endpoint });
-    }
-    return holders;
-}
 /**
  * Live processes that have `sessionFile` open right now (stale records of dead or reused pids are
  * reclaimed on the way). A caller about to start another writer uses it to wait instead of racing one.
  */
 export async function liveSessionHolders(sessionFile, sessionId, probes = {}) {
     try {
-        return await liveHolders(holdersDir(sessionFile, sessionId), probes);
+        return await liveHolders(holdersDir(sessionFile, sessionId), probes, () => advanceSessionFence(sessionFile));
     }
     catch (error) {
         if (errorCode(error) === "ENOENT")

package/dist/core/session-manager.d.ts

@@ -312,6 +312,7 @@ export declare class SessionManager {
     private cwd;
     private persist;
     private readonly writeGuard;
+    private readonly writeFence;
     private flushed;
     private headerWrite;
     private ownedHeaderFile;

package/dist/core/session-manager.js

@@ -18,6 +18,7 @@ import { HistoryReductions } from "./session-history-reduce.js";
 import { planLoadedTail } from "./session-loaded-tail.js";
 import { SessionWriteGuard } from "./session-move/write-guard.js";
 import { ResidentStringStore } from "./session-resident-store.js";
+import { SessionWriteFence } from "./session-write-fence.js";
 import { discardFailedFirstFlush, discardFailedFirstFlushAsync, truncateToLastCompleteLine, } from "./session-write-recovery.js";
 import { hasOtherLiveSessionWriter, registerSessionWriter, reserveSessionWrite, unregisterSessionWriter, } from "./session-write-reservation.js";
 import { isVirtualModel } from "./virtual-models.js";
@@ -680,6 +681,7 @@ export class SessionManager {
     constructor(cwd, sessionDir, sessionFile, persist, newSessionOptions, preloadedFileEntries) {
         this.sessionId = "";
         this.writeGuard = new SessionWriteGuard();
+        this.writeFence = new SessionWriteFence();
         this.flushed = false;
         // Set when an append to the flushed file failed and may have left a partial last line.
         this.tailMayBeTorn = false;
@@ -839,8 +841,10 @@ export class SessionManager {
     /** Points this manager at `sessionFile`; the path when it exists, undefined when a new session was started there. */
     _beginSessionFile(sessionFile, newSessionOptions) {
         const resolvedFile = resolvePath(sessionFile);
-        if (this.persist)
+        if (this.persist) {
             reserveSessionWrite(resolvedFile);
+            this.writeFence.opened(resolvedFile);
+        }
         this.sessionFile = resolvedFile;
         this.mirrorTrimmed = false;
         this.trimmedIds.clear();
@@ -1056,6 +1060,7 @@ export class SessionManager {
         if (!this.persist || !this.sessionFile)
             return;
         this.writeGuard.assertRewritable(this.fileEntries, this.sessionFile);
+        this.writeFence.assertOwned(this.sessionFile);
         reserveSessionWrite(this.sessionFile);
         replaceFileAtomically(this.sessionFile, this._serializedFileEntries());
     }
@@ -1134,6 +1139,7 @@ export class SessionManager {
         return true;
     }
     async _writeHeaderAsync(sessionFile) {
+        this.writeFence.assertOwned(sessionFile);
         reserveSessionWrite(sessionFile);
         const entries = this.fileEntries;
         const serialize = (batch) => batch.map((e) => `${JSON.stringify(this.residentStore.materialize(e))}\n`).join("");
@@ -1185,6 +1191,7 @@ export class SessionManager {
         if (!this.persist || !this.sessionFile)
             return;
         this.writeGuard.assertWritable(this.fileEntries, entry, this.sessionFile);
+        this.writeFence.assertOwned(this.sessionFile);
         reserveSessionWrite(this.sessionFile);
         const persistedEntry = this.residentStore.materialize(entry);
         if (this.flushed) {

package/dist/core/session-write-fence.d.ts

@@ -0,0 +1,18 @@
+export declare function sessionFenceFile(sessionFile: string): string;
+/** The fence token now on disk; empty when the file was never taken over. Any other read failure throws. */
+export declare function readSessionFence(sessionFile: string): string;
+/** Gives the file a new token, so every writer that opened it before this call refuses its next write. */
+export declare function advanceSessionFence(sessionFile: string): Promise<void>;
+/** One writer's view of its file's fence: the token seen when the file was opened, re-checked before every write. */
+export declare class SessionWriteFence {
+    private seen;
+    private fencedFile;
+    opened(sessionFile: string): void;
+    assertOwned(sessionFile: string): void;
+}
+export declare class SessionFencedError extends Error {
+    readonly code = "session_fenced";
+    readonly sessionFile: string;
+    constructor(sessionFile: string);
+}
+//# sourceMappingURL=session-write-fence.d.ts.map

package/dist/core/session-write-fence.js

@@ -0,0 +1,71 @@
+/**
+ * The write fence of one session file (senpi#3652).
+ *
+ * A host may take a session file over from another generation whose claim it could not prove alive, for example a
+ * Windows generation that stopped heartbeating while an unrelated process wears its recycled pid. That verdict can be
+ * wrong: a generation whose event loop froze, or whose machine slept, also stops heartbeating, and it would resume
+ * writing the same file. The fence makes that second writer impossible instead of unlikely. A takeover replaces the
+ * token in `<session file>.fence` before the new owner opens the file; every writer remembers the token it saw when it
+ * opened the file and re-reads it, synchronously, right before each write. A writer that finds another token refuses
+ * the write and every later one: the file is no longer its own.
+ */
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { rename, rm, writeFile } from "node:fs/promises";
+export function sessionFenceFile(sessionFile) {
+    return `${sessionFile}.fence`;
+}
+/** The fence token now on disk; empty when the file was never taken over. Any other read failure throws. */
+export function readSessionFence(sessionFile) {
+    try {
+        return readFileSync(sessionFenceFile(sessionFile), "utf8").trim();
+    }
+    catch (cause) {
+        if (cause.code === "ENOENT")
+            return "";
+        throw cause;
+    }
+}
+/** Gives the file a new token, so every writer that opened it before this call refuses its next write. */
+export async function advanceSessionFence(sessionFile) {
+    const file = sessionFenceFile(sessionFile);
+    const temporary = `${file}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
+    try {
+        await writeFile(temporary, `${randomUUID()}\n`, { mode: 0o600 });
+        await rename(temporary, file);
+    }
+    catch (cause) {
+        await rm(temporary, { force: true }).catch(() => undefined);
+        throw cause;
+    }
+}
+/** One writer's view of its file's fence: the token seen when the file was opened, re-checked before every write. */
+export class SessionWriteFence {
+    opened(sessionFile) {
+        if (this.fencedFile !== sessionFile)
+            this.fencedFile = undefined;
+        this.seen = { file: sessionFile, token: readSessionFence(sessionFile) };
+    }
+    assertOwned(sessionFile) {
+        if (this.fencedFile === sessionFile)
+            throw new SessionFencedError(sessionFile);
+        // A file this writer starts itself (a new session, a fork) has no earlier owner to fence out.
+        if (this.seen?.file !== sessionFile) {
+            this.opened(sessionFile);
+            return;
+        }
+        if (readSessionFence(sessionFile) === this.seen.token)
+            return;
+        this.fencedFile = sessionFile;
+        throw new SessionFencedError(sessionFile);
+    }
+}
+export class SessionFencedError extends Error {
+    constructor(sessionFile) {
+        super(`${sessionFile} was taken over by another host generation; this writer no longer owns it and will not write to it`);
+        this.code = "session_fenced";
+        this.name = "SessionFencedError";
+        this.sessionFile = sessionFile;
+    }
+}
+//# sourceMappingURL=session-write-fence.js.map

package/dist/core/user-text-blocks.d.ts

@@ -1,4 +1,15 @@
 import type { TextContent } from "@earendil-works/pi-ai";
+/** The one text a user message's text blocks spell: the blocks joined by a newline. */
+export declare function joinUserTextBlocks(blocks: readonly string[]): string;
+/**
+ * The text a queued user message is tracked by. The queue records it on enqueue and matches the
+ * started message's content against it on delivery, so both sides must read it here (senpi#3588):
+ * `userMessageText(userTextContent(text, textBlocks)) === text` for every queued `text`.
+ */
+export declare function userMessageText(content: string | readonly {
+    type: string;
+    text?: string;
+}[]): string;
 /**
  * The text content of a user message. Text that arrived as several blocks keeps them while they
  * still spell the final text exactly (joined by a newline); text that an input handler or a

package/dist/core/user-text-blocks.js

@@ -1,4 +1,22 @@
 import { parseAskUserAnswerFrame } from "./extensions/builtin/ask-user/format.js";
+/** The one text a user message's text blocks spell: the blocks joined by a newline. */
+export function joinUserTextBlocks(blocks) {
+    return blocks.join("\n");
+}
+/**
+ * The text a queued user message is tracked by. The queue records it on enqueue and matches the
+ * started message's content against it on delivery, so both sides must read it here (senpi#3588):
+ * `userMessageText(userTextContent(text, textBlocks)) === text` for every queued `text`.
+ */
+export function userMessageText(content) {
+    if (typeof content === "string")
+        return content;
+    const blocks = [];
+    for (const part of content)
+        if (part.type === "text" && part.text !== undefined)
+            blocks.push(part.text);
+    return joinUserTextBlocks(blocks);
+}
 /**
  * The text content of a user message. Text that arrived as several blocks keeps them while they
  * still spell the final text exactly (joined by a newline); text that an input handler or a
@@ -6,7 +24,7 @@ import { parseAskUserAnswerFrame } from "./extensions/builtin/ask-user/format.js
  * words in separate blocks (senpi#2920).
  */
 export function userTextContent(text, textBlocks) {
-    if (textBlocks !== undefined && textBlocks.length > 1 && textBlocks.join("\n") === text) {
+    if (textBlocks !== undefined && textBlocks.length > 1 && joinUserTextBlocks(textBlocks) === text) {
         return textBlocks.map((block) => ({ type: "text", text: block }));
     }
     return [{ type: "text", text }];

package/dist/modes/rpc/host-daemon-registration.js

@@ -26,7 +26,7 @@ import { rename, rm } from "node:fs/promises";
 import { ProcessIdentityUnreadableError, parseDaemonPidFile, processIsLive, processMatchesPidFile, processStartTimeMs, readProcessStartTime, sameProcessStartMs, } from "../../utils/process-identity.js";
 import { createGenerationDirectory, generationPaths, HOST_DAEMON_LAYOUT, sameEndpoint, } from "./host-daemon-paths.js";
 import { isRecord, parseJson, readFileOrUndefined, writeStateFile } from "./host-daemon-state.js";
-import { pruneDeadGenerations } from "./host-generations.js";
+import { endClaimsOfEndedGenerations, pruneDeadGenerations } from "./host-generations.js";
 import { hostChildAlive } from "./host-stalled-evidence.js";
 import { logUnknownHostIdentity } from "./host-supervisor-log.js";
 /**
@@ -112,6 +112,7 @@ export async function clearHostRegistration(paths) {
     if (typeof pointer?.instance_id === "string") {
         if (await hostChildAlive(generationPaths(paths, pointer.instance_id)))
             throw new Error(`refusing to clear generation ${pointer.instance_id} with a live host child`);
+        await endClaimsOfEndedGenerations(paths, new Set([pointer.instance_id]));
         await rm(generationPaths(paths, pointer.instance_id).dir, { recursive: true, force: true });
     }
     await rm(paths.settingsFile, { force: true });

package/dist/modes/rpc/host-generations.d.ts

@@ -30,6 +30,12 @@ export interface PrunedDaemonState {
  * LEFT - an ensure writing one right now must not be mistaken for a generation that ended.
  */
 export declare function pruneDeadGenerations(paths: HostDaemonPaths): Promise<PrunedDaemonState>;
+/**
+ * Removes every claim whose owner is gone, and every claim of a generation in `ended` (being removed by the caller)
+ * whose owner identity cannot be proven. Returns the session paths released. Every path that removes a generation
+ * directory calls this first, so no generation leaves claims behind that its directory no longer explains.
+ */
+export declare function endClaimsOfEndedGenerations(paths: HostDaemonDirectory, ended: ReadonlySet<string>): Promise<string[]>;
 /**
  * Every generation of this daemon that is still running, newest ordinal last. A record naming a
  * dead pid is omitted rather than reported as history: `host status` answers who is alive now.