@gajae-code/coding-agent 0.13.3 → 0.14.0

package/src/session/session-manager.ts

@@ -15,6 +15,7 @@ import type {
 	TextContent,
 	Usage,
 } from "@gajae-code/ai/core";
+import { hasAdjacentPrivateThinkingBlocks } from "@gajae-code/ai/core";
 import type * as native from "@gajae-code/natives";
 
 function nativeSessionManager(): typeof import("@gajae-code/natives") {
@@ -39,6 +40,7 @@ import {
 	Snowflake,
 	toError,
 } from "@gajae-code/utils";
+import { EDIT_SNAPSHOT_EXTERNALIZED_NOTICE, editSnapshotReceipt } from "../edit/renderer";
 import type { TtsrInjectionRecord } from "../export/ttsr";
 import { assertSafePathComponent } from "../gjc-runtime/session-layout";
 import { writeTextAtomic } from "../gjc-runtime/state-writer";
@@ -89,9 +91,11 @@ import {
 	captureManagedFileNoFollow,
 	fsyncManagedArtifactTree,
 	MANAGED_ARTIFACT_MAX_FILE_BYTES,
+	type ManagedAppendReceipt,
 	type ManagedBoundedAppendExpectation,
 	ManagedCommittedMutationError,
 	type ManagedDirectoryRoot,
+	type ManagedFileIdentity,
 	type ManagedFileSnapshot,
 	ManagedSessionDescendantStore,
 	type ManagedSessionSecurityPolicy,
@@ -1746,7 +1750,7 @@ async function writeOwnerOnlyFileNoReplace(filePath: string, content: Uint8Array
 	await fsyncDirectoryPath(path.dirname(filePath));
 }
 
-const MEMORY_GUARD_CHECKPOINT_FILE_MAX_BYTES = 64 * 1024 * 1024;
+const MEMORY_GUARD_CHECKPOINT_FILE_MAX_BYTES = 128 * 1024 * 1024;
 const MEMORY_GUARD_CHECKPOINT_BLOB_MAX_ENTRIES = 4096;
 const MEMORY_GUARD_CHECKPOINT_BLOB_TOTAL_MAX_BYTES = 64 * 1024 * 1024;
 
@@ -2042,6 +2046,49 @@ export class SessionAppendPersistenceError extends Error {
 	}
 }
 
+/**
+ * Typed near-limit append outcome (#4566).
+ *
+ * A live managed append that would cross the per-file transcript cap is now
+ * preflighted: when the append alone cannot fit even after a full rewrite of
+ * the live entries, this deterministic error replaces the generic
+ * `SessionAppendPersistenceError: content_too_large` abort. It states whether
+ * the in-memory entry was kept (so the just-committed source mutation keeps
+ * its receipt on the next successful persist) and how to continue.
+ */
+export class SessionNearLimitAppendError extends Error {
+	readonly code = "near_limit_append" as const;
+	/** Serialized size (bytes) of the entry that could not fit. */
+	readonly entryBytes: number;
+	/** Live-entry rewrite size (bytes) the recovery already attempted. */
+	readonly liveBytes: number;
+	/** Managed per-file cap in force when the append was rejected. */
+	readonly capBytes: number;
+	/** True when the entry remains in the resident list awaiting the next persist. */
+	readonly entryRetained: boolean;
+
+	constructor(details: {
+		entryBytes: number;
+		liveBytes: number;
+		capBytes: number;
+		entryRetained: boolean;
+	}) {
+		super(
+			[
+				`near_limit_append: entry (${details.entryBytes} B) plus live transcript (${details.liveBytes} B) exceeds the managed per-file limit (${details.capBytes} B).`,
+				details.entryRetained
+					? "The appended entry is retained in memory; its effect (including any committed source edit) is recorded and will persist on the next successful write. Compact the session (`/compact`) or export to a fresh session (`gjc export <session-file>`) before continuing."
+					: "The appended entry was rolled back from memory; re-issue it after compacting the session (`/compact`) or exporting to a fresh session (`gjc export <session-file>`).",
+			].join(" "),
+		);
+		this.name = "SessionNearLimitAppendError";
+		this.entryBytes = details.entryBytes;
+		this.liveBytes = details.liveBytes;
+		this.capBytes = details.capBytes;
+		this.entryRetained = details.entryRetained;
+	}
+}
+
 export class SessionManagedStorageError extends Error {
 	readonly code = "managed_storage_unsupported";
 
@@ -2628,9 +2675,10 @@ function measureJsonLikeBytes(value: unknown, visited = new Set<object>()): numb
 
 /** Measure one materialized {@link SessionContext} and throw when over the budget. */
 function assertSessionContextWithinBudget(context: SessionContext): SessionContext {
+	const budgetBytes = effectiveSessionContextBudgetBytes();
 	const measuredBytes = measureJsonLikeBytes(context);
-	if (measuredBytes > SESSION_CONTEXT_MATERIALIZATION_BUDGET_BYTES) {
-		throw new SessionContextTooLargeError(measuredBytes);
+	if (measuredBytes > budgetBytes) {
+		throw new SessionContextTooLargeError(measuredBytes, budgetBytes);
 	}
 	return context;
 }
@@ -3163,6 +3211,24 @@ function managedFileSnapshotEquals(left: ManagedFileSnapshot | null, right: Mana
 		left.bytes.equals(right.bytes)
 	);
 }
+
+function managedFileSnapshotMatchesDescriptor(snapshot: ManagedFileSnapshot, descriptor: DescriptorSnapshot): boolean {
+	return (
+		snapshot.identity.dev === descriptor.dev &&
+		snapshot.identity.ino === descriptor.ino &&
+		snapshot.identity.nlink === descriptor.nlink &&
+		snapshot.identity.size === descriptor.size &&
+		snapshot.identity.mtimeNs === descriptor.mtimeNs &&
+		snapshot.identity.ctimeNs === descriptor.ctimeNs
+	);
+}
+
+function unrefDelay(ms: number): Promise<void> {
+	const { promise, resolve } = Promise.withResolvers<void>();
+	const timer = setTimeout(resolve, ms);
+	timer.unref();
+	return promise;
+}
 const trustedSessionDestinations = new WeakSet<SessionDestination>();
 const explicitProfileAgentDirs = new WeakMap<SessionDestination, string>();
 const managedSecurityPolicies = new WeakMap<ManagedSessionSecurityContext, ManagedSessionSecurityPolicy>();
@@ -3426,6 +3492,18 @@ function descriptorSnapshotAsStorageStat(descriptor: DescriptorSnapshot): Sessio
 	return { ...descriptor, mtimeMs, mtime: new Date(mtimeMs), isFile: true };
 }
 
+function managedIdentityFromDescriptor(descriptor: DescriptorSnapshot): ManagedFileIdentity {
+	if (descriptor.nlink === undefined) throw new Error("managed_identity_nlink_unavailable");
+	return {
+		dev: descriptor.dev,
+		ino: descriptor.ino,
+		nlink: descriptor.nlink,
+		size: descriptor.size,
+		mtimeNs: descriptor.mtimeNs,
+		ctimeNs: descriptor.ctimeNs,
+	};
+}
+
 function retainedManagedInspectionStorage(
 	storage: SessionStorage,
 	store: ManagedSessionDescendantStore,
@@ -3901,6 +3979,18 @@ function revalidateTranscriptIdentityBounded(
 	return sameResumeIdentity(expected, observed) ? { kind: "valid" } : { kind: "error", reason: "identity-mismatch" };
 }
 
+function revalidateStrictResumeInspection(
+	filePath: string,
+	storage: SessionStorage,
+	inspection: ResumeInspectionSnapshot,
+): boolean {
+	if (!storage.readRangeSync) {
+		const inspected = inspectResumeSessionFile(filePath, storage);
+		return !("kind" in inspected) && sameResumeIdentity(inspection.identity, inspected.identity);
+	}
+	return revalidateTranscriptIdentityBounded(filePath, storage, inspection.identity).kind === "valid";
+}
+
 function createTranscriptSnapshotHandle(
 	inspection: BoundedTranscriptInspection,
 	filePath: string,
@@ -3967,8 +4057,9 @@ function createTranscriptSnapshotHandle(
 		},
 		materialize(): Uint8Array {
 			if (closed) throw new Error("transcript_handle_closed");
-			if (size > SESSION_CONTEXT_MATERIALIZATION_BUDGET_BYTES - TRANSCRIPT_CAPTURE_CHUNK_BYTES) {
-				throw new SessionContextTooLargeError(size, SESSION_CONTEXT_MATERIALIZATION_BUDGET_BYTES);
+			const budgetBytes = effectiveSessionContextBudgetBytes();
+			if (size > budgetBytes - TRANSCRIPT_CAPTURE_CHUNK_BYTES) {
+				throw new SessionContextTooLargeError(size, budgetBytes);
 			}
 			const output = Buffer.allocUnsafe(size);
 			for (let offset = 0; offset < size; offset += TRANSCRIPT_CAPTURE_CHUNK_BYTES) {
@@ -4587,6 +4678,12 @@ async function movePathAcrossDevicesSafe(source: string, destination: string): P
 
 const MAX_PERSIST_CHARS = 500_000;
 const TRUNCATION_NOTICE = "\n\n[Session persistence truncated large content]";
+/**
+ * Inline cap for edit-result snapshot bodies (`EditToolDetails.oldText` /
+ * `.newText` and per-file copies). Bodies up to this size persist verbatim;
+ * larger ones persist as a digest receipt (#4566).
+ */
+const EDIT_SNAPSHOT_INLINE_MAX_CHARS = 16 * 1024;
 /** Minimum base64 length to externalize to blob store (skip tiny inline images) */
 const BLOB_EXTERNALIZE_THRESHOLD = 1024;
 const TEXT_CONTENT_KEY = "content";
@@ -4714,6 +4811,77 @@ function truncateString(value: string, maxLength: number): string {
 	return truncated;
 }
 
+/**
+ * Bound durable edit-result snapshot bodies (#4566).
+ *
+ * A tiny edit to a large file used to persist the complete pre- and post-edit
+ * file bodies in `EditToolDetails.oldText`/`newText` (and each
+ * `perFileResults[]` copy), so every patch added ~2x file size to the managed
+ * transcript and long sessions hit the 64 MiB per-file append limit mid-turn.
+ *
+ * Persisted edit results keep full bodies only under the inline cap; larger
+ * bodies are replaced by a fixed-size receipt (`oldTextDigest`/`newTextDigest`
+ * = byte length + SHA-256) plus a marker, so rendering, diagnostics, diffs,
+ * paths, and source-change accounting stay intact while the durable cost per
+ * edit is bounded independently of file size. Live in-process results are
+ * untouched — ACP `diff` ToolCallContent still receives full bodies.
+ */
+function boundEditSnapshotFields(value: unknown, visited: WeakSet<object>): unknown {
+	if (typeof value !== "object" || value === null) return value;
+	if (visited.has(value)) return value;
+	visited.add(value);
+
+	const boundOne = (entry: Record<string, unknown>): Record<string, unknown> => {
+		let changed = false;
+		const next: Record<string, unknown> = { ...entry };
+		const pairs: Array<["oldText", "oldTextDigest"] | ["newText", "newTextDigest"]> = [
+			["oldText", "oldTextDigest"],
+			["newText", "newTextDigest"],
+		];
+		for (const [bodyKey, digestKey] of pairs) {
+			const body = entry[bodyKey];
+			if (typeof body !== "string" || body.length <= EDIT_SNAPSHOT_INLINE_MAX_CHARS) continue;
+			const receipt = editSnapshotReceipt(body);
+			if (receipt === undefined) continue;
+			next[digestKey] = receipt;
+			next[bodyKey] = EDIT_SNAPSHOT_EXTERNALIZED_NOTICE;
+			changed = true;
+		}
+		return changed ? next : entry;
+	};
+
+	if (Array.isArray(value)) {
+		let changed = false;
+		const result: unknown[] = new Array(value.length);
+		for (let i = 0; i < value.length; i++) {
+			const item = value[i];
+			const bounded =
+				typeof item === "object" && item !== null && !Array.isArray(item)
+					? boundOne(item as Record<string, unknown>)
+					: item;
+			result[i] = bounded === item ? boundEditSnapshotFields(item, visited) : bounded;
+			if (result[i] !== item) changed = true;
+		}
+		return changed ? result : value;
+	}
+
+	for (const [key, child] of Object.entries(value)) {
+		if (child !== null && typeof child === "object" && !Array.isArray(child)) {
+			const boundedChild = boundOne(child as Record<string, unknown>);
+			if (boundedChild !== child) {
+				return { ...value, [key]: boundedChild };
+			}
+		}
+	}
+	for (const [key, child] of Object.entries(value)) {
+		const bounded = boundEditSnapshotFields(child, visited);
+		if (bounded !== child) {
+			return { ...(value as Record<string, unknown>), [key]: bounded };
+		}
+	}
+	return boundOne(value as Record<string, unknown>);
+}
+
 function isImageBlock(value: unknown): value is { type: "image"; data: string; mimeType?: string } {
 	return (
 		typeof value === "object" &&
@@ -5547,7 +5715,10 @@ async function truncateForPersistence(obj: unknown, blobStore: BlobStore, key?:
 }
 
 async function prepareEntryForPersistence(entry: FileEntry, blobStore: BlobStore): Promise<FileEntry> {
-	return truncateForPersistence(entry, blobStore);
+	// Bound edit snapshots before the generic 500k string truncation so the
+	// receipt hashes/lengths identify the exact source bodies, not truncated
+	// prefixes of files larger than MAX_PERSIST_CHARS (#4566).
+	return (await truncateForPersistence(boundEditSnapshotFieldsForEntry(entry), blobStore)) as FileEntry;
 }
 
 /**
@@ -5652,7 +5823,27 @@ function truncateForPersistenceSync(obj: unknown, blobStore: BlobStore, key?: st
 }
 
 function prepareEntryForPersistenceSync(entry: FileEntry, blobStore: BlobStore): FileEntry {
-	return truncateForPersistenceSync(entry, blobStore) as FileEntry;
+	// Keep this ordering identical to the async path: snapshot receipts must be
+	// computed from the complete body before generic persistence truncation.
+	return truncateForPersistenceSync(boundEditSnapshotFieldsForEntry(entry), blobStore) as FileEntry;
+}
+
+/**
+ * Apply {@link boundEditSnapshotFields} to a persisted entry's edit-result
+ * details. Only `message` entries with `role === "toolResult"` and a `details`
+ * object can carry edit snapshots; everything else returns unchanged, so the
+ * walk never touches unrelated entries (#4566).
+ */
+function boundEditSnapshotFieldsForEntry(entry: FileEntry): FileEntry {
+	if (entry.type !== "message") return entry;
+	const message = entry.message;
+	if (message === null || typeof message !== "object" || (message as { role?: unknown }).role !== "toolResult")
+		return entry;
+	const details = (message as { details?: unknown }).details;
+	if (details === null || typeof details !== "object" || Array.isArray(details)) return entry;
+	const bounded = boundEditSnapshotFields(details, new WeakSet());
+	if (bounded === details) return entry;
+	return { ...entry, message: { ...(message as object), details: bounded } } as FileEntry;
 }
 
 class NdjsonFileWriter {
@@ -6475,6 +6666,7 @@ interface SessionManagerStateSnapshot {
 	sessionName: string | undefined;
 	titleSource: "auto" | "user" | undefined;
 	sessionFile: string | undefined;
+	managedPersistExpectedIdentity: ManagedFileIdentity | undefined;
 	flushed: boolean;
 	ensuredOnDisk: boolean;
 	needsFullRewriteOnNextPersist: boolean;
@@ -6495,6 +6687,15 @@ export const SessionManagerTestHooks: {
 	afterForkTranscriptPublished?: () => void | Promise<void>;
 	beforeEphemeralArtifactManagerInstall?: (dir: string) => void | Promise<void>;
 	beforePersistPatchFence?: (attempt: number) => void;
+	beforeStrictMissingCheck?: (filePath: string, storage: SessionStorage) => void;
+	beforeManagedResumeAcceptance?: (filePath: string, storage: SessionStorage) => void;
+	beforeManagedResumeReturn?: (filePath: string, storage: SessionStorage) => void;
+	beforeManagedSourceStat?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
+	beforeManagedMissingInit?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
+	beforeManagedMissingPublish?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
+	beforeManagedMissingReturn?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
+	afterManagedMissingAssertion?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
+	beforeManagedSwitchIdentity?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
 	/** Internal first-open GC strategy override; omitted means current. */
 	firstOpenGcStrategy?: SessionMemoryGcStrategy;
 	/** Internal first-open secondary-artifact mode override; omitted means auto. */
@@ -6511,6 +6712,8 @@ export const SessionManagerTestHooks: {
 	lastSidecarInitError?: string;
 	/** Test-only generated-ID cache capacity override. */
 	coldIdHashMaxEntriesOverride?: number;
+	/** Test-only session-context budget override (in-process; does not leak to subprocesses). */
+	sessionContextBudgetBytesOverride?: number;
 } = {};
 
 function materializedCacheMaxBytes(): number {
@@ -6552,6 +6755,13 @@ function coldIdHashMaxEntries(): number {
 		throw new RangeError(`coldIdHashMaxEntriesOverride must be between 1 and ${COLD_ID_HASH_CAPACITY}.`);
 	return override;
 }
+function effectiveSessionContextBudgetBytes(): number {
+	const override = SessionManagerTestHooks.sessionContextBudgetBytesOverride;
+	if (override === undefined) return SESSION_CONTEXT_MATERIALIZATION_BUDGET_BYTES;
+	if (!Number.isSafeInteger(override) || override < 1)
+		throw new RangeError("sessionContextBudgetBytesOverride must be a positive safe integer.");
+	return override;
+}
 
 function emptyFirstOpenTelemetry(
 	strategy: SessionMemoryGcStrategy = "pressure",
@@ -6802,6 +7012,9 @@ export class SessionManager {
 	#persistChain: Promise<void> = Promise.resolve();
 	#persistError: Error | undefined;
 	#persistErrorReported = false;
+	/** Defense-in-depth (#4443): one-shot warn for adjacent private thinking blocks in persisted assistant transcripts. */
+	#warnedAdjacentThinkingPersist = false;
+	#closeRetryPending = false;
 	/** Depth of the non-yielding same-session persistence fence (reentrancy counter). */
 	#persistenceFenceDepth = 0;
 	/** Publication fence counter carried by the mutable `.spill.commit` marker. */
@@ -6833,6 +7046,7 @@ export class SessionManager {
 	#managedSidecarSecurityContext: ManagedSessionSecurityContext | undefined;
 	#managedSidecarCacheSessionFile: string | undefined;
 	#managedRangeExpectedDescriptor: DescriptorSnapshot | undefined;
+	#managedPersistExpectedIdentity: ManagedFileIdentity | undefined;
 	#boundedReadStorageProxy: SessionStorage | undefined;
 	#boundedManagedSource:
 		| { path: string; store: ManagedSessionDescendantStore; descriptor: DescriptorSnapshot; owned: boolean }
@@ -6897,6 +7111,7 @@ export class SessionManager {
 		private readonly persist: boolean,
 		storage: SessionStorage,
 		private destination: SessionDestination = explicitDestination(sessionDir),
+		skipEnsureSessionDir = false,
 	) {
 		this.#storage = new Proxy(storage, {
 			get: (target, property, receiver) => {
@@ -6999,7 +7214,7 @@ export class SessionManager {
 		this.#blobStore = persist ? new BlobStore(getBlobsDir()) : this.#residentTextBlobStore;
 		this.#residentImageBlobStore = this.#blobStore;
 		if (persist && sessionDir) {
-			this.#storage.ensureDirSync(sessionDir);
+			if (!skipEnsureSessionDir) this.#storage.ensureDirSync(sessionDir);
 			// Canonicalize the trusted session directory (single choke point for every
 			// creation path: create/open/moveTo/fork/SDK) so benign ancestor symlinks
 			// (e.g. macOS `/var -> /private/var`, a symlinked `$HOME`) are resolved to a
@@ -7448,6 +7663,7 @@ export class SessionManager {
 				flushed: this.#flushed,
 				ensuredOnDisk: this.#ensuredOnDisk,
 				needsFullRewriteOnNextPersist: this.#needsFullRewriteOnNextPersist,
+				managedPersistExpectedIdentity: this.#managedPersistExpectedIdentity,
 				fileEntries: [],
 				materializedFileEntries: [],
 				adoptedArtifactManager: this.#adoptedArtifactManager,
@@ -7482,6 +7698,7 @@ export class SessionManager {
 		this.#flushed = snapshot.flushed;
 		this.#ensuredOnDisk = snapshot.ensuredOnDisk;
 		this.#needsFullRewriteOnNextPersist = snapshot.needsFullRewriteOnNextPersist;
+		this.#managedPersistExpectedIdentity = snapshot.managedPersistExpectedIdentity;
 		this.#adoptedArtifactManager = snapshot.adoptedArtifactManager;
 	}
 	captureState(): SessionManagerStateSnapshot {
@@ -7498,6 +7715,7 @@ export class SessionManager {
 			flushed: this.#flushed,
 			ensuredOnDisk: this.#ensuredOnDisk,
 			needsFullRewriteOnNextPersist: this.#needsFullRewriteOnNextPersist,
+			managedPersistExpectedIdentity: this.#managedPersistExpectedIdentity,
 			// Snapshot entry objects by reference: switch/reload replaces the active entry array,
 			// so rollback does not need structured cloning of extension/custom details.
 			fileEntries: [...this.#fileEntries],
@@ -7533,6 +7751,7 @@ export class SessionManager {
 		this.#flushed = snapshot.flushed;
 		this.#ensuredOnDisk = snapshot.ensuredOnDisk;
 		this.#needsFullRewriteOnNextPersist = snapshot.needsFullRewriteOnNextPersist;
+		this.#managedPersistExpectedIdentity = snapshot.managedPersistExpectedIdentity;
 		if (!retainsPersistWriter) {
 			this.#persistWriter = undefined;
 			this.#persistWriterPath = undefined;
@@ -7581,6 +7800,7 @@ export class SessionManager {
 		this.#titleSource = state.header.titleSource;
 		this.#sessionFile = state.sessionFile;
 		this.#managedRangeExpectedDescriptor = undefined;
+		this.#managedPersistExpectedIdentity = undefined;
 		this.#clearBoundedManagedSource();
 		this.#flushed = false;
 		this.#needsFullRewriteOnNextPersist = false;
@@ -7822,6 +8042,7 @@ export class SessionManager {
 			this.#usageStatistics = commit.usageStatistics;
 			this.#flushed = true;
 			this.#ensuredOnDisk = true;
+			this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(terminalDescriptor);
 			this.#lazyReopenSucceeded = true;
 			this.#lazyReopenFallbackReason = undefined;
 			initialized = true;
@@ -7881,9 +8102,14 @@ export class SessionManager {
 		for (let attempt = 0; attempt < 3000; attempt++) {
 			const lock = this.#storage.acquireExclusiveLockSync(lockPath);
 			if (lock) {
-				if (contended && this.#storage.existsSync(commitPath)) {
+				try {
+					if (contended && this.#storage.existsSync(commitPath)) {
+						this.#releaseExclusiveLockWithRetry(lock);
+						return "published";
+					}
+				} catch (error) {
 					this.#releaseExclusiveLockWithRetry(lock);
-					return "published";
+					throw error;
 				}
 				return lock;
 			}
@@ -8003,6 +8229,7 @@ export class SessionManager {
 				this.#lazyReopenFallbackReason = "bounded_first_open_descriptor_changed";
 				return false;
 			}
+			this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(finalDescriptor);
 			this.#sessionId = discovery.header.id;
 			this.#sessionName = discovery.header.title;
 			this.#titleSource = discovery.header.titleSource;
@@ -8686,9 +8913,24 @@ export class SessionManager {
 	}
 
 	/** Initialize with a specific session file (used by factory methods). */
-	async #initSessionFile(sessionFile: string, initializeMissing = false): Promise<void> {
+	async #initSessionFile(
+		sessionFile: string,
+		initializeMissing = false,
+		strictResume?: { inspection: ResumeInspectionSnapshot; storage: SessionStorage; reuseEntries?: boolean },
+		requireExisting = false,
+		deferPersistenceUntilAccepted = false,
+	): Promise<void> {
 		let strictManagedFallbackEntries: FileEntry[] | undefined;
+		let strictManagedFallbackMigrationApplied = false;
 		const resolvedSessionFile = this.#storage instanceof FileSessionStorage ? path.resolve(sessionFile) : sessionFile;
+		const revalidateStrictResume = (): void => {
+			if (
+				strictResume &&
+				!revalidateStrictResumeInspection(resolvedSessionFile, strictResume.storage, strictResume.inspection)
+			)
+				throw new Error("Could not open session: unstable");
+		};
+		revalidateStrictResume();
 		const sidecarRoot =
 			this.destination.kind === "managed"
 				? this.#managedSidecarRoot(resolvedSessionFile)
@@ -8710,6 +8952,7 @@ export class SessionManager {
 			this.#storage.existsSync(`${sidecarRoot}/.session-memory.spill.commit`);
 		if (boundedTranscriptAdmitted && (await this.#tryInitSessionFileFromSidecar(resolvedSessionFile))) {
 			writeTerminalBreadcrumb(this.cwd, resolvedSessionFile);
+			revalidateStrictResume();
 			return;
 		}
 
@@ -8719,9 +8962,16 @@ export class SessionManager {
 				this.#sessionMemoryAutoDisabledReason = "sidecar_reload_failures";
 			}
 			writeTerminalBreadcrumb(this.cwd, resolvedSessionFile);
+			revalidateStrictResume();
 			return;
 		}
-		if (initializeMissing && !this.#storage.existsSync(resolvedSessionFile)) {
+		revalidateStrictResume();
+		SessionManagerTestHooks.beforeStrictMissingCheck?.(resolvedSessionFile, this.#storage);
+		const transcriptMissing =
+			(initializeMissing || strictResume !== undefined || requireExisting) &&
+			!this.#storage.existsSync(resolvedSessionFile);
+		if ((strictResume || requireExisting) && transcriptMissing) throw new Error("Could not open session: unstable");
+		if (initializeMissing && transcriptMissing) {
 			const fresh = this.#freshSessionState(undefined, resolvedSessionFile);
 			const prepared = this.#prepareFreshSessionTransition(fresh, "memory-fallback");
 			this.#applyFreshSessionMetadata(fresh);
@@ -8733,7 +8983,9 @@ export class SessionManager {
 			this.#ensuredOnDisk = true;
 			return;
 		}
+		if (strictResume?.reuseEntries !== false) strictManagedFallbackEntries = strictResume?.inspection.entries;
 		if (
+			!strictResume &&
 			this.destination.kind === "managed" &&
 			this.#sessionMemoryMode === "enabled" &&
 			process.platform !== "win32"
@@ -8741,10 +8993,12 @@ export class SessionManager {
 			const inspected = inspectResumeSessionFile(resolvedSessionFile, this.#storage);
 			if ("kind" in inspected) throw new Error(`Could not open session: ${inspected.reason}`);
 			strictManagedFallbackEntries = inspected.entries;
+			strictManagedFallbackMigrationApplied = inspected.migrationApplied;
 		}
 		const eagerStat = this.#statSync(resolvedSessionFile);
 		if (eagerStat.size > EAGER_RESUME_TRANSCRIPT_MAX_BYTES) throw new SessionTranscriptOversizedError(eagerStat.size);
 		const entries = strictManagedFallbackEntries ?? (await loadEntriesFromFile(resolvedSessionFile, this.#storage));
+		revalidateStrictResume();
 		if (entries.length === 0) {
 			const fresh = this.#freshSessionState(undefined, resolvedSessionFile);
 			const prepared = this.#prepareFreshSessionTransition(fresh, "memory-fallback");
@@ -8759,7 +9013,12 @@ export class SessionManager {
 		}
 		const header = entries.find(entry => entry.type === "session") as SessionHeader | undefined;
 		const sessionId = header?.id ?? createSessionId();
-		const migrationApplied = migrateToCurrentVersion(entries);
+		const migrationApplied =
+			strictResume && strictResume.reuseEntries !== false
+				? strictResume.inspection.migrationApplied
+				: strictManagedFallbackEntries
+					? strictManagedFallbackMigrationApplied
+					: migrateToCurrentVersion(entries);
 		await resolveBlobRefsInEntries(entries, this.#blobStore);
 		const prepared = this.#prepareResidentTextStoreTransition(
 			{
@@ -8782,7 +9041,9 @@ export class SessionManager {
 		writeTerminalBreadcrumb(this.cwd, resolvedSessionFile);
 		this.#flushed = true;
 		this.#ensuredOnDisk = true;
-		await this.#sanitizeLoadedOpenAIResponsesReplayMetadataAndPersist();
+		this.#adoptManagedPersistIdentity(resolvedSessionFile);
+		if (!strictResume && !deferPersistenceUntilAccepted)
+			await this.#sanitizeLoadedOpenAIResponsesReplayMetadataAndPersist();
 		if (publishedSidecarWasPresent && this.#lazyReopenAttempted && !this.#lazyReopenSucceeded) {
 			this.#sessionMemoryMode = "shadow";
 			this.#sessionMemoryAutoDisabledReason = "sidecar_reload_failures";
@@ -8820,6 +9081,7 @@ export class SessionManager {
 		this.#commitResidentTextStoreTransition(prepared);
 		this.#flushed = true;
 		this.#ensuredOnDisk = true;
+		this.#adoptManagedPersistIdentity(resolvedSessionFile);
 	}
 
 	/** Initialize with a new session (used by factory methods). */
@@ -8933,6 +9195,7 @@ export class SessionManager {
 					titleSource: this.#titleSource,
 					sessionFile: this.#sessionFile,
 					needsFullRewriteOnNextPersist: this.#needsFullRewriteOnNextPersist,
+					managedPersistExpectedIdentity: this.#managedPersistExpectedIdentity,
 				};
 				this.#persistError = undefined;
 				this.#persistErrorReported = false;
@@ -8944,6 +9207,8 @@ export class SessionManager {
 				try {
 					managedTransition?.adopt();
 					writeTerminalBreadcrumb(this.cwd, resolvedSessionFile);
+					await SessionManagerTestHooks.beforeManagedSwitchIdentity?.(resolvedSessionFile, this.#storage);
+					this.#adoptManagedPersistIdentity(resolvedSessionFile);
 					this.#commitResidentTextStoreTransition(prepared);
 				} catch (error) {
 					managedTransition?.rollback();
@@ -8952,6 +9217,7 @@ export class SessionManager {
 					this.#titleSource = previous.titleSource;
 					this.#sessionFile = previous.sessionFile;
 					this.#needsFullRewriteOnNextPersist = previous.needsFullRewriteOnNextPersist;
+					this.#managedPersistExpectedIdentity = previous.managedPersistExpectedIdentity;
 					prepared.dispose();
 					throw error;
 				}
@@ -8984,6 +9250,7 @@ export class SessionManager {
 				flushed: this.#flushed,
 				needsFullRewriteOnNextPersist: this.#needsFullRewriteOnNextPersist,
 				ensuredOnDisk: this.#ensuredOnDisk,
+				managedPersistExpectedIdentity: this.#managedPersistExpectedIdentity,
 				artifactManager: this.#artifactManager,
 				artifactManagerSessionFile: this.#artifactManagerSessionFile,
 				adoptedArtifactManager: this.#adoptedArtifactManager,
@@ -9007,6 +9274,7 @@ export class SessionManager {
 				this.#flushed = previous.flushed;
 				this.#needsFullRewriteOnNextPersist = previous.needsFullRewriteOnNextPersist;
 				this.#ensuredOnDisk = previous.ensuredOnDisk;
+				this.#managedPersistExpectedIdentity = previous.managedPersistExpectedIdentity;
 				this.#artifactManager = previous.artifactManager;
 				this.#artifactManagerSessionFile = previous.artifactManagerSessionFile;
 				this.#adoptedArtifactManager = previous.adoptedArtifactManager;
@@ -9162,7 +9430,10 @@ export class SessionManager {
 		);
 		if (this.destination.kind === "managed") {
 			const bytes = Buffer.from(`${entries.map(entry => JSON.stringify(entry)).join("\n")}\n`, "utf8");
-			await this.#managedTranscriptStore(stage.sessionFile).replace(path.basename(stage.sessionFile), bytes);
+			await this.#managedTranscriptStore(stage.sessionFile).publishNoReplace(
+				path.basename(stage.sessionFile),
+				bytes,
+			);
 		} else {
 			const staleCleanupError = await this.#cleanupPreparedNewSessionPersistence(stage);
 			if (staleCleanupError) throw staleCleanupError;
@@ -9466,6 +9737,7 @@ export class SessionManager {
 		this.#artifactManagerSessionFile = null;
 		this.#adoptedArtifactManager = null;
 		this.#commitResidentTextStoreTransition(transition);
+		if (stage.flushed) this.#adoptManagedPersistIdentity(stage.sessionFile);
 		this.#retireEphemeralArtifacts();
 		stage.committed = true;
 		this.#preparedNewSessions.delete(stage);
@@ -9492,6 +9764,7 @@ export class SessionManager {
 		}
 		this.#preparedNewSessions.delete(stage);
 		stage.discarded = true;
+		if (this.#preparedNewSessions.size === 0 && this.#fileEntries.length === 0) this.#releaseOwnedManagedAuthority();
 	}
 
 	async #retryPreparedNewSessionCleanups(): Promise<void> {
@@ -9794,6 +10067,7 @@ export class SessionManager {
 		this.#needsFullRewriteOnNextPersist = false;
 		this.#ensuredOnDisk = true;
 		this.#commitResidentTextStoreTransition(transition);
+		this.#adoptManagedPersistIdentity(newSessionFile);
 		return { oldSessionFile, newSessionFile };
 	}
 
@@ -9975,7 +10249,7 @@ export class SessionManager {
 					parentStore.removeTreeExpected(stagingName, stagingSnapshot);
 			} catch (cleanupError) {
 				const cleanupMessage = toError(cleanupError).message;
-				if (cleanupMessage !== "cleanup_pending") {
+				if (cleanupMessage !== "cleanup_pending" && cleanupMessage !== "not_found") {
 					throw new Error(`Failed to clean up managed fork artifacts: ${cleanupMessage}`, {
 						cause: toError(error),
 					});
@@ -10243,6 +10517,13 @@ export class SessionManager {
 			managedMove && managedDestinationStore
 				? { directory: path.resolve(newSessionDir), store: managedDestinationStore }
 				: null;
+		// A transcript is only guaranteed to exist at the destination when the old file was
+		// actually present and moved (hadSessionFile). Absent/fresh/deleted-source sessions
+		// have no destination transcript yet, so adopting a strict expected identity here
+		// would invent identity for a nonexistent file; defer adoption until the first real
+		// publication (#writeEntriesAtomicallySync / #appendManagedRecordsSync) instead.
+		if (hadSessionFile) this.#adoptManagedPersistIdentity(this.#sessionFile);
+		else this.#managedPersistExpectedIdentity = undefined;
 
 		const hasAssistant = this.#fileEntries.some(e => e.type === "message" && e.message.role === "assistant");
 		try {
@@ -10279,6 +10560,10 @@ export class SessionManager {
 					managedMove && managedSourceStore
 						? { directory: path.resolve(previousSessionDir), store: managedSourceStore }
 						: null;
+				// Same rationale as the forward path: only adopt strict identity when the source
+				// transcript actually existed (and was thus restorable) before the failed move.
+				if (hadSessionFile) this.#adoptManagedPersistIdentity(previousSessionFile);
+				else this.#managedPersistExpectedIdentity = undefined;
 				const header = this.#fileEntries.find(entry => entry.type === "session") as SessionHeader | undefined;
 				if (header) applyHeaderPatch(header, { cwd: previousCwd });
 				this.#headerExportRevision++;
@@ -14095,6 +14380,20 @@ export class SessionManager {
 		return classification;
 	}
 
+	#adoptManagedPersistIdentity(sessionFile = this.#sessionFile): void {
+		if (this.destination.kind !== "managed" || !sessionFile) {
+			this.#managedPersistExpectedIdentity = undefined;
+			return;
+		}
+		const sessionDir = path.resolve(path.dirname(sessionFile));
+		if (sessionDir !== path.resolve(this.destination.directory)) {
+			this.#managedPersistExpectedIdentity = undefined;
+			return;
+		}
+		const descriptor = this.#managedTranscriptStore(sessionFile).descriptorExpected(path.basename(sessionFile));
+		if (!descriptor) throw new Error("managed_persist_identity_unavailable");
+		this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(descriptor);
+	}
 	/** Current transcript descriptor, or null when unavailable. */
 	#managedDescriptorSnapshotOrNull(): DescriptorSnapshot | null {
 		const sessionFile = this.#sessionFile;
@@ -14127,7 +14426,23 @@ export class SessionManager {
 		this.#withSessionPersistenceFenceSync(() => {
 			if (this.destination.kind === "managed") {
 				const bytes = Buffer.from(`${entries.map(entry => JSON.stringify(entry)).join("\n")}\n`, "utf8");
-				this.#managedTranscriptStore(sessionFile).replaceSync(path.basename(sessionFile), bytes);
+				const store = this.#managedTranscriptStore(sessionFile);
+				const relativePath = path.basename(sessionFile);
+				if (this.#managedPersistExpectedIdentity) {
+					try {
+						store.replaceExpectedIdentitySync(relativePath, bytes, this.#managedPersistExpectedIdentity);
+					} catch (err) {
+						// A confirmed missing predecessor can be recreated from the complete
+						// resident transcript. Any present-but-different identity still fails
+						// closed so a concurrent successor is never overwritten.
+						if (!isEnoent(err)) throw err;
+						this.#managedPersistExpectedIdentity = undefined;
+						store.replaceSync(relativePath, bytes);
+					}
+				} else store.replaceSync(relativePath, bytes);
+				const descriptor = store.descriptorExpected(relativePath);
+				if (!descriptor) throw new Error("managed_replace_identity_unavailable");
+				this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(descriptor);
 				this.#publishCommitMarkerFromCurrentTranscriptSync();
 				return;
 			}
@@ -14634,6 +14949,74 @@ export class SessionManager {
 		this.#clearBoundedManagedSource();
 	}
 
+	#releaseRejectedOpenResources(): void {
+		this.#releaseResidentTextStore();
+		if (this.#preparedNewSessions.size === 0) this.#releaseOwnedManagedAuthority();
+		this.#releaseClosedSessionState();
+	}
+
+	async #retryRejectedOpenWriterCleanup(): Promise<void> {
+		for (let attempt = 0; this.#persistWriter?.getCloseState() === "close_failed_retryable"; attempt++) {
+			await unrefDelay(Math.min(100 * 2 ** Math.min(attempt, 6), 5_000));
+			try {
+				await this.#closePersistWriterInternal();
+			} catch (error) {
+				logger.warn("Retained rejected-open writer close retry failed", { error: toError(error).message });
+			}
+		}
+		// The loop only exits once the writer is terminal (`closed` or the quarantined
+		// `close_unknown`) or was already cleared by a successful close, so ownership of
+		// the descriptor and of the rejected session's resident state always ends here.
+		if (this.#persistWriter) {
+			this.#persistWriter = undefined;
+			this.#persistWriterPath = undefined;
+		}
+		this.#releaseRejectedOpenResources();
+	}
+
+	async #discardRejectedOpenState(): Promise<void> {
+		let closeError: Error | undefined;
+		for (let attempt = 0; this.#persistWriter && attempt < 2; attempt++) {
+			try {
+				await this.#closePersistWriterInternal();
+			} catch (error) {
+				closeError = toError(error);
+				if (this.#persistWriter?.getCloseState() !== "close_failed_retryable") break;
+			}
+		}
+		const state = this.#persistWriter?.getCloseState();
+		if (state === "closed") {
+			// The OS close was dispatched and confirmed, so cleanup succeeded even though
+			// `close()` rethrew a queued write/flush drain failure. Reporting that drain
+			// error as a cleanup failure would mask the real resume rejection, so record
+			// it and let the caller surface the resume error alone.
+			this.#persistWriter = undefined;
+			this.#persistWriterPath = undefined;
+			this.#releaseRejectedOpenResources();
+			if (closeError)
+				logger.warn("Rejected-open writer drained with errors before a confirmed close", {
+					error: closeError.message,
+				});
+			return;
+		}
+		if (state === "close_unknown") {
+			this.#persistWriter = undefined;
+			this.#persistWriterPath = undefined;
+			this.#releaseRejectedOpenResources();
+			throw closeError ?? new Error("Rejected open writer close outcome is unknown");
+		}
+		if (this.#persistWriter) {
+			// Certified pre-dispatch failure: the descriptor is still owned, so the writer
+			// and the resident state it guards are retained until a retry reaches a
+			// terminal close. The retry loop keeps this manager reachable on its own.
+			void this.#retryRejectedOpenWriterCleanup().catch(error => {
+				logger.warn("Rejected-open writer cleanup retry loop failed", { error: toError(error).message });
+			});
+			throw closeError ?? new Error("Rejected open writer close remains retryable");
+		}
+		this.#releaseRejectedOpenResources();
+	}
+
 	/** Close the persistent writer after flushing all pending data. */
 	async close(): Promise<void> {
 		// Drain any uncommitted prepared successors before releasing resources so
@@ -14645,19 +15028,34 @@ export class SessionManager {
 				error: toError(error).message,
 			});
 		}
-		await this.#queuePersistTask(async () => {
-			if (this.#persistWriter) {
-				await this.#closePersistWriterInternal();
-				this.#flushed = true;
-			}
-			if (this.#needsFullRewriteOnNextPersist && !this.#readOnlyResume) await this.#rewriteFileContents();
-		});
-		this.#retireEphemeralArtifacts();
-		await this.#drainEphemeralArtifactCleanups();
+		let closeError: unknown;
+		let taskStarted = false;
+		try {
+			await this.#queuePersistTask(
+				async () => {
+					taskStarted = true;
+					if (this.#persistWriter) {
+						await this.#closePersistWriterInternal();
+						this.#flushed = true;
+					}
+					if (this.#needsFullRewriteOnNextPersist && !this.#readOnlyResume) await this.#rewriteFileContents();
+				},
+				{ ignoreError: this.#closeRetryPending },
+			);
+			this.#persistError = undefined;
+			this.#persistErrorReported = false;
+			this.#closeRetryPending = false;
+			this.#retireEphemeralArtifacts();
+			await this.#drainEphemeralArtifactCleanups();
+		} catch (error) {
+			closeError = error;
+			if (taskStarted) this.#closeRetryPending = true;
+		}
+		const terminalError = closeError ?? this.#persistError;
+		if (terminalError) throw terminalError;
 		this.#releaseResidentTextStore();
-		this.#releaseOwnedManagedAuthority();
+		if (this.#preparedNewSessions.size === 0) this.#releaseOwnedManagedAuthority();
 		this.#releaseClosedSessionState();
-		if (this.#persistError) throw this.#persistError;
 	}
 	/** Flush while open, then strictly close; retryable close skips the invalid second flush. */
 	async flushAndCloseStrict(): Promise<SessionManagerCloseOutcome> {
@@ -14720,7 +15118,7 @@ export class SessionManager {
 			} catch (error) {
 				outcome = { kind: "close_unknown", error: toError(error) };
 			}
-			this.#releaseOwnedManagedAuthority();
+			if (this.#preparedNewSessions.size === 0) this.#releaseOwnedManagedAuthority();
 			this.#releaseClosedSessionState();
 		}
 		return outcome;
@@ -15646,9 +16044,25 @@ export class SessionManager {
 			const store = this.#managedTranscriptStore(sessionFile);
 			const relativePath = path.basename(sessionFile);
 			const bytes = Buffer.from(`${records.map(record => JSON.stringify(record)).join("\n")}\n`, "utf8");
-			// R2.3: the post-operation receipt descriptor (retained or Darwin
-			// replacement) feeds the commit snapshot directly — no pathname stat.
-			const receipt = store.appendSync(relativePath, bytes);
+			let receipt: ManagedAppendReceipt;
+			if (this.#managedPersistExpectedIdentity) {
+				try {
+					receipt = store.appendExpectedIdentitySync(relativePath, bytes, this.#managedPersistExpectedIdentity);
+				} catch (err) {
+					const predecessorMissing = store.descriptorExpected(relativePath) === null;
+					if (
+						!isEnoent(err) &&
+						(!(err instanceof Error) || err.message !== "managed_append_identity_mismatch" || !predecessorMissing)
+					)
+						throw err;
+					// Appending only the new records would create a truncated transcript.
+					// Recreate the missing file from the complete resident entry set instead.
+					this.#managedPersistExpectedIdentity = undefined;
+					this.#rewriteFileSync();
+					return;
+				}
+			} else receipt = store.appendSync(relativePath, bytes);
+			this.#managedPersistExpectedIdentity = receipt.identity;
 			this.#publishSessionCommitMarkerSync(receipt.descriptor);
 		});
 	}
@@ -15806,9 +16220,62 @@ export class SessionManager {
 			// in-memory entries, shrinking the file below the limit. The entry has
 			// already been added to #fileEntries by #appendEntryWithinPersistenceFence.
 			if (err instanceof Error && err.message === "content_too_large") {
-				this.#rewriteFileSync();
+				// Typed near-limit contract (#4566): recover by rewriting only the
+				// live in-memory entries, then verify the recovered file actually
+				// holds the just-appended entry. When even the rewrite cannot fit
+				// the entry (live content alone is at the cap), surface the typed
+				// near-limit outcome instead of silently succeeding without the
+				// receipt for an effect that already committed (e.g. a source edit).
+				const entryBytes = (() => {
+					try {
+						const materialized = materializeResidentEntryForPersistenceSync(
+							entry,
+							this.#residentBlobStores(),
+							new Map(),
+						);
+						return Buffer.byteLength(
+							`${JSON.stringify(prepareEntryForPersistenceSync(materialized, this.#blobStore))}\n`,
+							"utf8",
+						);
+					} catch {
+						return 0;
+					}
+				})();
+				const liveBytesBefore = this.getTranscriptFileBytes();
+				try {
+					this.#rewriteFileSync();
+				} catch (rewriteError) {
+					// The recovery rewrite itself failed. The appended entry stays in
+					// the resident list (its effect, including any committed source
+					// edit, is not lost), but the receipt is not durable yet: report
+					// the typed near-limit outcome instead of an unclassified abort.
+					if (rewriteError instanceof Error && rewriteError.message === "content_too_large") {
+						this.#needsFullRewriteOnNextPersist = true;
+						throw new SessionNearLimitAppendError({
+							entryBytes,
+							liveBytes: liveBytesBefore,
+							capBytes: MANAGED_ARTIFACT_MAX_FILE_BYTES,
+							entryRetained: this.#byId.has(entry.id),
+						});
+					}
+					throw rewriteError;
+				}
 				if (publishResumeBreadcrumb) writeTerminalBreadcrumb(this.cwd, this.#sessionFile);
 				this.#readOnlyResume = false;
+				// Post-rewrite verification: a rewrite that still cannot fit the
+				// entry leaves an effect/receipt gap and must be reported, never
+				// silently swallowed as a successful append.
+				const liveBytesAfter = this.getTranscriptFileBytes();
+				const entryRetained = liveBytesAfter <= MANAGED_ARTIFACT_MAX_FILE_BYTES && this.#byId.has(entry.id);
+				if (!entryRetained) {
+					this.#needsFullRewriteOnNextPersist = true;
+					throw new SessionNearLimitAppendError({
+						entryBytes,
+						liveBytes: liveBytesAfter || liveBytesBefore,
+						capBytes: MANAGED_ARTIFACT_MAX_FILE_BYTES,
+						entryRetained: this.#byId.has(entry.id),
+					});
+				}
 				return;
 			}
 			this.#recordPersistError(err);
@@ -15816,6 +16283,43 @@ export class SessionManager {
 		}
 	}
 
+	/**
+	 * Defense-in-depth (#4443): detect directly adjacent thinking/redacted_thinking
+	 * blocks in a persisted assistant transcript message. Non-mutating read-only
+	 * diagnostic that fires at most once per session manager instance. Bounded to
+	 * development/test builds only via an explicit environment gate so normal
+	 * production never emits the diagnostic or transcript-path metadata.
+	 *
+	 * Only Anthropic-origin assistant messages are inspected: the adjacency class
+	 * is specific to the Anthropic wire contract (#4416), and a provider-neutral
+	 * check would false-positive on OpenAI Responses assemblies that emit one
+	 * internal `thinking` block per reasoning output item.
+	 *
+	 * Names only the envelope shape (content block count), never raw thinking
+	 * text, signatures, or redacted payloads.
+	 */
+	#warnAdjacentPrivateThinking(message: Parameters<typeof this.appendMessage>[0]): void {
+		if (this.#warnedAdjacentThinkingPersist) return;
+		// Explicit environment gate: production builds must not emit this
+		// diagnostic or transcript-path metadata. `NODE_ENV` is the canonical
+		// build-mode signal; the gate is robust to undefined (default: silent).
+		if (process.env.NODE_ENV !== "development" && process.env.NODE_ENV !== "test") return;
+		// Only assistant messages carry content block arrays with thinking blocks.
+		if (message?.role !== "assistant" || !Array.isArray(message.content)) return;
+		// Restrict to Anthropic-origin: the adjacency rejection is specific to the
+		// Anthropic replay wire contract. Other providers tolerate adjacent
+		// reasoning blocks, so a provider-neutral check would be a false positive.
+		if (message.api !== "anthropic-messages") return;
+		if (!hasAdjacentPrivateThinkingBlocks(message.content)) return;
+		this.#warnedAdjacentThinkingPersist = true;
+		logger.warn("Session transcript: persisted assistant message has adjacent thinking blocks", {
+			role: "assistant",
+			provider: message.provider,
+			contentBlockCount: message.content.length,
+			hasAdjacentPrivateBlocks: true,
+		});
+	}
+
 	#appendEntry(entry: SessionEntry): void {
 		this.#withSessionPersistenceFenceSync(() => this.#appendEntryWithinPersistenceFence(entry));
 	}
@@ -15874,6 +16378,16 @@ export class SessionManager {
 				this.#needsFullRewriteOnNextPersist = true;
 				throw new SessionAppendPersistenceError("current_append", residentEntry.id, this.#persistError ?? error);
 			}
+			// Typed near-limit recovery (#4566) already ran its deterministic
+			// rewrite inside _persist and deliberately kept the entry resident so
+			// the committed effect keeps its receipt. Do not roll it back or wrap
+			// it into a generic SessionAppendPersistenceError: propagate the typed
+			// outcome with its structured fields intact.
+			if (error instanceof SessionNearLimitAppendError) {
+				if (sidecarAppendCharge > 0) activeRuntime?.accountant.release(sidecarAppendCharge);
+				if (sidecarTailCharge > 0) activeRuntime?.tailCache.release(sidecarTailCharge);
+				throw error;
+			}
 			const removed = this.#fileEntries.pop();
 			if (removed !== residentEntry)
 				throw new Error("Session append rollback lost resident ordering.", { cause: error });
@@ -16031,6 +16545,12 @@ export class SessionManager {
 			message,
 		};
 		associateSessionMessageEntryId(message, entry.id);
+		// Defense-in-depth (#4443): detect directly adjacent thinking/redacted_thinking
+		// blocks in a persisted assistant transcript message and warn once per session.
+		// This is a read-only observation — storage is NEVER mutated. The diagnostic is
+		// bounded to development/test to avoid production noise, and names only the
+		// envelope shape (block count), never raw thinking text, signatures, or payloads.
+		this.#warnAdjacentPrivateThinking(message);
 		this.#appendEntry(entry);
 		const residentEntry = this.#byId.get(entry.id);
 		if (residentEntry?.type === "message") transferSessionMessageIdentity([message], [residentEntry.message]);
@@ -17460,6 +17980,7 @@ export class SessionManager {
 			this.#sessionFile = newSessionFile;
 			this.#flushed = true;
 			this.#commitResidentTextStoreTransition(transition);
+			this.#adoptManagedPersistIdentity(newSessionFile);
 			return newSessionFile;
 		}
 
@@ -18156,6 +18677,7 @@ export class SessionManager {
 				throw error;
 			}
 		}
+		let retainedFallbackSnapshot: ManagedFileSnapshot | undefined;
 		let sourceSize: number | undefined;
 		try {
 			sourceSize = boundedStorage.statSync(managedSourcePath).size;
@@ -18171,12 +18693,32 @@ export class SessionManager {
 				)
 					return manager;
 			}
+			if (manager.#boundedManagedSource && sourceSize <= eagerHydrationMaxBytes()) {
+				const boundedSource = manager.#boundedManagedSource;
+				retainedFallbackSnapshot = boundedSource.store.readExpected(path.basename(managedSourcePath)) ?? undefined;
+				const terminalDescriptor = boundedSource.store.descriptorExpected(path.basename(managedSourcePath));
+				if (
+					!retainedFallbackSnapshot ||
+					!terminalDescriptor ||
+					!sameDescriptor(boundedSource.descriptor, terminalDescriptor) ||
+					!managedFileSnapshotMatchesDescriptor(retainedFallbackSnapshot, boundedSource.descriptor)
+				)
+					throw new Error("source_changed");
+			}
 		} finally {
 			manager.#clearBoundedManagedSource();
 		}
 		if (sourceSize === undefined) throw new Error("Managed source size unavailable");
 		if (sourceSize > eagerHydrationMaxBytes()) throw new SessionTranscriptOversizedError(sourceSize);
-		const forkEntries = await loadEntriesFromFile(managedSourcePath, storage);
+		const forkEntries = retainedFallbackSnapshot
+			? (() => {
+					const entries = parseSessionEntries(
+						new TextDecoder("utf-8", { fatal: true }).decode(retainedFallbackSnapshot.bytes),
+					);
+					const header = entries[0] as SessionHeader | undefined;
+					return header?.type === "session" && typeof header.id === "string" ? entries : [];
+				})()
+			: await loadEntriesFromFile(managedSourcePath, storage);
 		migrateToCurrentVersion(forkEntries);
 		await resolveBlobRefsInEntries(forkEntries, manager.#blobStore);
 		const sourceHeader = forkEntries.find(entry => entry.type === "session") as SessionHeader | undefined;
@@ -18298,17 +18840,46 @@ export class SessionManager {
 				destination,
 			);
 			manager.#sessionMemoryMode = sessionMemoryMode;
-			await manager.#initSessionFile(filePath);
-			if (strictSmallInspection) {
-				const revalidated = revalidateTranscriptIdentityBounded(filePath, storage, strictSmallInspection.identity);
-				if (revalidated.kind !== "valid" || manager.#sessionId !== strictSmallInspection.identity.sessionId) {
-					manager.setSessionMemoryMode("off");
-					await manager.close();
-					throw new Error("Could not open session: unstable");
+			try {
+				await manager.#initSessionFile(
+					filePath,
+					false,
+					strictSmallInspection ? { inspection: strictSmallInspection, storage, reuseEntries: false } : undefined,
+				);
+				if (strictSmallInspection) {
+					if (
+						!revalidateStrictResumeInspection(filePath, storage, strictSmallInspection) ||
+						manager.#sessionId !== strictSmallInspection.identity.sessionId
+					)
+						throw new Error("Could not open session: unstable");
+					await manager.#sanitizeLoadedOpenAIResponsesReplayMetadataAndPersist();
 				}
+				manager.buildSessionContext();
+				return manager;
+			} catch (error) {
+				manager.setSessionMemoryMode("off");
+				for (const sidecarPath of manager.#disposableSidecarPaths()) {
+					if (!sidecarPath) continue;
+					try {
+						manager.#storage.unlinkSync(sidecarPath);
+					} catch (cleanupError) {
+						if (!isEnoent(cleanupError))
+							logger.warn("Rejected explicit resume sidecar cleanup failed", {
+								error: toError(cleanupError).message,
+							});
+					}
+				}
+				manager.#sidecarRuntime = undefined;
+				try {
+					await manager.#discardRejectedOpenState();
+				} catch (cleanupError) {
+					throw new AggregateError(
+						[toError(error), toError(cleanupError)],
+						"Rejected explicit resume cleanup failed",
+					);
+				}
+				throw error;
 			}
-			manager.buildSessionContext();
-			return manager;
 		}
 		const sameManagedDirectory = path.dirname(path.resolve(filePath)) === path.resolve(destination.directory);
 		let managedInspectionStore: ManagedSessionDescendantStore | undefined;
@@ -18319,16 +18890,68 @@ export class SessionManager {
 		}
 		let managedSourceSize: number | undefined;
 		try {
+			await SessionManagerTestHooks.beforeManagedSourceStat?.(filePath, managedInspectionStorage);
 			managedSourceSize = managedInspectionStorage.statSync(filePath).size;
-		} catch {
-			// Strict inspection below reports the stable failure.
+		} catch (error) {
+			if (!isEnoent(error)) {
+				managedInspectionStore?.close();
+				throw error;
+			}
+			if (managedInspectionStore) {
+				managedInspectionStore.assertBound();
+				await SessionManagerTestHooks.beforeManagedMissingInit?.(filePath, managedInspectionStorage);
+				managedInspectionStore.assertBound();
+				const manager = new SessionManager(
+					getProjectDir(),
+					destination.directory,
+					true,
+					storage,
+					destination,
+					true,
+				);
+				manager.#sessionMemoryMode = sessionMemoryMode;
+				try {
+					await SessionManagerTestHooks.beforeManagedMissingPublish?.(filePath, managedInspectionStorage);
+					managedInspectionStore.assertBound();
+					await SessionManagerTestHooks.afterManagedMissingAssertion?.(filePath, managedInspectionStorage);
+					const fresh = manager.#freshSessionState(undefined, filePath);
+					const prepared = manager.#prepareFreshSessionTransition(fresh, "memory-fallback");
+					manager.#applyFreshSessionMetadata(fresh);
+					manager.#commitResidentTextStoreTransition(prepared, false);
+					manager.#retireEphemeralArtifacts();
+					const content = `${JSON.stringify(prepareEntryForPersistenceSync(fresh.header, manager.#blobStore))}\n`;
+					managedInspectionStore.publishNoReplaceSync(path.basename(filePath), Buffer.from(content, "utf8"));
+					const publishedTranscript = managedInspectionStore.readExpected(path.basename(filePath));
+					if (publishedTranscript?.bytes?.equals(Buffer.from(content, "utf8")) !== true)
+						throw new Error("Could not open session: unstable");
+					if (manager.#effectiveSessionMemoryMode() !== "off") {
+						manager.#buildDisposableSidecars(manager.#fileEntries);
+						if (manager.#coldSidecarActive()) manager.#retireColdEntries();
+					}
+					manager.#flushed = true;
+					manager.#ensuredOnDisk = true;
+					await SessionManagerTestHooks.beforeManagedMissingReturn?.(filePath, managedInspectionStorage);
+					const returnTranscript = managedInspectionStore.readExpected(path.basename(filePath));
+					if (!returnTranscript || !managedFileSnapshotEquals(returnTranscript, publishedTranscript))
+						throw new Error("Could not open session: unstable");
+					manager.#managedPersistExpectedIdentity = returnTranscript.identity;
+					writeTerminalBreadcrumb(manager.cwd, filePath);
+					return manager;
+				} catch (createError) {
+					await manager.#discardRejectedOpenState();
+					throw createError;
+				} finally {
+					managedInspectionStore.close();
+				}
+			}
+			// Cross-directory missing candidates continue through the migration path below.
 		}
 		const managedResumeBounded =
-			sessionMemoryMode === "enabled" ||
-			(sessionMemoryMode === "auto" &&
-				process.platform !== "win32" &&
-				managedSourceSize !== undefined &&
-				managedSourceSize >= autoModeMinTranscriptBytes());
+			managedSourceSize !== undefined &&
+			(sessionMemoryMode === "enabled" ||
+				(sessionMemoryMode === "auto" &&
+					process.platform !== "win32" &&
+					managedSourceSize >= autoModeMinTranscriptBytes()));
 		let strictManagedSmallInspection: ResumeInspectionSnapshot | undefined;
 		if (
 			managedResumeBounded &&
@@ -18345,32 +18968,78 @@ export class SessionManager {
 				throw error;
 			}
 		}
+		const managedBoundedDescriptor =
+			managedResumeBounded && sameManagedDirectory
+				? managedInspectionStore?.descriptorExpected(path.basename(filePath))
+				: undefined;
+		if (managedResumeBounded && sameManagedDirectory && !managedBoundedDescriptor) {
+			managedInspectionStore?.close();
+			throw new Error("Could not open session: unstable");
+		}
 
 		if (managedResumeBounded && sameManagedDirectory) {
 			const manager = new SessionManager(getProjectDir(), destination.directory, true, storage, destination);
 			manager.#sessionMemoryMode = sessionMemoryMode;
 			try {
-				await manager.#initSessionFile(filePath, true);
+				await manager.#initSessionFile(
+					filePath,
+					true,
+					strictManagedSmallInspection
+						? { inspection: strictManagedSmallInspection, storage: managedInspectionStorage }
+						: undefined,
+					true,
+					true,
+				);
+				SessionManagerTestHooks.beforeManagedResumeAcceptance?.(filePath, managedInspectionStorage);
+				const terminalManagedDescriptor = managedInspectionStore?.descriptorExpected(path.basename(filePath));
+				if (
+					!managedBoundedDescriptor ||
+					!terminalManagedDescriptor ||
+					!sameDescriptor(managedBoundedDescriptor, terminalManagedDescriptor)
+				)
+					throw new Error("Could not open session: unstable");
 				if (strictManagedSmallInspection) {
-					const revalidated = revalidateTranscriptIdentityBounded(
-						filePath,
-						managedInspectionStorage,
-						strictManagedSmallInspection.identity,
-					);
 					if (
-						revalidated.kind !== "valid" ||
+						!revalidateStrictResumeInspection(filePath, managedInspectionStorage, strictManagedSmallInspection) ||
 						manager.#sessionId !== strictManagedSmallInspection.identity.sessionId
 					) {
 						manager.setSessionMemoryMode("off");
 						throw new Error("Could not open session: unstable");
 					}
 				}
+				if (manager.#sanitizeLoadedOpenAIResponsesReplayMetadata().length > 0)
+					manager.#needsFullRewriteOnNextPersist = true;
+				SessionManagerTestHooks.beforeManagedResumeReturn?.(filePath, managedInspectionStorage);
+				const returnManagedDescriptor = managedInspectionStore?.descriptorExpected(path.basename(filePath));
+				if (!returnManagedDescriptor || !sameDescriptor(managedBoundedDescriptor, returnManagedDescriptor))
+					throw new Error("Could not open session: unstable");
+				manager.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(returnManagedDescriptor);
 				const header = manager.#fileEntries.find(entry => entry.type === "session") as SessionHeader | undefined;
 				if (header?.cwd) manager.cwd = header.cwd;
 				manager.buildSessionContext();
 				return manager;
 			} catch (error) {
-				await manager.close().catch(() => {});
+				manager.setSessionMemoryMode("off");
+				for (const sidecarPath of manager.#disposableSidecarPaths()) {
+					if (!sidecarPath) continue;
+					try {
+						manager.#storage.unlinkSync(sidecarPath);
+					} catch (cleanupError) {
+						if (!isEnoent(cleanupError))
+							logger.warn("Rejected managed resume sidecar cleanup failed", {
+								error: toError(cleanupError).message,
+							});
+					}
+				}
+				manager.#sidecarRuntime = undefined;
+				try {
+					await manager.#discardRejectedOpenState();
+				} catch (cleanupError) {
+					throw new AggregateError(
+						[toError(error), toError(cleanupError)],
+						"Rejected managed resume cleanup failed",
+					);
+				}
 				throw error;
 			} finally {
 				managedInspectionStore?.close();
@@ -18462,6 +19131,7 @@ export class SessionManager {
 					const finalDescriptor = store.descriptorExpected(path.basename(resolved));
 					if (!finalDescriptor || !sameDescriptor(capturedDescriptor, finalDescriptor))
 						throw new Error("source_changed");
+					boundedManager.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(finalDescriptor);
 					boundedManager.buildSessionContext();
 					return boundedManager;
 				}
@@ -18901,6 +19571,7 @@ export class SessionManager {
 					manager.destination = destination;
 					manager.#sessionFile = finalSessionFile;
 					manager.#commitResidentTextStoreTransition(finalTransition);
+					manager.#adoptManagedPersistIdentity(finalSessionFile);
 				} catch (error) {
 					finalTransition.dispose();
 					throw error;
@@ -19251,6 +19922,7 @@ export class SessionManager {
 		this.#sessionFile = promotionPath;
 		this.#recoveryPromotionTranscriptPath = undefined;
 		this.#commitResidentTextStoreTransition(transition);
+		this.#adoptManagedPersistIdentity(promotionPath);
 		writeTerminalBreadcrumb(this.cwd, promotionPath);
 		this.#recoveryHydrationContext = undefined;
 	}