@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/session-reconcile.d.ts

@@ -92,13 +92,13 @@ export interface ReconcileReport {
  */
 export declare function findOrphanToolCalls(messages: AgentMessage[], suspendedBatch?: ReadonlySet<string>): OrphanToolCall[];
 /**
- * backlog #389 伴生 (D-2) — CC 2.1.223's interruption markers, VERBATIM (`$U`/`CR` @ `CC:151120-151121`,
+ * backlog #389 伴生 (D-2) — the reference's interruption markers, as is (
  * minted as a USER message by `Jce` @ `CC:640141-640154`). CC mints one on every abort whose reason is
  * outside `{"interrupt","refusal-fallback-edit"}` — and the interactive Esc / remote cancel, which is
  * what `TaskStream.interrupt()` corresponds to, is precisely on the minting side (`CC:1033698-1033733`).
  * The suppressed reason is the one case where the user's own replacement message is already the context.
  *
- * Taken verbatim rather than reworded: this string is an INPUT to later reasoning in CC (its own
+ * Taken as is rather than reworded: this string is an INPUT to later reasoning in CC (its own
  * "interrupted then immediately retried the same action" rule reads it back), and the constitution's
  * standing rule is that a question CC has answered is answered in CC's form.
  */

package/dist/core/session-store.d.ts

@@ -1,5 +1,5 @@
-import { type SessionPlacementRecord, type SessionRepo } from "../internal/harness.js";
-import { type AcquiredSession, type PlacedSessionRow, type SessionPlacement, type SessionStore, type SessionStoreSummary } from "./session.js";
+import { type Session, type SessionHead, type SessionPlacementRecord, type SessionRepo } from "../internal/harness.js";
+import { type AcquiredSession, type PlacedSessionRow, type SessionListQuery, type SessionPlacement, type SessionStore, type SessionStoreSummary } from "./session.js";
 import type { StoreDurability } from "./checkpoint-store.js";
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
@@ -117,29 +117,27 @@ export declare class TtlSessionStore implements SessionStore {
         olderThanMs?: number;
         scope?: string;
     }) => Promise<PlacedSessionRow[]>;
+    /** The by-id head read ({@link SessionStore.headOf}): the repo's own, verbatim — the row is the repo's, never this cache's, and a read
+     *  racing a delete answers either generation (it never waits on one). Present only when the backing repo answers it (absence means no
+     *  by-id head read, and so no ownership pair for an authorizer). */
+    readonly headOf?: (sessionId: string) => Promise<SessionHead | undefined>;
+    /** The repo's head read as this store's own decisions read the row through it (the cache check, the existence check), held
+     *  privately so the store's reading of its rows is the repo's whatever a host does with the face. */
+    private readonly repoHead?;
     private repo;
     private entries;
-    /** Session-ownership rows (the multi-tenant admission capability face — see SessionStore.ownerOf).
-     *  Deliberately NOT part of `entries`: an evicted-but-durable session (`forget` / evict:"forget")
-     *  still EXISTS, and its ownership row outliving the cache entry is what keeps a live session from
-     *  reading as `undefined` (= re-claimable by anyone). Rows die only when the repo's history does. */
-    private owners;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) share one session. */
     private pending;
-    /** Subagent transcript persistence — placed ids whose durable deletion FAILED: the
-     *  placed fact for the retry lives HERE, not on a retained cache entry, because the repo may have
-     *  torn down the shared session authority before its removal failed (the File repo closes the
-     *  append fd pre-rmSync) — a retained entry would serve a session whose log is closed while the
-     *  file still exists (append → log_closed, transcript revival broken until restart). The entry is
-     *  dropped instead, so a re-acquire replays a FRESH authority from disk; success clears the row. */
+    /** Subagent transcript persistence — placed ids whose durable deletion FAILED. Not a reading of placement: the row is that
+     *  (see `rowIsPlaced`). It makes a later cold `release` read the row whatever the repo or the store's declaration, and it is never
+     *  believed in the row's place: a read that faults deletes nothing. No cache entry is retained instead, because the repo may have torn down the shared session
+     *  authority before its removal failed (the File repo closes the append fd pre-rmSync): a retained entry would serve a closed log. */
     private pendingPlacedDeletes;
-    /** Subagent transcript persistence — placed deletions IN FLIGHT: acquire awaits the
-     *  settlement before resolving the id, because the repo's delete tears down the shared session
-     *  authority mid-flight — an acquire racing the await window could capture (or rebuild and then
-     *  lose) an authority the delete is about to close, and the caller would hold a session whose
-     *  first append answers log_closed while the file still exists. The gate is per-id and bounded by
-     *  the delete's own settlement (both outcomes release it). */
-    private deletingPlaced;
+    /** Releases (and idle-sweep deletes) IN FLIGHT that may delete the row: acquire and register — the two that resolve or write the row —
+     *  await the settlement, because the repo's delete tears down the shared session authority mid-flight — an acquire racing the await window could capture (or rebuild
+     *  and then lose) an authority the delete is about to close, and the caller would hold a session whose first append answers
+     *  log_closed while the file still exists. The gate is per-id and bounded by the release's own settlement (both outcomes release it). */
+    private releasing;
     /** Sessions pinned by a design/45 checkpoint — skipped by idle sweep until unpinned (B6/§5). */
     private pinned;
     private defaultTtlMs;
@@ -151,6 +149,17 @@ export declare class TtlSessionStore implements SessionStore {
         requireExisting?: boolean;
         placement?: SessionPlacement;
     }): Promise<AcquiredSession>;
+    /** The one judgement of "does this cached view still stand for this row": `shown` is the view's session metadata and `row` the row as
+     *  a read of it answered (a listed row, or the repo's head; `undefined` = no row, or no read of one). A row naming the view's
+     *  occupant (`compareOccupants`) stands for it; a row naming another does not; and a row naming a different owner does not either —
+     *  the owner is recorded once, by the write that creates the row, so another owner's row is another row whatever it names. When
+     *  the evidence says neither (unknown) the answer is the repo's: over one with a head read the row can always be read again, so a
+     *  view without positive proof is dropped and the id resolved from the row; over one with no head read (it mints no occupant token)
+     *  the cached view is the only evidence of the occupant, and it stands. */
+    private viewStandsFor;
+    /** Whether a cached view is still the occupant the row holds ({@link viewStandsFor}, over the row's head read in one read). Over a repo
+     *  with no head read there is no row to read: the judge's answer for no row there is "stands", given without reading the view. */
+    private cachedViewStands;
     /** The placement admission ({@link admitSessionPlacement}) for this store, judged on every resolution path. The
      *  partition declaration is a getter over this store's live field, so it is read where the admission judges the
      *  mirror direction (after the request's own members, and only then) — never captured at construction. */
@@ -159,16 +168,28 @@ export declare class TtlSessionStore implements SessionStore {
      *  `requireExisting`, in which case a genuinely-missing id fails loud instead — design/114 Phase3). */
     private openOrCreate;
     private createAndStore;
-    /** Refresh the idle timer for a session. */
-    touch(sessionId: string): void;
+    /** Refresh the idle timer for a session, and record the activity on its row through the repo ({@link SessionRepo.touch}, where the repo
+     *  has it) — the time {@link list} orders by. A fault recording it rejects. */
+    touch(sessionId: string): Promise<void>;
     /** Record the most recent task run on a cached session (the `/resume` `lastRunId`); also bumps the idle
      *  timer. Best-effort — a no-op if the session isn't cached here (the run will still be re-attachable via
      *  its checkpoint). */
     noteTaskRun(sessionId: string, taskId: string, runId?: string): void;
-    /** List the live cache as {@link SessionStoreSummary} projections, newest-first by `lastActiveAt` (so a
-     *  shell's `/resume` shows recent sessions + their last run first). The in-memory store lists only its
-     *  live cache, not evicted/durable history — a durable backend overrides this to list persisted sessions. */
-    list(): Promise<SessionStoreSummary[]>;
+    /**
+     * One page of the repo's sessions ({@link SessionStore.list}): the rows the repo lists — what a restart still finds, not this
+     * cache — each projected from the row and ordered by the activity the repo RECORDS for it (its writes, and the touches this store
+     * records through it): never by what this process saw, so a dropped cache, a restart or another replica pages the same order, and a
+     * cursor is never overtaken by a row whose time moved back. The cached view adds only what it alone holds — the run it recorded
+     * (`lastTaskId` / `lastTaskRunId`; after a restart, or once the view is evicted, a row lists without them) — and only while the view
+     * stands for the listed row ({@link viewStandsFor}, the judgement `acquire` serves the cached session by). Every row is read to order the page; the repo's listing cost is its own (the File repo: one header
+     * read per session).
+     */
+    list(query?: SessionListQuery): Promise<SessionStoreSummary[]>;
+    /** A listed row's projection: the row's own cells, and the cached view's run while the view stands for the row
+     *  ({@link viewStandsFor} — the row is read here, so a view of an occupant it names otherwise lends nothing). A row's activity is the
+     *  repo's recorded time for it, else its creation — the view's own time is never read, so a repo that records none lists by creation;
+     *  one whose times are both unreadable lists at 0 — at the end, never left out. */
+    private summaryOf;
     /**
      * design/110 (F3) — FORK a session: copy `sourceId`'s committed history into a NEW session and return its id
      * (or `null` when the source doesn't exist). Delegates to the backing repo's `fork`, so a durable repo persists the
@@ -179,8 +200,34 @@ export declare class TtlSessionStore implements SessionStore {
      * fork capability mounts (it was INERT before — the durable repo had `fork` but the store never exposed it).
      */
     fork(sourceId: string, owner?: string | null): Promise<string | null>;
-    /** Drop a session from the live set. With a durable repo (`evict: "forget"`) the history is kept. */
+    /** Drop a session from the live set. With a durable repo (`evict: "forget"`) the history is kept. A release that rejects leaves the
+     *  session where it was: the store keeps no view of it and retries nothing on its own, and a placed row is found again by the
+     *  partition-GC leg's `listPlaced` — except one whose header is damaged, which `listPlaced` skips and every release of it rejects
+     *  (`corrupt_session`), so only manual cleanup removes it. */
     release(sessionId: string): Promise<void>;
+    /** Run a release that may delete the row while it holds the id: the gate is set before the first await, after any release already in
+     *  flight for the id, and `acquire` / `register` answer after it settles — no caller captures an authority the delete is about to tear
+     *  down (the repo closes the shared authority before its removal can fail), or writes the row mid-decision. */
+    private holdingId;
+    /** The deciding half of {@link release}, under its gate. A delete goes through the cached view only while the row still stands for it
+     *  (`cachedViewStands`); with no view, or a view of an occupant the row no longer holds (another writer deleted the row, or deleted and
+     *  created it again), the row decides — its placement read cold ({@link rowIsPlaced}) — and an unplaced row nobody here holds is left
+     *  as it is. Placement obligation 4: a placed row's release is a REAL deletion whatever the evict policy (the joint reap deletes the
+     *  agent row first and then calls this to end the transcript; a forget would strand it). A delete runs only on a read that answered
+     *  — the head read with the view still standing, or the row's own placement: a read that faults deletes nothing, and the release
+     *  rejects with it. A placed release that fails (a read or the delete) leaves the tombstone, so the retry reads the row again —
+     *  never a retained cache entry, which could serve a closed log; an unplaced view's release under `evict: "delete"` leaves nothing,
+     *  so its retry after a failed read resolves and deletes nothing. */
+    private releaseRow;
+    /** The repo's placement probe, where it has one. */
+    private placementProbe;
+    /** Whether an uncached id's row is worth reading for its placement: through the probe on a store that declares placements, and by
+     *  either means for an id whose placed deletion failed here. */
+    private rowReadMatters;
+    /** Whether the row standing under `sessionId` is placed: the repo's placement probe where it has one, else the row's own metadata,
+     *  read where {@link rowReadMatters}. Its answer retires the tombstone. A read that FAULTS answers nothing: it rejects (the release
+     *  deletes nothing and fails with it), and the tombstone stays for the next release to read the row again. */
+    private rowIsPlaced;
     /** Drop only the cached view — the repo keeps the session regardless of `evictPolicy`, so a re-acquire
      *  re-opens the SAME history (B-17: the reconcile retry / prepare-throw paths must never delete). Cost
      *  on the default in-memory repo: ONE retained session object **per forgotten id** until process end
@@ -193,19 +240,41 @@ export declare class TtlSessionStore implements SessionStore {
     pin(sessionId: string): void;
     /** Release a design/45 pin (on resume or checkpoint expiry); the session resumes normal idle eviction. */
     unpin(sessionId: string): void;
-    /** Multi-tenant admission capability (see the SessionStore contract for the three-state semantics
-     *  and the first-write-wins requirement — both are load-bearing for the deployment's owner gate). */
-    ownerOf(sessionId: string): Promise<string | null | undefined>;
-    /** First-write-wins idempotent upsert; a synchronous Map write is atomic per the contract. Makes no
-     *  authorization decision — the authorizer re-reads {@link ownerOf} and judges there. */
+    /** The owner write of the ownership pair (see the SessionStore contract): an id with no row gets one — an ordinary row recording
+     *  `owner` in its creating write, through the repo's create (the repo makes the creation first-write-wins); an id whose row exists is
+     *  left exactly as it is, whatever this call carries. Makes no authorization decision — the authorizer re-reads {@link headOf}. The
+     *  row is not cached here: it is resolved like any other row on the next `acquire`. */
     register(sessionId: string, owner: string | null): Promise<void>;
-    /** The session row's incarnation cell (see the SessionStore contract), read from the ROW through the
-     *  repo on every call — never from this cache: a cached view outlives a row another store over the
-     *  same repo deleted or recreated, and its copy would name the previous occupant. No row ⇒
-     *  `undefined`; any other repo failure rejects (a fault is not an answer). Never caches, never creates. */
-    incarnationOf(sessionId: string): Promise<string | undefined>;
+    /** Whether the repo holds a row for `sessionId` — its head read where it has one (no replay of the row's history), else an open. A
+     *  fault rejects; it is not an answer. */
+    private hasRow;
     /** Evict idle-expired sessions from the cache. Deletes durable history only when `evict: "delete"`. */
     sweep(now?: number): void;
     get size(): number;
     dispose(): void;
 }
+/**
+ * design/110 (F4) — pick the fork point so a child does NOT inherit an in-flight (uncommitted) tool call.
+ *
+ * The agent loop commits the assistant turn (`message_end` → `appendMessage`) BEFORE it executes that turn's tool
+ * calls. So while the Fork tool's own `execute` runs, the source session's LEAF is the assistant message that carries
+ * the Fork tool-call (and any sibling parallel calls) with NO tool results behind it yet. Forking the whole log would
+ * copy that orphan call into the child, and the child's wake-time `reconcileInterruptedSession` would inject an
+ * `[INTERRUPTED]` result for it — polluting the inherited context ("I called Fork → it was interrupted").
+ *
+ * Detection: the latest assistant `message` on the leaf's chain (past the tool results behind it) has a `toolCall` block
+ * (the message shape — there is NO `toolCalls` field; tool calls are content blocks) that no tool result behind it answers —
+ * the loop's own reading of an open batch (`findUnansweredToolBatch`). When so, fork at the turn's PARENT (`position:"at"`
+ * includes the parent, excludes the assistant turn) — the correct fork semantics: "inherit my context up to, but not
+ * including, the spawn call". A settled leaf (a text-only turn, or a tool turn every call of which is answered), or an
+ * unsettled assistant that is somehow a root (no `parentId`, fail-safe), forks the whole log (`{}`).
+ *
+ * Exported at the package root: the bundled store's `fork` and any other store's `fork` are the same question and must give the same
+ * answer — a backend reads the source session (`SessionRepo.open`), asks this, and hands the answer to `SessionRepo.fork` with the id
+ * and owner it mints. Forking the whole log instead copies the in-flight turn. The walk is one of the parent-chain walks, so it takes the
+ * shared guard: a leaf on a loop of tool-result messages is refused `invalid_session` (the sentence of `getPathToRoot`) instead of followed.
+ */
+export declare function settledForkOptions(source: Session): Promise<{
+    entryId?: string;
+    position?: "at";
+}>;

package/dist/core/session-store.js

@@ -1,5 +1,5 @@
-import { InMemorySessionRepo, SessionError, uuidv7, } from "../internal/harness.js";
-import { isSessionConflict } from "./session.js";
+import { InMemorySessionRepo, ParentChainGuard, SessionError, findUnansweredToolBatch, compareOccupants, ownerCell, uuidv7, } from "../internal/harness.js";
+import { isSessionConflict, readSessionListQuery } from "./session.js";
 import { readMember } from "./thrown-value.js";
 const DAY_MS = 24 * 60 * 60 * 1000;
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
@@ -23,12 +23,13 @@ export class TtlSessionStore {
     durability;
     placements;
     listPlaced;
+    headOf;
+    repoHead;
     repo;
     entries = new Map();
-    owners = new Map();
     pending = new Map();
     pendingPlacedDeletes = new Set();
-    deletingPlaced = new Map();
+    releasing = new Map();
     pinned = new Set();
     defaultTtlMs;
     evictPolicy;
@@ -46,6 +47,11 @@ export class TtlSessionStore {
         if (typeof repoListPlaced === "function") {
             this.listPlaced = (kind, o) => repoListPlaced.call(this.repo, kind, o);
         }
+        const repoHeadOf = this.repo.headOf;
+        if (typeof repoHeadOf === "function") {
+            this.repoHead = (sessionId) => repoHeadOf.call(this.repo, sessionId);
+            this.headOf = this.repoHead;
+        }
         if (opts.sweepIntervalMs !== undefined && opts.sweepIntervalMs > 0) {
             this.sweepTimer = setInterval(() => this.sweep(), opts.sweepIntervalMs);
             this.sweepTimer.unref?.();
@@ -54,14 +60,18 @@ export class TtlSessionStore {
     async acquire(sessionId, opts) {
         this.sweep();
         if (sessionId) {
-            const inflightPlacedDelete = this.deletingPlaced.get(sessionId);
-            if (inflightPlacedDelete !== undefined)
-                await inflightPlacedDelete;
+            const inflightRelease = this.releasing.get(sessionId);
+            if (inflightRelease !== undefined)
+                await inflightRelease;
             const existing = this.entries.get(sessionId);
             if (existing) {
-                this.assertPlacementAdmission(sessionId, existing.placement, opts);
-                existing.lastActiveAt = Date.now();
-                return { session: existing.session, sessionId };
+                if (await this.cachedViewStands(sessionId, existing)) {
+                    this.assertPlacementAdmission(sessionId, existing.placement, opts);
+                    existing.lastActiveAt = Date.now();
+                    return { session: existing.session, sessionId };
+                }
+                if (this.entries.get(sessionId) === existing)
+                    this.entries.delete(sessionId);
             }
             if (opts?.requireExisting) {
                 return { session: await this.openOrCreate(sessionId, true), sessionId };
@@ -87,6 +97,20 @@ export class TtlSessionStore {
         const meta = await session.getMetadata();
         return { session, sessionId: meta.id };
     }
+    viewStandsFor(shown, row) {
+        const verdict = compareOccupants(shown, row);
+        if (verdict !== "unknown")
+            return verdict === "same";
+        if (row !== undefined && (shown.owner ?? null) !== (row.owner ?? null))
+            return false;
+        return this.repoHead === undefined;
+    }
+    async cachedViewStands(sessionId, cached) {
+        if (this.repoHead === undefined)
+            return true;
+        const [shown, row] = await Promise.all([cached.session.getMetadata(), this.repoHead(sessionId)]);
+        return this.viewStandsFor(shown, row);
+    }
     assertPlacementAdmission(sessionId, placement, opts) {
         const store = this;
         admitSessionPlacement(sessionId, placement, opts ?? {}, {
@@ -99,8 +123,6 @@ export class TtlSessionStore {
         try {
             const session = await this.repo.open({ id, createdAt: "" });
             const meta = await session.getMetadata();
-            if (meta.placement === undefined)
-                this.pendingPlacedDeletes.delete(id);
             this.entries.set(id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}), ...(meta.placement !== undefined ? { placement: meta.placement } : {}) });
             return session;
         }
@@ -115,18 +137,25 @@ export class TtlSessionStore {
         }
     }
     async createAndStore(id, placement) {
-        const session = await this.repo.create({ ...(id !== undefined ? { id } : {}), ...(placement !== undefined ? { placement } : {}) });
+        let session;
+        try {
+            session = await this.repo.create({ ...(id !== undefined ? { id } : {}), ...(placement !== undefined ? { placement } : {}) });
+        }
+        catch (err) {
+            if (id === undefined || !isSessionConflict(err))
+                throw err;
+            session = await this.repo.open({ id, createdAt: "" });
+        }
         const meta = await session.getMetadata();
-        if (meta.placement === undefined)
-            this.pendingPlacedDeletes.delete(meta.id);
         this.entries.set(meta.id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}), ...(meta.placement !== undefined ? { placement: meta.placement } : {}) });
         return session;
     }
-    touch(sessionId) {
+    async touch(sessionId) {
         const e = this.entries.get(sessionId);
         if (e) {
             e.lastActiveAt = Date.now();
         }
+        await this.repo.touch?.(sessionId);
     }
     noteTaskRun(sessionId, taskId, runId) {
         const e = this.entries.get(sessionId);
@@ -139,18 +168,36 @@ export class TtlSessionStore {
             e.lastActiveAt = Date.now();
         }
     }
-    async list() {
-        return [...this.entries.entries()]
-            .filter(([, e]) => e.placement === undefined)
-            .map(([sessionId, e]) => ({
-            sessionId,
-            lastActiveAt: e.lastActiveAt,
-            ...(e.createdAt !== undefined && e.createdAt !== "" ? { createdAt: e.createdAt } : {}),
-            ...(e.lastTaskId !== undefined ? { lastTaskId: e.lastTaskId } : {}),
-            ...(e.lastTaskRunId !== undefined ? { lastTaskRunId: e.lastTaskRunId } : {}),
-            ...(e.forkedFrom !== undefined ? { forkedFrom: e.forkedFrom } : {}),
-        }))
-            .sort((a, b) => b.lastActiveAt - a.lastActiveAt);
+    async list(query) {
+        const q = readSessionListQuery(query);
+        const page = [];
+        for (const row of await this.repo.list()) {
+            if (row.placement !== undefined)
+                continue;
+            const owner = row.owner ?? null;
+            if (q.owner !== undefined && owner !== q.owner && !(q.includeUnowned && owner === null))
+                continue;
+            const summary = await this.summaryOf(row);
+            if (q.after !== undefined && newestFirst(q.after, summary) >= 0)
+                continue;
+            page.push(summary);
+        }
+        return page.sort(newestFirst).slice(0, q.limit);
+    }
+    async summaryOf(row) {
+        const cached = this.entries.get(row.id);
+        const view = cached !== undefined && this.viewStandsFor(await cached.session.getMetadata(), row) ? cached : undefined;
+        const recorded = row.lastActiveAt !== undefined && Number.isFinite(row.lastActiveAt) ? row.lastActiveAt : Date.parse(row.createdAt);
+        const lastActiveAt = Number.isFinite(recorded) ? recorded : 0;
+        const forkedFrom = row.forkedFrom ?? view?.forkedFrom;
+        return {
+            sessionId: row.id,
+            lastActiveAt,
+            ...(row.createdAt !== "" ? { createdAt: row.createdAt } : {}),
+            ...(view?.lastTaskId !== undefined ? { lastTaskId: view.lastTaskId } : {}),
+            ...(view?.lastTaskRunId !== undefined ? { lastTaskRunId: view.lastTaskRunId } : {}),
+            ...(forkedFrom !== undefined ? { forkedFrom } : {}),
+        };
     }
     async fork(sourceId, owner) {
         let source;
@@ -164,17 +211,8 @@ export class TtlSessionStore {
             throw err;
         }
         const forkOptions = await settledForkOptions(source);
-        const forkParams = { ...forkOptions, id: uuidv7() };
-        if (owner != null) {
-            forkParams.owner = owner;
-        }
-        const forked = await this.repo.fork(await source.getMetadata(), forkParams);
+        const forked = await this.repo.fork(await source.getMetadata(), { ...forkOptions, id: uuidv7(), ...(owner !== undefined ? { owner } : {}) });
         const meta = await forked.getMetadata();
-        const inherited = this.owners.has(sourceId) ? this.owners.get(sourceId) : undefined;
-        const forkOwner = owner ?? inherited;
-        if (forkOwner !== undefined && !this.owners.has(meta.id)) {
-            this.owners.set(meta.id, forkOwner);
-        }
         this.entries.set(meta.id, {
             session: forked,
             lastActiveAt: Date.now(),
@@ -187,46 +225,66 @@ export class TtlSessionStore {
         if (this.pinned.has(sessionId)) {
             return;
         }
-        const e = this.entries.get(sessionId);
-        if (e !== undefined && e.placement === undefined)
-            this.pendingPlacedDeletes.delete(sessionId);
-        let placed = e !== undefined ? e.placement !== undefined : this.pendingPlacedDeletes.has(sessionId);
-        if (!placed && e === undefined && this.placements !== undefined) {
-            const probe = this.repo.placementOf;
-            if (typeof probe === "function") {
-                try {
-                    placed = (await probe.call(this.repo, sessionId)) !== undefined;
-                }
-                catch {
-                    placed = false;
-                }
-            }
-        }
-        if (!e && !placed) {
+        const cached = this.entries.get(sessionId);
+        if (cached !== undefined)
+            this.entries.delete(sessionId);
+        if (cached !== undefined && cached.placement === undefined && this.evictPolicy !== "delete")
             return;
+        if (cached === undefined && !this.releasing.has(sessionId) && !this.rowReadMatters(sessionId))
+            return;
+        return this.holdingId(sessionId, () => this.releaseRow(sessionId, cached));
+    }
+    async holdingId(sessionId, work) {
+        const prior = this.releasing.get(sessionId);
+        let settle;
+        const gate = new Promise((r) => (settle = r));
+        this.releasing.set(sessionId, gate);
+        try {
+            if (prior !== undefined)
+                await prior;
+            await work();
         }
-        if (placed) {
+        finally {
+            if (this.releasing.get(sessionId) === gate)
+                this.releasing.delete(sessionId);
+            settle();
+        }
+    }
+    async releaseRow(sessionId, cached) {
+        if (cached?.placement !== undefined)
             this.pendingPlacedDeletes.add(sessionId);
-            this.entries.delete(sessionId);
-            let settleGate;
-            this.deletingPlaced.set(sessionId, new Promise((r) => (settleGate = r)));
-            try {
-                const meta = e !== undefined ? await e.session.getMetadata() : { id: sessionId, createdAt: "" };
-                await this.repo.delete(meta);
-            }
-            finally {
-                this.deletingPlaced.delete(sessionId);
-                settleGate();
-            }
-            this.pendingPlacedDeletes.delete(sessionId);
-            this.owners.delete(sessionId);
+        const view = cached !== undefined && (await this.cachedViewStands(sessionId, cached)) ? cached : undefined;
+        const placed = view !== undefined ? view.placement !== undefined : await this.rowIsPlaced(sessionId);
+        if (view === undefined && !placed)
             return;
+        const meta = view !== undefined ? await view.session.getMetadata() : { id: sessionId, createdAt: "" };
+        if (!placed)
+            return this.repo.delete(meta);
+        this.pendingPlacedDeletes.add(sessionId);
+        await this.repo.delete(meta);
+        this.pendingPlacedDeletes.delete(sessionId);
+    }
+    placementProbe() {
+        const probe = this.repo.placementOf;
+        return typeof probe === "function" ? probe.bind(this.repo) : undefined;
+    }
+    rowReadMatters(sessionId) {
+        return this.pendingPlacedDeletes.has(sessionId) || (this.placements !== undefined && this.placementProbe() !== undefined);
+    }
+    async rowIsPlaced(sessionId) {
+        if (!this.rowReadMatters(sessionId))
+            return false;
+        const probe = this.placementProbe();
+        let placement;
+        try {
+            placement = probe !== undefined ? await probe(sessionId) : (await (await this.repo.open({ id: sessionId, createdAt: "" })).getMetadata()).placement;
         }
-        this.entries.delete(sessionId);
-        if (this.evictPolicy === "delete") {
-            await this.repo.delete(e !== undefined ? await e.session.getMetadata() : { id: sessionId, createdAt: "" });
-            this.owners.delete(sessionId);
+        catch (err) {
+            if (!isNotFound(err))
+                throw err;
         }
+        this.pendingPlacedDeletes.delete(sessionId);
+        return placement !== undefined;
     }
     forget(sessionId) {
         this.entries.delete(sessionId);
@@ -237,29 +295,36 @@ export class TtlSessionStore {
     unpin(sessionId) {
         this.pinned.delete(sessionId);
     }
-    async ownerOf(sessionId) {
-        return this.owners.has(sessionId) ? this.owners.get(sessionId) : undefined;
-    }
     async register(sessionId, owner) {
-        if (this.owners.has(sessionId)) {
+        const inflightRelease = this.releasing.get(sessionId);
+        if (inflightRelease !== undefined)
+            await inflightRelease;
+        if (await this.hasRow(sessionId))
             return;
+        if (owner === undefined)
+            throw new TypeError("SessionStore.register: owner must be a principal name or null (anonymous), got undefined");
+        ownerCell(owner);
+        try {
+            await this.repo.create({ id: sessionId, owner });
         }
-        if (owner !== null && typeof owner !== "string") {
-            throw new TypeError(`SessionStore.register: owner must be a string (owned) or null (anonymous), got ${owner === undefined ? "undefined" : typeof owner}`);
+        catch (err) {
+            if (isSessionConflict(err))
+                return;
+            throw err;
         }
-        this.owners.set(sessionId, owner);
     }
-    async incarnationOf(sessionId) {
-        let session;
+    async hasRow(sessionId) {
+        if (this.repoHead !== undefined)
+            return (await this.repoHead(sessionId)) !== undefined;
         try {
-            session = await this.repo.open({ id: sessionId, createdAt: "" });
+            await this.repo.open({ id: sessionId, createdAt: "" });
+            return true;
         }
         catch (err) {
             if (isNotFound(err))
-                return undefined;
+                return false;
             throw err;
         }
-        return (await session.getMetadata()).incarnation;
     }
     sweep(now = Date.now()) {
         for (const [id, e] of this.entries) {
@@ -269,9 +334,10 @@ export class TtlSessionStore {
             if (now - e.lastActiveAt > this.defaultTtlMs) {
                 this.entries.delete(id);
                 if (this.evictPolicy === "delete" && e.placement === undefined) {
-                    void this.repo.delete({ id, createdAt: "" }).then(() => {
-                        this.owners.delete(id);
-                    }, () => { });
+                    void this.holdingId(id, async () => {
+                        if (await this.cachedViewStands(id, e))
+                            await this.repo.delete({ id, createdAt: "" });
+                    }).catch(() => { });
                 }
             }
         }
@@ -285,26 +351,34 @@ export class TtlSessionStore {
         }
     }
 }
-async function settledForkOptions(source) {
+export async function settledForkOptions(source) {
     const storage = source.getStorage();
     let id = await storage.getLeafId();
+    const chain = new ParentChainGuard();
+    const answers = [];
     while (id) {
+        chain.stepOnto(id);
         const entry = await storage.getEntry(id);
         if (!entry || entry.type !== "message") {
             return {};
         }
         if (entry.message.role === "assistant") {
-            const hasToolCall = Array.isArray(entry.message.content) &&
-                entry.message.content.some((c) => c.type === "toolCall");
-            return hasToolCall && entry.parentId ? { entryId: entry.parentId, position: "at" } : {};
+            const open = findUnansweredToolBatch([entry.message, ...answers]) !== undefined;
+            return open && entry.parentId ? { entryId: entry.parentId, position: "at" } : {};
         }
         if (entry.message.role !== "toolResult") {
             return {};
         }
+        answers.push(entry.message);
         id = entry.parentId;
     }
     return {};
 }
+function newestFirst(a, b) {
+    if (a.lastActiveAt !== b.lastActiveAt)
+        return b.lastActiveAt - a.lastActiveAt;
+    return a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0;
+}
 function isNotFound(err) {
     return readMember(err, "code") === "not_found";
 }