@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/local-session-store.js

@@ -1,31 +1,36 @@
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readdirSync, readFileSync, unlinkSync } from "node:fs";
+import { SCENARIO_SUBJECT_PREFIX } from "../owner-brands.js";
+import { lstat, readFile } from "node:fs/promises";
+import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readdirSync, readFileSync, unlinkSync } from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { isDeepStrictEqual } from "node:util";
 import { dirname, join, resolve } from "node:path";
+import { IS_WIN32 } from "./host-platform.js";
+import { atomicWriteFileAsync, atomicWriteFileSync, proveDurableSync } from "./owner-only-file-mode.js";
 import { assertFirstOwnerWritable, forkOwnerOf, importerOwnerOf, placedSessionOwnerOf } from "./session-ownership.js";
 import { SessionOwnerUnreadableError, StampedSessionArchiveError, sessionUnreadableOf } from "../session-error-wire.js";
-import { FileSessionRepo, SessionError, StoredSession, admitSessionPlacement, atomicWriteFile, sessionLogMarkOf, settledForkOptions, uuidv7, validateEntriesForImport } from "@sema-agent/core";
+import { SHELL_SENTINEL_OWNER_M48 } from "./shell-sentinel-owner-m48.js";
+import { FileSessionRepo, SessionError, StoredSession, admitSessionPlacement, atomicWriteFile, ensureDir, forkRowCells, sessionLogMarkOf, settledForkOptions, uuidv7, validateEntriesForImport } from "@sema-agent/core";
 import { placementCapabilityOf } from "./session-placement.js";
 import { z } from "zod";
 import { contentForkRelation, fastForwardSharedContentDiverged, identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
-import { StoreBootRefusalError } from "./store-contracts.js";
+import { SCHEMA_MISMATCH_ERROR_CODE, StoreBootRefusalError } from "./store-contracts.js";
+import { entryTypeWithdrawable } from "./session-birth.js";
 import { judgeSessionRowWrite, sessionRowTagKey, settleSessionRowWrite, } from "../session-row.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
-import { createZodColumnReader, decodeJsonColumn, isJsonColumnBodyProblem, readStringRecordColumn, SqlJsonColumnError } from "./sql-json-column.js";
-import { SCHEMA_MISMATCH_ERROR_CODE } from "./schema-consistency.js";
-import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./one-time-migrations.js";
+import { createZodColumnReader, decodeJsonColumn, isJsonColumnBodyProblem, isJsonObject, readJsonObjectColumn, readStringRecordColumn, SqlJsonColumnError } from "./sql-json-column.js";
+import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40 } from "./execution-lane-rename-m40.js";
+import { ExecutionLaneRenameWriteRefusedError, ONE_TIME_MIGRATIONS } from "./one-time-migrations.js";
+import { compareReleaseTriples, releaseText, releaseTriple } from "./release-version.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { createLogger } from "../observability/logger.js";
-import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
-import { UnreadableLeaf, carriedRowCells, headFromRow, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
+import { createLogger, writeLogText } from "../observability/logger.js";
+import { UNMANAGED_RETENTION } from "./retention-declaration.js";
+import { UnreadableLeaf, carriedRowCells, forkLineageOfRow, headFromRow, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
 import { isExecutionLane } from "../execution-lane-caps.js";
-import { SessionForkInProgressError, SessionWriterPresentError, WRITABLE, assertPlaceableLane, isUnusableArchive, settledMirrorOutcome, settledPlaceOutcome, } from "../execution-placement.js";
+import { SessionForkInProgressError, WRITABLE, assertPlaceableLane, judgeSessionWrite, settledMirrorOutcome, settledPlaceOutcome, SessionDeletingError, } from "../execution-placement.js";
 import { classifyForkTarget, forkByFreshId } from "./session-fork.js";
 import { decodeInstructionSource, encodeInstructionSource, sameInstructionSourceBaseline } from "../instruction-source-notice.js";
 import { decodeSessionWorkspaceCell, encodeSessionWorkspaceCell } from "./session-workspace-cell.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
-import { buildObjectivePreview, isAttachmentFrame } from "../user-authored-text.js";
 import { classifySyncRelationshipByIds, ownerCellIs, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, } from "../session-sync-kernel.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const isNotFound = (e) => e instanceof SessionError && e.code === "not_found";
@@ -49,46 +54,29 @@ function archiveFaultWord(code) {
         }
     }
 }
-function unusableArchiveOf(word, fault) {
-    const code = fault instanceof SessionError ? undefined : fault?.code;
+function unusableArchiveOfFault(fault) {
+    const engine = fault instanceof SessionOwnerUnreadableError ? "corrupt_session" : fault instanceof SessionError ? archiveFaultWord(fault.code) : "storage";
+    const word = engine === "absent" ? "storage" : engine;
+    const code = fault instanceof SessionError || fault instanceof SessionOwnerUnreadableError ? undefined : fault?.code;
     return { state: "unusable", word, fault, ...(word === "storage" && typeof code === "string" ? { errno: code } : {}) };
 }
-function ownerUnreadableArchive(probe) {
-    const { fault } = probe;
-    if (probe.word === "storage" || !(fault instanceof SessionError))
-        return probe;
-    return { ...probe, fault: new SessionOwnerUnreadableError(fault) };
+function ownerUnreadableFault(fault) {
+    return fault instanceof SessionError ? new SessionOwnerUnreadableError(fault) : fault instanceof Error ? fault : new Error(String(fault));
 }
+const ABSENT_ROW = { row: "absent" };
+const NO_CELL = { state: "none" };
 function importRowRefused(sessionId, landing) {
     return new SessionError("conflict", landing === "create"
         ? `session ${sessionId} already exists — importEntries only creates a session (replaceEntries rewrites one); nothing was written`
         : `session ${sessionId} is not the importer's row — an import replaces only a log whose row the importer owns (or an anonymous row, by an anonymous import); nothing was written`);
 }
-const SESSION_OBJECTIVE_PREVIEW_CHARS = 200;
-function userText(entry) {
-    if (entry.type !== "message")
-        return null;
-    const msg = entry.message;
-    if (msg.role !== "user" || isAttachmentFrame(msg))
-        return null;
-    const c = msg.content;
-    if (typeof c === "string")
-        return c;
-    if (Array.isArray(c)) {
-        return c
-            .filter((p) => !!p && typeof p === "object" && p.type === "text")
-            .map((p) => p.text)
-            .join(" ");
-    }
-    return null;
-}
 const SIDECAR_DEGRADES = { lastActivity: "recency", title: "title", pinned: "pin state", "instruction-source": "instruction-source baseline", workspace: "each session's last recorded place and project (the next frame records it again)", "session-meta": "session owner + incarnation (the write that needed it failed loudly)" };
 const readPinnedSidecar = createZodColumnReader(z.record(z.string(), z.literal(true)));
 const MIRROR_CELL = { role: "mirror" };
 function readSessionMetaCell(cell) {
     return typeof cell === "string"
-        ? { incarnation: cell, owner: undefined, execution: undefined, forkKey: undefined, createdAt: undefined, forkedFrom: undefined }
-        : { incarnation: cell.incarnation, owner: cell.owner, execution: cell.execution, forkKey: cell.forkKey, createdAt: cell.createdAt, forkedFrom: cell.forkedFrom };
+        ? { incarnation: cell, owner: undefined, execution: undefined, forkKey: undefined, createdAt: undefined, forkedFrom: undefined, forkedFromIncarnation: undefined, dropping: false, deleting: undefined, clientWrites: undefined }
+        : { incarnation: cell.incarnation, owner: cell.owner, execution: cell.execution, forkKey: cell.forkKey, createdAt: cell.createdAt, forkedFrom: cell.forkedFrom, forkedFromIncarnation: cell.forkedFromIncarnation, dropping: cell.dropping === true, deleting: cell.deleting, clientWrites: cell.clientWrites };
 }
 const ownerRecorded = (cell) => cell !== undefined && readSessionMetaCell(cell).owner !== undefined;
 const cellObjectOf = (cell) => (typeof cell === "string" ? { incarnation: cell } : cell);
@@ -104,9 +92,9 @@ function archivedRowFactsOf(head) {
         ...(typeof forkedFrom === "string" && forkedFrom !== "" ? { forkedFrom } : {}),
     };
 }
-function rowFactsFilled(before, facts) {
+function rowFactsFilled(sessionId, before, facts, archiveToken) {
     if (before === undefined)
-        return { incarnation: mintSessionIncarnation(), createdAt: facts.createdAt, ...(facts.forkedFrom !== undefined ? { forkedFrom: facts.forkedFrom } : {}) };
+        return { incarnation: firstCellIncarnationOf(sessionId, archiveToken).incarnation, createdAt: facts.createdAt, ...(facts.forkedFrom !== undefined ? { forkedFrom: facts.forkedFrom } : {}) };
     const held = cellObjectOf(before);
     const add = {
         ...(held.createdAt === undefined ? { createdAt: facts.createdAt } : {}),
@@ -123,12 +111,37 @@ function rowCreatedAtOf(sessionId, meta) {
 }
 function rowMetadataOf(sessionId, meta) {
     const face = sessionFaceFromRow(sessionId, meta.owner ?? null, meta.incarnation);
-    return { id: sessionId, createdAt: rowCreatedAtOf(sessionId, meta), owner: face.owner, incarnation: face.incarnation, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}) };
+    return { id: sessionId, createdAt: rowCreatedAtOf(sessionId, meta), owner: face.owner, incarnation: face.incarnation, ...forkLineageOfRow(sessionId, meta.forkedFrom, meta.forkedFromIncarnation) };
 }
 const isForkCreatedCell = (meta) => meta !== undefined && meta.forkKey !== undefined && meta.execution === undefined;
+function placementCellOf(meta, forking) {
+    return forking ? { role: "forking" } : (meta?.execution ?? { role: "absent" });
+}
 function readingOfCell(sessionId, meta, forking) {
-    return { occupant: sessionFaceFromRow(sessionId, meta.owner ?? null, meta.incarnation), cell: forking ? { role: "forking" } : (meta.execution ?? { role: "absent" }) };
+    return { occupant: sessionFaceFromRow(sessionId, meta.owner ?? null, meta.incarnation), cell: placementCellOf(meta, forking) };
+}
+function legacyNeedsMint(seen) {
+    return seen.row === "legacy" && seen.placed === undefined && seen.unreadable === undefined;
 }
+function executionReadingOf(sessionId, seen) {
+    switch (seen.row) {
+        case "absent":
+            return undefined;
+        case "live":
+            return seen.placed !== undefined ? undefined : readingOfCell(sessionId, seen.meta, seen.forking);
+        case "legacy":
+            if (seen.placed !== undefined)
+                return undefined;
+            if (seen.unreadable !== undefined)
+                throw ownerUnreadableFault(seen.unreadable);
+            throw new Error(`LocalSessionStore: session ${sessionId} is a legacy row — its cell is minted under its write lock before an execution reading is given`);
+        default: {
+            const unknownRow = seen;
+            throw new Error(`LocalSessionStore: no row observation ${JSON.stringify(unknownRow)}`);
+        }
+    }
+}
+const SESSION_META_SIDECAR_FILE = "session-incarnations.json";
 const LOCAL_EXECUTION_CELL = z.discriminatedUnion("role", [
     z.object({ role: z.literal("writer"), lane: z.custom((v) => typeof v === "string" && isExecutionLane(v), { message: "not an execution lane" }) }).strict(),
     z.object({ role: z.literal("mirror") }).strict(),
@@ -141,31 +154,53 @@ export const SESSION_META_CELL_OBJECT = z
     forkKey: z.string().optional(),
     createdAt: z.string().optional(),
     forkedFrom: z.string().optional(),
+    forkedFromIncarnation: z.string().optional(),
+    dropping: z.literal(true).optional(),
+    deleting: z.string().min(1).optional(),
+    clientWrites: z.number().int().nonnegative().optional(),
 })
     .strict();
 const SESSION_META_SIDECAR = z.record(z.string(), z.union([z.string(), SESSION_META_CELL_OBJECT]));
 const readSessionMetaSidecar = createZodColumnReader(SESSION_META_SIDECAR);
-function ownerClaimWindowOpen() {
-    const window = ONE_TIME_MIGRATIONS.find((w) => w.id === "M10");
-    if (window === undefined)
-        throw new Error("LocalSessionStore: the one-time migration registry has no M10 row (the local session-owner claim window) — the claim arm outlived its registry row; delete it with that row");
-    return migrationWindowOpen(window, new Date().toISOString().slice(0, 10));
-}
 const SIDECAR_MAP_STATE_BY_PATH = new Map();
 const SESSION_WRITE_LOCKS_BY_ROOT = new Map();
 const quotedFieldNames = (names) => `${names.slice(0, 8).map((name) => JSON.stringify(name.slice(0, 64))).join(", ")}${names.length > 8 ? `, … (${names.length} in all)` : ""}`;
+function releaseAtOrAbove(a, b) {
+    const ta = releaseTriple(a);
+    const tb = releaseTriple(b);
+    return ta !== undefined && tb !== undefined && compareReleaseTriples(ta, tb) >= 0;
+}
+function describeDataRootFinding(f) {
+    if (f.problem === "newer-engine") {
+        return `  ${f.label} at ${f.path}: engine high-water ${f.engineHighWater.highWater} — the data root has been opened by server ${f.engineHighWater.highWater}, NEWER than this build (${f.engineHighWater.engine}).`;
+    }
+    if (f.problem === "skipped-required-migration") {
+        const { highWater, requiredSince, sessions } = f.skippedMigration;
+        const consequence = "This build no longer carries that migration: opening the root would give those sessions a new occupant token, and memory records kept under the old one (capture opt-outs, pollution marks) would stop applying to them.";
+        if (highWater !== null && releaseAtOrAbove(highWater, requiredSince)) {
+            return (`  ${f.label} at ${f.path}: ${sessions} session archive(s) have no session-meta cell, and the data root was last opened by server ${highWater}, which carries the one-time migration ` +
+                `(introduced in ${requiredSince}) that gives such an archive its row cell under the occupant token the archive already carries — but that start did not finish it ` +
+                `(${ARCHIVE_TOKEN_ADOPTION_PENDING_FILE} is still in the data root). ${consequence} ` +
+                `Start the root once with a release at or above ${highWater} that still carries that migration (server or run-local) and let that start finish, then start this build.`);
+        }
+        const lastOpened = highWater === null ? "no engine that records a high-water (run-local before 7.148.0, or a server before 7.144.0)" : `server ${highWater}`;
+        return (`  ${f.label} at ${f.path}: ${sessions} session archive(s) have no session-meta cell, and the data root was last opened by ${lastOpened} — older than ${requiredSince}, ` +
+            `whose one-time migration gives such an archive its row cell under the occupant token the archive already carries. ${consequence} ` +
+            `Start the root once with a release at or above ${requiredSince} that still carries that migration (server or run-local) and let that start finish, then start this build.`);
+    }
+    return f.unknownFields.length > 0
+        ? `  ${f.label} at ${f.path}: UNKNOWN field(s) ${quotedFieldNames(f.unknownFields)} — the data root is NEWER than this build (a newer server engine wrote it).`
+        : `  ${f.label} at ${f.path}: unreadable (${f.problem}) — this build cannot read it, and an unreadable file is treated as a mismatch, not as empty.`;
+}
 function describeLocalDataRootMismatch(findings, when) {
     const lines = [
         when === "boot"
             ? `${SCHEMA_MISMATCH_ERROR_CODE}: the local data root does not match this build's shape — refusing to start.`
             : `${SCHEMA_MISMATCH_ERROR_CODE}: the local data root does not match this build's shape — refusing to read or write the file(s) named below until this process is restarted.`,
     ];
-    for (const f of findings) {
-        lines.push(f.unknownFields.length > 0
-            ? `  ${f.label} at ${f.path}: UNKNOWN field(s) ${quotedFieldNames(f.unknownFields)} — the data root is NEWER than this build (a newer server engine wrote it).`
-            : `  ${f.label} at ${f.path}: unreadable (${f.problem}) — this build cannot read it, and an unreadable file is treated as a mismatch, not as empty.`);
-    }
-    lines.push("This build never reads such a file as empty and never writes over it: either would silently change what the file records.", "", "  Ways out (these three and no others):", "    (1) the data root is NEWER than this build (unknown fields): deploy the build that wrote it;", "    (2) roll back: restore the data-root backup taken before the upgrade, then start this build — also the way out when the file's bytes are damaged (not-json / malformed);", "    (3) the file could not be read at all (an I/O error such as EACCES): repair access to it (permissions, mount, disk) and restart — nothing in the file needs changing.", "The check behind this refusal only reads: the file was left in place and nothing in the data root was changed.");
+    for (const f of findings)
+        lines.push(describeDataRootFinding(f));
+    lines.push("This build never reads such a file as empty and never writes over it: either would silently change what the file records.", "", "  Ways out (these four and no others):", "    (1) the data root is NEWER than this build (unknown fields, or an engine high-water above this build): deploy the build that wrote it (for a high-water: server at or above it) — to run an older build on this machine, give it its own data root (LOCAL_DATA_ROOT);", "    (2) roll back: restore the data-root backup taken before the upgrade, then start this build — also the way out when the file's bytes are damaged (not-json / malformed);", "    (3) the file could not be read at all (an I/O error such as EACCES): repair access to it (permissions, mount, disk) and restart — nothing in the file needs changing;", "    (4) the data root skipped a required one-time migration, or a release carrying it opened the root and did not finish it (the finding names the release to start with): start the root once with a release at or above that one that still carries the migration (server or run-local), let that start finish, then start this build.", "The check behind this refusal only reads: the file(s) named above were left in place, unchanged.");
     return lines.join("\n");
 }
 export class LocalDataRootSchemaMismatchError extends StoreBootRefusalError {
@@ -179,6 +214,165 @@ export class LocalDataRootSchemaMismatchError extends StoreBootRefusalError {
         this.name = "LocalDataRootSchemaMismatchError";
     }
 }
+export const ARCHIVE_TOKEN_ADOPTION_SINCE = "7.148.0";
+export function archiveTokenAdoptionCarried() {
+    return ONE_TIME_MIGRATIONS.some((w) => w.id === "M47");
+}
+const ARCHIVE_DIR = "sessions";
+const ARCHIVE_SUFFIX = ".jsonl";
+const ARCHIVE_TOKEN_ADOPTION_PENDING_FILE = "archive-token-adoption.pending";
+const archiveTokenAdoptionPendingPath = (root) => resolve(join(root, ARCHIVE_TOKEN_ADOPTION_PENDING_FILE));
+function archiveTokenAdoptionPendingPresent(root) {
+    try {
+        lstatSync(archiveTokenAdoptionPendingPath(root));
+        return true;
+    }
+    catch (e) {
+        if (e?.code === "ENOENT")
+            return false;
+        throw e;
+    }
+}
+function recordArchiveTokenAdoptionPending(root, priorHighWater) {
+    const path = archiveTokenAdoptionPendingPath(root);
+    const prior = priorHighWater === undefined ? "none" : releaseText(priorHighWater);
+    try {
+        atomicWriteFileSync(path, `opened ${new Date().toISOString()} by a release that adopts archive tokens; engine high-water before that start: ${prior}\n`, { durability: "required" });
+    }
+    catch (e) {
+        throw new Error(`DB_BACKEND=local cannot record ${path} durably: ${e instanceof Error ? e.message : String(e)} — refusing to open the data root: ` +
+            "this start raises the engine high-water past the release that adopts the occupant tokens of session archives without a session-meta cell, and without this record a later build could not tell that the adoption has not finished. " +
+            "Repair write access to the data root and restart.", { cause: e });
+    }
+}
+function dischargeArchiveTokenAdoptionPending(root) {
+    const path = archiveTokenAdoptionPendingPath(root);
+    try {
+        unlinkSync(path);
+    }
+    catch (e) {
+        if (e?.code !== "ENOENT")
+            throw e;
+        return;
+    }
+    if (!IS_WIN32)
+        fsyncPaths(dirname(path));
+}
+function archiveIdsInSync(root) {
+    let names;
+    try {
+        names = readdirSync(join(root, ARCHIVE_DIR));
+    }
+    catch (e) {
+        if (e?.code === "ENOENT")
+            return [];
+        throw e;
+    }
+    return names.filter((name) => name.endsWith(ARCHIVE_SUFFIX)).map((name) => name.slice(0, -ARCHIVE_SUFFIX.length));
+}
+export function archiveIdsWithoutCellSync(root) {
+    const sidecarPath = resolve(join(root, SESSION_META_SIDECAR_FILE));
+    const label = `${SESSION_META_SIDECAR_FILE} (the local session-meta sidecar)`;
+    const raw = readDataRootFileTextSync(sidecarPath);
+    if (raw.state === "unreadable")
+        throw new LocalDataRootSchemaMismatchError([dataRootMismatchOf(sidecarPath, label, raw.fault)], "boot");
+    let cells = {};
+    if (raw.state === "text") {
+        try {
+            cells = decodeJsonColumn(raw.text, readSessionMetaSidecar, label);
+        }
+        catch (e) {
+            throw new LocalDataRootSchemaMismatchError([dataRootMismatchOf(sidecarPath, label, e)], "boot");
+        }
+    }
+    return archiveIdsInSync(root)
+        .filter((id) => !Object.hasOwn(cells, id))
+        .sort();
+}
+export function holdArchiveTokenAdoptionDuty(root, priorHighWater, adoptionCarried) {
+    const since = releaseTriple(ARCHIVE_TOKEN_ADOPTION_SINCE);
+    const neverOpenedByAdoptingRelease = priorHighWater === undefined || compareReleaseTriples(priorHighWater, since) < 0;
+    if (adoptionCarried) {
+        if (neverOpenedByAdoptingRelease && archiveIdsInSync(root).length > 0)
+            recordArchiveTokenAdoptionPending(root, priorHighWater);
+        return;
+    }
+    const owed = archiveTokenAdoptionPendingPresent(root);
+    if (!neverOpenedByAdoptingRelease && !owed)
+        return;
+    const cellLess = archiveIdsWithoutCellSync(root);
+    if (cellLess.length === 0) {
+        if (owed)
+            dischargeArchiveTokenAdoptionPending(root);
+        return;
+    }
+    throw new LocalDataRootSchemaMismatchError([
+        {
+            path: resolve(join(root, ARCHIVE_DIR)),
+            label: `${ARCHIVE_DIR} (the local session archives)`,
+            problem: "skipped-required-migration",
+            unknownFields: [],
+            skippedMigration: { highWater: priorHighWater === undefined ? null : releaseText(priorHighWater), requiredSince: ARCHIVE_TOKEN_ADOPTION_SINCE, sessions: cellLess.length },
+        },
+    ], "boot");
+}
+function firstCellIncarnationOf(sessionId, archiveToken) {
+    const token = archiveTokenAdoptionCarried() ? incarnationFromCell(sessionId, archiveToken, "absent") : undefined;
+    return token !== undefined ? { incarnation: token, adopted: true } : { incarnation: mintSessionIncarnation(), adopted: false };
+}
+function cellChangedUnderLock(sessionId) {
+    throw new SessionError("storage", `LocalSessionStore: session ${sessionId}'s session-meta cell changed under its own write lock between the observation and the write — refusing to guess its occupant`);
+}
+export async function readDataRootFileText(path) {
+    try {
+        return { state: "text", text: await readFile(path, "utf8") };
+    }
+    catch (e) {
+        if (e?.code !== "ENOENT")
+            return { state: "unreadable", fault: e };
+        return judgedAfterEnoent(e, await lstat(path).then(() => ENTRY_PRESENT, (fault) => ({ fault })));
+    }
+}
+export function readDataRootFileTextSync(path) {
+    try {
+        return { state: "text", text: readFileSync(path, "utf8") };
+    }
+    catch (e) {
+        if (e?.code !== "ENOENT")
+            return { state: "unreadable", fault: e };
+        let probe = ENTRY_PRESENT;
+        try {
+            lstatSync(path);
+        }
+        catch (fault) {
+            probe = { fault };
+        }
+        return judgedAfterEnoent(e, probe);
+    }
+}
+const ENTRY_PRESENT = { present: true };
+function judgedAfterEnoent(readFault, probe) {
+    if ("present" in probe)
+        return { state: "unreadable", fault: readFault };
+    return probe.fault?.code === "ENOENT" ? { state: "absent" } : { state: "unreadable", fault: probe.fault };
+}
+export function dataRootMismatchOf(path, label, fault) {
+    if (fault instanceof SqlJsonColumnError)
+        return { path, label, problem: fault.problem, unknownFields: fault.unknownKeys };
+    const code = fault?.code;
+    return { path, label, problem: typeof code === "string" && /^E[A-Z0-9_]+$/.test(code) ? code : "unreadable", unknownFields: [] };
+}
+async function readSessionMetaForM40(path) {
+    const raw = await readDataRootFileText(path);
+    if (raw.state !== "text")
+        return raw;
+    try {
+        return { state: "read", entries: decodeJsonColumn(raw.text, readJsonObjectColumn, `${SESSION_META_SIDECAR_FILE} (one-time migration M40)`) };
+    }
+    catch (e) {
+        return { state: "unreadable", fault: e };
+    }
+}
 class SidecarMap {
     path;
     label;
@@ -243,16 +437,27 @@ class SidecarMap {
         if (disk.state === "unreadable")
             throw this.refuse(path, disk);
     }
-    async readDisk(path) {
-        let text;
-        try {
-            text = await readFile(path, "utf8");
-        }
-        catch (e) {
-            return e?.code === "ENOENT" ? { state: "absent" } : { state: "unreadable", fault: e };
+    async landed(path, changed, draft) {
+        const disk = await this.readDisk(path);
+        switch (disk.state) {
+            case "absent":
+                return "not-landed";
+            case "unreadable":
+                return "unknown";
+            case "read":
+                return changed.every((key) => (draft.has(key) ? Object.hasOwn(disk.entries, key) && isDeepStrictEqual(disk.entries[key], draft.get(key)) : !Object.hasOwn(disk.entries, key))) ? "landed" : "not-landed";
+            default: {
+                const unknownRead = disk;
+                throw new Error(`SidecarMap: no sidecar read state ${JSON.stringify(unknownRead)}`);
+            }
         }
+    }
+    async readDisk(path) {
+        const raw = await readDataRootFileText(path);
+        if (raw.state !== "text")
+            return raw;
         try {
-            return { state: "read", entries: decodeJsonColumn(text, this.read, this.label) };
+            return { state: "read", entries: decodeJsonColumn(raw.text, this.read, this.label) };
         }
         catch (e) {
             return { state: "unreadable", fault: e };
@@ -260,15 +465,13 @@ class SidecarMap {
     }
     refuse(path, disk) {
         const shape = isJsonColumnBodyProblem(disk.fault);
-        const problem = disk.fault instanceof SqlJsonColumnError ? disk.fault.problem : (disk.fault?.code ?? "unreadable");
-        const unknownFields = disk.fault instanceof SqlJsonColumnError ? disk.fault.unknownKeys : [];
-        const refusal = new LocalDataRootSchemaMismatchError([{ path, label: this.label, problem, unknownFields }], "serving");
+        const refusal = new LocalDataRootSchemaMismatchError([dataRootMismatchOf(path, this.label, disk.fault)], "serving");
         if (shape)
             this.state.refused = refusal;
         return refusal;
     }
     persist() {
-        return this.commit(() => true);
+        return this.commit(() => true, "best-effort");
     }
     syncToDisk() {
         const path = this.path;
@@ -276,10 +479,10 @@ class SidecarMap {
             return;
         fsyncPaths(path, dirname(path));
     }
-    deleteKey(key) {
-        return this.commit((draft) => draft.delete(key));
+    deleteKey(key, durability) {
+        return this.commit((draft) => draft.delete(key), durability);
     }
-    commit(change) {
+    commit(change, durability) {
         const path = this.path;
         const st = this.state;
         const link = st.writeChain.then(async () => {
@@ -287,8 +490,27 @@ class SidecarMap {
                 throw st.refused;
             const base = new Map(st.entries);
             const draft = new Map(base);
-            if (!change(draft))
-                return true;
+            if (!change(draft)) {
+                if (durability !== "required" || !path || !existsSync(path))
+                    return true;
+                try {
+                    proveDurableSync(path);
+                    return true;
+                }
+                catch (e) {
+                    this.onWriteFailed(e);
+                    return false;
+                }
+            }
+            const changed = [...new Set([...base.keys(), ...draft.keys()])].filter((key) => !(draft.has(key) === base.has(key) && draft.get(key) === base.get(key)));
+            const publish = () => {
+                for (const key of changed) {
+                    if (draft.has(key))
+                        st.entries.set(key, draft.get(key));
+                    else
+                        st.entries.delete(key);
+                }
+            };
             if (path) {
                 if (this.strict) {
                     const disk = await this.readDisk(path);
@@ -300,23 +522,16 @@ class SidecarMap {
                     }
                 }
                 try {
-                    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-                    await writeFile(tmp, JSON.stringify(Object.fromEntries(draft)), "utf8");
-                    await rename(tmp, path);
+                    await atomicWriteFileAsync(path, JSON.stringify(Object.fromEntries(draft)), { durability });
                 }
                 catch (e) {
                     this.onWriteFailed(e);
+                    if (durability === "required" && (await this.landed(path, changed, draft)) !== "not-landed")
+                        publish();
                     return false;
                 }
             }
-            for (const key of new Set([...base.keys(), ...draft.keys()])) {
-                if (draft.has(key) === base.has(key) && draft.get(key) === base.get(key))
-                    continue;
-                if (draft.has(key))
-                    st.entries.set(key, draft.get(key));
-                else
-                    st.entries.delete(key);
-            }
+            publish();
             return true;
         });
         st.writeChain = link.then(() => undefined, () => undefined);
@@ -428,14 +643,12 @@ export class LocalSessionStore {
     listPlaced;
     recordedPlacementOf;
     pending = new Map();
-    rowsDropped = new Set();
     lastActivity = new Map();
     stagings = new Map();
     loaded;
     flushTimer;
     writeChain = Promise.resolve();
     dirty = false;
-    writeSeq = 0;
     lastWarnAt = 0;
     sidecarPath;
     titles;
@@ -450,10 +663,12 @@ export class LocalSessionStore {
     executionPlacementBackfill;
     dataRoot;
     archiveSnapshotsSettled = 0;
+    withdrawCheckpointCtx;
     constructor(repo, runs, dataDir, opts) {
         this.repo = repo;
         this.runs = runs;
         this.sidecarPath = dataDir ? join(dataDir, "session-last-activity.json") : undefined;
+        this.withdrawCheckpointCtx = opts?.withdrawCheckpointCtx;
         this.log = opts?.log ?? createLogger();
         const repoPlacementOf = repo.placementOf;
         const repoListPlaced = repo.listPlaced;
@@ -493,7 +708,7 @@ export class LocalSessionStore {
         this.pinned = sidecar("session-pinned.json", "pinned", readPinnedSidecar);
         this.instructionSources = sidecar("session-instruction-sources.json", "instruction-source", readStringRecordColumn);
         this.workspaces = sidecar("session-workspaces.json", "workspace", readStringRecordColumn);
-        this.meta = sidecar("session-incarnations.json", "session-meta", readSessionMetaSidecar, true);
+        this.meta = sidecar(SESSION_META_SIDECAR_FILE, "session-meta", readSessionMetaSidecar, true);
         const root = dataDir ? resolve(dataDir) : undefined;
         this.dataRoot = root;
         if (root !== undefined && !SESSION_WRITE_LOCKS_BY_ROOT.has(root))
@@ -504,10 +719,44 @@ export class LocalSessionStore {
             place: (sessionId, occupant, cell) => this.placeExecution(sessionId, occupant, cell),
             markMirror: (sessionId, occupant) => this.markMirrorExecution(sessionId, occupant),
         };
-        this.executionPlacementBackfill = {
-            read: (sessionId) => this.placementRead(sessionId),
-            place: (sessionId, occupant, cell) => this.placeExecution(sessionId, occupant, cell),
-        };
+        this.executionPlacementBackfill = { backfill: (sessionId, lanes) => this.backfillPlacement(sessionId, lanes) };
+    }
+    async scenarioPrefixOwnerRowsM42() {
+        await this.meta.ensureLoaded();
+        let n = 0;
+        for (const id of [...this.liveCellIds(), ...this.droppingIds(), ...this.deletingIds()]) {
+            const cell = this.cellStateOf(id);
+            if (cell.state !== "none" && typeof cell.meta.owner === "string" && cell.meta.owner.startsWith(SCENARIO_SUBJECT_PREFIX))
+                n += 1;
+        }
+        return n;
+    }
+    async renameRetiredExecutionLaneWordM40() {
+        if (this.dataRoot === undefined)
+            return 0;
+        const path = join(this.dataRoot, SESSION_META_SIDECAR_FILE);
+        const disk = await readSessionMetaForM40(path);
+        if (disk.state !== "read")
+            return 0;
+        let renamed = 0;
+        for (const cell of Object.values(disk.entries)) {
+            if (!isJsonObject(cell))
+                continue;
+            const execution = cell["execution"];
+            if (!isJsonObject(execution) || execution["role"] !== "writer" || execution["lane"] !== RETIRED_EXECUTION_LANE_WORD_M40)
+                continue;
+            execution["lane"] = RENAMED_EXECUTION_LANE_M40;
+            renamed += 1;
+        }
+        if (renamed === 0)
+            return 0;
+        try {
+            await atomicWriteFileAsync(path, JSON.stringify(disk.entries), { durability: "best-effort" });
+        }
+        catch (e) {
+            throw new ExecutionLaneRenameWriteRefusedError(path, e);
+        }
+        return renamed;
     }
     async assertStrictSidecarsReadable() {
         const loads = await Promise.allSettled(this.strictSidecars.map((map) => map.reconcile()));
@@ -522,39 +771,67 @@ export class LocalSessionStore {
         if (findings.length > 0)
             throw new LocalDataRootSchemaMismatchError(findings, "boot");
     }
-    async forkingRead(sessionId, meta) {
+    async forkingOf(sessionId, meta) {
         if (!isForkCreatedCell(meta))
             return false;
-        const probe = await this.probeArchive(sessionId);
-        if (probe.state === "unusable" && probe.word === "storage")
-            return probe;
-        return probe.state === "absent";
+        return (await this.probeArchive(sessionId)).state === "absent";
     }
-    async forkingOf(sessionId, meta) {
-        const forking = await this.forkingRead(sessionId, meta);
-        if (typeof forking !== "boolean")
-            throw forking.fault;
-        return forking;
-    }
-    async placementRead(sessionId) {
-        const read = await this.metaRead(sessionId);
-        if (read.state === "unusable")
-            return read;
-        if (read.state === "absent")
-            return undefined;
-        const partition = await this.placementProbe(sessionId);
-        if (partition.state === "placed")
-            return undefined;
-        if (partition.state === "unusable" && partition.word === "storage")
-            return partition;
-        const forking = await this.forkingRead(sessionId, read.meta);
-        return typeof forking === "boolean" ? readingOfCell(sessionId, read.meta, forking) : forking;
+    async observeRow(sessionId, want = {}) {
+        await this.meta.ensureLoaded();
+        const cell = this.cellStateOf(sessionId);
+        if (cell.state === "dropping" || cell.state === "deleting")
+            return ABSENT_ROW;
+        if (cell.state === "none") {
+            const probe = await this.probeArchive(sessionId);
+            if (probe.state === "absent")
+                return ABSENT_ROW;
+            const placed = want.placement === true ? await this.placedRecordOf(sessionId) : undefined;
+            return { row: "legacy", placed, ...(probe.state === "corrupt" ? { unreadable: probe.fault } : {}) };
+        }
+        const placed = want.placement === true ? await this.placedRecordOf(sessionId) : undefined;
+        const forking = want.forking === true && placed === undefined ? await this.forkingOf(sessionId, cell.meta) : false;
+        return { row: "live", meta: cell.meta, placed, forking };
     }
     async readExecutionPlacement(sessionId) {
-        const reading = await this.placementRead(sessionId);
-        if (isUnusableArchive(reading))
-            throw reading.fault;
-        return reading;
+        const seen = await this.observeRow(sessionId, { placement: true, forking: true });
+        if (!legacyNeedsMint(seen))
+            return executionReadingOf(sessionId, seen);
+        return this.withSessionWriteLock(sessionId, async () => {
+            const held = await this.observeRow(sessionId, { placement: true, forking: true });
+            return legacyNeedsMint(held) ? readingOfCell(sessionId, await this.mintHeld(sessionId), false) : executionReadingOf(sessionId, held);
+        });
+    }
+    async backfillPlacement(sessionId, lanes) {
+        return this.withSessionWriteLock(sessionId, async () => {
+            let seen;
+            try {
+                seen = await this.observeRow(sessionId, { placement: true, forking: true });
+            }
+            catch (fault) {
+                return unusableArchiveOfFault(fault);
+            }
+            if (seen.row === "absent" || seen.placed !== undefined)
+                return { outcome: "skipped" };
+            if (seen.row === "legacy" && seen.unreadable !== undefined)
+                return unusableArchiveOfFault(ownerUnreadableFault(seen.unreadable));
+            if (seen.row === "live" && (seen.meta.execution !== undefined || seen.forking))
+                return { outcome: "skipped" };
+            if (lanes.length !== 1)
+                return { outcome: "ambiguous" };
+            const writer = { role: "writer", lane: lanes[0] };
+            assertPlaceableLane(sessionId, writer);
+            let first;
+            if (seen.row === "legacy") {
+                try {
+                    first = await this.firstCellIncarnationHeld(sessionId);
+                }
+                catch (fault) {
+                    return unusableArchiveOfFault(fault);
+                }
+            }
+            await this.writeMeta(sessionId, (before) => before === undefined ? { incarnation: first ?? cellChangedUnderLock(sessionId), execution: writer } : readSessionMetaCell(before).execution === undefined ? cellWith(before, { execution: writer }) : undefined);
+            return { outcome: "placed" };
+        });
     }
     async placeExecution(sessionId, occupant, cell) {
         assertPlaceableLane(sessionId, cell);
@@ -566,7 +843,7 @@ export class LocalSessionStore {
     async markMirrorExecution(sessionId, occupant) {
         return this.withSessionWriteLock(sessionId, async () => {
             await this.meta.ensureLoaded();
-            const claim = this.metaCellOf(sessionId) === undefined ? undefined : await this.runs.getActiveTaskId(sessionId);
+            const claim = this.liveCellOf(sessionId) === undefined ? undefined : await this.runs.getActiveTaskId(sessionId);
             return this.settleExecutionHeld(sessionId, (reading) => {
                 const settled = settledMirrorOutcome(sessionId, reading, occupant);
                 if (settled !== WRITABLE)
@@ -576,9 +853,9 @@ export class LocalSessionStore {
         });
     }
     async settleExecutionHeld(sessionId, judge) {
-        await this.meta.ensureLoaded();
-        const placed = await this.isPlacedRow(sessionId);
-        const forking = !placed && (await this.forkingOf(sessionId, this.metaCellOf(sessionId)));
+        const seen = await this.observeRow(sessionId, { placement: true, forking: true });
+        const placed = seen.row !== "absent" && seen.placed !== undefined;
+        const forking = seen.row === "live" && seen.forking;
         let settled;
         let fault;
         await this.writeMeta(sessionId, (before) => {
@@ -595,33 +872,75 @@ export class LocalSessionStore {
             throw fault;
         return settled.outcome;
     }
-    metaCellOf(sessionId) {
+    cellStateOf(sessionId) {
         const cell = this.meta.state.entries.get(sessionId);
-        return cell === undefined ? undefined : readSessionMetaCell(cell);
+        if (cell === undefined)
+            return NO_CELL;
+        const meta = readSessionMetaCell(cell);
+        return { state: meta.deleting !== undefined ? "deleting" : meta.dropping ? "dropping" : "live", meta };
+    }
+    async rowDropping(sessionId) {
+        await this.meta.ensureLoaded();
+        const state = this.cellStateOf(sessionId).state;
+        return state === "dropping" || state === "deleting";
+    }
+    rowGoneSince(sessionId, hadLiveCell) {
+        const state = this.cellStateOf(sessionId).state;
+        return state === "dropping" || state === "deleting" || (state === "none" && hadLiveCell);
+    }
+    liveCellOf(sessionId) {
+        const cell = this.cellStateOf(sessionId);
+        return cell.state === "live" ? cell.meta : undefined;
+    }
+    liveCellIds() {
+        return [...this.meta.state.entries]
+            .filter(([, cell]) => {
+            const meta = readSessionMetaCell(cell);
+            return !meta.dropping && meta.deleting === undefined;
+        })
+            .map(([id]) => id)
+            .sort();
+    }
+    deletingIds() {
+        return [...this.meta.state.entries].filter(([id]) => this.cellStateOf(id).state === "deleting").map(([id]) => id).sort();
+    }
+    droppingIds() {
+        return [...this.meta.state.entries].filter(([id]) => this.cellStateOf(id).state === "dropping").map(([id]) => id).sort();
     }
     async writeMeta(sessionId, next) {
         await this.meta.ensureLoaded();
         let changed = false;
         const committed = await this.meta.commit((draft) => {
-            const value = next(draft.get(sessionId));
+            const before = draft.get(sessionId);
+            if (before !== undefined && readSessionMetaCell(before).deleting !== undefined)
+                throw new SessionError("not_found", `LocalSessionStore: session ${sessionId} is being deleted — it reads as gone; this write was not made`);
+            if (before !== undefined && readSessionMetaCell(before).dropping)
+                throw new Error(`LocalSessionStore: session ${sessionId}'s cell carries the drop mark while another writer reached it — every section finishes a pending drop first; refusing to write`);
+            const value = next(before);
             if (value === undefined)
                 return false;
             draft.set(sessionId, value);
             changed = true;
             return true;
-        });
+        }, "best-effort");
         if (!committed)
             throw new SessionError("storage", `LocalSessionStore: session-meta sidecar write failed for session ${sessionId} — nothing was recorded`);
         return changed;
     }
     async dropMeta(sessionId) {
         await this.meta.ensureLoaded();
-        if (!(await this.meta.deleteKey(sessionId)))
-            throw new SessionError("storage", `LocalSessionStore: session-meta sidecar write failed while deleting session ${sessionId} — its owner/incarnation cell is still on disk`);
+        if (!(await this.meta.deleteKey(sessionId, "best-effort")))
+            throw new SessionError("storage", `LocalSessionStore: session-meta sidecar write failed while withdrawing session ${sessionId}'s cell — the cell is still on disk`);
+    }
+    async withRootRow(sessionId, body) {
+        return this.withSessionWriteLock(sessionId, async () => body(await this.rowPresentHeld(sessionId)));
+    }
+    async rowPresentHeld(sessionId) {
+        return (await this.observeRow(sessionId)).row !== "absent";
     }
     async withSessionWriteLock(sessionId, body) {
         const locks = this.sessionWriteLocks;
-        const link = (locks.get(sessionId) ?? Promise.resolve()).then(body);
+        const link = (locks.get(sessionId) ?? Promise.resolve()).then(async () => body(await this.finishPendingDropHeld(sessionId)));
         const tail = link.then(() => undefined, () => undefined);
         locks.set(sessionId, tail);
         try {
@@ -639,7 +958,9 @@ export class LocalSessionStore {
         }
         catch (e) {
             const word = e instanceof SessionError ? archiveFaultWord(e.code) : "storage";
-            return word === "absent" ? { state: "absent" } : unusableArchiveOf(word, e);
+            if (word === "storage")
+                throw e;
+            return word === "absent" ? { state: "absent" } : { state: "corrupt", fault: e };
         }
     }
     async placementProbe(sessionId) {
@@ -649,76 +970,88 @@ export class LocalSessionStore {
         }
         catch (e) {
             const word = e instanceof SessionError ? archiveFaultWord(e.code) : "storage";
-            return word === "absent" ? { state: "ordinary" } : unusableArchiveOf(word, e);
+            if (word === "storage")
+                throw e;
+            return word === "absent" ? { state: "ordinary" } : { state: "corrupt", fault: e };
         }
     }
     async placedRecordOf(sessionId) {
         const probe = await this.placementProbe(sessionId);
-        if (probe.state === "unusable") {
-            if (probe.word === "storage")
-                throw probe.fault;
-            return undefined;
-        }
         return probe.state === "placed" ? probe.record : undefined;
     }
-    async isPlacedRow(sessionId) {
-        return (await this.placedRecordOf(sessionId)) !== undefined;
-    }
     async placedRecordOrThrow(sessionId) {
         const probe = await this.placementProbe(sessionId);
-        if (probe.state === "unusable")
+        if (probe.state === "corrupt")
             throw probe.fault;
         return probe.state === "placed" ? probe.record : undefined;
     }
     async existsInRepo(sessionId) {
         const probe = await this.probeArchive(sessionId);
-        if (probe.state === "unusable")
+        if (probe.state === "corrupt")
             throw probe.fault;
         return probe.state === "readable";
     }
     async metaOf(sessionId) {
-        const read = await this.metaRead(sessionId);
-        if (read.state === "unusable")
-            throw read.fault;
-        return read.state === "found" ? read.meta : undefined;
+        const seen = await this.observeRow(sessionId);
+        switch (seen.row) {
+            case "absent":
+                return undefined;
+            case "live":
+                return seen.meta;
+            case "legacy":
+                if (seen.unreadable !== undefined)
+                    throw ownerUnreadableFault(seen.unreadable);
+                return this.withSessionWriteLock(sessionId, () => this.metaHeld(sessionId));
+            default: {
+                const unknownRow = seen;
+                throw new Error(`LocalSessionStore: no row observation ${JSON.stringify(unknownRow)}`);
+            }
+        }
     }
-    async metaRead(sessionId) {
-        await this.meta.ensureLoaded();
-        const cell = this.meta.state.entries.get(sessionId);
-        if (cell !== undefined)
-            return { state: "found", meta: readSessionMetaCell(cell) };
-        const probe = await this.probeArchive(sessionId);
-        if (probe.state === "unusable")
-            return ownerUnreadableArchive(probe);
-        if (probe.state === "absent")
-            return { state: "absent" };
-        const meta = await this.cellOfPresent(sessionId);
-        return meta === undefined ? { state: "absent" } : { state: "found", meta };
-    }
-    async cellOfPresent(sessionId) {
-        if (!this.meta.state.entries.has(sessionId))
-            await this.writeMeta(sessionId, (before) => (before === undefined && !this.rowsDropped.has(sessionId) ? { incarnation: mintSessionIncarnation() } : undefined));
-        const cell = this.meta.state.entries.get(sessionId);
-        return cell === undefined ? undefined : readSessionMetaCell(cell);
+    async metaHeld(sessionId) {
+        const seen = await this.observeRow(sessionId);
+        if (seen.row === "absent")
+            return undefined;
+        if (seen.row === "live")
+            return seen.meta;
+        if (seen.unreadable !== undefined)
+            throw ownerUnreadableFault(seen.unreadable);
+        return this.mintHeld(sessionId);
+    }
+    async mintHeld(sessionId) {
+        const incarnation = await this.firstCellIncarnationHeld(sessionId);
+        await this.writeMeta(sessionId, (before) => (before === undefined ? { incarnation } : undefined));
+        const meta = this.liveCellOf(sessionId);
+        if (meta === undefined)
+            throw new SessionError("storage", `LocalSessionStore: session ${sessionId} has no live session-meta cell right after its cell was minted under its own write lock — refusing to guess`);
+        return meta;
+    }
+    async firstCellIncarnationHeld(sessionId) {
+        const head = archiveTokenAdoptionCarried() ? await this.archiveHeadOf(sessionId) : undefined;
+        return firstCellIncarnationOf(sessionId, head?.incarnation).incarnation;
     }
     async headOf(sessionId) {
         const before = await this.metaOf(sessionId);
         if (before === undefined)
             return undefined;
         const leaf = await this.archiveHeadOf(sessionId).then((archive) => archive?.leafId ?? null, (fault) => new UnreadableLeaf(fault));
-        const cell = this.meta.state.entries.get(sessionId);
-        const after = cell === undefined ? undefined : readSessionMetaCell(cell);
+        const after = this.liveCellOf(sessionId);
         if (after === undefined || after.incarnation !== before.incarnation || (after.owner ?? null) !== (before.owner ?? null))
             return undefined;
         return headFromRow(sessionId, before.owner ?? null, before.incarnation, leaf);
     }
+    async deletionHeadOf(sessionId) {
+        await this.meta.ensureLoaded();
+        const cell = this.cellStateOf(sessionId);
+        if (cell.state === "dropping" || cell.state === "deleting")
+            return headFromRow(sessionId, cell.meta.owner ?? null, cell.meta.incarnation, null);
+        return this.headOf(sessionId);
+    }
     archiveHeadOf(sessionId) {
         return this.repo.headOf(sessionId);
     }
     async handOut(sessionId, session) {
-        const meta = await this.cellOfPresent(sessionId);
-        if (meta === undefined)
-            throw new SessionError("storage", `LocalSessionStore: session ${sessionId} lost its session-meta cell while it was being handed out`);
+        const meta = this.liveCellOf(sessionId) ?? (await this.mintHeld(sessionId));
         return { session: occupiedBy(session, rowMetadataOf(sessionId, meta)), sessionId };
     }
     async sessionMetadataOf(sessionId) {
@@ -726,11 +1059,15 @@ export class LocalSessionStore {
         return meta === undefined ? undefined : rowMetadataOf(sessionId, meta);
     }
     async probeTitle(sessionId) {
+        if (await this.rowDropping(sessionId))
+            return "none";
         await this.titles.ensureLoaded();
         return this.titles.state.entries.has(sessionId) ? "titled" : "untitled";
     }
     async setTitleIfNull(sessionId, title) {
         return this.withSessionWriteLock(sessionId, async () => {
+            if (!(await this.rowPresentHeld(sessionId)))
+                return false;
             await this.titles.ensureLoaded();
             const entries = this.titles.state.entries;
             if (entries.has(sessionId))
@@ -756,6 +1093,7 @@ export class LocalSessionStore {
                 case "mirror":
                     return { kind: "mirror" };
                 case "write":
+                    await this.bumpClientWritesHeld(sessionId);
                     await this.writeRowCellsHeld(sessionId, cells);
                     return settleSessionRowWrite(how, verdict, await this.listRowOf(sessionId));
                 case "changed":
@@ -768,7 +1106,7 @@ export class LocalSessionStore {
         });
     }
     async lockedRowOf(sessionId) {
-        const meta = this.metaCellOf(sessionId);
+        const meta = this.liveCellOf(sessionId);
         if (meta === undefined || (await this.rowHeaderOf(sessionId)) === undefined)
             return undefined;
         return { owner: meta.owner ?? null, incarnation: incarnationFromCell(sessionId, meta.incarnation, "absent"), placed: false, mirror: meta.execution?.role === "mirror", cells: this.rowCellsOf(sessionId) };
@@ -786,7 +1124,7 @@ export class LocalSessionStore {
                     return false;
                 draft.set(sessionId, title);
                 return true;
-            });
+            }, "best-effort");
             if (!ok)
                 throw new SessionError("storage", `LocalSessionStore: title sidecar write failed for session ${sessionId} — the title was not recorded`);
         }
@@ -798,7 +1136,7 @@ export class LocalSessionStore {
                     return false;
                 draft.set(sessionId, true);
                 return true;
-            });
+            }, "best-effort");
             if (!ok)
                 throw new SessionError("storage", `LocalSessionStore: pin sidecar write failed for session ${sessionId} — the pin was not recorded`);
         }
@@ -806,23 +1144,28 @@ export class LocalSessionStore {
     async listRowOf(sessionId) {
         await this.loadRowSidecars();
         const header = await this.rowHeaderOf(sessionId);
-        const meta = this.metaCellOf(sessionId);
+        const meta = this.liveCellOf(sessionId);
         if (header === undefined || meta === undefined)
             return undefined;
-        return { row: await this.summaryOf(await this.listedRowOf(header), await this.runRollups()), occupant: { owner: meta.owner ?? null, incarnation: incarnationFromCell(sessionId, meta.incarnation, "absent") } };
+        return { row: this.summaryOf(await this.listedRowOf(header), await this.runRollups()), occupant: { owner: meta.owner ?? null, incarnation: incarnationFromCell(sessionId, meta.incarnation, "absent") } };
     }
     async sessionSummaryOf(sessionId) {
         await this.loadRowSidecars();
         const header = await this.rowHeaderOf(sessionId);
-        return header === undefined ? undefined : this.summaryOf(await this.listedRowOf(header), await this.runRollups());
+        if (header === undefined)
+            return undefined;
+        const hadLiveCell = this.cellStateOf(sessionId).state === "live";
+        const listed = await this.listedRowOf(header);
+        const rollups = await this.runRollups();
+        return this.rowGoneSince(sessionId, hadLiveCell) ? undefined : this.summaryOf(listed, rollups);
     }
     async rowHeaders() {
         await this.meta.ensureLoaded();
-        const listed = await this.repo.list();
+        const listed = (await this.repo.list()).filter((row) => this.cellStateOf(row.id).state !== "dropping");
         const listedIds = new Set(listed.map((row) => row.id));
         const placed = this.createPlacedIdsReader();
         const rows = listed.map((header) => ({ sessionId: header.id, header }));
-        for (const id of [...this.meta.state.entries.keys()].sort()) {
+        for (const id of this.liveCellIds()) {
             if (listedIds.has(id))
                 continue;
             const row = await this.headerUnreadableRowOf(id, placed);
@@ -833,10 +1176,13 @@ export class LocalSessionStore {
     }
     async rowHeaderOf(sessionId) {
         await this.meta.ensureLoaded();
+        const cell = this.cellStateOf(sessionId);
+        if (cell.state === "dropping" || cell.state === "deleting")
+            return undefined;
         const header = (await this.repo.list()).find((m) => m.id === sessionId);
         if (header !== undefined)
             return { sessionId, header };
-        return this.meta.state.entries.has(sessionId) ? this.headerUnreadableRowOf(sessionId, this.createPlacedIdsReader()) : undefined;
+        return cell.state === "live" ? this.headerUnreadableRowOf(sessionId, this.createPlacedIdsReader()) : undefined;
     }
     async headerUnreadableRowOf(sessionId, placed) {
         try {
@@ -856,35 +1202,43 @@ export class LocalSessionStore {
             return { sessionId: row.sessionId, unreadable: row.headerFault };
         try {
             await this.archiveHeadOf(row.sessionId);
-            return { sessionId: row.sessionId, readable: row.header };
+            return { sessionId: row.sessionId, readable: true };
         }
         catch (fault) {
             return { sessionId: row.sessionId, unreadable: fault };
         }
     }
     async readInstructionSource(sessionId) {
+        if (await this.rowDropping(sessionId))
+            return decodeInstructionSource(undefined);
         await this.instructionSources.ensureLoaded();
         return decodeInstructionSource(this.instructionSources.state.entries.get(sessionId));
     }
     async recordInstructionSource(sessionId, expected, source) {
-        await this.instructionSources.ensureLoaded();
-        const committed = await this.instructionSources.commit((draft) => {
-            if (!sameInstructionSourceBaseline(decodeInstructionSource(draft.get(sessionId)), expected))
-                return false;
-            draft.set(sessionId, encodeInstructionSource(source));
-            return true;
+        await this.withSessionWriteLock(sessionId, async () => {
+            if (!(await this.rowPresentHeld(sessionId)))
+                return;
+            await this.instructionSources.ensureLoaded();
+            const committed = await this.instructionSources.commit((draft) => {
+                if (!sameInstructionSourceBaseline(decodeInstructionSource(draft.get(sessionId)), expected))
+                    return false;
+                draft.set(sessionId, encodeInstructionSource(source));
+                return true;
+            }, "best-effort");
+            if (!committed)
+                throw new Error("LocalSessionStore: instruction-source sidecar write failed — baseline not recorded");
         });
-        if (!committed)
-            throw new Error("LocalSessionStore: instruction-source sidecar write failed — baseline not recorded");
     }
     async readSessionWorkspace(sessionId) {
+        if (await this.rowDropping(sessionId))
+            return undefined;
         await this.workspaces.ensureLoaded();
         return decodeSessionWorkspaceCell(this.workspaces.state.entries.get(sessionId) ?? null, sessionId);
     }
     async recordSessionWorkspace(sessionId, incarnation, workspace) {
         const text = encodeSessionWorkspaceCell(workspace, JSON.stringify, sessionId);
         await this.withSessionWriteLock(sessionId, async () => {
-            if ((await this.metaOf(sessionId))?.incarnation !== incarnation)
+            if ((await this.metaHeld(sessionId))?.incarnation !== incarnation)
                 return;
             await this.workspaces.ensureLoaded();
             const committed = await this.workspaces.commit((draft) => {
@@ -892,7 +1246,7 @@ export class LocalSessionStore {
                     return false;
                 draft.set(sessionId, text);
                 return true;
-            });
+            }, "best-effort");
             if (!committed)
                 throw new SessionError("storage", `LocalSessionStore: workspace sidecar write failed for session ${sessionId} — its place was not recorded`);
         });
@@ -943,10 +1297,8 @@ export class LocalSessionStore {
         this.dirty = false;
         const snapshot = Object.fromEntries(this.lastActivity);
         try {
-            await mkdir(join(path, ".."), { recursive: true });
-            const tmp = `${path}.${process.pid}.${++this.writeSeq}.tmp`;
-            await writeFile(tmp, JSON.stringify(snapshot), "utf8");
-            await rename(tmp, path);
+            ensureDir(dirname(path));
+            await atomicWriteFileAsync(path, JSON.stringify(snapshot), { durability: "best-effort" });
         }
         catch (e) {
             this.warnSidecar("write", e);
@@ -963,7 +1315,7 @@ export class LocalSessionStore {
         if (now - this.lastWarnAt < 60_000)
             return;
         this.lastWarnAt = now;
-        console.warn(`LocalSessionStore: ${which} sidecar ${op} failed (${SIDECAR_DEGRADES[which]} persistence degraded): ${e instanceof Error ? e.message : String(e)}`);
+        writeLogText("stderr", `LocalSessionStore: ${which} sidecar ${op} failed (${SIDECAR_DEGRADES[which]} persistence degraded): ${e instanceof Error ? e.message : String(e)}`);
     }
     async acquire(sessionId, opts) {
         if (!sessionId && this.declaredPlacement(opts) !== undefined)
@@ -992,6 +1344,9 @@ export class LocalSessionStore {
     }
     async load(sessionId, requireExisting = false, opts) {
         return this.withSessionWriteLock(sessionId, async () => {
+            await this.meta.ensureLoaded();
+            if (this.cellStateOf(sessionId).state === "deleting")
+                throw new SessionError("not_found", `session ${sessionId} not found (it is being deleted)`);
             try {
                 return await this.openForItselfHeld(sessionId, opts);
             }
@@ -1002,7 +1357,7 @@ export class LocalSessionStore {
                     throw e;
             }
             await this.meta.ensureLoaded();
-            if (isForkCreatedCell(this.metaCellOf(sessionId)))
+            if (isForkCreatedCell(this.liveCellOf(sessionId)))
                 throw new SessionForkInProgressError(sessionId);
             const placement = this.declaredPlacement(opts);
             if (placement !== undefined)
@@ -1019,7 +1374,7 @@ export class LocalSessionStore {
         return this.handOut(sessionId, session);
     }
     async createPlacedHeld(sessionId, placement, opts) {
-        if (this.metaCellOf(sessionId) !== undefined) {
+        if (this.liveCellOf(sessionId) !== undefined) {
             throw new SessionError("placement_refused", `session ${sessionId} is already registered as an ordinary session — refusing to create a subagent transcript on its id`);
         }
         const { owner: treeOwner, ...tuple } = placement;
@@ -1046,8 +1401,8 @@ export class LocalSessionStore {
         return this.handOut(sessionId, session);
     }
     async holdsThisPlacement(sessionId, opts) {
-        const probe = await this.placementProbe(sessionId);
-        if (probe.state === "unusable")
+        const probe = await this.placementProbe(sessionId).then((answer) => answer, (fault) => ({ state: "storage", fault }));
+        if (probe.state === "corrupt" || probe.state === "storage")
             return true;
         try {
             admitSessionPlacement(sessionId, probe.state === "placed" ? probe.record : undefined, opts, placementCapabilityOf(this));
@@ -1068,28 +1423,31 @@ export class LocalSessionStore {
         }
     }
     async register(sessionId, owner) {
-        await this.withSessionWriteLock(sessionId, async () => {
+        await this.registerWithReceipt(sessionId, owner);
+    }
+    async registerWithReceipt(sessionId, owner) {
+        return this.withSessionWriteLock(sessionId, async () => {
             await this.meta.ensureLoaded();
-            if (ownerRecorded(this.meta.state.entries.get(sessionId)))
-                return;
+            if (this.cellStateOf(sessionId).state === "deleting")
+                return {};
+            if (this.liveCellOf(sessionId)?.owner !== undefined)
+                return {};
             assertFirstOwnerWritable(sessionId, owner);
             const existed = await this.existsInRepo(sessionId);
-            if (!existed && isForkCreatedCell(this.metaCellOf(sessionId)))
+            if (!existed && isForkCreatedCell(this.liveCellOf(sessionId)))
                 throw new SessionForkInProgressError(sessionId);
-            const claim = existed && owner !== null && ownerClaimWindowOpen() && !(await this.isPlacedRow(sessionId));
+            const born = mintSessionIncarnation();
+            const first = existed && this.liveCellOf(sessionId) === undefined ? await this.firstCellIncarnationHeld(sessionId) : undefined;
             const wrote = await this.writeMeta(sessionId, (before) => {
                 if (ownerRecorded(before))
                     return undefined;
-                if (claim)
-                    return before === undefined ? { incarnation: mintSessionIncarnation(), owner } : cellWith(before, { owner });
                 if (!existed)
-                    return { incarnation: mintSessionIncarnation(), owner, createdAt: rowBornNow() };
-                return before === undefined ? { incarnation: mintSessionIncarnation() } : undefined;
+                    return { incarnation: born, owner, createdAt: rowBornNow(), clientWrites: 0 };
+                return before === undefined ? { incarnation: first ?? cellChangedUnderLock(sessionId) } : undefined;
             });
             if (!existed && wrote)
                 await this.repo.create({ id: sessionId });
-            if (claim && wrote)
-                this.log.info("session_owner_claimed", { sessionId });
+            return !existed && wrote ? { minted: { sessionId, owner, incarnation: born } } : {};
         });
     }
     async touch(sessionId) {
@@ -1101,8 +1459,10 @@ export class LocalSessionStore {
         await this.withSessionWriteLock(sessionId, async () => {
             if ((await this.placedRecordOrThrow(sessionId)) === undefined)
                 return;
+            const verdict = await judgeSessionWrite({ op: "delete", rootSessionId: sessionId }, { claim: () => this.runs.getActiveTaskId(sessionId), cell: async () => ({ role: "absent" }), deleting: async () => this.deletingTokenOf(sessionId) });
+            if (verdict !== "proceed")
+                throw verdict.refuse;
             await this.dropRowHeld(sessionId);
-            await this.repo.delete({ id: sessionId, createdAt: "" });
         });
     }
     async listSessions(opts) {
@@ -1110,28 +1470,31 @@ export class LocalSessionStore {
     }
     async listSessionRows(opts) {
         await this.loadRowSidecars();
+        const hadLiveCell = new Set(this.liveCellIds());
         const rows = [];
         for (const header of await this.rowHeaders())
             rows.push(await this.listedRowOf(header));
-        const rollups = await this.runRollups();
+        const rollups = await this.runRollups(opts.q);
         const all = [];
         for (const row of rows) {
+            if (opts.q && !rollups.has(row.sessionId))
+                continue;
+            if (this.rowGoneSince(row.sessionId, hadLiveCell.has(row.sessionId)))
+                continue;
             const owner = this.ownerCellOf(row.sessionId);
             if (opts.owner !== undefined && owner !== opts.owner && !(opts.includeUnowned === true && owner === null))
                 continue;
-            const meta = this.metaCellOf(row.sessionId);
+            const meta = this.liveCellOf(row.sessionId);
             const incarnation = meta === undefined ? undefined : incarnationFromCell(row.sessionId, meta.incarnation, "absent");
-            all.push({ row: await this.summaryOf(row, rollups), occupant: { owner, incarnation } });
+            all.push({ row: this.summaryOf(row, rollups), occupant: { owner, incarnation } });
         }
-        const qlc = opts.q?.toLowerCase();
-        const filtered = qlc ? all.filter(({ row: r }) => r.objectivePreview?.toLowerCase().includes(qlc)) : all;
-        filtered.sort(({ row: a }, { row: b }) => a.lastActivityAt !== b.lastActivityAt
+        all.sort(({ row: a }, { row: b }) => a.lastActivityAt !== b.lastActivityAt
             ? (a.lastActivityAt < b.lastActivityAt ? 1 : -1)
             : (a.sessionId < b.sessionId ? 1 : -1));
         const c = opts.cursor;
         const after = c
-            ? filtered.filter(({ row: r }) => r.lastActivityAt < c.lastActivityAt || (r.lastActivityAt === c.lastActivityAt && r.sessionId < c.sessionId))
-            : filtered;
+            ? all.filter(({ row: r }) => r.lastActivityAt < c.lastActivityAt || (r.lastActivityAt === c.lastActivityAt && r.sessionId < c.sessionId))
+            : all;
         return after.slice(0, opts.limit);
     }
     async loadRowSidecars() {
@@ -1141,58 +1504,43 @@ export class LocalSessionStore {
         await this.meta.ensureLoaded();
     }
     ownerCellOf(sessionId) {
-        const cell = this.meta.state.entries.get(sessionId);
-        return cell === undefined ? null : (readSessionMetaCell(cell).owner ?? null);
+        return this.liveCellOf(sessionId)?.owner ?? null;
     }
-    async summaryOf(listed, rollups) {
+    summaryOf(listed, rollups) {
         const { sessionId } = listed;
-        const firstActivityAt = rowCreatedAtOf(sessionId, this.metaCellOf(sessionId));
+        const firstActivityAt = rowCreatedAtOf(sessionId, this.liveCellOf(sessionId));
         const owner = this.ownerCellOf(sessionId);
         const cells = this.rowCellsOf(sessionId);
         const rowTag = this.rowTagKeyOf(sessionId, owner, cells);
         const lastActivityAt = this.lastActivity.get(sessionId) ?? firstActivityAt;
-        const objectivePreview = "readable" in listed ? await this.previewOf(listed.readable) : null;
         return {
             sessionId,
             owner,
             lastActivityAt,
             firstActivityAt,
-            objectivePreview,
-            ...this.runProjectionOf(sessionId, rollups),
+            ...this.runRollupOf(sessionId, rollups),
             title: cells.title,
             pinned: cells.pinned,
             ...rowTag,
             ...("unreadable" in listed ? { unreadable: sessionUnreadableOf(listed.unreadable) } : {}),
+            ...this.listedLineageOf(sessionId),
         };
     }
+    listedLineageOf(sessionId) {
+        const lineage = forkLineageOfRow(sessionId, this.liveCellOf(sessionId)?.forkedFrom, undefined);
+        return lineage.forkedFrom !== undefined ? { forkedFrom: lineage.forkedFrom } : {};
+    }
     rowTagKeyOf(sessionId, owner, cells) {
-        const meta = this.metaCellOf(sessionId);
+        const meta = this.liveCellOf(sessionId);
         if (meta === undefined)
             return {};
         return sessionRowTagKey({ sessionId, owner, incarnation: incarnationFromCell(sessionId, meta.incarnation, "absent"), cells });
     }
-    async runRollups() {
-        const rows = await this.runs.listSessions({ limit: Number.MAX_SAFE_INTEGER });
-        return new Map(rows.map((r) => [r.sessionId, { runCount: r.runCount, lastStatus: r.lastStatus, lastRunId: r.lastRunId, ...(r.lastTaskRunId !== undefined ? { lastTaskRunId: r.lastTaskRunId } : {}) }]));
+    runRollups(q) {
+        return this.runs.sessionRunRollups(q ? { q } : {});
     }
-    runProjectionOf(sessionId, rollups) {
-        return rollups.get(sessionId) ?? { runCount: 0, lastStatus: "", lastRunId: null };
-    }
-    async previewOf(meta) {
-        try {
-            const session = await this.repo.open({ id: meta.id, createdAt: meta.createdAt });
-            const entries = await session.getEntries();
-            for (let i = entries.length - 1; i >= 0; i--) {
-                const text = userText(entries[i]);
-                const preview = text === null ? "" : buildObjectivePreview(text, SESSION_OBJECTIVE_PREVIEW_CHARS);
-                if (preview !== "")
-                    return preview;
-            }
-            return null;
-        }
-        catch {
-            return null;
-        }
+    runRollupOf(sessionId, rollups) {
+        return rollups.get(sessionId) ?? { runCount: 0, lastStatus: "", lastRunId: null, objectivePreview: null };
     }
     async fork(sourceId, owner, opts) {
         return forkByFreshId((s, o, t) => this.forkTo(s, o, t), sourceId, owner, opts);
@@ -1205,6 +1553,9 @@ export class LocalSessionStore {
         return this.withSessionWriteLock(first, () => this.withSessionWriteLock(second, () => this.forkToHeld(sourceId, owner, target)));
     }
     async forkToHeld(sourceId, owner, target) {
+        await this.meta.ensureLoaded();
+        if (this.cellStateOf(sourceId).state === "deleting")
+            return null;
         const sourceMeta = { id: sourceId, createdAt: "" };
         let source;
         try {
@@ -1217,15 +1568,25 @@ export class LocalSessionStore {
         }
         await this.assertArchiveAnonymous(sourceId);
         const forkOptions = await settledForkOptions(source);
-        const forkOwner = forkOwnerOf(owner, this.metaCellOf(sourceId)?.owner);
-        const existing = this.metaCellOf(target.id);
+        const sourceCell = this.liveCellOf(sourceId);
+        const forkOwner = forkOwnerOf(owner, sourceCell?.owner);
+        const sourceToken = sourceCell === undefined ? undefined : incarnationFromCell(sourceId, sourceCell.incarnation, "absent");
+        const lineage = forkRowCells({ ...sourceMeta, ...(sourceToken !== undefined ? { incarnation: sourceToken } : {}) });
+        const existing = this.liveCellOf(target.id);
         const targetArchived = await this.existsInRepo(target.id);
         const placement = this.placements !== undefined ? target.placement : undefined;
         const copy = () => this.repo.fork(sourceMeta, { ...forkOptions, id: target.id, ...(placement !== undefined ? { placement } : {}) });
         if (existing === undefined && !targetArchived) {
             const created = await this.writeMeta(target.id, (before) => before !== undefined
                 ? undefined
-                : { incarnation: mintSessionIncarnation(), ...(forkOwner !== undefined ? { owner: forkOwner } : {}), ...(target.key !== undefined ? { forkKey: target.key } : {}), createdAt: rowBornNow(), forkedFrom: sourceId });
+                : {
+                    incarnation: mintSessionIncarnation(),
+                    ...(forkOwner !== undefined ? { owner: forkOwner } : {}),
+                    ...(target.key !== undefined ? { forkKey: target.key } : {}),
+                    createdAt: rowBornNow(),
+                    ...(lineage.forkedFrom !== undefined ? { forkedFrom: lineage.forkedFrom } : {}),
+                    ...(lineage.forkedFromIncarnation !== undefined ? { forkedFromIncarnation: lineage.forkedFromIncarnation } : {}),
+                });
             if (!created)
                 throw new SessionError("storage", `LocalSessionStore: fork target ${target.id} gained a session-meta cell under its own write lock — refusing to guess`);
             let forked;
@@ -1241,8 +1602,12 @@ export class LocalSessionStore {
             return { outcome: "created", id: target.id };
         }
         const out = classifyForkTarget(target, { owner: existing?.owner, forkKey: existing?.forkKey }, forkOwner);
-        if (out.outcome === "replayed" && !targetArchived)
+        if (out.outcome === "replayed" && isForkCreatedCell(existing) && !targetArchived) {
+            const recorded = existing?.forkedFromIncarnation;
+            if (recorded !== undefined && recorded !== lineage.forkedFromIncarnation)
+                return null;
             await copy();
+        }
         return out;
     }
     async admitForkedPlacement(sessionId, forked, placement) {
@@ -1263,6 +1628,9 @@ export class LocalSessionStore {
     async exportEntries(sessionId) {
         if (!this.repo.exportEntries)
             return null;
+        await this.meta.ensureLoaded();
+        if (this.cellStateOf(sessionId).state !== "live" && this.cellStateOf(sessionId).state !== "none")
+            return null;
         try {
             return await this.repo.exportEntries(sessionId);
         }
@@ -1305,11 +1673,9 @@ export class LocalSessionStore {
         if (landing === "replace")
             await this.assertNotPlacedHeld(sessionId);
         validateEntriesForImport(entries);
-        const current = this.metaCellOf(sessionId);
-        if (current?.execution?.role === "writer")
-            throw new SessionWriterPresentError(sessionId, current.execution.lane);
-        if (await this.forkingOf(sessionId, current))
-            throw new SessionForkInProgressError(sessionId);
+        const current = this.liveCellOf(sessionId);
+        if (landing !== "judged")
+            await this.admitImportHeld(sessionId, current);
         if (!(await this.importMayLand(sessionId, current, owner, landing)))
             throw importRowRefused(sessionId, landing);
         const prior = await this.landImportCell(sessionId, owner);
@@ -1317,8 +1683,8 @@ export class LocalSessionStore {
             case "create":
             case "judged":
                 try {
-                    const archive = (await this.archiveHeadOf(sessionId)) ?? null;
-                    await this.repo.importEntries(sessionId, undefined, entries, { expect: { row: archive } });
+                    const expectRow = landing === "create" ? null : ((await this.archiveHeadOf(sessionId)) ?? null);
+                    await this.repo.importEntries(sessionId, undefined, entries, { expect: { row: expectRow } });
                 }
                 catch (err) {
                     await this.withdrawImportCell(sessionId, prior, err);
@@ -1348,6 +1714,15 @@ export class LocalSessionStore {
             throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${placed.kind} placement partition (a delegated agent's transcript) — a session import cannot replace its log`);
         }
     }
+    async admitImportHeld(sessionId, current) {
+        const verdict = await judgeSessionWrite({ op: "import", rootSessionId: sessionId }, {
+            claim: () => this.runs.getActiveTaskId(sessionId),
+            cell: async () => placementCellOf(current, await this.forkingOf(sessionId, current)),
+            deleting: async () => this.deletingTokenOf(sessionId),
+        });
+        if (verdict !== "proceed")
+            throw verdict.refuse;
+    }
     async importMayLand(sessionId, current, owner, landing) {
         switch (landing) {
             case "create":
@@ -1369,7 +1744,7 @@ export class LocalSessionStore {
             const cells = carriedRowCells(sessionId, before === undefined ? undefined : readSessionMetaCell(before));
             const base = before === undefined ? { createdAt: rowBornNow() } : cellObjectOf(before);
             const { forkKey: _carriedByTheRule, ...kept } = base;
-            return { ...kept, incarnation: cells.incarnation, owner, execution: MIRROR_CELL, ...(cells.forkKey !== null ? { forkKey: cells.forkKey } : {}) };
+            return { ...kept, incarnation: cells.incarnation, owner, execution: MIRROR_CELL, ...(cells.forkKey !== null ? { forkKey: cells.forkKey } : {}), clientWrites: (kept.clientWrites ?? 0) + 1 };
         });
         return prior;
     }
@@ -1401,11 +1776,9 @@ export class LocalSessionStore {
     }
     async commitStagedImport(sessionId, owner, staged, opts) {
         return this.withImportLock(sessionId, owner, async (importer) => {
-            const current = await this.metaOf(sessionId);
+            const current = await this.metaHeld(sessionId);
             if (!ownerCellIs(opts.expectedOwner, current === undefined ? undefined : (current.owner ?? null)))
                 throw new StagedCommitOwnerChangedError(sessionId);
-            if (await this.forkingOf(sessionId, current))
-                throw new SessionForkInProgressError(sessionId);
             await this.assertNotPlacedHeld(sessionId);
             const dstEntries = await this.exportEntries(sessionId);
             const rel = classifySyncRelationshipByIds(staged.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
@@ -1421,8 +1794,7 @@ export class LocalSessionStore {
                 if (diverged)
                     throw new SyncConflictError(sessionId, contentForkRelation(diverged, rel.newEntryIds));
             }
-            if (current?.execution?.role === "writer")
-                throw new SessionWriterPresentError(sessionId, current.execution.lane);
+            await this.admitImportHeld(sessionId, current);
             if (rel.relation !== "identical" || !contentEqual) {
                 await this.importHeld(sessionId, importer, staged, "judged");
             }
@@ -1430,46 +1802,326 @@ export class LocalSessionStore {
                 await this.landImportCell(sessionId, importer);
                 await this.touch(sessionId);
             }
-            const meta = await this.metaOf(sessionId);
+            const meta = await this.metaHeld(sessionId);
             if (meta === undefined)
                 throw new SessionError("storage", `LocalSessionStore: staged commit for session ${sessionId} left no session face — nothing was settled`);
             const face = sessionFaceFromRow(sessionId, meta.owner ?? null, meta.incarnation);
             return { relation: rel.relation, face };
         });
     }
-    async deleteSession(sessionId, owner) {
-        return this.withSessionWriteLock(sessionId, () => this.deleteSessionHeld(sessionId, owner));
+    async deleteSession(sessionId, owner, token, legs) {
+        return this.withSessionWriteLock(sessionId, (dropped) => this.deleteSessionHeld(sessionId, owner, token, legs, dropped));
     }
-    async deleteSessionHeld(sessionId, owner) {
-        const current = await this.metaOf(sessionId);
-        if (current === undefined || !ownerEq(current.owner ?? null, owner))
-            return false;
+    async deleteSessionHeld(sessionId, owner, token, legs, dropped) {
+        if (dropped !== undefined)
+            return undefined;
+        await this.meta.ensureLoaded();
+        const cell = this.cellStateOf(sessionId);
+        if (cell.state === "none" || !ownerEq(cell.meta.owner ?? null, owner))
+            return undefined;
+        const verdict = await judgeSessionWrite({ op: "erase", rootSessionId: sessionId, token }, { claim: () => this.runs.getActiveTaskId(sessionId), cell: async () => ({ role: "absent" }), deleting: async () => this.deletingTokenOf(sessionId) });
+        if (verdict !== "proceed")
+            throw verdict.refuse;
+        const occupant = { owner: cell.meta.owner ?? null, incarnation: cell.meta.incarnation };
+        await legs(occupant);
+        await this.dropRowHeld(sessionId);
+        return occupant;
+    }
+    deletingTokenOf(sessionId) {
+        const cell = this.cellStateOf(sessionId);
+        return cell.state === "none" ? null : (cell.meta.deleting ?? null);
+    }
+    sessionDeletion = {
+        fence: (sessionId, owner, opts) => this.withSessionWriteLock(sessionId, (dropped) => this.fenceDeletionHeld(sessionId, owner, opts, dropped)),
+        holds: async (sessionId, token) => {
+            await this.meta.ensureLoaded();
+            return this.deletingTokenOf(sessionId) === token;
+        },
+        pending: async () => {
+            await this.meta.ensureLoaded();
+            return this.deletingIds().map((sessionId) => ({ sessionId, owner: this.deletionOwnerOf(sessionId), token: this.deletingTokenOf(sessionId) }));
+        },
+    };
+    deletionOwnerOf(sessionId) {
+        const cell = this.cellStateOf(sessionId);
+        return cell.state === "none" ? null : (cell.meta.owner ?? null);
+    }
+    async fenceDeletionHeld(sessionId, owner, opts, dropped) {
+        if (dropped !== undefined)
+            return undefined;
+        await this.meta.ensureLoaded();
+        const state = this.cellStateOf(sessionId);
+        let current;
+        if (state.state === "deleting")
+            current = state.meta;
+        else {
+            if (opts.expect !== undefined)
+                return undefined;
+            const seen = await this.observeRow(sessionId);
+            if (seen.row === "absent")
+                return undefined;
+            current = seen.row === "live" ? seen.meta : undefined;
+        }
+        if (!ownerEq(current?.owner ?? null, owner))
+            return undefined;
+        if (state.state === "deleting") {
+            const held = state.meta.deleting;
+            if (opts.expect !== undefined && held !== opts.expect)
+                return undefined;
+            if (opts.holder(held) === "running")
+                return { inProgress: true };
+        }
+        else {
+            const verdict = await judgeSessionWrite({ op: "delete", rootSessionId: sessionId }, { claim: () => this.runs.getActiveTaskId(sessionId), cell: async () => ({ role: "absent" }), deleting: async () => this.deletingTokenOf(sessionId) });
+            if (verdict !== "proceed")
+                throw verdict.refuse;
+        }
+        const token = uuidv7();
+        let incarnation;
+        const committed = await this.meta.commit((draft) => {
+            const before = draft.get(sessionId);
+            const base = before === undefined ? { incarnation: mintSessionIncarnation() } : cellObjectOf(before);
+            incarnation = before === undefined ? undefined : base.incarnation;
+            draft.set(sessionId, { ...base, deleting: token });
+            return true;
+        }, "required");
+        if (!committed)
+            throw new SessionError("storage", `LocalSessionStore: the deletion fence of session ${sessionId} could not be made durable — nothing of the session was removed; retry the delete`);
+        return { token, incarnation };
+    }
+    async bumpClientWritesHeld(sessionId) {
+        await this.meta.ensureLoaded();
+        if (this.cellStateOf(sessionId).state === "deleting")
+            throw new SessionDeletingError(sessionId);
+        if (this.liveCellOf(sessionId) === undefined)
+            return;
+        const committed = await this.meta.commit((draft) => {
+            const before = draft.get(sessionId);
+            if (before === undefined)
+                return false;
+            const cell = readSessionMetaCell(before);
+            if (cell.dropping)
+                throw new Error(`LocalSessionStore: session ${sessionId}'s cell carries the drop mark while a client write reached it — every section finishes a pending drop first; refusing to write`);
+            draft.set(sessionId, { ...cellObjectOf(before), clientWrites: (cell.clientWrites ?? 0) + 1 });
+            return true;
+        }, "required");
+        if (!committed)
+            throw new SessionError("storage", `LocalSessionStore: the client-write count of session ${sessionId} could not be made durable — the write was not made; retry it`);
+    }
+    async withClientWrite(sessionId, write) {
+        return this.withSessionWriteLock(sessionId, async () => {
+            let open = true;
+            try {
+                return await write(async () => {
+                    if (!open)
+                        throw new Error(`LocalSessionStore.withClientWrite: session ${sessionId}'s client-write count was taken after its lock section ended`);
+                    await this.bumpClientWritesHeld(sessionId);
+                });
+            }
+            finally {
+                open = false;
+            }
+        });
+    }
+    async withdrawBirth(birth, ownTaskId) {
+        const runs = this.runs;
+        return this.withSessionWriteLock(birth.sessionId, async (dropped) => {
+            const sessionId = birth.sessionId;
+            const kept = (word) => ({ withdrawn: false, kept: word });
+            if (dropped !== undefined)
+                return kept("absent");
+            await this.meta.ensureLoaded();
+            if (this.cellStateOf(sessionId).state === "deleting")
+                return kept("claim");
+            const seen = await this.observeRow(sessionId);
+            if (seen.row === "absent")
+                return kept("absent");
+            if (seen.row !== "live")
+                return kept("incarnation");
+            const cell = seen.meta;
+            if (cell.incarnation !== birth.incarnation || cell.owner === undefined || cell.owner !== birth.owner)
+                return kept("incarnation");
+            if (cell.clientWrites === undefined)
+                return kept("upgrade_pending");
+            if (await this.archiveHasContentHeld(sessionId))
+                return kept("content");
+            const verdict = await judgeSessionWrite({ op: "delete", rootSessionId: sessionId }, { claim: () => this.runs.getActiveTaskId(sessionId), cell: async () => placementCellOf(cell, false), deleting: async () => this.deletingTokenOf(sessionId) });
+            if (verdict !== "proceed")
+                return kept("claim");
+            if (cell.clientWrites > 0)
+                return kept("client_writes");
+            if (typeof runs.withdrawRunsOf !== "function") {
+                throw new Error(`LocalSessionStore.withdrawBirth: the run store wired into this session store cannot answer the withdraw's run half (withdrawRunsOf) — cannot tell whether session ${sessionId} has other runs; refusing to guess`);
+            }
+            const runsVerdict = runs.withdrawRunsOf.call(this.runs, sessionId, ownTaskId);
+            if (runsVerdict !== "proceed")
+                return kept(runsVerdict.keep);
+            this.withdrawCheckpointCtx?.(sessionId);
+            await this.dropRowHeld(sessionId);
+            return { withdrawn: true };
+        });
+    }
+    async archiveHasContentHeld(sessionId) {
+        if (!this.repo.exportEntries)
+            return true;
+        let entries;
         try {
-            await this.repo.delete({ id: sessionId, createdAt: "" });
+            entries = await this.repo.exportEntries(sessionId);
         }
         catch (e) {
-            if (!isNotFound(e))
-                throw e;
+            if (isNotFound(e))
+                return false;
+            throw e;
         }
-        await this.dropRowHeld(sessionId);
-        return true;
+        return entries.some((e) => !entryTypeWithdrawable(e.type));
     }
     async dropRowHeld(sessionId) {
-        this.rowsDropped.add(sessionId);
+        await this.meta.ensureLoaded();
+        let marked;
+        const s0 = await this.meta.commit((draft) => {
+            const before = draft.get(sessionId);
+            if (before !== undefined && readSessionMetaCell(before).dropping) {
+                marked = cellObjectOf(before);
+                return false;
+            }
+            marked = { ...(before === undefined ? { incarnation: mintSessionIncarnation() } : cellObjectOf(before)), dropping: true };
+            draft.set(sessionId, marked);
+            return true;
+        }, "required");
+        if (!s0)
+            throw new SessionError("storage", `LocalSessionStore: the drop mark of session ${sessionId} could not be made durable — nothing of the session was removed; retry the delete`);
         for (const [map, which] of [[this.titles, "title"], [this.pinned, "pinned"], [this.instructionSources, "instruction-source"], [this.workspaces, "workspace"]]) {
             await map.ensureLoaded();
-            if (!(await map.deleteKey(sessionId)))
-                throw new SessionError("storage", `LocalSessionStore: ${which} sidecar write failed while deleting session ${sessionId} — its ${which} is still on disk; retry the delete`);
+            if (!(await map.deleteKey(sessionId, "required")))
+                throw new SessionError("storage", `LocalSessionStore: ${which} sidecar write failed while deleting session ${sessionId} — the session already reads as deleted; retry the delete (or restart) to finish it`);
         }
         await this.ensureLoaded();
         this.lastActivity.delete(sessionId);
         this.scheduleFlush();
-        await this.dropMeta(sessionId);
+        try {
+            await this.repo.delete({ id: sessionId, createdAt: "" });
+        }
+        catch (e) {
+            if (!isNotFound(e))
+                throw e;
+        }
+        this.syncArchiveDirectory();
+        if (!(await this.meta.deleteKey(sessionId, "required")))
+            throw new SessionError("storage", `LocalSessionStore: session-meta sidecar write failed while deleting session ${sessionId} — the session already reads as deleted; retry the delete (or restart) to finish it`);
+        return readSessionMetaCell(marked);
     }
     syncArchiveDirectory() {
-        if (this.dataRoot === undefined)
+        if (this.dataRoot === undefined || !(this.repo instanceof FileSessionRepo) || IS_WIN32)
             return;
-        fsyncPaths(join(this.dataRoot, "sessions"));
+        fsyncPaths(join(this.dataRoot, ARCHIVE_DIR));
+    }
+    async finishPendingDropHeld(sessionId) {
+        await this.meta.ensureLoaded();
+        if (this.cellStateOf(sessionId).state !== "dropping")
+            return undefined;
+        return this.dropRowHeld(sessionId);
+    }
+    async finishPendingDrops() {
+        await this.meta.ensureLoaded();
+        for (const sessionId of this.droppingIds()) {
+            try {
+                await this.withSessionWriteLock(sessionId, async () => undefined);
+            }
+            catch (e) {
+                this.log.warn("session_drop_unfinished", {
+                    sessionId,
+                    error: e instanceof Error ? e.message : String(e),
+                    effect: "the session reads as deleted everywhere; its remaining bytes are removed the next time anything touches this session id, or at the next start",
+                });
+            }
+        }
+    }
+    async clearShellSentinelOwnersM48() {
+        await this.meta.ensureLoaded();
+        let cleared = 0;
+        const committed = await this.meta.commit((draft) => {
+            cleared = 0;
+            for (const sessionId of [...draft.keys()]) {
+                const cell = draft.get(sessionId);
+                if (cell === undefined || typeof cell === "string" || cell.owner !== SHELL_SENTINEL_OWNER_M48 || readSessionMetaCell(cell).dropping)
+                    continue;
+                draft.set(sessionId, { ...cell, owner: null });
+                cleared += 1;
+            }
+            return cleared > 0;
+        }, "best-effort");
+        if (!committed)
+            throw new SessionError("storage", "LocalSessionStore: the one-time migration M48 could not write the session-meta cells it cleared of the shell sentinel owner durably — nothing was changed");
+        return cleared;
+    }
+    async adoptArchiveTokensM47() {
+        const root = this.dataRoot;
+        if (root === undefined)
+            return { adopted: 0, minted: 0 };
+        const owed = archiveTokenAdoptionPendingPresent(root);
+        const rows = await this.rowHeaders();
+        let adopted = 0;
+        let minted = 0;
+        const committed = await this.meta.commit((draft) => {
+            adopted = 0;
+            minted = 0;
+            for (const row of rows) {
+                if (!("header" in row) || draft.get(row.sessionId) !== undefined)
+                    continue;
+                const first = firstCellIncarnationOf(row.sessionId, row.header.incarnation);
+                const facts = archivedRowFactsOf(row.header);
+                draft.set(row.sessionId, { incarnation: first.incarnation, createdAt: facts.createdAt, ...(facts.forkedFrom !== undefined ? { forkedFrom: facts.forkedFrom } : {}) });
+                if (first.adopted)
+                    adopted += 1;
+                else
+                    minted += 1;
+            }
+            return adopted + minted > 0;
+        }, owed ? "required" : "best-effort");
+        if (!committed)
+            throw new SessionError("storage", "LocalSessionStore: the one-time migration M47 could not write the session-meta cells it adopted into the sidecar durably — the adoption stays owed");
+        if (owed) {
+            await this.assertArchiveTokensAdoptedM47(root);
+            dischargeArchiveTokenAdoptionPending(root);
+        }
+        return { adopted, minted };
+    }
+    async assertArchiveTokensAdoptedM47(root) {
+        let left = 0;
+        for (const sessionId of archiveIdsWithoutCellSync(root))
+            if ((await this.adoptionScopeOf(sessionId)) === "in")
+                left += 1;
+        if (left > 0) {
+            throw new SessionError("storage", `LocalSessionStore: the one-time migration M47 did not adopt ${left} session archive(s) without a session-meta cell whose header it can read (the session listing it read did not list them) — refusing to start. ` +
+                `${ARCHIVE_TOKEN_ADOPTION_PENDING_FILE} stays in the data root; the next start of a release carrying this migration tries again.`);
+        }
+    }
+    async adoptionScopeOf(sessionId) {
+        let placed;
+        try {
+            placed = await this.recordedPlacementOf(sessionId);
+        }
+        catch (fault) {
+            return this.skippedFromAdoption(sessionId, fault);
+        }
+        if (placed !== undefined)
+            return "out";
+        try {
+            return (await this.archiveHeadOf(sessionId)) === undefined ? "out" : "in";
+        }
+        catch (fault) {
+            if (fault instanceof SessionError && archiveFaultWord(fault.code) === "corrupt_session")
+                return this.skippedFromAdoption(sessionId, fault);
+            return "in";
+        }
+    }
+    skippedFromAdoption(sessionId, fault) {
+        this.log.warn("archive_token_adoption_skipped", {
+            sessionId,
+            error: fault instanceof Error ? fault.message : String(fault),
+            effect: "this session archive's header cannot be read, so the one-time migration M47 cannot keep its occupant token; if it becomes readable only after the migration's window, its first read mints a new token and memory records kept under the old one stop applying",
+        });
+        return "out";
     }
     archiveSnapshotDir() {
         return this.dataRoot === undefined ? undefined : join(this.dataRoot, LOCAL_ARCHIVE_SNAPSHOT_DIR);
@@ -1538,10 +2190,10 @@ export class LocalSessionStore {
                 catch (e) {
                     throw refuse("restoring the archive from the snapshot failed", e);
                 }
-                await this.fillRowFacts(id, record.rowFacts);
+                await this.fillRowFacts(id, record.rowFacts, record.archiveIncarnation);
             }
             else if (head.owner === null) {
-                await this.fillRowFacts(id, record.rowFacts);
+                await this.fillRowFacts(id, record.rowFacts, record.archiveIncarnation);
             }
             else if (head.incarnation !== (record.archiveIncarnation ?? undefined)) {
                 throw refuse("the session's archive is a different generation from the one the snapshot was taken of");
@@ -1550,8 +2202,8 @@ export class LocalSessionStore {
             fsyncPaths(dir);
         });
     }
-    async fillRowFacts(sessionId, facts) {
-        await this.writeMeta(sessionId, (before) => rowFactsFilled(before, facts));
+    async fillRowFacts(sessionId, facts, archiveToken) {
+        await this.writeMeta(sessionId, (before) => rowFactsFilled(sessionId, before, facts, archiveToken));
     }
     async migrateLocalArchives() {
         const dir = this.archiveSnapshotDir();
@@ -1576,20 +2228,20 @@ export class LocalSessionStore {
         const committed = await this.meta.commit((draft) => {
             rowFactsBackfilled = 0;
             for (const row of listed) {
-                const next = rowFactsFilled(draft.get(row.id), archivedRowFactsOf(row));
+                const next = rowFactsFilled(row.id, draft.get(row.id), archivedRowFactsOf(row), row.incarnation);
                 if (next === undefined)
                     continue;
                 draft.set(row.id, next);
                 rowFactsBackfilled += 1;
             }
             return rowFactsBackfilled > 0;
-        });
+        }, "best-effort");
         if (!committed)
             throw new SessionError("storage", "LocalSessionStore: the one-time migration M33 could not write the row facts it backfilled into the session-meta sidecar — no archive was touched");
         this.meta.syncToDisk();
         let anonymized = 0;
         if (listed.some((row) => (row.owner ?? null) !== null)) {
-            mkdirSync(dir, { recursive: true, mode: 0o700 });
+            ensureDir(dir);
             fsyncPaths(dir, dirname(dir));
         }
         const keptStamped = [];
@@ -1641,7 +2293,7 @@ export class LocalSessionStore {
         }
         if (!sameLog(validated, row.entries))
             return { outcome: "kept", reason: "normalizes" };
-        const cell = this.metaCellOf(sessionId);
+        const cell = this.liveCellOf(sessionId);
         if (cell?.createdAt === undefined)
             throw new Error(`LocalSessionStore: the one-time migration M33 reached session ${sessionId}'s archive before its row facts were backfilled — refusing to rewrite it`);
         const record = {