cc-viewer 1.7.2 → 1.7.3

package/server/lib/v2/live-feed.js

@@ -22,13 +22,15 @@
 // through log-watcher's processWatchedEntry pipeline — the same enrichment,
 // reconstruction and side-events the v1 tail produced.
 
-import { watch, existsSync, readdirSync, statSync, openSync, readSync, closeSync } from 'node:fs';
+import { watch, existsSync, readdirSync, readFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
 import { reportSwallowed } from '../error-report.js';
 import { createIncrementalReconstructor } from '../delta-reconstructor.js';
 import { processWatchedEntry, sendEventToClients, sendEventRawToClients } from '../log-watcher.js';
 import { SessionSynthesizer } from './adapter.js';
 import { isDiscardableSession } from './session-select.js';
+import { isForeignLiveOwned } from './session-owner.js';
+import { isConvertRunning } from './convert-manager.js';
 import { computeCacheLoss } from './meta-rows.js';
 import { classifyRequest } from '../../../src/utils/requestType.js';
 
@@ -38,6 +40,12 @@ const DEFER_MS = 3000;          // synthesizer park deadline (lagging lines)
 const ATTACH_RECENT_MS = 5 * 60 * 1000; // pre-existing dirs considered "live"
 const TICK_RETRY_MS = 250;      // in-process tick raced the first queue drain
 const TICK_RETRY_MAX = 8;
+// Idle cursor eviction: a followed dir whose journal hasn't moved for this
+// long is detached, freeing its synthesizer/reconstructor state (a migration
+// can promote hundreds of dirs at once — holding all of them pins ~the whole
+// project in heap). Re-attach self-heals via the safety poll's mtime-bump
+// scan or the leader's tick() (both suppress history on a seen dir).
+const IDLE_EVICT_MS = 10 * 60 * 1000;
 
 const READ_CHUNK_BYTES = 8 * 1024 * 1024;
 // Node's max string length (~512MiB) — a longer line can never be decoded.
@@ -149,7 +157,11 @@ export class V2LiveFeed {
    * @param {number} [opts.safetyPollMs] - 0 disables the timer (tests drive
    *   _safetyTick manually)
    * @param {number} [opts.deferMs]
+   * @param {number} [opts.idleEvictMs] - 0 disables idle cursor eviction (tests)
    * @param {Function} [opts.now]
+   * @param {Function} [opts.isConvertRunningFn] - injection seam (tests)
+   * @param {Function} [opts.isForeignLiveOwnedFn] - injection seam (tests):
+   *   (dir) => boolean, defaults to session-owner's isForeignLiveOwned
    */
   constructor(opts = {}) {
     this._clients = opts.clients || [];
@@ -159,7 +171,14 @@ export class V2LiveFeed {
     this._watchImpl = opts.watchImpl || watch;
     this._safetyPollMs = typeof opts.safetyPollMs === 'number' ? opts.safetyPollMs : SAFETY_POLL_MS;
     this._deferMs = typeof opts.deferMs === 'number' ? opts.deferMs : DEFER_MS;
+    this._idleEvictMs = typeof opts.idleEvictMs === 'number' ? opts.idleEvictMs : IDLE_EVICT_MS;
     this._now = opts.now || Date.now;
+    this._isConvertRunning = opts.isConvertRunningFn || isConvertRunning;
+    // Claim owners are compared against THIS process's pid: the feed must
+    // co-reside with its V2Writer in one process (worker_threads would still
+    // share the pid; moving the feed into a forked CHILD process would make
+    // every own dir look foreign and break single-window live-follow).
+    this._isForeignLiveOwned = opts.isForeignLiveOwnedFn || isForeignLiveOwned;
     // Wire v3 (V3.S2): when on, every emitted item ALSO broadcasts a metadata
     // row (v2_requests_delta). Explicit ctor param — this module has no access
     // to the server deps object.
@@ -207,7 +226,12 @@ export class V2LiveFeed {
     if (!this._active || !sessionDir) return;
     let cur = this._sessions.get(sessionDir);
     if (!cur) {
-      cur = this._attach(sessionDir, { suppressExisting: false });
+      // A dir we have ALREADY seen re-attaching through tick() is an idle
+      // eviction (or a watcher loss) resuming — its backlog is history and
+      // must be seeded suppressed, or the re-attach replays the whole session
+      // through the broadcast path (the exact OOM this module was fixed for).
+      // Only a genuinely never-seen dir emits from byte 0.
+      cur = this._attach(sessionDir, { suppressExisting: this._seenDirs.has(sessionDir) });
       if (!cur) {
         if (_retries < TICK_RETRY_MAX) {
           setTimeout(() => this.tick(sessionDir, _retries + 1), TICK_RETRY_MS);
@@ -315,6 +339,16 @@ export class V2LiveFeed {
   _attach(dir, { suppressExisting }) {
     if (this._sessions.has(dir)) return this._sessions.get(dir);
     if (!existsSync(join(dir, 'journal.jsonl'))) return null;
+    // Multi-window isolation: a dir exclusively claimed by ANOTHER live ccv
+    // window (owner.lock, pid-liveness validity) never enters this feed — its
+    // traffic belongs to that window. Checked BEFORE the discard gate so a
+    // foreign dir never lands in _discardGated (whose delete side-effect would
+    // flip suppressExisting to false on a later attach and flood clients with
+    // the whole foreign history). Re-evaluated on every attach attempt — no
+    // persistent gate set — so a dead owner's claim stops mattering the
+    // moment its pid dies. Own dirs (tick path) and unclaimed teammate/IM
+    // dirs pass through untouched.
+    if (this._isForeignLiveOwned(dir)) return null;
     // Discardable sessions (quota-probe orphans — no main/teammate req, no
     // meta.leader) are never followed: single choke point, every attach path
     // (_initialScan / _maybeAttachNew / tick / _safetyTick / _rebuildCursor)
@@ -332,6 +366,32 @@ export class V2LiveFeed {
     // not swallow it: cross-process producers (IM worker, second ccv) have no
     // cold-load fallback for a connected client.
     if (this._discardGated.delete(dir)) suppressExisting = false;
+    // Migration output is dead history: converted sessions (meta origin:
+    // 'convert') have no producer and never append again, yet a promote
+    // renames dozens of them into sessions/ at once with fresh birthtimes —
+    // full-history seeding synthesized + JSON-round-tripped every entry of
+    // every promoted session inside the safety-poll/debounce timers (the
+    // 4GB main-thread OOM). Seek their cursors to EOF instead: nothing is
+    // read, cloned, or broadcast; the cold-load channel owns their history.
+    let convertOrigin = false;
+    try {
+      const meta = JSON.parse(readFileSync(join(dir, 'meta.json'), 'utf-8'));
+      convertOrigin = !!meta && meta.origin === 'convert';
+    } catch (err) {
+      // meta.json is written synchronously BEFORE the journal's first async
+      // drain (ensureSessionDirSync), so journal-present + meta-ABSENT is
+      // abnormal. Never fall through to a broadcast replay: mid-conversion
+      // (same-process check — the converter worker runs inside the server
+      // process) the dir is almost certainly a promote in flight — treat as
+      // convert output; a truly missing meta otherwise seeds suppressed (cold
+      // load covers the history). Any OTHER errno is a transient lock on an
+      // EXISTING meta (Windows AV/EBUSY) — keep the caller's suppress verdict:
+      // flipping a fresh live session to suppressed would silently drop its
+      // first turn (review finding).
+      reportSwallowed('v2-live.meta-read', err);
+      if (this._isConvertRunning()) convertOrigin = true;
+      else if (err && err.code === 'ENOENT') suppressExisting = true;
+    }
     const cur = {
       dir,
       synth: new SessionSynthesizer(dir, { deferMs: this._deferMs, now: this._now }),
@@ -348,24 +408,92 @@ export class V2LiveFeed {
       reading: false,
       dirty: false,
       suppress: !!suppressExisting,
+      convertOrigin,
+      // Journal req seqs with no done yet. The journal is only touched at
+      // request start and completion, so a single >10min request would look
+      // "idle" to the mtime-based eviction and get detached mid-flight — its
+      // completion would then re-attach suppressed and never resolve the
+      // already-broadcast placeholder (review finding). Eviction skips
+      // cursors with an open request. A crash orphan (req, no done ever)
+      // pins its one session un-evicted — acceptable: eviction is a memory
+      // optimization, a stuck live card is a correctness bug.
+      openReqs: new Set(),
     };
     this._sessions.set(dir, cur);
     this._seenDirs.set(dir, this._journalMtime(dir));
-    try {
-      cur.watcher = this._watchImpl(dir, () => this._scheduleRead(cur));
-      cur.watcher.on('error', (err) => {
+    if (!convertOrigin) {
+      try {
+        cur.watcher = this._watchImpl(dir, () => this._scheduleRead(cur));
+        cur.watcher.on('error', (err) => {
+          reportSwallowed('v2-live.session-watch', err);
+          try { cur.watcher.close(); } catch { /* already closed */ }
+          cur.watcher = null; // safety poll keeps the cursor alive
+        });
+      } catch (err) {
         reportSwallowed('v2-live.session-watch', err);
-        try { cur.watcher.close(); } catch { /* already closed */ }
-        cur.watcher = null; // safety poll keeps the cursor alive
-      });
-    } catch (err) {
-      reportSwallowed('v2-live.session-watch', err);
+      }
+      this._readCursor(cur); // seed (suppressed history or brand-new content)
+    } else {
+      // No per-dir watcher either: a promote can bring hundreds of dead dirs
+      // at once and each fs.watch costs an fd. The safety poll's unconditional
+      // _readCursor still picks up any (theoretical) append past the seeked
+      // offsets until idle eviction reclaims the cursor.
+      this._seekCursorsToEof(cur);
     }
-    this._readCursor(cur); // seed (suppressed history or brand-new content)
     cur.suppress = false;
     return cur;
   }
 
+  /** Position every cursor of a session at the current end of its file —
+   *  attach without reading: nothing existing is synthesized or emitted, only
+   *  bytes appended AFTER this point would flow. Enumerates ALL conv epoch
+   *  files up front so pre-existing epochs can't be replayed from 0 later. */
+  _seekCursorsToEof(cur) {
+    const sizeOf = (p) => {
+      try { return statSync(p).size; } catch (err) {
+        if (err && err.code === 'ENOENT') return 0; // missing file: offset 0 IS its EOF
+        // Any other stat failure must never seed offset 0 — that re-arms the
+        // full replay this seek exists to prevent. Park the cursor past any
+        // real size; a later successful read sees size < offset and rebuilds.
+        reportSwallowed('v2-live.seek-stat', err);
+        return Number.MAX_SAFE_INTEGER;
+      }
+    };
+    cur.journal.offset = sizeOf(cur.journal.path);
+    cur.responses.offset = sizeOf(cur.responses.path);
+    for (const { key, path } of this._enumerateConvFiles(cur.dir)) {
+      cur.convFiles.set(path, { key, path, offset: sizeOf(path) });
+    }
+  }
+
+  /** Enumerate a session's conversation epoch files as [{key, path}], epochs
+   *  numerically ordered within each conv key — the single home of the
+   *  two-level conversations/<key>/e<N>.jsonl walk (shared by the EOF-seek
+   *  attach and the incremental reader; review dedup). NB: file order is NOT
+   *  guaranteed to be globally seq-ordered (a pre-fix writer restart appended
+   *  newer seqs into an older epoch file) — the synthesizer's ingestConvLine
+   *  keeps its event window seq-sorted on insert, so consumers only need a
+   *  stable feed order. */
+  _enumerateConvFiles(dir) {
+    const convRoot = join(dir, 'conversations');
+    const out = [];
+    let keys = [];
+    try {
+      keys = readdirSync(convRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    } catch {
+      return out; // no conversations dir yet
+    }
+    for (const key of keys) {
+      let files = [];
+      try {
+        files = readdirSync(join(convRoot, key)).filter((f) => /^e\d+\.jsonl$/.test(f));
+      } catch { continue; }
+      files.sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0]));
+      for (const f of files) out.push({ key, path: join(convRoot, key, f) });
+    }
+    return out;
+  }
+
   _closeCursor(cur) {
     if (cur.debounce) { clearTimeout(cur.debounce); cur.debounce = null; }
     if (cur.watcher) { try { cur.watcher.close(); } catch { /* already closed */ } cur.watcher = null; }
@@ -405,7 +533,11 @@ export class V2LiveFeed {
           try { line = JSON.parse(raw); } catch (err) {
             reportSwallowed('v2-live.journal-parse', new Error(`${cur.dir}: ${err.message}`));
           }
-          if (line) cur.synth.ingestJournalLine(line);
+          if (line) {
+            if (line.ph === 'req') cur.openReqs.add(line.seq);
+            else if (line.ph === 'done') cur.openReqs.delete(line.seq);
+            cur.synth.ingestJournalLine(line);
+          }
         }
         this._emitDrained(cur);
       } while (cur.dirty);
@@ -415,44 +547,22 @@ export class V2LiveFeed {
   }
 
   _feedConvFiles(cur) {
-    const convRoot = join(cur.dir, 'conversations');
-    if (!existsSync(convRoot)) return;
-    let keys = [];
-    try {
-      keys = readdirSync(convRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
-    } catch {
-      return;
-    }
-    for (const key of keys) {
-      let files = [];
-      try {
-        files = readdirSync(join(convRoot, key)).filter((f) => /^e\d+\.jsonl$/.test(f));
-      } catch {
-        continue;
+    for (const { key, path } of this._enumerateConvFiles(cur.dir)) {
+      let fc = cur.convFiles.get(path);
+      if (!fc) {
+        fc = { key, path, offset: 0 };
+        cur.convFiles.set(path, fc);
       }
-      // Numeric epoch order. NB: file order is NOT guaranteed to be globally
-      // seq-ordered (a pre-fix writer restart appended newer seqs into an
-      // older epoch file) — the synthesizer's ingestConvLine keeps its event
-      // window seq-sorted on insert, so feed order only needs to be stable.
-      files.sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0]));
-      for (const f of files) {
-        const p = join(convRoot, key, f);
-        let fc = cur.convFiles.get(p);
-        if (!fc) {
-          fc = { key, path: p, offset: 0 };
-          cur.convFiles.set(p, fc);
+      const lines = readNewLines(fc);
+      if (lines === null) { this._rebuildCursor(cur); return; }
+      for (const raw of lines) {
+        let ev = null;
+        try { ev = JSON.parse(raw); } catch (err) {
+          reportSwallowed('v2-live.conv-parse', new Error(`${cur.dir}/${key}: ${err.message}`));
         }
-        const lines = readNewLines(fc);
-        if (lines === null) { this._rebuildCursor(cur); return; }
-        for (const raw of lines) {
-          let ev = null;
-          try { ev = JSON.parse(raw); } catch (err) {
-            reportSwallowed('v2-live.conv-parse', new Error(`${cur.dir}/${key}: ${err.message}`));
-          }
-          if (ev) {
-            cur.synth.ingestConvLine(key, ev);
-            if (this._wireV3 && !cur.suppress) this._forwardNative(cur, 'conv', key, raw);
-          }
+        if (ev) {
+          cur.synth.ingestConvLine(key, ev);
+          if (this._wireV3 && !cur.suppress) this._forwardNative(cur, 'conv', key, raw);
         }
       }
     }
@@ -622,7 +732,38 @@ export class V2LiveFeed {
     if (!this._active) return;
     this._armRootWatcher(); // re-arm after errors / late directory creation
     // Attached sessions: unconditional slow re-read (fs.watch is lossy).
+    // Idle eviction first: a cursor whose journal has not moved for
+    // _idleEvictMs is detached, releasing its synthesizer/reconstructor/
+    // _v3PrevMain retained state (post-migration this is ~the whole project).
+    // _seenDirs keeps the mtime, so the existing mtime-bump scan below (or the
+    // leader's tick(), now suppress-on-seen) re-attaches on real new activity.
     for (const cur of [...this._sessions.values()]) {
+      // Multi-window isolation: an ATTACHED dir can turn foreign-owned after
+      // the fact — an unowned (dead-owner) dir followed since startup gets
+      // adopted by another window's `ccv -c`. The attach-time gate can't see
+      // that, so re-check here and detach before the unconditional re-read
+      // would stream the adopter's traffic into this window (bounded to one
+      // safety-poll period). _seenDirs keeps the current mtime so a later
+      // ownership release (owner exits) plus new activity re-attaches through
+      // the normal mtime-bump path below.
+      if (this._isForeignLiveOwned(cur.dir)) {
+        this._closeCursor(cur);
+        this._sessions.delete(cur.dir);
+        this._seenDirs.set(cur.dir, this._journalMtime(cur.dir));
+        continue;
+      }
+      // openReqs guard: never evict mid-flight — a long request keeps the
+      // journal mtime frozen between its req and done lines, and evicting
+      // then would strand its already-broadcast placeholder (see openReqs).
+      if (this._idleEvictMs > 0 && cur.openReqs.size === 0) {
+        const mtime = this._journalMtime(cur.dir);
+        if (mtime > 0 && this._now() - mtime > this._idleEvictMs) {
+          this._closeCursor(cur);
+          this._sessions.delete(cur.dir);
+          this._seenDirs.set(cur.dir, mtime);
+          continue;
+        }
+      }
       this._readCursor(cur);
     }
     // Unattached dirs: attach brand-new ones (missed root events) and

package/server/lib/v2/session-owner.js

@@ -0,0 +1,135 @@
+// Per-session-dir live-owner claim (multi-window log isolation, 2026-07-17).
+//
+// Problem: every ccv window (one process = V2Writer + viewer server) writes
+// into the SHARED `LOG_DIR/<project>/sessions/` root. The "newest session"
+// selectors (cold-load fallback, `-c` folder adoption) and the live feed's
+// whole-root follow have no notion of "which process owns which dir", so
+// parallel windows on one project cross-read (and, via adoption, cross-WRITE)
+// each other's sessions.
+//
+// Mechanism: the writing process claims its session dir with an `owner.lock`
+// sidecar `{pid, startedAt}`. The file is only a POINTER — the claim's
+// validity is "the owning process is alive" (`process.kill(pid, 0)`, a
+// kernel-memory fact), so a crashed owner's claim expires the instant the
+// process dies and a dir can never be locked forever. Same liveness model as
+// im-lock.js / log-management.js. The sidecar never touches journal /
+// conversations / blobs — it is not part of the wire format.
+//
+// Error-direction asymmetry (deliberate — each path errs toward its safe side):
+// - acquire: an unreadable/half-written lock is treated as HELD (refuse) —
+//   worst case the caller mints a fresh dir, which is Claude Code's own
+//   `-c` fork semantics anyway; never two writers on one journal.
+// - isForeignLiveOwned: an unreadable lock is treated as UNOWNED (readable) —
+//   a torn crash residue must never permanently gate a dir out of the live
+//   feed / cold-load fallback.
+
+import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { isPidAlive } from '../pid-alive.js';
+import { reportSwallowed } from '../error-report.js';
+
+export const OWNER_LOCK_NAME = 'owner.lock';
+
+// Contention retries for the wx create-exclusive acquire (im-lock precedent).
+const MAX_CLAIM_ATTEMPTS = 3;
+
+export function ownerLockPath(dir) { return join(dir, OWNER_LOCK_NAME); }
+
+/** Read the claim; missing / half-written / non-object → null (tolerated,
+ *  never grounds for deletion here — acquire has its own recycle rules). */
+export function readSessionClaim(dir) {
+  try {
+    const o = JSON.parse(readFileSync(ownerLockPath(dir), 'utf-8'));
+    return (o && typeof o === 'object') ? o : null;
+  } catch { return null; }
+}
+
+/**
+ * Atomically claim `dir` for `pid` (default: this process). Modeled on
+ * im-lock.js acquireImLock: `wx` create-exclusive IS the arbiter, so two
+ * processes racing to adopt the same dead-owned dir get exactly one winner.
+ * Two DELIBERATE divergences from that model (don't "fix" them back):
+ * own-pid holder → idempotent {ok:true} without rewriting (acquire runs twice
+ * per dir: adoption, then _session), where im-lock recycles its own residue;
+ * and content is written in the same call as creation ('wx' flag) — no
+ * empty-file window between sentinel and payload, so no temp+rename step.
+ * `startedAt` is diagnostic only — validity is pid-liveness alone (the
+ * accepted im-lock-style pid-reuse tradeoff; a socket-bind probe would close
+ * it and is backlog).
+ *
+ * @param {string} dir - absolute session dir
+ * @param {{pid?: number, pidAlive?: (pid:number)=>boolean}} [opts] test seams
+ * @returns {{ok:true}|{ok:false, holder?:object|null}} ok:false = cannot
+ *   claim, for any of: a live foreign holder, an unreadable/half-written lock
+ *   (conservatively treated as held), an unexpected write I/O failure
+ *   (reported via reportSwallowed), or contention exhausting the retries.
+ *   `holder` is set only when a live foreign pid was identified. Either way
+ *   the caller must NOT write into this dir (adoption: mint a fresh one).
+ */
+export function acquireSessionClaim(dir, opts = {}) {
+  const pid = opts.pid ?? process.pid;
+  const pidAlive = opts.pidAlive || isPidAlive;
+  const p = ownerLockPath(dir);
+  for (let attempt = 0; attempt < MAX_CLAIM_ATTEMPTS; attempt++) {
+    try {
+      writeFileSync(p, JSON.stringify({ pid, startedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 });
+      return { ok: true };
+    } catch (e) {
+      if (!e || e.code !== 'EEXIST') {
+        // Unexpected I/O failure (EACCES, EROFS, fd exhaustion…): a silently
+        // missing claim means the isolation quietly stops working — report.
+        reportSwallowed('v2-owner.claim', e);
+        return { ok: false, holder: null };
+      }
+      const holder = readSessionClaim(dir);
+      if (holder && holder.pid === pid) return { ok: true }; // idempotent re-entry
+      if (holder && pidAlive(holder.pid)) return { ok: false, holder };
+      if (!holder) {
+        // Unreadable: either a concurrent recycler unlinked it between our
+        // EEXIST and the read (→ retry the atomic create) or it is genuinely
+        // half-written (→ conservatively held; the writer is mid-claim).
+        if (!existsSync(p)) continue;
+        return { ok: false, holder: null };
+      }
+      // Dead holder → recycle the stale lock and retry the atomic create.
+      try { unlinkSync(p); } catch { /* concurrent recycler won the unlink — retry */ }
+    }
+  }
+  // Contention exhausted the retries: report the current holder if live.
+  const holder = readSessionClaim(dir);
+  if (holder && holder.pid !== pid && pidAlive(holder.pid)) return { ok: false, holder };
+  return { ok: false, holder: holder || null };
+}
+
+/**
+ * Release the claim on `dir` — identity-checked: only unlinks when the lock
+ * is held by `pid` (default: this process), so a successor process's claim is
+ * never deleted by a late-exiting predecessor. Missing file = already
+ * released. Synchronous on purpose: it runs at the top of V2Writer.close()
+ * ahead of the (bounded, raceable) async queue drain.
+ * @returns {boolean} true when the dir is no longer claimed by `pid`
+ */
+export function releaseSessionClaim(dir, opts = {}) {
+  const pid = opts.pid ?? process.pid;
+  const holder = readSessionClaim(dir);
+  if (holder && holder.pid !== pid) return false; // taken over — don't touch
+  try { unlinkSync(ownerLockPath(dir)); } catch { /* ENOENT = already released */ }
+  return true;
+}
+
+/**
+ * Is `dir` exclusively owned by ANOTHER live process? The single skip
+ * predicate used by latestMainSession (cold-load fallback + `-c` adoption
+ * candidates) and the live feed's attach/re-check gates. History readers
+ * never call this — a dead owner's claim makes the dir plain unowned data.
+ * @param {string} dir - absolute session dir
+ * @param {{pid?: number, pidAlive?: (pid:number)=>boolean}} [opts] test seams
+ * @returns {boolean}
+ */
+export function isForeignLiveOwned(dir, opts = {}) {
+  const pid = opts.pid ?? process.pid;
+  const pidAlive = opts.pidAlive || isPidAlive;
+  const holder = readSessionClaim(dir); // unreadable → null → unowned (self-healing)
+  if (!holder || !Number.isInteger(holder.pid)) return false;
+  return holder.pid !== pid && pidAlive(holder.pid);
+}

package/server/lib/v2/session-select.js

@@ -24,6 +24,7 @@ import { join } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 import { listSessionIds } from './replay.js';
 import { isSupportedWireFormat } from './layout.js';
+import { isForeignLiveOwned } from './session-owner.js';
 
 /**
  * Find the on-disk dir NAME of an existing session for `sessionId` (a UUID), or
@@ -247,17 +248,29 @@ export function isDiscardableSession(dir, meta) {
  * has-a-main-req gate would otherwise re-select exactly the dir the caller's
  * completed-turn gate just rejected (it IS the newest once its first main req
  * is written), nullifying the fallback.
+ *
+ * `skipForeignLive` (multi-window isolation, 2026-07-17) drops candidates
+ * whose `owner.lock` is held by ANOTHER live process — a parallel ccv window's
+ * in-flight session. Without it, the cold-load fallback serves the other
+ * window's conversation and `-c` adoption writes into its journal. A dead
+ * owner's claim expires with its pid (kernel liveness), so crashed windows'
+ * sessions stay selectable — never a permanent lock. Both consumers
+ * (getLiveLogSource fallback, _resolveAdoption) pass true; default false keeps
+ * the raw picker semantics for everything else.
  * @param {string} projectDir - absolute LOG_DIR/<project>
- * @param {{excludeDir?: string}} [opts]
+ * @param {{excludeDir?: string, skipForeignLive?: boolean}} [opts]
  * @returns {{dir:string, sessionId:string}|null}
  */
-export function latestMainSession(projectDir, { excludeDir = '' } = {}) {
+export function latestMainSession(projectDir, { excludeDir = '', skipForeignLive = false } = {}) {
   if (!projectDir) return null;
   const candidates = []; // { dir, sessionId, startTs }
   for (const name of listSessionIds(projectDir)) {
     const dir = join(projectDir, 'sessions', name);
     if (excludeDir && dir === excludeDir) continue;
     if (!existsSync(join(dir, 'journal.jsonl'))) continue;
+    // After the cheaper journal-existence reject: skips one owner.lock read
+    // per torn/non-session dir on large-history cold loads.
+    if (skipForeignLive && isForeignLiveOwned(dir)) continue;
     let meta = null;
     try { meta = JSON.parse(readFileSync(join(dir, 'meta.json'), 'utf-8')); } catch { continue; }
     if (!meta) continue;