chainlesschain 0.162.197 → 0.162.200

package/src/harness/jsonl-session-store.js

@@ -2,7 +2,7 @@
  * JSONL Session Store — append-only session persistence.
  */
 
-import {
+import fs, {
   constants as fsConstants,
   existsSync,
   appendFileSync,
@@ -16,6 +16,7 @@ import {
   fstatSync,
   lstatSync,
   readSync,
+  writeSync,
   ftruncateSync,
 } from "node:fs";
 import { join, basename, resolve } from "node:path";
@@ -23,9 +24,16 @@ import { createHash, randomUUID } from "node:crypto";
 import { TextDecoder } from "node:util";
 import { getHomeDir } from "../lib/paths.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../lib/secure-fs.js";
+import {
+  isAffectedWindowsZeroDeviceStatRuntime,
+  samePathHandleStableFileIdentity,
+  withTrustedFileParentSync,
+} from "../lib/secure-file-identity.js";
 import {
   computeEventHash,
+  latestChainHash,
   TRANSCRIPT_CHAIN_STATUS,
+  verifyTranscriptText,
 } from "./transcript-integrity.js";
 import { withFileLock } from "../lib/with-file-lock.js";
 import {
@@ -48,11 +56,24 @@ import {
   publicSessionMeta,
   readLatestSessionActivity,
   readSessionMeta,
+  readSessionTombstoneMarker,
   recordSessionDeleted,
   recordSessionEvent,
   recordSessionActivity,
   replaceSessionMeta,
+  normalizeSessionGenerationAuthority,
+  SESSION_GENERATION_AUTHORITY_FIELD,
+  SESSION_GENERATION_AUTHORITY_SCHEMA,
+  SESSION_TOMBSTONE_MARKER_SUFFIX,
 } from "./session-list-index.js";
+import { createSessionPersistenceFailure } from "../lib/session-persistence-failure.js";
+import { withSessionHostWriteAuthority } from "../lib/session-host-lease.js";
+import {
+  listSessionAntiRollbackIds,
+  publishSessionAntiRollbackAnchor,
+  readSessionAntiRollbackAnchor,
+  sessionAntiRollbackPredecessorWitness,
+} from "../lib/session-anti-rollback-anchor.js";
 
 let securedSessionsDir = null;
 let securedSessionsDirIdentity = null;
@@ -61,6 +82,7 @@ let securedSessionsDirIdentity = null;
 // gate. The hooks are inert unless the dedicated child process opts in; this
 // keeps production behavior and ordinary tests on the exact same append path.
 export const _sessionScaleFaultHooks = Object.seal({
+  beforeTranscriptAppend: null,
   afterTranscriptAppend: null,
   afterForkCopy: null,
   afterForkLineage: null,
@@ -78,6 +100,11 @@ const WS_TURN_INPUT_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
 const WS_TURN_CLAIM_ID_PATTERN = /^claim-[0-9a-f-]{36}$/;
 const WS_TURN_FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 
+export {
+  SESSION_GENERATION_AUTHORITY_FIELD,
+  SESSION_GENERATION_AUTHORITY_SCHEMA,
+};
+
 function wsTurnError(message, code) {
   const error = new Error(message);
   error.code = code;
@@ -510,6 +537,100 @@ export function sessionPath(sessionId) {
   return join(getSessionsDir(), `${sessionId}.jsonl`);
 }
 
+function physicalTranscriptStateFromStats(stats) {
+  const exact = (value) =>
+    typeof value === "bigint" ? String(value) : undefined;
+  const legacyNumber = (value) => Number(value);
+  const timeMs = (name) => {
+    const nanoseconds = stats[`${name}Ns`];
+    return typeof nanoseconds === "bigint"
+      ? Number(nanoseconds / 1_000_000n) +
+          Number(nanoseconds % 1_000_000n) / 1_000_000
+      : Number(stats[`${name}Ms`]);
+  };
+  return Object.freeze({
+    // Keep the rounded legacy fields so metadata produced by older releases
+    // remains readable. BigIntStats supplies the exact witness used by new
+    // writers; this avoids Node 22.12 Windows fstat/lstat precision drift.
+    dev: String(legacyNumber(stats.dev)),
+    ino: String(legacyNumber(stats.ino)),
+    size: legacyNumber(stats.size),
+    mtimeMs: timeMs("mtime"),
+    ctimeMs: timeMs("ctime"),
+    devExact: exact(stats.dev),
+    inoExact: exact(stats.ino),
+    sizeExact: exact(stats.size),
+    mtimeNs: exact(stats.mtimeNs),
+    ctimeNs: exact(stats.ctimeNs),
+  });
+}
+
+function readPhysicalTranscriptStats(filePath) {
+  const stats = lstatSync(filePath, { bigint: true });
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    const error = new Error("Session transcript path is not a regular file");
+    error.code = "SESSION_TRANSCRIPT_IDENTITY_CHANGED";
+    error.commitState = "not-committed";
+    throw error;
+  }
+  return stats;
+}
+
+function readPhysicalTranscriptState(filePath) {
+  return physicalTranscriptStateFromStats(
+    readPhysicalTranscriptStats(filePath),
+  );
+}
+
+function samePhysicalTranscriptState(left, right, { content = true } = {}) {
+  if (!left || !right) return left === right;
+  const sameField = (exactField, legacyField, { numeric = false } = {}) => {
+    if (left[exactField] != null && right[exactField] != null) {
+      return String(left[exactField]) === String(right[exactField]);
+    }
+    return numeric
+      ? Number(left[legacyField]) === Number(right[legacyField])
+      : String(left[legacyField]) === String(right[legacyField]);
+  };
+  return (
+    sameField("devExact", "dev") &&
+    sameField("inoExact", "ino") &&
+    (!content ||
+      (sameField("sizeExact", "size", { numeric: true }) &&
+        sameField("mtimeNs", "mtimeMs", { numeric: true }) &&
+        sameField("ctimeNs", "ctimeMs", { numeric: true })))
+  );
+}
+
+function samePhysicalTranscriptContentState(left, right) {
+  if (!left || !right) return left === right;
+  const sameField = (exactField, legacyField) => {
+    if (left[exactField] != null && right[exactField] != null) {
+      return String(left[exactField]) === String(right[exactField]);
+    }
+    return Number(left[legacyField]) === Number(right[legacyField]);
+  };
+  return (
+    sameField("sizeExact", "size") &&
+    sameField("mtimeNs", "mtimeMs") &&
+    sameField("ctimeNs", "ctimeMs")
+  );
+}
+
+function withTranscriptFileParent(filePath, task) {
+  if (!isAffectedWindowsZeroDeviceStatRuntime()) {
+    return task({ canonicalPath: filePath, parentDevice: null });
+  }
+  return withTrustedFileParentSync(fs, filePath, task);
+}
+
+function transcriptIdentityError(commitState, reason) {
+  const error = new Error(`Session transcript identity changed: ${reason}`);
+  error.code = "SESSION_TRANSCRIPT_IDENTITY_CHANGED";
+  error.commitState = commitState;
+  return error;
+}
+
 export function appendTokenUsage(sessionId, usage) {
   appendEvent(sessionId, "token_usage", usage || {});
 }
@@ -660,19 +781,26 @@ function appendVerifiedWsAuthorityEventLocked(
   const core = { type, timestamp: Date.now(), data };
   const hash = computeEventHash(previousHeadHash, core);
   const event = { ...core, prevHash: previousHeadHash, hash };
-  appendFileSync(filePath, `${JSON.stringify(event)}\n`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
   ensurePrivateFile(filePath);
-  runSessionScaleFaultHook("afterTranscriptAppend", {
+  const expectedState = readPhysicalTranscriptState(filePath);
+  const transcriptState = appendTranscriptEvent(
     sessionId,
     type,
     event,
     filePath,
-  });
+    expectedState,
+  );
   try {
-    recordSessionEvent(getSessionsDir(), sessionId, event, hash);
+    const nextMeta = recordSessionEvent(
+      getSessionsDir(),
+      sessionId,
+      event,
+      hash,
+      {
+        transcriptState,
+      },
+    );
+    publishSessionAntiRollbackWitness(sessionId, nextMeta, filePath, "live");
   } catch (cause) {
     const error = new Error(
       `Session authority anchor could not be persisted: ${sessionId}`,
@@ -710,9 +838,17 @@ function appendVerifiedWsAuthorityEventLocked(
   return Object.freeze({ hash, event });
 }
 
+function withSessionHostWriterLock(sessionId, filePath, task, options) {
+  return withFileLock(
+    filePath,
+    () => withSessionHostWriteAuthority(sessionId, task),
+    options,
+  );
+}
+
 function withVerifiedWsTurnLock(sessionId, task) {
   const filePath = sessionPath(sessionId);
-  return withFileLock(filePath, () => task(filePath), {
+  return withSessionHostWriterLock(sessionId, filePath, () => task(filePath), {
     failIfUnavailable: true,
     timeoutMs: 30_000,
     retryMs: 1,
@@ -739,6 +875,153 @@ function encodeEventMessageProvenance(type, data) {
   return data;
 }
 
+function appendTranscriptEvent(
+  sessionId,
+  type,
+  event,
+  filePath,
+  expectedState,
+) {
+  const payload = { sessionId, type, event, filePath };
+  try {
+    runSessionScaleFaultHook("beforeTranscriptAppend", payload);
+  } catch (cause) {
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation: "transcript-append",
+      commitState: "not-committed",
+    });
+  }
+  try {
+    return withTranscriptFileParent(
+      filePath,
+      ({ canonicalPath, parentDevice }) =>
+        appendTranscriptEventAtPath({
+          sessionId,
+          event,
+          payload,
+          filePath: canonicalPath,
+          expectedState,
+          parentDevice,
+        }),
+    );
+  } catch (cause) {
+    if (
+      cause?.code === "SESSION_TRANSCRIPT_IDENTITY_CHANGED" ||
+      cause?.operation === "transcript-append" ||
+      cause?.operation === "transcript-settlement"
+    ) {
+      throw cause;
+    }
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation: "transcript-settlement",
+      commitState: "unknown",
+    });
+  }
+}
+
+function appendTranscriptEventAtPath({
+  sessionId,
+  event,
+  payload,
+  filePath,
+  expectedState,
+  parentDevice,
+}) {
+  let fd = null;
+  let wroteBytes = false;
+  let appendCompleted = false;
+  try {
+    let flags = fsConstants.O_WRONLY | fsConstants.O_APPEND;
+    if (expectedState === null) {
+      flags |= fsConstants.O_CREAT | fsConstants.O_EXCL;
+    }
+    if (typeof fsConstants.O_NOFOLLOW === "number") {
+      flags |= fsConstants.O_NOFOLLOW;
+    }
+    fd = openSync(filePath, flags, 0o600);
+    const openedStats = fstatSync(fd, { bigint: true });
+    const openedState = physicalTranscriptStateFromStats(openedStats);
+    if (expectedState !== null) {
+      if (parentDevice === null) {
+        if (!samePhysicalTranscriptState(expectedState, openedState)) {
+          throw transcriptIdentityError(
+            "not-committed",
+            "the append descriptor does not match the verified path",
+          );
+        }
+      } else {
+        const publishedBeforeStats = readPhysicalTranscriptStats(filePath);
+        const publishedBeforeState =
+          physicalTranscriptStateFromStats(publishedBeforeStats);
+        if (
+          !samePhysicalTranscriptState(expectedState, publishedBeforeState) ||
+          !samePathHandleStableFileIdentity(
+            publishedBeforeStats,
+            openedStats,
+            parentDevice,
+          )
+        ) {
+          throw transcriptIdentityError(
+            "not-committed",
+            "the append descriptor does not match the verified path",
+          );
+        }
+      }
+    }
+    const bytes = Buffer.from(`${JSON.stringify(event)}\n`, "utf8");
+    let offset = 0;
+    while (offset < bytes.length) {
+      const written = writeSync(fd, bytes, offset, bytes.length - offset);
+      if (!Number.isSafeInteger(written) || written <= 0) {
+        throw new Error("Session transcript append made no forward progress");
+      }
+      offset += written;
+      wroteBytes = true;
+    }
+    appendCompleted = true;
+    runSessionScaleFaultHook("afterTranscriptAppend", payload);
+    const descriptorStats = fstatSync(fd, { bigint: true });
+    const descriptorState = physicalTranscriptStateFromStats(descriptorStats);
+    const pathStats = readPhysicalTranscriptStats(filePath);
+    const pathState = physicalTranscriptStateFromStats(pathStats);
+    const publishedIdentityMatches =
+      parentDevice === null
+        ? samePhysicalTranscriptState(descriptorState, pathState, {
+            content: false,
+          })
+        : samePathHandleStableFileIdentity(
+            pathStats,
+            descriptorStats,
+            parentDevice,
+          );
+    if (!publishedIdentityMatches) {
+      throw transcriptIdentityError(
+        "unknown",
+        "the published path no longer names the appended descriptor",
+      );
+    }
+    return pathState;
+  } catch (cause) {
+    if (cause?.code === "SESSION_TRANSCRIPT_IDENTITY_CHANGED") throw cause;
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation: appendCompleted
+        ? "transcript-settlement"
+        : "transcript-append",
+      // ENOSPC can follow a short write. EROFS fails before the append can
+      // mutate the target.
+      commitState:
+        !appendCompleted && (cause?.code === "EROFS" || !wroteBytes)
+          ? "not-committed"
+          : "unknown",
+    });
+  } finally {
+    if (fd !== null) closeSync(fd);
+  }
+}
+
 const SESSION_AUTHORITY_RECOVERY_TEXT_LIMITS = Object.freeze({
   safetyId: 512,
   safetyIdentity: 512,
@@ -773,6 +1056,174 @@ function sanitizeSessionAuthorityRecoveryEvidence(value) {
   return Object.keys(evidence).length > 0 ? Object.freeze(evidence) : null;
 }
 
+function sessionDeletedError(sessionId) {
+  const error = new Error(`Session was deleted: ${sessionId}`);
+  error.code = "SESSION_DELETED";
+  return error;
+}
+
+function createSessionGenerationAuthority(
+  sessionId,
+  predecessorWitness = null,
+  generationId = `generation-${randomUUID()}`,
+) {
+  const previous = normalizeSessionGenerationAuthority(
+    predecessorWitness?.generation,
+  );
+  const isReplacement = predecessorWitness !== null;
+  return Object.freeze({
+    schema: SESSION_GENERATION_AUTHORITY_SCHEMA,
+    sessionId,
+    generationId,
+    ordinal:
+      previous?.sessionId === sessionId
+        ? previous.ordinal + 1
+        : isReplacement
+          ? 2
+          : 1,
+    predecessor: isReplacement
+      ? Object.freeze({
+          kind:
+            previous?.sessionId === sessionId
+              ? "tombstone"
+              : "legacy-tombstone",
+          generationId:
+            previous?.sessionId === sessionId ? previous.generationId : null,
+          headHash:
+            typeof predecessorWitness?.last_hash === "string" &&
+            /^[0-9a-f]{64}$/.test(predecessorWitness.last_hash)
+              ? predecessorWitness.last_hash
+              : null,
+          eventCount: Math.max(0, Number(predecessorWitness?.event_count) || 0),
+          tombstonedAtMs: Number.isSafeInteger(
+            Number(predecessorWitness?.deleted_at_ms),
+          )
+            ? Math.max(0, Number(predecessorWitness.deleted_at_ms))
+            : null,
+        })
+      : null,
+  });
+}
+
+function encodeSessionGenerationData(data, authority = null) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    return authority
+      ? { [SESSION_GENERATION_AUTHORITY_FIELD]: authority }
+      : data;
+  }
+  const clean = { ...data };
+  // The namespace generation is store-owned authority. Callers may not forge
+  // it on arbitrary events or choose a replacement predecessor.
+  delete clean[SESSION_GENERATION_AUTHORITY_FIELD];
+  if (authority) clean[SESSION_GENERATION_AUTHORITY_FIELD] = authority;
+  return clean;
+}
+
+function sessionAntiRollbackCandidateFromWitness(witness, status = "live") {
+  if (!witness || typeof witness !== "object") return null;
+  const eventCount = Math.max(0, Number(witness.event_count) || 0);
+  const headHash =
+    typeof witness.last_hash === "string" &&
+    /^[0-9a-f]{64}$/.test(witness.last_hash)
+      ? witness.last_hash
+      : null;
+  const generation = normalizeSessionGenerationAuthority(witness.generation);
+  const legacyDeletion =
+    status === "deleted" && generation === null && headHash === null;
+  if (!legacyDeletion && (eventCount === 0) !== (headHash === null))
+    return null;
+  return Object.freeze({
+    status,
+    generation,
+    headHash,
+    eventCount,
+    deletedAtMs:
+      status === "deleted"
+        ? Math.max(
+            0,
+            Number(witness.deleted_at_ms || witness.updated_at_ms) || 0,
+          )
+        : null,
+  });
+}
+
+function antiRollbackAnchorMatchesCandidate(anchor, candidate) {
+  return (
+    anchor !== null &&
+    candidate !== null &&
+    anchor.status === candidate.status &&
+    JSON.stringify(anchor.generation) ===
+      JSON.stringify(candidate.generation) &&
+    anchor.headHash === candidate.headHash &&
+    anchor.eventCount === candidate.eventCount &&
+    anchor.deletedAtMs === candidate.deletedAtMs
+  );
+}
+
+function transcriptHashAtEventCount(filePath, eventCount) {
+  if (eventCount === 0) return null;
+  let count = 0;
+  for (const { line } of iterateFileLinesSync(filePath)) {
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (typeof event?.hash !== "string") continue;
+    count += 1;
+    if (count === eventCount) return event.hash;
+  }
+  return null;
+}
+
+function publishSessionAntiRollbackWitness(
+  sessionId,
+  witness,
+  filePath,
+  status = "live",
+) {
+  const candidate = sessionAntiRollbackCandidateFromWitness(witness, status);
+  if (candidate === null) {
+    const error = new Error(
+      `Session anti-rollback candidate is incomplete: ${sessionId}`,
+    );
+    error.code = "CC_SESSION_ANTI_ROLLBACK_UNAVAILABLE";
+    throw error;
+  }
+  return publishSessionAntiRollbackAnchor(sessionId, candidate, {
+    provePrefix: (current) =>
+      current.status === "live" &&
+      existsSync(filePath) &&
+      transcriptHashAtEventCount(filePath, current.eventCount) ===
+        current.headHash,
+  });
+}
+
+function assertSessionAntiRollbackBeforeWrite(
+  sessionId,
+  witness,
+  filePath,
+  status = "live",
+) {
+  const current = readSessionAntiRollbackAnchor(sessionId);
+  if (current === null && witness === null) return null;
+  const candidate = sessionAntiRollbackCandidateFromWitness(witness, status);
+  if (candidate === null) return current;
+  if (antiRollbackAnchorMatchesCandidate(current, candidate)) return current;
+
+  if (status === "live" && existsSync(filePath)) {
+    const verification = verifyTranscriptFile(filePath);
+    assertLocalVerifiedTranscriptAnchor(sessionId, verification);
+  }
+  return publishSessionAntiRollbackWitness(
+    sessionId,
+    witness,
+    filePath,
+    status,
+  );
+}
+
 function appendEventLocked(
   sessionId,
   type,
@@ -780,20 +1231,117 @@ function appendEventLocked(
   { expectedHeadHash, compareHead = false, requireIndexAnchor = false } = {},
 ) {
   const filePath = sessionPath(sessionId);
-  return withFileLock(
+  return withSessionHostWriterLock(
+    sessionId,
     filePath,
     () => {
-      const existingMeta = readSessionMeta(getSessionsDir(), sessionId);
+      let existingMeta = readSessionMeta(getSessionsDir(), sessionId);
+      const marker = readSessionTombstoneMarker(getSessionsDir(), sessionId);
+      const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
+      const presence = getSessionPresence(sessionId);
+      const transcriptExists = existsSync(filePath);
+      const startsNewGeneration =
+        presence === SESSION_PRESENCE.TOMBSTONED && type === "session_start";
+      if (presence === SESSION_PRESENCE.CONFLICT) {
+        if (marker !== null || existingMeta?.deleted === true) {
+          throw sessionDeletedError(sessionId);
+        }
+        throw unverifiedTranscriptError(
+          sessionId,
+          transcriptAnchorMismatchVerification(),
+        );
+      }
       if (
-        !existsSync(filePath) &&
-        existingMeta?.deleted === true &&
+        presence === SESSION_PRESENCE.TOMBSTONED &&
         type !== "session_start"
       ) {
-        const error = new Error(`Session was deleted: ${sessionId}`);
-        error.code = "SESSION_DELETED";
-        throw error;
+        throw sessionDeletedError(sessionId);
       }
+      if (
+        presence === SESSION_PRESENCE.MISSING_TRANSCRIPT ||
+        (!transcriptExists &&
+          existingMeta !== null &&
+          existingMeta?.deleted !== true)
+      ) {
+        throw unverifiedTranscriptError(
+          sessionId,
+          missingTranscriptVerification(),
+        );
+      }
+      const duplicateLiveStart =
+        presence === SESSION_PRESENCE.PRESENT && type === "session_start";
       const { prevHash, recovery } = _resolveChainTail(filePath);
+      let expectedTranscriptState = transcriptExists
+        ? readPhysicalTranscriptState(filePath)
+        : null;
+      if (
+        transcriptExists &&
+        existingMeta?.transcript &&
+        (!samePhysicalTranscriptState(
+          existingMeta.transcript,
+          expectedTranscriptState,
+          { content: recovery === null },
+        ) ||
+          Number(existingMeta.transcript.size) !==
+            Number(expectedTranscriptState.size))
+      ) {
+        throw transcriptIdentityError(
+          "not-committed",
+          "the transcript no longer matches its persisted physical witness",
+        );
+      }
+      if (transcriptExists) {
+        ensurePrivateFile(filePath);
+        expectedTranscriptState = readPhysicalTranscriptState(filePath);
+      }
+      if (
+        transcriptExists &&
+        existingMeta !== null &&
+        existingMeta?.deleted !== true &&
+        (existingMeta.last_hash ?? null) !== prevHash
+      ) {
+        throw unverifiedTranscriptError(
+          sessionId,
+          transcriptAnchorMismatchVerification(prevHash),
+        );
+      }
+      if (transcriptExists && existingMeta === null) {
+        const verification = verifyTranscriptFile(filePath);
+        if (
+          verification.status === TRANSCRIPT_CHAIN_STATUS.TAMPERED ||
+          verification.malformedLines > 0 ||
+          verification.truncatedTail
+        ) {
+          throw unverifiedTranscriptError(sessionId, verification);
+        }
+        // A sidecar is rebuildable, but appending before rebuilding it would
+        // publish a count of one for a multi-event transcript. Restore the
+        // projection under the same writer lock before advancing the chain.
+        rebuildSessionMetaUnlocked(getSessionsDir(), sessionId, filePath);
+        existingMeta = readSessionMeta(getSessionsDir(), sessionId);
+      }
+      if (transcriptExists) {
+        assertSessionAntiRollbackBeforeWrite(
+          sessionId,
+          existingMeta,
+          filePath,
+          "live",
+        );
+      } else if (presence === SESSION_PRESENCE.TOMBSTONED) {
+        assertSessionAntiRollbackBeforeWrite(
+          sessionId,
+          existingMeta ||
+            marker ||
+            sessionAntiRollbackPredecessorWitness(externalAnchor),
+          filePath,
+          "deleted",
+        );
+      }
+      if (duplicateLiveStart) {
+        const error = new Error(`Session already exists: ${sessionId}`);
+        error.code = "SESSION_ALREADY_EXISTS";
+        throw error;
+      }
       if (compareHead && prevHash !== (expectedHeadHash || null)) {
         const error = new Error(
           `Session revision changed for ${sessionId}; refresh the checkpoint timeline`,
@@ -803,33 +1351,60 @@ function appendEventLocked(
         error.actualHeadHash = prevHash;
         throw error;
       }
-      const persistedData = encodeEventMessageProvenance(type, data);
+      const generationAuthority =
+        type === "session_start" &&
+        [SESSION_PRESENCE.ABSENT, SESSION_PRESENCE.TOMBSTONED].includes(
+          presence,
+        )
+          ? createSessionGenerationAuthority(
+              sessionId,
+              startsNewGeneration
+                ? existingMeta ||
+                    marker ||
+                    sessionAntiRollbackPredecessorWitness(externalAnchor)
+                : null,
+            )
+          : null;
+      const persistedData = encodeSessionGenerationData(
+        encodeEventMessageProvenance(type, data),
+        generationAuthority,
+      );
       const core = { type, timestamp: Date.now(), data: persistedData };
       const hash = computeEventHash(prevHash, core);
       const event = { ...core, prevHash, hash };
-      const line = JSON.stringify(event) + "\n";
-      appendFileSync(filePath, line, { encoding: "utf8", mode: 0o600 });
-      ensurePrivateFile(filePath);
-      runSessionScaleFaultHook("afterTranscriptAppend", {
+      const transcriptState = appendTranscriptEvent(
         sessionId,
         type,
         event,
         filePath,
-      });
+        expectedTranscriptState,
+      );
       try {
-        recordSessionEvent(getSessionsDir(), sessionId, event, hash);
+        const nextMeta = recordSessionEvent(
+          getSessionsDir(),
+          sessionId,
+          event,
+          hash,
+          {
+            resetGeneration: startsNewGeneration,
+            transcriptState,
+          },
+        );
+        publishSessionAntiRollbackWitness(
+          sessionId,
+          nextMeta,
+          filePath,
+          "live",
+        );
       } catch (cause) {
-        if (requireIndexAnchor) {
-          const error = new Error(
-            `Session authority anchor could not be persisted: ${sessionId}`,
-            { cause },
-          );
-          error.code = "SESSION_INDEX_ANCHOR_FAILED";
-          error.sessionId = sessionId;
-          throw error;
-        }
-        // The metadata index is explicitly rebuildable. Never turn a committed
-        // transcript event into an apparent failure that a caller may retry.
+        const error = new Error(
+          `Session authority anchor could not be persisted: ${sessionId}`,
+          { cause },
+        );
+        error.code = "SESSION_INDEX_ANCHOR_FAILED";
+        error.sessionId = sessionId;
+        error.commitState = "unknown";
+        throw error;
       }
       if (requireIndexAnchor) {
         const verification = verifyTranscriptFile(filePath);
@@ -848,10 +1423,11 @@ function appendEventLocked(
           error.code = "SESSION_INDEX_ANCHOR_FAILED";
           error.sessionId = sessionId;
           error.verification = verification;
+          error.commitState = "unknown";
           throw error;
         }
       }
-      return { hash, recovery };
+      return { hash, recovery, commitState: "committed" };
     },
     {
       failIfUnavailable: true,
@@ -864,8 +1440,24 @@ function appendEventLocked(
   );
 }
 
+function runClassifiedAppend(sessionId, operation, append) {
+  try {
+    return append();
+  } catch (cause) {
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation,
+      // Preserve an inner append/settlement classification. Without one,
+      // EROFS defaults to not-committed and ENOSPC remains unknown.
+      commitState: cause?.commitState,
+    });
+  }
+}
+
 export function appendEvent(sessionId, type, data) {
-  return appendEventLocked(sessionId, type, data);
+  return runClassifiedAppend(sessionId, "append-event", () =>
+    appendEventLocked(sessionId, type, data),
+  );
 }
 
 /**
@@ -873,9 +1465,11 @@ export function appendEvent(sessionId, type, data) {
  * crash/tail-truncation anchor are durably updated and still agree.
  */
 export function appendAuthorityEvent(sessionId, type, data) {
-  return appendEventLocked(sessionId, type, data, {
-    requireIndexAnchor: true,
-  });
+  return runClassifiedAppend(sessionId, "append-authority-event", () =>
+    appendEventLocked(sessionId, type, data, {
+      requireIndexAnchor: true,
+    }),
+  );
 }
 
 /**
@@ -889,10 +1483,12 @@ export function appendEventIfHead(
   data,
   expectedHeadHash = null,
 ) {
-  return appendEventLocked(sessionId, type, data, {
-    expectedHeadHash,
-    compareHead: true,
-  });
+  return runClassifiedAppend(sessionId, "compare-and-append-event", () =>
+    appendEventLocked(sessionId, type, data, {
+      expectedHeadHash,
+      compareHead: true,
+    }),
+  );
 }
 
 /** Authority-bearing compare-and-append with a mandatory index anchor. */
@@ -902,11 +1498,123 @@ export function appendAuthorityEventIfHead(
   data,
   expectedHeadHash = null,
 ) {
-  return appendEventLocked(sessionId, type, data, {
-    expectedHeadHash,
-    compareHead: true,
-    requireIndexAnchor: true,
-  });
+  return runClassifiedAppend(
+    sessionId,
+    "compare-and-append-authority-event",
+    () =>
+      appendEventLocked(sessionId, type, data, {
+        expectedHeadHash,
+        compareHead: true,
+        requireIndexAnchor: true,
+      }),
+  );
+}
+
+/**
+ * Validate a caller-owned projection and append one authority event while the
+ * same transcript writer lock remains held. This closes the read/validate to
+ * append race for authorities (such as MCP host fencing) that are derived from
+ * the complete verified transcript rather than from the head hash alone.
+ *
+ * Both callbacks must be synchronous. The projection remains caller-owned and
+ * only its validation result controls whether the event is appended.
+ */
+export function appendAuthorityEventWithVerifiedProjection(
+  sessionId,
+  type,
+  data,
+  { createProjection, validateProjection } = {},
+) {
+  if (
+    typeof createProjection !== "function" ||
+    typeof validateProjection !== "function"
+  ) {
+    throw new TypeError(
+      "Authority projection append requires projection and validation callbacks",
+    );
+  }
+  if (
+    createProjection.constructor?.name === "AsyncFunction" ||
+    validateProjection.constructor?.name === "AsyncFunction"
+  ) {
+    throw new TypeError(
+      "Authority projection append callbacks must be synchronous",
+    );
+  }
+  const filePath = sessionPath(sessionId);
+  return withSessionHostWriterLock(
+    sessionId,
+    filePath,
+    () => {
+      const projection = createProjection();
+      if (
+        !projection ||
+        typeof projection.accept !== "function" ||
+        typeof projection.finish !== "function"
+      ) {
+        throw new TypeError(
+          "Authority projection must provide accept() and finish()",
+        );
+      }
+      if (!existsSync(filePath)) {
+        throw unverifiedTranscriptError(sessionId, {
+          status: "missing",
+          reason: "authority transcript does not exist",
+          lastHash: null,
+          chainedEvents: 0,
+        });
+      }
+      _resolveChainTail(filePath);
+      const verification = verifyTranscriptFile(filePath, {
+        onVerifiedEvent: (event) => {
+          const accepted = projection.accept(event);
+          if (accepted && typeof accepted.then === "function") {
+            throw new TypeError(
+              "Authority projection accept() must be synchronous",
+            );
+          }
+        },
+      });
+      assertVerifiedTranscriptAnchor(sessionId, verification);
+      const authority = Object.freeze({
+        headHash: verification.lastHash,
+        eventCount: verification.chainedEvents,
+        readMessages: () => rebuildVerifiedMessagesFromFile(filePath),
+      });
+      const projected = projection.finish(authority);
+      if (projected && typeof projected.then === "function") {
+        throw new TypeError(
+          "Authority projection finish() must be synchronous",
+        );
+      }
+      const validation = validateProjection(projected, authority);
+      if (validation && typeof validation.then === "function") {
+        throw new TypeError(
+          "Authority projection validation must be synchronous",
+        );
+      }
+      if (validation === false) {
+        throw new Error("Authority projection validation rejected the append");
+      }
+      const persistedData = encodeEventMessageProvenance(type, data);
+      const appended = appendVerifiedWsAuthorityEventLocked(
+        sessionId,
+        filePath,
+        type,
+        persistedData,
+        authority.headHash,
+      );
+      return Object.freeze({ hash: appended.hash });
+    },
+    {
+      failIfUnavailable: true,
+      timeoutMs: 30_000,
+      retryMs: 1,
+      maxRetryMs: 8,
+      retryJitterMs: 4,
+      yieldAfterReleaseMs: 2,
+    },
+  );
 }
 
 /**
@@ -944,16 +1652,18 @@ export function withSessionAuthorityTransaction(
   }
 
   const filePath = sessionPath(sessionId);
-  return withFileLock(
+  return withSessionHostWriterLock(
+    sessionId,
     filePath,
     () => {
       const existingMeta = readSessionMeta(getSessionsDir(), sessionId);
-      if (!existsSync(filePath) && existingMeta?.deleted === true) {
+      const persistedWitness = existingMeta;
+      if (persistedWitness?.deleted === true) {
         const error = new Error(`Session was deleted: ${sessionId}`);
         error.code = "SESSION_DELETED";
         throw error;
       }
-      if (!existsSync(filePath) && existingMeta !== null) {
+      if (!existsSync(filePath) && persistedWitness !== null) {
         throw unverifiedTranscriptError(sessionId, {
           status: "missing",
           reason: "session sidecar exists without its transcript",
@@ -1204,8 +1914,19 @@ export function verifySession(sessionId) {
   if (isUnsafeSessionId(sessionId)) {
     return { sessionId, status: "invalid-id", reason: "invalid session id" };
   }
-  const filePath = sessionPath(sessionId);
+  const filePath = sessionPath(sessionId);
+  const presence = getSessionPresence(sessionId);
+  if (presence === SESSION_PRESENCE.CONFLICT) {
+    return {
+      sessionId,
+      status: "conflict",
+      reason: "tombstoned session has a restored transcript path",
+    };
+  }
   if (!existsSync(filePath)) {
+    if (presence === SESSION_PRESENCE.MISSING_TRANSCRIPT) {
+      return { sessionId, ...missingTranscriptVerification() };
+    }
     return { sessionId, status: "not-found", reason: "session file not found" };
   }
   return {
@@ -1217,10 +1938,20 @@ export function verifySession(sessionId) {
 export function verifyAllSessions(options = {}) {
   const dir = getSessionsDir();
   if (!existsSync(dir)) return [];
-  return readdirSync(dir)
-    .filter((file) => file.endsWith(".jsonl"))
+  const sessionIds = new Set(listSessionIds());
+  for (const file of readdirSync(dir)) {
+    if (!file.endsWith(".meta.json")) continue;
+    const sessionId = file.slice(0, -".meta.json".length);
+    if (
+      !isUnsafeSessionId(sessionId) &&
+      getSessionPresence(sessionId) === SESSION_PRESENCE.MISSING_TRANSCRIPT
+    ) {
+      sessionIds.add(sessionId);
+    }
+  }
+  return [...sessionIds]
     .slice(0, options.limit || 1000)
-    .map((file) => verifySession(basename(file, ".jsonl")));
+    .map((sessionId) => verifySession(sessionId));
 }
 
 function indexedProjectionMatchesTranscript(meta, verification, validation) {
@@ -1267,6 +1998,32 @@ export function repairSession(sessionId, options = {}) {
     filePath,
     () => {
       const dir = getSessionsDir();
+      if (getSessionPresence(sessionId) === SESSION_PRESENCE.CONFLICT) {
+        return {
+          sessionId,
+          dryRun,
+          changed: false,
+          physicalChanged: false,
+          indexChanged: false,
+          wouldChange: false,
+          action: "none",
+          physicalAction: "none",
+          indexAction: "none",
+          indexRepairRequired: false,
+          indexRebuilt: false,
+          indexRepairError: null,
+          discardedBytes: 0,
+          discardedRecords: 0,
+          healthy: false,
+          transcriptHealthy: false,
+          status: "conflict",
+          before: null,
+          after: null,
+          beforeValidation: null,
+          afterValidation: null,
+          reason: "tombstoned session has a restored transcript path",
+        };
+      }
       const before = verifyTranscriptFile(filePath);
       const beforeValidation = validateJsonlSession(sessionId);
       const repair = inspectPhysicalTail(filePath, { dryRun });
@@ -1363,18 +2120,77 @@ export function listSessionIds() {
     .map((file) => basename(file, ".jsonl"));
 }
 
-/** Resolve an exact id or one unambiguous prefix without reading transcripts. */
-export function resolveSessionId(input) {
+/**
+ * Enumerate every durable id occupying the canonical JSONL namespace.
+ *
+ * A transcript is not the only authority witness: a live/missing sidecar and
+ * a tombstone marker must continue to fence legacy stores even when the JSONL
+ * path itself is absent. Keeping this enumeration content-free also lets
+ * prefix resolution detect ambiguity without opening transcript bodies.
+ */
+export function listSessionEvidenceIds() {
+  const dir = getSessionsDir();
+  const ids = new Set(listSessionAntiRollbackIds());
+  if (!existsSync(dir)) return [...ids].sort();
+  for (const file of readdirSync(dir)) {
+    let id = null;
+    if (file.endsWith(".jsonl")) {
+      id = basename(file, ".jsonl");
+    } else if (file.endsWith(".meta.json")) {
+      id = file.slice(0, -".meta.json".length);
+    } else if (file.endsWith(SESSION_TOMBSTONE_MARKER_SUFFIX)) {
+      id = file.slice(0, -SESSION_TOMBSTONE_MARKER_SUFFIX.length);
+    }
+    if (id && !isUnsafeSessionId(id)) ids.add(id);
+  }
+  return [...ids].sort();
+}
+
+/**
+ * Resolve an exact id or unambiguous prefix across the complete persisted
+ * namespace, including damaged and tombstoned generations.
+ *
+ * Returning the presence separately from the id prevents callers from using
+ * "not readable" as "not canonical" and then silently consulting a legacy
+ * store. Ambiguity is fail-closed even when only one candidate is currently
+ * readable.
+ */
+export function resolveSessionAuthority(input) {
   if (isUnsafeSessionId(input)) return null;
-  if (sessionExists(input)) return input;
-  const matches = listSessionIds().filter((id) => id.startsWith(input));
+  const exactPresence = getSessionPresence(input);
+  if (exactPresence !== SESSION_PRESENCE.ABSENT) {
+    return Object.freeze({
+      id: input,
+      match: "exact",
+      presence: exactPresence,
+      readable: exactPresence === SESSION_PRESENCE.PRESENT,
+    });
+  }
+  const matches = listSessionEvidenceIds()
+    .filter((id) => id.startsWith(input))
+    .map((id) => ({ id, presence: getSessionPresence(id) }))
+    .filter(({ presence }) => presence !== SESSION_PRESENCE.ABSENT);
   if (matches.length > 1) {
     const error = new Error(`Ambiguous session id prefix: ${input}`);
     error.code = "AMBIGUOUS_SESSION_ID";
-    error.matches = matches.slice(0, 20);
+    error.matches = matches.slice(0, 20).map(({ id }) => id);
+    error.authorities = matches.slice(0, 20).map((item) => ({ ...item }));
     throw error;
   }
-  return matches[0] || null;
+  if (matches.length === 0) return null;
+  const [{ id, presence }] = matches;
+  return Object.freeze({
+    id,
+    match: "prefix",
+    presence,
+    readable: presence === SESSION_PRESENCE.PRESENT,
+  });
+}
+
+/** Resolve an exact id or one unambiguous prefix without reading transcripts. */
+export function resolveSessionId(input) {
+  const authority = resolveSessionAuthority(input);
+  return authority?.readable ? authority.id : null;
 }
 
 export { TRANSCRIPT_CHAIN_STATUS };
@@ -1394,11 +2210,17 @@ export function startSession(sessionId, meta = {}) {
 }
 
 export function appendUserMessage(sessionId, content) {
-  appendEvent(sessionId, "user_message", { role: "user", content });
+  return appendEvent(sessionId, "user_message", {
+    role: "user",
+    content,
+  });
 }
 
 export function appendAssistantMessage(sessionId, content) {
-  appendEvent(sessionId, "assistant_message", { role: "assistant", content });
+  return appendEvent(sessionId, "assistant_message", {
+    role: "assistant",
+    content,
+  });
 }
 
 function wsTurnLifecycleResult(snapshot, overrides = {}) {
@@ -1757,6 +2579,16 @@ export function appendCompactEventIfMessagesMatch(
 
 export function readEvents(sessionId) {
   if (isUnsafeSessionId(sessionId)) return []; // traversal id → treat as empty
+  const presence = getSessionPresence(sessionId);
+  if (presence === SESSION_PRESENCE.MISSING_TRANSCRIPT) {
+    throw unverifiedTranscriptError(sessionId, missingTranscriptVerification());
+  }
+  if (presence === SESSION_PRESENCE.CONFLICT) {
+    throw unverifiedTranscriptError(
+      sessionId,
+      transcriptAnchorMismatchVerification(),
+    );
+  }
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) return [];
 
@@ -1782,22 +2614,110 @@ function unverifiedTranscriptError(sessionId, verification) {
   return error;
 }
 
-function assertVerifiedTranscriptAnchor(sessionId, verification) {
+function missingTranscriptVerification() {
+  return Object.freeze({
+    status: "missing",
+    reason: "persisted session witness exists without its transcript",
+    lastHash: null,
+    chainedEvents: 0,
+    malformedLines: 0,
+    truncatedTail: false,
+  });
+}
+
+function transcriptAnchorMismatchVerification(lastHash = null) {
+  return Object.freeze({
+    status: "anchor-mismatch",
+    reason: "persisted session witness does not match its transcript",
+    lastHash,
+    chainedEvents: 0,
+    malformedLines: 0,
+    truncatedTail: false,
+  });
+}
+
+function readSessionPersistenceWitness(sessionId) {
+  return readSessionMeta(getSessionsDir(), sessionId);
+}
+
+function hasLiveSessionWitness(sessionId) {
+  const witness = readSessionPersistenceWitness(sessionId);
+  if (witness !== null && witness?.deleted !== true) return true;
+  return readSessionAntiRollbackAnchor(sessionId)?.status === "live";
+}
+
+function assertLocalVerifiedTranscriptAnchor(
+  sessionId,
+  verification,
+  physicalState = null,
+) {
   const meta = readSessionMeta(getSessionsDir(), sessionId);
+  let physicalAnchorMatches = true;
+  let currentPhysicalState = physicalState;
+  if (meta?.transcript) {
+    try {
+      currentPhysicalState ||= readPhysicalTranscriptState(
+        sessionPath(sessionId),
+      );
+      physicalAnchorMatches = samePhysicalTranscriptState(
+        meta.transcript,
+        currentPhysicalState,
+      );
+    } catch {
+      physicalAnchorMatches = false;
+    }
+  }
   const trustedStatus =
     verification.status === TRANSCRIPT_CHAIN_STATUS.VERIFIED;
+  const headMatches = meta?.last_hash === verification.lastHash;
+  const eventCountMatches =
+    Number(meta?.event_count) === verification.chainedEvents;
   const anchoredHead =
     meta?.deleted !== true &&
-    meta?.last_hash === verification.lastHash &&
-    Number(meta?.event_count) === verification.chainedEvents;
+    headMatches &&
+    eventCountMatches &&
+    physicalAnchorMatches;
   if (
     !trustedStatus ||
     !anchoredHead ||
     verification.malformedLines > 0 ||
     verification.truncatedTail
   ) {
-    throw unverifiedTranscriptError(sessionId, verification);
+    const error = unverifiedTranscriptError(sessionId, verification);
+    error.anchor = Object.freeze({
+      metadataPresent: meta !== null,
+      metadataDeleted: meta?.deleted === true,
+      headMatches,
+      eventCountMatches,
+      physicalAnchorMatches,
+      metadataHeadHash: meta?.last_hash ?? null,
+      metadataEventCount: Number.isSafeInteger(Number(meta?.event_count))
+        ? Number(meta.event_count)
+        : null,
+      metadataTranscript: meta?.transcript ?? null,
+      currentTranscript: currentPhysicalState ?? null,
+    });
+    throw error;
   }
+  return meta;
+}
+
+function assertVerifiedTranscriptAnchor(
+  sessionId,
+  verification,
+  physicalState = null,
+) {
+  const meta = assertLocalVerifiedTranscriptAnchor(
+    sessionId,
+    verification,
+    physicalState,
+  );
+  publishSessionAntiRollbackWitness(
+    sessionId,
+    meta,
+    sessionPath(sessionId),
+    "live",
+  );
 }
 
 /**
@@ -1812,8 +2732,8 @@ function assertVerifiedTranscriptAnchor(sessionId, verification) {
  *
  * This removes the mandatory all-event array from resume projections. It does
  * not make verification IO sublinear: authenticating a plain chained JSONL
- * transcript remains O(N), and the local sidecar is not an anti-rollback
- * anchor or a cross-process lease.
+ * transcript remains O(N). The local sidecar is checked against an independent
+ * machine-local anti-rollback witness; it is not itself that witness.
  */
 export function readVerifiedProjection(
   sessionId,
@@ -1847,6 +2767,16 @@ export function readVerifiedProjection(
         );
       }
       if (!existsSync(filePath)) {
+        const presence = getSessionPresence(sessionId);
+        if (presence === SESSION_PRESENCE.TOMBSTONED) {
+          throw sessionDeletedError(sessionId);
+        }
+        if (presence === SESSION_PRESENCE.MISSING_TRANSCRIPT) {
+          throw unverifiedTranscriptError(
+            sessionId,
+            missingTranscriptVerification(),
+          );
+        }
         return projection.finish(
           Object.freeze({
             headHash: null,
@@ -1901,6 +2831,112 @@ export function readVerifiedEvents(sessionId) {
   });
 }
 
+/**
+ * Return the exact JSONL bytes only after the transcript and its persisted
+ * anchor verify under the canonical writer lock. This is the export/mirror
+ * boundary; derived consumers must never copy a merely parseable raw path.
+ */
+export function readVerifiedTranscriptBytes(sessionId) {
+  if (isUnsafeSessionId(sessionId)) {
+    throw unverifiedTranscriptError(
+      sessionId,
+      transcriptAnchorMismatchVerification(),
+    );
+  }
+  const filePath = sessionPath(sessionId);
+  return withFileLock(
+    filePath,
+    () => {
+      const presence = getSessionPresence(sessionId);
+      if (presence === SESSION_PRESENCE.MISSING_TRANSCRIPT) {
+        throw unverifiedTranscriptError(
+          sessionId,
+          missingTranscriptVerification(),
+        );
+      }
+      if (presence !== SESSION_PRESENCE.PRESENT) {
+        throw unverifiedTranscriptError(
+          sessionId,
+          transcriptAnchorMismatchVerification(),
+        );
+      }
+      return withTranscriptFileParent(
+        filePath,
+        ({ canonicalPath, parentDevice }) =>
+          readVerifiedTranscriptBytesAtPath(
+            sessionId,
+            canonicalPath,
+            parentDevice,
+          ),
+      );
+    },
+    {
+      failIfUnavailable: true,
+      timeoutMs: 30_000,
+      retryMs: 1,
+      maxRetryMs: 8,
+      retryJitterMs: 4,
+      yieldAfterReleaseMs: 2,
+    },
+  );
+}
+
+function readVerifiedTranscriptBytesAtPath(sessionId, filePath, parentDevice) {
+  let flags = fsConstants.O_RDONLY;
+  if (typeof fsConstants.O_NOFOLLOW === "number") {
+    flags |= fsConstants.O_NOFOLLOW;
+  }
+  const fd = openSync(filePath, flags);
+  try {
+    const beforeStats = fstatSync(fd, { bigint: true });
+    const before = physicalTranscriptStateFromStats(beforeStats);
+    const publishedBeforeStats = readPhysicalTranscriptStats(filePath);
+    const publishedBefore =
+      physicalTranscriptStateFromStats(publishedBeforeStats);
+    const descriptorMatchesPublished =
+      parentDevice === null
+        ? samePhysicalTranscriptState(before, publishedBefore)
+        : samePathHandleStableFileIdentity(
+            publishedBeforeStats,
+            beforeStats,
+            parentDevice,
+          ) && samePhysicalTranscriptContentState(before, publishedBefore);
+    if (!descriptorMatchesPublished) {
+      throw transcriptIdentityError(
+        "not-committed",
+        "the read descriptor does not match the canonical path",
+      );
+    }
+    const text = readFileSync(fd, "utf8");
+    const afterStats = fstatSync(fd, { bigint: true });
+    const after = physicalTranscriptStateFromStats(afterStats);
+    const publishedStats = readPhysicalTranscriptStats(filePath);
+    const published = physicalTranscriptStateFromStats(publishedStats);
+    const publishedStillMatches =
+      parentDevice === null
+        ? samePhysicalTranscriptState(after, published)
+        : samePathHandleStableFileIdentity(
+            publishedStats,
+            afterStats,
+            parentDevice,
+          ) && samePhysicalTranscriptContentState(after, published);
+    if (!samePhysicalTranscriptState(before, after) || !publishedStillMatches) {
+      throw transcriptIdentityError(
+        "unknown",
+        "the transcript changed while verified bytes were read",
+      );
+    }
+    const verification = {
+      ...verifyTranscriptText(text),
+      lastHash: latestChainHash(text),
+    };
+    assertVerifiedTranscriptAnchor(sessionId, verification, published);
+    return text;
+  } finally {
+    closeSync(fd);
+  }
+}
+
 /**
  * Read the active context only after transcript and sidecar-anchor validation.
  * Unlike the compatibility `rebuildMessages()` reader, this is allowed to
@@ -1956,30 +2992,29 @@ export function readVerifiedWsTurnState(sessionId, requestId, options = {}) {
 }
 
 /**
- * Return the newest event matching a type/predicate using bounded reverse IO.
- * This is the recovery path for snapshots and ledgers: callers never need to
- * materialize a multi-gigabyte transcript merely to inspect its latest state.
+ * Return the newest event matching a type/predicate after authenticating the
+ * complete transcript and sidecar anchor. Heap remains bounded to one event;
+ * the forward integrity pass is intentionally O(N).
  */
 export function findLatestEvent(sessionId, type, predicate = null) {
   if (isUnsafeSessionId(sessionId)) return null;
-  const filePath = sessionPath(sessionId);
-  if (!existsSync(filePath)) return null;
   const wanted = Array.isArray(type) ? new Set(type) : null;
-  for (const { line } of iterateFileLinesReverseSync(filePath)) {
-    let event;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    const typeMatches = wanted
-      ? wanted.has(event?.type)
-      : type == null || event?.type === type;
-    if (!typeMatches) continue;
-    if (typeof predicate === "function" && !predicate(event)) continue;
-    return event;
-  }
-  return null;
+  return readVerifiedProjection(sessionId, () => {
+    let latest = null;
+    return {
+      accept(event) {
+        const typeMatches = wanted
+          ? wanted.has(event?.type)
+          : type == null || event?.type === type;
+        if (!typeMatches) return;
+        if (typeof predicate === "function" && !predicate(event)) return;
+        latest = event;
+      },
+      finish() {
+        return latest;
+      },
+    };
+  });
 }
 
 /**
@@ -2052,6 +3087,16 @@ function rebuildVerifiedMessagesFromFile(filePath, options = {}) {
 
 export function rebuildMessages(sessionId, options = {}) {
   if (isUnsafeSessionId(sessionId)) return [];
+  const presence = getSessionPresence(sessionId);
+  if (presence === SESSION_PRESENCE.MISSING_TRANSCRIPT) {
+    throw unverifiedTranscriptError(sessionId, missingTranscriptVerification());
+  }
+  if (presence === SESSION_PRESENCE.CONFLICT) {
+    throw unverifiedTranscriptError(
+      sessionId,
+      transcriptAnchorMismatchVerification(),
+    );
+  }
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) return [];
   return rebuildMessagesFromFile(filePath, options);
@@ -2081,6 +3126,7 @@ function rebuildSessionMetaUnlocked(dir, sessionId, filePath) {
       // a best-effort projection over all intact events.
     }
   }
+  meta.transcript = readPhysicalTranscriptState(filePath);
   return replaceSessionMeta(dir, meta);
 }
 
@@ -2090,7 +3136,30 @@ function rebuildSessionMeta(sessionId) {
   if (!existsSync(filePath)) return null;
   return withFileLock(
     filePath,
-    () => rebuildSessionMetaUnlocked(dir, sessionId, filePath),
+    () => {
+      const verification = verifyTranscriptFile(filePath);
+      const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
+      if (
+        externalAnchor === null &&
+        [
+          TRANSCRIPT_CHAIN_STATUS.LEGACY,
+          TRANSCRIPT_CHAIN_STATUS.PARTIAL,
+        ].includes(verification.status) &&
+        !verification.truncatedTail
+      ) {
+        return rebuildSessionMetaUnlocked(dir, sessionId, filePath);
+      }
+      if (
+        verification.status !== TRANSCRIPT_CHAIN_STATUS.VERIFIED ||
+        verification.malformedLines > 0 ||
+        verification.truncatedTail
+      ) {
+        throw unverifiedTranscriptError(sessionId, verification);
+      }
+      const meta = rebuildSessionMetaUnlocked(dir, sessionId, filePath);
+      assertVerifiedTranscriptAnchor(sessionId, verification);
+      return meta;
+    },
     {
       failIfUnavailable: true,
       timeoutMs: 30_000,
@@ -2115,9 +3184,13 @@ export function listJsonlSessions(options = {}) {
 
   const limit = options.limit || 20;
   const sessionIds = listSessionIds();
+  let indexScan = null;
   let indexed = listIndexedSessions(dir, {
     limit,
     hasSession: (id) => sessionExists(id),
+    onScanComplete: (scan) => {
+      indexScan = scan;
+    },
   });
 
   // First use after upgrade (or a lost/corrupt rebuildable index): stream each
@@ -2126,8 +3199,22 @@ export function listJsonlSessions(options = {}) {
   if (indexed.length < expected) {
     const rebuilt = [];
     for (const id of sessionIds) {
-      const meta = readSessionMeta(dir, id);
-      rebuilt.push(meta || rebuildSessionMeta(id));
+      // A physical path restored behind a tombstone is a conflict, not a live
+      // list entry. Never re-emit its deleted snapshot as list activity.
+      if (!sessionExists(id)) continue;
+      const meta = readSessionMeta(dir, id) || rebuildSessionMeta(id);
+      if (!meta) continue;
+      const indexedMeta = indexScan?.latestBySessionId?.get(id) || null;
+      if (
+        indexedMeta?.deleted !== true &&
+        indexedMeta?.last_hash === meta.last_hash &&
+        Number(indexedMeta?.updated_at_ms || 0) ===
+          Number(meta.updated_at_ms || 0) &&
+        Number(indexedMeta?.event_count || 0) === Number(meta.event_count || 0)
+      ) {
+        continue;
+      }
+      rebuilt.push(meta);
     }
     // Directory enumeration order is not activity order. Re-append the rebuilt
     // snapshots oldest-first so reverse journal reads preserve the transcript
@@ -2145,6 +3232,58 @@ export function listJsonlSessions(options = {}) {
   return indexed;
 }
 
+/**
+ * List canonical namespace occupants for recent-session and picker consumers.
+ * Damaged generations are deliberately represented as blocked rows so a
+ * newer missing/conflicting canonical session cannot disappear and cause an
+ * older legacy conversation to be resumed instead. Tombstones fence duplicate
+ * legacy ids but are not resumable choices unless explicitly requested.
+ */
+export function listSessionAuthoritySummaries(options = {}) {
+  const limit = Math.max(1, Number(options.limit) || 20);
+  const evidenceIds = listSessionEvidenceIds();
+  const readable = new Map(
+    listJsonlSessions({ limit: Math.max(limit, evidenceIds.length) }).map(
+      (item) => [item.id, item],
+    ),
+  );
+  const rows = [];
+  for (const id of evidenceIds) {
+    const presence = getSessionPresence(id);
+    if (
+      presence === SESSION_PRESENCE.ABSENT ||
+      (presence === SESSION_PRESENCE.TOMBSTONED &&
+        options.includeTombstoned !== true)
+    ) {
+      continue;
+    }
+    const item = readable.get(id);
+    const meta = item ? null : readSessionMeta(getSessionsDir(), id);
+    rows.push({
+      ...(item ||
+        publicSessionMeta({
+          ...emptySessionMeta(id),
+          ...(meta || {}),
+          id,
+        })),
+      id,
+      _store: "jsonl",
+      _presence: presence,
+      _blocked: presence !== SESSION_PRESENCE.PRESENT,
+    });
+  }
+  return rows
+    .sort((a, b) => {
+      const delta =
+        (Date.parse(b.updated_at || "") || 0) -
+        (Date.parse(a.updated_at || "") || 0);
+      if (delta !== 0) return delta;
+      if (a._blocked !== b._blocked) return a._blocked ? -1 : 1;
+      return String(b.id).localeCompare(String(a.id));
+    })
+    .slice(0, limit);
+}
+
 /**
  * Rename a session (gap-analysis 2026-07-11 P1 "命名会话"): appends a
  * `session_rename` event so the hash chain stays intact (no rewrite). The
@@ -2160,25 +3299,90 @@ export function renameSession(sessionId, title) {
   return { id: sessionId, title: normalized.slice(0, 200) };
 }
 
-/** Delete the canonical transcript under its writer lock and publish a
- * rebuildable tombstone so an already-waiting stale writer cannot resurrect
- * the session after the deletion commits. */
+/** Delete the canonical transcript under its writer lock and publish durable
+ * tombstone witnesses so an already-waiting stale writer cannot resurrect the
+ * session after the deletion commits. */
 export function deleteJsonlSession(sessionId) {
   if (isUnsafeSessionId(sessionId)) return false;
   const filePath = sessionPath(sessionId);
-  if (!existsSync(filePath)) return false;
-  return withFileLock(
+  if (!existsSync(filePath) && !hasLiveSessionWitness(sessionId)) return false;
+  return withSessionHostWriterLock(
+    sessionId,
     filePath,
     () => {
-      if (!existsSync(filePath)) return false;
-      rmSync(filePath, { force: true });
+      const transcriptExists = existsSync(filePath);
+      let existingMeta = readSessionPersistenceWitness(sessionId);
+      const marker = readSessionTombstoneMarker(getSessionsDir(), sessionId);
+      const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
+      if (
+        !transcriptExists &&
+        (existingMeta === null || existingMeta?.deleted === true)
+      ) {
+        return false;
+      }
+      const deletionWitness =
+        existingMeta?.deleted === true
+          ? existingMeta
+          : sessionAntiRollbackPredecessorWitness(externalAnchor) || marker;
+      if (
+        transcriptExists &&
+        existingMeta === null &&
+        deletionWitness === null
+      ) {
+        const verification = verifyTranscriptFile(filePath);
+        if (
+          verification.status !== TRANSCRIPT_CHAIN_STATUS.VERIFIED ||
+          verification.malformedLines > 0 ||
+          verification.truncatedTail
+        ) {
+          throw unverifiedTranscriptError(sessionId, verification);
+        }
+        rebuildSessionMetaUnlocked(getSessionsDir(), sessionId, filePath);
+        existingMeta = readSessionPersistenceWitness(sessionId);
+      }
+      if (deletionWitness === null) {
+        assertSessionAntiRollbackBeforeWrite(
+          sessionId,
+          existingMeta,
+          filePath,
+          "live",
+        );
+      } else if (existingMeta?.deleted !== true) {
+        existingMeta = replaceSessionMeta(getSessionsDir(), {
+          ...emptySessionMeta(sessionId),
+          id: sessionId,
+          generation: deletionWitness.generation || null,
+          last_hash: deletionWitness.last_hash || null,
+          event_count: Math.max(0, Number(deletionWitness.event_count) || 0),
+          updated_at_ms: Math.max(
+            0,
+            Number(deletionWitness.deleted_at_ms) || Date.now(),
+          ),
+          deleted_at_ms: Math.max(
+            0,
+            Number(deletionWitness.deleted_at_ms) || Date.now(),
+          ),
+          deleted: true,
+          transcript: null,
+        });
+      }
+      if (transcriptExists) rmSync(filePath, { force: true });
       try {
-        recordSessionDeleted(getSessionsDir(), sessionId);
+        const tombstone = recordSessionDeleted(getSessionsDir(), sessionId);
+        publishSessionAntiRollbackWitness(
+          sessionId,
+          tombstone,
+          filePath,
+          "deleted",
+        );
       } catch (error) {
         // writeMetaAtomic precedes the activity-journal append. If only the
         // rebuildable journal lock/release failed, the durable sidecar still
         // prevents a stale writer from resurrecting this deleted session.
-        if (readSessionMeta(getSessionsDir(), sessionId)?.deleted !== true) {
+        if (
+          readSessionMeta(getSessionsDir(), sessionId)?.deleted !== true ||
+          readSessionAntiRollbackAnchor(sessionId)?.status !== "deleted"
+        ) {
           throw error;
         }
       }
@@ -2481,12 +3685,22 @@ export function forkSession(sourceId, options = {}) {
               sourceHeadHash: sourceVerification.lastHash,
               sourceEventCount: sourceVerification.chainedEvents,
             };
+            const forkGenerationId = `generation-${createHash("sha256")
+              .update(`fork-generation\0${newId}`, "utf8")
+              .digest("hex")
+              .slice(0, 32)}`;
             const core = {
               type: "system",
               timestamp: Date.now(),
               data: {
                 ...persistedData,
                 [SESSION_FORK_AUTHORITY_FIELD]: forkAuthority,
+                [SESSION_GENERATION_AUTHORITY_FIELD]:
+                  createSessionGenerationAuthority(
+                    newId,
+                    null,
+                    forkGenerationId,
+                  ),
               },
             };
             const hash = computeEventHash(prevHash, core);
@@ -2516,6 +3730,17 @@ export function forkSession(sourceId, options = {}) {
             sourceHeadHash: authority?.sourceHeadHash,
             sourceEventCount: authorityEventCount,
           };
+          const generationAuthority = normalizeSessionGenerationAuthority(
+            target.lineageEvent?.data?.[SESSION_GENERATION_AUTHORITY_FIELD],
+          );
+          const hasGenerationAuthority =
+            target.lineageEvent?.data?.[SESSION_GENERATION_AUTHORITY_FIELD] !==
+            undefined;
+          const generationMatches =
+            !hasGenerationAuthority ||
+            (generationAuthority?.sessionId === newId &&
+              generationAuthority.ordinal === 1 &&
+              generationAuthority.predecessor === null);
           const lineageMatches =
             target.matchingLineageEvents === 1 &&
             target.lineageEvent?.type === "system" &&
@@ -2524,10 +3749,16 @@ export function forkSession(sourceId, options = {}) {
             typeof authority?.sourceHeadHash === "string" &&
             target.lineageEventIndex === creationEventCount &&
             target.lineageEvent?.prevHash === authority.sourceHeadHash &&
+            generationMatches &&
             JSON.stringify(target.lineageEvent?.data) ===
               JSON.stringify({
                 ...persistedData,
                 [SESSION_FORK_AUTHORITY_FIELD]: expectedAuthority,
+                ...(hasGenerationAuthority
+                  ? {
+                      [SESSION_GENERATION_AUTHORITY_FIELD]: generationAuthority,
+                    }
+                  : {}),
               });
           if (
             target.verification.status !== TRANSCRIPT_CHAIN_STATUS.VERIFIED ||
@@ -2689,7 +3920,7 @@ export function createBranchSession({
     provider: typeof cleanMeta.provider === "string" ? cleanMeta.provider : "",
     model: typeof cleanMeta.model === "string" ? cleanMeta.model : "",
   };
-  const plannedEvents = [
+  const digestEvents = [
     { type: "session_start", data: startData },
     {
       type: "session_branch",
@@ -2702,19 +3933,19 @@ export function createBranchSession({
   let count = 0;
   for (const m of canonicalMessages) {
     if (m.role === "user") {
-      plannedEvents.push({
+      digestEvents.push({
         type: "user_message",
         data: { role: "user", content: m.content },
       });
       count += 1;
     } else if (m.role === "assistant") {
-      plannedEvents.push({
+      digestEvents.push({
         type: "assistant_message",
         data: { role: "assistant", content: m.content },
       });
       count += 1;
     } else if (m.role === "system") {
-      plannedEvents.push({
+      digestEvents.push({
         type: "system",
         data: encodePersistedMessage(m),
       });
@@ -2724,8 +3955,27 @@ export function createBranchSession({
     // canonical projection above retains only explicitly durable systems.
   }
   const inputDigest = `sha256:${createHash("sha256")
-    .update(JSON.stringify(plannedEvents), "utf8")
+    .update(JSON.stringify(digestEvents), "utf8")
     .digest("hex")}`;
+  const branchGenerationId = `generation-${createHash("sha256")
+    .update(`branch-generation\0${branchSessionId}`, "utf8")
+    .digest("hex")
+    .slice(0, 32)}`;
+  const plannedEvents = digestEvents.map((event, index) =>
+    index === 0
+      ? {
+          ...event,
+          data: encodeSessionGenerationData(
+            event.data,
+            createSessionGenerationAuthority(
+              branchSessionId,
+              null,
+              branchGenerationId,
+            ),
+          ),
+        }
+      : event,
+  );
   plannedEvents.push({
     type: "session_branch_complete",
     data: {
@@ -2740,6 +3990,23 @@ export function createBranchSession({
   return withFileLock(
     filePath,
     () => {
+      const presence = getSessionPresence(branchSessionId);
+      if (
+        presence === SESSION_PRESENCE.TOMBSTONED ||
+        (presence === SESSION_PRESENCE.CONFLICT &&
+          readSessionTombstoneMarker(sessionsDir, branchSessionId) !== null)
+      ) {
+        throw sessionDeletedError(branchSessionId);
+      }
+      if (
+        presence === SESSION_PRESENCE.MISSING_TRANSCRIPT ||
+        presence === SESSION_PRESENCE.CONFLICT
+      ) {
+        throw unverifiedTranscriptError(
+          branchSessionId,
+          transcriptAnchorMismatchVerification(),
+        );
+      }
       if (existsSync(filePath)) inspectPhysicalTail(filePath);
       let verification = existsSync(filePath)
         ? verifyTranscriptFile(filePath)
@@ -2761,12 +4028,22 @@ export function createBranchSession({
         : [];
       const prefixMatches = existingEvents
         .slice(0, Math.min(existingEvents.length, plannedEvents.length))
-        .every(
-          (event, index) =>
+        .every((event, index) => {
+          let plannedData = plannedEvents[index].data;
+          // Existing v1 branches predate generation authority. They remain
+          // idempotently readable; only newly created branches publish it.
+          if (
+            index === 0 &&
+            event?.data?.[SESSION_GENERATION_AUTHORITY_FIELD] === undefined
+          ) {
+            plannedData = { ...plannedData };
+            delete plannedData[SESSION_GENERATION_AUTHORITY_FIELD];
+          }
+          return (
             event.type === plannedEvents[index].type &&
-            JSON.stringify(event.data) ===
-              JSON.stringify(plannedEvents[index].data),
-        );
+            JSON.stringify(event.data) === JSON.stringify(plannedData)
+          );
+        });
       if (!prefixMatches) {
         const error = new Error(
           `Branch session conflicts with its deterministic input: ${branchSessionId}`,
@@ -2821,6 +4098,9 @@ export function createBranchSession({
       }
 
       let prevHash = verification.lastHash;
+      let expectedTranscriptState = existsSync(filePath)
+        ? readPhysicalTranscriptState(filePath)
+        : null;
       for (
         let index = existingEvents.length;
         index < plannedEvents.length;
@@ -2834,17 +4114,13 @@ export function createBranchSession({
         };
         const hash = computeEventHash(prevHash, core);
         const event = { ...core, prevHash, hash };
-        appendFileSync(filePath, `${JSON.stringify(event)}\n`, {
-          encoding: "utf8",
-          mode: 0o600,
-        });
-        ensurePrivateFile(filePath);
-        runSessionScaleFaultHook("afterTranscriptAppend", {
-          sessionId: branchSessionId,
-          type: planned.type,
+        expectedTranscriptState = appendTranscriptEvent(
+          branchSessionId,
+          planned.type,
           event,
           filePath,
-        });
+          expectedTranscriptState,
+        );
         prevHash = hash;
       }
 
@@ -2873,14 +4149,148 @@ export function createBranchSession({
   );
 }
 
+export const SESSION_PRESENCE = Object.freeze({
+  ABSENT: "absent",
+  PRESENT: "present",
+  MISSING_TRANSCRIPT: "missing-transcript",
+  TOMBSTONED: "tombstoned",
+  CONFLICT: "conflict",
+});
+
+export function getSessionPresence(sessionId) {
+  if (isUnsafeSessionId(sessionId)) return SESSION_PRESENCE.ABSENT;
+  const dir = getSessionsDir();
+  const transcriptExists = existsSync(sessionPath(sessionId));
+  const tombstoneMarkerExists = existsSync(
+    join(dir, `${sessionId}${SESSION_TOMBSTONE_MARKER_SUFFIX}`),
+  );
+  const witness = readSessionPersistenceWitness(sessionId);
+  const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
+  if (
+    transcriptExists &&
+    (witness?.deleted === true ||
+      tombstoneMarkerExists ||
+      externalAnchor?.status === "deleted")
+  ) {
+    return SESSION_PRESENCE.CONFLICT;
+  }
+  if (transcriptExists) {
+    if (witness !== null && witness?.deleted !== true) {
+      assertSessionAntiRollbackBeforeWrite(
+        sessionId,
+        witness,
+        sessionPath(sessionId),
+        "live",
+      );
+    }
+    return SESSION_PRESENCE.PRESENT;
+  }
+  if (
+    witness?.deleted === true ||
+    tombstoneMarkerExists ||
+    externalAnchor?.status === "deleted"
+  ) {
+    return SESSION_PRESENCE.TOMBSTONED;
+  }
+  if (witness !== null || externalAnchor?.status === "live") {
+    return SESSION_PRESENCE.MISSING_TRANSCRIPT;
+  }
+  return SESSION_PRESENCE.ABSENT;
+}
+
+/** True when a host must treat this id as canonical instead of falling back. */
+export function sessionHasPersistedEvidence(sessionId) {
+  return [
+    SESSION_PRESENCE.PRESENT,
+    SESSION_PRESENCE.MISSING_TRANSCRIPT,
+    SESSION_PRESENCE.TOMBSTONED,
+    SESSION_PRESENCE.CONFLICT,
+  ].includes(getSessionPresence(sessionId));
+}
+
+/** True only for a physical, non-tombstoned transcript path. */
 export function sessionExists(sessionId) {
-  if (isUnsafeSessionId(sessionId)) return false; // never resolve a traversal id
-  return existsSync(sessionPath(sessionId));
+  return getSessionPresence(sessionId) === SESSION_PRESENCE.PRESENT;
 }
 
 export function getLastSessionId() {
-  const sessions = listJsonlSessions({ limit: 1 });
-  return sessions.length > 0 ? sessions[0].id : null;
+  // Seed/rebuild missing indexes for physical transcripts first, then include
+  // a live missing-transcript witness so --continue fails closed on the newest
+  // canonical identity instead of silently selecting an older healthy chat.
+  const dir = getSessionsDir();
+  listJsonlSessions({ limit: 1 });
+  const sessions = listIndexedSessions(dir, {
+    limit: 1,
+    hasSession: (id) =>
+      [
+        SESSION_PRESENCE.PRESENT,
+        SESSION_PRESENCE.MISSING_TRANSCRIPT,
+        SESSION_PRESENCE.CONFLICT,
+      ].includes(getSessionPresence(id)),
+    includeDeleted: (id) =>
+      getSessionPresence(id) === SESSION_PRESENCE.CONFLICT,
+  });
+  const candidateRisk = (presence) =>
+    [SESSION_PRESENCE.MISSING_TRANSCRIPT, SESSION_PRESENCE.CONFLICT].includes(
+      presence,
+    )
+      ? 1
+      : 0;
+  let latest =
+    sessions.length > 0
+      ? {
+          id: sessions[0].id,
+          updatedAt: Date.parse(sessions[0].updated_at) || 0,
+          risk: candidateRisk(getSessionPresence(sessions[0].id)),
+        }
+      : null;
+
+  // A stale/corrupt disposable activity journal cannot rediscover a sidecar-
+  // only missing witness. Directory enumeration already occurs in the list
+  // path; normally read only metadata files that have no transcript
+  // counterpart. Durable tombstone namespace witnesses are enumerable, so
+  // restored transcript conflicts are checked without opening every live
+  // sidecar. This remains correct when the disposable activity journal is
+  // absent, corrupt, or a parseable stale prefix.
+  if (existsSync(dir)) {
+    const files = readdirSync(dir);
+    const transcriptIds = new Set(
+      files
+        .filter((file) => file.endsWith(".jsonl"))
+        .map((file) => basename(file, ".jsonl")),
+    );
+    const tombstoneIds = new Set(
+      files
+        .filter((file) => file.endsWith(SESSION_TOMBSTONE_MARKER_SUFFIX))
+        .map((file) => file.slice(0, -SESSION_TOMBSTONE_MARKER_SUFFIX.length)),
+    );
+    for (const file of files) {
+      if (!file.endsWith(".meta.json")) continue;
+      const id = file.slice(0, -".meta.json".length);
+      const hasTranscript = transcriptIds.has(id);
+      if (isUnsafeSessionId(id) || (hasTranscript && !tombstoneIds.has(id))) {
+        continue;
+      }
+      const meta = readSessionMeta(dir, id);
+      const presence = getSessionPresence(id);
+      const isMissing = presence === SESSION_PRESENCE.MISSING_TRANSCRIPT;
+      const isRecoveredConflict = presence === SESSION_PRESENCE.CONFLICT;
+      if (!meta || (!isMissing && !isRecoveredConflict)) continue;
+      const updatedAt = Math.max(0, Number(meta?.updated_at_ms) || 0);
+      const risk = candidateRisk(presence);
+      if (
+        latest === null ||
+        updatedAt > latest.updatedAt ||
+        (updatedAt === latest.updatedAt && risk > latest.risk) ||
+        (updatedAt === latest.updatedAt &&
+          risk === latest.risk &&
+          id > latest.id)
+      ) {
+        latest = { id, updatedAt, risk };
+      }
+    }
+  }
+  return latest?.id || null;
 }
 
 export function migrateLegacySessions(sourceDir, options = {}) {
@@ -3068,7 +4478,8 @@ function performLegacySessionMigration(sourcePath, options) {
     };
   }
 
-  if (!options.force && sessionExists(sessionId)) {
+  const existingPresence = getSessionPresence(sessionId);
+  if (!options.force && existingPresence !== SESSION_PRESENCE.ABSENT) {
     return {
       file: sourcePath,
       sessionId,
@@ -3078,8 +4489,17 @@ function performLegacySessionMigration(sourcePath, options) {
   }
 
   if (!options.dryRun) {
-    if (options.force && sessionExists(sessionId)) {
-      rmSync(sessionPath(sessionId), { force: true });
+    if (
+      options.force &&
+      ![SESSION_PRESENCE.ABSENT, SESSION_PRESENCE.TOMBSTONED].includes(
+        existingPresence,
+      )
+    ) {
+      if (!deleteJsonlSession(sessionId)) {
+        throw new Error(
+          `could not tombstone existing JSONL session before forced migration: ${sessionId}`,
+        );
+      }
     }
     startSession(sessionId, legacy.meta);
     for (const message of legacy.messages) {