chainlesschain 0.162.198 → 0.162.200

package/src/harness/jsonl-session-store.js

@@ -2,7 +2,7 @@
  * JSONL Session Store — append-only session persistence.
  */
 
-import {
+import fs, {
   constants as fsConstants,
   existsSync,
   appendFileSync,
@@ -16,6 +16,7 @@ import {
   fstatSync,
   lstatSync,
   readSync,
+  writeSync,
   ftruncateSync,
 } from "node:fs";
 import { join, basename, resolve } from "node:path";
@@ -23,9 +24,16 @@ import { createHash, randomUUID } from "node:crypto";
 import { TextDecoder } from "node:util";
 import { getHomeDir } from "../lib/paths.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../lib/secure-fs.js";
+import {
+  isAffectedWindowsZeroDeviceStatRuntime,
+  samePathHandleStableFileIdentity,
+  withTrustedFileParentSync,
+} from "../lib/secure-file-identity.js";
 import {
   computeEventHash,
+  latestChainHash,
   TRANSCRIPT_CHAIN_STATUS,
+  verifyTranscriptText,
 } from "./transcript-integrity.js";
 import { withFileLock } from "../lib/with-file-lock.js";
 import {
@@ -48,12 +56,24 @@ import {
   publicSessionMeta,
   readLatestSessionActivity,
   readSessionMeta,
+  readSessionTombstoneMarker,
   recordSessionDeleted,
   recordSessionEvent,
   recordSessionActivity,
   replaceSessionMeta,
+  normalizeSessionGenerationAuthority,
+  SESSION_GENERATION_AUTHORITY_FIELD,
+  SESSION_GENERATION_AUTHORITY_SCHEMA,
   SESSION_TOMBSTONE_MARKER_SUFFIX,
 } from "./session-list-index.js";
+import { createSessionPersistenceFailure } from "../lib/session-persistence-failure.js";
+import { withSessionHostWriteAuthority } from "../lib/session-host-lease.js";
+import {
+  listSessionAntiRollbackIds,
+  publishSessionAntiRollbackAnchor,
+  readSessionAntiRollbackAnchor,
+  sessionAntiRollbackPredecessorWitness,
+} from "../lib/session-anti-rollback-anchor.js";
 
 let securedSessionsDir = null;
 let securedSessionsDirIdentity = null;
@@ -62,6 +82,7 @@ let securedSessionsDirIdentity = null;
 // gate. The hooks are inert unless the dedicated child process opts in; this
 // keeps production behavior and ordinary tests on the exact same append path.
 export const _sessionScaleFaultHooks = Object.seal({
+  beforeTranscriptAppend: null,
   afterTranscriptAppend: null,
   afterForkCopy: null,
   afterForkLineage: null,
@@ -79,6 +100,11 @@ const WS_TURN_INPUT_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
 const WS_TURN_CLAIM_ID_PATTERN = /^claim-[0-9a-f-]{36}$/;
 const WS_TURN_FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 
+export {
+  SESSION_GENERATION_AUTHORITY_FIELD,
+  SESSION_GENERATION_AUTHORITY_SCHEMA,
+};
+
 function wsTurnError(message, code) {
   const error = new Error(message);
   error.code = code;
@@ -511,6 +537,100 @@ export function sessionPath(sessionId) {
   return join(getSessionsDir(), `${sessionId}.jsonl`);
 }
 
+function physicalTranscriptStateFromStats(stats) {
+  const exact = (value) =>
+    typeof value === "bigint" ? String(value) : undefined;
+  const legacyNumber = (value) => Number(value);
+  const timeMs = (name) => {
+    const nanoseconds = stats[`${name}Ns`];
+    return typeof nanoseconds === "bigint"
+      ? Number(nanoseconds / 1_000_000n) +
+          Number(nanoseconds % 1_000_000n) / 1_000_000
+      : Number(stats[`${name}Ms`]);
+  };
+  return Object.freeze({
+    // Keep the rounded legacy fields so metadata produced by older releases
+    // remains readable. BigIntStats supplies the exact witness used by new
+    // writers; this avoids Node 22.12 Windows fstat/lstat precision drift.
+    dev: String(legacyNumber(stats.dev)),
+    ino: String(legacyNumber(stats.ino)),
+    size: legacyNumber(stats.size),
+    mtimeMs: timeMs("mtime"),
+    ctimeMs: timeMs("ctime"),
+    devExact: exact(stats.dev),
+    inoExact: exact(stats.ino),
+    sizeExact: exact(stats.size),
+    mtimeNs: exact(stats.mtimeNs),
+    ctimeNs: exact(stats.ctimeNs),
+  });
+}
+
+function readPhysicalTranscriptStats(filePath) {
+  const stats = lstatSync(filePath, { bigint: true });
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    const error = new Error("Session transcript path is not a regular file");
+    error.code = "SESSION_TRANSCRIPT_IDENTITY_CHANGED";
+    error.commitState = "not-committed";
+    throw error;
+  }
+  return stats;
+}
+
+function readPhysicalTranscriptState(filePath) {
+  return physicalTranscriptStateFromStats(
+    readPhysicalTranscriptStats(filePath),
+  );
+}
+
+function samePhysicalTranscriptState(left, right, { content = true } = {}) {
+  if (!left || !right) return left === right;
+  const sameField = (exactField, legacyField, { numeric = false } = {}) => {
+    if (left[exactField] != null && right[exactField] != null) {
+      return String(left[exactField]) === String(right[exactField]);
+    }
+    return numeric
+      ? Number(left[legacyField]) === Number(right[legacyField])
+      : String(left[legacyField]) === String(right[legacyField]);
+  };
+  return (
+    sameField("devExact", "dev") &&
+    sameField("inoExact", "ino") &&
+    (!content ||
+      (sameField("sizeExact", "size", { numeric: true }) &&
+        sameField("mtimeNs", "mtimeMs", { numeric: true }) &&
+        sameField("ctimeNs", "ctimeMs", { numeric: true })))
+  );
+}
+
+function samePhysicalTranscriptContentState(left, right) {
+  if (!left || !right) return left === right;
+  const sameField = (exactField, legacyField) => {
+    if (left[exactField] != null && right[exactField] != null) {
+      return String(left[exactField]) === String(right[exactField]);
+    }
+    return Number(left[legacyField]) === Number(right[legacyField]);
+  };
+  return (
+    sameField("sizeExact", "size") &&
+    sameField("mtimeNs", "mtimeMs") &&
+    sameField("ctimeNs", "ctimeMs")
+  );
+}
+
+function withTranscriptFileParent(filePath, task) {
+  if (!isAffectedWindowsZeroDeviceStatRuntime()) {
+    return task({ canonicalPath: filePath, parentDevice: null });
+  }
+  return withTrustedFileParentSync(fs, filePath, task);
+}
+
+function transcriptIdentityError(commitState, reason) {
+  const error = new Error(`Session transcript identity changed: ${reason}`);
+  error.code = "SESSION_TRANSCRIPT_IDENTITY_CHANGED";
+  error.commitState = commitState;
+  return error;
+}
+
 export function appendTokenUsage(sessionId, usage) {
   appendEvent(sessionId, "token_usage", usage || {});
 }
@@ -661,19 +781,26 @@ function appendVerifiedWsAuthorityEventLocked(
   const core = { type, timestamp: Date.now(), data };
   const hash = computeEventHash(previousHeadHash, core);
   const event = { ...core, prevHash: previousHeadHash, hash };
-  appendFileSync(filePath, `${JSON.stringify(event)}\n`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
   ensurePrivateFile(filePath);
-  runSessionScaleFaultHook("afterTranscriptAppend", {
+  const expectedState = readPhysicalTranscriptState(filePath);
+  const transcriptState = appendTranscriptEvent(
     sessionId,
     type,
     event,
     filePath,
-  });
+    expectedState,
+  );
   try {
-    recordSessionEvent(getSessionsDir(), sessionId, event, hash);
+    const nextMeta = recordSessionEvent(
+      getSessionsDir(),
+      sessionId,
+      event,
+      hash,
+      {
+        transcriptState,
+      },
+    );
+    publishSessionAntiRollbackWitness(sessionId, nextMeta, filePath, "live");
   } catch (cause) {
     const error = new Error(
       `Session authority anchor could not be persisted: ${sessionId}`,
@@ -711,9 +838,17 @@ function appendVerifiedWsAuthorityEventLocked(
   return Object.freeze({ hash, event });
 }
 
+function withSessionHostWriterLock(sessionId, filePath, task, options) {
+  return withFileLock(
+    filePath,
+    () => withSessionHostWriteAuthority(sessionId, task),
+    options,
+  );
+}
+
 function withVerifiedWsTurnLock(sessionId, task) {
   const filePath = sessionPath(sessionId);
-  return withFileLock(filePath, () => task(filePath), {
+  return withSessionHostWriterLock(sessionId, filePath, () => task(filePath), {
     failIfUnavailable: true,
     timeoutMs: 30_000,
     retryMs: 1,
@@ -740,6 +875,153 @@ function encodeEventMessageProvenance(type, data) {
   return data;
 }
 
+function appendTranscriptEvent(
+  sessionId,
+  type,
+  event,
+  filePath,
+  expectedState,
+) {
+  const payload = { sessionId, type, event, filePath };
+  try {
+    runSessionScaleFaultHook("beforeTranscriptAppend", payload);
+  } catch (cause) {
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation: "transcript-append",
+      commitState: "not-committed",
+    });
+  }
+  try {
+    return withTranscriptFileParent(
+      filePath,
+      ({ canonicalPath, parentDevice }) =>
+        appendTranscriptEventAtPath({
+          sessionId,
+          event,
+          payload,
+          filePath: canonicalPath,
+          expectedState,
+          parentDevice,
+        }),
+    );
+  } catch (cause) {
+    if (
+      cause?.code === "SESSION_TRANSCRIPT_IDENTITY_CHANGED" ||
+      cause?.operation === "transcript-append" ||
+      cause?.operation === "transcript-settlement"
+    ) {
+      throw cause;
+    }
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation: "transcript-settlement",
+      commitState: "unknown",
+    });
+  }
+}
+
+function appendTranscriptEventAtPath({
+  sessionId,
+  event,
+  payload,
+  filePath,
+  expectedState,
+  parentDevice,
+}) {
+  let fd = null;
+  let wroteBytes = false;
+  let appendCompleted = false;
+  try {
+    let flags = fsConstants.O_WRONLY | fsConstants.O_APPEND;
+    if (expectedState === null) {
+      flags |= fsConstants.O_CREAT | fsConstants.O_EXCL;
+    }
+    if (typeof fsConstants.O_NOFOLLOW === "number") {
+      flags |= fsConstants.O_NOFOLLOW;
+    }
+    fd = openSync(filePath, flags, 0o600);
+    const openedStats = fstatSync(fd, { bigint: true });
+    const openedState = physicalTranscriptStateFromStats(openedStats);
+    if (expectedState !== null) {
+      if (parentDevice === null) {
+        if (!samePhysicalTranscriptState(expectedState, openedState)) {
+          throw transcriptIdentityError(
+            "not-committed",
+            "the append descriptor does not match the verified path",
+          );
+        }
+      } else {
+        const publishedBeforeStats = readPhysicalTranscriptStats(filePath);
+        const publishedBeforeState =
+          physicalTranscriptStateFromStats(publishedBeforeStats);
+        if (
+          !samePhysicalTranscriptState(expectedState, publishedBeforeState) ||
+          !samePathHandleStableFileIdentity(
+            publishedBeforeStats,
+            openedStats,
+            parentDevice,
+          )
+        ) {
+          throw transcriptIdentityError(
+            "not-committed",
+            "the append descriptor does not match the verified path",
+          );
+        }
+      }
+    }
+    const bytes = Buffer.from(`${JSON.stringify(event)}\n`, "utf8");
+    let offset = 0;
+    while (offset < bytes.length) {
+      const written = writeSync(fd, bytes, offset, bytes.length - offset);
+      if (!Number.isSafeInteger(written) || written <= 0) {
+        throw new Error("Session transcript append made no forward progress");
+      }
+      offset += written;
+      wroteBytes = true;
+    }
+    appendCompleted = true;
+    runSessionScaleFaultHook("afterTranscriptAppend", payload);
+    const descriptorStats = fstatSync(fd, { bigint: true });
+    const descriptorState = physicalTranscriptStateFromStats(descriptorStats);
+    const pathStats = readPhysicalTranscriptStats(filePath);
+    const pathState = physicalTranscriptStateFromStats(pathStats);
+    const publishedIdentityMatches =
+      parentDevice === null
+        ? samePhysicalTranscriptState(descriptorState, pathState, {
+            content: false,
+          })
+        : samePathHandleStableFileIdentity(
+            pathStats,
+            descriptorStats,
+            parentDevice,
+          );
+    if (!publishedIdentityMatches) {
+      throw transcriptIdentityError(
+        "unknown",
+        "the published path no longer names the appended descriptor",
+      );
+    }
+    return pathState;
+  } catch (cause) {
+    if (cause?.code === "SESSION_TRANSCRIPT_IDENTITY_CHANGED") throw cause;
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation: appendCompleted
+        ? "transcript-settlement"
+        : "transcript-append",
+      // ENOSPC can follow a short write. EROFS fails before the append can
+      // mutate the target.
+      commitState:
+        !appendCompleted && (cause?.code === "EROFS" || !wroteBytes)
+          ? "not-committed"
+          : "unknown",
+    });
+  } finally {
+    if (fd !== null) closeSync(fd);
+  }
+}
+
 const SESSION_AUTHORITY_RECOVERY_TEXT_LIMITS = Object.freeze({
   safetyId: 512,
   safetyIdentity: 512,
@@ -774,6 +1056,174 @@ function sanitizeSessionAuthorityRecoveryEvidence(value) {
   return Object.keys(evidence).length > 0 ? Object.freeze(evidence) : null;
 }
 
+function sessionDeletedError(sessionId) {
+  const error = new Error(`Session was deleted: ${sessionId}`);
+  error.code = "SESSION_DELETED";
+  return error;
+}
+
+function createSessionGenerationAuthority(
+  sessionId,
+  predecessorWitness = null,
+  generationId = `generation-${randomUUID()}`,
+) {
+  const previous = normalizeSessionGenerationAuthority(
+    predecessorWitness?.generation,
+  );
+  const isReplacement = predecessorWitness !== null;
+  return Object.freeze({
+    schema: SESSION_GENERATION_AUTHORITY_SCHEMA,
+    sessionId,
+    generationId,
+    ordinal:
+      previous?.sessionId === sessionId
+        ? previous.ordinal + 1
+        : isReplacement
+          ? 2
+          : 1,
+    predecessor: isReplacement
+      ? Object.freeze({
+          kind:
+            previous?.sessionId === sessionId
+              ? "tombstone"
+              : "legacy-tombstone",
+          generationId:
+            previous?.sessionId === sessionId ? previous.generationId : null,
+          headHash:
+            typeof predecessorWitness?.last_hash === "string" &&
+            /^[0-9a-f]{64}$/.test(predecessorWitness.last_hash)
+              ? predecessorWitness.last_hash
+              : null,
+          eventCount: Math.max(0, Number(predecessorWitness?.event_count) || 0),
+          tombstonedAtMs: Number.isSafeInteger(
+            Number(predecessorWitness?.deleted_at_ms),
+          )
+            ? Math.max(0, Number(predecessorWitness.deleted_at_ms))
+            : null,
+        })
+      : null,
+  });
+}
+
+function encodeSessionGenerationData(data, authority = null) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    return authority
+      ? { [SESSION_GENERATION_AUTHORITY_FIELD]: authority }
+      : data;
+  }
+  const clean = { ...data };
+  // The namespace generation is store-owned authority. Callers may not forge
+  // it on arbitrary events or choose a replacement predecessor.
+  delete clean[SESSION_GENERATION_AUTHORITY_FIELD];
+  if (authority) clean[SESSION_GENERATION_AUTHORITY_FIELD] = authority;
+  return clean;
+}
+
+function sessionAntiRollbackCandidateFromWitness(witness, status = "live") {
+  if (!witness || typeof witness !== "object") return null;
+  const eventCount = Math.max(0, Number(witness.event_count) || 0);
+  const headHash =
+    typeof witness.last_hash === "string" &&
+    /^[0-9a-f]{64}$/.test(witness.last_hash)
+      ? witness.last_hash
+      : null;
+  const generation = normalizeSessionGenerationAuthority(witness.generation);
+  const legacyDeletion =
+    status === "deleted" && generation === null && headHash === null;
+  if (!legacyDeletion && (eventCount === 0) !== (headHash === null))
+    return null;
+  return Object.freeze({
+    status,
+    generation,
+    headHash,
+    eventCount,
+    deletedAtMs:
+      status === "deleted"
+        ? Math.max(
+            0,
+            Number(witness.deleted_at_ms || witness.updated_at_ms) || 0,
+          )
+        : null,
+  });
+}
+
+function antiRollbackAnchorMatchesCandidate(anchor, candidate) {
+  return (
+    anchor !== null &&
+    candidate !== null &&
+    anchor.status === candidate.status &&
+    JSON.stringify(anchor.generation) ===
+      JSON.stringify(candidate.generation) &&
+    anchor.headHash === candidate.headHash &&
+    anchor.eventCount === candidate.eventCount &&
+    anchor.deletedAtMs === candidate.deletedAtMs
+  );
+}
+
+function transcriptHashAtEventCount(filePath, eventCount) {
+  if (eventCount === 0) return null;
+  let count = 0;
+  for (const { line } of iterateFileLinesSync(filePath)) {
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (typeof event?.hash !== "string") continue;
+    count += 1;
+    if (count === eventCount) return event.hash;
+  }
+  return null;
+}
+
+function publishSessionAntiRollbackWitness(
+  sessionId,
+  witness,
+  filePath,
+  status = "live",
+) {
+  const candidate = sessionAntiRollbackCandidateFromWitness(witness, status);
+  if (candidate === null) {
+    const error = new Error(
+      `Session anti-rollback candidate is incomplete: ${sessionId}`,
+    );
+    error.code = "CC_SESSION_ANTI_ROLLBACK_UNAVAILABLE";
+    throw error;
+  }
+  return publishSessionAntiRollbackAnchor(sessionId, candidate, {
+    provePrefix: (current) =>
+      current.status === "live" &&
+      existsSync(filePath) &&
+      transcriptHashAtEventCount(filePath, current.eventCount) ===
+        current.headHash,
+  });
+}
+
+function assertSessionAntiRollbackBeforeWrite(
+  sessionId,
+  witness,
+  filePath,
+  status = "live",
+) {
+  const current = readSessionAntiRollbackAnchor(sessionId);
+  if (current === null && witness === null) return null;
+  const candidate = sessionAntiRollbackCandidateFromWitness(witness, status);
+  if (candidate === null) return current;
+  if (antiRollbackAnchorMatchesCandidate(current, candidate)) return current;
+
+  if (status === "live" && existsSync(filePath)) {
+    const verification = verifyTranscriptFile(filePath);
+    assertLocalVerifiedTranscriptAnchor(sessionId, verification);
+  }
+  return publishSessionAntiRollbackWitness(
+    sessionId,
+    witness,
+    filePath,
+    status,
+  );
+}
+
 function appendEventLocked(
   sessionId,
   type,
@@ -781,35 +1231,69 @@ function appendEventLocked(
   { expectedHeadHash, compareHead = false, requireIndexAnchor = false } = {},
 ) {
   const filePath = sessionPath(sessionId);
-  return withFileLock(
+  return withSessionHostWriterLock(
+    sessionId,
     filePath,
     () => {
-      const existingMeta = readSessionMeta(getSessionsDir(), sessionId);
-      const persistedWitness = existingMeta;
+      let existingMeta = readSessionMeta(getSessionsDir(), sessionId);
+      const marker = readSessionTombstoneMarker(getSessionsDir(), sessionId);
+      const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
+      const presence = getSessionPresence(sessionId);
       const transcriptExists = existsSync(filePath);
       const startsNewGeneration =
-        !transcriptExists &&
-        persistedWitness?.deleted === true &&
-        type === "session_start";
+        presence === SESSION_PRESENCE.TOMBSTONED && type === "session_start";
+      if (presence === SESSION_PRESENCE.CONFLICT) {
+        if (marker !== null || existingMeta?.deleted === true) {
+          throw sessionDeletedError(sessionId);
+        }
+        throw unverifiedTranscriptError(
+          sessionId,
+          transcriptAnchorMismatchVerification(),
+        );
+      }
       if (
-        persistedWitness?.deleted === true &&
-        (transcriptExists || type !== "session_start")
+        presence === SESSION_PRESENCE.TOMBSTONED &&
+        type !== "session_start"
       ) {
-        const error = new Error(`Session was deleted: ${sessionId}`);
-        error.code = "SESSION_DELETED";
-        throw error;
+        throw sessionDeletedError(sessionId);
       }
       if (
-        !transcriptExists &&
-        persistedWitness !== null &&
-        persistedWitness?.deleted !== true
+        presence === SESSION_PRESENCE.MISSING_TRANSCRIPT ||
+        (!transcriptExists &&
+          existingMeta !== null &&
+          existingMeta?.deleted !== true)
       ) {
         throw unverifiedTranscriptError(
           sessionId,
           missingTranscriptVerification(),
         );
       }
+      const duplicateLiveStart =
+        presence === SESSION_PRESENCE.PRESENT && type === "session_start";
       const { prevHash, recovery } = _resolveChainTail(filePath);
+      let expectedTranscriptState = transcriptExists
+        ? readPhysicalTranscriptState(filePath)
+        : null;
+      if (
+        transcriptExists &&
+        existingMeta?.transcript &&
+        (!samePhysicalTranscriptState(
+          existingMeta.transcript,
+          expectedTranscriptState,
+          { content: recovery === null },
+        ) ||
+          Number(existingMeta.transcript.size) !==
+            Number(expectedTranscriptState.size))
+      ) {
+        throw transcriptIdentityError(
+          "not-committed",
+          "the transcript no longer matches its persisted physical witness",
+        );
+      }
+      if (transcriptExists) {
+        ensurePrivateFile(filePath);
+        expectedTranscriptState = readPhysicalTranscriptState(filePath);
+      }
       if (
         transcriptExists &&
         existingMeta !== null &&
@@ -834,6 +1318,29 @@ function appendEventLocked(
         // publish a count of one for a multi-event transcript. Restore the
         // projection under the same writer lock before advancing the chain.
         rebuildSessionMetaUnlocked(getSessionsDir(), sessionId, filePath);
+        existingMeta = readSessionMeta(getSessionsDir(), sessionId);
+      }
+      if (transcriptExists) {
+        assertSessionAntiRollbackBeforeWrite(
+          sessionId,
+          existingMeta,
+          filePath,
+          "live",
+        );
+      } else if (presence === SESSION_PRESENCE.TOMBSTONED) {
+        assertSessionAntiRollbackBeforeWrite(
+          sessionId,
+          existingMeta ||
+            marker ||
+            sessionAntiRollbackPredecessorWitness(externalAnchor),
+          filePath,
+          "deleted",
+        );
+      }
+      if (duplicateLiveStart) {
+        const error = new Error(`Session already exists: ${sessionId}`);
+        error.code = "SESSION_ALREADY_EXISTS";
+        throw error;
       }
       if (compareHead && prevHash !== (expectedHeadHash || null)) {
         const error = new Error(
@@ -844,35 +1351,60 @@ function appendEventLocked(
         error.actualHeadHash = prevHash;
         throw error;
       }
-      const persistedData = encodeEventMessageProvenance(type, data);
+      const generationAuthority =
+        type === "session_start" &&
+        [SESSION_PRESENCE.ABSENT, SESSION_PRESENCE.TOMBSTONED].includes(
+          presence,
+        )
+          ? createSessionGenerationAuthority(
+              sessionId,
+              startsNewGeneration
+                ? existingMeta ||
+                    marker ||
+                    sessionAntiRollbackPredecessorWitness(externalAnchor)
+                : null,
+            )
+          : null;
+      const persistedData = encodeSessionGenerationData(
+        encodeEventMessageProvenance(type, data),
+        generationAuthority,
+      );
       const core = { type, timestamp: Date.now(), data: persistedData };
       const hash = computeEventHash(prevHash, core);
       const event = { ...core, prevHash, hash };
-      const line = JSON.stringify(event) + "\n";
-      appendFileSync(filePath, line, { encoding: "utf8", mode: 0o600 });
-      ensurePrivateFile(filePath);
-      runSessionScaleFaultHook("afterTranscriptAppend", {
+      const transcriptState = appendTranscriptEvent(
         sessionId,
         type,
         event,
         filePath,
-      });
+        expectedTranscriptState,
+      );
       try {
-        recordSessionEvent(getSessionsDir(), sessionId, event, hash, {
-          resetGeneration: startsNewGeneration,
-        });
+        const nextMeta = recordSessionEvent(
+          getSessionsDir(),
+          sessionId,
+          event,
+          hash,
+          {
+            resetGeneration: startsNewGeneration,
+            transcriptState,
+          },
+        );
+        publishSessionAntiRollbackWitness(
+          sessionId,
+          nextMeta,
+          filePath,
+          "live",
+        );
       } catch (cause) {
-        if (requireIndexAnchor) {
-          const error = new Error(
-            `Session authority anchor could not be persisted: ${sessionId}`,
-            { cause },
-          );
-          error.code = "SESSION_INDEX_ANCHOR_FAILED";
-          error.sessionId = sessionId;
-          throw error;
-        }
-        // The metadata index is explicitly rebuildable. Never turn a committed
-        // transcript event into an apparent failure that a caller may retry.
+        const error = new Error(
+          `Session authority anchor could not be persisted: ${sessionId}`,
+          { cause },
+        );
+        error.code = "SESSION_INDEX_ANCHOR_FAILED";
+        error.sessionId = sessionId;
+        error.commitState = "unknown";
+        throw error;
       }
       if (requireIndexAnchor) {
         const verification = verifyTranscriptFile(filePath);
@@ -891,10 +1423,11 @@ function appendEventLocked(
           error.code = "SESSION_INDEX_ANCHOR_FAILED";
           error.sessionId = sessionId;
           error.verification = verification;
+          error.commitState = "unknown";
           throw error;
         }
       }
-      return { hash, recovery };
+      return { hash, recovery, commitState: "committed" };
     },
     {
       failIfUnavailable: true,
@@ -907,8 +1440,24 @@ function appendEventLocked(
   );
 }
 
+function runClassifiedAppend(sessionId, operation, append) {
+  try {
+    return append();
+  } catch (cause) {
+    throw createSessionPersistenceFailure(cause, {
+      sessionId,
+      operation,
+      // Preserve an inner append/settlement classification. Without one,
+      // EROFS defaults to not-committed and ENOSPC remains unknown.
+      commitState: cause?.commitState,
+    });
+  }
+}
+
 export function appendEvent(sessionId, type, data) {
-  return appendEventLocked(sessionId, type, data);
+  return runClassifiedAppend(sessionId, "append-event", () =>
+    appendEventLocked(sessionId, type, data),
+  );
 }
 
 /**
@@ -916,9 +1465,11 @@ export function appendEvent(sessionId, type, data) {
  * crash/tail-truncation anchor are durably updated and still agree.
  */
 export function appendAuthorityEvent(sessionId, type, data) {
-  return appendEventLocked(sessionId, type, data, {
-    requireIndexAnchor: true,
-  });
+  return runClassifiedAppend(sessionId, "append-authority-event", () =>
+    appendEventLocked(sessionId, type, data, {
+      requireIndexAnchor: true,
+    }),
+  );
 }
 
 /**
@@ -932,10 +1483,12 @@ export function appendEventIfHead(
   data,
   expectedHeadHash = null,
 ) {
-  return appendEventLocked(sessionId, type, data, {
-    expectedHeadHash,
-    compareHead: true,
-  });
+  return runClassifiedAppend(sessionId, "compare-and-append-event", () =>
+    appendEventLocked(sessionId, type, data, {
+      expectedHeadHash,
+      compareHead: true,
+    }),
+  );
 }
 
 /** Authority-bearing compare-and-append with a mandatory index anchor. */
@@ -945,11 +1498,16 @@ export function appendAuthorityEventIfHead(
   data,
   expectedHeadHash = null,
 ) {
-  return appendEventLocked(sessionId, type, data, {
-    expectedHeadHash,
-    compareHead: true,
-    requireIndexAnchor: true,
-  });
+  return runClassifiedAppend(
+    sessionId,
+    "compare-and-append-authority-event",
+    () =>
+      appendEventLocked(sessionId, type, data, {
+        expectedHeadHash,
+        compareHead: true,
+        requireIndexAnchor: true,
+      }),
+  );
 }
 
 /**
@@ -984,7 +1542,8 @@ export function appendAuthorityEventWithVerifiedProjection(
     );
   }
   const filePath = sessionPath(sessionId);
-  return withFileLock(
+  return withSessionHostWriterLock(
+    sessionId,
     filePath,
     () => {
       const projection = createProjection();
@@ -1093,7 +1652,8 @@ export function withSessionAuthorityTransaction(
   }
 
   const filePath = sessionPath(sessionId);
-  return withFileLock(
+  return withSessionHostWriterLock(
+    sessionId,
     filePath,
     () => {
       const existingMeta = readSessionMeta(getSessionsDir(), sessionId);
@@ -1560,20 +2120,77 @@ export function listSessionIds() {
     .map((file) => basename(file, ".jsonl"));
 }
 
-/** Resolve an exact id or one unambiguous prefix without reading transcripts. */
-export function resolveSessionId(input) {
+/**
+ * Enumerate every durable id occupying the canonical JSONL namespace.
+ *
+ * A transcript is not the only authority witness: a live/missing sidecar and
+ * a tombstone marker must continue to fence legacy stores even when the JSONL
+ * path itself is absent. Keeping this enumeration content-free also lets
+ * prefix resolution detect ambiguity without opening transcript bodies.
+ */
+export function listSessionEvidenceIds() {
+  const dir = getSessionsDir();
+  const ids = new Set(listSessionAntiRollbackIds());
+  if (!existsSync(dir)) return [...ids].sort();
+  for (const file of readdirSync(dir)) {
+    let id = null;
+    if (file.endsWith(".jsonl")) {
+      id = basename(file, ".jsonl");
+    } else if (file.endsWith(".meta.json")) {
+      id = file.slice(0, -".meta.json".length);
+    } else if (file.endsWith(SESSION_TOMBSTONE_MARKER_SUFFIX)) {
+      id = file.slice(0, -SESSION_TOMBSTONE_MARKER_SUFFIX.length);
+    }
+    if (id && !isUnsafeSessionId(id)) ids.add(id);
+  }
+  return [...ids].sort();
+}
+
+/**
+ * Resolve an exact id or unambiguous prefix across the complete persisted
+ * namespace, including damaged and tombstoned generations.
+ *
+ * Returning the presence separately from the id prevents callers from using
+ * "not readable" as "not canonical" and then silently consulting a legacy
+ * store. Ambiguity is fail-closed even when only one candidate is currently
+ * readable.
+ */
+export function resolveSessionAuthority(input) {
   if (isUnsafeSessionId(input)) return null;
-  if (sessionExists(input)) return input;
-  const matches = listSessionIds().filter(
-    (id) => id.startsWith(input) && sessionExists(id),
-  );
+  const exactPresence = getSessionPresence(input);
+  if (exactPresence !== SESSION_PRESENCE.ABSENT) {
+    return Object.freeze({
+      id: input,
+      match: "exact",
+      presence: exactPresence,
+      readable: exactPresence === SESSION_PRESENCE.PRESENT,
+    });
+  }
+  const matches = listSessionEvidenceIds()
+    .filter((id) => id.startsWith(input))
+    .map((id) => ({ id, presence: getSessionPresence(id) }))
+    .filter(({ presence }) => presence !== SESSION_PRESENCE.ABSENT);
   if (matches.length > 1) {
     const error = new Error(`Ambiguous session id prefix: ${input}`);
     error.code = "AMBIGUOUS_SESSION_ID";
-    error.matches = matches.slice(0, 20);
+    error.matches = matches.slice(0, 20).map(({ id }) => id);
+    error.authorities = matches.slice(0, 20).map((item) => ({ ...item }));
     throw error;
   }
-  return matches[0] || null;
+  if (matches.length === 0) return null;
+  const [{ id, presence }] = matches;
+  return Object.freeze({
+    id,
+    match: "prefix",
+    presence,
+    readable: presence === SESSION_PRESENCE.PRESENT,
+  });
+}
+
+/** Resolve an exact id or one unambiguous prefix without reading transcripts. */
+export function resolveSessionId(input) {
+  const authority = resolveSessionAuthority(input);
+  return authority?.readable ? authority.id : null;
 }
 
 export { TRANSCRIPT_CHAIN_STATUS };
@@ -1593,11 +2210,17 @@ export function startSession(sessionId, meta = {}) {
 }
 
 export function appendUserMessage(sessionId, content) {
-  appendEvent(sessionId, "user_message", { role: "user", content });
+  return appendEvent(sessionId, "user_message", {
+    role: "user",
+    content,
+  });
 }
 
 export function appendAssistantMessage(sessionId, content) {
-  appendEvent(sessionId, "assistant_message", { role: "assistant", content });
+  return appendEvent(sessionId, "assistant_message", {
+    role: "assistant",
+    content,
+  });
 }
 
 function wsTurnLifecycleResult(snapshot, overrides = {}) {
@@ -2019,25 +2642,82 @@ function readSessionPersistenceWitness(sessionId) {
 
 function hasLiveSessionWitness(sessionId) {
   const witness = readSessionPersistenceWitness(sessionId);
-  return witness !== null && witness?.deleted !== true;
+  if (witness !== null && witness?.deleted !== true) return true;
+  return readSessionAntiRollbackAnchor(sessionId)?.status === "live";
 }
 
-function assertVerifiedTranscriptAnchor(sessionId, verification) {
+function assertLocalVerifiedTranscriptAnchor(
+  sessionId,
+  verification,
+  physicalState = null,
+) {
   const meta = readSessionMeta(getSessionsDir(), sessionId);
+  let physicalAnchorMatches = true;
+  let currentPhysicalState = physicalState;
+  if (meta?.transcript) {
+    try {
+      currentPhysicalState ||= readPhysicalTranscriptState(
+        sessionPath(sessionId),
+      );
+      physicalAnchorMatches = samePhysicalTranscriptState(
+        meta.transcript,
+        currentPhysicalState,
+      );
+    } catch {
+      physicalAnchorMatches = false;
+    }
+  }
   const trustedStatus =
     verification.status === TRANSCRIPT_CHAIN_STATUS.VERIFIED;
+  const headMatches = meta?.last_hash === verification.lastHash;
+  const eventCountMatches =
+    Number(meta?.event_count) === verification.chainedEvents;
   const anchoredHead =
     meta?.deleted !== true &&
-    meta?.last_hash === verification.lastHash &&
-    Number(meta?.event_count) === verification.chainedEvents;
+    headMatches &&
+    eventCountMatches &&
+    physicalAnchorMatches;
   if (
     !trustedStatus ||
     !anchoredHead ||
     verification.malformedLines > 0 ||
     verification.truncatedTail
   ) {
-    throw unverifiedTranscriptError(sessionId, verification);
+    const error = unverifiedTranscriptError(sessionId, verification);
+    error.anchor = Object.freeze({
+      metadataPresent: meta !== null,
+      metadataDeleted: meta?.deleted === true,
+      headMatches,
+      eventCountMatches,
+      physicalAnchorMatches,
+      metadataHeadHash: meta?.last_hash ?? null,
+      metadataEventCount: Number.isSafeInteger(Number(meta?.event_count))
+        ? Number(meta.event_count)
+        : null,
+      metadataTranscript: meta?.transcript ?? null,
+      currentTranscript: currentPhysicalState ?? null,
+    });
+    throw error;
   }
+  return meta;
+}
+
+function assertVerifiedTranscriptAnchor(
+  sessionId,
+  verification,
+  physicalState = null,
+) {
+  const meta = assertLocalVerifiedTranscriptAnchor(
+    sessionId,
+    verification,
+    physicalState,
+  );
+  publishSessionAntiRollbackWitness(
+    sessionId,
+    meta,
+    sessionPath(sessionId),
+    "live",
+  );
 }
 
 /**
@@ -2052,8 +2732,8 @@ function assertVerifiedTranscriptAnchor(sessionId, verification) {
  *
  * This removes the mandatory all-event array from resume projections. It does
  * not make verification IO sublinear: authenticating a plain chained JSONL
- * transcript remains O(N), and the local sidecar is not an anti-rollback
- * anchor or a cross-process lease.
+ * transcript remains O(N). The local sidecar is checked against an independent
+ * machine-local anti-rollback witness; it is not itself that witness.
  */
 export function readVerifiedProjection(
   sessionId,
@@ -2087,13 +2767,11 @@ export function readVerifiedProjection(
         );
       }
       if (!existsSync(filePath)) {
-        const witness = readSessionPersistenceWitness(sessionId);
-        if (witness?.deleted === true) {
-          const error = new Error(`Session was deleted: ${sessionId}`);
-          error.code = "SESSION_DELETED";
-          throw error;
+        const presence = getSessionPresence(sessionId);
+        if (presence === SESSION_PRESENCE.TOMBSTONED) {
+          throw sessionDeletedError(sessionId);
         }
-        if (witness !== null) {
+        if (presence === SESSION_PRESENCE.MISSING_TRANSCRIPT) {
           throw unverifiedTranscriptError(
             sessionId,
             missingTranscriptVerification(),
@@ -2153,6 +2831,112 @@ export function readVerifiedEvents(sessionId) {
   });
 }
 
+/**
+ * Return the exact JSONL bytes only after the transcript and its persisted
+ * anchor verify under the canonical writer lock. This is the export/mirror
+ * boundary; derived consumers must never copy a merely parseable raw path.
+ */
+export function readVerifiedTranscriptBytes(sessionId) {
+  if (isUnsafeSessionId(sessionId)) {
+    throw unverifiedTranscriptError(
+      sessionId,
+      transcriptAnchorMismatchVerification(),
+    );
+  }
+  const filePath = sessionPath(sessionId);
+  return withFileLock(
+    filePath,
+    () => {
+      const presence = getSessionPresence(sessionId);
+      if (presence === SESSION_PRESENCE.MISSING_TRANSCRIPT) {
+        throw unverifiedTranscriptError(
+          sessionId,
+          missingTranscriptVerification(),
+        );
+      }
+      if (presence !== SESSION_PRESENCE.PRESENT) {
+        throw unverifiedTranscriptError(
+          sessionId,
+          transcriptAnchorMismatchVerification(),
+        );
+      }
+      return withTranscriptFileParent(
+        filePath,
+        ({ canonicalPath, parentDevice }) =>
+          readVerifiedTranscriptBytesAtPath(
+            sessionId,
+            canonicalPath,
+            parentDevice,
+          ),
+      );
+    },
+    {
+      failIfUnavailable: true,
+      timeoutMs: 30_000,
+      retryMs: 1,
+      maxRetryMs: 8,
+      retryJitterMs: 4,
+      yieldAfterReleaseMs: 2,
+    },
+  );
+}
+
+function readVerifiedTranscriptBytesAtPath(sessionId, filePath, parentDevice) {
+  let flags = fsConstants.O_RDONLY;
+  if (typeof fsConstants.O_NOFOLLOW === "number") {
+    flags |= fsConstants.O_NOFOLLOW;
+  }
+  const fd = openSync(filePath, flags);
+  try {
+    const beforeStats = fstatSync(fd, { bigint: true });
+    const before = physicalTranscriptStateFromStats(beforeStats);
+    const publishedBeforeStats = readPhysicalTranscriptStats(filePath);
+    const publishedBefore =
+      physicalTranscriptStateFromStats(publishedBeforeStats);
+    const descriptorMatchesPublished =
+      parentDevice === null
+        ? samePhysicalTranscriptState(before, publishedBefore)
+        : samePathHandleStableFileIdentity(
+            publishedBeforeStats,
+            beforeStats,
+            parentDevice,
+          ) && samePhysicalTranscriptContentState(before, publishedBefore);
+    if (!descriptorMatchesPublished) {
+      throw transcriptIdentityError(
+        "not-committed",
+        "the read descriptor does not match the canonical path",
+      );
+    }
+    const text = readFileSync(fd, "utf8");
+    const afterStats = fstatSync(fd, { bigint: true });
+    const after = physicalTranscriptStateFromStats(afterStats);
+    const publishedStats = readPhysicalTranscriptStats(filePath);
+    const published = physicalTranscriptStateFromStats(publishedStats);
+    const publishedStillMatches =
+      parentDevice === null
+        ? samePhysicalTranscriptState(after, published)
+        : samePathHandleStableFileIdentity(
+            publishedStats,
+            afterStats,
+            parentDevice,
+          ) && samePhysicalTranscriptContentState(after, published);
+    if (!samePhysicalTranscriptState(before, after) || !publishedStillMatches) {
+      throw transcriptIdentityError(
+        "unknown",
+        "the transcript changed while verified bytes were read",
+      );
+    }
+    const verification = {
+      ...verifyTranscriptText(text),
+      lastHash: latestChainHash(text),
+    };
+    assertVerifiedTranscriptAnchor(sessionId, verification, published);
+    return text;
+  } finally {
+    closeSync(fd);
+  }
+}
+
 /**
  * Read the active context only after transcript and sidecar-anchor validation.
  * Unlike the compatibility `rebuildMessages()` reader, this is allowed to
@@ -2208,30 +2992,29 @@ export function readVerifiedWsTurnState(sessionId, requestId, options = {}) {
 }
 
 /**
- * Return the newest event matching a type/predicate using bounded reverse IO.
- * This is the recovery path for snapshots and ledgers: callers never need to
- * materialize a multi-gigabyte transcript merely to inspect its latest state.
+ * Return the newest event matching a type/predicate after authenticating the
+ * complete transcript and sidecar anchor. Heap remains bounded to one event;
+ * the forward integrity pass is intentionally O(N).
  */
 export function findLatestEvent(sessionId, type, predicate = null) {
   if (isUnsafeSessionId(sessionId)) return null;
-  const filePath = sessionPath(sessionId);
-  if (!existsSync(filePath)) return null;
   const wanted = Array.isArray(type) ? new Set(type) : null;
-  for (const { line } of iterateFileLinesReverseSync(filePath)) {
-    let event;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    const typeMatches = wanted
-      ? wanted.has(event?.type)
-      : type == null || event?.type === type;
-    if (!typeMatches) continue;
-    if (typeof predicate === "function" && !predicate(event)) continue;
-    return event;
-  }
-  return null;
+  return readVerifiedProjection(sessionId, () => {
+    let latest = null;
+    return {
+      accept(event) {
+        const typeMatches = wanted
+          ? wanted.has(event?.type)
+          : type == null || event?.type === type;
+        if (!typeMatches) return;
+        if (typeof predicate === "function" && !predicate(event)) return;
+        latest = event;
+      },
+      finish() {
+        return latest;
+      },
+    };
+  });
 }
 
 /**
@@ -2343,6 +3126,7 @@ function rebuildSessionMetaUnlocked(dir, sessionId, filePath) {
       // a best-effort projection over all intact events.
     }
   }
+  meta.transcript = readPhysicalTranscriptState(filePath);
   return replaceSessionMeta(dir, meta);
 }
 
@@ -2352,7 +3136,30 @@ function rebuildSessionMeta(sessionId) {
   if (!existsSync(filePath)) return null;
   return withFileLock(
     filePath,
-    () => rebuildSessionMetaUnlocked(dir, sessionId, filePath),
+    () => {
+      const verification = verifyTranscriptFile(filePath);
+      const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
+      if (
+        externalAnchor === null &&
+        [
+          TRANSCRIPT_CHAIN_STATUS.LEGACY,
+          TRANSCRIPT_CHAIN_STATUS.PARTIAL,
+        ].includes(verification.status) &&
+        !verification.truncatedTail
+      ) {
+        return rebuildSessionMetaUnlocked(dir, sessionId, filePath);
+      }
+      if (
+        verification.status !== TRANSCRIPT_CHAIN_STATUS.VERIFIED ||
+        verification.malformedLines > 0 ||
+        verification.truncatedTail
+      ) {
+        throw unverifiedTranscriptError(sessionId, verification);
+      }
+      const meta = rebuildSessionMetaUnlocked(dir, sessionId, filePath);
+      assertVerifiedTranscriptAnchor(sessionId, verification);
+      return meta;
+    },
     {
       failIfUnavailable: true,
       timeoutMs: 30_000,
@@ -2425,6 +3232,58 @@ export function listJsonlSessions(options = {}) {
   return indexed;
 }
 
+/**
+ * List canonical namespace occupants for recent-session and picker consumers.
+ * Damaged generations are deliberately represented as blocked rows so a
+ * newer missing/conflicting canonical session cannot disappear and cause an
+ * older legacy conversation to be resumed instead. Tombstones fence duplicate
+ * legacy ids but are not resumable choices unless explicitly requested.
+ */
+export function listSessionAuthoritySummaries(options = {}) {
+  const limit = Math.max(1, Number(options.limit) || 20);
+  const evidenceIds = listSessionEvidenceIds();
+  const readable = new Map(
+    listJsonlSessions({ limit: Math.max(limit, evidenceIds.length) }).map(
+      (item) => [item.id, item],
+    ),
+  );
+  const rows = [];
+  for (const id of evidenceIds) {
+    const presence = getSessionPresence(id);
+    if (
+      presence === SESSION_PRESENCE.ABSENT ||
+      (presence === SESSION_PRESENCE.TOMBSTONED &&
+        options.includeTombstoned !== true)
+    ) {
+      continue;
+    }
+    const item = readable.get(id);
+    const meta = item ? null : readSessionMeta(getSessionsDir(), id);
+    rows.push({
+      ...(item ||
+        publicSessionMeta({
+          ...emptySessionMeta(id),
+          ...(meta || {}),
+          id,
+        })),
+      id,
+      _store: "jsonl",
+      _presence: presence,
+      _blocked: presence !== SESSION_PRESENCE.PRESENT,
+    });
+  }
+  return rows
+    .sort((a, b) => {
+      const delta =
+        (Date.parse(b.updated_at || "") || 0) -
+        (Date.parse(a.updated_at || "") || 0);
+      if (delta !== 0) return delta;
+      if (a._blocked !== b._blocked) return a._blocked ? -1 : 1;
+      return String(b.id).localeCompare(String(a.id));
+    })
+    .slice(0, limit);
+}
+
 /**
  * Rename a session (gap-analysis 2026-07-11 P1 "命名会话"): appends a
  * `session_rename` event so the hash chain stays intact (no rewrite). The
@@ -2447,25 +3306,83 @@ export function deleteJsonlSession(sessionId) {
   if (isUnsafeSessionId(sessionId)) return false;
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath) && !hasLiveSessionWitness(sessionId)) return false;
-  return withFileLock(
+  return withSessionHostWriterLock(
+    sessionId,
     filePath,
     () => {
       const transcriptExists = existsSync(filePath);
-      const existingMeta = readSessionPersistenceWitness(sessionId);
+      let existingMeta = readSessionPersistenceWitness(sessionId);
+      const marker = readSessionTombstoneMarker(getSessionsDir(), sessionId);
+      const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
       if (
         !transcriptExists &&
         (existingMeta === null || existingMeta?.deleted === true)
       ) {
         return false;
       }
+      const deletionWitness =
+        existingMeta?.deleted === true
+          ? existingMeta
+          : sessionAntiRollbackPredecessorWitness(externalAnchor) || marker;
+      if (
+        transcriptExists &&
+        existingMeta === null &&
+        deletionWitness === null
+      ) {
+        const verification = verifyTranscriptFile(filePath);
+        if (
+          verification.status !== TRANSCRIPT_CHAIN_STATUS.VERIFIED ||
+          verification.malformedLines > 0 ||
+          verification.truncatedTail
+        ) {
+          throw unverifiedTranscriptError(sessionId, verification);
+        }
+        rebuildSessionMetaUnlocked(getSessionsDir(), sessionId, filePath);
+        existingMeta = readSessionPersistenceWitness(sessionId);
+      }
+      if (deletionWitness === null) {
+        assertSessionAntiRollbackBeforeWrite(
+          sessionId,
+          existingMeta,
+          filePath,
+          "live",
+        );
+      } else if (existingMeta?.deleted !== true) {
+        existingMeta = replaceSessionMeta(getSessionsDir(), {
+          ...emptySessionMeta(sessionId),
+          id: sessionId,
+          generation: deletionWitness.generation || null,
+          last_hash: deletionWitness.last_hash || null,
+          event_count: Math.max(0, Number(deletionWitness.event_count) || 0),
+          updated_at_ms: Math.max(
+            0,
+            Number(deletionWitness.deleted_at_ms) || Date.now(),
+          ),
+          deleted_at_ms: Math.max(
+            0,
+            Number(deletionWitness.deleted_at_ms) || Date.now(),
+          ),
+          deleted: true,
+          transcript: null,
+        });
+      }
       if (transcriptExists) rmSync(filePath, { force: true });
       try {
-        recordSessionDeleted(getSessionsDir(), sessionId);
+        const tombstone = recordSessionDeleted(getSessionsDir(), sessionId);
+        publishSessionAntiRollbackWitness(
+          sessionId,
+          tombstone,
+          filePath,
+          "deleted",
+        );
       } catch (error) {
         // writeMetaAtomic precedes the activity-journal append. If only the
         // rebuildable journal lock/release failed, the durable sidecar still
         // prevents a stale writer from resurrecting this deleted session.
-        if (readSessionMeta(getSessionsDir(), sessionId)?.deleted !== true) {
+        if (
+          readSessionMeta(getSessionsDir(), sessionId)?.deleted !== true ||
+          readSessionAntiRollbackAnchor(sessionId)?.status !== "deleted"
+        ) {
           throw error;
         }
       }
@@ -2768,12 +3685,22 @@ export function forkSession(sourceId, options = {}) {
               sourceHeadHash: sourceVerification.lastHash,
               sourceEventCount: sourceVerification.chainedEvents,
             };
+            const forkGenerationId = `generation-${createHash("sha256")
+              .update(`fork-generation\0${newId}`, "utf8")
+              .digest("hex")
+              .slice(0, 32)}`;
             const core = {
               type: "system",
               timestamp: Date.now(),
               data: {
                 ...persistedData,
                 [SESSION_FORK_AUTHORITY_FIELD]: forkAuthority,
+                [SESSION_GENERATION_AUTHORITY_FIELD]:
+                  createSessionGenerationAuthority(
+                    newId,
+                    null,
+                    forkGenerationId,
+                  ),
               },
             };
             const hash = computeEventHash(prevHash, core);
@@ -2803,6 +3730,17 @@ export function forkSession(sourceId, options = {}) {
             sourceHeadHash: authority?.sourceHeadHash,
             sourceEventCount: authorityEventCount,
           };
+          const generationAuthority = normalizeSessionGenerationAuthority(
+            target.lineageEvent?.data?.[SESSION_GENERATION_AUTHORITY_FIELD],
+          );
+          const hasGenerationAuthority =
+            target.lineageEvent?.data?.[SESSION_GENERATION_AUTHORITY_FIELD] !==
+            undefined;
+          const generationMatches =
+            !hasGenerationAuthority ||
+            (generationAuthority?.sessionId === newId &&
+              generationAuthority.ordinal === 1 &&
+              generationAuthority.predecessor === null);
           const lineageMatches =
             target.matchingLineageEvents === 1 &&
             target.lineageEvent?.type === "system" &&
@@ -2811,10 +3749,16 @@ export function forkSession(sourceId, options = {}) {
             typeof authority?.sourceHeadHash === "string" &&
             target.lineageEventIndex === creationEventCount &&
             target.lineageEvent?.prevHash === authority.sourceHeadHash &&
+            generationMatches &&
             JSON.stringify(target.lineageEvent?.data) ===
               JSON.stringify({
                 ...persistedData,
                 [SESSION_FORK_AUTHORITY_FIELD]: expectedAuthority,
+                ...(hasGenerationAuthority
+                  ? {
+                      [SESSION_GENERATION_AUTHORITY_FIELD]: generationAuthority,
+                    }
+                  : {}),
               });
           if (
             target.verification.status !== TRANSCRIPT_CHAIN_STATUS.VERIFIED ||
@@ -2976,7 +3920,7 @@ export function createBranchSession({
     provider: typeof cleanMeta.provider === "string" ? cleanMeta.provider : "",
     model: typeof cleanMeta.model === "string" ? cleanMeta.model : "",
   };
-  const plannedEvents = [
+  const digestEvents = [
     { type: "session_start", data: startData },
     {
       type: "session_branch",
@@ -2989,19 +3933,19 @@ export function createBranchSession({
   let count = 0;
   for (const m of canonicalMessages) {
     if (m.role === "user") {
-      plannedEvents.push({
+      digestEvents.push({
         type: "user_message",
         data: { role: "user", content: m.content },
       });
       count += 1;
     } else if (m.role === "assistant") {
-      plannedEvents.push({
+      digestEvents.push({
         type: "assistant_message",
         data: { role: "assistant", content: m.content },
       });
       count += 1;
     } else if (m.role === "system") {
-      plannedEvents.push({
+      digestEvents.push({
         type: "system",
         data: encodePersistedMessage(m),
       });
@@ -3011,8 +3955,27 @@ export function createBranchSession({
     // canonical projection above retains only explicitly durable systems.
   }
   const inputDigest = `sha256:${createHash("sha256")
-    .update(JSON.stringify(plannedEvents), "utf8")
+    .update(JSON.stringify(digestEvents), "utf8")
     .digest("hex")}`;
+  const branchGenerationId = `generation-${createHash("sha256")
+    .update(`branch-generation\0${branchSessionId}`, "utf8")
+    .digest("hex")
+    .slice(0, 32)}`;
+  const plannedEvents = digestEvents.map((event, index) =>
+    index === 0
+      ? {
+          ...event,
+          data: encodeSessionGenerationData(
+            event.data,
+            createSessionGenerationAuthority(
+              branchSessionId,
+              null,
+              branchGenerationId,
+            ),
+          ),
+        }
+      : event,
+  );
   plannedEvents.push({
     type: "session_branch_complete",
     data: {
@@ -3027,6 +3990,23 @@ export function createBranchSession({
   return withFileLock(
     filePath,
     () => {
+      const presence = getSessionPresence(branchSessionId);
+      if (
+        presence === SESSION_PRESENCE.TOMBSTONED ||
+        (presence === SESSION_PRESENCE.CONFLICT &&
+          readSessionTombstoneMarker(sessionsDir, branchSessionId) !== null)
+      ) {
+        throw sessionDeletedError(branchSessionId);
+      }
+      if (
+        presence === SESSION_PRESENCE.MISSING_TRANSCRIPT ||
+        presence === SESSION_PRESENCE.CONFLICT
+      ) {
+        throw unverifiedTranscriptError(
+          branchSessionId,
+          transcriptAnchorMismatchVerification(),
+        );
+      }
       if (existsSync(filePath)) inspectPhysicalTail(filePath);
       let verification = existsSync(filePath)
         ? verifyTranscriptFile(filePath)
@@ -3048,12 +4028,22 @@ export function createBranchSession({
         : [];
       const prefixMatches = existingEvents
         .slice(0, Math.min(existingEvents.length, plannedEvents.length))
-        .every(
-          (event, index) =>
+        .every((event, index) => {
+          let plannedData = plannedEvents[index].data;
+          // Existing v1 branches predate generation authority. They remain
+          // idempotently readable; only newly created branches publish it.
+          if (
+            index === 0 &&
+            event?.data?.[SESSION_GENERATION_AUTHORITY_FIELD] === undefined
+          ) {
+            plannedData = { ...plannedData };
+            delete plannedData[SESSION_GENERATION_AUTHORITY_FIELD];
+          }
+          return (
             event.type === plannedEvents[index].type &&
-            JSON.stringify(event.data) ===
-              JSON.stringify(plannedEvents[index].data),
-        );
+            JSON.stringify(event.data) === JSON.stringify(plannedData)
+          );
+        });
       if (!prefixMatches) {
         const error = new Error(
           `Branch session conflicts with its deterministic input: ${branchSessionId}`,
@@ -3108,6 +4098,9 @@ export function createBranchSession({
       }
 
       let prevHash = verification.lastHash;
+      let expectedTranscriptState = existsSync(filePath)
+        ? readPhysicalTranscriptState(filePath)
+        : null;
       for (
         let index = existingEvents.length;
         index < plannedEvents.length;
@@ -3121,17 +4114,13 @@ export function createBranchSession({
         };
         const hash = computeEventHash(prevHash, core);
         const event = { ...core, prevHash, hash };
-        appendFileSync(filePath, `${JSON.stringify(event)}\n`, {
-          encoding: "utf8",
-          mode: 0o600,
-        });
-        ensurePrivateFile(filePath);
-        runSessionScaleFaultHook("afterTranscriptAppend", {
-          sessionId: branchSessionId,
-          type: planned.type,
+        expectedTranscriptState = appendTranscriptEvent(
+          branchSessionId,
+          planned.type,
           event,
           filePath,
-        });
+          expectedTranscriptState,
+        );
         prevHash = hash;
       }
 
@@ -3170,14 +4159,42 @@ export const SESSION_PRESENCE = Object.freeze({
 
 export function getSessionPresence(sessionId) {
   if (isUnsafeSessionId(sessionId)) return SESSION_PRESENCE.ABSENT;
+  const dir = getSessionsDir();
   const transcriptExists = existsSync(sessionPath(sessionId));
+  const tombstoneMarkerExists = existsSync(
+    join(dir, `${sessionId}${SESSION_TOMBSTONE_MARKER_SUFFIX}`),
+  );
   const witness = readSessionPersistenceWitness(sessionId);
-  if (transcriptExists && witness?.deleted === true) {
+  const externalAnchor = readSessionAntiRollbackAnchor(sessionId);
+  if (
+    transcriptExists &&
+    (witness?.deleted === true ||
+      tombstoneMarkerExists ||
+      externalAnchor?.status === "deleted")
+  ) {
     return SESSION_PRESENCE.CONFLICT;
   }
-  if (transcriptExists) return SESSION_PRESENCE.PRESENT;
-  if (witness?.deleted === true) return SESSION_PRESENCE.TOMBSTONED;
-  if (witness !== null) return SESSION_PRESENCE.MISSING_TRANSCRIPT;
+  if (transcriptExists) {
+    if (witness !== null && witness?.deleted !== true) {
+      assertSessionAntiRollbackBeforeWrite(
+        sessionId,
+        witness,
+        sessionPath(sessionId),
+        "live",
+      );
+    }
+    return SESSION_PRESENCE.PRESENT;
+  }
+  if (
+    witness?.deleted === true ||
+    tombstoneMarkerExists ||
+    externalAnchor?.status === "deleted"
+  ) {
+    return SESSION_PRESENCE.TOMBSTONED;
+  }
+  if (witness !== null || externalAnchor?.status === "live") {
+    return SESSION_PRESENCE.MISSING_TRANSCRIPT;
+  }
   return SESSION_PRESENCE.ABSENT;
 }