mixdog 0.9.37 → 0.9.39

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -5,6 +5,7 @@ import { resolvePluginData } from '../../../../shared/plugin-paths.mjs';
 import { updateJsonAtomicSync, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
 import { promptContentText, isInternalRuntimeNotificationText } from './prompt-utils.mjs';
 import { loadSession } from '../store.mjs';
+import { isDeliveredCompletion, logDuplicateSkip } from './delivered-completions.mjs';
 
 const _sessionPendingMessages = new Map();
 const PENDING_MESSAGES_FILE = 'session-pending-messages.json';
@@ -24,6 +25,31 @@ function isCompletionNotificationEntry(entry) {
         && entry.notificationKind === COMPLETION_NOTIFICATION_KIND;
 }
 
+// Pre-marker completion notifications were persisted as plain strings,
+// indistinguishable from genuine user/steering messages except by their
+// model-visible wrapper shape. Such stale strings must never replay into a
+// resumed session, but they carry no notificationKind marker, so the marker
+// check alone leaves them behind. Because this is a SILENT-drop path, the
+// shared lenient wrapper detector is too broad (a user message quoting a
+// completion card could be dropped), so this uses its OWN strict recognizer:
+// the string must be a verbatim full-card paste and nothing else —
+//   (1) start with the exact instruction preamble + "\n\nResult:\n",
+//   (2) have EVERY non-empty body line quoted with "> " (100%),
+//   (3) carry no extra leading/trailing prose (whitespace-trim only).
+// Conservative by design: a false negative just keeps a legacy string, but a
+// false positive on genuine user text would silently drop a real message.
+const LEGACY_COMPLETION_CARD_PREAMBLE_RE = /^The async \S+ task \S+ has finished \([^)]*\) - review this result in your next step\.\n\nResult:\n/;
+function isLegacyUnmarkedCompletionNotification(entry) {
+    if (typeof entry !== 'string') return false;
+    const value = entry.trim();
+    const match = LEGACY_COMPLETION_CARD_PREAMBLE_RE.exec(value);
+    if (!match) return false;
+    const body = value.slice(match[0].length);
+    const lines = body.split(/\r?\n/).filter((line) => line.length > 0);
+    if (lines.length === 0) return false;
+    return lines.every((line) => line.startsWith('> '));
+}
+
 // Canonical completion-enqueue tagger. Every deferred tool/agent completion
 // notification MUST be enqueued through this so drain can discard it on resume
 // (never replay out-of-order). Pass the model-visible completion text (or an
@@ -393,8 +419,21 @@ export function drainPendingMessages(sessionId) {
     // in-memory queue is empty, so keeping it only ever delivers live entries.
     // Genuine user/steering messages carry no marker and are kept in order in
     // both paths.
-    const memoryKept = memory;
-    const persistedKept = persisted.filter((m) => !isCompletionNotificationEntry(m));
+    // Drain-time belt: drop MARKED in-memory completion entries whose text hash
+    // was already delivered+ACKed (TUI execution-ui) this process — those would
+    // double-inject next turn. Only marked completion entries are eligible;
+    // genuine user/steering entries carry no marker and are always kept.
+    const memoryKept = memory.filter((m) => {
+        if (!isCompletionNotificationEntry(m)) return true;
+        const text = pendingMessageText(m);
+        if (text && isDeliveredCompletion({ text })) {
+            logDuplicateSkip('drain', { text });
+            return false;
+        }
+        return true;
+    });
+    const persistedKept = persisted.filter((m) => !isCompletionNotificationEntry(m)
+        && !isLegacyUnmarkedCompletionNotification(m));
     const memoryVisible = modelVisiblePendingMessages(memoryKept);
     const persistedVisible = modelVisiblePendingMessages(persistedKept);
     if (memoryVisible.length === 0) return persistedVisible;

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -24,7 +24,7 @@ import { _closeBashSessionLazy } from './runtime-loaders.mjs';
  * and recreates the session in its pre-close state.
  *
  * Long-term cleanup: `sweepTombstones()` below unlinks tombstones older than
- * TOMBSTONE_MAX_AGE_MS (24h — vastly longer than any realistic in-flight race).
+ * TOMBSTONE_MAX_AGE_MS (1h — vastly longer than the microsecond in-flight race).
  */
 export function closeSession(id, reason = 'manual', opts = {}) {
     // tombstone=false: detach runtime resources (heartbeat, bash shells,

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -8,12 +8,13 @@ import * as fsp from 'fs/promises';
 import { randomBytes } from 'crypto';
 import { join } from 'path';
 import { Worker } from 'worker_threads';
-import { getPluginData } from '../config.mjs';
+import { getPluginData, loadConfig } from '../config.mjs';
 import { isAgentOwner } from '../agent-owner.mjs';
 import { renameWithRetrySync } from '../../../shared/atomic-file.mjs';
 import { sanitizeContentForStoredHistory } from '../providers/media-normalization.mjs';
 import { scanTopLevelLifecycle } from './lifecycle-scan.mjs';
 import { rotateBoundedLog, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../../../../lib/mixdog-debug.cjs';
+import { resolveAgentTerminalReapMs } from '../../../../session-runtime/config-helpers.mjs';
 import {
     summaryIndexPath,
     _sessionSummary,
@@ -256,7 +257,16 @@ function _flushScheduled(id) {
 // Single long-lived Worker serializes all saveSessionAsync calls.
 // The worker's message queue preserves generation-race ordering.
 let _saveWorker = null;
-let _saveWorkerPending = new Map(); // reqId → { resolve, reject, session, opts }
+// In-flight writes, keyed by reqId. Value: { id, session, opts, waiters:[{resolve,reject}] }.
+// At most ONE entry per session id at a time (single-in-flight-per-id).
+let _saveWorkerPending = new Map();
+// Latest-wins queued payload per session, keyed by id. Value: { session, opts, waiters:[] }.
+// At most ONE queued write per id: a newer saveSessionAsync while a write is in
+// flight overwrites session/opts here and appends its resolver to waiters, so
+// every superseded caller resolves when this single queued write finally lands.
+let _saveAsyncQueued = new Map();
+// id → reqId of the in-flight write for that id (enforces one-in-flight-per-id).
+let _saveAsyncInflight = new Map();
 let _saveWorkerReqId = 0;
 let _saveWorkerRefCount = 0;
 
@@ -273,12 +283,37 @@ function _getOrSpawnWorker() {
         // becomes unref'd again once all in-flight writes settle. _saveWorker
         // null-check covers the error/exit race where the worker died first.
         if (--_saveWorkerRefCount === 0 && _saveWorker) _saveWorker.unref();
-        if (ok) p.resolve();
-        else p.reject(new Error(`[session-store] worker save failed: ${error}`));
+        const { id, waiters } = p;
+        _saveAsyncInflight.delete(id);
+        // Resolve/reject every caller whose payload this write represents
+        // (the originating call plus any that coalesced onto it before it was
+        // posted). A supersede never lands here as a rejection — only a real
+        // worker failure does.
+        if (ok) { for (const w of waiters) w.resolve(); }
+        else {
+            const e = new Error(`[session-store] worker save failed: ${error}`);
+            for (const w of waiters) w.reject(e);
+        }
+        // Promote the latest-wins queued payload (if any) into the now-free
+        // in-flight slot for this id. Runs regardless of ok: the queued write
+        // is a newer, independent payload and must still be attempted so its
+        // (possibly superseded) waiters resolve when it lands.
+        const q = _saveAsyncQueued.get(id);
+        if (q) {
+            _saveAsyncQueued.delete(id);
+            try {
+                _postAsyncWrite(id, q.session, q.opts, q.waiters);
+            } catch (err) {
+                for (const w of q.waiters) w.reject(err);
+            }
+        }
     });
     _saveWorker.on('error', (err) => {
-        for (const [, p] of _saveWorkerPending) p.reject(err);
+        for (const [, p] of _saveWorkerPending) for (const w of p.waiters) w.reject(err);
         _saveWorkerPending.clear();
+        for (const [, q] of _saveAsyncQueued) for (const w of q.waiters) w.reject(err);
+        _saveAsyncQueued.clear();
+        _saveAsyncInflight.clear();
         _saveWorkerRefCount = 0;
         _saveWorker = null;
     });
@@ -290,8 +325,11 @@ function _getOrSpawnWorker() {
         // saveSessionAsync registered a resolver but before the worker
         // received the message.
         const err = new Error(`[session-store] save worker exited with code ${code}`);
-        for (const [, p] of _saveWorkerPending) p.reject(err);
+        for (const [, p] of _saveWorkerPending) for (const w of p.waiters) w.reject(err);
         _saveWorkerPending.clear();
+        for (const [, q] of _saveAsyncQueued) for (const w of q.waiters) w.reject(err);
+        _saveAsyncQueued.clear();
+        _saveAsyncInflight.clear();
         _saveWorkerRefCount = 0;
         _saveWorker = null;
     });
@@ -299,14 +337,45 @@ function _getOrSpawnWorker() {
     return _saveWorker;
 }
 
+/**
+ * Post one in-flight write for `id` to the worker and register it as the
+ * single in-flight entry for that id. Callers guarantee no write is already
+ * in flight for `id`. Throws (after cleaning its own map entries) if the
+ * worker postMessage fails so the caller can reject the affected waiters.
+ */
+function _postAsyncWrite(id, session, opts, waiters) {
+    const reqId = ++_saveWorkerReqId;
+    _saveWorkerPending.set(reqId, { id, session, opts, waiters });
+    _saveAsyncInflight.set(id, reqId);
+    try {
+        const w = _getOrSpawnWorker();
+        w.postMessage({ session, opts, reqId });
+        // Ref AFTER successful postMessage so a queue/throw failure path does
+        // not leave the worker held alive with no pending message. Paired with
+        // the unref in the message handler when count hits 0.
+        if (++_saveWorkerRefCount === 1) w.ref();
+    } catch (err) {
+        _saveWorkerPending.delete(reqId);
+        _saveAsyncInflight.delete(id);
+        throw err;
+    }
+}
+
 /**
  * Async save via a dedicated Worker thread.
  * Errors surface as thrown Errors — callers must not silently swallow them.
+ *
+ * Per-session latest-wins coalescing: for a given id there is at most one
+ * write in flight plus one queued follow-up. N rapid saves for the same id in
+ * a turn collapse to (in-flight + one queued-latest), keeping the single
+ * worker's backlog bounded. Per-id write ORDERING is preserved (a queued write
+ * is only posted once the prior in-flight write for that id settles); different
+ * ids interleave freely as before.
  */
 export function saveSessionAsync(session, opts) {
     _ensureLifecycleFields(session);
     setLiveSession(session);
-    const reqId = ++_saveWorkerReqId;
+    const id = session.id;
     const safeOpts = opts || null;
     // The Worker `postMessage` below structured-clones the whole session on the
     // main thread. `session.liveTurnMessages` (live working transcript) and
@@ -322,18 +391,28 @@ export function saveSessionAsync(session, opts) {
         ? (() => { const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session; return rest; })()
         : session;
     return new Promise((resolve, reject) => {
-        // Persist {session, opts} so drainSessionStore can sync-flush
-        // outstanding writes if process exit interrupts the worker queue.
-        _saveWorkerPending.set(reqId, { resolve, reject, session: clonePayload, opts: safeOpts });
+        const waiter = { resolve, reject };
+        if (_saveAsyncInflight.has(id)) {
+            // A write is already on disk for this id — coalesce into the single
+            // latest-wins queued slot. Existing queued waiters carry over so a
+            // superseded caller resolves when THIS newer write lands (never
+            // hang, never reject on supersede).
+            const q = _saveAsyncQueued.get(id);
+            if (q) {
+                q.session = clonePayload;
+                q.opts = safeOpts;
+                q.waiters.push(waiter);
+            } else {
+                _saveAsyncQueued.set(id, { session: clonePayload, opts: safeOpts, waiters: [waiter] });
+            }
+            return;
+        }
+        // Idle for this id — post immediately as the in-flight write. The
+        // in-flight entry persists {session, opts} so drainSessionStore can
+        // sync-flush outstanding writes if process exit interrupts the queue.
         try {
-            const w = _getOrSpawnWorker();
-            w.postMessage({ session: clonePayload, opts: safeOpts, reqId });
-            // Ref AFTER successful postMessage so a queue/throw failure path
-            // does not leave the worker held alive with no pending message.
-            // Paired with the unref in the message handler when count hits 0.
-            if (++_saveWorkerRefCount === 1) w.ref();
+            _postAsyncWrite(id, clonePayload, safeOpts, [waiter]);
         } catch (err) {
-            _saveWorkerPending.delete(reqId);
             reject(err);
         }
     });
@@ -431,18 +510,35 @@ export function drainSessionStore() {
     // is sync-flushed directly here. The Promise is then rejected so the
     // caller's await site does not leak unresolved (caller is at process
     // exit so the rejection is informational, not actionable).
+    const _drainErr = new Error('[session-store] drain: worker-queue interrupted by process exit');
+    // Flush in-flight writes FIRST, then the latest-wins queued payloads, so
+    // for any id with both an in-flight and a queued write the queued (newest)
+    // state is written LAST and wins on disk — no lost last write.
     for (const [, pending] of _saveWorkerPending) {
-        if (!pending.session) continue;
+        if (pending.session) {
+            try {
+                _saveSessionSync(pending.session, pending.opts);
+            } catch (err) {
+                process.stderr.write(`[session-store] drain worker-queue save failed: ${err?.message}\n`);
+            }
+        }
+        for (const w of pending.waiters) {
+            try { w.reject(_drainErr); } catch { /* best-effort */ }
+        }
+    }
+    for (const [, q] of _saveAsyncQueued) {
         try {
-            _saveSessionSync(pending.session, pending.opts);
+            _saveSessionSync(q.session, q.opts);
         } catch (err) {
             process.stderr.write(`[session-store] drain worker-queue save failed: ${err?.message}\n`);
         }
-        try {
-            pending.reject(new Error('[session-store] drain: worker-queue interrupted by process exit'));
-        } catch { /* best-effort */ }
+        for (const w of q.waiters) {
+            try { w.reject(_drainErr); } catch { /* best-effort */ }
+        }
     }
     _saveWorkerPending.clear();
+    _saveAsyncQueued.clear();
+    _saveAsyncInflight.clear();
     _saveWorkerRefCount = 0;
 }
 
@@ -505,8 +601,37 @@ export function markSessionClosed(id, reason = 'manual') {
     _clearDebounce(id);
     const existing = loadSession(id);
     if (!existing) return null;
-    const newGen = (typeof existing.generation === 'number' ? existing.generation : 0) + 1;
-    const tombstone = { ...existing, closed: true, closedReason: reason, status: 'closed', generation: newGen, updatedAt: Date.now() };
+    // Re-close idempotence: a session that is ALREADY tombstoned keeps its
+    // ORIGINAL close time (updatedAt) and generation. The old code refreshed
+    // updatedAt=Date.now() on every call, so the 5-min idle sweep re-closing a
+    // stale summary row reset the tombstone age each cycle — tombstones never
+    // matured past the sweep threshold (immortality loop). Preserving the
+    // original close time lets the age accumulate so the tombstone sweep can
+    // reclaim it.
+    //
+    // The alreadyClosed / original-close-time / generation decision MUST come
+    // from the ON-DISK JSON, read cache-bypassing — NOT from loadSession(),
+    // which can serve a stale in-memory OPEN payload (a pending debounced save
+    // or a _liveSessions entry) after a late save. Deciding off that stale open
+    // copy would make a re-close of an already-tombstoned session look like a
+    // FIRST close and reset updatedAt+generation, resurrecting the exact
+    // immortality refresh this guard prevents. The disk file is the
+    // authoritative tombstone state.
+    let onDisk = null;
+    try { onDisk = JSON.parse(readFileSync(sessionPath(id), 'utf-8')); }
+    catch { onDisk = null; }
+    const alreadyClosed = onDisk
+        ? (onDisk.closed === true || onDisk.status === 'closed')
+        : (existing.closed === true);
+    // When the on-disk copy is already closed, base the (idempotent) tombstone
+    // rewrite on IT rather than on `existing`, so a stale open in-memory
+    // payload can never clobber the persisted tombstone's content/fields.
+    const base = (alreadyClosed && onDisk) ? onDisk : existing;
+    const closeTime = (alreadyClosed && typeof base.updatedAt === 'number' && base.updatedAt > 0)
+        ? base.updatedAt
+        : Date.now();
+    const newGen = (typeof base.generation === 'number' ? base.generation : 0) + (alreadyClosed ? 0 : 1);
+    const tombstone = { ...base, closed: true, closedReason: alreadyClosed ? (base.closedReason || reason) : reason, status: 'closed', generation: newGen, updatedAt: closeTime };
     // Bypass the queue + guard — this IS the tombstone write.
     const target = sessionPath(id);
     const tmp = target + '.' + randomBytes(6).toString('hex') + '.tmp';
@@ -527,7 +652,10 @@ export function markSessionClosed(id, reason = 'manual') {
     // it reflects the session's full lifetime including the close turn.
     try {
         const _dataDir = getPluginData();
-        if (_dataDir) {
+        // Emit the close metric only on the FIRST close — a re-close of an
+        // already-tombstoned session is a no-op idempotent write and must not
+        // spam the close log or double-count lifetimes.
+        if (_dataDir && !alreadyClosed) {
             const _ts = new Date().toISOString();
             const _lifeMs = (typeof existing.createdAt === 'number' && existing.createdAt > 0)
                 ? (tombstone.updatedAt - existing.createdAt)
@@ -627,16 +755,24 @@ export function deleteSession(id, options = {}) {
     return removed;
 }
 const DEFAULT_SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes idle — aligned with Anthropic 5m messages tier and OpenAI in-memory cache window
-// Completed agents (idle/done/error) live until terminal reap - must
-// match TERMINAL_REAP_MS / _scheduleBridgeReap (3_600_000) in index.mjs and
-// agent stall watchdog, so the store sweep is the durable 1h reaper.
-const AGENT_TERMINAL_TTL_MS = 60 * 60 * 1000;
 const AGENT_TERMINAL_STATUSES = new Set(['idle', 'done', 'error']);
 // Hard wall-clock ceiling for sessions stuck in status='running'. The
 // stream-watchdog should abort stalled streams within ~120s, but if it misses
 // one (process crash, watchdog not started, provider never returned), this
 // backstop reclaims the file so the sweep doesn't leak zombies indefinitely.
 const RUNNING_STALL_MS = 10 * 60 * 1000;
+// Retention cap for resumable OPEN (non-tombstone) sessions. Lead/user resume
+// closes sessions with { tombstone:false } — the runtime detaches but the
+// session JSON stays open/resumable and is never lifecycle-closed, so without
+// a cap the sessions/ dir grows without bound (observed 782 open files). The
+// sweep prunes open sessions past EITHER bound: older than 14d, or beyond the
+// newest 300 (oldest first). The cap targets ONLY ephemeral agent/ownerless
+// sessions — explicit USER-owned conversations are never auto-pruned (deleting
+// a user's history, including the current foreground session which is idle
+// during a gated sweep, is unacceptable). A session with a live runtime entry
+// (options.isSessionLive) is additionally protected as defense-in-depth.
+const RESUMABLE_OPEN_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
+const RESUMABLE_OPEN_MAX_COUNT = 300;
 
 export function listStoredSessions() {
     const dir = getStoreDir();
@@ -705,12 +841,44 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     }
     const maxAge = ttlMs || DEFAULT_SESSION_TTL_MS;
     const sweepIdle = options.sweepIdle !== false;
+    let terminalReapConfig = null;
+    try { terminalReapConfig = loadConfig({ secrets: false }); } catch { /* built-ins remain available */ }
     const tombstoneMaxAgeMs = Number(options.tombstoneMaxAgeMs);
     const sweepTombstones = Number.isFinite(tombstoneMaxAgeMs) && tombstoneMaxAgeMs > 0;
+    // Retention cap for resumable open sessions runs only on the idle sweep
+    // (never on a tombstone-only pass). isSessionLive protects the current /
+    // actively-running sessions from being pruned by the retention cap.
+    const isSessionLive = typeof options.isSessionLive === 'function' ? options.isSessionLive : null;
+    const retainOpen = sweepIdle && options.retainOpenSessions !== false;
+    const _optAge = Number(options.openMaxAgeMs);
+    const _optCount = Number(options.openMaxCount);
+    const openMaxAgeMs = Number.isFinite(_optAge) && _optAge > 0 ? _optAge : RESUMABLE_OPEN_MAX_AGE_MS;
+    const openMaxCount = Number.isFinite(_optCount) && _optCount >= 0 ? _optCount : RESUMABLE_OPEN_MAX_COUNT;
     const dir = getStoreDir();
     if (!existsSync(dir))
         return { cleaned: 0, remaining: 0, details: [], tombstonesCleaned: 0, tombstoneDetails: [], tombstoneErrors: [] };
-    const summaries = listStoredSessionSummaries();
+    // Reconcile the index-derived candidate set with a direct directory scan:
+    // the summary index is a best-effort sidecar that can lag far behind disk
+    // (thousands of on-disk .json files may be absent from a smaller index).
+    // Any such orphan closed+mature tombstone would otherwise be unreachable by
+    // this sweep and accumulate forever. Union the index rows with every
+    // on-disk .json id, deduped by id; synthetic { id } rows are sufficient
+    // because the loop below re-reads all lifecycle truth from disk. This stays
+    // sweep-local and does NOT change listStoredSessionSummaries for other
+    // callers. Steady-state cost is one readdirSync plus cheap per-orphan reads.
+    const indexRows = listStoredSessionSummaries();
+    const summaries = indexRows;
+    try {
+        const seen = new Set();
+        for (const row of indexRows) { if (row?.id) seen.add(row.id); }
+        for (const f of readdirSync(dir)) {
+            if (!f.endsWith('.json')) continue;
+            const id = f.slice(0, -5);
+            if (!id || seen.has(id)) continue;
+            seen.add(id);
+            summaries.push({ id });
+        }
+    } catch { /* dir scan failure — fall back to index rows only */ }
     const now = Date.now();
     let cleaned = 0;
     let remaining = 0;
@@ -718,6 +886,11 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     const details = [];
     const tombstoneDetails = [];
     const tombstoneErrors = [];
+    // Retention-cap bookkeeping: collect surviving open (non-tombstone)
+    // sessions here, then prune oldest-first after the main loop.
+    const openCandidates = [];
+    let openPruned = 0;
+    const openPrunedDetails = [];
     for (const row of summaries) {
         try {
             if (!row?.id) continue;
@@ -733,38 +906,116 @@ export function sweepStaleSessions(ttlMs, options = {}) {
                 const hbPath = join(dir, `${row.id}.hb`);
                 if (existsSync(hbPath)) heartbeatMtime = statSync(hbPath).mtimeMs || 0;
             } catch { /* .hb unavailable — fall back to JSON fields */ }
-            const freshnessGateMs = sweepIdle ? maxAge : (sweepTombstones ? tombstoneMaxAgeMs : 0);
-            const newestKnown = Math.max(row.updatedAt || 0, row.lastHeartbeatAt || 0, row.createdAt || 0, jsonMtime, heartbeatMtime);
-            if (freshnessGateMs > 0 && newestKnown > 0 && now - newestKnown <= freshnessGateMs) {
-                remaining++;
-                continue;
+            // Truth source: the summary index is a deferred/best-effort sidecar,
+            // so a row can still claim status='idle'/open while the session JSON
+            // was already tombstoned. Read the real session JSON BEFORE the
+            // freshness gate so closed-ness is decided from AUTHORITATIVE on-disk
+            // state — otherwise idle-sweep re-closes an already-closed session via
+            // markSessionClosed (which, pre-fix, reset the tombstone age every
+            // 5-min cycle → immortality loop).
+            let raw = null;
+            try { raw = readFileSync(jsonPath, 'utf-8'); }
+            catch { /* racing unlink / transient read failure */ }
+            let actual = null;
+            let diskClosed;
+            if (raw == null) {
+                diskClosed = (row.closed === true || row.status === 'closed');
+            } else {
+                // Cheap top-level scan avoids allocating the whole messages array
+                // just to read the closed flag for the (common) fresh open
+                // session the gate will skip; full-parse only when the scan can't
+                // resolve the top-level flag.
+                const scan = scanTopLevelLifecycle(raw);
+                if (scan && typeof scan.closed === 'boolean') {
+                    diskClosed = scan.closed;
+                } else {
+                    try { actual = JSON.parse(raw); } catch { actual = null; }
+                    diskClosed = actual
+                        ? (actual.closed === true || actual.status === 'closed')
+                        : (row.closed === true || row.status === 'closed');
+                }
             }
-            // Already-closed tombstones are handled here before heartbeat
-            // sidecar checks; they do not need liveness probing.
-            if (row.closed === true || row.status === 'closed') {
-                if (sweepTombstones) {
-                    const updated = Number(row.updatedAt);
-                    const age = now - updated;
-                    if (Number.isFinite(updated) && age >= tombstoneMaxAgeMs) {
-                        try {
-                            if (deleteSession(row.id, { deferSummaryUpdate: true })) {
-                                tombstonesCleaned++;
-                                tombstoneDetails.push({ id: row.id, ageSeconds: Math.floor(age / 1000) });
-                                continue;
-                            }
-                        } catch (err) {
-                            tombstoneErrors.push({ id: row.id, message: err?.message || String(err) });
-                            remaining++;
+            if (diskClosed) {
+                // Closed sessions are EXEMPT from the freshness gate: a tombstone
+                // whose file/hb mtime keeps getting bumped would otherwise stay
+                // perpetually "fresh" and never mature. Maturity is governed ONLY
+                // by the ORIGINAL close time (disk updatedAt, not row.updatedAt
+                // which a stale row may carry from before the close).
+                if (!actual && raw != null) { try { actual = JSON.parse(raw); } catch { actual = null; } }
+                const closedAt = Number(actual?.updatedAt ?? row.updatedAt);
+                const age = now - closedAt;
+                if (sweepTombstones && Number.isFinite(closedAt) && age >= tombstoneMaxAgeMs) {
+                    try {
+                        if (deleteSession(row.id, { deferSummaryUpdate: true })) {
+                            tombstonesCleaned++;
+                            tombstoneDetails.push({ id: row.id, ageSeconds: Math.floor(age / 1000) });
                             continue;
                         }
+                    } catch (err) {
+                        tombstoneErrors.push({ id: row.id, message: err?.message || String(err) });
+                        remaining++;
+                        continue;
                     }
                 }
+                // Repair a stale summary row that still claimed the session was
+                // open: reflect the real closed state so the next sweep sees the
+                // correct closed=true/updatedAt and never re-closes it.
+                if (actual && !(row.closed === true || row.status === 'closed')) {
+                    try { _upsertSessionSummary(actual); } catch { /* best-effort */ }
+                }
                 remaining++;
                 continue;
             }
+            // Parse the open record before its freshness gate: completed agents
+            // use their provider's Advanced terminal duration rather than the
+            // general sweep cadence. A short provider override must therefore
+            // not be hidden behind the default 5-minute gate.
+            if (!actual && raw != null) { try { actual = JSON.parse(raw); } catch { actual = null; } }
+            const gateOwner = (actual && typeof actual.owner === 'string' && actual.owner.length > 0)
+                ? actual.owner : row.owner;
+            const gateStatus = (actual && typeof actual.status === 'string') ? actual.status : row.status;
+            const gateProvider = (actual && typeof actual.provider === 'string') ? actual.provider : row.provider;
+            const isCompletedAgentForGate = isAgentOwner({ owner: gateOwner })
+                && AGENT_TERMINAL_STATUSES.has(gateStatus);
+            const terminalReapMsForGate = isCompletedAgentForGate
+                ? resolveAgentTerminalReapMs(terminalReapConfig, gateProvider)
+                : null;
+            if (isCompletedAgentForGate && terminalReapMsForGate == null) {
+                remaining++;
+                continue;
+            }
+            // Freshness gate — OPEN sessions only (closed sessions handled and
+            // `continue`d above). Recently-touched open sessions are skipped
+            // cheaply here.
+            const freshnessGateMs = sweepIdle
+                ? (terminalReapMsForGate ?? maxAge)
+                : (sweepTombstones ? tombstoneMaxAgeMs : 0);
+            const newestKnown = Math.max(row.updatedAt || 0, row.lastHeartbeatAt || 0, row.createdAt || 0, jsonMtime, heartbeatMtime);
+            if (freshnessGateMs > 0 && newestKnown > 0 && now - newestKnown <= freshnessGateMs) {
+                remaining++;
+                continue;
+            }
+            // Prefer the AUTHORITATIVE on-disk JSON over the best-effort (and
+            // possibly stale) summary row for every open/idle liveness and
+            // ownership decision below — a stale row must not close or prune the
+            // wrong session. Full-parse here if the cheap scan skipped it.
+            if (!actual && raw != null) { try { actual = JSON.parse(raw); } catch { actual = null; } }
+            const effOwner = (actual && typeof actual.owner === 'string' && actual.owner.length > 0)
+                ? actual.owner : row.owner;
+            const ownerRef = { owner: effOwner };
+            const effStatus = (actual && typeof actual.status === 'string') ? actual.status : row.status;
+            const effUpdatedAt = Number(actual?.updatedAt) > 0 ? Number(actual.updatedAt) : (row.updatedAt || 0);
+            const effLastHb = Number(actual?.lastHeartbeatAt) > 0 ? Number(actual.lastHeartbeatAt) : (row.lastHeartbeatAt || 0);
+            const effCreatedAt = Number(actual?.createdAt) > 0 ? Number(actual.createdAt) : (row.createdAt || 0);
+            const effBashId = (actual && actual.implicitBashSessionId) || row.implicitBashSessionId || null;
+            const effProvider = (actual && typeof actual.provider === 'string') ? actual.provider : row.provider;
             // Sweep agent-owned and ownerless (legacy) sessions; skip explicit
-            // user sessions before touching heartbeat sidecars.
-            if (typeof row.owner === 'string' && row.owner.length > 0 && !isAgentOwner(row)) {
+            // user sessions before touching heartbeat sidecars. USER-owned
+            // conversations are NEVER added to the retention-cap candidate set —
+            // the cap must not auto-delete user history (nor the current
+            // foreground session, which is idle during a gated sweep). Only the
+            // ephemeral agent/ownerless sessions below feed the cap.
+            if (typeof effOwner === 'string' && effOwner.length > 0 && !isAgentOwner(ownerRef)) {
                 remaining++;
                 continue;
             }
@@ -775,18 +1026,19 @@ export function sweepStaleSessions(ttlMs, options = {}) {
             // Prefer .hb sidecar mtime — updated at tight cadence (≤5s) without
             // serialising the full JSON, so it reflects true liveness more
             // accurately than the JSON timestamp fields.
-            let lastActive = row.lastHeartbeatAt || row.updatedAt || row.createdAt || 0;
+            let lastActive = effLastHb || effUpdatedAt || effCreatedAt || 0;
             if (heartbeatMtime) lastActive = Math.max(lastActive, heartbeatMtime);
             // Running sessions are normally reaped by the stream-watchdog
             // within ~120s. Skip them here unless they've been silent past
             // RUNNING_STALL_MS, at which point they are treated as zombies.
-            if (row.status === 'running' && now - lastActive <= RUNNING_STALL_MS) {
+            if (effStatus === 'running' && now - lastActive <= RUNNING_STALL_MS) {
                 remaining++;
                 continue;
             }
-            const isCompletedAgent = isAgentOwner(row)
-                && AGENT_TERMINAL_STATUSES.has(row.status);
-            const sessionMaxAge = isCompletedAgent ? AGENT_TERMINAL_TTL_MS : maxAge;
+            const isCompletedAgent = isAgentOwner(ownerRef)
+                && AGENT_TERMINAL_STATUSES.has(effStatus);
+            const terminalReapMs = isCompletedAgent ? terminalReapMsForGate : null;
+            const sessionMaxAge = terminalReapMs ?? maxAge;
             if (now - lastActive > sessionMaxAge) {
                 try { markSessionClosed(row.id, 'idle-sweep'); }
                 catch (err) {
@@ -796,16 +1048,40 @@ export function sweepStaleSessions(ttlMs, options = {}) {
                 cleaned++;
                 details.push({
                     id: row.id,
-                    owner: row.owner || 'unknown',
+                    owner: effOwner || 'unknown',
                     idleMinutes: Math.round((now - lastActive) / 60000),
-                    bashSessionId: row.implicitBashSessionId || null,
+                    bashSessionId: effBashId,
                 });
             } else {
+                if (retainOpen) openCandidates.push({ id: row.id, lastActive });
                 remaining++;
             }
         }
         catch { /* skip corrupt */ }
     }
+    // ── Retention cap: prune resumable open (non-tombstone) sessions ──────────
+    // Newest-first: keep the most recent openMaxCount, prune anything older than
+    // openMaxAgeMs OR beyond the count. Live/current sessions (isSessionLive)
+    // are never pruned but still occupy a kept slot.
+    if (retainOpen && openCandidates.length > 0) {
+        openCandidates.sort((a, b) => (b.lastActive || 0) - (a.lastActive || 0));
+        let kept = 0;
+        for (const c of openCandidates) {
+            if (isSessionLive && isSessionLive(c.id)) { kept++; continue; }
+            const tooOld = openMaxAgeMs > 0 && now - (c.lastActive || 0) > openMaxAgeMs;
+            const overCount = kept >= openMaxCount;
+            if (!tooOld && !overCount) { kept++; continue; }
+            try {
+                if (deleteSession(c.id, { deferSummaryUpdate: true })) {
+                    openPruned++;
+                    openPrunedDetails.push({ id: c.id, ageSeconds: Math.floor((now - (c.lastActive || 0)) / 1000) });
+                    if (remaining > 0) remaining--;
+                } else {
+                    kept++;
+                }
+            } catch { kept++; }
+        }
+    }
     // Orphan .hb reap: a heartbeat sidecar whose .json no longer exists is dead
     // weight once it is also stale (older than maxAge) — the session JSON was
     // swept/closed but the .hb lingered (a pre-fix orphaned heartbeat). The
@@ -825,11 +1101,11 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     // read-modify-write for the whole sweep instead of one per deleted id
     // (the index is multi-MB at scale; per-id rewrites made large sweeps
     // quadratic and stalled boot for seconds).
-    if (tombstoneDetails.length > 0) {
+    if (tombstoneDetails.length > 0 || openPrunedDetails.length > 0) {
         try {
-            const deletedIds = new Set(tombstoneDetails.map((d) => d.id));
+            const deletedIds = new Set([...tombstoneDetails, ...openPrunedDetails].map((d) => d.id));
             _pruneSummaryIndexIds(deletedIds);
         } catch { /* summary index is best-effort */ }
     }
-    return { cleaned, remaining, details, tombstonesCleaned, tombstoneDetails, tombstoneErrors };
+    return { cleaned, remaining, details, tombstonesCleaned, tombstoneDetails, tombstoneErrors, openPruned, openPrunedDetails };
 }