mixdog 1.2.1 → 1.2.3

package/src/runtime/agent/orchestrator/session/store/live-state.mjs

@@ -124,6 +124,29 @@ export function _retireSessionIncarnation(id) {
   if (id) _sessionIncarnations.delete(id);
 }
 
+// ── Delete fence ────────────────────────────────────────────────────────────
+// An explicitly deleted session may still own a running turn whose later saves
+// carry a brand-new write guard and incarnation, so neither the cancellation
+// counter nor the retired incarnation stops them: an absent file reads as
+// "creatable". The fence is the id-level refusal every write-admission check
+// consults. Only explicit user deletes fence (ids are never reused); the cap
+// only ever forgets the oldest, long-settled entries.
+const SESSION_DELETE_FENCE_MAX = 4096;
+const _deleteFence = new Set();
+
+export function fenceSessionWrites(id) {
+  if (!id) return;
+  _deleteFence.delete(id);
+  _deleteFence.add(id);
+  if (_deleteFence.size > SESSION_DELETE_FENCE_MAX) {
+    _deleteFence.delete(_deleteFence.values().next().value);
+  }
+}
+
+export function isSessionWriteFenced(id) {
+  return _deleteFence.has(id);
+}
+
 /** Clear every save marker for an id (successful hard delete). */
 export function _clearSessionSaveState(id) {
   if (!id) return;

package/src/runtime/agent/orchestrator/session/store/paths-heartbeat.mjs

@@ -83,6 +83,13 @@ function _readSidecarOwnerPid(path) {
   }
 }
 
+/** True only when the sidecar recorded an owner pid that no longer exists
+ *  (pid-less legacy sidecars prove nothing and read false). */
+export function isSidecarOwnerDead(path) {
+  const pid = _readSidecarOwnerPid(path);
+  return pid > 0 && !isProcessAlive(pid);
+}
+
 // ── Heartbeat publish ─────────────────────────────────────
 // Lightweight per-session timestamp file (`<id>.hb`) consumed by the
 // status aggregator for fresh-session detection. Decoupled from the
@@ -193,25 +200,74 @@ export function isSessionHeartbeatOwnerDead(id) {
 // writer on the same session file (dual-writer last-save-wins clobbering).
 // Refreshed by the engine share tick (~3s call, throttled here) and cleared
 // on session switch/dispose; staleness covers crashes.
+//
+// Presence is a sidecar OF a session record and never outlives it: it is
+// only published while the record exists, and a publish that loses a race
+// with a deletion (this process or another one unlinked the record and its
+// sidecar while the write was in flight) removes what it just wrote.
 const _PRESENCE_THROTTLE_MS = 20_000;
 const _presenceLastAt = new Map();
+// id -> in-flight publish; deleteSessionPresence cancels it so the write that
+// lands after the unlink is removed again instead of resurrecting the file.
+const _presenceInFlight = new Map();
 
 function _presencePath(id) {
   return _sessionFilePath(id, '.own');
 }
 
+async function _sessionRecordExists(id) {
+  try {
+    await fsp.stat(sessionPath(id));
+    return true;
+  } catch (error) {
+    // Only a proven absence stops the beacon; an unreadable stat keeps it.
+    return error?.code !== 'ENOENT';
+  }
+}
+
+async function _publishPresence(id, now, flight) {
+  try {
+    // A record that does not exist (never saved yet, or deleted) gets no
+    // beacon; the throttle stays open so the next tick retries.
+    if (!(await _sessionRecordExists(id)) || flight.cancelled) {
+      if (_presenceLastAt.get(id) === now) _presenceLastAt.delete(id);
+      return;
+    }
+    const target = _presencePath(id);
+    await fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8');
+    if (flight.cancelled || !(await _sessionRecordExists(id))) {
+      await fsp.unlink(target).catch(() => {});
+      if (_presenceLastAt.get(id) === now) _presenceLastAt.delete(id);
+    }
+  } catch {
+    /* best-effort beacon */
+  } finally {
+    if (_presenceInFlight.get(id) === flight) _presenceInFlight.delete(id);
+  }
+}
+
 export function publishSessionPresence(id, ts) {
   if (!id) return;
   const now = ts || Date.now();
   const last = _presenceLastAt.get(id) || 0;
   if (now - last < _PRESENCE_THROTTLE_MS) return;
-  const target = _presencePath(id);
+  if (_presenceInFlight.has(id)) return;
+  _assertSessionId(id);
   _presenceLastAt.set(id, now);
-  void fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8').catch(() => {});
+  const flight = { cancelled: false, done: null };
+  _presenceInFlight.set(id, flight);
+  flight.done = _publishPresence(id, now, flight);
+}
+
+/** Test/drain seam: resolves once the id's in-flight presence publish settled. */
+export function settleSessionPresence(id) {
+  return _presenceInFlight.get(id)?.done || Promise.resolve();
 }
 
 export function deleteSessionPresence(id) {
   if (!id) return;
+  const flight = _presenceInFlight.get(id);
+  if (flight) flight.cancelled = true;
   try {
     unlinkSync(_presencePath(id));
   } catch {

package/src/runtime/agent/orchestrator/session/store/save-worker.mjs

@@ -1,5 +1,5 @@
 import { MessageChannel, Worker } from 'node:worker_threads';
-import { guardedSaveOptions as _guardedSaveOptions } from './write-guards.mjs';
+import { guardedSaveOptions as _guardedSaveOptions, releaseSessionWriteControl } from './write-guards.mjs';
 import { _ensureLifecycleFields } from './serialize.mjs';
 import {
   _attemptEvidence,
@@ -63,9 +63,12 @@ export { _hasSessionSaveBaseline } from './save-delta.mjs';
  * the writes, so a write already posted for `id` still lands first; the next
  * save for `id`, if any, simply goes out as a full snapshot.
  */
-export function forgetSessionSaveBaseline(id) {
+export function forgetSessionSaveBaseline(id, { releaseWriteControl = false } = {}) {
   if (!id) return false;
   const had = _dropDeltaBaseline(id);
+  // Only when the session itself is gone (close/teardown/delete): a mid-life
+  // forget (compaction) must keep the landed-epoch fence for in-flight writes.
+  if (releaseWriteControl) releaseSessionWriteControl(String(id));
   if (_saveWorker) {
     try {
       _saveWorker.postMessage({ __forgetBase: String(id) });
@@ -854,7 +857,7 @@ export function purgeSessionSaveBookkeeping(id) {
     }
   }
   // Also frees the worker-side base: a deleted id never saves again.
-  forgetSessionSaveBaseline(id);
+  forgetSessionSaveBaseline(id, { releaseWriteControl: true });
   return purged;
 }
 

package/src/runtime/agent/orchestrator/session/store/session-delete.mjs

@@ -4,10 +4,11 @@
  * edge plus the full local-state purge that must happen under the same lock
  * (incarnation retirement, pending slots, purge hooks, markers, summary row).
  */
-import { readFileSync, readdirSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
+import { unlinkSync } from 'node:fs';
 import { isAgentOwner } from '../../agent-owner.mjs';
-import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle-scan.mjs';
+import { listStoredAgentWorkerLinks } from '../store-agent-worker-rows.mjs';
+import { listStoredSessionSummaries } from './listing.mjs';
+import { STORED_SESSION_UNREADABLE, _storedSessionFromFile } from './serialize.mjs';
 import { getStoreDir, sessionPath, deleteSessionPresence } from './paths-heartbeat.mjs';
 import {
   readCanonicalSessionRecord as _readCanonicalRecord,
@@ -22,49 +23,58 @@ import {
 } from './write-guards.mjs';
 import {
   _clearLiveSession,
+  _liveSessions,
   _retireSessionIncarnation,
   _clearSessionSaveState,
   clearSessionLifecycleCommitError,
+  fenceSessionWrites,
 } from './live-state.mjs';
 import { purgeSessionSaveBookkeeping as _purgeSessionSaveBookkeeping } from './save-worker.mjs';
-import { _uncacheSessionSummary, _queueSessionSummaryRemoval } from './summary-cache.mjs';
+import { _uncacheSessionSummary, _queueSessionSummaryRemoval, _cachedSummaryRows } from './summary-cache.mjs';
 import { _savePending, _clearDebounce, _releasePendingSlot } from './pending-saves.mjs';
 import { _runtimeLivenessVeto, _heartbeatLivenessVeto, _deleteHeartbeatUnlessNewer } from './liveness-veto.mjs';
 import { _runSessionPurgeHooks } from './session-observers.mjs';
 import { deleteCompactionArchive } from '../compaction-archive.mjs';
 
-/** Strictly enumerate child-agent session files linked to one visible parent.
- * Used only by explicit parent deletion; ordinary close/context switches keep
- * the relationship intact. */
+/** Child-agent session ids linked to one visible parent. Candidates come from
+ * metadata only (the summary rows and the agent-worker links — no folder
+ * scan); each candidate's own file is then read strictly and must still be an
+ * agent-owned record linked to this parent, so a stale/foreign metadata row
+ * can never name a deletion target. Used only by explicit parent deletion;
+ * ordinary close/context switches keep the relationship intact. */
 export function listOwnedAgentSessionIds(ownerSessionId) {
   const ownerId = String(ownerSessionId || '').trim();
   if (!/^[A-Za-z0-9_-]+$/.test(ownerId)) return [];
-  const dir = getStoreDir();
-  if (probePath(dir).state !== PROBE_PRESENT) return [];
-  let files;
-  try {
-    files = readdirSync(dir).filter((file) => file.endsWith('.json'));
-  } catch {
-    return [];
+  const linksTo = (row) => row?.ownerSessionId === ownerId || row?.parentSessionId === ownerId;
+  const candidates = new Set();
+  for (const row of [...listStoredSessionSummaries(), ...listStoredAgentWorkerLinks()]) {
+    const candidateId = String(row?.id || row?.sessionId || '').trim();
+    if (linksTo(row) && candidateId !== ownerId && /^[A-Za-z0-9_-]+$/.test(candidateId)) {
+      candidates.add(candidateId);
+    }
   }
+  const dir = getStoreDir();
   const ids = [];
-  for (const file of files) {
-    const candidateId = file.slice(0, -5);
-    if (!candidateId || candidateId === ownerId || !/^[A-Za-z0-9_-]+$/.test(candidateId)) continue;
-    try {
-      const record = readTopLevelLifecycleRecord(readFileSync(join(dir, file), 'utf8'));
-      if (isLifecycleUnreadable(record) || record.id !== candidateId) continue;
-      const session = record.doc;
-      if (!isAgentOwner(session)) continue;
-      const linkedOwner = String(session.ownerSessionId || session.parentSessionId || '').trim();
-      if (linkedOwner === ownerId) ids.push(candidateId);
-    } catch {
-      /* unreadable/vanished records are never deletion targets */
-    }
+  for (const candidateId of candidates) {
+    const session = _storedSessionFromFile(dir, `${candidateId}.json`, false);
+    // Unreadable, vanished, corrupt or foreign records are never deletion targets.
+    if (!session || session === STORED_SESSION_UNREADABLE || !isAgentOwner(session)) continue;
+    const linkedOwner = String(session.ownerSessionId || session.parentSessionId || '').trim();
+    if (linkedOwner === ownerId) ids.push(candidateId);
   }
   return ids;
 }
 
+/** Working folders the session is known to have used (its cached summary row
+ *  and live snapshot — no file read, no scan); the purge hooks derive
+ *  per-folder artifacts such as the transcript path from them. */
+function knownSessionCwds(id) {
+  const row = _cachedSummaryRows()?.find((candidate) => candidate.id === id);
+  const live = _liveSessions.get(id);
+  const cwds = [row?.cwd, row?.workspace?.cwd, row?.workspace?.projectPath, live?.cwd];
+  return [...new Set(cwds.filter((cwd) => typeof cwd === 'string' && cwd))];
+}
+
 export function deleteSession(id, options = {}) {
   // Keep caller probes and all vetoes ahead of the non-reentrant lock and
   // ahead of pending-save disruption, matching markSessionClosed().
@@ -122,12 +132,15 @@ export function deleteSession(id, options = {}) {
     // its settlement moves no marker and touches no bookkeeping — and a
     // re-created id gets a brand new incarnation of its own.
     _retireSessionIncarnation(id);
+    // An explicit user delete also fences the id: a still-running turn's later
+    // saves get fresh guards/incarnations and would otherwise recreate the file.
+    if (options.fenceWrites === true) fenceSessionWrites(id);
     _cancelSessionWrites(id);
     _clearDebounce(id);
     _releasePendingSlot(_savePending.get(id));
     _savePending.delete(id);
     _purgeSessionSaveBookkeeping(id);
-    _runSessionPurgeHooks(id);
+    _runSessionPurgeHooks(id, { cwds: knownSessionCwds(id) });
     // Preserve a sidecar published strictly after the sweep's scan snapshot.
     _deleteHeartbeatUnlessNewer(id, options);
     deleteSessionPresence(id);

package/src/runtime/agent/orchestrator/session/store/session-observers.mjs

@@ -44,10 +44,12 @@ export function _publishLiveSession(session) {
 
 _setLiveSessionPublisher(_publishLiveSession);
 
-export function _runSessionPurgeHooks(id) {
+/** `context` (optional, e.g. `{ cwds }`: working folders the session is known
+ *  to have used) is passed to every hook as its second argument. */
+export function _runSessionPurgeHooks(id, context) {
   for (const hook of _sessionPurgeHooks) {
     try {
-      hook(id);
+      hook(id, context);
     } catch {
       /* a cleanup hook never breaks delete */
     }

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-finish.mjs

@@ -7,6 +7,11 @@ import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSummaryIndexPrune } from '../summary-cache.mjs';
 import { deleteSession } from '../session-delete.mjs';
 import { COMPACTION_ARCHIVE_SUFFIX } from '../../compaction-archive.mjs';
+import { isSidecarOwnerDead } from '../paths-heartbeat.mjs';
+
+// A live presence owner rewrites `.own` every ~20s; one untouched for the
+// attach guard's whole freshness window holds nothing open.
+const PRESENCE_ORPHAN_AGE_MS = 2 * 60 * 1000;
 
 /** Retention cap: prune resumable open (non-tombstone) sessions newest-first
  *  — keep the most recent openMaxCount, prune anything older than openMaxAgeMs
@@ -68,7 +73,13 @@ export function* reapOrphanSidecars({ plan, dir, now, tally }) {
       if (probePath(join(dir, recordOf(h))).state !== PROBE_ABSENT) continue;
       const sidecarProbe = probePath(join(dir, h));
       if (sidecarProbe.state !== PROBE_PRESENT) continue;
-      if (now - sidecarProbe.mtimeMs > plan.maxAge) {
+      // A presence sidecar is only ever published while its record exists,
+      // so one without a record whose recorded owner is dead (or which no
+      // live owner refreshed within the presence window) is a leftover of a
+      // deleted session, not a session mid-create.
+      const orphanPresence =
+        h.endsWith('.own') && (now - sidecarProbe.mtimeMs > PRESENCE_ORPHAN_AGE_MS || isSidecarOwnerDead(join(dir, h)));
+      if (orphanPresence || now - sidecarProbe.mtimeMs > plan.maxAge) {
         try {
           unlinkSync(join(dir, h));
           tally.cleaned++;

package/src/runtime/agent/orchestrator/session/store/write-admission.mjs

@@ -14,6 +14,7 @@ import {
 } from './canonical-reader.mjs';
 import { isCancelledWrite as _isCancelledWrite } from './write-guards.mjs';
 import { _setSessionWriteAuthorityCheck } from './save-worker.mjs';
+import { isSessionWriteFenced } from './live-state.mjs';
 
 const _observeStamp = (target) => {
   try {
@@ -71,7 +72,7 @@ function _writeAuthorityRecord(target, attempt) {
  * under their own authority read).
  */
 export function _shouldDrop(id, opts, attempt = null) {
-  if (_isCancelledWrite(opts)) return true;
+  if (_isCancelledWrite(opts) || isSessionWriteFenced(id)) return true;
   const expected = typeof opts?.expectedGeneration === 'number' ? opts.expectedGeneration : null;
   const target = sessionPath(id);
   let record;
@@ -126,6 +127,7 @@ export function _shouldDrop(id, opts, attempt = null) {
 // under the lock by _shouldDrop.
 export function _sessionWriteAuthorityRefusal(id, attempt = null) {
   if (!id) return null;
+  if (isSessionWriteFenced(id)) return 'deleted';
   let authority;
   try {
     // A synchronous save passes its `attempt`: its pre-admission is then the

package/src/runtime/agent/orchestrator/session/store/write-guards.mjs

@@ -49,6 +49,22 @@ export function guardedSaveOptions(id, opts, epoch = null) {
   };
 }
 
+/**
+ * Drop the id's control buffer once the session is gone (close/forget/delete)
+ * so the map does not grow by one SharedArrayBuffer per session ever saved.
+ * Kept while a commit holds the lock: that write still serialises on this
+ * buffer. A later save for the same id simply allocates a fresh control.
+ */
+export function releaseSessionWriteControl(id) {
+  const control = _writeControls.get(id);
+  if (!control || Atomics.load(control, 1) !== 0) return false;
+  return _writeControls.delete(id);
+}
+
+export function _hasSessionWriteControl(id) {
+  return _writeControls.has(id);
+}
+
 export function cancelSessionWrites(id) {
   Atomics.add(writeControl(id), 0, 1);
 }

package/src/runtime/agent/orchestrator/session/store-agent-worker-rows.mjs

@@ -106,13 +106,25 @@ function agentStatusValues(row) {
     .filter((status, index, values) => Boolean(status) && values.indexOf(status) === index);
 }
 
+/** The worker's lifecycle. `status` decides; `stage` is only the runtime phase
+ *  copied in by the progress sweep, so mid-work it may read idle/done/error
+ *  beside a worker that is still running. Only a row with no status falls
+ *  back to its stage. */
+function workerLifecycle(row) {
+  return cleanValue(row?.status) || cleanValue(row?.stage);
+}
+
 function activeAgentWorker(row) {
-  const statuses = agentStatusValues(row);
-  return (
-    statuses.length > 0 &&
-    !statuses.some((status) => DEAD_AGENT_STATUS.test(status)) &&
-    statuses.some((status) => LIVING_AGENT_STATUS.test(status))
-  );
+  // A cancel in either field ends the work (bare `cancelling` is still work).
+  if (
+    agentStatusValues(row).some(
+      (status) => CANCELLED_AGENT_STATUS.test(status) || CANCEL_UNCONFIRMED_AGENT_STATUS.test(status)
+    )
+  ) {
+    return false;
+  }
+  const lifecycle = workerLifecycle(row);
+  return Boolean(lifecycle) && !DEAD_AGENT_STATUS.test(lifecycle) && LIVING_AGENT_STATUS.test(lifecycle);
 }
 
 function stampMs(value) {
@@ -287,7 +299,7 @@ const withinPoolWindow = (at, now) => at > 0 && now - at <= AGENT_POOL_HEARTBEAT
  *  a working status whose own stamp is still inside the pool window. */
 function poolRowWorking(row, heartbeatMtimes, now) {
   if (withinPoolWindow(heartbeatMtimes.get(cleanValue(row?.sessionId)) || 0, now)) return true;
-  if (!WORKING_AGENT_STATUS.test(cleanValue(row?.stage || row?.status))) return false;
+  if (!WORKING_AGENT_STATUS.test(workerLifecycle(row))) return false;
   return withinPoolWindow(Date.parse(cleanValue(row?.updatedAt)) || 0, now);
 }
 
@@ -307,7 +319,7 @@ function projectChildWorkerRow(row, { now, heartbeatMtimes }) {
   const session = readWorkerSessionHeader(sessionId);
   const declaredStatus = cleanValue(row.status) || 'running';
   const declaredStage = cleanValue(row.stage || row.status) || 'running';
-  const declaredWorking = WORKING_AGENT_STATUS.test(declaredStatus) || WORKING_AGENT_STATUS.test(declaredStage);
+  const declaredWorking = WORKING_AGENT_STATUS.test(workerLifecycle(row) || 'running');
   const heartbeatFresh = withinPoolWindow(heartbeatMtimes.get(sessionId) || 0, now);
   const recentlyUpdated = withinPoolWindow(Date.parse(cleanValue(row.updatedAt)) || 0, now);
   const runtimePid = positiveNumber(row.runtimePid, 0);
@@ -414,7 +426,7 @@ function promoteHeartbeatSidecar(bySessionId, sessionId, heartbeatAt) {
     bySessionId.set(sessionId, sidecarWorkerRow(current, session, { ...identity, status: cancel.status }));
     return;
   }
-  const currentStatus = cleanValue(current.stage || current.status);
+  const currentStatus = workerLifecycle(current);
   if (currentStatus && !WORKING_AGENT_STATUS.test(currentStatus)) return;
   // The sidecar is the live lease. Durable child sessions are intentionally
   // detached/closed while their external owner runs.
@@ -452,7 +464,7 @@ function projectLeadWorkerRow(row, { now, heartbeatMtimes }) {
   const heartbeatAt = heartbeatMtimes.get(sessionId) || 0;
   const heartbeatFresh = withinPoolWindow(heartbeatAt, now);
   const recentlyUpdated = withinPoolWindow(Date.parse(cleanValue(row.updatedAt)) || 0, now);
-  const declaredStatus = cleanValue(row.stage || row.status) || 'idle';
+  const declaredStatus = workerLifecycle(row) || 'idle';
   const working = WORKING_AGENT_STATUS.test(declaredStatus) && (heartbeatFresh || recentlyUpdated);
   const reapAt = Date.parse(cleanValue(row.reapAt)) || 0;
   if (!heartbeatFresh && reapAt > 0 && now >= reapAt) return null;

package/src/runtime/agent/orchestrator/session/store-summary-archived-agent.mjs

@@ -7,13 +7,17 @@
  * `label`, `agent`, `provider`, `model`, `effort`, `fast`, `finished`) and the
  * "\n\nResult:\n" marker are the wire format the notification writer emits;
  * they are matched verbatim.
+ *
+ * Only the parent(s) named by metadata are read — never the sessions
+ * directory: every vanished id reaches this path (deleted Lead records too),
+ * and a synchronous scan of every session file froze the daemon loop.
  */
-import { readFileSync, readdirSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { probePath, PROBE_PRESENT } from './store/fs-probe.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from './lifecycle-scan.mjs';
 import { dataDir } from './store-summary-locations.mjs';
-import { cleanValue, desktopSession, positiveNumber } from './store-summary-fields.mjs';
+import { listStoredAgentWorkerLinks } from './store-agent-worker-rows.mjs';
+import { cleanValue, desktopSession, isStoredSessionId, positiveNumber } from './store-summary-fields.mjs';
 
 function archivedAgentNotification(content, sessionId) {
   const text = typeof content === 'string' ? content : '';
@@ -52,23 +56,38 @@ function archivedAgentNotification(content, sessionId) {
   };
 }
 
+/** Parent session ids metadata names for `sessionId`: its agent-workers.json
+ *  link and its summary-catalog row (`catalogRow(id)`, optional). */
+function parentSessionIds(sessionId, catalogRow) {
+  const parents = new Set();
+  for (const link of listStoredAgentWorkerLinks()) {
+    if (link.sessionId !== sessionId) continue;
+    parents.add(link.parentSessionId);
+    parents.add(link.ownerSessionId);
+  }
+  const row = typeof catalogRow === 'function' ? catalogRow(sessionId) : null;
+  if (row) {
+    parents.add(cleanValue(row.parentSessionId));
+    parents.add(cleanValue(row.ownerSessionId));
+  }
+  parents.delete(sessionId);
+  return [...parents].filter(isStoredSessionId);
+}
+
 /** Legacy recovery for child transcripts already unlinked by terminal reaping.
- * The parent owns one canonical body-carrying completion notification, so scan
- * only files containing the exact child id and project the newest valid body. */
-export function readArchivedAgentResult(sessionId) {
+ * The parent owns one canonical body-carrying completion notification: read
+ * only the parent(s) metadata links the child to, asynchronously, and project
+ * the newest valid body. An id with no parent link (a deleted Lead record)
+ * resolves to null without touching any session file. */
+export async function readArchivedAgentResult(sessionId, { catalogRow } = {}) {
+  const parents = parentSessionIds(sessionId, catalogRow);
+  if (parents.length === 0) return null;
   const dir = join(dataDir(), 'sessions');
-  if (probePath(dir).state !== PROBE_PRESENT) return null;
-  let files;
-  try {
-    files = readdirSync(dir).filter((file) => file.endsWith('.json'));
-  } catch {
-    return null;
-  }
   let best = null;
-  for (const file of files) {
+  for (const parentId of parents) {
     let raw;
     try {
-      raw = readFileSync(join(dir, file), 'utf8');
+      raw = await readFile(join(dir, `${parentId}.json`), 'utf8');
     } catch {
       continue;
     }

package/src/runtime/agent/orchestrator/session/store-summary-catalog.mjs

@@ -21,10 +21,13 @@ import { dataDir } from './store-summary-locations.mjs';
 import {
   desktopSession,
   importKey,
+  inheritedFromSessionId,
   isStoredSessionId,
   positiveNumber,
+  realTurnCount,
   workspaceSummary,
 } from './store-summary-fields.mjs';
+import { isRealTurnMessage } from './compact/user-message-kind.mjs';
 import { byActivityThenId } from './catalog-db/schema.mjs';
 import {
   sessionStampOf,
@@ -181,6 +184,7 @@ export function normalizedRow(row, heartbeatAt = 0) {
     permission: row.permission || null,
     toolPermission: row.toolPermission || null,
     messageCount: Math.max(0, Math.floor(Number(row.messageCount) || 0)),
+    realTurnCount: realTurnCount(row),
     title: cleanText(row.title, 100),
     preview: cleanText(row.preview),
     generation: typeof row.generation === 'number' ? row.generation : 0,
@@ -188,6 +192,7 @@ export function normalizedRow(row, heartbeatAt = 0) {
     storageSize: positiveNumber(row.storageSize, 0),
     detachedReason: row.detachedReason || null,
     importKey: importKey(row),
+    inheritedFromSessionId: inheritedFromSessionId(row),
   };
 }
 
@@ -238,6 +243,7 @@ function rowFromSession(session, heartbeatAt = 0) {
     {
       ...session,
       messageCount: messages.filter((message) => message?.role === 'user' || message?.role === 'assistant').length,
+      realTurnCount: messages.filter(isRealTurnMessage).length,
       preview,
     },
     heartbeatAt

package/src/runtime/agent/orchestrator/session/store-summary-fields.mjs

@@ -50,6 +50,19 @@ export function workspaceSummary(value) {
 
 /** Dedupe key of an imported conversation: a session's `importOrigin.key`,
  *  or a summary row's projected `importKey`; null for ordinary sessions. */
+export function inheritedFromSessionId(value) {
+  const id = typeof value?.inheritedFromSessionId === 'string' ? value.inheritedFromSessionId.trim() : '';
+  return id || null;
+}
+
+/** Count of real human turns a session persisted (actual user instructions
+ *  plus compact summaries, which stand for earlier human turns); null for a
+ *  row written before the field existed. */
+export function realTurnCount(value) {
+  const count = value?.realTurnCount;
+  return typeof count === 'number' && Number.isFinite(count) && count >= 0 ? Math.floor(count) : null;
+}
+
 export function importKey(value) {
   const key = typeof value?.importKey === 'string' ? value.importKey : value?.importOrigin?.key;
   return typeof key === 'string' && key.trim() ? key : null;

package/src/runtime/agent/orchestrator/session/store-summary-index.mjs

@@ -20,10 +20,13 @@ import { cleanSessionPreview, isSessionPreviewNoise, sessionMessageText } from '
 import { sessionVisibility } from './store-summary-visibility.mjs';
 import {
   importKey,
+  inheritedFromSessionId,
   isStoredSessionId,
   positiveNumber as _positiveNumber,
+  realTurnCount,
   workspaceSummary,
 } from './store-summary-fields.mjs';
+import { isRealTurnMessage } from './compact/user-message-kind.mjs';
 
 export const SESSION_SUMMARY_INDEX_VERSION = 2;
 
@@ -91,6 +94,7 @@ function _sessionMessageProjection(session) {
   const cached = session && typeof session === 'object' ? sessionMessageProjectionMemo.get(session) : null;
   let start = 0;
   let count = 0;
+  let real = 0;
   let preview = '';
   let previewMessage = null;
   const canAppend =
@@ -100,6 +104,7 @@ function _sessionMessageProjection(session) {
   if (canAppend) {
     start = cached.length;
     count = cached.count;
+    real = cached.real;
     preview = cached.preview;
     previewMessage = cached.previewMessage;
     // The first real user message is stable in normal append-only session
@@ -111,6 +116,7 @@ function _sessionMessageProjection(session) {
       else {
         start = 0;
         count = 0;
+        real = 0;
         preview = '';
         previewMessage = null;
       }
@@ -119,6 +125,7 @@ function _sessionMessageProjection(session) {
   for (let index = start; index < messages.length; index += 1) {
     const message = messages[index];
     if (message && (message.role === 'user' || message.role === 'assistant')) count += 1;
+    if (isRealTurnMessage(message)) real += 1;
     if (!preview) {
       const candidate = _previewFromMessage(message);
       if (candidate) {
@@ -132,11 +139,12 @@ function _sessionMessageProjection(session) {
       length: messages.length,
       lastMessage: messages[messages.length - 1] || null,
       count,
+      real,
       preview,
       previewMessage,
     });
   }
-  return { count, preview };
+  return { count, real, preview };
 }
 
 function _desktopSessionSummary(value, cwd = null) {
@@ -198,6 +206,7 @@ export function _sessionSummary(session) {
       : null,
     taskType: session.taskType || null,
     messageCount: messageProjection.count,
+    realTurnCount: messageProjection.real,
     title: _cleanPreview(session.title || '', 100),
     preview: messageProjection.preview,
     generation: typeof session.generation === 'number' ? session.generation : 0,
@@ -209,6 +218,7 @@ export function _sessionSummary(session) {
     // Imported-conversation identity, so "already imported" is answered
     // from summaries without loading sessions.
     importKey: importKey(session),
+    inheritedFromSessionId: inheritedFromSessionId(session),
   };
 }
 
@@ -251,6 +261,7 @@ function _normalizeSummaryRow(row) {
       : null,
     taskType: row.taskType || null,
     messageCount: Math.max(0, Math.floor(Number(row.messageCount) || 0)),
+    realTurnCount: realTurnCount(row),
     title: _cleanPreview(row.title || '', 100),
     preview: _cleanPreview(row.preview || ''),
     generation: typeof row.generation === 'number' ? row.generation : 0,
@@ -258,6 +269,7 @@ function _normalizeSummaryRow(row) {
     storageSize: _positiveNumber(row.storageSize, 0),
     detachedReason: row.detachedReason || null,
     importKey: importKey(row),
+    inheritedFromSessionId: inheritedFromSessionId(row),
   };
 }