mixdog 1.2.2 → 1.2.3

package/src/runtime/agent/orchestrator/session/side-question-store.mjs

@@ -0,0 +1,96 @@
+// side-question-store.mjs — the in-memory state behind /btw side questions:
+// per session, the latest provider request the main loop sent (the request a
+// side question forks) and the side question in flight. It holds live
+// provider/tool objects, so it never reaches the session record or disk.
+import { isAgentOwner } from '../agent-owner.mjs';
+
+// sessionId -> { provider, model, messages, tools, opts, response }
+const requests = new Map();
+// sessionId -> AbortController of the side question in flight.
+const inFlight = new Map();
+
+// Send options that steer the live loop rather than shape the request: its
+// abort signal, a one-shot cache-break trace tag and the per-request stall
+// budget. A forced tool choice is dropped too (a side question must be able
+// to answer in text); the hard-cap `none` choice is kept.
+const LOOP_ONLY_OPTIONS = new Set(['signal', 'cacheBreakIntent', '_stallRetryBudget', 'toolChoice']);
+
+function requestOptions(opts) {
+  const out = {};
+  for (const [key, value] of Object.entries(opts || {})) {
+    if (typeof value === 'function' || LOOP_ONLY_OPTIONS.has(key)) continue;
+    out[key] = value;
+  }
+  if (opts?.toolChoice === 'none') out.toolChoice = 'none';
+  return out;
+}
+
+/** A request in the stored shape: its own message list and only the send
+ *  options a fork may reuse. `response` is null until the reply settles. */
+export function sideQuestionRequestSnapshot({ provider, model, messages, tools, opts }) {
+  return {
+    provider,
+    model,
+    messages: [...messages],
+    tools: Array.isArray(tools) ? tools : [],
+    opts: requestOptions(opts),
+    response: null,
+  };
+}
+
+/**
+ * Record a provider request the main loop is sending as the session's latest
+ * one. Agent sessions record nothing (/btw is a Lead command). The handle
+ * attaches the reply once the send proceeds, or puts the previous request
+ * back when this one fails, so only a successfully sent request is kept.
+ */
+export function captureSideQuestionRequest({ sessionId, sessionRef, provider, model, messages, tools, opts }) {
+  if (!sessionId || !provider || isAgentOwner(sessionRef)) return null;
+  const previous = requests.get(sessionId);
+  const request = sideQuestionRequestSnapshot({ provider, model, messages, tools, opts });
+  requests.set(sessionId, request);
+  return {
+    settle(response) {
+      request.response = response || null;
+    },
+    discard() {
+      if (requests.get(sessionId) !== request) return;
+      if (previous) requests.set(sessionId, previous);
+      else requests.delete(sessionId);
+    },
+  };
+}
+
+export function sideQuestionRequest(sessionId) {
+  return (sessionId && requests.get(sessionId)) || null;
+}
+
+/** Start the session's side question, aborting the one still in flight. */
+export function beginSideQuestion(sessionId) {
+  cancelSideQuestion(sessionId);
+  const controller = new AbortController();
+  inFlight.set(sessionId, controller);
+  return {
+    signal: controller.signal,
+    end() {
+      if (inFlight.get(sessionId) === controller) inFlight.delete(sessionId);
+    },
+  };
+}
+
+export function cancelSideQuestion(sessionId) {
+  const controller = sessionId ? inFlight.get(sessionId) : null;
+  if (!controller) return false;
+  inFlight.delete(sessionId);
+  controller.abort(new Error('Side question canceled.'));
+  return true;
+}
+
+/** The transcript the saved request carried is gone (clear, rewind): a later
+ *  side question waits for the next request. `cancel` also aborts the side
+ *  question in flight (session close / runtime unload). */
+export function forgetSideQuestion(sessionId, { cancel = false } = {}) {
+  if (!sessionId) return;
+  requests.delete(sessionId);
+  if (cancel) cancelSideQuestion(sessionId);
+}

package/src/runtime/agent/orchestrator/session/side-question.mjs

@@ -0,0 +1,192 @@
+// side-question.mjs — /btw: a quick question answered while the main turn
+// keeps working. The answer comes from a cache-sharing fork of the session's
+// latest provider request (side-question-store.mjs): the same model, system
+// prompt, tools and cache-relevant options and the same message prefix, so
+// the provider's prompt cache serves the prefix. Only the reply that request
+// produced and one question are appended. One provider call, no tool loop;
+// the answer is returned to the caller and never enters the transcript.
+import { collectAssistantToolCallIds } from './context-tool-pairs.mjs';
+import { buildIntermediateAssistantMessage, buildToolCallAssistantMessage } from './loop/assistant-commit.mjs';
+import { logSessionLlmUsage } from './manager/ask-turn-commit.mjs';
+import { disposeTransportScope, forkTransportScope } from '../providers/transport-scope.mjs';
+import { isAgentOwner } from '../agent-owner.mjs';
+import { getProvider } from '../providers/registry.mjs';
+import { prepareTurnEffortConfiguration } from '../providers/effort-configuration.mjs';
+import { providerNativeToolPrefixCount } from '../runtime-core/provider-request-tools.mjs';
+import { snapshotProviderRequestTools } from '../runtime-core/tool-catalog.mjs';
+import { repairTranscriptBeforeProviderSend } from './loop/transcript-repair.mjs';
+import { buildRequestSendOptions } from './manager/ask-turn-loop-options.mjs';
+import { filterModelVisibleSessionMessages } from './manager/message-sanitize.mjs';
+import { hasUserConversationMessage } from './manager/prompt-utils.mjs';
+import { loadSession } from './store.mjs';
+import { projectSyntheticUserEnvelopes } from './synthetic-user-envelope.mjs';
+import { beginSideQuestion, sideQuestionRequest, sideQuestionRequestSnapshot } from './side-question-store.mjs';
+
+export { cancelSideQuestion } from './side-question-store.mjs';
+
+export const SIDE_QUESTION_NO_REQUEST = 'Send a message first, then try /btw.';
+export const SIDE_QUESTION_TOOL_ATTEMPT =
+  'The model tried to use a tool instead of answering. A side question cannot run tools; try asking it differently.';
+const SIDE_QUESTION_EMPTY_ANSWER = 'The model returned no answer.';
+
+// The reply's tool calls run in the main session; the fork only needs each
+// call answered so the request stays well-formed.
+const SIDE_QUESTION_TOOL_STUB =
+  'This tool call belongs to the main task and is handled there; its result is not part of this side question.';
+
+function sideQuestionPrompt(question) {
+  return [
+    '<side-question>',
+    'The user is asking you a quick side question. The main agent keeps working on the task on its own;',
+    'this exchange does not reach it and does not change that work.',
+    'Answer directly, in this one response, from what this conversation already contains.',
+    'No tools are available here: do not call any, and do not offer or promise to do anything.',
+    'If the conversation does not tell you the answer, say that you do not know.',
+    '',
+    question,
+    '</side-question>',
+  ].join('\n');
+}
+
+// The assistant turn the saved request produced, built the way the loop
+// commits it (without the turn's one-shot transcript metadata), plus a stub
+// result per tool call.
+function replyMessages(response) {
+  if (!response) return [];
+  const reply = response.toolCalls?.length
+    ? buildToolCallAssistantMessage(response, { calls: response.toolCalls, suppressMidTurnText: false, opts: {} })
+    : buildIntermediateAssistantMessage(response, {});
+  if (!reply) return [];
+  const stubs = collectAssistantToolCallIds(reply).map((id) => ({
+    role: 'tool',
+    toolCallId: id,
+    content: SIDE_QUESTION_TOOL_STUB,
+  }));
+  return [reply, ...stubs];
+}
+
+/**
+ * The fork of a saved request: its messages unchanged, then the reply and
+ * the question. The send options are the saved ones; the provider
+ * continuation state follows the reply when it is appended, exactly as the
+ * main loop's next request would carry it. `sharedCachePrefixCount` (the
+ * shared prefix's message count, which survives model-proxy serialization)
+ * keeps an Anthropic message breakpoint on the shared prefix, so the fork reads the
+ * saved request's cache entry and writes none for its suffix.
+ */
+export function buildSideQuestionRequest(request, question) {
+  const reply = replyMessages(request.response);
+  const opts = { ...request.opts };
+  if (reply.length && Object.hasOwn(request.response, 'providerState')) {
+    opts.providerState = request.response.providerState;
+  }
+  if (request.messages.length) opts.sharedCachePrefixCount = request.messages.length;
+  const messages = [
+    ...request.messages,
+    ...reply,
+    // A user interjection keeps its own turn (never folded into a preceding
+    // tool result), so the prefix's last block reaches the provider unchanged.
+    { role: 'user', content: sideQuestionPrompt(question), meta: { source: 'steering' } },
+  ];
+  return { messages, opts };
+}
+
+/**
+ * The request the main loop would send next for a session that has none saved
+ * (the runtime restarted, or the saved one was forgotten): the session's own
+ * provider, model, tools, send options and transcript, assembled by the same
+ * pieces the loop uses, without the loop's side effects (no compaction, no
+ * transcript repair in place, nothing written to the session). Null when the
+ * session has no conversation, no resolvable provider, or is an agent's.
+ */
+function nextMainRequest(sessionId) {
+  const session = sessionId ? loadSession(sessionId) : null;
+  if (!session || session.closed === true || isAgentOwner(session)) return null;
+  if (!hasUserConversationMessage(session.messages)) return null;
+  const provider = getProvider(session.provider);
+  if (!provider) return null;
+  const transcript = filterModelVisibleSessionMessages(session.messages);
+  repairTranscriptBeforeProviderSend(transcript, sessionId);
+  const opts = buildRequestSendOptions({
+    sessionId,
+    session,
+    turnEffort: session.effort || null,
+    effortConfiguration: prepareTurnEffortConfiguration(session, provider),
+    stepAutoEffort: null,
+    codexTurnId: null,
+    startedAtMs: Date.now(),
+    signal: undefined,
+  });
+  const sendTools = snapshotProviderRequestTools({
+    provider: session.provider || provider.name,
+    tools: session.tools,
+    nativeTools: opts.nativeTools,
+    messages: transcript,
+    session,
+  });
+  opts.iteration = 1;
+  opts.providerToolSnapshotAuthoritative = true;
+  opts.providerNativeToolPrefixCount = providerNativeToolPrefixCount(sendTools);
+  return sideQuestionRequestSnapshot({
+    provider,
+    model: session.model,
+    messages: projectSyntheticUserEnvelopes(transcript).messages,
+    tools: sendTools,
+    opts,
+  });
+}
+
+function answerText(response) {
+  if (response?.toolCalls?.length) return SIDE_QUESTION_TOOL_ATTEMPT;
+  const text = typeof response?.content === 'string' ? response.content.trim() : '';
+  return text || SIDE_QUESTION_EMPTY_ANSWER;
+}
+
+/**
+ * Answer `question` from the session's latest provider request. One side
+ * question runs per session: a new one aborts the previous, and
+ * cancelSideQuestion aborts it. A session without a saved request forks the
+ * request its next turn would send. Rejects when the session has no
+ * conversation or provider, with the provider's error, or with the cancel
+ * reason.
+ */
+export async function askSideQuestion(sessionId, question) {
+  const text = typeof question === 'string' ? question.trim() : '';
+  if (!text) throw new TypeError('Side question is empty.');
+  const request = sideQuestionRequest(sessionId) || nextMainRequest(sessionId);
+  if (!request) throw new Error(SIDE_QUESTION_NO_REQUEST);
+  const run = beginSideQuestion(sessionId);
+  const startedAt = Date.now();
+  // The fork keeps the session id (prompt cache routing) but runs on its own
+  // transport scope: no pooled socket, response-chain anchor, turn-state
+  // token or provider run of the main session is waited on, read or replaced.
+  const transportScope = forkTransportScope(sessionId, 'side');
+  try {
+    const { messages, opts } = buildSideQuestionRequest(request, text);
+    let response;
+    try {
+      response = await request.provider.send(messages, request.model, request.tools.length ? request.tools : undefined, {
+        ...opts,
+        transportScope,
+        admissionOwner: sessionId,
+        signal: run.signal,
+      });
+    } catch (error) {
+      throw run.signal.aborted ? run.signal.reason : error;
+    }
+    if (run.signal.aborted) throw run.signal.reason;
+    const session = request.opts.session;
+    if (response?.usage && session?.id) {
+      void logSessionLlmUsage({
+        session: { ...session, model: request.model },
+        usage: response.usage,
+        startedAt,
+        mode: 'side-question',
+      }).catch(() => {});
+    }
+    return { text: answerText(response) };
+  } finally {
+    run.end();
+    disposeTransportScope(transportScope, request.provider);
+  }
+}

package/src/runtime/agent/orchestrator/session/store/lifecycle-barriers.mjs

@@ -158,9 +158,23 @@ function _logSessionCloseMetric(id, existing, closedAt, reason) {
   }
 }
 
+/**
+ * A barrier that found no record at all — nothing on disk and no live or
+ * pending copy in memory — fenced nothing because there is nothing to fence:
+ * its pending writes were already cancelled under the commit lock. It still
+ * returns null (no generation exists), but a caller passing `options.outcome`
+ * learns that the record was legitimately gone rather than vetoed, contended
+ * or failed.
+ */
+function _recordAbsent(options) {
+  if (options?.outcome && typeof options.outcome === 'object') options.outcome.absent = true;
+  return null;
+}
+
 /**
  * Atomically mark a session closed on disk with a bumped generation.
  * Returns the new generation, or null if the session file doesn't exist.
+ * `options.outcome` (an object) gets `absent: true` when no record existed.
  * Used by closeSession() to plant a tombstone that races against in-flight
  * saveSession() calls.
  */
@@ -187,7 +201,7 @@ export function markSessionClosed(id, reason = 'manual', options = {}) {
     _cancelSessionWrites(id);
     _uncacheSessionSummary(id);
     const existing = loadSession(id);
-    if (!existing) return null;
+    if (!existing) return _recordAbsent(options);
     // Re-close idempotence: a session that is ALREADY tombstoned keeps its
     // ORIGINAL close time (updatedAt) and generation. The old code refreshed
     // updatedAt=Date.now() on every call, so the 5-min idle sweep re-closing a
@@ -253,7 +267,7 @@ export function markSessionClosed(id, reason = 'manual', options = {}) {
  * of clobbering whatever the resumed session writes next.
  * Returns the new generation, or null if the session file doesn't exist.
  */
-export function bumpSessionGeneration(id, reason = 'detach') {
+export function bumpSessionGeneration(id, reason = 'detach', options = {}) {
   clearSessionLifecycleCommitError(id);
   // The detach barrier is a canonical write and MUST take the same commit
   // lock as markSessionClosed. Cancellation alone is not a barrier: a writer
@@ -278,7 +292,7 @@ export function bumpSessionGeneration(id, reason = 'detach') {
     _cancelSessionWrites(id);
     _uncacheSessionSummary(id);
     const existing = loadSession(id);
-    if (!existing) return null;
+    if (!existing) return _recordAbsent(options);
     const newGen = (typeof existing.generation === 'number' ? existing.generation : 0) + 1;
     const detached = { ...existing, generation: newGen, updatedAt: Date.now(), detachedReason: reason };
     if (!_writeLifecycleRecord(id, detached, existing, reason)) return null;

package/src/runtime/agent/orchestrator/session/store/live-state.mjs

@@ -124,6 +124,29 @@ export function _retireSessionIncarnation(id) {
   if (id) _sessionIncarnations.delete(id);
 }
 
+// ── Delete fence ────────────────────────────────────────────────────────────
+// An explicitly deleted session may still own a running turn whose later saves
+// carry a brand-new write guard and incarnation, so neither the cancellation
+// counter nor the retired incarnation stops them: an absent file reads as
+// "creatable". The fence is the id-level refusal every write-admission check
+// consults. Only explicit user deletes fence (ids are never reused); the cap
+// only ever forgets the oldest, long-settled entries.
+const SESSION_DELETE_FENCE_MAX = 4096;
+const _deleteFence = new Set();
+
+export function fenceSessionWrites(id) {
+  if (!id) return;
+  _deleteFence.delete(id);
+  _deleteFence.add(id);
+  if (_deleteFence.size > SESSION_DELETE_FENCE_MAX) {
+    _deleteFence.delete(_deleteFence.values().next().value);
+  }
+}
+
+export function isSessionWriteFenced(id) {
+  return _deleteFence.has(id);
+}
+
 /** Clear every save marker for an id (successful hard delete). */
 export function _clearSessionSaveState(id) {
   if (!id) return;

package/src/runtime/agent/orchestrator/session/store/paths-heartbeat.mjs

@@ -83,6 +83,13 @@ function _readSidecarOwnerPid(path) {
   }
 }
 
+/** True only when the sidecar recorded an owner pid that no longer exists
+ *  (pid-less legacy sidecars prove nothing and read false). */
+export function isSidecarOwnerDead(path) {
+  const pid = _readSidecarOwnerPid(path);
+  return pid > 0 && !isProcessAlive(pid);
+}
+
 // ── Heartbeat publish ─────────────────────────────────────
 // Lightweight per-session timestamp file (`<id>.hb`) consumed by the
 // status aggregator for fresh-session detection. Decoupled from the
@@ -193,25 +200,74 @@ export function isSessionHeartbeatOwnerDead(id) {
 // writer on the same session file (dual-writer last-save-wins clobbering).
 // Refreshed by the engine share tick (~3s call, throttled here) and cleared
 // on session switch/dispose; staleness covers crashes.
+//
+// Presence is a sidecar OF a session record and never outlives it: it is
+// only published while the record exists, and a publish that loses a race
+// with a deletion (this process or another one unlinked the record and its
+// sidecar while the write was in flight) removes what it just wrote.
 const _PRESENCE_THROTTLE_MS = 20_000;
 const _presenceLastAt = new Map();
+// id -> in-flight publish; deleteSessionPresence cancels it so the write that
+// lands after the unlink is removed again instead of resurrecting the file.
+const _presenceInFlight = new Map();
 
 function _presencePath(id) {
   return _sessionFilePath(id, '.own');
 }
 
+async function _sessionRecordExists(id) {
+  try {
+    await fsp.stat(sessionPath(id));
+    return true;
+  } catch (error) {
+    // Only a proven absence stops the beacon; an unreadable stat keeps it.
+    return error?.code !== 'ENOENT';
+  }
+}
+
+async function _publishPresence(id, now, flight) {
+  try {
+    // A record that does not exist (never saved yet, or deleted) gets no
+    // beacon; the throttle stays open so the next tick retries.
+    if (!(await _sessionRecordExists(id)) || flight.cancelled) {
+      if (_presenceLastAt.get(id) === now) _presenceLastAt.delete(id);
+      return;
+    }
+    const target = _presencePath(id);
+    await fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8');
+    if (flight.cancelled || !(await _sessionRecordExists(id))) {
+      await fsp.unlink(target).catch(() => {});
+      if (_presenceLastAt.get(id) === now) _presenceLastAt.delete(id);
+    }
+  } catch {
+    /* best-effort beacon */
+  } finally {
+    if (_presenceInFlight.get(id) === flight) _presenceInFlight.delete(id);
+  }
+}
+
 export function publishSessionPresence(id, ts) {
   if (!id) return;
   const now = ts || Date.now();
   const last = _presenceLastAt.get(id) || 0;
   if (now - last < _PRESENCE_THROTTLE_MS) return;
-  const target = _presencePath(id);
+  if (_presenceInFlight.has(id)) return;
+  _assertSessionId(id);
   _presenceLastAt.set(id, now);
-  void fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8').catch(() => {});
+  const flight = { cancelled: false, done: null };
+  _presenceInFlight.set(id, flight);
+  flight.done = _publishPresence(id, now, flight);
+}
+
+/** Test/drain seam: resolves once the id's in-flight presence publish settled. */
+export function settleSessionPresence(id) {
+  return _presenceInFlight.get(id)?.done || Promise.resolve();
 }
 
 export function deleteSessionPresence(id) {
   if (!id) return;
+  const flight = _presenceInFlight.get(id);
+  if (flight) flight.cancelled = true;
   try {
     unlinkSync(_presencePath(id));
   } catch {

package/src/runtime/agent/orchestrator/session/store/session-delete.mjs

@@ -4,10 +4,11 @@
  * edge plus the full local-state purge that must happen under the same lock
  * (incarnation retirement, pending slots, purge hooks, markers, summary row).
  */
-import { readFileSync, readdirSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
+import { unlinkSync } from 'node:fs';
 import { isAgentOwner } from '../../agent-owner.mjs';
-import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle-scan.mjs';
+import { listStoredAgentWorkerLinks } from '../store-agent-worker-rows.mjs';
+import { listStoredSessionSummaries } from './listing.mjs';
+import { STORED_SESSION_UNREADABLE, _storedSessionFromFile } from './serialize.mjs';
 import { getStoreDir, sessionPath, deleteSessionPresence } from './paths-heartbeat.mjs';
 import {
   readCanonicalSessionRecord as _readCanonicalRecord,
@@ -22,49 +23,58 @@ import {
 } from './write-guards.mjs';
 import {
   _clearLiveSession,
+  _liveSessions,
   _retireSessionIncarnation,
   _clearSessionSaveState,
   clearSessionLifecycleCommitError,
+  fenceSessionWrites,
 } from './live-state.mjs';
 import { purgeSessionSaveBookkeeping as _purgeSessionSaveBookkeeping } from './save-worker.mjs';
-import { _uncacheSessionSummary, _queueSessionSummaryRemoval } from './summary-cache.mjs';
+import { _uncacheSessionSummary, _queueSessionSummaryRemoval, _cachedSummaryRows } from './summary-cache.mjs';
 import { _savePending, _clearDebounce, _releasePendingSlot } from './pending-saves.mjs';
 import { _runtimeLivenessVeto, _heartbeatLivenessVeto, _deleteHeartbeatUnlessNewer } from './liveness-veto.mjs';
 import { _runSessionPurgeHooks } from './session-observers.mjs';
 import { deleteCompactionArchive } from '../compaction-archive.mjs';
 
-/** Strictly enumerate child-agent session files linked to one visible parent.
- * Used only by explicit parent deletion; ordinary close/context switches keep
- * the relationship intact. */
+/** Child-agent session ids linked to one visible parent. Candidates come from
+ * metadata only (the summary rows and the agent-worker links — no folder
+ * scan); each candidate's own file is then read strictly and must still be an
+ * agent-owned record linked to this parent, so a stale/foreign metadata row
+ * can never name a deletion target. Used only by explicit parent deletion;
+ * ordinary close/context switches keep the relationship intact. */
 export function listOwnedAgentSessionIds(ownerSessionId) {
   const ownerId = String(ownerSessionId || '').trim();
   if (!/^[A-Za-z0-9_-]+$/.test(ownerId)) return [];
-  const dir = getStoreDir();
-  if (probePath(dir).state !== PROBE_PRESENT) return [];
-  let files;
-  try {
-    files = readdirSync(dir).filter((file) => file.endsWith('.json'));
-  } catch {
-    return [];
+  const linksTo = (row) => row?.ownerSessionId === ownerId || row?.parentSessionId === ownerId;
+  const candidates = new Set();
+  for (const row of [...listStoredSessionSummaries(), ...listStoredAgentWorkerLinks()]) {
+    const candidateId = String(row?.id || row?.sessionId || '').trim();
+    if (linksTo(row) && candidateId !== ownerId && /^[A-Za-z0-9_-]+$/.test(candidateId)) {
+      candidates.add(candidateId);
+    }
   }
+  const dir = getStoreDir();
   const ids = [];
-  for (const file of files) {
-    const candidateId = file.slice(0, -5);
-    if (!candidateId || candidateId === ownerId || !/^[A-Za-z0-9_-]+$/.test(candidateId)) continue;
-    try {
-      const record = readTopLevelLifecycleRecord(readFileSync(join(dir, file), 'utf8'));
-      if (isLifecycleUnreadable(record) || record.id !== candidateId) continue;
-      const session = record.doc;
-      if (!isAgentOwner(session)) continue;
-      const linkedOwner = String(session.ownerSessionId || session.parentSessionId || '').trim();
-      if (linkedOwner === ownerId) ids.push(candidateId);
-    } catch {
-      /* unreadable/vanished records are never deletion targets */
-    }
+  for (const candidateId of candidates) {
+    const session = _storedSessionFromFile(dir, `${candidateId}.json`, false);
+    // Unreadable, vanished, corrupt or foreign records are never deletion targets.
+    if (!session || session === STORED_SESSION_UNREADABLE || !isAgentOwner(session)) continue;
+    const linkedOwner = String(session.ownerSessionId || session.parentSessionId || '').trim();
+    if (linkedOwner === ownerId) ids.push(candidateId);
   }
   return ids;
 }
 
+/** Working folders the session is known to have used (its cached summary row
+ *  and live snapshot — no file read, no scan); the purge hooks derive
+ *  per-folder artifacts such as the transcript path from them. */
+function knownSessionCwds(id) {
+  const row = _cachedSummaryRows()?.find((candidate) => candidate.id === id);
+  const live = _liveSessions.get(id);
+  const cwds = [row?.cwd, row?.workspace?.cwd, row?.workspace?.projectPath, live?.cwd];
+  return [...new Set(cwds.filter((cwd) => typeof cwd === 'string' && cwd))];
+}
+
 export function deleteSession(id, options = {}) {
   // Keep caller probes and all vetoes ahead of the non-reentrant lock and
   // ahead of pending-save disruption, matching markSessionClosed().
@@ -122,12 +132,15 @@ export function deleteSession(id, options = {}) {
     // its settlement moves no marker and touches no bookkeeping — and a
     // re-created id gets a brand new incarnation of its own.
     _retireSessionIncarnation(id);
+    // An explicit user delete also fences the id: a still-running turn's later
+    // saves get fresh guards/incarnations and would otherwise recreate the file.
+    if (options.fenceWrites === true) fenceSessionWrites(id);
     _cancelSessionWrites(id);
     _clearDebounce(id);
     _releasePendingSlot(_savePending.get(id));
     _savePending.delete(id);
     _purgeSessionSaveBookkeeping(id);
-    _runSessionPurgeHooks(id);
+    _runSessionPurgeHooks(id, { cwds: knownSessionCwds(id) });
     // Preserve a sidecar published strictly after the sweep's scan snapshot.
     _deleteHeartbeatUnlessNewer(id, options);
     deleteSessionPresence(id);

package/src/runtime/agent/orchestrator/session/store/session-observers.mjs

@@ -44,10 +44,12 @@ export function _publishLiveSession(session) {
 
 _setLiveSessionPublisher(_publishLiveSession);
 
-export function _runSessionPurgeHooks(id) {
+/** `context` (optional, e.g. `{ cwds }`: working folders the session is known
+ *  to have used) is passed to every hook as its second argument. */
+export function _runSessionPurgeHooks(id, context) {
   for (const hook of _sessionPurgeHooks) {
     try {
-      hook(id);
+      hook(id, context);
     } catch {
       /* a cleanup hook never breaks delete */
     }

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-finish.mjs

@@ -7,6 +7,11 @@ import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSummaryIndexPrune } from '../summary-cache.mjs';
 import { deleteSession } from '../session-delete.mjs';
 import { COMPACTION_ARCHIVE_SUFFIX } from '../../compaction-archive.mjs';
+import { isSidecarOwnerDead } from '../paths-heartbeat.mjs';
+
+// A live presence owner rewrites `.own` every ~20s; one untouched for the
+// attach guard's whole freshness window holds nothing open.
+const PRESENCE_ORPHAN_AGE_MS = 2 * 60 * 1000;
 
 /** Retention cap: prune resumable open (non-tombstone) sessions newest-first
  *  — keep the most recent openMaxCount, prune anything older than openMaxAgeMs
@@ -68,7 +73,13 @@ export function* reapOrphanSidecars({ plan, dir, now, tally }) {
       if (probePath(join(dir, recordOf(h))).state !== PROBE_ABSENT) continue;
       const sidecarProbe = probePath(join(dir, h));
       if (sidecarProbe.state !== PROBE_PRESENT) continue;
-      if (now - sidecarProbe.mtimeMs > plan.maxAge) {
+      // A presence sidecar is only ever published while its record exists,
+      // so one without a record whose recorded owner is dead (or which no
+      // live owner refreshed within the presence window) is a leftover of a
+      // deleted session, not a session mid-create.
+      const orphanPresence =
+        h.endsWith('.own') && (now - sidecarProbe.mtimeMs > PRESENCE_ORPHAN_AGE_MS || isSidecarOwnerDead(join(dir, h)));
+      if (orphanPresence || now - sidecarProbe.mtimeMs > plan.maxAge) {
         try {
           unlinkSync(join(dir, h));
           tally.cleaned++;

package/src/runtime/agent/orchestrator/session/store/write-admission.mjs

@@ -14,6 +14,7 @@ import {
 } from './canonical-reader.mjs';
 import { isCancelledWrite as _isCancelledWrite } from './write-guards.mjs';
 import { _setSessionWriteAuthorityCheck } from './save-worker.mjs';
+import { isSessionWriteFenced } from './live-state.mjs';
 
 const _observeStamp = (target) => {
   try {
@@ -71,7 +72,7 @@ function _writeAuthorityRecord(target, attempt) {
  * under their own authority read).
  */
 export function _shouldDrop(id, opts, attempt = null) {
-  if (_isCancelledWrite(opts)) return true;
+  if (_isCancelledWrite(opts) || isSessionWriteFenced(id)) return true;
   const expected = typeof opts?.expectedGeneration === 'number' ? opts.expectedGeneration : null;
   const target = sessionPath(id);
   let record;
@@ -126,6 +127,7 @@ export function _shouldDrop(id, opts, attempt = null) {
 // under the lock by _shouldDrop.
 export function _sessionWriteAuthorityRefusal(id, attempt = null) {
   if (!id) return null;
+  if (isSessionWriteFenced(id)) return 'deleted';
   let authority;
   try {
     // A synchronous save passes its `attempt`: its pre-admission is then the