mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/session/store/session-observers.mjs

@@ -44,10 +44,12 @@ export function _publishLiveSession(session) {
 
 _setLiveSessionPublisher(_publishLiveSession);
 
-export function _runSessionPurgeHooks(id) {
+/** `context` (optional, e.g. `{ cwds }`: working folders the session is known
+ *  to have used) is passed to every hook as its second argument. */
+export function _runSessionPurgeHooks(id, context) {
   for (const hook of _sessionPurgeHooks) {
     try {
-      hook(id);
+      hook(id, context);
     } catch {
       /* a cleanup hook never breaks delete */
     }

package/src/runtime/agent/orchestrator/session/store/session-paths.mjs

@@ -0,0 +1,59 @@
+import { existsSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { getPluginData } from '../../config.mjs';
+
+// Session file paths are rebuilt on every load/save/sidecar probe. Memoize the
+// joined strings per data dir: a changed data dir (MIXDOG_DATA_DIR switch)
+// drops the whole memo, and the per-extension maps are bounded.
+const SESSION_PATH_MEMO_LIMIT = 4096;
+let _memoDataDir = null;
+let _memoStoreDir = null;
+const _memoFilePaths = new Map(); // extension → Map<id, path>
+
+function _storeDirPath() {
+  const dataDir = getPluginData();
+  if (dataDir !== _memoDataDir) {
+    _memoDataDir = dataDir;
+    _memoStoreDir = join(dataDir, 'sessions');
+    _memoFilePaths.clear();
+  }
+  return _memoStoreDir;
+}
+
+function _memoFilePath(dir, id, extension) {
+  let byId = _memoFilePaths.get(extension);
+  if (!byId) {
+    byId = new Map();
+    _memoFilePaths.set(extension, byId);
+  }
+  let path = byId.get(id);
+  if (path === undefined) {
+    path = join(dir, _sessionFileName(id, extension));
+    if (byId.size >= SESSION_PATH_MEMO_LIMIT) byId.clear();
+    byId.set(id, path);
+  }
+  return path;
+}
+export function getStoreDir() {
+  const dir = _storeDirPath();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+function _sessionFileName(id, extension) {
+  return `${id}${extension}`;
+}
+// Enforce minted session-id shape before using it in a path to prevent
+// `../` traversal. session IDs are generated by createSession as
+// `sess_<timestamp>_<hex>` — reject anything that doesn't match.
+function _assertSessionId(id) {
+  if (!id || typeof id !== 'string' || !/^[A-Za-z0-9_-]+$/.test(id)) {
+    throw new Error(`[session-store] invalid session id: ${JSON.stringify(id)}`);
+  }
+}
+function _sessionFilePath(id, extension) {
+  _assertSessionId(id);
+  return _memoFilePath(getStoreDir(), id, extension);
+}
+export function sessionPath(id) {
+  return _sessionFilePath(id, '.json');
+}

package/src/runtime/agent/orchestrator/session/store/summary-cache.mjs

@@ -1,7 +1,7 @@
 import { readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getPluginData } from '../../config.mjs';
-import { getStoreDir } from './paths-heartbeat.mjs';
+import { getStoreDir } from './session-paths.mjs';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from './fs-probe.mjs';
 import { STORED_SESSION_UNREADABLE, _storedSessionFromFile } from './serialize.mjs';
 import {

package/src/runtime/agent/orchestrator/session/store/sweep/stale-sweep.mjs

@@ -4,7 +4,7 @@
 // sidecars. The generator yields between records so cooperative hosts never
 // hold the event loop for a whole directory scan; the synchronous wrapper
 // drains it in one go.
-import { getStoreDir } from '../paths-heartbeat.mjs';
+import { getStoreDir } from '../session-paths.mjs';
 import { probePath, PROBE_PRESENT } from '../fs-probe.mjs';
 import { persistSweepRecordCache, pruneSweepRecordCache } from './sweep-record.mjs';
 import { collectSweepRows, createSweepTally, resolveSweepPlan } from './sweep-plan.mjs';

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-finish.mjs

@@ -1,12 +1,13 @@
 // sweep/sweep-finish.mjs
 // What runs after every row has its verdict: the resumable-open retention
-// cap, the orphan sidecar reap, and the one batched summary-index prune.
+// cap, the legacy/orphan sidecar reap, and the one batched summary-index prune.
 import { readdirSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSummaryIndexPrune } from '../summary-cache.mjs';
 import { deleteSession } from '../session-delete.mjs';
 import { COMPACTION_ARCHIVE_SUFFIX } from '../../compaction-archive.mjs';
+import { LEGACY_MARKER_SUFFIXES, readLegacyMarker } from '../liveness-veto.mjs';
 
 /** Retention cap: prune resumable open (non-tombstone) sessions newest-first
  *  — keep the most recent openMaxCount, prune anything older than openMaxAgeMs
@@ -32,8 +33,7 @@ export function pruneOpenCandidates({ plan, now, tally }) {
         deleteSession(c.id, {
           deferSummaryUpdate: true,
           isSessionLive: plan.isSessionLive,
-          heartbeatSnapshotMtime: c.heartbeatSnapshotMtime,
-          heartbeatFreshMs: c.heartbeatFreshMs,
+          legacyOwnerVeto: true,
         })
       ) {
         tally.openPruned++;
@@ -48,34 +48,40 @@ export function pruneOpenCandidates({ plan, now, tally }) {
   }
 }
 
-/** Orphan .hb/.own/compaction-archive reap: a sidecar whose .json no longer
+/** Legacy `.hb` heartbeat and `.own` presence sidecars are written by no
+ *  current build, but an older Mixdog process still running mid-upgrade keeps
+ *  publishing them. One is reaped only once it holds nothing: its recorded
+ *  owner pid is dead or it went stale; a fresh marker of a live (or
+ *  unrecorded) owner is kept. Orphan compaction-archive reap: an archive whose .json no longer
  *  exists is dead weight once it is also stale (older than maxAge) — the
- *  session JSON was swept/closed but the sidecar lingered (crashed owner or
- *  pre-fix orphan). The staleness gate avoids nuking the sidecar of a session
- *  mid-create whose .json write has not landed yet. Yields between sidecars
- *  like the row loop. */
+ *  session JSON was swept/closed but the archive lingered. The staleness gate
+ *  avoids nuking the archive of a session mid-create whose .json write has not
+ *  landed yet. Yields between sidecars like the row loop. */
 export function* reapOrphanSidecars({ plan, dir, now, tally }) {
-  const recordOf = (sidecar) =>
-    sidecar.endsWith(COMPACTION_ARCHIVE_SUFFIX)
-      ? `${sidecar.slice(0, -COMPACTION_ARCHIVE_SUFFIX.length)}.json`
-      : sidecar.replace(/\.(hb|own)$/, '.json');
+  const recordOf = (sidecar) => `${sidecar.slice(0, -COMPACTION_ARCHIVE_SUFFIX.length)}.json`;
+  const unlinkSidecar = (h) => {
+    try {
+      unlinkSync(join(dir, h));
+      tally.cleaned++;
+    } catch {
+      /* ignore */
+    }
+  };
   try {
     for (const h of readdirSync(dir).filter(
       (f) => f.endsWith('.hb') || f.endsWith('.own') || f.endsWith(COMPACTION_ARCHIVE_SUFFIX)
     )) {
       yield undefined;
-      // Only a PROVEN-absent session file makes its sidecar an orphan.
+      if (LEGACY_MARKER_SUFFIXES.some((suffix) => h.endsWith(suffix))) {
+        const marker = readLegacyMarker(join(dir, h), now);
+        if (marker && (marker.ownerDead || !marker.fresh)) unlinkSidecar(h);
+        continue;
+      }
+      // Only a PROVEN-absent session file makes its archive an orphan.
       if (probePath(join(dir, recordOf(h))).state !== PROBE_ABSENT) continue;
       const sidecarProbe = probePath(join(dir, h));
       if (sidecarProbe.state !== PROBE_PRESENT) continue;
-      if (now - sidecarProbe.mtimeMs > plan.maxAge) {
-        try {
-          unlinkSync(join(dir, h));
-          tally.cleaned++;
-        } catch {
-          /* ignore */
-        }
-      }
+      if (now - sidecarProbe.mtimeMs > plan.maxAge) unlinkSidecar(h);
     }
   } catch {
     /* dir scan failure — non-fatal */

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-plan.mjs

@@ -2,7 +2,6 @@
 // One sweep's resolved options (what to sweep and with which bounds), the
 // candidate rows it visits, and the tally it fills in.
 import { readdirSync } from 'node:fs';
-import { loadConfig } from '../../../config.mjs';
 import { listStoredSessionSummaries } from '../listing.mjs';
 import { DEFAULT_SESSION_TTL_MS, RESUMABLE_OPEN_MAX_AGE_MS, RESUMABLE_OPEN_MAX_COUNT } from './sweep-record.mjs';
 
@@ -11,12 +10,6 @@ export function resolveSweepPlan(ttlMs, options = {}) {
     options = ttlMs;
     ttlMs = options.ttlMs;
   }
-  let terminalReapConfig = null;
-  try {
-    terminalReapConfig = loadConfig({ secrets: false });
-  } catch {
-    /* built-ins remain available */
-  }
   const sweepIdle = options.sweepIdle !== false;
   const tombstoneMaxAgeMs = Number(options.tombstoneMaxAgeMs);
   const optAge = Number(options.openMaxAgeMs);
@@ -24,7 +17,6 @@ export function resolveSweepPlan(ttlMs, options = {}) {
   return {
     maxAge: ttlMs || DEFAULT_SESSION_TTL_MS,
     sweepIdle,
-    terminalReapConfig,
     tombstoneMaxAgeMs,
     sweepTombstones: Number.isFinite(tombstoneMaxAgeMs) && tombstoneMaxAgeMs > 0,
     // Retention cap for resumable open sessions runs only on the idle sweep

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-record.mjs

@@ -1,18 +1,14 @@
 // sweep/sweep-record.mjs
 // What the stale-session sweep reads per record and the bounds it decides
-// with: the fingerprint-cached lifecycle record, the linked-agent retention
-// rule, and the idle / retention / blank-scratch thresholds.
+// with: the fingerprint-cached lifecycle record and the
+// idle / retention / blank-scratch thresholds.
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { writeJsonAtomicSync } from '../../../../../shared/atomic-file.mjs';
 import { getPluginData } from '../../../config.mjs';
-import { isAgentOwner } from '../../../agent-owner.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../../lifecycle-scan.mjs';
-import { sessionPath } from '../paths-heartbeat.mjs';
-import { probePath, PROBE_ABSENT } from '../fs-probe.mjs';
 
 export const DEFAULT_SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes idle — aligned with Anthropic 5m messages tier and OpenAI in-memory cache window
-export const AGENT_TERMINAL_STATUSES = new Set(['idle', 'done', 'error']);
 // Hard wall-clock ceiling for sessions stuck in status='running'. The
 // stream-watchdog should abort stalled streams within ~120s, but if it misses
 // one (process crash, watchdog not started, provider never returned), this
@@ -52,7 +48,7 @@ export const BLANK_SCRATCH_MAX_AGE_MS = 60 * 60 * 1000; // 1h
 // running is still parsed again.
 const sweepRecordCache = new Map();
 const SWEEP_RECORD_CACHE_FILE = 'session-sweep-records.json';
-const SWEEP_RECORD_CACHE_VERSION = 1;
+const SWEEP_RECORD_CACHE_VERSION = 2;
 let sweepRecordCacheDataDir = null;
 let sweepRecordCacheDirty = false;
 let sweepRecordParses = 0;
@@ -86,11 +82,13 @@ function syncSweepRecordCache() {
 }
 
 // The only document fields sweep-row reads (effectiveFields, the closed
-// check and retainedLinkedAgent). Caching the whole top-level document kept
+// check). Caching the whole top-level document kept
 // every session's tool catalogs, schemas and provider state alive — one
 // entry per session file, measured at ~290MB of a 470MB daemon heap.
 const SWEEP_DOC_FIELDS = [
   'id',
+  'closed',
+  'closedReason',
   'owner',
   'status',
   'provider',
@@ -172,13 +170,3 @@ export function sweepRecordCacheStats() {
   syncSweepRecordCache();
   return { entries: sweepRecordCache.size, parses: sweepRecordParses };
 }
-
-/** Child-agent transcripts share their visible parent's retention boundary.
- * Presence (including a tombstone or unreadable file) preserves the child;
- * only proven parent absence releases it to ordinary cleanup. */
-export function retainedLinkedAgent(session) {
-  if (!session || !isAgentOwner(session)) return false;
-  const parentId = String(session.ownerSessionId || session.parentSessionId || '').trim();
-  if (!/^[A-Za-z0-9_-]+$/.test(parentId) || parentId === session.id) return false;
-  return probePath(sessionPath(parentId)).state !== PROBE_ABSENT;
-}

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-row.mjs

@@ -5,30 +5,14 @@
 // top-level id/closed/generation, foreign id) is left EXACTLY as it is — not
 // deleted, not closed, not repaired.
 import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { isAgentOwner } from '../../../agent-owner.mjs';
+import { isHistoricalAutomaticClosure } from '../../historical-session-closure.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../../lifecycle-scan.mjs';
-import { resolveAgentTerminalReapMs } from '../../../runtime-core/config-helpers.mjs';
-import { sessionPath } from '../paths-heartbeat.mjs';
+import { sessionPath } from '../session-paths.mjs';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSessionSummaryUpsert, _queueSessionSummaryRemoval } from '../summary-cache.mjs';
 import { deleteSession } from '../session-delete.mjs';
 import { markSessionClosed } from '../lifecycle-barriers.mjs';
-import {
-  AGENT_TERMINAL_STATUSES,
-  BLANK_SCRATCH_MAX_AGE_MS,
-  RUNNING_STALL_MS,
-  readSweepRecord,
-  retainedLinkedAgent,
-} from './sweep-record.mjs';
-
-/** The .hb sidecar mtime: 0 when proven absent, null when its liveness cannot
- *  be judged (an unreadable sidecar makes the record no sweep candidate). */
-const heartbeatMtimeOf = (dir, id) => {
-  const probe = probePath(join(dir, `${id}.hb`));
-  if (probe.state === PROBE_PRESENT) return probe.mtimeMs || 0;
-  return probe.state === PROBE_ABSENT ? 0 : null;
-};
+import { BLANK_SCRATCH_MAX_AGE_MS, RUNNING_STALL_MS, readSweepRecord } from './sweep-record.mjs';
 
 /** The AUTHORITATIVE on-disk fields, falling back to the best-effort (and
  *  possibly stale) summary row only where the record lacks them — a stale row
@@ -56,7 +40,7 @@ function sweepClosedRecord(ctx, row, actual, jsonPath) {
     return;
   }
   // Closed sessions are EXEMPT from the freshness gate: a tombstone whose
-  // file/hb mtime keeps getting bumped would otherwise stay perpetually
+  // file mtime keeps getting bumped would otherwise stay perpetually
   // "fresh" and never mature. Maturity is governed ONLY by the ORIGINAL
   // close time (disk updatedAt, not row.updatedAt which a stale row may
   // carry from before the close).
@@ -64,7 +48,7 @@ function sweepClosedRecord(ctx, row, actual, jsonPath) {
   const age = now - closedAt;
   if (plan.sweepTombstones && Number.isFinite(closedAt) && age >= plan.tombstoneMaxAgeMs) {
     try {
-      if (deleteSession(row.id, { deferSummaryUpdate: true })) {
+      if (deleteSession(row.id, { deferSummaryUpdate: true, legacyOwnerVeto: true })) {
         tally.tombstonesCleaned++;
         tally.tombstoneDetails.push({ id: row.id, ageSeconds: Math.floor(age / 1000) });
         return;
@@ -96,14 +80,15 @@ function sweepClosedRecord(ctx, row, actual, jsonPath) {
  *  that permanence is a blank scratch: ZERO user/assistant conversation
  *  (engine boot artifact, force-killed window, crashed host) has nothing to
  *  preserve, and relaunch storms otherwise pile hundreds of "(blank)" rows
- *  that no sweep may touch. Reap once cold; liveness/heartbeat vetoes inside
- *  deleteSession still protect an in-flight boot. */
-function sweepUserOwnedRecord(ctx, row, record, eff, heartbeatMtime) {
+ *  that no sweep may touch. Reap once cold; the liveness veto inside
+ *  deleteSession still protects an in-flight boot, local or in a live older
+ *  process. */
+function sweepUserOwnedRecord(ctx, row, record, eff) {
   const { plan, now, tally } = ctx;
   const conversationCount = Number.isFinite(record.conversationCount)
     ? record.conversationCount
     : Number(row.messageCount) || 0;
-  const lastActive = Math.max(eff.updatedAt, eff.lastHeartbeatAt, eff.createdAt, heartbeatMtime || 0);
+  const lastActive = Math.max(eff.updatedAt, eff.lastHeartbeatAt, eff.createdAt);
   if (
     plan.sweepIdle &&
     conversationCount === 0 &&
@@ -115,8 +100,7 @@ function sweepUserOwnedRecord(ctx, row, record, eff, heartbeatMtime) {
         deleteSession(row.id, {
           deferSummaryUpdate: true,
           isSessionLive: plan.isSessionLive,
-          heartbeatSnapshotMtime: heartbeatMtime,
-          heartbeatFreshMs: BLANK_SCRATCH_MAX_AGE_MS,
+          legacyOwnerVeto: true,
         })
       ) {
         tally.openPruned++;
@@ -130,32 +114,17 @@ function sweepUserOwnedRecord(ctx, row, record, eff, heartbeatMtime) {
   tally.remaining++;
 }
 
-/** Closes an idle session. Close is destructive and the earlier heartbeat
- *  stat can race a different process publishing fresh liveness, so both the
- *  local runtime ownership and the sidecar are re-checked at the commit edge. */
-function closeIdleRecord(ctx, row, eff, { lastActive, sessionMaxAge, heartbeatMtime }) {
-  const { plan, dir, now, tally } = ctx;
+/** Closes an idle session. Close is destructive, so the in-memory runtime
+ *  ownership is re-checked at the commit edge. */
+function closeIdleRecord(ctx, row, eff, { lastActive }) {
+  const { plan, now, tally } = ctx;
   if (plan.isSessionLive?.(row.id)) {
     tally.remaining++;
     return;
   }
-  const preCloseHeartbeatMtime = heartbeatMtimeOf(dir, row.id);
-  if (preCloseHeartbeatMtime === null) {
-    // Unknown liveness at the destructive edge: do not close.
-    tally.remaining++;
-    return;
-  }
-  if (preCloseHeartbeatMtime > 0 && now - preCloseHeartbeatMtime <= sessionMaxAge) {
-    tally.remaining++;
-    return;
-  }
   let closeResult = null;
   try {
-    closeResult = markSessionClosed(row.id, 'idle-sweep', {
-      isSessionLive: plan.isSessionLive,
-      heartbeatSnapshotMtime: heartbeatMtime,
-      heartbeatFreshMs: sessionMaxAge,
-    });
+    closeResult = markSessionClosed(row.id, 'idle-sweep', { isSessionLive: plan.isSessionLive, legacyOwnerVeto: true });
   } catch (err) {
     process.stderr.write(`[session-store] idle-sweep close failed for ${row.id}: ${err?.message}\n`);
     return;
@@ -174,51 +143,29 @@ function closeIdleRecord(ctx, row, eff, { lastActive, sessionMaxAge, heartbeatMt
 
 /** An open record: the freshness gate, then user permanence, the running
  *  backstop, the idle close, or a retention-cap candidacy. */
-function sweepOpenRecord(ctx, row, record, { jsonMtime, heartbeatMtime }) {
+function sweepOpenRecord(ctx, row, record, { jsonMtime }) {
   const { plan, now, tally } = ctx;
   const eff = effectiveFields(record.doc, row);
-  const ownerRef = { owner: eff.owner };
   const ownerNamed = typeof eff.owner === 'string' && eff.owner.length > 0;
-  // Completed agents use their provider's Advanced terminal duration rather
-  // than the general sweep cadence, so it is resolved before the freshness
-  // gate: a short provider override must not be hidden behind the default
-  // 5-minute gate.
-  const isCompletedAgent = isAgentOwner(ownerRef) && AGENT_TERMINAL_STATUSES.has(eff.status);
-  const terminalReapMs = isCompletedAgent ? resolveAgentTerminalReapMs(plan.terminalReapConfig, eff.provider) : null;
-  if (isCompletedAgent && terminalReapMs == null) {
-    tally.remaining++;
-    return;
-  }
   // Freshness gate — recently-touched open sessions are skipped cheaply here.
   let freshnessGateMs = 0;
-  if (plan.sweepIdle) freshnessGateMs = terminalReapMs ?? plan.maxAge;
+  if (plan.sweepIdle) freshnessGateMs = plan.maxAge;
   else if (plan.sweepTombstones) freshnessGateMs = plan.tombstoneMaxAgeMs;
-  const newestKnown = Math.max(
-    row.updatedAt || 0,
-    row.lastHeartbeatAt || 0,
-    row.createdAt || 0,
-    jsonMtime,
-    heartbeatMtime
-  );
+  const newestKnown = Math.max(row.updatedAt || 0, row.lastHeartbeatAt || 0, row.createdAt || 0, jsonMtime);
   if (freshnessGateMs > 0 && newestKnown > 0 && now - newestKnown <= freshnessGateMs) {
     // Fresh agent/legacy sessions survive idle close but still participate
     // in the resumable-open retention cap. The cap performs its own
     // commit-edge liveness veto before deletion.
-    if (plan.retainOpen && plan.sweepIdle && (!ownerNamed || isAgentOwner(ownerRef))) {
-      tally.openCandidates.push({
-        id: row.id,
-        lastActive: newestKnown,
-        heartbeatSnapshotMtime: heartbeatMtime,
-        heartbeatFreshMs: terminalReapMs ?? plan.maxAge,
-      });
+    if (plan.retainOpen && plan.sweepIdle && !ownerNamed) {
+      tally.openCandidates.push({ id: row.id, lastActive: newestKnown });
     }
     tally.remaining++;
     return;
   }
-  // Sweep agent-owned and ownerless (legacy) sessions; explicit user sessions
-  // never feed the retention cap and are only ever reaped as blank scratch.
-  if (ownerNamed && !isAgentOwner(ownerRef)) {
-    sweepUserOwnedRecord(ctx, row, record, eff, heartbeatMtime);
+  // Every explicitly owned conversation has the same retention policy.
+  // Only ownerless legacy records enter idle closure and the retention cap.
+  if (ownerNamed) {
+    sweepUserOwnedRecord(ctx, row, record, eff);
     return;
   }
   if (!plan.sweepIdle) {
@@ -227,17 +174,13 @@ function sweepOpenRecord(ctx, row, record, { jsonMtime, heartbeatMtime }) {
   }
   // The manager may sweep while unrelated sessions are active. Protect this
   // specific locally-current/in-flight session regardless of stale on-disk
-  // timestamps; its controller/heartbeat owner decides when it is safe to
-  // become an idle-sweep candidate.
+  // timestamps; its in-memory runtime decides when it is safe to become an
+  // idle-sweep candidate.
   if (plan.isSessionLive?.(row.id)) {
     tally.remaining++;
     return;
   }
-  // Prefer .hb sidecar mtime — updated at tight cadence (≤5s) without
-  // serialising the full JSON, so it reflects true liveness more accurately
-  // than the JSON timestamp fields.
-  let lastActive = eff.lastHeartbeatAt || eff.updatedAt || eff.createdAt || 0;
-  if (heartbeatMtime) lastActive = Math.max(lastActive, heartbeatMtime);
+  const lastActive = eff.lastHeartbeatAt || eff.updatedAt || eff.createdAt || 0;
   // Running sessions are normally reaped by the stream-watchdog within
   // ~120s. Skip them here unless they've been silent past RUNNING_STALL_MS,
   // at which point they are treated as zombies.
@@ -245,19 +188,11 @@ function sweepOpenRecord(ctx, row, record, { jsonMtime, heartbeatMtime }) {
     tally.remaining++;
     return;
   }
-  const sessionMaxAge = terminalReapMs ?? plan.maxAge;
-  if (now - lastActive > sessionMaxAge) {
-    closeIdleRecord(ctx, row, eff, { lastActive, sessionMaxAge, heartbeatMtime });
+  if (now - lastActive > plan.maxAge) {
+    closeIdleRecord(ctx, row, eff, { lastActive });
     return;
   }
-  if (plan.retainOpen) {
-    tally.openCandidates.push({
-      id: row.id,
-      lastActive,
-      heartbeatSnapshotMtime: heartbeatMtime,
-      heartbeatFreshMs: sessionMaxAge,
-    });
-  }
+  if (plan.retainOpen) tally.openCandidates.push({ id: row.id, lastActive });
   tally.remaining++;
 }
 
@@ -277,11 +212,6 @@ export function sweepRow(ctx, row) {
     tally.remaining++;
     return;
   }
-  const heartbeatMtime = heartbeatMtimeOf(ctx.dir, row.id);
-  if (heartbeatMtime === null) {
-    tally.remaining++;
-    return;
-  }
   // Truth source: the summary index is a deferred/best-effort sidecar, so a
   // row can still claim status='idle'/open while the session JSON was
   // already tombstoned. Read the real session JSON BEFORE the freshness gate
@@ -299,10 +229,7 @@ export function sweepRow(ctx, row) {
   // One strict parse for the whole record: every decision below reads the
   // SAME authoritative document (owner/status/timestamps/messages).
   const actual = record.doc;
-  if (retainedLinkedAgent(actual)) {
-    // Parent-owned agent transcripts are task history, not ephemeral worker
-    // cache. This covers both new open sessions and tombstones created by
-    // older Mixdog versions.
+  if (isHistoricalAutomaticClosure(actual)) {
     tally.remaining++;
     return;
   }
@@ -310,5 +237,5 @@ export function sweepRow(ctx, row) {
     sweepClosedRecord(ctx, row, actual, jsonPath);
     return;
   }
-  sweepOpenRecord(ctx, row, record, { jsonMtime: jsonProbe.mtimeMs || 0, heartbeatMtime });
+  sweepOpenRecord(ctx, row, record, { jsonMtime: jsonProbe.mtimeMs || 0 });
 }

package/src/runtime/agent/orchestrator/session/store/write-admission.mjs

@@ -5,7 +5,7 @@
  * that decide whether bytes may be committed — no queueing, no commit, no
  * markers — which is why they stay out of the write pipeline itself.
  */
-import { sessionPath } from './paths-heartbeat.mjs';
+import { sessionPath } from './session-paths.mjs';
 import {
   readCanonicalSessionRecord as _readCanonicalRecord,
   CANONICAL_RECORD_UNREADABLE as LIFECYCLE_AMBIGUOUS,
@@ -14,6 +14,7 @@ import {
 } from './canonical-reader.mjs';
 import { isCancelledWrite as _isCancelledWrite } from './write-guards.mjs';
 import { _setSessionWriteAuthorityCheck } from './save-worker.mjs';
+import { isSessionWriteFenced } from './live-state.mjs';
 
 const _observeStamp = (target) => {
   try {
@@ -71,7 +72,7 @@ function _writeAuthorityRecord(target, attempt) {
  * under their own authority read).
  */
 export function _shouldDrop(id, opts, attempt = null) {
-  if (_isCancelledWrite(opts)) return true;
+  if (_isCancelledWrite(opts) || isSessionWriteFenced(id)) return true;
   const expected = typeof opts?.expectedGeneration === 'number' ? opts.expectedGeneration : null;
   const target = sessionPath(id);
   let record;
@@ -126,6 +127,7 @@ export function _shouldDrop(id, opts, attempt = null) {
 // under the lock by _shouldDrop.
 export function _sessionWriteAuthorityRefusal(id, attempt = null) {
   if (!id) return null;
+  if (isSessionWriteFenced(id)) return 'deleted';
   let authority;
   try {
     // A synchronous save passes its `attempt`: its pre-admission is then the

package/src/runtime/agent/orchestrator/session/store-agent-worker-pool.mjs

@@ -5,30 +5,27 @@
  */
 export function listStoredAgentWorkers({
   now,
-  heartbeatMtimes,
+  runningSessionIds,
   storedAgentWorkerIndexRows,
   projectChildWorkerRow,
-  promoteHeartbeatSidecar,
   storedLeadWorkerRows,
   projectLeadWorkerRow,
   pruneOrphanChildRows,
 }) {
+  const context = { now, runningSessionIds };
   const bySessionId = new Map();
   for (const row of storedAgentWorkerIndexRows()) {
-    const projected = projectChildWorkerRow(row, { now, heartbeatMtimes });
+    const projected = projectChildWorkerRow(row, context);
     if (projected) bySessionId.set(projected.sessionId, projected);
   }
-  for (const [sessionId, heartbeatAt] of heartbeatMtimes) {
-    promoteHeartbeatSidecar(bySessionId, sessionId, heartbeatAt);
-  }
   const liveLeadSessionIds = new Set();
   for (const row of storedLeadWorkerRows()) {
-    const projected = projectLeadWorkerRow(row, { now, heartbeatMtimes });
+    const projected = projectLeadWorkerRow(row, context);
     if (!projected) continue;
     liveLeadSessionIds.add(projected.sessionId);
     bySessionId.set(projected.sessionId, projected);
   }
-  pruneOrphanChildRows(bySessionId, { liveLeadSessionIds, heartbeatMtimes, now });
+  pruneOrphanChildRows(bySessionId, { liveLeadSessionIds });
   return [...bySessionId.values()].sort((left, right) => {
     const leftTime = Date.parse(String(left.startedAt || '')) || 0;
     const rightTime = Date.parse(String(right.startedAt || '')) || 0;