session-orchestrator 3.17.0 → 3.19.0

package/scripts/lib/session-close-backfill.mjs

@@ -221,9 +221,27 @@ function isCandidateDeadByAge({ relaxDeadByAge, assumeDeadBeforeMs, lastEventMs,
 function synthesizeRecord({ recordId, synthetic, gathered, nowMs }) {
   const startedIso = canonicalIso(gathered.startedAt, gathered.earliestMs ?? nowMs);
   const startedMs = Date.parse(startedIso);
-  const terminalMs = Number.isFinite(gathered.lastTerminalMs) ? gathered.lastTerminalMs : nowMs;
-  // completed_at = last terminal event (or now), never earlier than started_at.
-  const completedIso = new Date(Math.max(startedMs, terminalMs)).toISOString();
+  // completed_at is events-attested, never the backfill-run wall-clock (#914 R1).
+  // A fabricated `nowMs` produced ~64h of phantom runtime on real records
+  // (e.g. main-2026-07-18-session-2: started 2026-07-18, "completed" 2026-07-21).
+  // Precedence, all events-derived — the schema requires a string, so `null`
+  // is not an option (session-schema/validator.mjs rejects non-string):
+  //   1. lastTerminalMs — a real STOPPED/ENDED event: the true end.
+  //   2. lastEventMs — last life-sign; an ESTIMATE (flagged), never the run time.
+  //   3. startedIso — no post-start event at all → duration 0 (flagged).
+  let completedEstimated = false;
+  let completedMs;
+  if (Number.isFinite(gathered.lastTerminalMs)) {
+    completedMs = gathered.lastTerminalMs;
+  } else if (Number.isFinite(gathered.lastEventMs)) {
+    completedMs = gathered.lastEventMs;
+    completedEstimated = true;
+  } else {
+    completedMs = startedMs;
+    completedEstimated = true;
+  }
+  // Guard the same monotonic invariant as before: never earlier than started_at.
+  const completedIso = new Date(Math.max(startedMs, completedMs)).toISOString();
 
   let sessionType = 'housekeeping';
   let inferred = true;
@@ -238,6 +256,10 @@ function synthesizeRecord({ recordId, synthetic, gathered, nowMs }) {
   const incomplete = ['total_waves', 'waves', 'agent_summary', 'total_agents', 'total_files_changed'];
   if (!startedFound) incomplete.push('started_at');
   if (!branchFound) incomplete.push('branch');
+  // completed_at was estimated from lastEventMs (or defaulted to started_at) —
+  // no terminal event was found, so mark it incomplete so downstream duration
+  // consumers can tell an events-attested end apart from an estimate (#914 R1).
+  if (completedEstimated) incomplete.push('completed_at');
 
   const record = {
     session_id: recordId,
@@ -261,6 +283,7 @@ function synthesizeRecord({ recordId, synthetic, gathered, nowMs }) {
   if (branchFound) record.branch = gathered.branch;
   if (inferred) record._session_type_inferred = true;
   if (synthetic) record._synthetic_session_id = true;
+  if (completedEstimated) record._completed_at_estimated = true;
   return record;
 }
 
@@ -296,6 +319,7 @@ function checkAlreadyRecorded(readFileSync, sessionsPath, { recordId, sessionId
  *   { action: 'would-backfill', sessionId, record, deadByAge? }    — dryRun only, not written
  *   { action: 'skipped-no-identifier' }                — neither id known
  *   { action: 'skipped-already-recorded', sessionId }  — already in sessions.jsonl
+ *   { action: 'skipped-own-live-lock', sessionId }     — candidate IS this live session (#863)
  *   { action: 'skipped-foreign-live-lock', sessionId, lockSessionId }
  *   { action: 'skipped-marker-exists', sessionId }     — lost the TOCTOU claim
  *   { action: 'error', error, sessionId? }             — any failure, swallowed
@@ -421,7 +445,14 @@ export async function backfillAbandonedSession({
         if (dupe) return dupe;
       }
 
-      // -- Liveness guard — never overwrite a FOREIGN live lock ---------------
+      // -- Liveness guard — never overwrite a FOREIGN live lock, and never ----
+      // record OUR OWN live lock as 'abandoned' (#863 defect 1). Before this
+      // fix, the guard below only ever ran when `foreign` was true — the
+      // "this candidate IS the currently-live session" branch fell straight
+      // through to synthesis + append, backfilling a session as 'abandoned'
+      // mere seconds after it started (observed on-disk: main-2026-07-21-
+      // session-2, started 13:58:28.189Z, recorded abandoned 13:58:31.065Z).
+      //
       // deadByAge (#731): set when a foreign live lock was present but the
       // candidate qualified for relaxation — surfaced on the final result so
       // callers (the migration CLI's summary) can count relaxed backfills.
@@ -436,8 +467,32 @@ export async function backfillAbandonedSession({
         const ownByUuid = Boolean(sessionId) && lock.session_id === sessionId;
         const ownBySemantic =
           (Boolean(semanticSessionId) && lock.semantic_session_id === semanticSessionId) ||
-          (Boolean(recordId) && lock.semantic_session_id === recordId);
-        const foreign = !ownByUuid && !ownBySemantic;
+          (Boolean(recordId) && lock.semantic_session_id === recordId) ||
+          // #863 (d) — lock-shape trap: some on-disk locks store the semantic
+          // id directly in `session_id` with no separate `semantic_session_id`
+          // field at all (the "generated-semantic" acquisition path in
+          // on-session-start.mjs mints `session_id === the semantic id`, and
+          // bootstrapLock's v2 enrichment step — which would otherwise add
+          // `semantic_session_id` — never ran for that lock). Without this
+          // fallback, ownBySemantic is dead code for that shape and a
+          // genuinely-own lock is misclassified `foreign`, which can then be
+          // wrongly bypassed by the dead-by-age relaxation below despite
+          // being live right now.
+          (Boolean(semanticSessionId) && lock.session_id === semanticSessionId) ||
+          (Boolean(recordId) && lock.session_id === recordId);
+        const own = ownByUuid || ownBySemantic;
+        const foreign = !own;
+
+        // #863 defect 1 — an OWN lock that is still live means this session
+        // is actively running right now; it must never be recorded
+        // 'abandoned'. Runs BEFORE the foreign-live-lock guard below (which
+        // only ever fires when `foreign` is true). A STALE own lock
+        // (isLockLive === false) falls through unchanged — this is a
+        // liveness gate, not a blanket own-session off-switch.
+        if (own && isLockLive(lock, nowMs)) {
+          return { action: 'skipped-own-live-lock', sessionId: recordId };
+        }
+
         if (foreign && isLockLive(lock, nowMs)) {
           const relaxed = isCandidateDeadByAge({
             relaxDeadByAge,

package/scripts/lib/session-end/phase-skip.mjs

@@ -276,6 +276,7 @@ async function decideReconcile({ repoRoot, cfg }) {
       ruleExpiryDays: cfg?.reconcile?.['rule-expiry-days'] ?? undefined,
       minRuleDays: cfg?.reconcile?.['min-rule-days'] ?? undefined,
       minInsightChars: cfg?.reconcile?.['min-insight-chars'] ?? undefined,
+      maxProposalsPerRun: cfg?.reconcile?.['max-proposals-per-run'] ?? undefined,
       now: new Date(),
       dryRun: true, // never write the candidate sidecar from the aggregator
     });

package/scripts/lib/session-id.mjs

@@ -2,8 +2,9 @@
  * session-id.mjs — Semantic session-ID generation and dual-format parsing.
  *
  * Public API:
- *   - resolveSemanticSessionId({ branch, mode, activeSessions, repoRoot, history }): Promise<string>
+ *   - resolveSemanticSessionId({ branch, mode, activeSessions, repoRoot, sources }): Promise<string>
  *   - parseSessionId(id): { format: 'semantic'|'uuid', ...fields, raw } | null
+ *   - DEFAULT_SESSION_ID_SOURCES — the default `sources` array (see below)
  *   - SEMANTIC_ID_RE — source-of-truth regex for semantic session IDs
  *   - UUID_V4_RE     — regex for UUID-v4 format session IDs
  *
@@ -19,20 +20,26 @@
  *  - resolveSemanticSessionId wraps its body in withStateMdLock so two
  *    concurrent preambles cannot assign duplicate n values (PSA-005).
  *  - parseSessionId is a pure synchronous function — no I/O, no side effects.
- *  - History-aware (#585): the n-increment consults three candidate sources:
+ *  - History-aware (#585): the n-increment consults four candidate sources:
  *      1. activeSessions (the legacy source — live lockfiles + registry).
  *      2. sessions.jsonl history (closed sessions; appended on session-end).
  *      3. STATE.md frontmatter `session:` (last-resort survivor of crashed sessions).
- *    Sources 2 and 3 are read inside the existing withStateMdLock so their
- *    visibility is consistent with the n-claim that follows. Both are opt-out
- *    via opts.history.{consultHistory,consultStateMd} and DI-overridable via
- *    opts.history.{readHistoryImpl,readStateMdSessionImpl} for tests.
+ *      4. events.jsonl `orchestrator.session.lock.acquired` (#952 Teil B —
+ *         append-only mint-ledger; the only source written at CLAIM time).
+ *    Sources 2-4 are DEFAULT_SESSION_ID_SOURCES — deferred readers invoked
+ *    inside the existing withStateMdLock, so their visibility is consistent
+ *    with the n-claim that follows. They are configured through the single
+ *    `opts.sources` array (#956): opting out is passing a shorter array,
+ *    overriding is passing your own reader, and adding a fifth source costs
+ *    no new interface element. Source 1 stays a separate parameter — it is
+ *    already-resolved data gathered BEFORE the lock, so it is deliberately
+ *    not disguised as a deferred, lock-covered reader.
  *  - Reader helpers never throw: missing files, malformed JSONL lines, and
  *    unparseable frontmatter are all treated as "no signal" (empty/null).
  *  - Production code is silent: no console.log, no console.warn.
  */
 
-import { readFile } from 'node:fs/promises';
+import { open, readFile } from 'node:fs/promises';
 import path from 'node:path';
 
 import { withStateMdLock } from './session-lock.mjs';
@@ -139,6 +146,118 @@ async function readSessionIdsFromHistory(repoRoot) {
   return ids;
 }
 
+/**
+ * Event name emitted by `hooks/_lib/lock-bootstrap.mjs` on every successful
+ * session-lock acquisition — i.e. on every semantic-ID MINT.
+ * @type {string}
+ */
+const LOCK_ACQUIRED_EVENT = 'orchestrator.session.lock.acquired';
+
+/**
+ * Byte window for the events.jsonl tail read (1 MiB).
+ *
+ * Sizing rationale: the match downstream is `date === today`, so the window
+ * only has to cover today's events. Worst observed single-day volume in this
+ * repo is ~164 KiB (measured 2026-07-31 over the live log), and rotation caps
+ * the file at `events-rotation.max-size-mb` (default 10 MiB). 1 MiB is ~6x the
+ * worst observed day and 10% of the rotation ceiling.
+ * @type {number}
+ */
+const EVENTS_TAIL_BYTES = 1024 * 1024;
+
+/**
+ * Age cutoff for events considered by the reader (2 days).
+ *
+ * Anything older cannot influence a `date === today` match, so dropping it
+ * early keeps the candidate set small. Records whose timestamp is absent or
+ * unparseable are KEPT, never dropped — under-reporting a claimed n is exactly
+ * the failure this source exists to prevent (#952).
+ * @type {number}
+ */
+const EVENTS_MAX_AGE_MS = 2 * 24 * 60 * 60 * 1000;
+
+/**
+ * Read minted semantic session IDs from
+ * `<repoRoot>/.orchestrator/metrics/events.jsonl`.
+ *
+ * Why this source exists (#952 Teil B): `sessions.jsonl` is written at
+ * session-END. A session that is killed before its SessionEnd hook fires never
+ * writes a record, so the `n` it consumed becomes invisible to every other
+ * source and the NEXT session mints the same ID. Proven collision (live ledger,
+ * 2026-07-29): `main-2026-07-29-session-2` was minted twice, 7h57m apart.
+ * `events.jsonl` is append-only and written at CLAIM time by
+ * `hooks/_lib/lock-bootstrap.mjs`, so a minted `n` survives a crash by
+ * construction.
+ *
+ * Read strategy: a bounded TAIL read (`EVENTS_TAIL_BYTES` from the end of the
+ * file), not a whole-file read — events.jsonl grows without bound between
+ * rotations (~1.9 MB at time of writing). When the window does not reach the
+ * start of the file, the first (possibly truncated) line is discarded.
+ *
+ * Robustness contract (mirrors `readSessionIdsFromHistory`):
+ *  - Missing file (ENOENT) → returns [].
+ *  - Permission/FS/read error → returns [] (fail-open; a telemetry read must
+ *    never block the n-claim it feeds).
+ *  - Malformed JSONL line → silently skipped (per-line try/catch).
+ *  - Freshly rotated file → legitimately yields [] or few records. Not an
+ *    error: the three other sources remain in play unchanged.
+ *
+ * @param {string} repoRoot
+ * @returns {Promise<string[]>}  Array of semantic_session_id strings (may include duplicates).
+ */
+async function readSessionIdsFromEvents(repoRoot) {
+  const filePath = path.join(repoRoot, '.orchestrator', 'metrics', 'events.jsonl');
+
+  let text = '';
+  // Assigned in the try below; every path that reaches its read site has
+  // passed through that assignment (the catch returns early).
+  let windowIsPartial;
+  let handle = null;
+  try {
+    handle = await open(filePath, 'r');
+    const { size } = await handle.stat();
+    const start = size > EVENTS_TAIL_BYTES ? size - EVENTS_TAIL_BYTES : 0;
+    windowIsPartial = start > 0;
+    const length = size - start;
+    if (length > 0) {
+      const buf = Buffer.alloc(length);
+      const { bytesRead } = await handle.read(buf, 0, length, start);
+      text = buf.subarray(0, bytesRead).toString('utf8');
+    }
+  } catch {
+    return [];
+  } finally {
+    if (handle !== null) await handle.close().catch(() => {});
+  }
+
+  const lines = text.split(/\r?\n/);
+  // The window started mid-file, so line 0 may be a truncated record.
+  if (windowIsPartial) lines.shift();
+
+  const cutoff = Date.now() - EVENTS_MAX_AGE_MS;
+  const ids = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === '') continue;
+    // Cheap substring pre-filter: events.jsonl carries many event kinds and
+    // JSON.parse on every line of a 1 MiB window is the dominant cost.
+    if (!trimmed.includes(LOCK_ACQUIRED_EVENT)) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      // Malformed line — skip silently (same contract as sessions.jsonl).
+      continue;
+    }
+    if (parsed?.event !== LOCK_ACQUIRED_EVENT) continue;
+    const ts = Date.parse(parsed.timestamp);
+    // Only drop on a PARSEABLE, definitely-stale timestamp (see EVENTS_MAX_AGE_MS).
+    if (Number.isFinite(ts) && ts < cutoff) continue;
+    if (typeof parsed.semantic_session_id === 'string') ids.push(parsed.semantic_session_id);
+  }
+  return ids;
+}
+
 /**
  * Read the `session:` field from `<repoRoot>/.claude/STATE.md` (or `.codex`,
  * `.cursor`, `.pi` — `resolveStateMdPath` picks the active/existing candidate).
@@ -170,10 +289,53 @@ async function readSessionIdFromStateMd(repoRoot) {
   return typeof sessionField === 'string' ? sessionField : null;
 }
 
+/**
+ * Shape adapter for the STATE.md source.
+ *
+ * STATE.md has exactly ONE `session:` slot, so its reader naturally returns
+ * `string|null` while every other source returns `string[]`. This adapter
+ * normalises it to the uniform source signature `(repoRoot) => Promise<string[]>`,
+ * which is what lets `sources` be a single homogeneous array. Before #956 the
+ * mismatch was special-cased twice at the merge site (a `.catch(() => null)`
+ * that differed from its siblings, plus a `stateMdId !== null` spread guard).
+ *
+ * @param {string} repoRoot
+ * @returns {Promise<string[]>}  `[]` when absent/unreadable, else `[sessionId]`.
+ */
+async function readSessionIdsFromStateMd(repoRoot) {
+  const id = await readSessionIdFromStateMd(repoRoot);
+  return id === null ? [] : [id];
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
 
+/**
+ * The default `sources` array for {@link resolveSemanticSessionId} — the three
+ * on-disk candidate-ID readers, in the order they were introduced:
+ *
+ *   1. `readSessionIdsFromHistory`   — `.orchestrator/metrics/sessions.jsonl` (#585)
+ *   2. `readSessionIdsFromStateMd`   — STATE.md frontmatter `session:`        (#585)
+ *   3. `readSessionIdsFromEvents`    — `.orchestrator/metrics/events.jsonl`   (#952)
+ *
+ * Order is irrelevant to the result: aggregation is `max` over the UNION of all
+ * sources, so it is commutative and monotone — an additional source can only
+ * raise `n`, never lower it.
+ *
+ * Exported so callers can derive from it rather than restate it:
+ *   - add a source:  `sources: [...DEFAULT_SESSION_ID_SOURCES, myReader]`
+ *   - drop a source: `sources: DEFAULT_SESSION_ID_SOURCES.filter(s => s !== …)`
+ *   - legacy mode:   `sources: []` (activeSessions only)
+ *
+ * @type {ReadonlyArray<(repoRoot: string) => Promise<string[]>>}
+ */
+export const DEFAULT_SESSION_ID_SOURCES = Object.freeze([
+  readSessionIdsFromHistory,
+  readSessionIdsFromStateMd,
+  readSessionIdsFromEvents,
+]);
+
 /**
  * Parse a session ID string into a structured object.
  *
@@ -228,23 +390,33 @@ export function parseSessionId(id) {
  *   `^[a-z0-9._/-]+-\d{4}-\d{2}-\d{2}-[a-z-]+-\d+$`
  *
  * Counter semantics (PRD §3.A P2 Ubiquitous + #585 history-aware extension):
- *   n = max(existing n values for same branch+date+mode across THREE sources) + 1
+ *   n = max(existing n values for same branch+date+mode across FOUR sources) + 1
  *   When no matching sessions exist anywhere → n = 1.
  *   Gaps are never filled: if existing n = [1, 3] the next is 4, not 2.
  *
  *   Sources consulted (all merged into a single candidate set):
  *     A. opts.activeSessions  — live sessions (lockfiles + host-wide registry).
- *     B. sessions.jsonl       — closed-session history (opt-out via opts.history.consultHistory=false).
- *     C. STATE.md `session:`  — last-resort survivor (opt-out via opts.history.consultStateMd=false).
+ *     B. sessions.jsonl       — closed-session history.
+ *     C. STATE.md `session:`  — last-resort survivor.
+ *     D. events.jsonl         — mint ledger, written at CLAIM time.
  *
- *   Defaults for B and C are ON — historically only source A was consulted,
+ *   B, C and D are `opts.sources` (default: DEFAULT_SESSION_ID_SOURCES, i.e.
+ *   all three ON) — historically only source A was consulted,
  *   which caused n to reset to 1 once the previous session deregistered itself
  *   (root-cause of duplicate-ID incidents documented in #585).
  *
+ *   Source D closes the residual hole (#952 Teil B): B is written at session-END
+ *   and C has exactly ONE slot (an interleaved session of a different mode
+ *   overwrites it, and the mode filter below then discards it). A session killed
+ *   before its SessionEnd hook therefore leaves NO trace in A, B or C, and the
+ *   next session re-mints its n. Proven live: `main-2026-07-29-session-2` was
+ *   minted twice, 7h57m apart. D would have yielded maxN=2 → `session-3`.
+ *
  * Concurrency safety (PSA-005):
- *   All three reads and the n-claim are wrapped in `withStateMdLock` so two
+ *   All `sources` reads and the n-claim are wrapped in `withStateMdLock` so two
  *   concurrent preambles in parallel worktrees observe a consistent view and
- *   cannot assign the same n.
+ *   cannot assign the same n. The #952 collision was NOT a concurrency defect —
+ *   the lock held; the candidate set was incomplete.
  *
  * UUID-v4 entries (in any source) are silently dropped (parseSessionId returns
  * format:'uuid' which the filter excludes). Malformed semantic-looking IDs are
@@ -258,21 +430,27 @@ export function parseSessionId(id) {
  * @param {Array<{sessionId: string}>} [opts.activeSessions=[]] - Active sessions
  *   array from session-discovery. Each element must have a `.sessionId` string.
  *   Defaults to an empty array when omitted or undefined.
+ *   Deliberately NOT part of `sources`: it is `{sessionId}` objects rather than
+ *   strings, and it is already-resolved data gathered BEFORE the call (see
+ *   `hooks/on-session-start.mjs` `deriveSemanticCandidate`), so it is the one
+ *   source NOT covered by the lock's consistent-read guarantee. Wrapping it as
+ *   `async () => data` would hide both facts.
  * @param {string} [opts.repoRoot] - Absolute path to the repo root. Used by
- *   `withStateMdLock`, the sessions.jsonl reader, and the STATE.md reader.
+ *   `withStateMdLock` and passed to every entry of `sources`.
  *   Defaults to `process.cwd()` when omitted.
- * @param {object} [opts.history] - Opt-out + DI controls for the history-aware
- *   sources introduced in #585. All fields optional.
- * @param {boolean} [opts.history.consultHistory=true] - When false, the
- *   sessions.jsonl reader is skipped entirely (legacy-only behaviour).
- * @param {boolean} [opts.history.consultStateMd=true] - When false, the
- *   STATE.md `session:` reader is skipped entirely (legacy-only behaviour).
- * @param {(repoRoot: string) => Promise<string[]>} [opts.history.readHistoryImpl]
- *   Test/DI override for the sessions.jsonl reader. Signature must mirror the
- *   internal helper: returns an array of session_id strings (no throws).
- * @param {(repoRoot: string) => Promise<string|null>} [opts.history.readStateMdSessionImpl]
- *   Test/DI override for the STATE.md reader. Signature must mirror the
- *   internal helper: returns a session_id string or null (no throws).
+ * @param {ReadonlyArray<(repoRoot: string) => Promise<string[]>>} [opts.sources=DEFAULT_SESSION_ID_SOURCES]
+ *   The candidate-ID readers for sources B/C/D — the ONLY DI knob (#956).
+ *   Each entry is a deferred thunk invoked with the effective repo root INSIDE
+ *   `withStateMdLock`, and must resolve to an array of session-ID strings.
+ *   Non-string and unknown-format entries are dropped downstream, so a reader
+ *   may return raw IDs without pre-filtering.
+ *   The default is {@link DEFAULT_SESSION_ID_SOURCES} =
+ *   `[sessions.jsonl reader, STATE.md reader, events.jsonl reader]`.
+ *   Opting a source out = passing a shorter array (`[]` for the pre-#585
+ *   activeSessions-only behaviour); overriding one = passing your own function;
+ *   adding a fifth = appending to the default. Each entry is individually
+ *   error-swallowed (a throwing or rejecting source contributes `[]` and never
+ *   blocks the n-claim), so one bad reader cannot fail the mint.
  * @returns {Promise<string>} The next semantic session ID, e.g. "main-2026-05-27-deep-2".
  * @throws {TypeError} When `branch` is missing, empty, or contains invalid characters.
  * @throws {TypeError} When `mode` is missing, empty, or contains characters other than
@@ -284,7 +462,7 @@ export async function resolveSemanticSessionId({
   mode,
   activeSessions,
   repoRoot,
-  history,
+  sources,
 } = {}) {
   // Input validation — validate before acquiring the lock to fail fast.
   if (!isValidBranch(branch)) {
@@ -298,30 +476,32 @@ export async function resolveSemanticSessionId({
     );
   }
 
-  // Normalise the history opts bag. Both flags default ON — see audit §2.3.
-  const consultHistory = history?.consultHistory !== false;
-  const consultStateMd = history?.consultStateMd !== false;
-  const historyImpl = history?.readHistoryImpl ?? readSessionIdsFromHistory;
-  const stateMdImpl = history?.readStateMdSessionImpl ?? readSessionIdFromStateMd;
+  // Resolve the source set. An explicit array (including []) wins; anything
+  // else — omitted, undefined, non-array — falls back to the documented default.
+  const effectiveSources = Array.isArray(sources) ? sources : DEFAULT_SESSION_ID_SOURCES;
   const effectiveRoot = repoRoot ?? process.cwd();
 
   return withStateMdLock(repoRoot, async () => {
     // Derive the current UTC date as YYYY-MM-DD.
     const today = new Date().toISOString().slice(0, 10);
 
-    // Read the two history-aware sources in parallel. Errors from either source
-    // are swallowed (the .catch() guards belt-and-braces; helpers already
-    // never throw, but a third-party DI impl might).
-    const [historicalIds, stateMdId] = await Promise.all([
-      consultHistory ? historyImpl(effectiveRoot).catch(() => []) : Promise.resolve([]),
-      consultStateMd ? stateMdImpl(effectiveRoot).catch(() => null) : Promise.resolve(null),
-    ]);
+    // Read every source in parallel. Each is individually error-swallowed:
+    // the built-in readers already never throw, but a caller-supplied source
+    // might — and one bad reader must never block the n-claim it feeds. The
+    // Promise.resolve().then() wrapper also catches a SYNCHRONOUS throw, which
+    // a bare `.catch()` on the return value would not.
+    const perSourceIds = await Promise.all(
+      effectiveSources.map((read) =>
+        Promise.resolve()
+          .then(() => read(effectiveRoot))
+          .catch(() => []),
+      ),
+    );
 
     // Build a single candidate stream. Duplicates are fine — Math.max handles them.
     const candidateIds = [
       ...(activeSessions ?? []).map((s) => s?.sessionId),
-      ...historicalIds,
-      ...(stateMdId !== null ? [stateMdId] : []),
+      ...perSourceIds.flat(),
     ];
 
     // Match against (branch, date, mode) and project to n.