fix(sessions): keep a parent forked after the plan, and refuse sessions removed under a caller

Three gaps jatmn found in the prune lease rules.

A fork made after prune's plan, by a process that has since exited,
was not in the plan, so its old parent was removed and the fork was
left under a missing ancestor. Once prune holds a parent exclusively it
now looks for sessions the plan did not see that name it as parent,
and keeps it if there is one.

Store.Create with a ParentSessionID, which exec --calling-session-id
and spec implementations use, did not hold the parent at all. It now
holds it the way Fork and CreateChild do, and all three refuse a
parent whose directory is still there without its metadata: prune
removes the metadata first and unlinks lease.lock after it, so a lease
taken at that moment lands on a fresh lease file and proves nothing.

A resume, exec --resume or --fork, or ACP load that picked a session a
moment before prune removed it could take a fresh lease and read the
session as empty. HoldToContinue now holds the picked session and
requires its metadata, and those callers go through it. The
rehydrated read on its own still reads a missing session as empty.

Author: Vasanthdev2004

internal/acp/agent.go

@@ -914,6 +914,12 @@ func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRec
 	// enough: rehydration substitutes the compaction event in place of the events
 	// it replaced, so a loop that skips everything but EventMessage would drop the
 	// summary exactly as before. It is projected below. Reported by @jatmn.
+	//
+	// The session was picked from its metadata a moment ago. Make sure it is
+	// still there, and held, before restoring it: see sessions.HoldToContinue.
+	if err := a.deps.Store.HoldToContinue(sessionID); err != nil {
+		return nil, nil, nil, err
+	}
 	events, eventLogPresent, err := a.deps.Store.ReadRehydratedEventsWithPresence(sessionID)
 	var rehydrateWarning error
 	if err != nil {

internal/acp/agent_test.go

@@ -2455,3 +2455,31 @@ func TestACPLoadAndResumeAreRefusedWhilePruneHoldsTheSession(t *testing.T) {
 		t.Fatal("a session refused while prune held it was still promptable")
 	}
 }
+
+// Activation reads the session's metadata before it restores the history. A
+// session prune removes in between is refused as removed, which activation then
+// refuses to publish for load as well as resume, instead of restoring it as an
+// empty conversation.
+func TestACPLoadHistoryRefusesASessionRemovedAfterItWasPicked(t *testing.T) {
+	deps := testDeps(t)
+	meta, err := deps.Store.Create(sessions.CreateInput{Title: "ACP session", Cwd: t.TempDir()})
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+	deps.Store.Release(meta.SessionID)
+	dir := filepath.Join(deps.Store.RootDir, meta.SessionID)
+	if err := os.Remove(filepath.Join(dir, sessions.MetadataFile)); err != nil {
+		t.Fatal(err)
+	}
+
+	a := &Agent{deps: deps}
+	if _, _, _, err := a.loadHistory(meta.SessionID, false); !errors.Is(err, sessions.ErrPruning) {
+		t.Errorf("load history of a session prune is removing: err = %v, want it refused", err)
+	}
+	if err := os.RemoveAll(dir); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, _, err := a.loadHistory(meta.SessionID, false); !errors.Is(err, sessions.ErrPruning) {
+		t.Errorf("load history of a session prune removed: err = %v, want it refused", err)
+	}
+}

internal/sessions/exec_session.go

@@ -152,6 +152,11 @@ func PrepareExec(options PrepareExecOptions) (PreparedExec, error) {
 }
 
 func readExecContextEvents(store *Store, sessionID string) ([]Event, error) {
+	// The session was picked from its metadata a moment ago. Make sure it is
+	// still there, and held, before reading it to continue: see HoldToContinue.
+	if err := store.HoldToContinue(sessionID); err != nil {
+		return nil, err
+	}
 	contextEvents, err := store.ReadRehydratedEvents(sessionID)
 	if err == nil {
 		return contextEvents, nil

internal/sessions/lease.go

@@ -3,6 +3,7 @@ package sessions
 import (
 	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"sync"
@@ -36,24 +37,101 @@ func (store *Store) Hold(sessionID string) {
 	store.hold(sessionID)
 }
 
-// ErrPruning is returned, wrapped, when a process tries to continue a session,
-// or to create a session under it, while zero sessions prune holds it.
-var ErrPruning = errors.New("locked by zero sessions prune; try again")
+// ErrPruning is matched, through errors.Is, by the error a process gets when it
+// tries to continue a session, or to create a session under it, while zero
+// sessions prune holds that session or once it has removed it.
+var ErrPruning = errors.New("locked by zero sessions prune")
+
+// pruneRefusal is an error matching ErrPruning whose message says which of the
+// two it was.
+type pruneRefusal struct{ message string }
+
+func (refusal pruneRefusal) Error() string { return refusal.message }
+
+func (refusal pruneRefusal) Is(target error) bool { return target == ErrPruning }
+
+func pruneBusy(sessionID string) error {
+	return pruneRefusal{"zero session " + sessionID + " is locked by zero sessions prune; try again"}
+}
+
+func pruneRemoved(sessionID string) error {
+	return pruneRefusal{"zero session " + sessionID + " was removed while it was being opened"}
+}
 
 // holdOrRefuse holds a session that is about to be read in order to continue it
 // (the rehydrated read behind the TUI's resume, exec --resume and --fork, and
 // ACP's session/load and session/resume) or to create a session under it (Fork,
-// CreateChild). When prune holds it at this moment the caller is refused rather
-// than left to read it without the lease: prune could then remove a session
-// this process goes on to use, or one a new session is created under, whose
-// Lineage and Tree fail on a missing ancestor.
+// CreateChild, Create with a parent). When prune holds it at this moment the
+// caller is refused rather than left to read it without the lease: prune could
+// then remove a session this process goes on to use, or one a new session is
+// created under, whose Lineage and Tree fail on a missing ancestor.
 func (store *Store) holdOrRefuse(sessionID string) error {
 	if store.hold(sessionID) {
-		return fmt.Errorf("zero session %s is %w", sessionID, ErrPruning)
+		return pruneBusy(sessionID)
+	}
+	return nil
+}
+
+// holdParent is holdOrRefuse for the session a new one is created under: Fork,
+// CreateChild, and Create with a ParentSessionID.
+//
+// HOLDING A LEASE FILE DOES NOT PROVE THE SESSION IS STILL THERE. Prune removes
+// the metadata first and unlinks lease.lock after it, so a process that takes
+// the lease just then creates a fresh lease.lock in a directory prune is
+// emptying, and locks it with nothing to contend with. So a parent whose
+// directory still exists without its metadata is refused once the lease is
+// held. A parent whose directory is gone altogether is left alone, as before: a
+// session may name a parent this store never had.
+func (store *Store) holdParent(parentSessionID string) error {
+	if err := store.holdOrRefuse(parentSessionID); err != nil {
+		return err
+	}
+	if store.beingRemoved(parentSessionID) {
+		store.dropStrayLease(parentSessionID)
+		return pruneRemoved(parentSessionID)
 	}
 	return nil
 }
 
+// HoldToContinue holds a session the caller has already picked, having read its
+// metadata, and is about to continue: the TUI's resume, exec --resume and
+// --fork, and ACP's session/load and session/resume. It refuses, with an error
+// matching ErrPruning, a session prune holds and one that is gone by the time it
+// is held, whether prune is part way through removing it or has finished.
+// Callers must not fall back to reading the session another way on that error.
+// ReadRehydratedEvents on its own still reads a session that does not exist as
+// an empty one, for callers that picked nothing.
+func (store *Store) HoldToContinue(sessionID string) error {
+	if err := store.holdOrRefuse(sessionID); err != nil {
+		return err
+	}
+	if _, err := os.Stat(store.metadataPath(sessionID)); errors.Is(err, fs.ErrNotExist) {
+		store.dropStrayLease(sessionID)
+		return pruneRemoved(sessionID)
+	}
+	return nil
+}
+
+// beingRemoved reports a session directory that exists without its metadata:
+// one prune is part way through removing.
+func (store *Store) beingRemoved(sessionID string) bool {
+	if _, err := os.Stat(store.metadataPath(sessionID)); !errors.Is(err, fs.ErrNotExist) {
+		return false
+	}
+	info, err := os.Stat(store.sessionPath(sessionID))
+	return err == nil && info.IsDir()
+}
+
+// dropStrayLease gives back a lease taken on a session that turned out to be
+// gone, and removes the lease file it may have created afresh in a directory
+// prune is emptying, so that prune can still remove the directory.
+func (store *Store) dropStrayLease(sessionID string) {
+	store.Release(sessionID)
+	if store.beingRemoved(sessionID) {
+		_ = os.Remove(store.leasePath(sessionID))
+	}
+}
+
 // hold is Hold, reporting busy when the lease could not be taken because prune
 // holds it exclusively right now.
 func (store *Store) hold(sessionID string) (busy bool) {

internal/sessions/lineage.go

@@ -10,7 +10,7 @@ func (store *Store) CreateChild(parentSessionID string, input ChildInput) (Metad
 	if !ValidSessionID(parentSessionID) {
 		return Metadata{}, fmt.Errorf("invalid zero session id %q", parentSessionID)
 	}
-	if err := store.holdOrRefuse(parentSessionID); err != nil {
+	if err := store.holdParent(parentSessionID); err != nil {
 		return Metadata{}, err
 	}
 	parent, err := store.Get(parentSessionID)

internal/sessions/prune.go

@@ -69,12 +69,16 @@ var pruneRemoveSeam func(sessionID string)
 // says whether Prune still holds the lease. Nil in production.
 var pruneRemoveDirSeam func(sessionID string, leaseHeld bool)
 
+// prunePlannedSeam runs once Prune has made its plan and before it removes
+// anything. Nil in production.
+var prunePlannedSeam func()
+
 // Prune removes sessions last updated before the cutoff that OlderThan sets.
 //
 // Only on request: nothing in Zero calls it by itself (#971). It never removes:
 //   - a session another process has open, which holds its lease (see Hold);
-//   - a session with a descendant that is kept, because Lineage and Tree fail
-//     on a missing ancestor;
+//   - a session with a descendant that is kept, including one created after the
+//     plan was made, because Lineage and Tree fail on a missing ancestor;
 //   - a session written between the plan and its removal;
 //   - a session whose last update time cannot be read.
 //
@@ -157,6 +161,9 @@ func (store *Store) Prune(options PruneOptions) (PruneReport, error) {
 		}
 		return order[left].SessionID < order[right].SessionID
 	})
+	if prunePlannedSeam != nil {
+		prunePlannedSeam()
+	}
 
 	keep := map[string]bool{}
 	for _, session := range order {
@@ -169,7 +176,7 @@ func (store *Store) Prune(options PruneOptions) (PruneReport, error) {
 			report.Removed = append(report.Removed, entry)
 			continue
 		}
-		removed, keptReason, err := store.pruneSession(session.SessionID, cutoff)
+		removed, keptReason, err := store.pruneSession(session.SessionID, cutoff, byID)
 		switch {
 		case err != nil:
 			entry.Reason = err.Error()
@@ -230,11 +237,39 @@ func (store *Store) sessionBytes(sessionID string) int64 {
 	return total
 }
 
+// childCreatedAfterPlan reports whether a session the plan did not see names
+// sessionID as its parent. Only sessions missing from planned are read, so the
+// cost is one directory listing plus whatever was created since the plan.
+func (store *Store) childCreatedAfterPlan(sessionID string, planned map[string]Metadata) (bool, error) {
+	entries, err := os.ReadDir(store.RootDir)
+	if err != nil {
+		return false, err
+	}
+	for _, entry := range entries {
+		id := entry.Name()
+		if !entry.IsDir() || id == sessionID {
+			continue
+		}
+		if _, seen := planned[id]; seen {
+			continue
+		}
+		child, err := store.readMetadata(id)
+		if err != nil {
+			continue // not a session, or one without its metadata
+		}
+		if child.ParentSessionID == sessionID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 // pruneSession removes one session that planning chose. It reports removed
 // once the metadata is gone, even when leftovers could not be deleted (err says
-// what), and a keptReason when the session turned out to be open or was written
-// since the plan.
-func (store *Store) pruneSession(sessionID string, cutoff time.Time) (removed bool, keptReason string, err error) {
+// what), and a keptReason when the session turned out to be open, was written
+// since the plan, or has a child the plan did not know about. planned is every
+// session the plan saw.
+func (store *Store) pruneSession(sessionID string, cutoff time.Time, planned map[string]Metadata) (removed bool, keptReason string, err error) {
 	releaseLease, locked, err := store.HoldExclusive(sessionID)
 	if err != nil {
 		return false, "", fmt.Errorf("check the session's lease: %w", err)
@@ -276,6 +311,18 @@ func (store *Store) pruneSession(sessionID string, cutoff time.Time) (removed bo
 	if !updated.Before(cutoff) {
 		return false, PruneKeptUpdated, nil
 	}
+	// A session forked or given a child after the plan was made, by a process that
+	// has exited since, is not in the plan, and nothing else would stop its parent
+	// going. Every way of creating a session under a parent holds that parent
+	// first (holdParent), so none can start while this lease is held exclusively,
+	// and one that finished has its metadata on disk.
+	child, err := store.childCreatedAfterPlan(sessionID, planned)
+	if err != nil {
+		return false, "", fmt.Errorf("look for sessions created under it: %w", err)
+	}
+	if child {
+		return false, PruneKeptParent, nil
+	}
 
 	// THE METADATA FIRST. From here the session no longer exists to List or Get.
 	if err := os.Remove(store.metadataPath(sessionID)); err != nil {

internal/sessions/prune_race_test.go

@@ -0,0 +1,101 @@
+package sessions
+
+import (
+	"errors"
+	"os"
+	"strings"
+	"testing"
+)
+
+// A fork made after prune's plan, by a process that has exited since, is not in
+// the plan and holds nothing. It still keeps its parent: once prune holds that
+// parent exclusively it looks for children the plan did not know about.
+func TestPruneKeepsAParentForkedAfterThePlan(t *testing.T) {
+	root := t.TempDir()
+	createFinishedSession(t, root, "parent", "2026-06-01T00:00:00Z", "")
+
+	forked := false
+	prunePlannedSeam = func() {
+		other := NewStore(StoreOptions{RootDir: root, Now: fixedClock("2026-09-25T00:00:00Z")})
+		if _, err := other.Fork("parent", ForkInput{SessionID: "late"}); err != nil {
+			t.Errorf("fork after the plan: %v", err)
+			return
+		}
+		forked = true
+		// The forking process exits, and its leases go with it.
+		other.Release("late")
+		other.Release("parent")
+	}
+	defer func() { prunePlannedSeam = nil }()
+
+	report, err := pruneStore(root).Prune(PruneOptions{OlderThan: thirtyDays})
+	if err != nil {
+		t.Fatalf("Prune: %v", err)
+	}
+	if !forked {
+		t.Fatal("SETUP INVALID: the fork after the plan never happened")
+	}
+	if reason := keptReason(report, "parent"); reason != PruneKeptParent {
+		t.Errorf("parent kept for %q, want %q (removed %v)", reason, PruneKeptParent, pruneIDs(report.Removed))
+	}
+	if lineage, err := pruneStore(root).Lineage("late"); err != nil || len(lineage) != 2 {
+		t.Fatalf("the late fork's lineage is broken: %d entries, %v", len(lineage), err)
+	}
+}
+
+// Prune removes the metadata first and unlinks lease.lock after it. A process
+// that picked the session a moment earlier and only now takes its lease creates
+// a fresh lease.lock in the directory prune is emptying, and locks it with
+// nothing to contend with. Continuing the session, or creating one under it, is
+// refused all the same, and prune still removes the directory.
+func TestContinuingASessionPruneIsRemovingIsRefused(t *testing.T) {
+	root := t.TempDir()
+	createFinishedSession(t, root, "old", "2026-06-01T00:00:00Z", "")
+	other := NewStore(StoreOptions{RootDir: root})
+
+	reached := false
+	pruneRemoveDirSeam = func(id string, _ bool) {
+		if id != "old" {
+			return
+		}
+		reached = true
+		if _, err := os.Stat(other.metadataPath("old")); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("SETUP INVALID: the metadata is still there at the seam: %v", err)
+		}
+		if err := other.HoldToContinue("old"); !errors.Is(err, ErrPruning) || !strings.Contains(err.Error(), "was removed") {
+			t.Errorf("continue a session prune is removing: err = %v, want it refused as removed", err)
+		}
+		if events, err := readExecContextEvents(other, "old"); !errors.Is(err, ErrPruning) || events != nil {
+			t.Errorf("exec context read of a session prune is removing: %d events, err = %v, want it refused", len(events), err)
+		}
+		if _, err := other.Create(CreateInput{SessionID: "child", ParentSessionID: "old"}); !errors.Is(err, ErrPruning) {
+			t.Errorf("create a session under one prune is removing: err = %v, want it refused", err)
+		}
+	}
+	defer func() { pruneRemoveDirSeam = nil }()
+
+	report, err := pruneStore(root).Prune(PruneOptions{OlderThan: thirtyDays})
+	if err != nil {
+		t.Fatalf("Prune: %v", err)
+	}
+	if !reached {
+		t.Fatal("SETUP INVALID: prune never reached the directory removal")
+	}
+	if strings.Join(pruneIDs(report.Removed), ",") != "old" || len(report.Failed) != 0 {
+		t.Errorf("removed %v, failed %v: the refused continuation must not keep prune from removing the directory", pruneIDs(report.Removed), pruneIDs(report.Failed))
+	}
+	if sessionDirExists(t, root, "old") || sessionDirExists(t, root, "child") {
+		t.Errorf("left behind: old=%v child=%v", sessionDirExists(t, root, "old"), sessionDirExists(t, root, "child"))
+	}
+
+	// Once prune has finished, the session the caller picked is simply gone, and
+	// continuing it is refused the same way.
+	if err := other.HoldToContinue("old"); !errors.Is(err, ErrPruning) {
+		t.Errorf("continue a session prune removed: err = %v, want it refused", err)
+	}
+	// A caller that picked nothing still reads a missing session as empty.
+	events, present, err := other.ReadRehydratedEventsWithPresence("never-existed")
+	if err != nil || present || len(events) != 0 {
+		t.Errorf("rehydrated read of a session that never existed = %d events, present=%v, err=%v; want empty", len(events), present, err)
+	}
+}