fix(sessions): make a dry run decide at removal time like a real prune

A dry run appended every planned session to Removed without calling
pruneSession, so none of the checks made once a session is held for removal
ran: the second lease check, the re-read of the last update, and the scan for
a child created after the plan. On the same disk, a dry run could list a
session that a real run keeps.

pruneSession now takes a dry-run flag, makes every one of those checks under
the same locks, and stops before removing anything. The prune command reports
a session a dry run could not check as such, not as one it could not remove.

Author: Vasanthdev2004

internal/cli/sessions_prune.go

@@ -121,7 +121,11 @@ func formatPruneReport(report sessions.PruneReport) string {
 		}
 	}
 	if len(report.Failed) > 0 {
-		fmt.Fprintf(&out, "Could not remove %d:\n", len(report.Failed))
+		failed := "Could not remove"
+		if report.DryRun {
+			failed = "Could not check"
+		}
+		fmt.Fprintf(&out, "%s %d:\n", failed, len(report.Failed))
 		for _, entry := range report.Failed {
 			fmt.Fprintf(&out, "  %s\n", formatPruneEntry(entry, redact(entry.Reason)))
 		}

internal/cli/sessions_prune_test.go

@@ -71,6 +71,20 @@ func TestSessionsPruneDryRunListsWithoutRemoving(t *testing.T) {
 	}
 }
 
+// A dry run removes nothing, so a session it could not check is not reported
+// as one it could not remove.
+func TestSessionsPruneDryRunReportsFailuresAsUnchecked(t *testing.T) {
+	failed := []sessions.PruneEntry{{SessionID: "old-session", UpdatedAt: "2020-01-01T00:00:00Z", Reason: "the session disappeared while pruning"}}
+	dryRun := formatPruneReport(sessions.PruneReport{Cutoff: "2026-08-27T00:00:00Z", DryRun: true, Failed: failed})
+	if !strings.Contains(dryRun, "Could not check 1:") || strings.Contains(dryRun, "Could not remove") {
+		t.Errorf("dry run report:\n%s", dryRun)
+	}
+	run := formatPruneReport(sessions.PruneReport{Cutoff: "2026-08-27T00:00:00Z", Failed: failed})
+	if !strings.Contains(run, "Could not remove 1:") {
+		t.Errorf("report:\n%s", run)
+	}
+}
+
 func TestSessionsPruneRemovesOnlyOldSessions(t *testing.T) {
 	root, _, deps := pruneCLIFixture(t)
 	code, stdout, stderr := runPruneCLI(t, deps, "prune", "--older-than=30d")

internal/sessions/prune.go

@@ -23,7 +23,9 @@ type PruneOptions struct {
 	// OlderThan makes a session a candidate when it was last updated at least
 	// this long ago. It must be at least MinimumPruneAge.
 	OlderThan time.Duration
-	// DryRun decides everything a real run would and removes nothing.
+	// DryRun decides everything a real run would and removes nothing. It takes
+	// the same locks to decide, so a Zero opening a session at the moment it is
+	// being checked is told to try again, as it would be during a real run.
 	DryRun bool
 }
 
@@ -48,8 +50,9 @@ type PruneReport struct {
 	Removed []PruneEntry `json:"removed"`
 	// Kept are sessions Prune left for a reason other than being recent.
 	Kept []PruneEntry `json:"kept"`
-	// Failed are sessions whose removal went wrong; Reason says how. A failure
-	// after the metadata was removed leaves a directory List no longer shows.
+	// Failed are sessions whose removal went wrong, or in a dry run could not be
+	// checked; Reason says how. A failure after the metadata was removed leaves
+	// a directory List no longer shows.
 	Failed []PruneEntry `json:"failed"`
 }
 
@@ -172,11 +175,7 @@ func (store *Store) Prune(options PruneOptions) (PruneReport, error) {
 			continue
 		}
 		entry := store.pruneEntry(session, "")
-		if options.DryRun {
-			report.Removed = append(report.Removed, entry)
-			continue
-		}
-		removed, keptReason, err := store.pruneSession(session.SessionID, cutoff, byID)
+		removed, keptReason, err := store.pruneSession(session.SessionID, cutoff, byID, options.DryRun)
 		switch {
 		case err != nil:
 			entry.Reason = err.Error()
@@ -268,8 +267,10 @@ func (store *Store) childCreatedAfterPlan(sessionID string, planned map[string]M
 // once the metadata is gone, even when leftovers could not be deleted (err says
 // what), and a keptReason when the session turned out to be open, was written
 // since the plan, or has a child the plan did not know about. planned is every
-// session the plan saw.
-func (store *Store) pruneSession(sessionID string, cutoff time.Time, planned map[string]Metadata) (removed bool, keptReason string, err error) {
+// session the plan saw. A dry run makes every one of those checks under the
+// same locks and stops before removing anything; removed then says a real run
+// would have gone on to remove the session.
+func (store *Store) pruneSession(sessionID string, cutoff time.Time, planned map[string]Metadata, dryRun bool) (removed bool, keptReason string, err error) {
 	releaseLease, locked, err := store.HoldExclusive(sessionID)
 	if err != nil {
 		return false, "", fmt.Errorf("check the session's lease: %w", err)
@@ -323,6 +324,9 @@ func (store *Store) pruneSession(sessionID string, cutoff time.Time, planned map
 	if child {
 		return false, PruneKeptParent, nil
 	}
+	if dryRun {
+		return true, "", nil
+	}
 
 	// THE METADATA FIRST. From here the session no longer exists to List or Get.
 	if err := os.Remove(store.metadataPath(sessionID)); err != nil {

internal/sessions/prune_race_test.go

@@ -2,6 +2,7 @@ package sessions
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -43,6 +44,106 @@ func TestPruneKeepsAParentForkedAfterThePlan(t *testing.T) {
 	}
 }
 
+// A dry run decides what a real run would, including what only shows once a
+// session is held for removal: a fork made after the plan, a write since the
+// plan, and a process that opened the session since the plan. Each case runs
+// both ways from the same start, and both reports must be the one wanted.
+func TestPruneDryRunDecidesLikeARealRunAtRemoval(t *testing.T) {
+	cases := []struct {
+		name string
+		// create lays out the sessions. afterPlan changes them once the plan is
+		// made, and returns what to undo when Prune has finished.
+		create    func(t *testing.T, root string)
+		afterPlan func(t *testing.T, root string) (undo func())
+		want      string
+	}{
+		{
+			name: "a fork made after the plan",
+			create: func(t *testing.T, root string) {
+				createFinishedSession(t, root, "parent", "2026-06-01T00:00:00Z", "")
+			},
+			afterPlan: func(t *testing.T, root string) func() {
+				other := NewStore(StoreOptions{RootDir: root, Now: fixedClock("2026-09-25T00:00:00Z")})
+				if _, err := other.Fork("parent", ForkInput{SessionID: "late"}); err != nil {
+					t.Errorf("fork after the plan: %v", err)
+				}
+				other.Release("late")
+				other.Release("parent")
+				return func() {}
+			},
+			want: "removed [] kept [parent: " + PruneKeptParent + "] failed []",
+		},
+		{
+			name: "a write since the plan",
+			create: func(t *testing.T, root string) {
+				createFinishedSession(t, root, "parent", "2026-06-01T00:00:00Z", "")
+				createFinishedSession(t, root, "child", "2026-06-15T00:00:00Z", "parent")
+			},
+			afterPlan: func(t *testing.T, root string) func() {
+				rewriteUpdatedAt(t, root, "child", "2026-09-25T23:00:00Z")
+				return func() {}
+			},
+			want: "removed [] kept [child: " + PruneKeptUpdated + ", parent: " + PruneKeptParent + "] failed []",
+		},
+		{
+			name: "a session opened since the plan",
+			create: func(t *testing.T, root string) {
+				createFinishedSession(t, root, "opened", "2026-06-01T00:00:00Z", "")
+				createFinishedSession(t, root, "idle", "2026-06-02T00:00:00Z", "")
+			},
+			afterPlan: func(t *testing.T, root string) func() {
+				other := NewStore(StoreOptions{RootDir: root})
+				if busy := other.hold("opened"); busy {
+					t.Error("SETUP INVALID: the session was busy when opened after the plan")
+				}
+				return func() { other.Release("opened") }
+			},
+			want: "removed [idle] kept [opened: " + PruneKeptOpen + "] failed []",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() { prunePlannedSeam = nil }()
+			for _, dryRun := range []bool{false, true} {
+				root := t.TempDir()
+				tc.create(t, root)
+				before := sessionDirNames(t, root)
+				var undo func()
+				prunePlannedSeam = func() { undo = tc.afterPlan(t, root) }
+				report, err := pruneStore(root).Prune(PruneOptions{OlderThan: thirtyDays, DryRun: dryRun})
+				prunePlannedSeam = nil
+				if undo == nil {
+					t.Fatal("SETUP INVALID: nothing changed after the plan")
+				}
+				undo()
+				if err != nil {
+					t.Fatalf("dry run %v: Prune: %v", dryRun, err)
+				}
+				if got := pruneSummary(report); got != tc.want {
+					t.Errorf("dry run %v: the report is %s, want %s", dryRun, got, tc.want)
+				}
+				if !dryRun {
+					continue
+				}
+				for _, id := range before {
+					if _, err := os.Stat(pruneStore(root).metadataPath(id)); err != nil {
+						t.Errorf("the dry run removed the metadata of %s: %v", id, err)
+					}
+				}
+			}
+		})
+	}
+}
+
+// pruneSummary puts what a report decided on one line, in report order.
+func pruneSummary(report PruneReport) string {
+	kept := []string{}
+	for _, entry := range report.Kept {
+		kept = append(kept, entry.SessionID+": "+entry.Reason)
+	}
+	return fmt.Sprintf("removed %v kept [%s] failed %v", pruneIDs(report.Removed), strings.Join(kept, ", "), pruneIDs(report.Failed))
+}
+
 // Prune removes the metadata first and unlinks lease.lock after it. A process
 // that picked the session a moment earlier and only now takes its lease creates
 // a fresh lease.lock in the directory prune is emptying, and locks it with