refactor(session): separate retention orchestration from storage

[snowykr]

Task admission stack — 03: separate retention orchestration from storage

Depends on settings/native predecessors (#6277 and #6281) in the prepared branch stack. Base stays dev. Own production added+deleted 336 lines; actual dev diff at approved settings merge 345b2782… 336 lines, this layer only. Native #6277 and settings #6281 were externally approved/merged; neither preceding delta is re-applied. Extraction additions AND deletions count.

Move complete existing retention plan/probe/retire orchestration to session-retirement.ts; owning storage remains the verified-delete primitive. Extract one shared first-JSONL-line parser, update the sole direct runtime caller in GC, remove old exports without compatibility aliases. This semantic boundary avoids the storage↔managed-scope runtime cycle when owner-aware retirement arrives later.

Behavior-neutral: no new owner publication, destructive capability, journal schema, task admission or legacy parsing behavior is enabled. No user-facing changelog fragment is added for this internal ownership-only extraction.

Exact-prefix verification

Owned-only conflict-free integration onto actual approved settings merge 345b27820380071509222b734f45b41b739e50d0. Neither native nor settings duplicate reapplied. Every listed prefix test/package gate freshly rerun at this current exact head. Prior head 98d0f1… code-event 37132359578 succeeded but its review is DISMISSED, not current approval; old stale-base REQUEST_CHANGES is audited. Actual 851556… code-event 37135926599 completed successfully. Exact-head review 5401752481 is APPROVED by probepark (write permission verified). External maintainer Yeachan-Heo merged that head at 2026-10-03T16:56:29Z, merge commit 8e709f5964987ab7dc206ca9d4b86c9e039f3803. The later prepared/rebased branch 75a7abf1… was pushed during the external merge transition; it is NOT the reviewed or merged head and receives no transferred approval.
Head 85155636fe40056498a99674bdb90aa338ef1568 independently checked in clean detached nonnested QA with real byte-bound unchanged-native-source addon and committed strict provenance; no metadata rewrite:

• bun test GC disk-retention, GC session-scope and session-storage suites: exit0; full counts/output retained.
• Package vendor/Biome/TypeScript checks passed; exact tracked checkout remained clean.
• git diff --check passed.
• Existing skips and large-file/unused-loader/String.raw warnings retained, not suppressed. Local runtime proof is Darwin-only; successful code-event CI is separately identified above. No final owner-aware GC or task integration is claimed.

Reference #6240 and protected44-staged original untouched. Later owner codec/access/retirement/GC/SDK layers remain separate, with production activation last. External exact-head approval and merge observed as recorded above; the leader did not merge. No approval applies to the later prepared branch or unfinished consumers.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[probepark]

Review (head 9d1f305, gajae-reviewer on behalf of probepark)

CI: PR cause 1 — Affected path validation / plan fails with Exact-head CI requires this PR head to contain base 100502f8f96727953856b9f57597a2d6a96f6c6d; rebase onto current dev. (job 111225482420). Confirmed locally: git merge-base --is-ancestor 100502f8 9d1f305 → exit 1; merge-base is 2a97f5f. Because plan short-circuits, evidence producer / the aggregate also fail and every affected shard (coding-agent check/types/tests, native-build) is unevaluated on this head, not passing.
Scope: +408 / -173, 13 files vs merge-base 2a97f5f — 3 commits: b7fafa1 (#6277, natives), a6ab76a (#6281, readonly settings snapshots), 9d1f305 (this PR, session retirement extraction).
Conventions: changelog.d fragments present for the settings and natives commits; none for the retirement extraction, which is reasonable for an internal, behavior-neutral move. No generated files touched by hand (packages/natives/native/diagnostic-artifact.json comes from #6277). No labels.
Notable:

• packages/coding-agent/src/session/session-retirement.ts:1-155 — I diffed this against the removed block of session-storage.ts (prior lines 3535–3677). It is a byte-identical move. The only changes are the new import block and createHash/randomUUID → crypto.createHash/crypto.randomUUID. SessionDeleteVerificationError, VerifiedSessionDeleteTarget and SessionStorageSnapshot remain exported from session-storage.ts (L402, L417, L57), so the type/value imports resolve. No import cycle: session-retirement → session-storage/session-transcript-header only.
• packages/coding-agent/src/gjc-runtime/gc-runtime.ts:33 is the only remaining consumer of probeSessionRetirement/retireSessionTranscript at this head (grep over packages/), so removing the old exports without aliases breaks no caller. parseFirstJsonlLine moved verbatim to session-transcript-header.ts, and session-storage.ts still uses it at L2796/L3466. utf8Decoder stays used in storage.
  Blocking:

1. Stale base / stale stack prefix. The head does not contain current dev (100502f8). #6277 was squash-merged into dev as 8de425e, but this branch still carries the pre-squash commit b7fafa1, so the PR diff re-applies the natives changes (path_identity.rs, diagnostic-artifact.json, the natives changelog fragment) on top of their squashed copy. It also bundles #6281's a6ab76a, which is still open and unreviewed. Rebase onto current dev so the exact-head plan runs: after #6281 lands, or with #6281's commit kept as an explicit, reviewed prefix. Then re-request review. On the current tree the code itself looks approvable; this verdict is about CI evidence and the stack shape only.

PR body has no verdict line (count=0), so the body was not edited. Suggested verdict line: gajae.pr-review-verdict.v1 needs-human sha256:24f108341a832c5b19663d31c0caec28b6e12c3b7a5c332977a1b8c38dbefca5 reviewer:critic reviewer-id:gajae-reviewer evidence:stale-base-plan-fail;head-lacks-dev-100502f8;pre-squash-6277-commit-carried;retirement-move-byte-identical

Verdict: gajae.pr-review-verdict.v1 needs-human sha256:24f108341a832c5b19663d31c0caec28b6e12c3b7a5c332977a1b8c38dbefca5 reviewer:critic reviewer-id:gajae-reviewer evidence:stale-base-plan-fail;head-lacks-dev-100502f8;pre-squash-6277-commit-carried;retirement-move-byte-identical

[probepark]

Review (head 98d0f1a, gajae-reviewer on behalf of probepark)

CI: green — 21 pass / 17 skipping, 0 pending, 0 failed at this head; approve gate ALLOW (check:@gajae-code/coding-agent covered by the head CI plan, Affected path validation green).
Scope: +399 / -169, 10 files — packages/coding-agent/src/session (retirement extraction), src/gjc-runtime/gc-runtime.ts (import), and the stacked #6281 commit ce22d61 (config/settings.ts, capability/*, discovery/helpers.ts, settings test, changelog fragment). Head contains base 8de425ed (ahead 2 / behind 0), so the stale-base blocker from my CHANGES_REQUESTED on 9d1f305 no longer applies; this review supersedes it.
Conventions: changelog fragment present for the settings change (changelog.d/task-stack-readonly-settings.md); none for the internal extraction, which the body declares behavior-neutral — fine. No generated files, no released CHANGELOG section edits.
Notable:

• src/session/session-retirement.ts:1-155 — planSessionRetirement / probeSessionRetirement / retireSessionTranscript / SessionRetirementOutcome are a byte-equivalent move of the block removed from session-storage.ts (old lines 3534-3677); only createHash/randomUUID became crypto.*. session-storage.ts still imports createHash, randomUUID for its own remaining uses (lines 622, 786, 906, ...), so no dead import.
• src/session/session-transcript-header.ts:4 — parseFirstJsonlLine moved verbatim; git grep at head shows the only callers are session-storage.ts:2796,3466, session-retirement.ts, and gc-runtime.ts:33 imports the retirement functions from the new module. No stale importer of the removed exports.
• Note (non-blocking): this PR carries the still-open #6281 commit ce22d61; merging #6281 first keeps the dev history matching the declared stack.
  Blocking: none

Body has no gajae.pr-review-verdict.v1 line (count=0), not updated. Suggested verdict line: gajae.pr-review-verdict.v1 merge-approved sha256:15b6ab0fc761be0db54ea285c3d46ca3d9f90ce5ab405f1124bef5ced99a5763 reviewer:human reviewer-id:probepark evidence:ci-green;approve-gate-allow;byte-equivalent-move-checked;no-stale-importers;base-current

Verdict: gajae.pr-review-verdict.v1 merge-approved sha256:15b6ab0fc761be0db54ea285c3d46ca3d9f90ce5ab405f1124bef5ced99a5763 reviewer:human reviewer-id:probepark evidence:ci-green;approve-gate-allow;byte-equivalent-move-checked;no-stale-importers;base-current

The merge-base changed after approval.

[probepark]

Review (head 8515563, gajae-reviewer on behalf of probepark)

CI: green — affected-path validation, coding-agent checks, targeted session/GC tests, state gates, and virtual integration validation passed; approve gate ALLOW.
Scope: +175 / -161, 4 files — GC orchestration, session retirement, session storage, transcript-header parsing.
Conventions: CHANGELOG fragment not added (internal ownership-only extraction as documented), generated files none, labels none.
Notable:

• Checked the extracted retirement plan/probe/retire flow and its sole GC caller for preserved behavior and stale imports.
• Checked the shared JSONL header parser extraction, identity-bound deletion handoff, cleanup-pending handling, and exact-head CI coverage.
• No independent local test execution performed; verification relies on the exact-head CI evidence above.
  Blocking: none

Verdict: gaja.pr-review-verdict.v1 merge-approved sha256:5ef4effec61f49c17a8c8264929e032ddd7a68d26b1389519a0409cf04f7078b reviewer:human reviewer-id:probepark evidence:ci-green;approve-gate-allow;retirement-extraction-checked;parser-extraction-checked
Body verdict line count=0, not updated.

[Yeachan-Heo]

Merged into dev as 8e709f59.

• probepark approved the exact head 8515563 (earlier change request was on 9d1f305).
• CI on that head: 21 passed, 0 failed.
• Base 345b2782 is 2 commits behind dev (fix(hindsight): accept only plain digits for numeric HINDSIGHT_* env vars #6279 hindsight, fix(sdk-broker): stop per-poll heartbeat checkpoint + full index replay in readiness wait #6278 broker lifecycle); neither touches this PR's 4 files.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]