Untagged sessions still have no ownership proof that outlives the run dir (#419 direction 2, now unhomed)

[pbean]

Status 2026-09-20 (v0.12.0). Narrowed, not closed: the cross-project kill now reaches only tmux; on psmux every arm degrades to a skip, which leaves the stranding this issue names. #537 (65183872, PR #728, in 0.12.0) gave psmux a per-project registry root: prune_sessions (src/bmad_loop/runs.py:1577) passes require_tag=not _registry_proves_ownership(project) (src/bmad_loop/runs.py:1612; helper at src/bmad_loop/runs.py:1521), and the legacy pass always runs with require_tag=True (src/bmad_loop/runs.py:1618). Consequences:

• psmux, own registry — the listing is already this project's sessions, so the untagged run-dir fallback is evidence, not a guess; a run-id collision cannot reach another project's session. Cross-project kill closed; an untagged orphan whose run dir is gone is still skipped at src/bmad_loop/runs.py:1509 (elif require_tag or not is_run(run_dir)), so the stranding remains.
• psmux, shared registry (export degraded, leaving an ambient PSMUX_DATA_DIR or psmux's <home>\.psmux default in force — otherwise export_psmux_registry_root always derives the root and overrides any ambient value, src/bmad_loop/runs.py:544) — the tag is mandatory, so an untagged session is skipped rather than claimed. The cross-project kill is closed; an untagged session of ours has no proof left to read, stays standing, and is not reported: legacy_registry_leftovers (src/bmad_loop/runs.py:1635) walks only _legacy_registries() (src/bmad_loop/runs.py:1741; def at :1775), never the primary pass's registry. That stranding is this issue.
• tmux — no registry namespace, so _registry_proves_ownership keeps the historical reach (return not mux.has_registry_namespace(), src/bmad_loop/runs.py:1568) and prunable_sessions' untagged arm (src/bmad_loop/runs.py:1509) still claims on is_run alone. The exposure below is unchanged there.
• session_options (src/bmad_loop/adapters/tmux_base.py:184; psmux does not override it) is unchanged, so the degraded read is still reachable on both backends — the consequence on psmux is now a skip, not a kill. PR fix(adapters): tell a failed window listing apart from an empty session (#525) #751 (open) is the seam-side narrowing. The 2026-08-26 status refresh on psmux 3.3.8 -> 3.3.9 adoption: umbrella for the floor bump, workaround retirement, and the follow-on tracks #660: "list_windows folds a transport fault to an empty listing, so a faulted ctl candidate scan reads as "nothing to prune" #562 and Untagged sessions still have no ownership proof that outlives the run dir (#419 direction 2, now unhomed) #538 are narrowed, not closed".
• Code residual: in-tree pointers still send the reader to closed Untagged sessions are weak ownership: they leak once their run dir is gone, and can be pruned by the wrong project on a run-id collision (the fallback behind #320) #419 for this remedy. Retarget the direction-(2) pointers to Untagged sessions still have no ownership proof that outlives the run dir (#419 direction 2, now unhomed) #538: src/bmad_loop/runs.py:2496 (_refuse_live_session docstring; :2493 cites the same edge) and tests/test_runs.py:2489 (the characterization test's docstring). The backstop-origin references (src/bmad_loop/runs.py:1341, :2471; tests/test_runs.py:2472, :2766, :2872, :5194) name Untagged sessions are weak ownership: they leak once their run dir is gone, and can be pruned by the wrong project on a run-id collision (the fallback behind #320) #419 as history and may keep it, but should not be the only pointer a reader finds.
• Related to TUI: ctl_window_id admits an untagged control window on run-id collision, so two projects can attach to or kill each other's #531, TUI: a recorded ctl-window id is a handle, not an identity - a reused window id readmits an untagged neighbour #750 (same ownership-proof question from the ctl-window side), delete/archive/clean can remove a live run's directory when the multiplexer cannot be observed — revisit the guard's documented degrade #732.

---

#419 listed three candidate directions. Two shipped and it was closed:

• (1) Transportable surrogate tag — shipped in fix(runs,tui): tag project ownership with a transportable digest #523 (814f0a2): ordinary paths now tag by hex
  digest, so the psmux transportability refusal stops being reachable for them.
• (3) Accept the ceiling, refuse removal while a session is live — shipped in Run-dir removal can strand a live session, and the untagged run-id-collision prune is untested (residuals of #419 after #523) #526 / fix(runs,cli): refuse to remove a run dir under a live session (#526) #532
  (_refuse_live_session, src/bmad_loop/runs.py:598).
• (2) A second ownership proof that outlives the run dir — not shipped, and now with no open
  issue. This one.

Filing it so the direction has a home. This is not a new defect report: the exposure is already
pinned in-tree as characterization. What is new is that the code and the test both point a future
reader at a closed issue for the remedy.

The exposure, as pinned today

prunable_sessions (src/bmad_loop/runs.py:365-411) proves ownership of an untagged session by
run-id collision on the filesystem, not by identity: the run id is parsed out of the session name,
and is_run(run_dir_for(project, run_id)) decides. Two projects that share a run id therefore
disagree about one live session — pinned by
test_prunable_sessions_claims_an_untagged_session_on_a_run_id_collision (tests/test_runs.py),
which asserts both views: ours classifies it prunable while theirs is still running it.
prune_sessions (runs.py:414-426) kills every id in that list. The collision needs no luck —
--run-id is caller-supplied and validated for shape only.

Why #526's backstop does not close it

_refuse_live_session guards the opposite sequence (removing the run dir out from under a live
session) and its own docstring declines to call the remedy sound (runs.py:618-625): it points the
operator at bmad-loop cleanup, which is the prune above, "so on the untagged case it can prune
another project's session on a shared run id". It cannot do better — nothing available at that point
proves the session ours, and minting a proof that outlives the run dir is this direction.

The cause #419 did not enumerate: a degraded read, not a failed write

prunable_sessions' own docstring already records it (runs.py:382-384) — untagged is reachable
"when the option read degrades (session_options reads unset as 'no answer', never as proof nothing
was written)". BaseTmuxBackend.session_options (src/bmad_loop/adapters/tmux_base.py:173-191)
returns {} for a missing binary, an exception, or any nonzero exit. So a single failed read
makes every live session read untagged at once, not one — the fallback stops being an edge case
and becomes the whole ownership signal, which is exactly the end-state #489 Q2 predicted for a reap,
reachable with no reap involved.

Worth stating precisely, because the three causes are not equally live after #523:

Cause	Agent sessions	Notes
Tag write failed	not silent on tmux — set_session_option goes through the strict _tmux (tmux_base.py:101-110, :144-147), which raises	unlike ctl windows, where set_window_option swallows (tmux_base.py:401-405) — that half is #531
psmux refuses the value	cleared for ordinary paths by #523's digest; the gate remains as the general contract for every @ session option (psmux_backend.py:505-524)
Legacy / pre-digest sessions	still reachable	accepted_tags keeps the legacy path tag readable (runs.py:331-350)
Option read degrades	reachable on both backends, affects every session at once	tmux_base.py:173-191

Scope

Not a change to prunable_sessions. A durable record keyed by session name that a prune can consult
when the tag is unreadable — larger than the tag, and it touches cleanup semantics, which is why
#419 ranked it below (1).

When it lands, flip test_prunable_sessions_claims_an_untagged_session_on_a_run_id_collision
deliberately (its docstring says so) and update the two in-tree pointers that currently name
#419, now closed: runs.py:625 and that test's docstring.

Refs: #419 (closed), #523, #526, #531 (the control-window consumer of the same weak ownership), #489

[coderabbitai]

🔗 Related PRs

#418 - fix(adapters): gate the psmux session project tag on transportability (#320) [merged]
#434 - fix(adapters): seam-owned psmux option-key namespace, kill-order containment [merged]
#518 - fix(tui): resolve a run's control window by identity, not listing order [merged]
#522 - fix(adapters,engine): tell a lost mux session apart from an exited CLI [open]
#523 - fix(runs,tui): tag project ownership with a transportable digest [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!