[jefft72]

Summary

Hardens persisted session loading and accepted-plan continuation recovery so malformed history cannot silently reshape a conversation graph or partially replace the active session.
The failure cases covered here include malformed or non-object JSONL records, duplicate entry IDs, missing parents, invalid plan lifecycle transitions, and arbitrary user messages persisted where the exact accepted-plan implementation continuation is required.

Reasoning

Session files are a durable trust boundary, and skipping a corrupt record can reconnect its descendants under the wrong state or allow an invalid plan lifecycle to fail open.
The loader therefore tolerates only the narrow crash-recovery case of an incomplete final append after a valid header, while complete malformed records and graph violations remain hard failures.

An accepted plan also represents a one-shot transition from planning to implementation.
Requiring the generated implementation prompt through a dedicated append path prevents an unrelated user message from consuming that transition and makes restoration across branches deterministic.

Changes

• Rejects complete malformed JSONL records with line-specific errors, rejects non-object JSON values, validates persisted plan artifacts during parsing, and enforces unique entry IDs and complete parent links for every session graph.
• Recovers only an unterminated partial final append after a valid session header, rewrites the recovered file before future appends, and continues to reject the same malformed record when it is newline-terminated or appears inside the file.
• Builds migrated entries, lifecycle state, labels, and the leaf index in local state before adopting a target session, preserving the current session ID, entries, leaf, and indexes when a requested switch fails validation.
• Centralizes session index construction so entry lookup, labels, label timestamps, and the active leaf are derived consistently for loaded, initialized, and rebuilt sessions.
• Performs identity-bound rewrites through no-follow file descriptors and verifies the expected device and inode before truncating an existing session file, retaining the existing protection against symlink and replacement races.
• Adds appendPlanContinuationMessage as the only API that can consume a pending accepted plan, requires one text content block equal to createPlanImplementationPrompt(plan), and blocks ordinary user appends until that continuation is persisted.
• Routes the exact active continuation message from AgentSession through the dedicated persistence method and marks it persisted only after the trusted append path succeeds.
• Expands lifecycle coverage for malformed plans, plans outside plan mode, mismatched resolutions, accepted and discarded plans, compaction, branch navigation, continuation restoration, partial writes, sparse-file corruption, and invalid session switches.

Testing

• Validation ran on the final rebased stack: npm run check passed.
• Validation ran on the final rebased stack: the focused Vitest run across 28 affected files passed all 451 tests.
• This intermediate branch was reconstructed as part of the stack and was not checked independently after reconstruction.

[jefft72]

Closing to rebuild on a clean base.

This stack does not build. Two separate defects are present, and the first masks the second:

1. A stray closing brace committed in feat: enforce native plan collaboration policy #64 stops packages/coding-agent/src/core/agent-session.ts from parsing at all.
2. From feat: activate accepted plans in routed sessions #65 onward the stack imports five modules that exist only on the task profile stack: evolved.ts, harness-descriptors.ts, profile-router.ts, profiles.ts, and runtime-telemetry.ts.

Replacement stacks:

• plan/* for native plan mode standing alone on main
• plan-harness/* for the plan and profile integration

The branch behind this PR is retained unchanged as a backup.