bug(session ended): gentle-engram: mid-conversation session_shutdown permanently severs memory persistence ("session has already ended")

[carolitascl]

Engram bug report — paste-ready body (form: .github/ISSUE_TEMPLATE/bug_report.yml)

📝 Bug Description (field: description)

Mid-conversation, the gentle-engram Pi plugin permanently severs memory persistence: every later mem_save / mem_session_summary fails with the raw sentinel session has already ended, even though the Pi session is still running.

Root cause is a lifecycle-policy collision between Pi and Engram:

• Pi fires the session_shutdown extension event not only on quit but on reload / new / resume / fork extension rebinds (pi docs/extensions.md §"session_shutdown", §432, §449). A reload rebinds extensions without changing the runtime session id — the conversation continues in the same runtime session.
• The gentle-engram plugin (plugin/pi/index.ts, pi.on("session_shutdown")) unconditionally POSTs /sessions/{id}/end for the runtime session id — including on reload.
• The Engram server treats an ended runtime session as one-shot forever: startSessionTx (internal/store/store.go) only matches rows WHERE sessions.ended_at IS NULL, so re-registration returns ErrSessionAlreadyEnded ("Choose a new session ID and retry mem_session_start", internal/mcp/mcp.go).

Result: one mid-session extension rebind permanently marks the row ended_at while the runtime keeps running, and every subsequent write self-heals against the same (now ended) session id and is rejected.

🔄 Steps to Reproduce (field: steps)

1. Start a Pi session in any project with the gentle-engram plugin; Engram registers the runtime session (row started_at = session start).
2. Keep the session alive and idle >10 minutes so a runtime_lease_expires_at renewal happens shortly before the trigger (renewals happen on agent turns / tool activity).
3. Trigger any Pi extension reload/rebind that emits session_shutdown with reason: "reload" while the runtime session id stays the same (observed: extension-stack recovery right after a long-blocking review-consent tool call returned, with a review-reminder receipt logged 0-3 s before the end).
4. Observe the store: UPDATE sessions SET ended_at = datetime('now') has run for the still-live runtime session.
5. Call mem_save (or wait for the delivery-guarantee summary at session close): it fails with session has already ended for the rest of the conversation.

✅ Expected Behavior (field: expected)

A session_shutdown that does not retire the runtime session id (Pi reason: "reload") must not end the Engram session; and if an ended runtime session is re-registered while its runtime_lease_expires_at is still in the future, Engram should reopen it (the unexpired lease proves the same runtime never stopped). Ending should remain terminal only once the lease has lapsed (manual CreateSession rows have no lease and stay strictly terminal).

❌ Actual Behavior (field: actual)

Tool result (mem_save):  session has already ended
Tool result (mem_session_summary): session has already ended

Store evidence (sqlite, ~/.engram/engram.db, table sessions):
id                                   | project      | started_at         | ended_at           | runtime_lease_expires_at
01a0c0c3-... (this report's session) | pi-subagents | 2026-09-20 21:41:06 | 2026-09-20 22:45:36 | 2026-09-20 23:15:32
01a0c038-... (second victim, same day)| gentle-shell | 2026-09-20 19:11:23 | 2026-09-20 20:18:44 | 2026-09-20 20:48:29

Both rows: ended mid-life, transcript files continue past `ended_at` (runtime never quit),
lease = last successful renewal + 30 min, renewed seconds before the spurious end.
observations count for the ended session: 0 (every write rejected).
mem_doctor reports 9/9 checks ok — the store is consistent; this is lifecycle policy, not corruption.

🖥️ Environment (fields: os / engram-version / agent)

• OS: macOS
• Engram Version: engram main (Go server, engram serve); gentle-engram plugin 0.1.14 (plugin/pi)
• Agent / Client: Other — pi coding agent (@earendil-works/pi-coding-agent 0.86.1) with the gentle-engram Pi package

📋 Relevant Logs (field: logs)

Timeline (UTC, from the session transcript + store):
22:31:48  gentle_review START tool call issued (blocks ~14 min on a consent relay)
22:45:32.981  call returns: consent-binding-stale ("expired after 10 minutes")
22:45:33.910  gentle-pi.review-reminder-receipt/v1 custom event recorded
22:45:36      sessions.ended_at written for the STILL-RUNNING runtime session
22:45:42      user prompt arrives in the SAME session; conversation continues normally
23:35:50+     every mem_save / mem_session_summary -> "session has already ended"

Ruled out: subagent sessions (all five got their own ids with healthy start->end pairs),
store corruption (doctor ok), lease reaper (none exists; only /end writes ended_at),
manual-session interference (manual rows have no lease and are unaffected by the fix below).

💡 Additional Context (field: context)

Suggested fix (draft, three parts)

A. Server (internal/store/store.go, startSessionTx + caller StartSessionWithOwnershipMode): extend the upsert's WHERE to also match ended rows whose runtime_lease_expires_at is still in the future, and clear ended_at in that case; report reopened to the caller so the sync upsert mutation is enqueued. Manual rows (no lease) and expired/malformed leases keep the current terminal refusal.

 ON CONFLICT(id) DO UPDATE SET
   ... existing project/ownership/directory COALESCE branches ...,
   ended_at = CASE WHEN sessions.ended_at IS NOT NULL
                     AND datetime(sessions.runtime_lease_expires_at) > datetime('now')
                    THEN NULL ELSE sessions.ended_at END,
   runtime_lease_expires_at = excluded.runtime_lease_expires_at
 WHERE sessions.ended_at IS NULL
    OR datetime(sessions.runtime_lease_expires_at) > datetime('now')

startSessionTx returns (reopened bool, err error); StartSessionWithOwnershipMode folds reopened into its identityRepaired sync-enqueue gate. Update the doc comment at the StartSessionWithOwnershipMode ("reopens an ended session only while its runtime lease is unexpired; once the lease lapses, EndSession remains terminal truth").

B. Plugin (plugin/pi/index.ts, pi.on("session_shutdown")): skip the /end POST when event.reason === "reload" (Pi rebinds extensions but keeps the runtime session id; quit/new/resume/fork keep today's behavior).

pi.on("session_shutdown", async (event: unknown, ctx: SessionContext) => {
  if ((event as { reason?: string } | undefined)?.reason === "reload") return;
  // ... existing closing-marker + endRegisteredSessionOnce + cleanup unchanged

C. Plugin UX (optional): map the session_already_ended error body on write paths to an actionable message ("Engram session was ended server-side; run mem_session_start with a new id or restart the Pi session") instead of the bare sentinel.

Test plan

• store_test.go: split TestRuntimeSessionRegistrationRejectsEndedSessions into (1) reopen succeeds while lease is live (ended_at cleared, lease refreshed) and (2) refusal after the lease is expired (UPDATE ... runtime_lease_expires_at = datetime('now','-1 minute')), keeping the existing before/after DeepEqual. TestStartSessionRejectsEndedSessionWithoutMutation (manual CreateSession, no lease) stays green unchanged.
• plugin/pi/test/native-tool-contract.test.mjs: new test — session_shutdown({reason:"reload"}) sends no /end, session_start + mem_save still succeed; session_shutdown({reason:"quit"}) still sends exactly one /end. Existing shutdown tests call the handler with ({}, ctx) (no reason) so they keep their current end-behavior.
• Gates: gofmt -l internal/store && go build ./...; go test ./internal/store -run 'TestRuntimeSession|TestStartSession|TestCreateSession'; cd plugin/pi && npm test.

Note on already-severed sessions

Rows whose lease has already lapsed (e.g. the two victims above) stay terminal by design; the remedy for those remains "start a new session id". The fix prevents new occurrences and heals ends that happen while the lease is still live (the common case, since renewals trail activity by ≤30 min).

[carolitascl]

🔬 Full investigation result

Symptom

Mid-conversation, the gentle-engram Pi plugin permanently severs memory persistence: every later mem_save, mem_session_summary, and passive capture fails with the raw sentinel session has already ended, even though the Pi session keeps running normally for hours afterwards. mem_doctor reports 9/9 checks ok throughout — the store is consistent; this is a session-lifecycle policy defect, not data corruption.

Environment

• Engram server: engram serve (Go, main), SQLite store ~/.engram/engram.db (WAL)
• Plugin: gentle-engram 0.1.14 (plugin/pi, loaded as a Pi package)
• Client: pi coding agent (@earendil-works/pi-coding-agent 0.86.1), macOS

Root-cause chain

1. Pi fires the session_shutdown extension event on quit and on reload / new / resume / fork extension rebinds (pi docs/extensions.md, sections "Session replacement flows" and "session_shutdown"). A reload rebinds extensions without changing the runtime session id — the conversation continues in the same runtime session.
2. The plugin's pi.on("session_shutdown") handler (plugin/pi/index.ts, ~line 1572) unconditionally POSTs /sessions/{id}/end for the runtime session id — including on reload.
3. EndSession (internal/store/store.go, ~line 2881) writes ended_at = datetime('now'). The server treats an ended runtime session as one-shot forever: startSessionTx (~line 8191) re-registers only rows WHERE sessions.ended_at IS NULL; otherwise it returns ErrSessionAlreadyEnded ("session has already ended", store.go line 59).
4. The HTTP layer maps that error to HTTP 409 with code: "session_already_ended" (internal/server/server.go ~528) and the MCP wrapper suggests "Choose a new session ID and retry mem_session_start" (internal/mcp/mcp.go ~2368) — but every write path in the plugin self-heals registration against the same runtime session id (ensureSession(..., renew=true) → POST /sessions), so all writes are rejected with the bare sentinel text.

Store evidence (read-only queries against ~/.engram/engram.db)

id	project	started_at	ended_at	runtime_lease_expires_at
01a0c0c3-… (this report's session)	pi-subagents	2026-09-20 21:41:06	2026-09-20 22:45:36	2026-09-20 23:15:32
01a0c038-… (second victim, same day)	gentle-shell	2026-09-20 19:11:23	2026-09-20 20:18:44	2026-09-20 20:48:29

• Both rows were ended mid-life: their transcript files contain messages long after ended_at (the runtime never quit).
• runtime_lease_expires_at = last successful lease renewal + 30 min (runtimeSessionLeaseDuration, store.go ~2807); in both cases the lease was renewed seconds before the spurious end — proof the runtime was alive at the moment of the end.
• Observations count for the ended session: 0 — every write was rejected.
• The server process did not restart around either end event.

Trigger timeline (UTC, transcript + store)

22:31:48      review tool call issued; blocks ~14 min on a consent relay
22:45:32.981  call returns: consent-binding-stale ("expired after 10 minutes without an answer")
22:45:33.910  gentle-pi.review-reminder-receipt/v1 custom event recorded
22:45:36      sessions.ended_at written for the STILL-RUNNING runtime session
22:45:42      user prompt arrives in the SAME session; conversation continues normally
23:35:50+     every mem_save / mem_session_summary -> "session has already ended"

The exact extension that performed the rebind at 22:45:33-36 is inferred (receipt marker is the strongest anchor); the store and transcript facts above are verified directly.

Ruled out

• Subagents: all five subagent runtimes in the affected session received their own session ids with healthy start→end pairs — no id sharing.
• Store corruption / locks: mem_doctor 9/9 ok (including sqlite WAL contention and session-identity checks).
• A lease reaper: none exists; the only writer of ended_at is the /end endpoint (EndSession), plus sync import paths that preserve existing rows.
• Manual-session interference: manual rows (CreateSession) carry no lease and are untouched by the proposed fix's reopen path.

Workaround probe

mem_session_start with a fresh id succeeds (row created, open) — but plugin writes still fail, because every write keys off the runtime session id, not the last-started manual session. The only working escape today is restarting the Pi session (new runtime id). Rows whose lease has already lapsed are permanently terminal.

---

🛠️ Fix options (full code)

Option A — Server: reopen an ended runtime session while its lease is live

File: internal/store/store.go. Replace startSessionTx (~8191) and StartSessionWithOwnershipMode (~2817). Semantics: an ended session is reopened only while runtime_lease_expires_at is still in the future (the unexpired lease proves the same runtime never stopped); expired/malformed/absent leases keep ending terminal; manual rows (no lease) always stay terminal.

// StartSessionWithOwnershipMode registers a runtime session or renews its local
// lease. It preserves the existing session identity. An ended session is
// reopened only while its runtime lease is still unexpired — the live lease is
// proof the same runtime never stopped running, so the earlier end was spurious
// (e.g. an extension rebind that emitted session_shutdown mid-conversation).
// Once the lease has lapsed, ending remains terminal truth and registration
// refuses with ErrSessionAlreadyEnded.
func (s *Store) StartSessionWithOwnershipMode(id, project, directory, mode string) error {
	if err := validateSessionID(id); err != nil {
		return err
	}
	if !validSessionOwnershipMode(mode) {
		return fmt.Errorf("%w %q", ErrInvalidSessionOwnershipMode, mode)
	}
	project, _ = NormalizeProject(project)
	if strings.TrimSpace(project) == "" {
		return ErrProjectRequired
	}

	return s.withTx(func(tx *sql.Tx) error {
		existingProject, existingMode, found, err := sessionOwnershipTx(tx, id)
		if err != nil {
			return err
		}
		identityRepaired := !found
		if found {
			if mode == SessionOwnershipProjectOwned && existingProject != "" && existingProject != project {
				return &SessionProjectConflictError{SessionID: id, OwnerProject: existingProject, RequestedProject: project}
			}
			if err := sessionProjectWriteError(id, existingProject, existingMode, project); err != nil {
				return err
			}
			var existingDirectory string
			if err := tx.QueryRow(`SELECT ifnull(directory, '') FROM sessions WHERE id = ?`, id).Scan(&existingDirectory); err != nil {
				return err
			}
			identityRepaired = existingProject == "" || existingMode == "" || strings.TrimSpace(existingDirectory) == ""
		}
		reopened, err := s.startSessionTx(tx, id, project, directory, mode)
		if err != nil {
			return err
		}
		if !identityRepaired && !reopened {
			return nil
		}
		var persisted Session
		// sessions.project is read through ifnull() because a database upgraded from
		// the schema where the column was nullable still carries rows that identify no
		// project, and no migration rewrites them.
		if err := tx.QueryRow(`SELECT id, ifnull(project, ''), ifnull(ownership_mode, ''), directory, started_at, ended_at, summary FROM sessions WHERE id = ?`, id).Scan(
			&persisted.ID, &persisted.Project, &persisted.OwnershipMode, &persisted.Directory, &persisted.StartedAt, &persisted.EndedAt, &persisted.Summary,
		); err != nil {
			return err
		}
		return s.enqueueSyncMutationTx(tx, SyncEntitySession, persisted.ID, SyncOpUpsert, syncSessionPayload{
			ID:            persisted.ID,
			Project:       persisted.Project,
			OwnershipMode: persisted.OwnershipMode,
			Directory:     persisted.Directory,
			StartedAt:     persisted.StartedAt,
			EndedAt:       persisted.EndedAt,
			Summary:       persisted.Summary,
		})
	})
}

// startSessionTx registers or renews a runtime session row. An ended session is
// reopened only while its runtime lease is still unexpired: the live lease is
// proof the same runtime never stopped running, so the earlier end was spurious
// (e.g. a reload rebind emitting session_shutdown mid-conversation). Expired,
// malformed, or absent leases keep ending terminal. Reports whether an ended
// session was reopened, so the caller can enqueue a sync mutation.
func (s *Store) startSessionTx(tx *sql.Tx, id, project, directory, mode string) (bool, error) {
	var wasEnded bool
	if err := tx.QueryRow(
		`SELECT ended_at IS NOT NULL FROM sessions WHERE id = ?`, id,
	).Scan(&wasEnded); err != nil {
		if !errors.Is(err, sql.ErrNoRows) {
			return false, err
		}
		wasEnded = false
	}
	result, err := s.execHook(tx,
		`INSERT INTO sessions (id, project, ownership_mode, directory, runtime_lease_expires_at) VALUES (?, ?, ?, ?, datetime('now', ?))
		 ON CONFLICT(id) DO UPDATE SET
		   project   = CASE WHEN ifnull(trim(sessions.project, ?), '') = '' THEN excluded.project ELSE sessions.project END,
		   ownership_mode = CASE WHEN ifnull(trim(sessions.ownership_mode, ?), '') = '' THEN excluded.ownership_mode ELSE sessions.ownership_mode END,
		   directory = CASE WHEN trim(sessions.directory, ?) = '' THEN excluded.directory ELSE sessions.directory END,
		   ended_at = CASE WHEN sessions.ended_at IS NOT NULL
		                     AND datetime(sessions.runtime_lease_expires_at) > datetime('now')
		                    THEN NULL ELSE sessions.ended_at END,
		   runtime_lease_expires_at = excluded.runtime_lease_expires_at
		 WHERE sessions.ended_at IS NULL
		    OR datetime(sessions.runtime_lease_expires_at) > datetime('now')`,
		id, project, mode, directory, runtimeSessionLeaseDuration, sqlWhitespaceTrimSet, sqlWhitespaceTrimSet, sqlWhitespaceTrimSet,
	)
	if err != nil {
		return false, err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return false, err
	}
	if rows == 0 {
		return false, ErrSessionAlreadyEnded
	}
	return wasEnded, nil
}

Tests (internal/store/store_test.go) — split TestRuntimeSessionRegistrationRejectsEndedSessions (~16468) into the two-sided policy:

func TestRuntimeSessionRegistrationReopensEndedSessionWithLiveLease(t *testing.T) {
	s := newTestStore(t)
	if err := s.StartSession("runtime-session", "runtime-project", "/runtime"); err != nil {
		t.Fatalf("register runtime session: %v", err)
	}
	if err := s.EndSession("runtime-session", "premature end"); err != nil {
		t.Fatalf("end runtime session: %v", err)
	}
	// The lease is still live right after EndSession: the same runtime is
	// demonstrably alive, so registration must reopen the session.
	if err := s.StartSession("runtime-session", "runtime-project", "/runtime"); err != nil {
		t.Fatalf("reopen ended runtime session with live lease: %v", err)
	}
	reopened, err := s.GetSession("runtime-session")
	if err != nil {
		t.Fatalf("get reopened runtime session: %v", err)
	}
	if reopened.EndedAt != nil {
		t.Fatalf("reopened runtime session ended_at = %q, want nil", *reopened.EndedAt)
	}
	if reopened.RuntimeLeaseExpiresAt == nil {
		t.Fatal("reopened runtime session lease = nil, want refreshed")
	}
}

func TestRuntimeSessionRegistrationRejectsEndedSessions(t *testing.T) {
	s := newTestStore(t)
	if err := s.StartSession("runtime-session", "runtime-project", "/runtime"); err != nil {
		t.Fatalf("register runtime session: %v", err)
	}
	if err := s.EndSession("runtime-session", "complete"); err != nil {
		t.Fatalf("end runtime session: %v", err)
	}
	if _, err := s.DB().Exec(`UPDATE sessions SET runtime_lease_expires_at = datetime('now', '-1 minute') WHERE id = ?`, "runtime-session"); err != nil {
		t.Fatalf("expire runtime lease: %v", err)
	}
	before, err := s.GetSession("runtime-session")
	if err != nil {
		t.Fatalf("get ended runtime session: %v", err)
	}

	if err := s.StartSession("runtime-session", "runtime-project", "/runtime"); !errors.Is(err, ErrSessionAlreadyEnded) {
		t.Fatalf("renew ended runtime session error = %v, want ErrSessionAlreadyEnded", err)
	}
	after, err := s.GetSession("runtime-session")
	if err != nil {
		t.Fatalf("get ended runtime session after renewal: %v", err)
	}
	if !reflect.DeepEqual(after, before) {
		t.Fatalf("ended runtime session changed: before=%#v after=%#v", before, after)
	}
}

TestStartSessionRejectsEndedSessionWithoutMutation (manual CreateSession, no lease) passes unchanged. Affected caller in server.go/mcp.go error mapping is unchanged — ErrSessionAlreadyEnded still only surfaces for expired leases.

Option B — Plugin: don't end the session on a reload rebind

File: plugin/pi/index.ts, replace the shutdown handler (~1572). Pi emits session_shutdown with event.reason ("quit" | "reload" | "new" | "resume" | "fork"); only "reload" keeps the same runtime session id, so only it must skip the end. Existing behavior is preserved for every other reason (and for missing reasons — older event payloads):

  pi.on("session_shutdown", async (event: unknown, ctx: SessionContext) => {
    // Pi emits session_shutdown on quit AND on reload/new/resume/fork extension
    // rebinds. Only "reload" keeps the same runtime session id: the conversation
    // continues after the rebind, so ending the Engram session here permanently
    // severs memory persistence (the server refuses to reopen an ended session).
    if ((event as { reason?: string } | undefined)?.reason === "reload") return;
    const sessionId = observeRuntimeSessionID(ctx);
    if (!sessionId) return;
    knownSessions.add(`\u0000closing:${sessionId}`);
    try {
      await endRegisteredSessionOnce(sessionId, () => bestEffortEngramFetch(
        `/sessions/${encodeURIComponent(sessionId)}/end`,
        { method: "POST", body: { summary: "" } },
      ));
    } catch (error) {
      warnEngramFailure(`/sessions/${encodeURIComponent(sessionId)}/end`, error);
    }
    toolCounts.delete(sessionId);
    forgetKnownSession(sessionId);
    forgetSelfHealContext(sessionId);
  });

Test (plugin/pi/test/native-tool-contract.test.mjs) — new case, mirroring the existing shutdown-test scaffold:

test("session shutdown with reload reason keeps the Engram session open", async () => {
  const originalFetch = globalThis.fetch;
  const originalUrl = process.env.ENGRAM_URL;
  process.env.ENGRAM_URL = "http://127.0.0.1:17437";
  const endCalls = [];
  globalThis.fetch = async (url, init = {}) => {
    const path = new URL(url).pathname;
    if (path === "/health") return new Response(JSON.stringify({ status: "ok" }));
    if (path === "/project/current") return new Response(JSON.stringify({ project: "pi" }));
    if (path === "/sessions") return new Response(JSON.stringify({ status: "created" }));
    if (path.endsWith("/end")) {
      endCalls.push({ method: init.method ?? "GET", body: JSON.parse(init.body) });
      return new Response(JSON.stringify({ status: "ended" }));
    }
    if (path === "/observations") return new Response(JSON.stringify({ id: 1 }));
    throw new Error(`unexpected request: ${path}`);
  };

  try {
    await withPluginSandbox("engram-pi-reload-", async ({ sandbox }) => {
      const { registeredTools, eventHandlers } = await loadPluginHarness(sandbox);
      const ctx = runtimeContext("reload-shutdown-session");
      await registeredTools.get("mem_save").execute("register", { title: "one", content: "one" }, undefined, undefined, ctx);

      await eventHandlers.get("session_shutdown")({ reason: "reload" }, ctx);
      assert.equal(endCalls.length, 0, "a reload shutdown must not end the runtime session");

      await eventHandlers.get("session_start")({}, ctx);
      const afterReload = await registeredTools.get("mem_save").execute("after-reload", { title: "two", content: "two" }, undefined, undefined, ctx);
      assert.equal(afterReload.isError, undefined, "writes must keep flowing after a reload shutdown");

      await eventHandlers.get("session_shutdown")({ reason: "quit" }, ctx);
      assert.deepEqual(endCalls, [{ method: "POST", body: { summary: "" } }], "a quit shutdown must still end the runtime session exactly once");
    });
  } finally {
    globalThis.fetch = originalFetch;
    if (originalUrl === undefined) delete process.env.ENGRAM_URL;
    else process.env.ENGRAM_URL = originalUrl;
  }
});

All existing shutdown tests invoke the handler with ({}, ctx) (no reason) and keep their current end-behavior.

Option C — Plugin: actionable error when a write hits an ended session

Defense-in-depth UX for rows already ended (or ended by third parties). EngramHttpError (plugin/pi/index.ts ~197) carries status and the parsed body in data; the server answers POST /sessions with HTTP 409 and {"error": "...", "code": "session_already_ended", "session_id": "..."} (internal/server/server.go ~528).

Add a detector next to the error types (~line 207):

function sessionAlreadyEnded(error: unknown): boolean {
  return error instanceof EngramHttpError
    && error.status === 409
    && typeof error.data === "object"
    && error.data !== null
    && (error.data as { code?: unknown }).code === "session_already_ended";
}

And in ensureSession (~line 920), wrap the registration POST's error:

    let acknowledgement: unknown;
    try {
      acknowledgement = await fetch("/sessions", { method: "POST", body });
    } catch (error) {
      if (sessionAlreadyEnded(error)) {
        throw new Error(
          `Engram session ${sessionId} was ended server-side while Pi runtime session ${sessionId} is still live. ` +
          "Memory writes are severed for this runtime: restart the Pi session so a fresh runtime session id is registered " +
          "(mem_session_start with a new id registers a manual session but does not re-bind runtime-attributed writes).",
        );
      }
      throw sessionProjectConflictFromResponse(error, sessionId, sessionProject) || error;
    }

Recommendation

Ship A + B together (B removes the trigger; A heals any end that still lands while the lease is live — including ends from older plugin versions or third-party /end callers), with C as a small follow-up for operator clarity. Verification gates: gofmt -l internal/store && go build ./...; go test ./internal/store -run 'TestRuntimeSession|TestStartSession|TestCreateSession'; cd plugin/pi && npm test.

Note on already-severed rows: leases that have already lapsed (both victims above) stay terminal by design; the remedy for those remains restarting the Pi session. The fix prevents new occurrences.

[JhonHawk]

Same policy collision in the OpenCode adapter (deterministic reproduction + root cause)

Adding the OpenCode case to this report. Environment: macOS, engram 2.1.0, OpenCode 2.0.15, adapter plugin/opencode-v2/engram.ts (the file added by #1240, plus a local patch).

Trigger

OpenCode evicts and rebuilds its location services routinely (a host rebind). On eviction the plugin instance is disposed and the adapter's cleanup ends every session that instance registered — plugin/opencode-v2/engram.ts in #1240, lines 928-933:

return async () => {
  disposed = true
  controller.abort()
  if (!localReady) return
  await Promise.all([...registrationAttempts].map(closeKnownSession))   // → POST /sessions/{id}/end
}

Observed: location services evicted followed by four sessions of the same project carrying an identical ended_at in the same second, with zero session.deleted events in the OpenCode log — i.e. the closure came from the plugin's disposal, not from a real deletion. The user kept working in one of those sessions and every later mem_save / mem_session_summary failed with:

gentle-engram could not confirm Engram session registration for engram_mem_save;
verify that the Engram server is available and retry

mem_session_start failed with the ended sessions cannot be reopened hint. Reads (mem_context, mem_search) kept working, so the failure looks like a server problem when it is not.

Server-side state (2.1.0)

• internal/store/store.go startSessionTx is an UPSERT with WHERE sessions.ended_at IS NULL; on an ended row it affects 0 rows → ErrSessionAlreadyEnded.
• internal/server/server.go:528 maps that to 409 {"code":"session_already_ended","error":"session has already ended"}.
• internal/mcp/mcp.go:3461 hint: Choose a new session ID and retry mem_session_start; ended sessions cannot be reopened.

Deterministic reproduction (throwaway session, removed afterwards):

Step	Result
POST /sessions (new id)	201
POST /sessions/{id}/end	200
POST /sessions (same id again)	409 session_already_ended

Impact

Writes are dead for the rest of a conversation that the host considers alive, and retrying can never succeed. In our case the affected sessions lost every memory attempt made after the rebind (the last saved observations predate it).

Proposed fix (same shape as the merged Pi fixes #1331 and #1338)

1. Disposal is not a session close. Do not POST /sessions/{id}/end when the plugin instance is disposed (host rebind); keep closure on the real session.deleted event and on the archive lifecycle tracked in feat(opencode): close the matching Engram session when an OpenCode session is archived #1192/feat(opencode): close matching Engram session when OpenCode archive becomes idle #1263.
2. Heal on 409. When registration answers session_already_ended, register one deterministic derived id (<sessionId>-rN, skipping suffixes that are ended themselves) and attribute the write to it, so a rebind that already ended a row cannot permanently sever the session.
3. Truthful error. Report the ended-session state instead of "verify that the Engram server is available and retry", which sends users chasing a healthy server.

We implemented and verified this locally on the V2 adapter: 7 behavioral scenarios (heal to the derived id, id reuse, healthy session untouched, unreachable server, suffix storm, exhausted suffixes, disposal never emitting /end) plus a real reload test where no session was ended.

Happy to send a PR once the scope is approved. Note the same defect exists in the V1 adapter on main (plugin/opencode/engram.ts, cleanup around line 587) and in the current #1240 branch, so the approved scope should state which adapters it covers.

[hectormr206]

One more path that keeps the same id: quit, then resume (pi --continue)

Thanks for #1375, it fixes the reload case. There is a second path it does not cover, and I think it is worth deciding in this issue: a real quit followed by a resume in a new Pi process.

The analysis above assumes that only reload keeps the runtime session id. That is true inside one process, but pi --continue, pi --resume and pi --session-id <id> start a new process with the same session id. The quit shutdown has already ended that Engram session, so every write in the resumed conversation fails.

Reproduction

Environment: Linux, Pi 0.87.1, gentle-engram 0.1.15, engram serve 2.1.0.

cd "$(mktemp -d)" && git init -q
SID=$(python3 -c 'import uuid; print(uuid.uuid4())')
P='Call mem_save once (title "probe", content "probe"). Reply RESULT=<saved or ERROR:<text>>.'
pi -p --session-id "$SID" "$P"   # RESULT=saved   (process exits: session_shutdown reason=quit → POST /sessions/{id}/end)
pi -p --session-id "$SID" "$P"   # RESULT=ERROR:session has already ended

Interactive /quit followed by pi --continue fails the same way.

What the server actually enforces

Raw HTTP against 2.1.0, with the same session id:

Step	Request	Response
1	POST /sessions	201 created
2	POST /sessions/{id}/end	200 completed
3	POST /sessions (what the plugin does before each write)	409 session_already_ended
4	POST /observations with that session_id	201 saved

So the "ended sessions are terminal" rule is enforced only when the session is registered again, not on the write itself. The hard failure comes from ensureSession(..., renew = true) running before every write and rethrowing the 409.

Directions I can see

1. Plugin: treat 409 session_already_ended on re-registration as "registered" and continue. I run this locally as a small change in the catch of ensureSession. The plugin/pi suite gives the same result as without the change (155/163; the 2 failing files are the packaging and publish contract tests, which need the full repo checkout). The downside: writes land in a session row whose ended_at is older than they are.
2. Plugin: derive a fresh id on resume (the fix(pi): heal a runtime session the server already ended #1331 approach, with its review notes about ending the effective id).
3. Server: support an explicit reopen for runtime sessions. The lease-based reopen proposed above does not help here, because the lease has usually lapsed by the time someone resumes.

If you prefer to keep #1307 scoped to reload, I am happy to open a separate issue. Once you pick a direction, I can also send a PR with a regression test that uses a fake server that models ended_at.