Summary

Windows users on v1.16.x–v1.17.0 hit recurring bogus "save conflict" warnings during normal single-window chats — every app start could fork another recovery branch, accumulating dozens of *-recovery-*.jsonl files and sidecars (#6014: 24 recovery files; #5998, #6003, and the "session changed on disk; adopted the newer transcript" loop in #5996).

The transcript CAS itself (from #5856) is sound as a goal; this PR hardens its ledger so it can no longer manufacture conflicts out of transient Windows filesystem behavior. It deliberately does not redesign the mechanism (kept minimal for a hotfix).

Root causes

The CAS ledger (Revision/ContentDigest in the .jsonl.meta sidecar) was maintained without protection:

1. Unreadable ledger silently became revision 0. sessionContentRevision swallowed read errors into (0, nil); LoadSession did the same when establishing the baseline; recordSessionContentRevision swallowed them into "don't write the ledger at all". On Windows a sidecar read can fail transiently (AV/indexer handles; fileutil.ReplaceFile's non-atomic copyOnto fallback tears readers). Any of these desynced baseline vs. ledger, and the next honest save misread as a foreign write → Diverged → recovery branch. This is the "triggers on every app start" shape.
2. Unlocked read-modify-write rolled the ledger back. RenameSession, topic-title propagation (updateTopicSessionTitles, runs after autosaves), legacy topic migration, and restoreSessionTopicIndex load→mutate→save meta without LockSessionMetaPath; a concurrent save's revision bump landing in that window was overwritten with the stale value. The write-side window is amplified to ~720ms by ReplaceFile's retry ladder on Windows.
3. Index write failure stranded the baseline. save() returned an error after the transcript and revision were already durable if writeSessionEventIndex failed (AV-held handle), skipping markPersisted — baseline behind disk → next save conflicts.
4. Snapshots were captured before locking. Concurrent in-process savers (turn-end, periodic autosave, desktop TurnDone) could land out of order; the stalest capture then read the newer transcript as a stale-prefix conflict, producing the repeated "adopted the newer transcript" notices.

Changes

• loadBranchMetaRetry: short backoff (20/50/100ms) over I/O and JSON-decode failures, separating Windows torn reads from real corruption; missing sidecar stays an immediate legitimate ok=false.
• sessionContentRevision / recordSessionContentRevision now fail the save on a persistently unreadable ledger instead of fabricating revision 0 / silently skipping the bump. The transcript bytes are already durable; the autosave retry heals once the sidecar reads cleanly.
• LoadSession with an unreadable sidecar still opens the session but records a revision-unknown baseline (sessionPersistState.revisionKnown): revision-based CAS is disarmed (content digest/prefix checks still catch real divergence), and ownership checks (ownsPersistedState) anchor on digest+version so owned rewrites (compaction) don't become permanent conflicts. A missing sidecar remains a known revision-0 baseline; a successful save re-learns the real revision.
• The four unlocked meta RMW paths now hold the per-path meta lock for the whole load→mutate→save cycle (the legacy-migration pass runs outside the caller's lock — it takes its own per-session locks).
• writeSessionEventIndex failures downgrade to a warning at both save() call sites; the index is a listing accelerator and must not strand the baseline.
• save() captures the snapshot under the save locks, eliminating out-of-order captures (lock-order audited: saveLock → Session.mu is the pre-existing order; no reverse path exists).

Tests

New regression suite (session_meta_ledger_test.go, all -race):

• Corrupt ledger → save fails closed, no recovery branch, ledger untouched; heals after repair.
• Unreadable-meta load → session opens, appends don't conflict, owned rewrite (SaveRewrite) proceeds via digest+version ownership. Reverting the fix reproduces the original bogus diverged … from snapshot revision 0 error.
• Missing meta stays a known zero baseline (behavior unchanged).
• Event-index path pre-created as a directory → save still succeeds and the baseline advances.
• Concurrent SaveSnapshot × RenameSession/SetBranchModel hammer: revision stays monotonic, no conflicts.
• Deterministic under-lock capture test (fails with the old pre-lock capture) plus a concurrent-savers zero-conflict stress.

Full suites: go test ./internal/agent -race, ./internal/control, desktop go test . — all pass; GOOS=windows GOARCH=amd64 builds clean in both modules.

Cache impact

Cache-impact: none. Session persistence, sidecar bookkeeping, and lock scope only; no provider-visible prompts, tool schemas, request serialization, or compaction changes.

Fixes #6014. Fixes #5998. Fixes #5996. Refs #6003 (the recovery-branch loop; its bash-sandbox half is tracked by #5937).