Summary

Fixes a regression in 2026.6.11-boon.* where long agent turns (notably cron turns) throw EmbeddedAttemptSessionTakeoverError on their own transcript append — the paired-lane / same-lane race (upstream openclaw#86572). On the gandalf fleet box this is firing ~192×/day across 54 of 84 crons.

This restores the fork [openclaw#86584] fence mechanism that was dropped in the 5.18→6.11 merge (#31) on the assumption that "upstream's fence work now covers it." It does not: 6.11 carries the owned-write machinery (transcript-write-context, publishOwnedSessionFileFenceSync) but the message-persist path registers owned writes via refreshAfterOwnedSessionWrite(), which keys its beforeWrite off the controller's stale fenceFingerprint field rather than a fingerprint read immediately before the append. On a long turn whose two nested async lanes each append, that stale key diverges from the real pre-append on-disk state, so the run's own write is never recognized as owned and the peer lane's fence throws a takeover on it.

The fix

Register the owned write keyed on a fresh pre-append fingerprint captured at the persist callsite, reusing 6.11's existing hardened publishOwnedSessionFileFenceSync trust gate:

• session-tool-result-guard{,.-wrapper}.ts: widen onMessagePersisted to (message, { beforeWriteSnapshot }) and add a beforeMessagePersist hook captured immediately before the append.
• attempt.session-lock.ts: new controller method publishOwnedPostMessageWrite(beforeWrite) — on the fence-active path delegates to publishOwnedSessionFileFenceSync keyed on the fresh snapshot; on the pre-fence path records the user-message write as trusted state (superseding refreshAfterOwnedSessionWrite on this callsite). Export SessionFileFingerprint + readSessionFileFingerprintSync.
• attempt.ts: wire beforeMessagePersist + call only publishOwnedPostMessageWrite from onMessagePersisted (drops the stale-keyed refreshAfterOwnedSessionWrite here — a Codex-review finding: calling it first could launder a real external takeover into a silently dropped reply).

Fail-closed property (why this can't hide a real takeover)

publishOwnedSessionFileFenceSync records nothing and does not advance the fence unless beforeWrite matches the active fence or a recorded trusted state. If an external mutation lands before the lane's append, the freshly captured beforeWrite reflects that untrusted state → no publish → the subsequent fence still trips the genuine takeover. Covered by a negative regression test.

Tests

3 new regression tests in attempt.session-lock.test.ts:

• own append registered via publishOwnedPostMessageWrite does not trip the fence;
• external-write-before-own-append still trips (fail-closed);
• exact production hook sequence (publish-only, no refresh) does not launder an external takeover.

tsgo:core clean; 360 tests pass across the session-lock + guard + write-lock suites.

Follow-ups (out of scope, filed separately)

Two adjacent hardening gaps surfaced during review, deferred to keep this hotfix minimal/revertible:

1. installPromptSubmissionLockRelease's unconditional finally { reacquireAfterPrompt() } can mask a provider error with a takeover error (attribution bug).
2. classifySessionFenceAdvance (async fence-assert path) reads only the appended region and does not re-validate the prefix — the prefix-launder guard from fork commit f11af41c18 covers the rewrite path but not the advance path.

🤖 Generated with Claude Code

Summary by cubic

Fixes a 6.11-boon regression where long agent turns threw session takeovers on their own transcript append. Restores the owned-write fence keyed on a fresh pre-append fingerprint to stop false takeovers while still catching real ones.

• Bug Fixes
  • Restores the owned-write trust gate for the same-lane takeover race by capturing a fresh pre-append session-file fingerprint and publishing via publishOwnedSessionFileFenceSync.
  • Adds beforeMessagePersist and widens onMessagePersisted to (message, { beforeWriteSnapshot }); updates the guard and wrapper to pass this snapshot.
  • Adds publishOwnedPostMessageWrite on the controller and uses it instead of refreshAfterOwnedSessionWrite at the persist site; handles pre-fence trusted-state; exports SessionFileFingerprint and readSessionFileFingerprintSync.
  • Wires attempt.ts to snapshot before append and call only publishOwnedPostMessageWrite to avoid laundering real takeovers.
  • Adds 3 regression tests; runs the laundering test through the real guard wiring (beforeMessagePersist → append → onMessagePersisted) and fully types the assistant message for stricter type checks, proving a genuine external write still trips.

^{Written for commit 7e874f3. Summary will update on new commits.}