Problem

A legacy default-agent main session serialized as agent:main:main in a single (non-per-agent) store. After the default agent was renamed (e.g. to ops) — or the no-config default became default — src/gateway/sessions-resolve.ts started rejecting that on-disk entry with Agent "main" no longer exists in configuration, breaking continuity for the user's old default-agent main thread.

Approach — NARROW 4-conjunct remap

The legacy agent:main:main alias is remapped onto the live default agent's main session iff ALL FOUR conjuncts hold; otherwise the current reject/pass behavior is unchanged:

1. The encoded agent-id segment is the literal historical default id main, AND the key is the main-SESSION alias agent:main:main (a concrete agent:main:<peer> session under the deleted main agent stays rejected).
2. main is not a currently-configured agent.
3. A live default agent exists — resolveDefaultAgentId(cfg) resolves to a configured agent, not the no-config default fallback.
4. Legacy single-store provenance — the matched entry came from the single configured (non-template) store, not a discovered per-agent store.

Conjunct 4 is load-bearing for security. It keeps a discovered per-agent deleted-agent store rejected, preserving the openclaw#65524 deleted-agent send/steer guard. A remap that ignored provenance would re-open that hole.

When all four hold: agent:main:<rest> → agent:<live-default>:<rest>, then re-canonicalized via canonicalizeMainSessionAlias.

Changes

• session-utils.ts — resolveLegacyDefaultMainRemap (the 4-conjunct gate) + isSingleConfiguredSessionStore; loadCombinedSessionStoreForGateway now returns fromSingleStore provenance so the sessionId/label paths can distinguish single-store from discovered-store.
• sessions-resolve.ts — the 2-state rejectDeletedAgentSessionKey (reject | pass) becomes the 3-state resolveDeletedAgentSessionKey (remap | reject | pass), applied at all four resolution sites (key / sessionId / label). Key-path sites pass single-store provenance directly; combined-loader paths thread fromSingleStore.
• In-code ADR-NOTE — documents the boundary + rationale, and records that this reject-guard and its remap are fork-introduced (Gateway behavioral test suite is gated out of CI — recently-merged fixes have no behavioral coverage #2720 / gateway: design legacy main-alias remap boundary (agent:main:main → default agent) — un-skip sessions-resolve-store test #2733). Upstream has neither the guard nor the test, so a future diff-sync must not "restore" upstream's no-guard form and silently delete this hardening (ADR-0011 re-introduction-guard pattern).
• sessions-resolve-store.test.ts — un-skipped the legacy main-alias remap case (refs gateway: design legacy main-alias remap boundary (agent:main:main → default agent) — un-skip sessions-resolve-store test #2733).

Test evidence

vitest run --config vitest.gateway.config.ts --pool=forks src/gateway/sessions-resolve-store.test.ts → 4 passed, 0 skipped:

• ✓ resolves legacy main-alias matches by sessionId and label for the configured default agent (agent:main:main → agent:ops:main) — the un-skipped case
• ✓ still rejects non-alias agent:main matches when main is no longer configured — falsifier
• ✓ does not adopt legacy main aliases from discovered deleted-agent stores — falsifier (conjunct 4)
• ✓ rejects an explicit listed deleted main key instead of remapping — falsifier

Broader gateway lane: 143 files / 1582 passed, 6 skipped (pre-existing), 0 failed. pnpm check (format + typecheck + type-aware lint + css-drift) green; rebrand-gate, zombie-import, stub-debt, throwing-stub-callers gates green.

Closes #2733

🤖 Generated with Claude Code