[P0] CRITICAL: CC Bridge reuses OLD Claude sessions — stale claudeSessionId assignment

[OneStepAt4time]

Bug Report

Reported by: Zeus (LoL Stonks orchestrator) — first real user

Severity: CRITICAL — blocks all new task creation

Symptoms

New CC Bridge sessions get assigned claudeSessionId from OLD tasks. Claude responds with context from previous sessions instead of processing the new brief.

Reproduction (Zeus D51 Champion Pool Builder):

• Attempt 1: got 186951e5 from D18-rune-details
• Attempt 2: got fe7653c8 — responded with D19 Global Search output
• Attempt 3: got 5490cf60 from D20-returning-player

All 3 attempts: Claude receives the D51 brief but responds with context from old sessions.

Root Cause Analysis

syncSessionMap() in session.ts matches session_map entries by windowId or windowName. After service restarts or prolonged uptime:

1. Old session_map.json entries survive with stale windowIds
2. New sessions get windowIds that collide with old entries (tmux reuses @N ids)
3. cleanSessionMapForWindow() (v1.2.1 fix) doesn't always clean — race condition between hook write and bridge read
4. purgeStaleSessionMapEntries() on startup helps but doesn't cover runtime collisions

Additional factor: archiveStaleSessionFiles() (v1.2.0) archives .jsonl files, but findSessionFile() can still find them via sessions-index.json entries that point to the original paths.

Fix Plan

1. Atomic session_map: clean ALL entries for a windowId/windowName BEFORE creating the session, not just on startup
2. Verify JSONL freshness: reject any claudeSessionId whose .jsonl mtime is older than the session createdAt
3. Reject archived paths: findSessionFile() should skip _archived/ paths (partially done but not comprehensive)
4. Timestamp guard: session_map entries should include a timestamp; reject entries older than the bridge session

Related

• Partial fix in v1.2.1 (commit 27bfd59) — cleanSessionMapForWindow()
• Partial fix in v1.2.0 (commit 52ddc8d) — archive .jsonl files
• [DX] npx aegis — zero-config quick start #5 (P0 prompt delivery) is lower priority than this