[BUG] Gateway/internal: failed to create session

[hjiog]

Title: Corrupt session log: writer allows turn-scoped events outside an open turn

Version: @deepseek-ai/dsh 0.2.1-rc.5 (master 0.2.2-alpha.2 still shows this)
Symptom: Creating a session fails with
gateway/internal: failed to create session: SessionQueryError: stored session "session-cec6a8ae-…" is corrupt: stored log is corrupt: SessionFormatError: tool/ptc-dispatch-start is outside an open turn

Cause: writer and reader disagree on turn scoping.

• Reader enforces it: packages/session/session-format-v3-to-v4/src/relationships.ts:183
  → requireTurn(event.type) throws at :82 when the turn is closed.
• Writer does not: Session.append() (packages/core/session/src/index.ts:806)
  never checks turn state, and
  packages/core/tool-executor-ptc/src/ptc.ts:577 appends
  tool/ptc-dispatch-start from the dispatch queue's start() with no guard.
  The settle path at ptc.ts:536 even asserts in a comment that settle events
  "are still appended inside the open turn" — that is an assumption, not enforced.

Impact: one such event makes the whole session unloadable. Since
create may reuse a blank session, a single poisoned blank session breaks
every subsequent "new session" until that file is repaired by hand.
I hit exactly this: 1 blank session with 2 orphan events blocked all session
creation.

Also observed: openTurnClosers() (packages/core/session/src/repair.ts:53)
repairs an open tail turn (turn/start without turn/end) but there is no
repair path for the inverse — turn-scoped events with no enclosing turn —
so the session can never be loaded again.

Suggestion: have Session.append() reject (or drop) turn-scoped event
types when no turn is open, mirroring relationships.ts; that turns a
permanent corruption into an in-process failure.

Repro data available: the corrupt logs are tiny (8–10 events, no turn/start).

[aturzone]

Confirmed on master @ 8bd073392e (root 0.2.2-alpha.3, Linux, Node 24.22.2). The writer/reader disagreement is
real and deterministic; no model key is needed to reproduce it.

Minimal reproduction:

import { Session, SessionId } from 'packages/core/session/src/index.ts'
import { restoreReleasedV4Artifact } from 'packages/session/session-format-v3-to-v4/src/validation.ts'

const session = Session.create(SessionId('demo'))
session.append('turn/start', { turn: 1 })
session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
session.append('tool/ptc-dispatch-start', { /* rootCallId, parentCallId, subCallId, name, arguments */ })
// writer accepts (bug)
// the same three events fed to restoreReleasedV4Artifact throw
// "tool/ptc-dispatch-start is outside an open turn" (reader)

Trigger path: agent-loop appends turn/end in a finally, while tool-executor-ptc keeps appending
tool/ptc-dispatch-start/tool/ptc-dispatch from its queued start and asynchronous settle lane. One abandoned
run_code sub-call is enough to make the whole stored session unloadable — and, as #11971 notes, a poisoned blank
session blocks subsequent session creation.

Fix under test locally (branch fix/dsh-bug-triage):

1. Session tracks the open turn (turn/start opens, turn/end closes, seeded logs replay it) and rejects the PTC
   dispatch pair at the append site with SessionTurnScopeError before the log changes.
2. The PTC bridge remembers whether each sub-call's start entered the log; when its owning turn closed first it drops
   the log-only dispatch record with a warning and never appends a settle without its start. The run_code call still
   settles normally; only the log-only record is lost.
3. Fixtures in four packages that logged PTC dispatches without opening a turn now open one (assertions unchanged).

Tests added: reject-after-turn/end with replay-valid log, in-turn happy path, non-turn-scoped appends, restored
open tail, and the two drop paths (before start, before settle). All new tests fail with the guard removed. Wider
run: 76 files / 1757 tests pass (session 583, PTC 224, agent-loop 491, patched dirs 459); typecheck 5/5, docs gates
21/21.

Scope note: the reader's full turn/step-scoped set is larger (request/header, request/context, step messages,
replacement tool/result, llm/retry). This change enforces only the PTC pair because that is the confirmed
corruption source; manual compaction was verified to run between turns using only reader-legal events. Enforcing the
rest needs a separate audit of every append site and fixture, and probably a dedicated follow-up. #11981's second
class (step numbers restarting inside one turn) looks like the same writer/reader class of defect and is not
addressed here.

Patch: branch fix/dsh-bug-triage on my fork (commit e2eba3dbf6), if useful as a starting point.