[code-review] CRITICAL: pruneInvalidIndexEntries silently deletes large idle sessions (>=500 messages, >24h idle) - permanent data loss

[topcheer]

Bug Description — CRITICAL: Silent data loss

pruneInvalidIndexEntries (store.go:1211-1229) deletes session files when !ses.HasUserInteraction(). But HasUserInteraction() (line 625) scans in-memory ses.Messages, and with the default fullLoad=false, loadSession (line 699) applies time-windowed loading: when a session has >=500 messages and the last message is older than RecentMessageWindow (24h), only the tail messages are loaded into ses.Messages.

Trigger: A session with >=500 messages, idle >24h, ending with an assistant/tool message (the normal case — the last message is almost always the assistant's reply). The next List() call triggers scheduleMaintenanceLocked → runMaintenance → pruneInvalidIndexEntries. loadSession returns a session whose Messages contains only non-user tail messages → HasUserInteraction() returns false → the entire .jsonl file is deleted, permanently destroying the conversation.

This runs automatically in the background, at least once per 30s while a session list is rendered — no user action required.

Impact

• Silent, irreversible loss of user conversation data for any large session idle for >24h
• Runs automatically without user action
• The session file is permanently deleted, not just hidden

Location

• internal/session/store.go:1211-1229 — pruneInvalidIndexEntries deletes based on in-memory HasUserInteraction()
• internal/session/store.go:625 — HasUserInteraction() scans in-memory messages only
• internal/session/store.go:795-800 — time-windowed loading excludes old messages from ses.Messages

Fix

pruneInvalidIndexEntries must never delete based on a time-windowed load. Either:

1. Pass fullLoad=true when validating for deletion, or
2. Gate deletion on the on-disk file (scan for any user-message record in the JSONL) instead of in-memory Messages

Severity

Critical — Silent permanent data loss of user conversations. This is the most severe bug found in the codebase review.

[topcheer]

Fixed in commit 93a52eb.

pruneInvalidIndexEntries now calls loadSessionFull() which creates a lightweight clone with fullLoad=true, bypassing time-windowed message loading. This ensures all messages are loaded before checking HasUserInteraction(), preventing silent deletion of large idle sessions (>=500 messages, >24h idle).

The clone approach avoids racing on s.fullLoad in concurrent access scenarios.