Fix review round 2 of the wait list and its hooks (issues 1629, 1743, 1744, ADR 0490)

The Stop hook treated a missing waits file exactly like one that could
not be read: a notice on every stop of every session with no waits —
the normal state, not an exceptional one. DecideStop now treats
os.ErrNotExist as the ordinary case of no open waits, silently; the
notice is still said for a file that exists but cannot be read or does
not parse.

ADR 0490 §1 keeps waits under a name, but the file a hook reads is kept
per session id: writing it from only the name an op just acted on meant
a second name bound to the same session id had its waits silently drop
out of enforcement the moment the first name was touched, and adopting
one name away emptied the id's file outright even when another name was
still bound to it. Every write now rewrites a session's file from the
union of every name currently bound to it (sessionWaitsUnion), adopt's
rewrite of the superseded id included.

Also: each atomic write gets its own temp file name, so two writes to
the same path can never interleave on one; adopt clears the refusal
counter of both the superseded and the adopting session, so a fresh
three-strikes count starts under the new binding; and list is read-only
again — it no longer claims an unbound name or refuses a session that
is not (yet) the one bound to it, and instead says who currently holds
the name.

modules/claude-code/cmd/claude-code/waits.go

@@ -247,8 +247,18 @@ func updateNamedWaits(store WaitStore, key string, mutate func(NamedWaits) (Name
 	return NamedWaits{}, errors.New("the wait list kept changing elsewhere; try again")
 }
 
-// writeSessionFile rewrites one session id's mirrored file whole, atomically (temp file, then rename): it
-// holds exactly the open waits given and the time of this write (1629/AC3).
+// tempSuffix is a short random name for a temp file, so two writes racing for the same path never share one
+// (review round 2, item a): each gets its own, and only the rename is a single atomic step.
+func tempSuffix() string {
+	var b [8]byte
+	_, _ = rand.Read(b[:])
+	return hex.EncodeToString(b[:])
+}
+
+// writeSessionFile rewrites one session id's mirrored file whole, atomically (its own temp file, then
+// rename): it holds exactly the open waits given and the time of this write (1629/AC3). waits is always the
+// union of every name currently bound to sessionID (sessionWaitsUnion), never only the name an op acted on:
+// a second name bound to the same id must stay enforced (ADR 0490 §1, review round 2 item 2).
 func writeSessionFile(p Paths, sessionID string, waits []Wait, now time.Time) error {
 	path := waitsFilePath(p, sessionID)
 	if err := fsys.MkdirAll(filepath.Dir(path), 0o700); err != nil {
@@ -261,13 +271,51 @@ func writeSessionFile(p Paths, sessionID string, waits []Wait, now time.Time) er
 	if err != nil {
 		return err
 	}
-	tmp := path + ".mesh-tmp"
+	tmp := path + ".mesh-tmp-" + tempSuffix()
 	if err := fsys.WriteFile(tmp, raw, 0o600); err != nil {
 		return err
 	}
 	return fsys.Rename(tmp, path)
 }
 
+// sessionWaitsUnion is every open wait of every name on this node currently bound to session (ADR 0490 §1):
+// what that session id's mirrored file must hold, whole — never only the one name an op just acted on, or a
+// second name bound to the same id would stop being enforced the moment any op touched the first.
+func sessionWaitsUnion(store WaitStore, node, session string) ([]Wait, error) {
+	keys, err := store.Keys()
+	if err != nil {
+		return nil, err
+	}
+	prefix := node + "/"
+	var out []Wait
+	names := make([]string, 0, len(keys))
+	for _, k := range keys {
+		if strings.HasPrefix(k, prefix) {
+			names = append(names, k)
+		}
+	}
+	sort.Strings(names) // deterministic order: tests, and a session reading its own file, see the same thing
+	for _, k := range names {
+		nw, _, found, err := readNamedWaits(store, k)
+		if err != nil || !found || nw.CurrentSession != session {
+			continue
+		}
+		out = append(out, nw.Waits...)
+	}
+	return out, nil
+}
+
+// writeSessionWaits rewrites session's mirrored file with sessionWaitsUnion: every call that changes a
+// name's waits or its binding goes through this, never writeSessionFile directly with one name's waits
+// alone.
+func writeSessionWaits(p Paths, store WaitStore, session string, now time.Time) error {
+	union, err := sessionWaitsUnion(store, p.Node, session)
+	if err != nil {
+		return fmt.Errorf("the session's other names could not be read: %w", err)
+	}
+	return writeSessionFile(p, session, union, now)
+}
+
 // writeNodeIndex rewrites the node-wide index whole, atomically, from every name's current state on this
 // node (novox/hq ADR 0490 §2): a full scan of the `waits` state, bounded by how many names are ever used on
 // one node at once. Best-effort for its caller: a name's own file is already correct by the time this runs.
@@ -299,7 +347,7 @@ func writeNodeIndex(p Paths, store WaitStore, now time.Time) error {
 	if err != nil {
 		return err
 	}
-	tmp := path + ".mesh-tmp"
+	tmp := path + ".mesh-tmp-" + tempSuffix()
 	if err := fsys.WriteFile(tmp, raw, 0o600); err != nil {
 		return err
 	}
@@ -394,7 +442,7 @@ func AddWait(p Paths, in WaitInput, store WaitStore, now time.Time) (map[string]
 	if err != nil {
 		return nil, err
 	}
-	if err := writeSessionFile(p, session, nw.Waits, now); err != nil {
+	if err := writeSessionWaits(p, store, session, now); err != nil {
 		return nil, fmt.Errorf("the wait was kept, but its file could not be written: %w", err)
 	}
 	if err := writeNodeIndex(p, store, now); err != nil {
@@ -422,7 +470,7 @@ func WatchedWait(p Paths, session, by, id, watcher string, store WaitStore, now
 		return nil, errors.New("watcher is required: what follows this wait (mesh_wait on its family, or a watcher agent)")
 	}
 	key := waitsKey(p, name)
-	nw, err := updateNamedWaits(store, key, func(nw NamedWaits) (NamedWaits, error) {
+	_, err = updateNamedWaits(store, key, func(nw NamedWaits) (NamedWaits, error) {
 		if err := bindCaller(&nw, name, p.Node, by, session, now); err != nil {
 			return nw, err
 		}
@@ -436,7 +484,7 @@ func WatchedWait(p Paths, session, by, id, watcher string, store WaitStore, now
 	if err != nil {
 		return nil, err
 	}
-	if err := writeSessionFile(p, session, nw.Waits, now); err != nil {
+	if err := writeSessionWaits(p, store, session, now); err != nil {
 		return nil, fmt.Errorf("the wait was watched, but its file could not be written: %w", err)
 	}
 	_ = writeNodeIndex(p, store, now)
@@ -458,7 +506,7 @@ func DoneWait(p Paths, session, by, id, outcome string, store WaitStore, now tim
 		return nil, errors.New("id is required: the one add answered")
 	}
 	key := waitsKey(p, name)
-	nw, err := updateNamedWaits(store, key, func(nw NamedWaits) (NamedWaits, error) {
+	_, err = updateNamedWaits(store, key, func(nw NamedWaits) (NamedWaits, error) {
 		if err := bindCaller(&nw, name, p.Node, by, session, now); err != nil {
 			return nw, err
 		}
@@ -472,7 +520,7 @@ func DoneWait(p Paths, session, by, id, outcome string, store WaitStore, now tim
 	if err != nil {
 		return nil, err
 	}
-	if err := writeSessionFile(p, session, nw.Waits, now); err != nil {
+	if err := writeSessionWaits(p, store, session, now); err != nil {
 		return nil, fmt.Errorf("the wait was done, but its file could not be written: %w", err)
 	}
 	_ = writeNodeIndex(p, store, now)
@@ -496,7 +544,7 @@ func SaidWait(p Paths, session, by, id string, store WaitStore, now time.Time) (
 		return nil, errors.New("id is required: the one add answered")
 	}
 	key := waitsKey(p, name)
-	nw, err := updateNamedWaits(store, key, func(nw NamedWaits) (NamedWaits, error) {
+	_, err = updateNamedWaits(store, key, func(nw NamedWaits) (NamedWaits, error) {
 		if err := bindCaller(&nw, name, p.Node, by, session, now); err != nil {
 			return nw, err
 		}
@@ -513,14 +561,17 @@ func SaidWait(p Paths, session, by, id string, store WaitStore, now time.Time) (
 	if err != nil {
 		return nil, err
 	}
-	if err := writeSessionFile(p, session, nw.Waits, now); err != nil {
+	if err := writeSessionWaits(p, store, session, now); err != nil {
 		return nil, fmt.Errorf("the wait was said, but its file could not be written: %w", err)
 	}
 	_ = writeNodeIndex(p, store, now)
 	return map[string]any{"id": id, "said": true}, nil
 }
 
-// ListWaits answers a name's open waits, with their age and whether they are past their bound (1629/AC1).
+// ListWaits answers a name's open waits, with their age and whether they are past their bound (1629/AC1),
+// and who currently holds the name. Read-only (review round 2, item c): unlike every other op it never
+// claims an unbound name, and never refuses a session that is not (or not yet) the one bound to it — a
+// session may want to look before adopting.
 func ListWaits(p Paths, session, by string, store WaitStore, now time.Time) (map[string]any, error) {
 	session, err := requireSessionID(session)
 	if err != nil {
@@ -530,15 +581,9 @@ func ListWaits(p Paths, session, by string, store WaitStore, now time.Time) (map
 	if err != nil {
 		return nil, err
 	}
-	key := waitsKey(p, name)
-	nw, err := updateNamedWaits(store, key, func(nw NamedWaits) (NamedWaits, error) {
-		if err := bindCaller(&nw, name, p.Node, by, session, now); err != nil {
-			return nw, err
-		}
-		return nw, nil
-	})
+	nw, _, _, err := readNamedWaits(store, waitsKey(p, name))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("the wait list could not be read: %w", err)
 	}
 	out := []map[string]any{}
 	for _, w := range nw.Waits {
@@ -553,7 +598,11 @@ func ListWaits(p Paths, session, by string, store WaitStore, now time.Time) (map
 		}
 		out = append(out, entry)
 	}
-	return map[string]any{"session": session, "name": name, "open": out}, nil
+	answer := map[string]any{"session": session, "name": name, "open": out}
+	if nw.CurrentSession != "" {
+		answer["held-by"] = map[string]any{"session": nw.CurrentSession, "last-called": nw.LastCall.UTC().Format(time.RFC3339)}
+	}
+	return answer, nil
 }
 
 // AdoptName binds name to session, always taking it over from whoever held it (novox/hq ADR 0490 §3): the
@@ -582,16 +631,25 @@ func AdoptName(p Paths, by, session string, store WaitStore, now time.Time) (map
 	}
 	tookOver := oldSession != "" && oldSession != session
 	if tookOver {
-		if err := writeSessionFile(p, oldSession, nil, now); err != nil {
+		// oldSession's file is rewritten from the union of whatever names remain bound to it (ADR 0490 §1,
+		// review round 2 item 2): name no longer is one of them, but another might still be — never simply
+		// emptied.
+		if err := writeSessionWaits(p, store, oldSession, now); err != nil {
 			return nil, fmt.Errorf("%s was adopted, but the session it was taken from could not be told: %w", name, err)
 		}
 	}
-	if err := writeSessionFile(p, session, nw.Waits, now); err != nil {
+	if err := writeSessionWaits(p, store, session, now); err != nil {
 		return nil, fmt.Errorf("the name was adopted, but its file could not be written: %w", err)
 	}
 	if err := writeNodeIndex(p, store, now); err != nil {
 		say("writing the node-wide wait index after %s was adopted: %v", name, err)
 	}
+	// Review round 2, item b: a fresh three-strikes count starts under the new binding, on both ids.
+	waitsDir := WaitsDirPath(p)
+	_ = writeRefusalCounters(waitsDir, session, map[string]int{})
+	if tookOver {
+		_ = writeRefusalCounters(waitsDir, oldSession, map[string]int{})
+	}
 	answer := map[string]any{"name": name, "session": session, "open": len(nw.Waits)}
 	if tookOver {
 		answer["took-over-from"] = map[string]any{"session": oldSession, "last-called": oldLastCall.UTC().Format(time.RFC3339)}