fix: prevent conversation loss when switching Claude accounts

internal/session/instance.go

@@ -2953,7 +2953,17 @@ func (i *Instance) ensureClaudeSessionIDFromDisk() {
 	// transcripts (e.g. a removed-then-recreated review session) cannot hijack
 	// a sibling's conversation. The Restart prelude already does this for
 	// #1147; this closes the same gap on the Start path.
-	if i.adoptExplicitClaudeSessionID("session_id_flag_explicit") {
+	explicitSessionID := i.adoptExplicitClaudeSessionID("session_id_flag_explicit")
+	if i.Tool == "claude" && i.ClaudeSessionID != "" {
+		if restored, err := RestoreOrphanedConversationBackup(i, GetClaudeConfigDirForInstance(i)); err == nil && restored != "" {
+			sessionLog.Info("resume: restored orphaned conversation backup id="+i.ClaudeSessionID+" reason=orphan_bak_restore",
+				slog.String("instance_id", i.ID),
+				slog.String("claude_session_id", i.ClaudeSessionID),
+				slog.String("path", restored),
+				slog.String("reason", "orphan_bak_restore"))
+		}
+	}
+	if explicitSessionID {
 		return
 	}
 	if i.ClaudeSessionID != "" {
@@ -5959,6 +5969,20 @@ func (i *Instance) Restart() error {
 
 	// If Claude session with known ID AND tmux session exists, use respawn-pane.
 	if IsClaudeCompatible(i.Tool) && i.ClaudeSessionID != "" && i.tmuxSession != nil && i.tmuxSession.Exists() {
+		// A known-ID restart resumes straight to `claude --resume <uuid>`
+		// without passing through the Start-path prelude. If the live
+		// <id>.jsonl was lost to the #1533 account-switch bug but an
+		// orphaned <id>.jsonl.bak-<epoch> remains, restore it here so the
+		// resume finds its history instead of starting empty.
+		if i.Tool == "claude" {
+			if restored, rErr := RestoreOrphanedConversationBackup(i, GetClaudeConfigDirForInstance(i)); rErr == nil && restored != "" {
+				sessionLog.Info("resume: restored orphaned conversation backup id="+i.ClaudeSessionID+" reason=orphan_bak_restore_restart",
+					slog.String("instance_id", i.ID),
+					slog.String("claude_session_id", i.ClaudeSessionID),
+					slog.String("path", restored),
+					slog.String("reason", "orphan_bak_restore_restart"))
+			}
+		}
 		resumeCmd, containerName, err := i.prepareCommand(i.buildClaudeResumeCommand())
 		if err != nil {
 			return err

internal/session/migrate.go

@@ -52,7 +52,7 @@
 	if src == "" || dst == "" {
 		return "", fmt.Errorf("source and target config dirs must be non-empty")
 	}
-	if filepath.Clean(src) == filepath.Clean(dst) {
+	if filepath.Clean(src) == filepath.Clean(dst) || resolveRealPath(src) == resolveRealPath(dst) {
 		return "", nil
 	}
 
@@ -82,19 +82,69 @@
 		return "", fmt.Errorf("create target project dir: %w", err)
 	}
 	dstFile := filepath.Join(dstProjDir, sid+".jsonl")
+	bak := ""
 	if fileIsRegular(dstFile) {
 		// Backup before any destructive write (2026-06-04 incident, S2).
-		bak := fmt.Sprintf("%s.bak-%d", dstFile, time.Now().Unix())
+		bak = fmt.Sprintf("%s.bak-%d", dstFile, time.Now().Unix())
 		if err := os.Rename(dstFile, bak); err != nil {
 			return "", fmt.Errorf("backup existing conversation: %w", err)
 		}
 	}
 	if err := copyFileVerified(srcFile, dstFile); err != nil {
+		if bak != "" {
+			_ = os.Remove(dstFile)
+			if restoreErr := os.Rename(bak, dstFile); restoreErr != nil {
+				return "", fmt.Errorf("%w (restore backup failed: %v)", err, restoreErr)
+			}
+		}
 		return "", err
 	}
 	return dstFile, nil
 }
 
+// RestoreOrphanedConversationBackup restores a conversation whose live
+// <id>.jsonl went missing but whose most recent <id>.jsonl.bak-<epoch>
+// orphan still exists in the project dir (the #1533 data-loss residue).
+// It is a no-op when a live <id>.jsonl is already present, when inst has
+// no ClaudeSessionID, or when no matching .bak- orphan exists. Returns the
+// restored path (or "" for no-op) and any error.
+func RestoreOrphanedConversationBackup(inst *Instance, configDir string) (string, error) {
+	if inst == nil || inst.Tool != "claude" || inst.ClaudeSessionID == "" || strings.TrimSpace(configDir) == "" {
+		return "", nil
+	}
+
+	cfgDir := ExpandPath(strings.TrimSpace(configDir))
+	projectPath := inst.EffectiveWorkingDir()
+	resolvedPath := projectPath
+	if resolved, err := filepath.EvalSymlinks(projectPath); err == nil {
+		resolvedPath = resolved
+	}
+	encodedPath := ConvertToClaudeDirName(resolvedPath)
+	if encodedPath == "" {
+		encodedPath = "-"
+	}
+	projDir := filepath.Join(cfgDir, "projects", encodedPath)
+	live := filepath.Join(projDir, inst.ClaudeSessionID+".jsonl")
+	if fileIsRegular(live) {
+		return "", nil
+	}
+
+	bak, err := newestConversationBackup(projDir, inst.ClaudeSessionID)
+	if err != nil {
+		return "", err
+	}
+	if bak == "" {
+		return "", nil
+	}
+	if err := os.Rename(bak, live); err == nil {
+		return live, nil
+	}
+	if err := copyFileVerified(bak, live); err != nil {
+		return "", err
+	}
+	return live, nil
+}
+
 // newestConversationFile returns the most recently modified UUID-named
 // conversation file in projDir (and its session id), skipping agent-*.jsonl.
 // Unlike findActiveSessionIDExcluding it has no recency cutoff: a conversation
@@ -123,6 +173,26 @@
 	return path, sessionID
 }
 
+func newestConversationBackup(projDir, sessionID string) (string, error) {
+	files, err := filepath.Glob(filepath.Join(projDir, sessionID+".jsonl.bak-*"))
+	if err != nil {
+		return "", fmt.Errorf("glob orphaned conversation backups: %w", err)
+	}
+	var newest string
+	var newestMod time.Time
+	for _, file := range files {
+		info, err := os.Stat(file)
+		if err != nil || !info.Mode().IsRegular() {
+			continue
+		}
+		if newest == "" || info.ModTime().After(newestMod) {
+			newest = file
+			newestMod = info.ModTime()
+		}
+	}
+	return newest, nil
+}
+
 // copyFileVerified copies src to dst (0600, matching Claude's conversation
 // files) and verifies the written size matches the source.
 func copyFileVerified(src, dst string) error {

internal/session/migrate_test.go

@@ -53,6 +53,29 @@ func writeConversation(t *testing.T, cfgDir, projectPath, sid, content string) s
 	return path
 }
 
+// writeConversationBackup creates <cfgDir>/projects/<encoded>/<sid>.jsonl.bak-<suffix>.
+func writeConversationBackup(t *testing.T, cfgDir, projectPath, sid, suffix, content string) string {
+	t.Helper()
+	dir := filepath.Join(cfgDir, "projects", ConvertToClaudeDirName(projectPath))
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dir, sid+".jsonl.bak-"+suffix)
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func resolvedClaudeProjectPath(t *testing.T, projectPath string) string {
+	t.Helper()
+	resolvedPath := projectPath
+	if resolved, err := filepath.EvalSymlinks(projectPath); err == nil {
+		resolvedPath = resolved
+	}
+	return resolvedPath
+}
+
 func TestMigrateConversationFrom_HappyPath(t *testing.T) {
 	src, dst, project := t.TempDir(), t.TempDir(), t.TempDir()
 	inst := migTestInstance(t, project)
@@ -94,6 +117,36 @@ func TestMigrateConversationFrom_SameDirNoOp(t *testing.T) {
 	}
 }
 
+func TestMigrateConversationFrom_SameRealDirViaSymlinkNoOp(t *testing.T) {
+	realCfg, linkParent, project := t.TempDir(), t.TempDir(), t.TempDir()
+	linkCfg := filepath.Join(linkParent, "linked-claude")
+	if err := os.Symlink(realCfg, linkCfg); err != nil {
+		t.Skipf("symlink unavailable: %v", err)
+	}
+	inst := migTestInstance(t, project)
+	live := writeConversation(t, realCfg, project, migTestSID, migTestLines)
+
+	migrated, err := MigrateConversationFrom(inst, linkCfg, realCfg)
+	if err != nil {
+		t.Fatalf("same-real-dir migration should be a silent no-op, got %v", err)
+	}
+	if migrated != "" {
+		t.Errorf("no-op should return empty path, got %q", migrated)
+	}
+	got, err := os.ReadFile(live)
+	if err != nil {
+		t.Fatalf("live conversation missing after no-op: %v", err)
+	}
+	if string(got) != migTestLines {
+		t.Errorf("live conversation content changed")
+	}
+	projDir := filepath.Join(realCfg, "projects", ConvertToClaudeDirName(project))
+	baks, _ := filepath.Glob(filepath.Join(projDir, migTestSID+".jsonl.bak-*"))
+	if len(baks) != 0 {
+		t.Fatalf("same-real-dir no-op created backups: %v", baks)
+	}
+}
+
 func TestMigrateConversationFrom_MissingSourceErrors(t *testing.T) {
 	src, dst, project := t.TempDir(), t.TempDir(), t.TempDir()
 	inst := migTestInstance(t, project)
@@ -176,6 +229,143 @@ func TestMigrateConversationFrom_BacksUpConflictingDestination(t *testing.T) {
 	}
 }
 
+func TestMigrateConversationFrom_RestoresDestinationBackupOnCopyFailure(t *testing.T) {
+	src, dst, project := t.TempDir(), t.TempDir(), t.TempDir()
+	inst := migTestInstance(t, project)
+	srcFile := writeConversation(t, src, project, migTestSID, migTestLines)
+	dstFile := writeConversation(t, dst, project, migTestSID, "original destination\n")
+
+	if err := os.Chmod(srcFile, 0); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_ = os.Chmod(srcFile, 0o600)
+	}()
+	if f, err := os.Open(srcFile); err == nil {
+		_ = f.Close()
+		t.Skip("chmod did not make the source unreadable on this platform")
+	}
+
+	if _, err := MigrateConversationFrom(inst, src, dst); err == nil {
+		t.Fatal("expected copy failure")
+	}
+	got, err := os.ReadFile(dstFile)
+	if err != nil {
+		t.Fatalf("destination was not restored after failed copy: %v", err)
+	}
+	if string(got) != "original destination\n" {
+		t.Fatalf("destination content = %q, want original", string(got))
+	}
+	baks, _ := filepath.Glob(filepath.Join(filepath.Dir(dstFile), migTestSID+".jsonl.bak-*"))
+	if len(baks) != 0 {
+		t.Fatalf("failed migration left orphan backups: %v", baks)
+	}
+}
+
+func TestRestoreOrphanedConversationBackup_RestoresOrphan(t *testing.T) {
+	cfgDir, project := t.TempDir(), t.TempDir()
+	inst := migTestInstance(t, project)
+	claudeProject := resolvedClaudeProjectPath(t, project)
+	bak := writeConversationBackup(t, cfgDir, claudeProject, migTestSID, "100", "orphaned backup\n")
+	live := filepath.Join(filepath.Dir(bak), migTestSID+".jsonl")
+
+	restored, err := RestoreOrphanedConversationBackup(inst, cfgDir)
+	if err != nil {
+		t.Fatalf("RestoreOrphanedConversationBackup: %v", err)
+	}
+	if restored != live {
+		t.Fatalf("restored path = %q, want %q", restored, live)
+	}
+	got, err := os.ReadFile(live)
+	if err != nil {
+		t.Fatalf("restored live conversation not readable: %v", err)
+	}
+	if string(got) != "orphaned backup\n" {
+		t.Fatalf("restored content = %q, want backup content", string(got))
+	}
+}
+
+func TestRestoreOrphanedConversationBackup_UsesEffectiveWorkingDirForMultiRepo(t *testing.T) {
+	cfgDir, project, multiRepoDir := t.TempDir(), t.TempDir(), t.TempDir()
+	inst := migTestInstance(t, project)
+	inst.MultiRepoEnabled = true
+	inst.MultiRepoTempDir = multiRepoDir
+
+	resolvedMultiRepoDir := resolvedClaudeProjectPath(t, multiRepoDir)
+	bak := writeConversationBackup(t, cfgDir, resolvedMultiRepoDir, migTestSID, "100", "multi-repo backup\n")
+	live := filepath.Join(filepath.Dir(bak), migTestSID+".jsonl")
+
+	restored, err := RestoreOrphanedConversationBackup(inst, cfgDir)
+	if err != nil {
+		t.Fatalf("RestoreOrphanedConversationBackup: %v", err)
+	}
+	if restored != live {
+		t.Fatalf("restored path = %q, want %q", restored, live)
+	}
+	if got, err := os.ReadFile(live); err != nil || string(got) != "multi-repo backup\n" {
+		t.Fatalf("restored live conversation content mismatch (err=%v, content=%q)", err, string(got))
+	}
+
+	projectLive := filepath.Join(cfgDir, "projects", ConvertToClaudeDirName(project), migTestSID+".jsonl")
+	if fileIsRegular(projectLive) {
+		t.Fatalf("restore used ProjectPath instead of EffectiveWorkingDir: %s", projectLive)
+	}
+}
+
+func TestRestoreOrphanedConversationBackup_NewestBackupWinsByMtime(t *testing.T) {
+	cfgDir, project := t.TempDir(), t.TempDir()
+	inst := migTestInstance(t, project)
+	claudeProject := resolvedClaudeProjectPath(t, project)
+	older := writeConversationBackup(t, cfgDir, claudeProject, migTestSID, "999", "older backup\n")
+	newer := writeConversationBackup(t, cfgDir, claudeProject, migTestSID, "111", "newer backup\n")
+	oldTime := time.Now().Add(-time.Hour)
+	newTime := time.Now()
+	if err := os.Chtimes(older, oldTime, oldTime); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(newer, newTime, newTime); err != nil {
+		t.Fatal(err)
+	}
+
+	restored, err := RestoreOrphanedConversationBackup(inst, cfgDir)
+	if err != nil {
+		t.Fatalf("RestoreOrphanedConversationBackup: %v", err)
+	}
+	if !strings.HasSuffix(restored, migTestSID+".jsonl") {
+		t.Fatalf("restored path = %q, want live jsonl", restored)
+	}
+	got, err := os.ReadFile(restored)
+	if err != nil {
+		t.Fatalf("restored live conversation not readable: %v", err)
+	}
+	if string(got) != "newer backup\n" {
+		t.Fatalf("restored content = %q, want newest backup content", string(got))
+	}
+}
+
+func TestRestoreOrphanedConversationBackup_NoOpWhenLivePresent(t *testing.T) {
+	cfgDir, project := t.TempDir(), t.TempDir()
+	inst := migTestInstance(t, project)
+	claudeProject := resolvedClaudeProjectPath(t, project)
+	live := writeConversation(t, cfgDir, claudeProject, migTestSID, "live conversation\n")
+	writeConversationBackup(t, cfgDir, claudeProject, migTestSID, "100", "stale backup\n")
+
+	restored, err := RestoreOrphanedConversationBackup(inst, cfgDir)
+	if err != nil {
+		t.Fatalf("RestoreOrphanedConversationBackup: %v", err)
+	}
+	if restored != "" {
+		t.Fatalf("expected no-op with live conversation present, got %q", restored)
+	}
+	got, err := os.ReadFile(live)
+	if err != nil {
+		t.Fatalf("live conversation not readable: %v", err)
+	}
+	if string(got) != "live conversation\n" {
+		t.Fatalf("live conversation was overwritten: %q", string(got))
+	}
+}
+
 func TestMigrateConversationFrom_NonClaudeToolRejected(t *testing.T) {
 	src, dst, project := t.TempDir(), t.TempDir(), t.TempDir()
 	inst := migTestInstance(t, project)