fix(state): keep one state store per herdr session

[gillesdandrea]

Fixes #22.

Before

herdr numbers every session's tabs from w1:t1. With two servers up, say herdr --session work and herdr --session home, both plugins write the same keys into the one ~/.local/state/herdr-automatic-rename/state.json, and each full pass prunes the tab ids it did not see, which in the other session's store is every tab there. A tab whose record is gone reads as renamed by hand on the next pass and opts out of naming for good.

On a machine running three sessions I found the store flipping between two sets of keys within seconds, every tab record it held at enabled: false, and the current session's tabs absent from it altogether. Titles stopped following the foreground program and the reset action was the only way back, once per tab, until the next pass from another session wiped it again. The shared lock directory drops events as well: a traced tab.focused pass exited at once because another session's pass held it.

After

A named session keeps its store, lock and rerun flag under sessions/<name>/ inside the state directory. The session is resolved the way the herdr CLI picks its server: from the sessions/<name>/ directory in $HERDR_SOCKET_PATH whenever that is set, the same directory ar_herdr_session_dir already reads, and from $HERDR_SESSION only when it is not. herdr exports both to plugin commands and pane environments alike (checked on the live [[startup]] children of three 0.8.2 servers), so the herdr-invoked pass and the shell hooks resolve one file. The default session, which herdr also calls default, keeps the store exactly where it was, so a single-session install sees no change.

A named session's store is created once from the owned records of the old shared one (ar_state_seed). Without that, the first pass after the upgrade would read every label the old store wrote as a hand rename and opt every named tab out, which would hurt exactly the single-named-session user who never had the bug. Only enabled: true records come across, so a matching one keeps the tab named, a mismatched one opts out as no record would, and a placeholder label is adopted as it would be from nothing. The copy is a hard link, which refuses an existing file, so a burst of first events cannot cover a pass that already wrote. Ids the session lacks go on the first prune.

The extracted name must be one real path segment, so a relative socket path with no parent, a doubled slash, or a dot segment resolves to the root store rather than aliasing it onto sessions/ itself or the root. Nothing removes a session's directory when the session is deleted; the docs say it is safe to delete by hand.

ar_herdr_session_dir, which locates session.json and config.toml, follows the same order, so a name-only run reads the files of the server it talks to.

tests/test_session.sh pins the resolution (no socket path, default-shaped socket, named session, the dot and relative cases, the name fallback and the socket path winning over it), that the lock and the rerun flag follow the store, the regression itself (one session's prune leaves the other session's record alone and that tab stays eligible), and the seeding (owned records come across, opted-out ones do not, an existing store is never seeded over, an unreadable shared store seeds nothing, the root store never seeds onto itself). It ends with the two-session regression run through ar_main against tests/mocks/herdr, a work pass, a home pass, then a work pass with the program changed, which renames on this branch and renames nothing on main.

Two contrived layouts still collapse onto one store and are left as they are: a server started with a socket path override outside any sessions/<name>/ directory, and a config directory whose own parent happens to be named sessions.

Checks

• ./tests/run.sh: all files pass, including the new one, under bash 3.2 as well. The second and third commits answer a review of the first; their messages list what changed.
• shellcheck -x -s bash over the Makefile's file list: clean (the one suppression names its code and reason).
• make lint-md: clean.

🤖 Generated with Claude Code

[qu8n]

LGTM. Thank you!

I pushed two commits to the branch rather than send it back round.

The seeding had no upgrade boundary. The root store is the default session's live store as well as the one an upgrade leaves behind, so a session created later seeded from it too, and since every server numbers from w1:t1 the copied record landed on a tab it had nothing to do with. That tab still carried herdr's generated number, which is what a hand rename looks like against an owned record, so the first tab of every session created after the upgrade opted itself out. Copied records now carry a mark, and the label has to confirm one before it counts. That also makes the invariant you documented hold: a mismatched record opts out exactly as no record would.

The other is small. HERDR_SESSION went into the path verbatim where the socket route takes one segment, so a name with a slash in it put the store outside sessions/ altogether.

Tests went from 37 to 58, nine of which fail against the old code.