refactor: make session observation pure - #124

Current draft slice is directionally and mechanically green. The read path is actually zero-write, explicit GC owns cleanup, dry-run remains non-mutating, and the per-name lock plus re-inventory closes the important observe/apply race. The new tests cover absent roots, stale/corrupt artifacts, live-owner refusal, changed evidence, reachable sockets, and one-pass vanished reporting.

One non-blocking source correction before ready: the comment above socketCandidates still says a live session is “destroyed here ONLY on POSITIVE proof of death” and describes the old mutating behavior. listSessions no longer destroys anything; rewrite that comment to describe classification/reporting only. I am leaving this as a comment rather than approval because the PR remains draft, not because I found a functional blocker.

One exact comment correction remains. The new socketCandidates comment says an unreadable PID plus unreachable socket “remains ambiguous and is omitted,” but the actual pid === null branch deliberately pushes a session and reports it as running defensively. Please make the comment match that behavior (for example, “remains ambiguous and is reported running defensively”). No functional change or broader rerun is needed beyond the appropriate exact-head checks.

Approved at exact head e95beab. listSessions is a bounded zero-write observation; explicit GC owns cleanup, dry-run remains non-mutating, and cleanup revalidates under the per-name creation lock. The final comment now accurately describes the defensive ambiguous-session classification. Focused, full hosted, typecheck, build, and documentation gates are green.