deleting a conversation forgets what the platform stored about it

Found by a sanity check after two commanders were deleted through the UI: the Command HQ tables cascaded
perfectly and four OTHER tables kept a row each, for ever. 24 orphaned rows in chat_session_models, 26 in
chat_session_events, against 14 live transcripts.

Nothing cascades because there is nothing to cascade FROM. All four are keyed on a transcript id, and a
transcript is a file the harness writes — there is no row for a conversation, so the database cannot help and
the delete path has to be explicit. It was not.

Three of the four are inert: a model, a bell preference, a durable copy of turn output nothing will ask for
again. `nudges` is not — it is a SCHEDULE, read by the tick in nudger.ts. A nudge belonging to a deleted
conversation is a timer that keeps firing at something that no longer exists. That is what turned this from
untidy into worth doing now.

deleteClaudeSession returns the IDS it removed rather than a boolean, because a `/clear` chain is several
transcripts presenting as one conversation and forgetting the head while orphaning its parts is the same bug
at a smaller scale.

THE TRAP THAT CHANGE INTRODUCED, caught before shipping: every call site said `if (deleteClaudeSession(...))`
and an empty array is TRUTHY in JavaScript, so a delete that found nothing would have reported success. The
typecheck was clean — `string[]` is a perfectly good truthy expression. All three sites test `.length` now.
Fifth silently-wrong thing today that a typecheck could not see.

Cleared the existing orphans with the same function the delete path now uses, after checking the one thing
that would have made it wrong: whether any of them belonged to a member, whose transcripts live in a home
this scan does not read. There is one account on this machine, so they were all the owner's.

Two chat_session_events rows appeared again immediately after, and are not a leak: the durable log is written
independently of the transcript — that is what makes turn output survive officer being down — so a session
that has just begun legitimately has events before a transcript exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/command-hq/router.ts

@@ -5,7 +5,7 @@ import { checkBudget } from '../sub-agents/budget';
 import * as errors from '@@/custom-errors';
 import { resolveHomeDir } from '@@/user-home';
 import { getCommandersDir, toShellUsername } from '@@/data-path';
-import { getChatEventsSince, ingestSpawnedChildren } from 'officerdb';
+import { forgetChatSessions, getChatEventsSince, ingestSpawnedChildren } from 'officerdb';
 import {
   clearSpawnedRecord,
   listSpawnedSessions,
@@ -552,14 +552,23 @@ commandHqRouter.delete('/commanders/:sessionId', async (ctx) => {
     (c) => c.spawnedSessionId,
   );
   let childrenDeleted = 0;
+  // Every transcript id actually removed — the commander's and its children's, chains included. Collected
+  // rather than assumed, because a `/clear` chain is several ids behind one conversation.
+  const forgotten: string[] = [];
   for (const child of children) {
     try {
       // A spawned agent runs in the platform checkout, not the commanders directory, so its transcript
       // lives in that project's group — the same lookup `/chat/sessions/:id` falls back to.
       // The cwd is a HINT here, not an authority — `deleteClaudeSession` falls back to locating the
-      // transcript wherever it actually is, which is what makes this work for a child that ran in the
-      // platform checkout rather than the commanders directory.
-      if (deleteClaudeSession(who, who.home, child)) childrenDeleted += 1;
+      // transcript wherever it actually is, which is what makes this work for a child that ran in a
+      // different directory from its parent.
+      //
+      // `.length`, not truthiness: this returns the ids it removed, and an empty array is truthy.
+      const removedChild = deleteClaudeSession(who, who.home, child);
+      if (removedChild.length) {
+        childrenDeleted += 1;
+        forgotten.push(...removedChild);
+      }
     } catch {
       // Already gone, or never written. Counted as not-deleted rather than failing the request.
     }
@@ -567,9 +576,21 @@ commandHqRouter.delete('/commanders/:sessionId', async (ctx) => {
   clearSpawnedRecord(who.email, sessionId);
 
   // 3. The commander itself.
-  deleteClaudeSession(who, who.home, sessionId);
+  forgotten.push(...deleteClaudeSession(who, who.home, sessionId));
   await deleteCommandHqSession(user.id, sessionId);
 
+  /*
+    Forget what the platform stored ABOUT every transcript that just went — the commander's and its
+    children's, in one call.
+
+    The `command_hq_*` tables cascade from the row, because they reference it. These four do not: they are
+    keyed on a transcript id, which is a FILE, so there is no row for them to reference and nothing to
+    cascade from. Left behind they are mostly inert — a model, a bell preference, a durable copy of turn
+    output — except `nudges`, which is a live schedule that would keep firing at a conversation that no
+    longer exists.
+  */
+  await forgetChatSessions(forgotten);
+
   // Said back rather than a bare ok: this is the one irreversible action here, and the counts are what
   // make it auditable after the fact.
   return ctx.json({ ok: true, processesStopped: stopped, childrenFound: children.length, childrenDeleted });