@@ -1000,6 +1000,51 @@ def _output_result(success: bool, json_mode: bool, message: str = "", exit_code:
     return 0 if success else 1
 
 
+def sessions_dir() -> Path:
+    """The session-record store. The ROOT half of the path SSOT (#899).
+
+    Consolidating only the leaf left this built by hand wherever something
+    *enumerates* records rather than addressing one — which is how a "single
+    source of truth" ends up with two spellings of where it lives.
+    """
+    return CONFIG_DIR / "sessions"
+
+
+def session_metadata_path(session_name: str) -> Path:
+    """Where a session's record lives. One implementation, every direction.
+
+    Read, written, enumerated and unlinked through here — reads by
+    :func:`load_session_metadata`, writes by :func:`store_session_metadata`,
+    and the unlink by ``agentwire kill``. The docstring used to claim "both
+    directions" while the reader and the unlink each rebuilt the path inline
+    (#899), which is the same shape as ``tmux_safe_name`` (#865 → #868 → #870
+    → #878) and ``encode_project_path`` (#892): the helper existed, and callers
+    simply did not route through it. In every prior round the divergence stayed
+    invisible until production behaved wrongly.
+
+    The ``@machine`` suffix is stripped HERE and nowhere else — the store is
+    keyed by bare session name, so ``web@remote`` and ``web`` are one record.
+
+    The result is CONTAINED to the store. A session name is operator-supplied
+    and reaches this from the CLI, and the path it returns is unlinked by
+    ``agentwire kill`` — so ``../../../evil`` would have addressed, and
+    deleted, a file outside the store entirely. That was equally true of the
+    inlined copy this replaced, but consolidating is the moment the check
+    becomes possible to write once instead of four times.
+    """
+    clean = session_name.split("@")[0]
+    root = sessions_dir()
+    candidate = root / clean / "metadata.json"
+    try:
+        resolved = candidate.resolve(strict=False)
+        resolved.relative_to(root.resolve(strict=False))
+    except (ValueError, OSError):
+        raise ValueError(
+            f"session name escapes the session store: {session_name!r}"
+        ) from None
+    return candidate
+
+
 def load_session_metadata(session_name: str) -> dict:
     """Load session metadata from storage.
 
@@ -1009,10 +1054,7 @@ def load_session_metadata(session_name: str) -> dict:
     Returns:
         Dictionary of metadata (empty dict if not found)
     """
-    # Parse session name to extract just the name part (remove @machine)
-    clean_name = session_name.split("@")[0]
-
-    metadata_file = CONFIG_DIR / "sessions" / clean_name / "metadata.json"
+    metadata_file = session_metadata_path(session_name)
 
     if not metadata_file.exists():
         return {}
@@ -1024,11 +1066,6 @@ def load_session_metadata(session_name: str) -> dict:
         return {}
 
 
-def session_metadata_path(session_name: str) -> Path:
-    """Where a session's record lives. One implementation, both directions."""
-    return CONFIG_DIR / "sessions" / session_name.split("@")[0] / "metadata.json"
-
-
 def recorded_sessions() -> list[str]:
     """Every session name with a launch record on disk, sorted.
 
@@ -1045,11 +1082,11 @@ def recorded_sessions() -> list[str]:
     records on this machine — a sweep built on it would silently skip 58% of
     the fleet while reporting itself clean.
     """
-    sessions_dir = CONFIG_DIR / "sessions"
+    root = sessions_dir()
     try:
         return sorted(
-            str(f.parent.relative_to(sessions_dir))
-            for f in sessions_dir.glob("**/metadata.json")
+            str(f.parent.relative_to(root))
+            for f in root.glob("**/metadata.json")
         )
     except OSError:
         return []
 
@@ -843,7 +843,7 @@ def _render_role_prompt_store_section(
     from . import core, role_prompts
 
     store = core.role_prompts_dir()
-    sessions_dir = core.CONFIG_DIR / "sessions"
+    sessions_dir = core.sessions_dir()
     s = role_prompts.status(store, sessions_dir)
 
     if not s["exists"]:
 
@@ -41,7 +41,7 @@
 import uuid
 from pathlib import Path
 
-from .core import CONFIG_DIR, load_session_metadata
+from .core import load_session_metadata, recorded_sessions, session_metadata_path
 from .history import (
     PROJECTS_DIR,
     history_key_candidates,
@@ -374,7 +374,7 @@ def resolve_session(session_name: str) -> dict:
     # load_session_metadata returns {} both for "no such session" and for "a
     # session with an empty record", so distinguish them here rather than
     # telling someone who mistyped a name that their session predates #881.
-    if not (CONFIG_DIR / "sessions" / session_name.split("@")[0] / "metadata.json").is_file():
+    if not session_metadata_path(session_name).is_file():
         return {**base, "status": UNDETERMINED, "detail": "no such session recorded"}
 
     old = metadata.get("cwd_at_launch")
@@ -437,11 +437,18 @@ def _find_worktree_cached(finder, repo: str, branch: str | None, name: str) -> d
 
 
 def known_sessions() -> list[str]:
-    """Session names that have a metadata record, in stable order."""
-    root = CONFIG_DIR / "sessions"
-    if not root.is_dir():
-        return []
-    return sorted(d.name for d in root.iterdir() if (d / "metadata.json").is_file())
+    """Session names that have a metadata record, in stable order.
+
+    Delegates to :func:`core.recorded_sessions` rather than scanning here.
+    This used to do a FLAT scan of the store, which is wrong for the reason
+    #898 measured: session names contain slashes by design (``project/branch``
+    is what every ``agentwire worktree`` and every scheduler dispatch is
+    called), so those records nest one level deeper. A flat scan found 469 of
+    1106 records on that machine — this sweep would have silently skipped 58%
+    of the fleet while reporting itself clean, which is the exact failure mode
+    :func:`scan` exists to catch in someone else's data.
+    """
+    return recorded_sessions()
 
 
 def scan() -> list[dict]:
 
@@ -21,7 +21,6 @@
 
 from . import pane_manager
 from .core import (
-    CONFIG_DIR,
     _add_posture_flag,
     _check_tmux_installed,
     _display_parent,
@@ -39,6 +38,7 @@
     load_config,
     load_session_metadata,
     parse_env_args,
+    session_metadata_path,
     tmux_session_exists,
 )
 from .project_config import load_project_config
@@ -579,6 +579,28 @@ def _wants_graceful_exit(posture: str | None, pane_command: str | None) -> bool:
     return True
 
 
+def _drop_session_metadata(session: str) -> None:
+    """Remove a killed session's record, addressed through the path SSOT (#899).
+
+    Dropping it is deliberate: the record carries ``created_by``, so leaving it
+    behind would let an unrelated future session that reuses the name inherit a
+    stale parent. Consistent with the store's lifetime — when the session is
+    gone, so is the tmux environment holding its launch line, and nothing can
+    re-read it.
+
+    Routed through :func:`session_metadata_path` rather than reassembling the
+    store layout inline, so an unlink can never address a different file than
+    the write did.
+    """
+    path = session_metadata_path(session)
+    if not path.exists():
+        return
+    try:
+        path.unlink()
+    except OSError:
+        pass
+
+
 def cmd_kill(args) -> int:
     """Kill a tmux session or pane (graceful /exit first, then kill).
 
@@ -757,14 +779,7 @@ def kill_local_session(session: str, force: bool = False, timeout: int = 10,
     if verbose:
         print(f"Killed session '{session}'")
 
-    # Drop session metadata (creator record) so a future unrelated session
-    # reusing this name doesn't inherit a stale parent.
-    metadata_file = CONFIG_DIR / "sessions" / session.split("@")[0] / "metadata.json"
-    if metadata_file.exists():
-        try:
-            metadata_file.unlink()
-        except OSError:
-            pass
+    _drop_session_metadata(session)
 
     # GC this sender's still-pending outbound across every recipient inbox (#621)
     # so report-backs it left undelivered don't accumulate. Load-bearing kinds
 
@@ -274,7 +274,7 @@ def tick() -> dict:
     from . import core
 
     store = core.role_prompts_dir()
-    sessions_dir = core.CONFIG_DIR / "sessions"
+    sessions_dir = core.sessions_dir()
     stamp = core.CONFIG_DIR / "role-prompt-sweep.json"
     now = time.time()
 
 
@@ -235,6 +235,10 @@ markers = [
     # Deselected in the hermetic CI gate via `-m 'not requires_tmux'` (#323);
     # still runs locally where tmux is on PATH.
     "requires_tmux: spawns a real tmux process; deselected in hermetic CI (#323)",
+    # Opts a test out of the ~/.agentwire redirect so it can assert on the REAL
+    # deployment paths (#893). READ-ONLY by intent — the session-scoped backstop
+    # still fails the run if an opted-out test writes anything.
+    "real_agentwire_home: sees the real ~/.agentwire paths instead of the tmp redirect (#893)",
 ]
 asyncio_mode = "auto"
 
 
@@ -1,13 +1,157 @@
 """Shared test fixtures for the AgentWire test suite."""
 
 import os
+import sys
 from pathlib import Path
 
 import pytest
 import yaml
 
+from tests import home_guard
+
 FIXTURES_DIR = Path(__file__).parent / "fixtures"
 
+#: The owner's real config directory. Nothing in the suite may write here.
+#: Re-exported from the single owner so both halves agree on what "real" is.
+REAL_AGENTWIRE_HOME = home_guard.REAL_AGENTWIRE_HOME
+
+home_guard.install()
+
+
+def _agentwire_modules():
+    """Loaded agentwire modules, snapshotted (import can mutate sys.modules)."""
+    return [m for name, m in list(sys.modules.items())
+            if name == "agentwire" or name.startswith("agentwire.")
+            if m is not None]
+
+
+def _import_every_agentwire_module():
+    """Import the whole package once, BEFORE any test redirects ``$HOME``.
+
+    Load-bearing, and subtle. The redirect below works by rebinding
+    module-level constants that were computed at import time — but it can only
+    rebind modules that are *already imported*. Much of this codebase imports
+    lazily inside functions (``from agentwire.__main__ import
+    build_agent_command`` inside a test helper), so without this the first
+    test to trigger such an import does it while ``$HOME`` already points at
+    that test's tmp directory. The module then computes
+    ``CONFIG_DIR = Path.home() / ".agentwire"`` against the *fake* home and
+    freezes it there — permanently, for the rest of the session, because
+    monkeypatch never patched it and so has nothing to restore.
+
+    The symptom is a constant stuck at some early test's tmp path, which is
+    exactly the kind of cross-test bleed this fixture exists to prevent. Doing
+    the imports up front means every constant is computed against the real
+    home, so the per-test walk both rebinds and restores it.
+
+    Best-effort: a submodule that cannot import (optional dependency, platform
+    guard) is skipped rather than failing collection.
+    """
+    import importlib
+    import pkgutil
+
+    import agentwire
+
+    # Importing the package touches the real config dir: `agentwire_dir()`
+    # both resolves AND mkdirs, and some modules call it at import. That is the
+    # package's own import-time behaviour, not a test polluting the store, and
+    # attributing it to whichever test happened to be first would be a lie. It
+    # is sanctioned rather than silenced, so it still shows up in
+    # SANCTIONED_WRITES if anyone wants to look.
+    with home_guard.sanctioned_real_home_write():
+        for info in pkgutil.walk_packages(agentwire.__path__, prefix="agentwire."):
+            try:
+                importlib.import_module(info.name)
+            except Exception:
+                continue
+
+
+_import_every_agentwire_module()
+
+
+@pytest.fixture(autouse=True)
+def _isolate_agentwire_home(request, tmp_path_factory, monkeypatch):
+    """No test may read or write the real ``~/.agentwire`` — ever (#893).
+
+    Found the hard way: ``~/.agentwire/sessions/resumed/metadata.json`` was a
+    live record in the owner's config directory, written by this suite and
+    grown to 80 fabricated conversation ids — one appended per full-suite run,
+    because ``conversation_ids`` is a chain by design (#871). Beyond tests
+    mutating real user state being a defect on its own, it corrupted a
+    measurement: sizing #871's orphaned-history doctor check against the real
+    store surfaced 28 recorded ids with no transcript, *all* from that one
+    record, with zero genuine orphans behind them.
+
+    Two levers, because there are two ways a path gets computed:
+
+    1. **``$HOME``** — ``Path.home()`` resolves through ``expanduser``, which
+       reads the variable, so redirecting it catches everything computed at
+       *call* time, including modules imported later by a lazy import.
+    2. **A walk over loaded modules** — roughly forty constants across ~25
+       modules are computed at *import* time
+       (``COHORT_ROOT = Path.home() / ".agentwire" / "cohorts"`` and friends)
+       and are already frozen before any fixture runs. Rebinding them by
+       walking beats enumerating them: a hand-written list would rot the first
+       time someone adds a constant, which is exactly how this class of bug
+       recurs. ``test_home_isolation.py`` asserts the walk missed nothing.
+
+    Per-test rather than per-session, so no test can observe another's writes.
+    Tests that need their own location re-patch the same attributes via
+    ``monkeypatch``, which overrides this.
+    """
+    # Escape hatch for the rare test that must see the REAL deployment paths
+    # to assert on them — e.g. "role prompts are not in a directory macOS
+    # garbage-collects", which this fixture would otherwise make vacuous by
+    # relocating them into exactly such a directory. Read-only by intent, and
+    # not a hole: the session-scoped backstop below still fails the run if an
+    # opted-out test writes anything.
+    if request.node.get_closest_marker("real_agentwire_home"):
+        return REAL_AGENTWIRE_HOME
+
+    fake_home = tmp_path_factory.mktemp("home")
+    fake_config = fake_home / ".agentwire"
+    fake_config.mkdir(parents=True, exist_ok=True)
+
+    monkeypatch.setenv("HOME", str(fake_home))
+    monkeypatch.setenv("AGENTWIRE_HOME", str(fake_config))
+
+    for module in _agentwire_modules():
+        for attr, value in list(vars(module).items()):
+            if not isinstance(value, Path):
+                continue
+            if value == REAL_AGENTWIRE_HOME:
+                monkeypatch.setattr(module, attr, fake_config, raising=False)
+            elif REAL_AGENTWIRE_HOME in value.parents:
+                relocated = fake_config / value.relative_to(REAL_AGENTWIRE_HOME)
+                monkeypatch.setattr(module, attr, relocated, raising=False)
+
+    # ``agentwire_dir()`` both resolves AND mkdirs, and callers bound it with
+    # ``from .utils.paths import agentwire_dir`` — a per-module copy that
+    # patching the definition site would not reach.
+    def _fake_agentwire_dir() -> Path:
+        fake_config.mkdir(parents=True, exist_ok=True)
+        return fake_config
+
+    for module in _agentwire_modules():
+        if callable(vars(module).get("agentwire_dir")):
+            monkeypatch.setattr(module, "agentwire_dir", _fake_agentwire_dir, raising=False)
+
+    return fake_config
+
+
+@pytest.fixture(scope="session", autouse=True)
+def _real_agentwire_home_untouched():
+    """Backstop: fail the run loudly if anything escaped the redirect (#893).
+
+    The redirect above is prevention; this is detection. Implementation lives
+    in :mod:`tests.home_guard` so there is exactly one recorder — see the note
+    there about pytest loading this file under two module names.
+    """
+    yield
+    failure = home_guard.report()
+    if failure:
+        pytest.fail(failure, pytrace=False)
+
 
 @pytest.fixture(autouse=True)
 def _no_real_outbound_email(request, monkeypatch):