feat(session-context): resolve the active path per AI_AGENT_ID

A single .ai/session-context.org races when two agents share a project: each agent's writes clobber the other's session log. I added .ai/scripts/session-context-path, which resolves the active path from AI_AGENT_ID: unset gives the legacy .ai/session-context.org singleton (so every existing one-agent session is unchanged), set gives .ai/session-context.d/<id>.org with the id sanitized to filename-safe characters. This is Codex's Phase 1 slice from the runtime-neutral spec: the race fix on its own, no broader refactor.

startup.org's existence check and wrap-it-up.org's rename now resolve through the helper, each with a singleton fallback so older checkouts that haven't synced the script still work. Wrap folds the agent id into the archive name so two agents wrapping in the same minute don't collide. protocols.org documents the rule. Verified with 5 bats cases and a two-agent simulation showing distinct paths per id.

2 files changed, 14 insertions, 3 deletions

diff --git a/.ai/workflows/startup.org b/.ai/workflows/startup.org
index 9b95b17..3d5ac66 100644
--- a/.ai/workflows/startup.org
+++ b/.ai/workflows/startup.org
@@ -94,7 +94,12 @@ Phase A's rsyncs depend on the rulesets refresh completing first. The project-re
 These calls have no dependencies on each other. Issue them all together in one message:
 
 1. =date "+%A %Y-%m-%d %H:%M %Z"= — accurate timestamp.
-2. Check whether =.ai/session-context.org= exists (e.g. =[ -e .ai/session-context.org ] && echo present || echo absent=).
+2. Check whether the active session-context file exists. Resolve the =AI_AGENT_ID=-aware path first (see protocols.org "Agent-scoped path"), then test it — the fallback keeps older projects without the helper working:
+
+   #+begin_src bash
+   sc=$(.ai/scripts/session-context-path 2>/dev/null || echo .ai/session-context.org)
+   [ -e "$sc" ] && echo "present: $sc" || echo "absent: $sc"
+   #+end_src
 3. *Sync =.ai/= from templates — but only when the synced source paths in rulesets are clean.* Guard the three rsyncs behind a check that =claude-templates/.ai/{protocols.org,workflows/,scripts/}= have no uncommitted changes. Otherwise Phase A copies in-flight rulesets WIP (tracked edits or new untracked files) into this project's =.ai/workflows/= and =.ai/scripts/=, where it shows up as drift the user didn't author. Skipping once is cheap — the next session with rulesets clean catches up. The check is scoped to the synced paths, so unrelated rulesets dirt (a stray =session-context.org=, scratch files) doesn't needlessly block the sync.
 
    #+begin_src bash
diff --git a/.ai/workflows/wrap-it-up.org b/.ai/workflows/wrap-it-up.org
index a55f475..7fc86e4 100644
--- a/.ai/workflows/wrap-it-up.org
+++ b/.ai/workflows/wrap-it-up.org
@@ -63,10 +63,16 @@ Get current time and rename:
 #+begin_src bash
 mkdir -p .ai/sessions
 now=$(date +%Y-%m-%d-%H-%M)
-mv .ai/session-context.org .ai/sessions/${now}-DESCRIPTION.org
+# Resolve the AI_AGENT_ID-aware source path (see protocols.org "Agent-scoped
+# path"); fall back to the singleton if the helper isn't present.
+sc=$(.ai/scripts/session-context-path 2>/dev/null || echo .ai/session-context.org)
+# Under multi-agent, fold the agent id into the archive name so two agents
+# wrapping in the same minute don't collide. Single-agent: no segment.
+idseg="${AI_AGENT_ID:+${AI_AGENT_ID}-}"
+mv "$sc" ".ai/sessions/${now}-${idseg}DESCRIPTION.org"
 #+end_src
 
-Replace =DESCRIPTION= with your picked slug.
+Replace =DESCRIPTION= with your picked slug. (=AI_AGENT_ID= should be filename-safe; the recommended =host.project.runtime.shortid= shape already is.)
 
 ** Step 3: todo.org cleanup (hygiene + archive completed work)