Thanks for this — it's a real hardening, not just a surface guard.

I traced the three load-bearing assumptions against main-v2 and they all hold:

• the subagent store lives at <sessionDir>/subagents, so filepath.Dir(s.dir) is exactly where branch metas resolve;
• LoadBranchMeta defaults ID to the filename, so the id-consistency check is meaningful (it only rejects a meta whose declared id was renamed away from its file);
• ParentSession is BranchID(SessionPath()), the same namespace isAncestorSession walks.

Failing closed on missing / corrupt / cyclic / inconsistent lineage is the right call for a security fix — better to reject a legitimate ancestor-fork than to let a sibling or unrelated session's transcript leak in through a known sa_... ref. Test coverage across sibling / unrelated / unprovable / corrupt-meta cases is solid.

Merging.