feat(graph): two-mode session deletion — the first destructive ledger operation

DELETE /api/chats/[id]?mode=preserve-graph|delete-nodes (mode required):
- preserve-graph: only extraction bookkeeping dies (coverage rows,
  legacy checkpoints) — graph ledgers byte-untouched
- delete-nodes: the chat's ledger traces die. Node survival = surviving
  provenance point / mapping line (notes imports carry empty
  provenance) / surviving event. The creator's aliases + provenance are
  stripped from a surviving node's create line (owner ruling
  2026-09-23: name/statement/createdAt are the shared identity);
  orphan nodes, their edges, events, mappings, positions, embedding
  vectors and cluster members die; cluster labels stay (immutable)

Gates: 404 unknown, 409 turn_in_flight / jobs_running (with jobIds),
503 extraction_winding_down after a 10s abort-and-poll; the purge is
one sync block (ledgers → jobs → chat record last). rewriteLedgers is
atomic (tmp + rename). graphRevision (max mtime over graph data files)
rides the activity feed + the response as the change stamp.

Anti-resurrection: the chat pipeline re-checks chat liveness at each
merge — a run that slips past the wind-down aborts with nothing merged
or checkpointed; its partial spend dies with the chat.

src/agent/subagents/extraction.ts

@@ -725,7 +725,12 @@ export function createExtractionPipeline(deps: ExtractionPipelineDeps): Extracti
 	 *  Idempotent per startedAt (the store dedupes). */
 	function persistRunUsage(chatId: string, durationMs: number, stats: EmissionStats | undefined): void {
 		const run = runningExtractions.get(chatId);
-		if (!run) return;
+		if (!run) return; // not running (tests driving stages directly)
+		// SESSION-DELETION GUARD (wave 6): a chat deleted mid-run has no
+		// usage log to append to — the record's death is the user's choice
+		// and its partial spend logs with it (appendSourceUsage below
+		// already no-ops for a vanished source; the chat path guards here).
+		if (run.kind === "chat" && !chatStore.getChat(chatId)) return;
 		const entry: ExtractionRunUsage = {
 			startedAt: run.startedAt,
 			at: new Date().toISOString(),
@@ -787,6 +792,16 @@ export function createExtractionPipeline(deps: ExtractionPipelineDeps): Extracti
 				setPhase(chatId, "auditing", "chat");
 				const auditResult = await audit(chatId, findings, view);
 				setPhase(chatId, "merging", "chat");
+				// SESSION-DELETION GUARD (wave 6): a chat deleted mid-run must never
+				// merge. The deletion route aborts this run first and runs its purge
+				// as one sync block; this closes the last window — a run that slipped
+				// past the wind-down finds the chat gone HERE and rides the existing
+				// abort path (info, not error): nothing merged, nothing checkpointed.
+				if (!chatStore.getChat(chatId)) {
+					const gone = new Error(`chat deleted mid-run: ${chatId}`);
+					gone.name = "AbortError";
+					throw gone;
+				}
 				// The batch's messages, snapshotted when the run computed
 				// coverage — if a message mutates mid-run (a quiz answer
 				// merges in), the stored fingerprint won't match its new