ENG-26: webhook accepts both sthr_ and sesn_ session-id prefixes

.claude/memory/MEMORY.md

@@ -14,5 +14,5 @@ Keep this file under 200 lines — anything longer is content bloat, not memory.
 - [decisions/two-agent-builder-reviewer](decisions/2026-05-25-two-agent-builder-reviewer.md) — Separate agents for build vs. review so the reviewer reads diffs cold
 
 ## Conventions
-- [conventions/pr-session-id-marker](conventions/pr-session-id-marker.md) — PR body MUST end with `<!-- session-id: sthr_... -->` so webhooks can resume
+- [conventions/pr-session-id-marker](conventions/pr-session-id-marker.md) — PR body MUST end with `<!-- session-id: sesn_... -->` (or legacy `sthr_...`) so webhooks can resume
 - [conventions/agent-review-marker](conventions/agent-review-marker.md) — Reviewer's verdict goes on the first line as `AGENT_REVIEW: APPROVED|REQUEST_CHANGES|ESCALATE — <rationale>`

.claude/memory/conventions/pr-session-id-marker.md

@@ -4,14 +4,18 @@ Every PR opened by the manager MUST end with this HTML comment as the
 **last line** of the PR body:
 
 ```
-<!-- session-id: sthr_xxxxxxxxxxxxxxxx -->
+<!-- session-id: sesn_xxxxxxxxxxxxxxxx -->
 ```
 
 The `/api/github-webhook` route extracts this marker when a webhook
 fires for the PR (e.g. `issue_comment.created` with
 `AGENT_REVIEW: APPROVED`). With it, the webhook resumes the original
 manager session — full implementation context, no re-explaining.
 
+The webhook regex accepts both the legacy `sthr_` prefix and the
+current `sesn_` prefix returned by `client.beta.sessions.create()`.
+Use whichever prefix the kickoff `user.message` carries.
+
 Without it, the webhook falls back to creating a fresh session. The
 fresh session loses all design rationale and re-derives everything.
 Functional but wasteful.

app/api/github-webhook/route.ts

@@ -17,7 +17,7 @@ function verifySignature(rawBody: string, sigHeader: string | null, secret: stri
 
 function extractSessionId(text: string | undefined | null): string | null {
   if (!text) return null;
-  const m = text.match(/<!--\s*session-id:\s*(sthr_[A-Za-z0-9]+)\s*-->/);
+  const m = text.match(/<!--\s*session-id:\s*((?:sthr_|sesn_)[A-Za-z0-9]+)\s*-->/);
   return m?.[1] ?? null;
 }