After an agent-loop-only reload the server keeps its SessionRecord but the record's agent is no longer registered. followup() no longer throws for a detached agent, so a prompt would run against a zombie session and still report accepted. Validate the record against the live registry before delivery, as the ACP bridge does. Adds a regression that detaches the agent and asserts rejection.