SessionManager._load() migrates sessions from the legacy directory (~/.nanobot/sessions/) to the workspace path, but delete_session only checked the workspace path. A user deleting a session could therefore see its history come back the next time the session was loaded. - delete_session now attempts to unlink both paths - returns True if at least one file was removed - added regression tests: legacy-only, both-paths, and no-revival