diff --git a/bun.lock b/bun.lock
index 61cbead3c..7753a3ab2 100644
--- a/bun.lock
+++ b/bun.lock
@@ -13,7 +13,6 @@
         "@intx/authz": "workspace:*",
         "@intx/crypto": "0.3.0",
         "@intx/harness": "workspace:*",
-        "@intx/hub-sessions": "0.3.0",
         "@intx/inference": "workspace:*",
         "@intx/log": "workspace:*",
         "@intx/mail-memory": "0.3.0",
diff --git a/docs/VENDORING.md b/docs/VENDORING.md
index f18240a88..6c93d8a27 100644
--- a/docs/VENDORING.md
+++ b/docs/VENDORING.md
@@ -77,6 +77,12 @@ signingKey })` (local disk + keypair, no hub, no database) is present in
   tarball already carries it (its `subscribeAgentEvents(agent,
 opts.onEvent)` wiring). Root `dependencies` pins `0.3.0`.
 
+CL-9021 later dropped the `@intx/hub-sessions` root pin: no first-party
+tree imports it (the only references are the inert
+`vendor/intx-workflow-host/` provenance files), so the published-tarball
+coverage above stands as fallback, not as an installed dependency.
+`scripts/check-no-hub-sessions.test.ts` locks the removal.
+
 Everything vendored in this pass sits at the same upstream commit
 `1ad010463a6bce6034cded3e078b14db482882a8` as the existing trees; no
 vendored tree mixes pins.
diff --git a/package.json b/package.json
index 28cf857cc..0b6c57772 100644
--- a/package.json
+++ b/package.json
@@ -94,7 +94,6 @@
     "@intx/authz": "workspace:*",
     "@intx/crypto": "0.3.0",
     "@intx/harness": "workspace:*",
-    "@intx/hub-sessions": "0.3.0",
     "@intx/inference": "workspace:*",
     "@intx/log": "workspace:*",
     "@intx/mail-memory": "0.3.0",
diff --git a/scripts/check-no-hub-sessions.test.ts b/scripts/check-no-hub-sessions.test.ts
new file mode 100644
index 000000000..84ba70e23
--- /dev/null
+++ b/scripts/check-no-hub-sessions.test.ts
@@ -0,0 +1,59 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+// CL-9021: the root pin for the sessions package was dropped because no
+// first-party tree imports it. The only remaining references are the inert
+// `vendor/intx-workflow-host/` provenance files (not a workspace member,
+// excluded from typecheck/test/build per docs/VENDORING.md) plus prose
+// comments. Fail if a built tree gains an import or the pin creeps back.
+
+const repoRoot = join(import.meta.dir, "..");
+const pkg = JSON.parse(
+  readFileSync(join(repoRoot, "package.json"), "utf8"),
+) as {
+  dependencies: Record<string, string>;
+};
+
+// Trees that participate in typecheck (tsconfig include) and the test suite.
+const FIRST_PARTY_TREES = [
+  "src",
+  "packages",
+  "scripts",
+  "e2e",
+  "evals",
+  "testkit",
+];
+
+const SESSIONS_IMPORT =
+  /(?:from\s+|require\(\s*|import\(\s*)["']@intx\/hub-sessions(?:\/[^"']*)?["']\s*\)?/;
+
+function tsFiles(dir: string): string[] {
+  const files: string[] = [];
+  const walk = (current: string) => {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const absolute = join(current, entry.name);
+      if (entry.isDirectory()) walk(absolute);
+      else if (entry.name.endsWith(".ts")) files.push(absolute);
+    }
+  };
+  if (existsSync(dir)) walk(dir);
+  return files;
+}
+
+describe("no sessions package", () => {
+  test("package.json carries no dependency on the sessions package", () => {
+    expect(pkg.dependencies["@intx/hub-sessions"]).toBeUndefined();
+  });
+
+  test("no first-party tree imports the sessions package", () => {
+    const offenders: string[] = [];
+    for (const tree of FIRST_PARTY_TREES) {
+      for (const file of tsFiles(join(repoRoot, tree))) {
+        if (SESSIONS_IMPORT.test(readFileSync(file, "utf8")))
+          offenders.push(relative(repoRoot, file).split("/").join("/"));
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+});