@gajae-code/coding-agent 0.11.1 → 0.11.3

package/src/session/session-storage.ts

@@ -1,6 +1,9 @@
+import { createHash } from "node:crypto";
+
 import * as fs from "node:fs";
-import * as fsp from "node:fs/promises";
 import * as path from "node:path";
+import * as native from "@gajae-code/natives";
+
 import { isEnoent, pathIsWithin, peekFile, toError } from "@gajae-code/utils";
 
 const utf8Decoder = new TextDecoder("utf-8");
@@ -155,10 +158,13 @@ export interface SessionStorage {
 // Verified hard-delete identity + typed partial-cleanup evidence
 // =============================================================================
 
-/** Exact (dev, ino) identity fields used for ACP authorization binding. */
+/** Exact authorization evidence for a transcript or artifact path. */
 export interface SessionStorageFileIdentity {
 	dev: bigint;
 	ino: bigint;
+	size: number;
+	mtimeNs: bigint;
+	sha256: string;
 }
 
 /** Kind of verification failure surfaced by {@link deleteSessionVerified}. */
@@ -209,6 +215,18 @@ export interface VerifiedSessionDeleteTarget {
 	 * fails closed. Omit on first attempt or to accept recorded absence.
 	 */
 	expectedArtifactsIdentity?: SessionStorageFileIdentity;
+	/** Stable native recursive-tree evidence captured before artifact detachment. */
+	expectedArtifactsTree?: NativeDirectoryTreeSnapshot;
+	/** Identity-bound quarantine path retained when recursive artifact cleanup failed. */
+	detachedArtifactsPath?: string;
+	/** Identity-bound quarantine path retained when transcript unlink deferred cleanup. */
+	detachedTranscriptPath?: string;
+	/** Caller-published, no-replace quarantine pathname for the next artifact detach. */
+	plannedArtifactsPath?: string;
+	/** Caller-published, no-replace quarantine pathname for the next transcript detach. */
+	plannedTranscriptPath?: string;
+	/** Set only after a durable caller receipt records successful artifact removal. */
+	artifactsRemoved?: true;
 }
 
 /**
@@ -218,6 +236,7 @@ export interface VerifiedSessionDeleteTarget {
  * `deleted` and never `{}`.
  */
 export type VerifiedSessionDeleteResult =
+	| { kind: "artifacts_removed"; phase: "artifacts"; transcriptIdentity: SessionStorageFileIdentity }
 	| { kind: "deleted" }
 	| {
 			kind: "cleanup_pending";
@@ -225,6 +244,10 @@ export type VerifiedSessionDeleteResult =
 			error: Error;
 			/** Artifact directory identity at failure time; undefined when absent. */
 			artifactsIdentity: SessionStorageFileIdentity | undefined;
+			/** Identity-bound quarantine path retained when recursive cleanup failed. */
+			detachedArtifactsPath: string;
+			/** Native snapshot required for an identity-bound recursive retry. */
+			artifactsTree: NativeDirectoryTreeSnapshot;
 			/** Transcript identity (unchanged) for retry binding. */
 			transcriptIdentity: SessionStorageFileIdentity;
 	  }
@@ -234,6 +257,8 @@ export type VerifiedSessionDeleteResult =
 			error: Error;
 			/** Transcript identity at failure time for retry binding. */
 			transcriptIdentity: SessionStorageFileIdentity;
+			/** Optional identity-bound transcript quarantine path for restart cleanup. */
+			detachedTranscriptPath?: string;
 	  };
 
 /** Default OS-close dispatcher: a direct `fs.closeSync`. */
@@ -243,6 +268,110 @@ const defaultCloseAdapter: SessionStorageWriterCloseAdapter = {
 	},
 };
 
+type NativeSecurity = { ok: true } | { ok: false; code: string };
+
+type NativeExactUnlinkResult = { ok: true; detachedPath?: string } | { ok: false; code: string; detachedPath?: string };
+type NativeExactUnlink = (
+	path: string,
+	identity: {
+		dev: bigint;
+		ino: bigint;
+		size: bigint;
+		mtimeNs: bigint;
+		/** Required for regular-file deletion; directories are identity-bound only. */
+		sha256?: string;
+		directory?: boolean;
+		/** Optional caller-planned no-replace quarantine destination component. */
+		quarantineName?: string;
+	},
+) => NativeExactUnlinkResult;
+
+function nativeExactUnlink(
+	pathname: string,
+	identity: {
+		dev: bigint;
+		ino: bigint;
+		size: bigint;
+		mtimeNs: bigint;
+		/** Required for regular-file deletion; directories are identity-bound only. */
+		sha256?: string;
+		directory?: boolean;
+		quarantineName?: string;
+	},
+): NativeExactUnlinkResult {
+	return (native.exactUnlink as unknown as NativeExactUnlink)(pathname, identity);
+}
+
+type NativeDirectoryTreeEntry = {
+	relativePath: string;
+	kind: string;
+	dev: string;
+	ino: string;
+	size: string;
+	mtimeNs: string;
+	sha256?: string;
+};
+export type NativeDirectoryTreeSnapshot = {
+	rootDev: string;
+	rootIno: string;
+	entries: NativeDirectoryTreeEntry[];
+};
+type NativeDirectoryTreeResult =
+	| { ok: true; snapshot: NativeDirectoryTreeSnapshot }
+	| { ok: false; code: string; snapshot?: undefined };
+type NativeDirectoryTreeApi = {
+	snapshotDirectoryTree(pathname: string): NativeDirectoryTreeResult;
+	exactRemoveDirectoryTree(pathname: string, snapshot: NativeDirectoryTreeSnapshot): NativeExactUnlinkResult;
+};
+function nativeDirectoryTreeApi(): NativeDirectoryTreeApi {
+	return native as unknown as NativeDirectoryTreeApi;
+}
+function snapshotDirectoryTree(pathname: string): NativeDirectoryTreeSnapshot {
+	const result = nativeDirectoryTreeApi().snapshotDirectoryTree(pathname);
+	if (!result.ok || !result.snapshot)
+		throw new SessionDeleteVerificationError(
+			"artifacts",
+			`Native artifact snapshot rejected: ${result.ok ? "missing_snapshot" : result.code}`,
+		);
+	return result.snapshot;
+}
+function removeDirectoryTreeExact(pathname: string, snapshot: NativeDirectoryTreeSnapshot): NativeExactUnlinkResult {
+	return nativeDirectoryTreeApi().exactRemoveDirectoryTree(pathname, snapshot);
+}
+
+function exactUnlinkFailure(result: NativeExactUnlinkResult): SessionDeleteVerificationError {
+	if (result.ok) throw new Error("Expected exact unlink failure");
+	const kind: VerifiedDeleteFailureKind =
+		result.code === "reparse_point" || result.code === "not_regular_file"
+			? "symlink"
+			: result.code === "identity_mismatch"
+				? "identity"
+				: "stat";
+	return new SessionDeleteVerificationError(kind, `Exact transcript deletion rejected: ${result.code}`);
+}
+function secureOwnerOnlyFile(pathname: string): void {
+	const applied = native.applyOwnerOnlyPathSecurity(pathname, "file") as NativeSecurity;
+	if (!applied.ok) throw new Error(`Owner-only security rejected ${pathname}: ${applied.code}`);
+	const verified = native.verifyOwnerOnlyPathSecurity(pathname, "file") as NativeSecurity;
+	if (!verified.ok) throw new Error(`Owner-only security rejected ${pathname}: ${verified.code}`);
+}
+
+/** Reject a symlink/junction/reparse component before a storage path is created or opened. */
+function assertNoReparsePath(pathname: string): void {
+	const resolved = path.resolve(pathname);
+	const parsed = path.parse(resolved);
+	let current = parsed.root;
+	for (const part of resolved.slice(parsed.root.length).split(path.sep)) {
+		if (!part) continue;
+		current = path.join(current, part);
+		try {
+			if (fs.lstatSync(current).isSymbolicLink()) throw new Error(`Unsafe reparse storage path: ${current}`);
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		}
+	}
+}
+
 // FinalizationRegistry to clean up leaked file descriptors
 const writerRegistry = new FinalizationRegistry<number>(fd => {
 	try {
@@ -264,14 +393,25 @@ class FileSessionStorageWriter implements SessionStorageWriter {
 		this.#onError = options?.onError;
 		this.#closeAdapter = options?.closeAdapter ?? defaultCloseAdapter;
 		const flags = options?.flags ?? "a";
-		// Ensure parent directory exists
 		const dir = path.dirname(fpath);
-		if (!fs.existsSync(dir)) {
-			fs.mkdirSync(dir, { recursive: true });
+		assertNoReparsePath(dir);
+		if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+		assertNoReparsePath(dir);
+		assertNoReparsePath(fpath);
+		// The creation mode prevents a POSIX exposure before the native verifier runs.
+		const openFlags =
+			(flags === "w"
+				? fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC
+				: fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND) | (fs.constants.O_NOFOLLOW ?? 0);
+		const fd = fs.openSync(fpath, openFlags, 0o600);
+		try {
+			// Do not rely on directory inheritance: secure and verify every file independently.
+			secureOwnerOnlyFile(fpath);
+		} catch (error) {
+			fs.closeSync(fd);
+			throw error;
 		}
-		// Open file once, keep fd for lifetime
-		this.#fd = fs.openSync(fpath, flags === "w" ? "w" : "a");
-		// Register for cleanup if abandoned without close()
+		this.#fd = fd;
 		writerRegistry.register(this, this.#fd, this);
 	}
 
@@ -491,20 +631,18 @@ export class FileSessionStorage implements SessionStorage {
 	}
 
 	/**
-	 * Delete a session file and its artifacts directory.
-	 * Artifacts are stored in a sibling directory with the same name minus .jsonl extension.
+	 * Delete a session and sibling artifacts in an operator-selected explicit directory.
+	 * Default managed roots use deleteSessionVerified and never call this path.
 	 */
 	async deleteSessionWithArtifacts(sessionPath: string): Promise<void> {
-		// Delete the session file itself
-		await this.unlink(sessionPath);
-
-		// Compute artifacts directory: /path/to/session.jsonl -> /path/to/session
+		try {
+			await this.unlink(sessionPath);
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+		}
 		const artifactsDir = sessionPath.slice(0, -6);
-
-		// Delete artifacts directory if it exists. Missing directories are fine, but
-		// surface real cleanup failures because the session file is already gone.
 		try {
-			await fsp.rm(artifactsDir, { recursive: true, force: true });
+			await fs.promises.rm(artifactsDir, { recursive: true, force: true });
 		} catch (err) {
 			const error = toError(err);
 			throw new Error(
@@ -521,68 +659,314 @@ export class FileSessionStorage implements SessionStorage {
 	 * evidence; identity/symlink/containment/header/cwd mismatch throws.
 	 */
 	async deleteSessionVerified(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult> {
-		const { sessionsRoot, transcriptPath, sessionId, cwd, transcriptIdentity, expectedArtifactsIdentity } = target;
+		const {
+			sessionsRoot,
+			transcriptPath,
+			sessionId,
+			cwd,
+			transcriptIdentity,
+			expectedArtifactsIdentity,
+			expectedArtifactsTree,
+			detachedArtifactsPath,
+			detachedTranscriptPath,
+			plannedArtifactsPath,
+			plannedTranscriptPath,
+			artifactsRemoved,
+		} = target;
+		try {
+			assertNoReparsePath(sessionsRoot);
+			assertNoReparsePath(transcriptPath);
+		} catch (err) {
+			throw new SessionDeleteVerificationError("symlink", "Sessions root or transcript path is a symlink", {
+				cause: toError(err),
+			});
+		}
 		if (!transcriptPath.endsWith(".jsonl")) {
 			throw new SessionDeleteVerificationError("containment", "Transcript path is not a .jsonl file");
 		}
 		if (!pathIsWithin(sessionsRoot, transcriptPath)) {
 			throw new SessionDeleteVerificationError("containment", "Transcript is outside the sessions root");
 		}
-		const initial = this.#verifiedReadAndHeader(transcriptPath, sessionId, cwd);
-		const initialStat = initial.snapshot.stat;
-		if (initialStat.dev !== transcriptIdentity.dev || initialStat.ino !== transcriptIdentity.ino) {
+		if (
+			!plannedArtifactsPath ||
+			!plannedTranscriptPath ||
+			path.dirname(plannedArtifactsPath) !== path.dirname(transcriptPath) ||
+			path.dirname(plannedTranscriptPath) !== path.dirname(transcriptPath) ||
+			!path.basename(plannedArtifactsPath).startsWith(".gjc-delete-") ||
+			!path.basename(plannedTranscriptPath).startsWith(".gjc-delete-") ||
+			plannedArtifactsPath === plannedTranscriptPath
+		) {
+			throw new SessionDeleteVerificationError(
+				"artifacts",
+				"Verified deletion requires caller-persisted quarantine paths",
+			);
+		}
+		const cleanupTranscriptPath = detachedTranscriptPath ?? transcriptPath;
+		const hasDetachedTranscript = detachedTranscriptPath !== undefined;
+		if (
+			detachedTranscriptPath &&
+			(path.dirname(detachedTranscriptPath) !== path.dirname(transcriptPath) ||
+				!path.basename(detachedTranscriptPath).startsWith(".gjc-delete-") ||
+				detachedTranscriptPath === plannedTranscriptPath)
+		) {
+			throw new SessionDeleteVerificationError(
+				"identity",
+				"Detached transcript retry requires a fresh quarantine destination",
+			);
+		}
+		if (hasDetachedTranscript && fs.existsSync(transcriptPath)) {
+			throw new SessionDeleteVerificationError(
+				"identity",
+				"Original transcript pathname became occupied during detached cleanup replay",
+			);
+		}
+		const artifactRemovalRoot = `${plannedArtifactsPath}.removing`;
+		if (detachedArtifactsPath === plannedArtifactsPath) {
+			throw new SessionDeleteVerificationError(
+				"artifacts",
+				"Detached artifact retry requires a fresh quarantine destination",
+			);
+		}
+		const retainedArtifactRoot = (input: string): string =>
+			input.endsWith(".removing") ? input : `${input}.removing`;
+
+		const initial = hasDetachedTranscript ? undefined : this.#verifiedReadAndHeader(transcriptPath, sessionId, cwd);
+		const initialStat = initial?.snapshot.stat;
+		const initialDigest = initial ? createHash("sha256").update(initial.snapshot.bytes).digest("hex") : undefined;
+		if (
+			initialStat &&
+			(initialStat.dev !== transcriptIdentity.dev ||
+				initialStat.ino !== transcriptIdentity.ino ||
+				initialStat.size !== transcriptIdentity.size ||
+				initialStat.mtimeNs !== transcriptIdentity.mtimeNs ||
+				initialDigest !== transcriptIdentity.sha256)
+		) {
 			throw new SessionDeleteVerificationError("identity", "Transcript identity does not match authorization");
 		}
+
 		const parentIdentity = this.#directoryIdentity(path.dirname(transcriptPath));
+		if (detachedArtifactsPath) {
+			if (
+				!expectedArtifactsIdentity ||
+				path.dirname(detachedArtifactsPath) !== path.dirname(transcriptPath) ||
+				!path.basename(detachedArtifactsPath).startsWith(".gjc-delete-")
+			) {
+				throw new SessionDeleteVerificationError("artifacts", "Detached artifact cleanup evidence is invalid");
+			}
+			const detachedIdentity = this.#optionalDirectoryIdentity(detachedArtifactsPath);
+			if (
+				!detachedIdentity ||
+				detachedIdentity.dev !== expectedArtifactsIdentity.dev ||
+				detachedIdentity.ino !== expectedArtifactsIdentity.ino
+			) {
+				throw new SessionDeleteVerificationError("artifacts", "Detached artifact identity changed before retry");
+			}
+			if (!expectedArtifactsTree)
+				throw new SessionDeleteVerificationError(
+					"artifacts",
+					"Detached artifact cleanup requires a persisted tree snapshot",
+				);
+			const removal = removeDirectoryTreeExact(detachedArtifactsPath, expectedArtifactsTree);
+			if (!removal.ok) {
+				const retainedRoot = removal.detachedPath ?? detachedArtifactsPath;
+				if (retainedRoot !== detachedArtifactsPath && retainedRoot !== retainedArtifactRoot(detachedArtifactsPath))
+					throw new SessionDeleteVerificationError(
+						"artifacts",
+						"Native artifact removal returned an unauthorized root",
+					);
+				return {
+					kind: "cleanup_pending",
+					phase: "artifacts",
+					error: new SessionDeleteVerificationError(
+						"artifacts",
+						`Exact detached artifact removal rejected: ${removal.code}`,
+					),
+					artifactsIdentity: expectedArtifactsIdentity,
+					detachedArtifactsPath: retainedRoot,
+					artifactsTree: expectedArtifactsTree,
+					transcriptIdentity,
+				};
+			}
+		}
 
+		if (artifactsRemoved && (detachedArtifactsPath || expectedArtifactsIdentity)) {
+			throw new SessionDeleteVerificationError(
+				"artifacts",
+				"Artifact phase receipt conflicts with pending artifact cleanup",
+			);
+		}
 		const artifactsDir = transcriptPath.slice(0, -6);
 		const artifactsIdentity = this.#optionalDirectoryIdentity(artifactsDir);
-		if (artifactsIdentity) {
+		if (artifactsRemoved && artifactsIdentity) {
+			throw new SessionDeleteVerificationError(
+				"artifacts",
+				"Artifact path reappeared after durable artifact-phase completion",
+			);
+		}
+		if (!artifactsIdentity && expectedArtifactsIdentity && !detachedArtifactsPath && !artifactsRemoved) {
+			// Absence at the original path alone is not completion: native recursive removal
+			// may retain the planned root or its deterministic `.removing` final-stage root.
+			if (fs.existsSync(plannedArtifactsPath) || fs.existsSync(artifactRemovalRoot))
+				throw new SessionDeleteVerificationError(
+					"artifacts",
+					"Authorized artifact removal root remains after restart",
+				);
+			return { kind: "artifacts_removed", phase: "artifacts", transcriptIdentity };
+		}
+
+		if (artifactsIdentity && !artifactsRemoved) {
 			if (
 				expectedArtifactsIdentity &&
 				(artifactsIdentity.dev !== expectedArtifactsIdentity.dev ||
-					artifactsIdentity.ino !== expectedArtifactsIdentity.ino)
+					artifactsIdentity.ino !== expectedArtifactsIdentity.ino ||
+					artifactsIdentity.size !== expectedArtifactsIdentity.size ||
+					artifactsIdentity.mtimeNs !== expectedArtifactsIdentity.mtimeNs ||
+					artifactsIdentity.sha256 !== expectedArtifactsIdentity.sha256)
 			) {
 				throw new SessionDeleteVerificationError(
 					"artifacts",
 					"Artifact directory identity does not match recorded cleanup evidence",
 				);
 			}
-			try {
-				await fsp.rm(artifactsDir, { recursive: true, force: true });
-			} catch (err) {
+			const artifactStat = fs.lstatSync(artifactsDir, { bigint: true });
+			if (
+				artifactStat.isSymbolicLink() ||
+				!artifactStat.isDirectory() ||
+				artifactStat.dev !== artifactsIdentity.dev ||
+				artifactStat.ino !== artifactsIdentity.ino
+			) {
+				throw new SessionDeleteVerificationError("artifacts", "Artifact directory changed before deletion");
+			}
+			const observedArtifactsTree = snapshotDirectoryTree(artifactsDir);
+			if (expectedArtifactsTree && JSON.stringify(observedArtifactsTree) !== JSON.stringify(expectedArtifactsTree))
+				throw new SessionDeleteVerificationError("artifacts", "Artifact tree changed before root detach");
+			const artifactsTree = expectedArtifactsTree ?? observedArtifactsTree;
+			const detach = nativeExactUnlink(artifactsDir, {
+				dev: artifactStat.dev,
+				ino: artifactStat.ino,
+				size: artifactStat.size,
+				mtimeNs: artifactStat.mtimeNs,
+				directory: true,
+				quarantineName: path.basename(plannedArtifactsPath),
+			});
+			if (!detach.ok || !detach.detachedPath) {
+				throw new SessionDeleteVerificationError(
+					"artifacts",
+					`Exact artifact detach rejected: ${detach.ok ? "missing_path" : detach.code}`,
+				);
+			}
+			const removal = removeDirectoryTreeExact(detach.detachedPath, artifactsTree);
+			if (!removal.ok) {
+				const retainedRoot = removal.detachedPath ?? detach.detachedPath;
+				if (retainedRoot !== detach.detachedPath && retainedRoot !== retainedArtifactRoot(detach.detachedPath))
+					throw new SessionDeleteVerificationError(
+						"artifacts",
+						"Native artifact removal returned an unauthorized root",
+					);
 				return {
 					kind: "cleanup_pending",
 					phase: "artifacts",
-					error: toError(err),
+					error: new SessionDeleteVerificationError(
+						"artifacts",
+						`Exact detached artifact removal rejected: ${removal.code}`,
+					),
 					artifactsIdentity,
-					transcriptIdentity: { dev: initialStat.dev, ino: initialStat.ino },
+					detachedArtifactsPath: retainedRoot,
+					artifactsTree,
+					transcriptIdentity,
 				};
 			}
 		}
-
+		if (!artifactsRemoved) {
+			if (process.platform !== "win32") {
+				let descriptor: number | undefined;
+				try {
+					descriptor = fs.openSync(
+						path.dirname(transcriptPath),
+						fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW,
+					);
+					const durableParent = fs.fstatSync(descriptor, { bigint: true });
+					if (
+						!durableParent.isDirectory() ||
+						durableParent.dev !== parentIdentity.dev ||
+						durableParent.ino !== parentIdentity.ino
+					)
+						throw new Error("parent_changed");
+					fs.fsyncSync(descriptor);
+				} catch (error) {
+					throw new SessionDeleteVerificationError("artifacts", "durability_failed", { cause: toError(error) });
+				} finally {
+					if (descriptor !== undefined) fs.closeSync(descriptor);
+				}
+			}
+			return { kind: "artifacts_removed", phase: "artifacts", transcriptIdentity };
+		}
+		if (hasDetachedTranscript) {
+			const deletion = nativeExactUnlink(cleanupTranscriptPath, {
+				dev: transcriptIdentity.dev,
+				ino: transcriptIdentity.ino,
+				size: BigInt(transcriptIdentity.size),
+				mtimeNs: transcriptIdentity.mtimeNs,
+				sha256: transcriptIdentity.sha256,
+				quarantineName: path.basename(plannedTranscriptPath),
+			});
+			if (!deletion.ok) {
+				const error = exactUnlinkFailure(deletion);
+				if (error.kind === "identity" || error.kind === "symlink") throw error;
+				return {
+					kind: "cleanup_pending",
+					phase: "transcript",
+					error,
+					transcriptIdentity,
+					detachedTranscriptPath: deletion.detachedPath ?? detachedTranscriptPath,
+				};
+			}
+			return { kind: "deleted" };
+		}
+		if (!initialStat || !initialDigest)
+			throw new SessionDeleteVerificationError("stat", "Transcript cleanup state is invalid");
 		const revalidate = this.#verifiedReadAndHeader(transcriptPath, sessionId, cwd);
 		const revalidateStat = revalidate.snapshot.stat;
-		if (revalidateStat.dev !== initialStat.dev || revalidateStat.ino !== initialStat.ino) {
+		const revalidateDigest = createHash("sha256").update(revalidate.snapshot.bytes).digest("hex");
+		if (
+			revalidateStat.dev !== initialStat.dev ||
+			revalidateStat.ino !== initialStat.ino ||
+			revalidateStat.size !== initialStat.size ||
+			revalidateStat.mtimeNs !== initialStat.mtimeNs ||
+			revalidateDigest !== initialDigest
+		) {
 			throw new SessionDeleteVerificationError(
 				"identity",
 				"Transcript identity changed after artifact removal (replacement detected)",
 			);
 		}
+
 		const parentIdentityNow = this.#directoryIdentity(path.dirname(transcriptPath));
 		if (parentIdentityNow.dev !== parentIdentity.dev || parentIdentityNow.ino !== parentIdentity.ino) {
 			throw new SessionDeleteVerificationError("identity", "Parent directory identity changed during deletion");
 		}
 
-		try {
-			await this.unlink(transcriptPath);
-		} catch (err) {
-			if (isEnoent(err)) return { kind: "deleted" };
+		this.#assertPathMatchesSnapshot(transcriptPath, revalidate.snapshot);
+		if (!Number.isSafeInteger(revalidateStat.size) || revalidateStat.size < 0) {
+			throw new SessionDeleteVerificationError("identity", "Transcript size cannot be bound exactly for deletion");
+		}
+		const deletion = nativeExactUnlink(transcriptPath, {
+			dev: initialStat.dev,
+			ino: initialStat.ino,
+			size: BigInt(initialStat.size),
+			mtimeNs: initialStat.mtimeNs,
+			sha256: initialDigest,
+			quarantineName: path.basename(plannedTranscriptPath),
+		});
+		if (!deletion.ok) {
+			const error = exactUnlinkFailure(deletion);
+			if (error.kind === "identity" || error.kind === "symlink") throw error;
 			return {
 				kind: "cleanup_pending",
 				phase: "transcript",
-				error: toError(err),
-				transcriptIdentity: { dev: revalidateStat.dev, ino: revalidateStat.ino },
+				error,
+				transcriptIdentity,
+				detachedTranscriptPath: deletion.detachedPath,
 			};
 		}
 		return { kind: "deleted" };
@@ -627,6 +1011,27 @@ export class FileSessionStorage implements SessionStorage {
 		return { snapshot };
 	}
 
+	#assertPathMatchesSnapshot(transcriptPath: string, snapshot: SessionStorageSnapshot): void {
+		let named: fs.BigIntStats;
+		try {
+			named = fs.lstatSync(transcriptPath, { bigint: true });
+		} catch (err) {
+			throw new SessionDeleteVerificationError("stat", "Transcript path could not be revalidated", {
+				cause: toError(err),
+			});
+		}
+		if (
+			named.isSymbolicLink() ||
+			!named.isFile() ||
+			named.dev !== snapshot.stat.dev ||
+			named.ino !== snapshot.stat.ino ||
+			Number(named.size) !== snapshot.stat.size ||
+			named.mtimeNs !== snapshot.stat.mtimeNs
+		) {
+			throw new SessionDeleteVerificationError("identity", "Transcript path changed before deletion");
+		}
+	}
+
 	#directoryIdentity(dirPath: string): SessionStorageFileIdentity {
 		let stat: fs.BigIntStats;
 		try {
@@ -637,7 +1042,7 @@ export class FileSessionStorage implements SessionStorage {
 		if (stat.isSymbolicLink() || !stat.isDirectory()) {
 			throw new SessionDeleteVerificationError("symlink", "Directory is a symlink or not a directory");
 		}
-		return { dev: stat.dev, ino: stat.ino };
+		return { dev: stat.dev, ino: stat.ino, size: Number(stat.size), mtimeNs: stat.mtimeNs, sha256: "" };
 	}
 
 	#optionalDirectoryIdentity(dirPath: string): SessionStorageFileIdentity | undefined {
@@ -660,7 +1065,7 @@ export class FileSessionStorage implements SessionStorage {
 			// Fail closed before any mutation.
 			throw new SessionDeleteVerificationError("artifacts", "Artifact path exists but is not a directory");
 		}
-		return { dev: stat.dev, ino: stat.ino };
+		return { dev: stat.dev, ino: stat.ino, size: Number(stat.size), mtimeNs: stat.mtimeNs, sha256: "" };
 	}
 }