@gajae-code/coding-agent 0.11.9 → 0.11.11

package/src/session/fallback-chain-controller.ts

@@ -30,6 +30,7 @@ export class FallbackChainController {
 
 	#attemptStarted = false;
 	#totalAttemptsUsed = 0;
+	#restoredEntryIndices = new Set<number>();
 	skips: Array<{ selector: string; reason: string }> = [];
 	exhaustedForTurn = false;
 
@@ -46,6 +47,10 @@ export class FallbackChainController {
 		return this.#totalAttemptsUsed;
 	}
 
+	#maxTotalAttempts(): number {
+		return this.maxAttempts * this.chain.entries.length + this.#restoredEntryIndices.size;
+	}
+
 	currentSelector(): string | undefined {
 		return this.chain.entries[this.activeIndex];
 	}
@@ -59,7 +64,7 @@ export class FallbackChainController {
 	/** Charge an upstream request at its concrete transport boundary. */
 	onAttemptStarted(): void {
 		if (!this.currentSelector() || this.exhaustedForTurn) return;
-		if (this.#totalAttemptsUsed >= this.maxAttempts * this.chain.entries.length) {
+		if (this.#totalAttemptsUsed >= this.#maxTotalAttempts()) {
 			this.activeIndex = this.chain.entries.length;
 			this.exhaustedForTurn = true;
 			return;
@@ -82,6 +87,7 @@ export class FallbackChainController {
 		this.attemptsUsed = 0;
 		this.#totalAttemptsUsed = 0;
 		this.tried = [];
+		this.#restoredEntryIndices.clear();
 		this.#attemptStarted = false;
 	}
 
@@ -91,6 +97,7 @@ export class FallbackChainController {
 		this.skips = [...skips];
 		this.attemptsUsed = 0;
 		this.#totalAttemptsUsed = 0;
+		this.#restoredEntryIndices.clear();
 		this.#attemptStarted = false;
 		this.exhaustedForTurn = this.activeIndex >= this.chain.entries.length;
 	}
@@ -104,7 +111,7 @@ export class FallbackChainController {
 		}
 		this.#attemptStarted = false;
 		this.tried.push({ selector, triggerClass, reason });
-		if (this.#totalAttemptsUsed >= this.maxAttempts * this.chain.entries.length) {
+		if (this.#totalAttemptsUsed >= this.#maxTotalAttempts()) {
 			this.activeIndex = this.chain.entries.length;
 			this.exhaustedForTurn = true;
 			return "exhausted";
@@ -126,19 +133,23 @@ export class FallbackChainController {
 	}
 
 	/**
-	 * Restore the entry that just advanced when credential rotation permits a retry.
-	 * The chain-wide budget and failure history remain charged.
+	 * Restore the entry that just advanced for one attempt with a rotated credential.
+	 * Each non-terminal entry may be restored once, so credential rotation remains
+	 * bounded and cannot consume the attempts reserved for downstream entries.
 	 */
 	restorePreviousEntryForRetry(): boolean {
+		const previousIndex = this.activeIndex - 1;
 		if (
-			this.activeIndex === 0 ||
+			previousIndex < 0 ||
 			this.exhaustedForTurn ||
-			this.#totalAttemptsUsed >= this.maxAttempts * this.chain.entries.length
+			this.#restoredEntryIndices.has(previousIndex) ||
+			this.#totalAttemptsUsed >= this.#maxTotalAttempts()
 		) {
 			return false;
 		}
-		this.activeIndex -= 1;
-		this.attemptsUsed = 0;
+		this.#restoredEntryIndices.add(previousIndex);
+		this.activeIndex = previousIndex;
+		this.attemptsUsed = this.maxAttempts - 1;
 		this.exhaustedForTurn = false;
 		this.#attemptStarted = false;
 		return true;
@@ -157,6 +168,7 @@ export class FallbackChainController {
 		this.attemptsUsed = 0;
 		this.#totalAttemptsUsed = 0;
 		this.tried = [];
+		this.#restoredEntryIndices.clear();
 		this.skips = [];
 		this.exhaustedForTurn = this.chain.entries.length === 0;
 		this.#attemptStarted = false;
@@ -174,6 +186,33 @@ export function cappedExponentialWithFullJitter(
 	return Math.floor(Math.max(0, cap) * Math.max(0, Math.min(1, random())));
 }
 
+/**
+ * Legacy auto-compaction retry delay.
+ *
+ * Deliberately the mirror image of `effectiveFallbackDelay`: this path recovers
+ * Retry-After by regex over provider error prose (`#parseRetryAfterMsFromError`),
+ * so it follows the documented legacy rule — `retry.maxDelayMs` caps every
+ * legacy session retry delay, including provider retry-after hints. Managed
+ * fallback stays uncapped because it retries within its own per-entry budget;
+ * compaction has no such budget, so the final candidate would otherwise sleep
+ * for the full server-suggested duration.
+ *
+ * `maxDelayMs <= 0` means "no cap", matching `cappedExponentialWithFullJitter`.
+ * A missing, NaN, or infinite hint collapses to "no usable hint".
+ */
+export function compactionRetryDelay(
+	baseDelayMs: number,
+	maxDelayMs: number,
+	attempt: number,
+	retryAfterMs: number | undefined,
+): number {
+	const exponential = baseDelayMs * 2 ** Math.max(0, attempt);
+	const hint = Number.isFinite(retryAfterMs) ? Math.max(0, retryAfterMs as number) : 0;
+	const hinted = Math.max(exponential, hint);
+	const bounded = maxDelayMs > 0 ? Math.min(hinted, maxDelayMs) : hinted;
+	return Math.max(0, bounded);
+}
+
 /** Retry-After is intentionally uncapped. */
 export function effectiveFallbackDelay(
 	baseDelayMs: number,

package/src/session/internal/managed-session-scope.ts

@@ -8,7 +8,7 @@ import {
 	verifyOwnerOnlyPathSecurity,
 	verifyOwnerOnlyPathSecurityExpected,
 } from "@gajae-code/natives";
-import { pathIsWithin } from "@gajae-code/utils";
+import { logger, pathIsWithin } from "@gajae-code/utils";
 import type { ResumeSessionIdentity } from "../session-manager";
 import {
 	FileSessionStorage,
@@ -2400,7 +2400,11 @@ type SourceArtifactCleanup = {
 	tree: NativeDirectoryTreeSnapshot;
 };
 
-function cleanupAuthorityMatches(cleanup: SourceArtifactCleanup, parent: string): boolean {
+export function cleanupAuthorityMatches(
+	cleanup: SourceArtifactCleanup,
+	parent: string,
+	platform: NodeJS.Platform = process.platform,
+): boolean {
 	try {
 		const stat = fs.lstatSync(cleanup.retainedPath, { bigint: true });
 		if (
@@ -2408,15 +2412,26 @@ function cleanupAuthorityMatches(cleanup: SourceArtifactCleanup, parent: string)
 			!stat.isDirectory() ||
 			stat.isSymbolicLink() ||
 			stat.dev !== cleanup.identity.dev ||
-			stat.ino !== cleanup.identity.ino ||
-			stat.size !== cleanup.identity.size ||
-			stat.mtimeNs !== cleanup.identity.mtimeNs
+			stat.ino !== cleanup.identity.ino
 		)
 			return false;
 		const snapshot = native.snapshotDirectoryTree(cleanup.retainedPath);
+		const observedRoot = snapshot.snapshot?.entries.find(
+			entry => entry.relativePath === "" && entry.kind === "directory",
+		);
+		if (
+			!snapshot.ok ||
+			!snapshot.snapshot ||
+			!observedRoot ||
+			(platform === "win32"
+				? observedRoot.dev !== cleanup.identity.dev.toString() ||
+					observedRoot.ino !== cleanup.identity.ino.toString() ||
+					BigInt(observedRoot.size) !== cleanup.identity.size ||
+					BigInt(observedRoot.mtimeNs) !== cleanup.identity.mtimeNs
+				: stat.size !== cleanup.identity.size || stat.mtimeNs !== cleanup.identity.mtimeNs)
+		)
+			return false;
 		return (
-			!!snapshot.ok &&
-			!!snapshot.snapshot &&
 			sameArtifactTree(snapshot.snapshot, cleanup.tree) &&
 			cleanup.tree.entries.length === 1 &&
 			cleanup.tree.entries[0]?.relativePath === "" &&
@@ -2427,8 +2442,9 @@ function cleanupAuthorityMatches(cleanup: SourceArtifactCleanup, parent: string)
 	}
 }
 
-function detachArtifactRootForMigration(
+export function detachArtifactRootForMigration(
 	plan: DetachedArtifactRoot,
+	platform: NodeJS.Platform = process.platform,
 ):
 	| { detached: DetachedArtifactRoot; detachOutcome: "clean" }
 	| { detached: DetachedArtifactRoot; detachOutcome: "cleanup_pending"; cleanup: SourceArtifactCleanup } {
@@ -2464,14 +2480,27 @@ function detachArtifactRootForMigration(
 	if (!stat.isDirectory() || stat.isSymbolicLink() || path.dirname(placeholder) !== path.dirname(plan.originalPath))
 		throw new Error("durability_failed");
 	const snapshot = native.snapshotDirectoryTree(placeholder);
+	if (!snapshot.ok || !snapshot.snapshot) throw new Error("durability_failed");
+	// Windows directory size/mtime authority is the native tree root, never Bun's
+	// zero-valued directory lstat. Capturing Bun values here would guarantee a
+	// mismatch against the native-authoritative check below.
+	const placeholderRoot = snapshot.snapshot.entries.find(
+		entry => entry.relativePath === "" && entry.kind === "directory",
+	);
+	if (!placeholderRoot) throw new Error("durability_failed");
 	const cleanup: SourceArtifactCleanup = {
 		state: "cleanup_pending",
 		role: "exchange_placeholder",
 		retainedPath: placeholder,
-		identity: { dev: stat.dev, ino: stat.ino, size: stat.size, mtimeNs: stat.mtimeNs },
-		tree: snapshot.snapshot!,
+		identity: {
+			dev: stat.dev,
+			ino: stat.ino,
+			size: platform === "win32" ? BigInt(placeholderRoot.size) : stat.size,
+			mtimeNs: platform === "win32" ? BigInt(placeholderRoot.mtimeNs) : stat.mtimeNs,
+		},
+		tree: snapshot.snapshot,
 	};
-	if (!snapshot.ok || !snapshot.snapshot || !cleanupAuthorityMatches(cleanup, path.dirname(plan.originalPath)))
+	if (!cleanupAuthorityMatches(cleanup, path.dirname(plan.originalPath), platform))
 		throw new Error("durability_failed");
 	return { detached, detachOutcome: "cleanup_pending", cleanup };
 }
@@ -2789,12 +2818,16 @@ function validateCandidateForScope(scope: ManagedScope, candidate: ManagedCandid
 }
 
 /** Resume tombstoned cleanup under its original operation lease without restoring retired candidates. */
-export async function reconcileManagedTombstones(scope: ManagedScope): Promise<void> {
+export async function reconcileManagedTombstones(
+	scope: ManagedScope,
+	expectedCandidate?: ManagedCandidate,
+): Promise<void> {
 	const directory = path.join(managedInternalDirectory(scope), MANAGED_TOMBSTONES_DIRECTORY);
 	for (const name of fs.readdirSync(directory)) {
 		const tombstone = path.join(directory, name);
 		const targets = retiredTargets(scope, tombstone);
 		if (!targets) continue;
+		if (targets.every(target => cleanupCompleted(scope, tombstone, target))) continue;
 		let lock: ManagedStorageLock | undefined;
 		try {
 			lock = await acquireManagedLock(
@@ -2807,135 +2840,148 @@ export async function reconcileManagedTombstones(scope: ManagedScope): Promise<v
 			for (const target of lockedTargets) {
 				lock.assertOwned();
 				if (cleanupCompleted(scope, tombstone, target)) continue;
-				const pending = pendingCleanupReceipt(scope, tombstone, target);
-				const observedPending = pending ? probePlannedCleanupDetach(target, pending) : undefined;
 				try {
-					fs.lstatSync(target.path);
-				} catch (error) {
-					if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-						if (!observedPending) continue;
-						if (
-							cleanupArtifactsRemoved(scope, tombstone, target, observedPending.attempt) &&
-							cleanupRootsAbsent(tombstone, target, observedPending)
-						) {
-							fsyncManagedParent(target.path);
-							await publishCleanupCompleted(scope, tombstone, target, lock);
-							continue;
-						}
-					} else throw error;
-				}
-				const verified = observedPending ? target : validateCandidateForScope(scope, target);
-				if (!verified || !sameCandidate(verified, target)) throw new Error("source_changed");
-				const discoveredDetach =
-					!!observedPending &&
-					(observedPending.detachedArtifactsPath !== pending?.detachedArtifactsPath ||
-						observedPending.detachedTranscriptPath !== pending?.detachedTranscriptPath);
-				const active =
-					discoveredDetach || (observedPending && requiresFreshCleanupPlan(observedPending))
-						? nextCleanupReceipt(target, observedPending)
-						: (observedPending ?? nextCleanupReceipt(target, undefined));
-				if (!observedPending || discoveredDetach || requiresFreshCleanupPlan(observedPending))
-					await publishCleanupPending(scope, tombstone, active, lock);
-				let deletion = await new FileSessionStorage().deleteSessionVerified({
-					sessionsRoot: scope.sessionsRoot,
-					transcriptPath: target.path,
-					sessionId: target.sessionId,
-					cwd: target.cwd,
-					transcriptIdentity: target.identity,
-					expectedArtifactsIdentity: active.expectedArtifactsIdentity,
-					expectedArtifactsTree: active.expectedArtifactsTree,
-					detachedArtifactsPath:
-						active.detachedArtifactsPath ??
-						observedPending?.detachedArtifactsPath ??
-						(fs.existsSync(active.plannedArtifactsPath) ? active.plannedArtifactsPath : undefined),
-					detachedTranscriptPath:
-						active.detachedTranscriptPath ??
-						observedPending?.detachedTranscriptPath ??
-						(pending && fs.existsSync(pending.plannedTranscriptPath)
-							? pending.plannedTranscriptPath
-							: undefined) ??
-						(fs.existsSync(active.plannedTranscriptPath) ? active.plannedTranscriptPath : undefined),
-					retainedArtifactsSuccessorPath: active.retainedArtifactsSuccessorPath,
-					retainedArtifactsPlaceholderPath: active.retainedArtifactsPlaceholderPath,
-					retainedArtifactsUnknownPath: active.retainedArtifactsUnknownPath,
-					retainedTranscriptSuccessorPath: active.retainedTranscriptSuccessorPath,
-					retainedTranscriptPlaceholderPath: active.retainedTranscriptPlaceholderPath,
-					retainedTranscriptUnknownPath: active.retainedTranscriptUnknownPath,
-					plannedArtifactsPath: active.plannedArtifactsPath,
-					plannedTranscriptPath: active.plannedTranscriptPath,
-					...(cleanupArtifactsRemoved(scope, tombstone, target, pending?.attempt ?? active.attempt)
-						? { artifactsRemoved: true as const }
-						: {}),
-				});
-				if (deletion.kind === "artifacts_removed") {
-					await publishCleanupArtifactsRemoved(scope, tombstone, active, lock);
-					deletion = await new FileSessionStorage().deleteSessionVerified({
+					const pending = pendingCleanupReceipt(scope, tombstone, target);
+					const observedPending = pending ? probePlannedCleanupDetach(target, pending) : undefined;
+					try {
+						fs.lstatSync(target.path);
+					} catch (error) {
+						if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+							if (!observedPending) continue;
+							if (
+								cleanupArtifactsRemoved(scope, tombstone, target, observedPending.attempt) &&
+								cleanupRootsAbsent(tombstone, target, observedPending)
+							) {
+								fsyncManagedParent(target.path);
+								await publishCleanupCompleted(scope, tombstone, target, lock);
+								continue;
+							}
+						} else throw error;
+					}
+					const verified = observedPending ? target : validateCandidateForScope(scope, target);
+					if (!verified || !sameCandidate(verified, target)) throw new Error("source_changed");
+					const discoveredDetach =
+						!!observedPending &&
+						(observedPending.detachedArtifactsPath !== pending?.detachedArtifactsPath ||
+							observedPending.detachedTranscriptPath !== pending?.detachedTranscriptPath);
+					const active =
+						discoveredDetach || (observedPending && requiresFreshCleanupPlan(observedPending))
+							? nextCleanupReceipt(target, observedPending)
+							: (observedPending ?? nextCleanupReceipt(target, undefined));
+					if (!observedPending || discoveredDetach || requiresFreshCleanupPlan(observedPending))
+						await publishCleanupPending(scope, tombstone, active, lock);
+					let deletion = await new FileSessionStorage().deleteSessionVerified({
 						sessionsRoot: scope.sessionsRoot,
 						transcriptPath: target.path,
 						sessionId: target.sessionId,
 						cwd: target.cwd,
 						transcriptIdentity: target.identity,
-						plannedArtifactsPath: active.plannedArtifactsPath,
-						plannedTranscriptPath: active.plannedTranscriptPath,
-						detachedTranscriptPath: active.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
-
+						expectedArtifactsIdentity: active.expectedArtifactsIdentity,
+						expectedArtifactsTree: active.expectedArtifactsTree,
+						detachedArtifactsPath:
+							active.detachedArtifactsPath ??
+							observedPending?.detachedArtifactsPath ??
+							(fs.existsSync(active.plannedArtifactsPath) ? active.plannedArtifactsPath : undefined),
+						detachedTranscriptPath:
+							active.detachedTranscriptPath ??
+							observedPending?.detachedTranscriptPath ??
+							(pending && fs.existsSync(pending.plannedTranscriptPath)
+								? pending.plannedTranscriptPath
+								: undefined) ??
+							(fs.existsSync(active.plannedTranscriptPath) ? active.plannedTranscriptPath : undefined),
 						retainedArtifactsSuccessorPath: active.retainedArtifactsSuccessorPath,
 						retainedArtifactsPlaceholderPath: active.retainedArtifactsPlaceholderPath,
 						retainedArtifactsUnknownPath: active.retainedArtifactsUnknownPath,
 						retainedTranscriptSuccessorPath: active.retainedTranscriptSuccessorPath,
 						retainedTranscriptPlaceholderPath: active.retainedTranscriptPlaceholderPath,
 						retainedTranscriptUnknownPath: active.retainedTranscriptUnknownPath,
-						artifactsRemoved: true,
+						plannedArtifactsPath: active.plannedArtifactsPath,
+						plannedTranscriptPath: active.plannedTranscriptPath,
+						...(cleanupArtifactsRemoved(scope, tombstone, target, pending?.attempt ?? active.attempt)
+							? { artifactsRemoved: true as const }
+							: {}),
 					});
-				}
-				if (deletion.kind === "cleanup_pending") {
-					const retry = nextCleanupReceipt(target, active);
-					await publishCleanupPending(
-						scope,
+					if (deletion.kind === "artifacts_removed") {
+						await publishCleanupArtifactsRemoved(scope, tombstone, active, lock);
+						deletion = await new FileSessionStorage().deleteSessionVerified({
+							sessionsRoot: scope.sessionsRoot,
+							transcriptPath: target.path,
+							sessionId: target.sessionId,
+							cwd: target.cwd,
+							transcriptIdentity: target.identity,
+							plannedArtifactsPath: active.plannedArtifactsPath,
+							plannedTranscriptPath: active.plannedTranscriptPath,
+							detachedTranscriptPath: active.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
+
+							retainedArtifactsSuccessorPath: active.retainedArtifactsSuccessorPath,
+							retainedArtifactsPlaceholderPath: active.retainedArtifactsPlaceholderPath,
+							retainedArtifactsUnknownPath: active.retainedArtifactsUnknownPath,
+							retainedTranscriptSuccessorPath: active.retainedTranscriptSuccessorPath,
+							retainedTranscriptPlaceholderPath: active.retainedTranscriptPlaceholderPath,
+							retainedTranscriptUnknownPath: active.retainedTranscriptUnknownPath,
+							artifactsRemoved: true,
+						});
+					}
+					if (deletion.kind === "cleanup_pending") {
+						const retry = nextCleanupReceipt(target, active);
+						await publishCleanupPending(
+							scope,
+							tombstone,
+							{
+								...retry,
+								expectedArtifactsIdentity:
+									deletion.phase === "artifacts"
+										? deletion.artifactsIdentity
+										: active.expectedArtifactsIdentity,
+								expectedArtifactsTree:
+									deletion.phase === "artifacts" ? deletion.artifactsTree : active.expectedArtifactsTree,
+								detachedArtifactsPath:
+									deletion.phase === "artifacts"
+										? deletion.detachedArtifactsPath
+										: active.detachedArtifactsPath,
+								detachedTranscriptPath:
+									deletion.phase === "transcript"
+										? deletion.detachedTranscriptPath
+										: active.detachedTranscriptPath,
+								retainedArtifactsSuccessorPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedSuccessorPath
+										: active.retainedArtifactsSuccessorPath,
+								retainedArtifactsPlaceholderPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedPlaceholderPath
+										: active.retainedArtifactsPlaceholderPath,
+								retainedArtifactsUnknownPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedUnknownPath
+										: active.retainedArtifactsUnknownPath,
+								retainedTranscriptSuccessorPath:
+									deletion.phase === "transcript"
+										? deletion.retainedSuccessorPath
+										: active.retainedTranscriptSuccessorPath,
+								retainedTranscriptPlaceholderPath:
+									deletion.phase === "transcript"
+										? deletion.retainedPlaceholderPath
+										: active.retainedTranscriptPlaceholderPath,
+								retainedTranscriptUnknownPath:
+									deletion.phase === "transcript"
+										? deletion.retainedUnknownPath
+										: active.retainedTranscriptUnknownPath,
+							},
+							lock,
+						);
+						continue;
+					}
+					fsyncManagedParent(target.path);
+					await publishCleanupCompleted(scope, tombstone, target, lock);
+				} catch (error) {
+					if (!expectedCandidate || target.sessionId === expectedCandidate.sessionId) throw error;
+					logger.warn("Tombstone reconciliation failed for one target; will retry on a future scope open", {
 						tombstone,
-						{
-							...retry,
-							expectedArtifactsIdentity:
-								deletion.phase === "artifacts" ? deletion.artifactsIdentity : active.expectedArtifactsIdentity,
-							expectedArtifactsTree:
-								deletion.phase === "artifacts" ? deletion.artifactsTree : active.expectedArtifactsTree,
-							detachedArtifactsPath:
-								deletion.phase === "artifacts" ? deletion.detachedArtifactsPath : active.detachedArtifactsPath,
-							detachedTranscriptPath:
-								deletion.phase === "transcript"
-									? deletion.detachedTranscriptPath
-									: active.detachedTranscriptPath,
-							retainedArtifactsSuccessorPath:
-								deletion.phase === "artifacts"
-									? deletion.retainedSuccessorPath
-									: active.retainedArtifactsSuccessorPath,
-							retainedArtifactsPlaceholderPath:
-								deletion.phase === "artifacts"
-									? deletion.retainedPlaceholderPath
-									: active.retainedArtifactsPlaceholderPath,
-							retainedArtifactsUnknownPath:
-								deletion.phase === "artifacts"
-									? deletion.retainedUnknownPath
-									: active.retainedArtifactsUnknownPath,
-							retainedTranscriptSuccessorPath:
-								deletion.phase === "transcript"
-									? deletion.retainedSuccessorPath
-									: active.retainedTranscriptSuccessorPath,
-							retainedTranscriptPlaceholderPath:
-								deletion.phase === "transcript"
-									? deletion.retainedPlaceholderPath
-									: active.retainedTranscriptPlaceholderPath,
-							retainedTranscriptUnknownPath:
-								deletion.phase === "transcript"
-									? deletion.retainedUnknownPath
-									: active.retainedTranscriptUnknownPath,
-						},
-						lock,
-					);
-					continue;
+						sessionId: target.sessionId,
+						error: String(error),
+					});
 				}
-				fsyncManagedParent(target.path);
-				await publishCleanupCompleted(scope, tombstone, target, lock);
 			}
 		} finally {
 			if (lock) await lock.release().catch(() => undefined);
@@ -2962,7 +3008,7 @@ export async function prepareManagedSessionScopeForWrite(
 		ensureManagedDirectory(path.join(internal, MANAGED_LOCKS_DIRECTORY), root, policy);
 		ensureManagedDirectory(path.join(internal, MANAGED_RECEIPTS_DIRECTORY), root, policy);
 		ensureManagedDirectory(path.join(internal, MANAGED_TOMBSTONES_DIRECTORY), root, policy);
-		await reconcileManagedTombstones(scope);
+		await reconcileManagedTombstones(scope, expectedCandidate);
 		return { kind: "resolved", scope };
 	} catch (error) {
 		const publication = error instanceof ManagedPublishError ? error : undefined;

package/src/session/internal/native-publish-outcome.ts

@@ -171,9 +171,14 @@ function legalOutcome(outcome: NativePublishOutcome): boolean {
 			outcome.durabilityState === "not_attempted" &&
 			preMutationReasons.has(outcome.reason) &&
 			((outcome.phase === "rename" &&
-				["destination_exists", "atomic_unavailable", "cross_device", "permission_denied", "io_failure"].includes(
-					outcome.reason,
-				)) ||
+				[
+					"destination_exists",
+					"atomic_unavailable",
+					"cross_device",
+					"permission_denied",
+					"io_failure",
+					"interrupted",
+				].includes(outcome.reason)) ||
 				(outcome.phase === "preflight" &&
 					!["atomic_unavailable", "cross_device", "interrupted"].includes(outcome.reason)) ||
 				(outcome.phase === "file_sync" && outcome.reason === "io_failure"))