@gajae-code/coding-agent 0.12.4 → 0.12.6

package/src/session/internal/managed-session-scope.ts

@@ -8,7 +8,7 @@ import {
 	verifyOwnerOnlyPathSecurity,
 	verifyOwnerOnlyPathSecurityExpected,
 } from "@gajae-code/natives";
-import { hasFsCode, logger, pathIsWithin } from "@gajae-code/utils";
+import { logger, pathIsWithin } from "@gajae-code/utils";
 import type { ResumeSessionIdentity } from "../session-manager";
 import {
 	FileSessionStorage,
@@ -31,7 +31,6 @@ import {
 	type ManagedFileSnapshot,
 	ManagedPublishError,
 	ManagedSessionDescendantStore,
-	ManagedSessionSecurityError,
 	type ManagedSessionSecurityPolicy,
 	type ManagedStorageLock,
 	managedSecurityFailureClassification,
@@ -128,7 +127,7 @@ function configuredRootPath(scope: ManagedScope): string {
 			const canonical = fs.realpathSync.native(candidate);
 			return suffix.length === 0 ? canonical : path.join(canonical, ...suffix);
 		} catch (error) {
-			if (!hasFsCode(error, "ENOENT")) throw error;
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
 			const parent = path.dirname(candidate);
 			if (parent === candidate) throw new Error("Configured managed root is unavailable.");
 			suffix.unshift(path.basename(candidate));
@@ -178,23 +177,6 @@ export type ManagedScopeResolution =
 			cause?: { readonly classification: string; readonly diagnostic?: string };
 	  };
 
-function managedScopeFailureCause(error: unknown): { readonly classification: string } {
-	return { classification: managedSecurityFailureClassification(error) ?? "binding_invalid" };
-}
-
-const managedScopeFailureCodes = new Set([
-	"atomic_unavailable",
-	"invalid_request",
-	"durability_failed",
-	"durability_not_provable",
-]);
-
-function managedScopeFailureMessage(error: unknown, fallback: string): string {
-	const classification = managedSecurityFailureClassification(error);
-	if (classification) return classification;
-	return error instanceof Error && managedScopeFailureCodes.has(error.message) ? error.message : fallback;
-}
-
 export interface ManagedCandidate {
 	sessionId: string;
 	path: string;
@@ -295,7 +277,7 @@ function identityFor(cwd: string): NativeIdentity {
 function verifyExistingManagedScopeDirectory(pathname: string) {
 	if (process.platform !== "win32") return verifyOwnerOnlyPathSecurity(pathname, "directory");
 	const expected = fs.lstatSync(pathname, { bigint: true });
-	if (!expected.isDirectory() || expected.isSymbolicLink()) throw new ManagedSessionSecurityError("reparse_point");
+	if (!expected.isDirectory() || expected.isSymbolicLink()) throw new Error("Unsafe managed directory");
 	const verified = verifyOwnerOnlyPathSecurityExpected(pathname, "directory", expected.dev, expected.ino);
 	const current = fs.lstatSync(pathname, { bigint: true });
 	if (
@@ -304,7 +286,7 @@ function verifyExistingManagedScopeDirectory(pathname: string) {
 		current.dev !== expected.dev ||
 		current.ino !== expected.ino
 	)
-		throw new ManagedSessionSecurityError("identity_mismatch");
+		throw new Error("Managed session directory changed");
 	return verified;
 }
 
@@ -423,18 +405,8 @@ function validateExistingBinding(scope: ManagedScope): ManagedScopeResolution |
 	try {
 		raw = captureManagedFileNoFollow(bindingPath).bytes.toString("utf8");
 	} catch (error) {
-		if (hasFsCode(error, "ENOENT")) return undefined;
-		const classification = hasFsCode(error, "EACCES")
-			? "EACCES"
-			: hasFsCode(error, "EPERM")
-				? "EPERM"
-				: "binding_invalid";
-		return {
-			kind: "error",
-			code: "binding_invalid",
-			message: "The managed scope binding is invalid JSON.",
-			cause: { classification },
-		};
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+		return { kind: "error", code: "binding_invalid", message: "The managed scope binding is invalid JSON." };
 	}
 	return validateBindingRaw(scope, raw);
 }
@@ -457,16 +429,14 @@ function resolveManagedScopeInternal(
 				kind: "error",
 				code: "sessions_root_unavailable",
 				message: "The sessions root is not a safe directory.",
-				cause: { classification: "reparse_point" },
 			};
 		}
 	} catch (error) {
-		if (!hasFsCode(error, "ENOENT")) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
 			return {
 				kind: "error",
 				code: "sessions_root_unavailable",
 				message: "The sessions root could not be inspected.",
-				cause: managedScopeFailureCause(error),
 			};
 		}
 	}
@@ -492,28 +462,21 @@ function resolveManagedScopeInternal(
 				kind: "error",
 				code: "sessions_root_unavailable",
 				message: "The sessions root is not a safe directory.",
-				cause: { classification: "reparse_point" },
 			};
 		}
 	} catch (error) {
-		if (!hasFsCode(error, "ENOENT")) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
 			return {
 				kind: "error",
 				code: "sessions_root_unavailable",
 				message: "The sessions root could not be inspected.",
-				cause: managedScopeFailureCause(error),
 			};
 		}
 	}
 	try {
 		const directory = fs.lstatSync(scope.directoryPath);
 		if (!directory.isDirectory() || directory.isSymbolicLink()) {
-			return {
-				kind: "error",
-				code: "binding_invalid",
-				message: "The managed scope path is not a safe directory.",
-				cause: { classification: "reparse_point" },
-			};
+			return { kind: "error", code: "binding_invalid", message: "The managed scope path is not a safe directory." };
 		}
 		const security = validateNativeSecurityResult(
 			verifyExistingManagedScopeDirectory(scope.directoryPath),
@@ -525,17 +488,11 @@ function resolveManagedScopeInternal(
 				kind: "error",
 				code: "binding_invalid",
 				message: "The managed scope security could not be verified.",
-				cause: { classification: security.code ?? "acl_verify_failed" },
 			};
 		}
 	} catch (error) {
-		if (!hasFsCode(error, "ENOENT")) {
-			return {
-				kind: "error",
-				code: "binding_invalid",
-				message: "The managed scope path could not be inspected.",
-				cause: managedScopeFailureCause(error),
-			};
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+			return { kind: "error", code: "binding_invalid", message: "The managed scope path could not be inspected." };
 		}
 	}
 	return validateExistingBinding(scope) ?? { kind: "resolved", scope };
@@ -600,7 +557,7 @@ function fsyncManagedParent(pathname: string): void {
 		try {
 			descriptor = fs.openSync(parent, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
 		} catch (error) {
-			if (hasFsCode(error, "ENOENT") && path.dirname(parent) !== parent) {
+			if ((error as NodeJS.ErrnoException).code === "ENOENT" && path.dirname(parent) !== parent) {
 				parent = path.dirname(parent);
 				continue;
 			}
@@ -735,6 +692,7 @@ function inspectCandidate(filePath: string, provenance: "v2" | "legacy"): Manage
 			named.isSymbolicLink() ||
 			named.dev !== snapshot.identity.dev ||
 			named.ino !== snapshot.identity.ino ||
+			named.nlink !== 1n ||
 			Number(named.size) !== snapshot.identity.size ||
 			named.mtimeNs !== snapshot.identity.mtimeNs
 		)
@@ -749,6 +707,7 @@ function inspectCandidate(filePath: string, provenance: "v2" | "legacy"): Manage
 				canonicalPath: path.resolve(filePath),
 				sessionId: header.id,
 				...snapshot.identity,
+				nlink: named.nlink,
 				mtimeMs: Number(named.mtimeMs),
 				sha256: createHash("sha256").update(snapshot.bytes).digest("hex"),
 			},
@@ -822,7 +781,7 @@ export async function ensureManagedScope(
 		try {
 			await publishManagedFileNoReplace(bindingPath, new TextEncoder().encode(binding), undefined, root, policy);
 		} catch (error) {
-			if (!(error instanceof Error) || error.message !== "destination_conflict") throw error;
+			if ((error as Error).message !== "destination_conflict") throw error;
 			bindingCollision = true;
 		}
 		const validated = validateExistingBinding(scope);
@@ -831,14 +790,14 @@ export async function ensureManagedScope(
 
 		const preparedDirectory = fs.lstatSync(scope.directoryPath, { bigint: true });
 		if (!preparedDirectory.isDirectory() || preparedDirectory.isSymbolicLink())
-			throw new ManagedSessionSecurityError("reparse_point");
+			throw new Error("Managed session directory changed");
 		managedDirectoryIdentities.set(scope, { dev: preparedDirectory.dev, ino: preparedDirectory.ino });
 		return { kind: "resolved", scope };
 	} catch (error) {
 		const publication = error instanceof ManagedPublishError ? error : undefined;
 		const message =
 			publication?.classification ??
-			managedScopeFailureMessage(error, "The managed scope could not be initialized.");
+			(error instanceof Error ? error.message : "The managed scope could not be initialized.");
 		const code =
 			message === "atomic_unavailable" ||
 			message === "invalid_request" ||
@@ -846,13 +805,14 @@ export async function ensureManagedScope(
 			message === "durability_not_provable"
 				? message
 				: "binding_invalid";
+
 		return {
 			kind: "error",
 			code,
 			message,
-			cause: publication
-				? { classification: publication.classification, diagnostic: publication.diagnostic }
-				: managedScopeFailureCause(error),
+			...(publication
+				? { cause: { classification: publication.classification, diagnostic: publication.diagnostic } }
+				: { cause: { classification: code } }),
 		};
 	}
 }
@@ -988,7 +948,7 @@ export function prepareManagedSessionScopeForWriteSync(
 		try {
 			store.publishNoReplaceSync(MANAGED_SESSION_BINDING_FILE, binding);
 		} catch (error) {
-			if (!(error instanceof Error) || error.message !== "destination_conflict") throw error;
+			if ((error as Error).message !== "destination_conflict") throw error;
 		}
 		stage = "binding_read";
 		const capturedBinding = store.readExpected(MANAGED_SESSION_BINDING_FILE);
@@ -1026,7 +986,8 @@ export function prepareManagedSessionScopeForWriteSync(
 	} catch (error) {
 		const publication = error instanceof ManagedPublishError ? error : undefined;
 		const message =
-			publication?.classification ?? managedScopeFailureMessage(error, "Managed write protocol setup failed.");
+			publication?.classification ??
+			(error instanceof Error ? error.message : "Managed write protocol setup failed.");
 		const code =
 			message === "atomic_unavailable" ||
 			message === "invalid_request" ||
@@ -1034,14 +995,14 @@ export function prepareManagedSessionScopeForWriteSync(
 			message === "durability_not_provable"
 				? message
 				: "binding_invalid";
-
+		const securityClassification = managedSecurityFailureClassification(error);
 		return {
 			kind: "error",
 			code,
 			message,
 			cause: publication
 				? { classification: publication.classification, diagnostic: publication.diagnostic }
-				: { ...managedScopeFailureCause(error), diagnostic: `prepare:${stage}` },
+				: { classification: securityClassification ?? code, diagnostic: `prepare:${stage}` },
 		};
 	}
 }
@@ -1179,6 +1140,7 @@ function sameCandidate(left: ManagedCandidate, right: ManagedCandidate): boolean
 		left.path === right.path &&
 		left.identity.dev === right.identity.dev &&
 		left.identity.ino === right.identity.ino &&
+		left.identity.nlink === right.identity.nlink &&
 		left.identity.size === right.identity.size &&
 		left.identity.mtimeNs === right.identity.mtimeNs &&
 		left.identity.sha256 === right.identity.sha256
@@ -1191,6 +1153,7 @@ function matchesExpectedResumeIdentity(candidate: ManagedCandidate, expected: Re
 		candidate.identity.sessionId === expected.sessionId &&
 		candidate.identity.dev === expected.dev &&
 		candidate.identity.ino === expected.ino &&
+		candidate.identity.nlink === expected.nlink &&
 		candidate.identity.size === expected.size &&
 		candidate.identity.mtimeMs === expected.mtimeMs &&
 		candidate.identity.mtimeNs === expected.mtimeNs &&
@@ -1405,7 +1368,27 @@ function preparedReceiptMatches(
 	}
 }
 
-type RetiredTarget = ManagedCandidate;
+type RetiredTarget = ManagedCandidate & { transcriptParentIdentity: { dev: bigint; ino: bigint } };
+
+function authorizeRetiredTarget(scope: ManagedScope, candidate: ManagedCandidate): RetiredTarget | undefined {
+	try {
+		const before = fs.lstatSync(path.dirname(candidate.path), { bigint: true });
+		if (!before.isDirectory()) return undefined;
+		const verified = validateCandidateForScope(scope, candidate);
+		const after = fs.lstatSync(path.dirname(candidate.path), { bigint: true });
+		if (
+			!verified ||
+			!sameCandidate(verified, candidate) ||
+			!after.isDirectory() ||
+			after.dev !== before.dev ||
+			after.ino !== before.ino
+		)
+			return undefined;
+		return { ...candidate, transcriptParentIdentity: { dev: before.dev, ino: before.ino } };
+	} catch {
+		return undefined;
+	}
+}
 
 function retiredTargets(scope: ManagedScope, pathname: string): readonly RetiredTarget[] | undefined {
 	try {
@@ -1426,6 +1409,14 @@ function retiredTargets(scope: ManagedScope, pathname: string): readonly Retired
 			const identity = item.identity;
 			if (!identity || typeof identity !== "object" || Array.isArray(identity)) return undefined;
 			const fields = identity as Record<string, unknown>;
+			const transcriptParentIdentity = item.transcriptParentIdentity;
+			if (
+				!transcriptParentIdentity ||
+				typeof transcriptParentIdentity !== "object" ||
+				Array.isArray(transcriptParentIdentity)
+			)
+				return undefined;
+			const parentFields = transcriptParentIdentity as Record<string, unknown>;
 			if (
 				typeof item.path !== "string" ||
 				typeof item.sessionId !== "string" ||
@@ -1435,10 +1426,13 @@ function retiredTargets(scope: ManagedScope, pathname: string): readonly Retired
 				typeof fields.canonicalPath !== "string" ||
 				typeof fields.dev !== "string" ||
 				typeof fields.ino !== "string" ||
+				typeof fields.nlink !== "string" ||
 				typeof fields.size !== "number" ||
 				typeof fields.mtimeMs !== "number" ||
 				typeof fields.mtimeNs !== "string" ||
-				typeof fields.sha256 !== "string"
+				typeof fields.sha256 !== "string" ||
+				typeof parentFields.dev !== "string" ||
+				typeof parentFields.ino !== "string"
 			)
 				return undefined;
 			const provenance =
@@ -1457,12 +1451,17 @@ function retiredTargets(scope: ManagedScope, pathname: string): readonly Retired
 					canonicalPath: fields.canonicalPath,
 					dev: BigInt(fields.dev),
 					ino: BigInt(fields.ino),
+					nlink: BigInt(fields.nlink as string),
 					size: fields.size,
 					mtimeMs: fields.mtimeMs,
 					mtimeNs: BigInt(fields.mtimeNs),
 					sha256: fields.sha256,
 					sessionId: item.sessionId,
 				},
+				transcriptParentIdentity: {
+					dev: BigInt(parentFields.dev as string),
+					ino: BigInt(parentFields.ino as string),
+				},
 			});
 		}
 		return targets;
@@ -1539,7 +1538,9 @@ function retainedArtifactsRootMatches(record: Record<string, unknown>): boolean
 type CleanupReceipt = {
 	attempt: number;
 	target: RetiredTarget;
+	transcriptParentIdentity: { dev: bigint; ino: bigint };
 	expectedArtifactsIdentity?: SessionStorageFileIdentity;
+	artifactsAbsentAtAuthorization?: true;
 	expectedArtifactsTree?: NativeDirectoryTreeSnapshot;
 	detachedArtifactsPath?: string;
 	detachedTranscriptPath?: string;
@@ -1579,7 +1580,12 @@ function cleanupReceipt(scope: ManagedScope, tombstone: string, receipt: Cleanup
 			cwd: receipt.target.cwd,
 			identity: receipt.target.identity,
 		},
+		transcriptParentIdentity: {
+			dev: receipt.transcriptParentIdentity.dev.toString(),
+			ino: receipt.transcriptParentIdentity.ino.toString(),
+		},
 		...(receipt.expectedArtifactsIdentity ? { expectedArtifactsIdentity: receipt.expectedArtifactsIdentity } : {}),
+		...(receipt.artifactsAbsentAtAuthorization ? { artifactsAbsentAtAuthorization: true as const } : {}),
 		...(receipt.expectedArtifactsTree ? { expectedArtifactsTree: receipt.expectedArtifactsTree } : {}),
 		...(receipt.detachedArtifactsPath ? { detachedArtifactsPath: receipt.detachedArtifactsPath } : {}),
 		...(receipt.detachedTranscriptPath ? { detachedTranscriptPath: receipt.detachedTranscriptPath } : {}),
@@ -1711,15 +1717,49 @@ function transcriptRootMatchesTarget(pathname: string, target: RetiredTarget): b
 	}
 }
 
-function cleanupRootsAbsent(tombstone: string, target: RetiredTarget, pending: CleanupReceipt): boolean {
+function cleanupTranscriptParentMatches(target: RetiredTarget, pending: CleanupReceipt): boolean {
+	try {
+		const stat = fs.lstatSync(path.dirname(target.path), { bigint: true });
+		return (
+			stat.isDirectory() &&
+			stat.dev === pending.transcriptParentIdentity.dev &&
+			stat.ino === pending.transcriptParentIdentity.ino
+		);
+	} catch {
+		return false;
+	}
+}
+
+function cleanupRootsAbsent(
+	tombstone: string,
+	target: RetiredTarget,
+	pending: CleanupReceipt,
+	includeTranscriptAuthority = true,
+): boolean {
+	const transcriptParent = path.dirname(target.path);
+	const transcriptParentMatches = (): boolean => {
+		try {
+			const stat = fs.lstatSync(transcriptParent, { bigint: true });
+			return (
+				stat.isDirectory() &&
+				stat.dev === pending.transcriptParentIdentity.dev &&
+				stat.ino === pending.transcriptParentIdentity.ino
+			);
+		} catch {
+			return false;
+		}
+	};
+	if (!transcriptParentMatches()) return false;
 	const prefix = `${path.basename(tombstone, ".json")}.${stableOperationName(target)}.cleanup-pending-`;
-	const activeTranscriptRoots = new Set(
-		[pending.plannedTranscriptPath, pending.detachedTranscriptPath].filter((pathname): pathname is string =>
-			isQuarantinePath(target, pathname),
-		),
-	);
+	const activeTranscriptRoots = includeTranscriptAuthority
+		? new Set(
+				[pending.plannedTranscriptPath, pending.detachedTranscriptPath].filter((pathname): pathname is string =>
+					isQuarantinePath(target, pathname),
+				),
+			)
+		: new Set<string>();
 	const roots = new Set<string>([
-		target.path,
+		...(includeTranscriptAuthority ? [target.path] : []),
 		target.path.slice(0, -6),
 		pending.plannedArtifactsPath,
 		deterministicRemovalRoot(pending.plannedArtifactsPath),
@@ -1787,7 +1827,52 @@ function cleanupRootsAbsent(tombstone: string, target: RetiredTarget, pending: C
 		if (!transcriptRootMatchesTarget(pathname, target)) throw new Error("durability_failed");
 		return false;
 	}
-	return true;
+	if (!includeTranscriptAuthority) return true;
+	const pendingDirectories = [transcriptParent];
+	const snapshots: Array<{ path: string; stat: fs.BigIntStats }> = [];
+	let entryCount = 0;
+	try {
+		while (pendingDirectories.length > 0) {
+			const directory = pendingDirectories.pop();
+			if (!directory) return false;
+			const before = fs.lstatSync(directory, { bigint: true });
+			if (!before.isDirectory()) return false;
+			if (
+				directory === transcriptParent &&
+				(before.dev !== pending.transcriptParentIdentity.dev || before.ino !== pending.transcriptParentIdentity.ino)
+			)
+				return false;
+			snapshots.push({ path: directory, stat: before });
+			const entries = fs.readdirSync(directory);
+			entryCount += entries.length;
+			if (entryCount > MANAGED_ARTIFACT_MAX_FILES) return false;
+			for (const name of entries) {
+				const pathname = path.join(directory, name);
+				let stat: fs.BigIntStats;
+				try {
+					stat = fs.lstatSync(pathname, { bigint: true });
+				} catch {
+					return false;
+				}
+				if (stat.dev === target.identity.dev && stat.ino === target.identity.ino) return false;
+				if (stat.isDirectory()) pendingDirectories.push(pathname);
+			}
+		}
+		for (const snapshot of snapshots) {
+			const after = fs.lstatSync(snapshot.path, { bigint: true });
+			if (
+				!after.isDirectory() ||
+				after.dev !== snapshot.stat.dev ||
+				after.ino !== snapshot.stat.ino ||
+				after.mtimeNs !== snapshot.stat.mtimeNs ||
+				after.ctimeNs !== snapshot.stat.ctimeNs
+			)
+				return false;
+		}
+		return true;
+	} catch {
+		return false;
+	}
 }
 
 function sameArtifactRootIdentity(left: SessionStorageFileIdentity, right: SessionStorageFileIdentity): boolean {
@@ -1798,20 +1883,21 @@ function sameArtifactTreeSnapshot(left: NativeDirectoryTreeSnapshot, right: Nati
 	if (left.rootDev !== right.rootDev || left.rootIno !== right.rootIno || left.entries.length !== right.entries.length)
 		return false;
 	const entryKey = (entry: NativeDirectoryTreeSnapshot["entries"][number]): string =>
-		JSON.stringify([entry.relativePath, entry.kind, entry.dev, entry.ino, entry.size, entry.mtimeNs, entry.sha256]);
+		JSON.stringify([
+			entry.relativePath,
+			entry.kind,
+			entry.dev,
+			entry.ino,
+			entry.nlink,
+			entry.size,
+			entry.mtimeNs,
+			entry.sha256,
+		]);
 	const leftEntries = left.entries.map(entryKey).sort();
 	const rightEntries = right.entries.map(entryKey).sort();
 	return leftEntries.every((entry, index) => entry === rightEntries[index]);
 }
 
-function artifactTreePayloadAbsent(snapshot: NativeDirectoryTreeSnapshot): boolean {
-	return (
-		snapshot.entries.length === 1 &&
-		snapshot.entries[0]?.relativePath === "" &&
-		snapshot.entries[0].kind === "directory"
-	);
-}
-
 function assertRetainedArtifactsAuthority(pending: CleanupReceipt): void {
 	if (!pending.detachedArtifactsPath) return;
 	if (!pending.expectedArtifactsIdentity || !pending.expectedArtifactsTree) throw new Error("durability_failed");
@@ -1822,12 +1908,10 @@ function assertRetainedArtifactsAuthority(pending: CleanupReceipt): void {
 		throw new Error("durability_failed");
 	}
 	const observed = artifactIdentityAt(pending.detachedArtifactsPath);
-	const observedTree = snapshotArtifactTree(pending.detachedArtifactsPath);
 	if (
 		!observed ||
 		!sameArtifactRootIdentity(observed, pending.expectedArtifactsIdentity) ||
-		(!sameArtifactTreeSnapshot(observedTree, pending.expectedArtifactsTree) &&
-			!artifactTreePayloadAbsent(observedTree))
+		!sameArtifactTreeSnapshot(snapshotArtifactTree(pending.detachedArtifactsPath), pending.expectedArtifactsTree)
 	)
 		throw new Error("binding_invalid");
 }
@@ -1890,6 +1974,7 @@ function artifactTreeSnapshot(value: unknown): NativeDirectoryTreeSnapshot | und
 				(item.kind === "file" || item.kind === "directory") &&
 				typeof item.dev === "string" &&
 				typeof item.ino === "string" &&
+				typeof item.nlink === "string" &&
 				typeof item.size === "string" &&
 				typeof item.mtimeNs === "string" &&
 				typeof item.ctimeNs === "string" &&
@@ -1937,6 +2022,14 @@ function pendingCleanupReceipt(
 			const attempt = record.attempt;
 			const recorded = record.target as Record<string, unknown> | undefined;
 			const identity = recorded?.identity as Record<string, unknown> | undefined;
+			const transcriptParentIdentity = record.transcriptParentIdentity as Record<string, unknown> | undefined;
+			if (
+				typeof transcriptParentIdentity?.dev === "string" &&
+				typeof transcriptParentIdentity?.ino === "string" &&
+				(transcriptParentIdentity.dev !== target.transcriptParentIdentity.dev.toString() ||
+					transcriptParentIdentity.ino !== target.transcriptParentIdentity.ino.toString())
+			)
+				throw new Error("durability_failed");
 			if (
 				record.schemaVersion !== 2 ||
 				record.state !== "cleanup_pending" ||
@@ -1950,9 +2043,20 @@ function pendingCleanupReceipt(
 				recorded.cwd !== target.cwd ||
 				identity?.dev !== String(target.identity.dev) ||
 				identity.ino !== String(target.identity.ino) ||
+				identity.nlink !== String(target.identity.nlink) ||
 				identity.size !== target.identity.size ||
 				identity.mtimeNs !== String(target.identity.mtimeNs) ||
 				identity.sha256 !== target.identity.sha256 ||
+				!transcriptParentIdentity ||
+				typeof transcriptParentIdentity.dev !== "string" ||
+				typeof transcriptParentIdentity.ino !== "string" ||
+				!/^[0-9]+$/.test(transcriptParentIdentity.dev) ||
+				!/^[0-9]+$/.test(transcriptParentIdentity.ino) ||
+				transcriptParentIdentity.dev !== target.transcriptParentIdentity.dev.toString() ||
+				transcriptParentIdentity.ino !== target.transcriptParentIdentity.ino.toString() ||
+				(latest !== undefined &&
+					(transcriptParentIdentity.dev !== latest.transcriptParentIdentity.dev.toString() ||
+						transcriptParentIdentity.ino !== latest.transcriptParentIdentity.ino.toString())) ||
 				!isQuarantinePath(target, record.plannedArtifactsPath) ||
 				!isQuarantinePath(target, record.plannedTranscriptPath) ||
 				record.plannedArtifactsPath === record.plannedTranscriptPath ||
@@ -1974,6 +2078,8 @@ function pendingCleanupReceipt(
 					!isRetainedNativePath(target, record.retainedTranscriptUnknownPath))
 			)
 				throw new Error("durability_failed");
+			if (record.artifactsAbsentAtAuthorization !== undefined && record.artifactsAbsentAtAuthorization !== true)
+				throw new Error("durability_failed");
 			const artifact = record.expectedArtifactsIdentity as Record<string, unknown> | undefined;
 			const expectedArtifactsIdentity = artifact
 				? typeof artifact.dev === "string" &&
@@ -1991,6 +2097,8 @@ function pendingCleanupReceipt(
 					: undefined
 				: undefined;
 			if (artifact && !expectedArtifactsIdentity) throw new Error("durability_failed");
+			if (record.artifactsAbsentAtAuthorization === true && expectedArtifactsIdentity)
+				throw new Error("durability_failed");
 			const expectedArtifactsTree =
 				record.expectedArtifactsTree === undefined ? undefined : artifactTreeSnapshot(record.expectedArtifactsTree);
 			if (record.expectedArtifactsTree !== undefined && !expectedArtifactsTree) throw new Error("durability_failed");
@@ -2009,7 +2117,12 @@ function pendingCleanupReceipt(
 			latest = {
 				attempt,
 				target,
+				transcriptParentIdentity: {
+					dev: BigInt(transcriptParentIdentity.dev as string),
+					ino: BigInt(transcriptParentIdentity.ino as string),
+				},
 				expectedArtifactsIdentity,
+				artifactsAbsentAtAuthorization: record.artifactsAbsentAtAuthorization === true ? true : undefined,
 				expectedArtifactsTree,
 				detachedArtifactsPath: record.detachedArtifactsPath as string | undefined,
 				detachedTranscriptPath: record.detachedTranscriptPath as string | undefined,
@@ -2034,7 +2147,13 @@ function artifactIdentityForCleanup(target: RetiredTarget): SessionStorageFileId
 	try {
 		const stat = fs.lstatSync(target.path.slice(0, -6), { bigint: true });
 		if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("unsafe_artifacts");
-		return { dev: stat.dev, ino: stat.ino, size: Number(stat.size), mtimeNs: stat.mtimeNs, sha256: "" };
+		return {
+			dev: stat.dev,
+			ino: stat.ino,
+			size: Number(stat.size),
+			mtimeNs: stat.mtimeNs,
+			sha256: "",
+		};
 	} catch (error) {
 		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
 		throw error;
@@ -2053,18 +2172,10 @@ function snapshotArtifactTree(pathname: string): NativeDirectoryTreeSnapshot {
 	return result.snapshot;
 }
 
-function retainedArtifactPayloadAbsent(pathname: string): boolean {
-	try {
-		return artifactTreePayloadAbsent(snapshotArtifactTree(pathname));
-	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return true;
-		throw error;
-	}
-}
-
 function nextCleanupReceipt(target: RetiredTarget, pending: CleanupReceipt | undefined): CleanupReceipt {
 	const attempt = (pending?.attempt ?? 0) + 1;
 	const directory = path.dirname(target.path);
+	const transcriptParentIdentity = pending?.transcriptParentIdentity ?? target.transcriptParentIdentity;
 	const operation = stableOperationName(target);
 	const expectedArtifactsIdentity = pending?.expectedArtifactsIdentity ?? artifactIdentityForCleanup(target);
 	const expectedArtifactsTree =
@@ -2074,7 +2185,10 @@ function nextCleanupReceipt(target: RetiredTarget, pending: CleanupReceipt | und
 	return {
 		attempt,
 		target,
+		transcriptParentIdentity,
 		expectedArtifactsIdentity,
+		artifactsAbsentAtAuthorization:
+			pending?.artifactsAbsentAtAuthorization ?? (expectedArtifactsIdentity ? undefined : true),
 		expectedArtifactsTree,
 		detachedArtifactsPath: pending?.detachedArtifactsPath,
 		retainedArtifactsSuccessorPath: pending?.retainedArtifactsSuccessorPath,
@@ -2467,6 +2581,7 @@ function sameArtifactTree(
 			entry.kind,
 			entry.dev,
 			entry.ino,
+			entry.nlink,
 			entry.size,
 			entry.mtimeNs,
 			entry.ctimeNs,
@@ -2949,11 +3064,8 @@ export async function reconcileManagedTombstones(
 							if (
 								cleanupArtifactsRemoved(scope, tombstone, target, observedPending.attempt) &&
 								cleanupRootsAbsent(tombstone, target, observedPending)
-							) {
-								fsyncManagedParent(target.path);
-								await publishCleanupCompleted(scope, tombstone, target, lock);
+							)
 								continue;
-							}
 						} else throw error;
 					}
 					const verified = observedPending ? target : validateCandidateForScope(scope, target);
@@ -2968,13 +3080,16 @@ export async function reconcileManagedTombstones(
 							: (observedPending ?? nextCleanupReceipt(target, undefined));
 					if (!observedPending || discoveredDetach || requiresFreshCleanupPlan(observedPending))
 						await publishCleanupPending(scope, tombstone, active, lock);
+					if (!cleanupTranscriptParentMatches(target, active)) continue;
 					let deletion = await new FileSessionStorage().deleteSessionVerified({
 						sessionsRoot: scope.sessionsRoot,
 						transcriptPath: target.path,
 						sessionId: target.sessionId,
 						cwd: target.cwd,
 						transcriptIdentity: target.identity,
+						transcriptParentIdentity: target.transcriptParentIdentity,
 						expectedArtifactsIdentity: active.expectedArtifactsIdentity,
+						artifactsAbsentAtAuthorization: active.artifactsAbsentAtAuthorization,
 						expectedArtifactsTree: active.expectedArtifactsTree,
 						detachedArtifactsPath:
 							active.detachedArtifactsPath ??
@@ -3000,6 +3115,8 @@ export async function reconcileManagedTombstones(
 							: {}),
 					});
 					if (deletion.kind === "artifacts_removed") {
+						if (!cleanupRootsAbsent(tombstone, target, active, false)) continue;
+						if (!cleanupTranscriptParentMatches(target, active)) continue;
 						await publishCleanupArtifactsRemoved(scope, tombstone, active, lock);
 						deletion = await new FileSessionStorage().deleteSessionVerified({
 							sessionsRoot: scope.sessionsRoot,
@@ -3007,6 +3124,7 @@ export async function reconcileManagedTombstones(
 							sessionId: target.sessionId,
 							cwd: target.cwd,
 							transcriptIdentity: target.identity,
+							transcriptParentIdentity: target.transcriptParentIdentity,
 							plannedArtifactsPath: active.plannedArtifactsPath,
 							plannedTranscriptPath: active.plannedTranscriptPath,
 							detachedTranscriptPath: active.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
@@ -3022,45 +3140,55 @@ export async function reconcileManagedTombstones(
 					}
 					if (deletion.kind === "cleanup_pending") {
 						const retry = nextCleanupReceipt(target, active);
-						const pendingEvidence = cleanupPendingEvidence(retry, active, deletion);
-						await publishCleanupPending(scope, tombstone, pendingEvidence, lock);
-						if (deletion.phase === "artifacts") {
-							if (!retainedArtifactPayloadAbsent(deletion.detachedArtifactsPath)) continue;
-							await publishCleanupArtifactsRemoved(scope, tombstone, pendingEvidence, lock);
-							deletion = await new FileSessionStorage().deleteSessionVerified({
-								sessionsRoot: scope.sessionsRoot,
-								transcriptPath: target.path,
-								sessionId: target.sessionId,
-								cwd: target.cwd,
-								transcriptIdentity: target.identity,
-								plannedArtifactsPath: pendingEvidence.plannedArtifactsPath,
-								plannedTranscriptPath: pendingEvidence.plannedTranscriptPath,
+						await publishCleanupPending(
+							scope,
+							tombstone,
+							{
+								...retry,
+								expectedArtifactsIdentity:
+									deletion.phase === "artifacts"
+										? deletion.artifactsIdentity
+										: active.expectedArtifactsIdentity,
+								expectedArtifactsTree:
+									deletion.phase === "artifacts" ? deletion.artifactsTree : active.expectedArtifactsTree,
+								detachedArtifactsPath:
+									deletion.phase === "artifacts"
+										? deletion.detachedArtifactsPath
+										: active.detachedArtifactsPath,
 								detachedTranscriptPath:
-									pendingEvidence.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
-								retainedArtifactsSuccessorPath: pendingEvidence.retainedArtifactsSuccessorPath,
-								retainedArtifactsPlaceholderPath: pendingEvidence.retainedArtifactsPlaceholderPath,
-								retainedArtifactsUnknownPath: pendingEvidence.retainedArtifactsUnknownPath,
-								retainedTranscriptSuccessorPath: pendingEvidence.retainedTranscriptSuccessorPath,
-								retainedTranscriptPlaceholderPath: pendingEvidence.retainedTranscriptPlaceholderPath,
-								retainedTranscriptUnknownPath: pendingEvidence.retainedTranscriptUnknownPath,
-								artifactsRemoved: true,
-							});
-							if (deletion.kind === "cleanup_pending") {
-								if (
-									deletion.phase !== "transcript" ||
-									deletion.detachedTranscriptPath !== pendingEvidence.plannedTranscriptPath
-								)
-									throw new Error("durability_failed");
-								const followup = nextCleanupReceipt(target, pendingEvidence);
-								await publishCleanupPending(
-									scope,
-									tombstone,
-									cleanupPendingEvidence(followup, pendingEvidence, deletion),
-									lock,
-								);
-							}
-						}
+									deletion.phase === "transcript"
+										? deletion.detachedTranscriptPath
+										: active.detachedTranscriptPath,
+								retainedArtifactsSuccessorPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedSuccessorPath
+										: active.retainedArtifactsSuccessorPath,
+								retainedArtifactsPlaceholderPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedPlaceholderPath
+										: active.retainedArtifactsPlaceholderPath,
+								retainedArtifactsUnknownPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedUnknownPath
+										: active.retainedArtifactsUnknownPath,
+								retainedTranscriptSuccessorPath:
+									deletion.phase === "transcript"
+										? deletion.retainedSuccessorPath
+										: active.retainedTranscriptSuccessorPath,
+								retainedTranscriptPlaceholderPath:
+									deletion.phase === "transcript"
+										? deletion.retainedPlaceholderPath
+										: active.retainedTranscriptPlaceholderPath,
+								retainedTranscriptUnknownPath:
+									deletion.phase === "transcript"
+										? deletion.retainedUnknownPath
+										: active.retainedTranscriptUnknownPath,
+							},
+							lock,
+						);
+						continue;
 					}
+					if (!cleanupRootsAbsent(tombstone, target, active)) continue;
 					fsyncManagedParent(target.path);
 					await publishCleanupCompleted(scope, tombstone, target, lock);
 				} catch (error) {
@@ -3073,7 +3201,7 @@ export async function reconcileManagedTombstones(
 				}
 			}
 		} finally {
-			if (lock) await lock.release();
+			if (lock) await lock.release().catch(() => undefined);
 		}
 	}
 }
@@ -3102,7 +3230,8 @@ export async function prepareManagedSessionScopeForWrite(
 	} catch (error) {
 		const publication = error instanceof ManagedPublishError ? error : undefined;
 		const message =
-			publication?.classification ?? managedScopeFailureMessage(error, "Managed write protocol setup failed.");
+			publication?.classification ??
+			(error instanceof Error ? error.message : "Managed write protocol setup failed.");
 		const code =
 			message === "atomic_unavailable" ||
 			message === "invalid_request" ||
@@ -3114,9 +3243,9 @@ export async function prepareManagedSessionScopeForWrite(
 			kind: "error",
 			code,
 			message,
-			cause: publication
-				? { classification: publication.classification, diagnostic: publication.diagnostic }
-				: managedScopeFailureCause(error),
+			...(publication
+				? { cause: { classification: publication.classification, diagnostic: publication.diagnostic } }
+				: { cause: { classification: code } }),
 		};
 	}
 }
@@ -3446,7 +3575,7 @@ export async function openManagedCandidateForWrite(
 						: "Managed migration failed.",
 		};
 	} finally {
-		if (lock) await lock.release();
+		if (lock) await lock.release().catch(() => undefined);
 	}
 }
 
@@ -3482,7 +3611,11 @@ export async function deleteManagedSessionCandidate(
 		let targets = retiredTargets(scope, tombstone);
 		if (!targets) {
 			if (!current) throw new Error("source_changed");
-			targets = [current, ...(paired ? [paired] : [])];
+			const authorizedTargets = [current, ...(paired ? [paired] : [])].map(target =>
+				authorizeRetiredTarget(scope, target),
+			);
+			if (authorizedTargets.some(target => target === undefined)) throw new Error("source_changed");
+			targets = authorizedTargets as RetiredTarget[];
 			lock.assertOwned();
 			try {
 				await publishManagedTombstone(
@@ -3497,6 +3630,10 @@ export async function deleteManagedSessionCandidate(
 							cwd: target.cwd,
 							provenance: target.provenance,
 							identity: target.identity,
+							transcriptParentIdentity: {
+								dev: target.transcriptParentIdentity.dev.toString(),
+								ino: target.transcriptParentIdentity.ino.toString(),
+							},
 						})),
 					},
 					lock.assertOwned,
@@ -3512,6 +3649,7 @@ export async function deleteManagedSessionCandidate(
 			lock.assertOwned();
 			const pending = pendingCleanupReceipt(scope, tombstone, target);
 			const observedPending = pending ? probePlannedCleanupDetach(target, pending) : undefined;
+			if (cleanupCompleted(scope, tombstone, target)) continue;
 			try {
 				fs.lstatSync(target.path);
 			} catch (error) {
@@ -3520,14 +3658,16 @@ export async function deleteManagedSessionCandidate(
 					if (
 						cleanupArtifactsRemoved(scope, tombstone, target, observedPending.attempt) &&
 						cleanupRootsAbsent(tombstone, target, observedPending)
-					) {
-						fsyncManagedParent(target.path);
-						await publishCleanupCompleted(scope, tombstone, target, lock);
-						continue;
-					}
+					)
+						return {
+							kind: "cleanup_pending",
+							tombstonePath: tombstone,
+							phase: "transcript",
+							message:
+								"Exact cleanup remains pending because transcript authority disappeared without native deletion proof.",
+						};
 				} else throw error;
 			}
-			if (cleanupCompleted(scope, tombstone, target)) continue;
 			deletedAny = true;
 			const verified = observedPending ? target : validateCandidateForScope(scope, target);
 			if (!verified || !sameCandidate(verified, target)) throw new Error("source_changed");
@@ -3541,13 +3681,24 @@ export async function deleteManagedSessionCandidate(
 					: (observedPending ?? nextCleanupReceipt(target, undefined));
 			if (!observedPending || discoveredDetach || requiresFreshCleanupPlan(observedPending))
 				await publishCleanupPending(scope, tombstone, active, lock);
+			if (!cleanupTranscriptParentMatches(target, active))
+				return {
+					kind: "cleanup_pending",
+					tombstonePath: tombstone,
+					phase: cleanupArtifactsRemoved(scope, tombstone, target, pending?.attempt ?? active.attempt)
+						? "transcript"
+						: "artifacts",
+					message: "Exact cleanup remains pending because transcript parent identity changed before mutation.",
+				};
 			let deletion = await new FileSessionStorage().deleteSessionVerified({
 				sessionsRoot: scope.sessionsRoot,
 				transcriptPath: target.path,
 				sessionId: target.sessionId,
 				cwd: target.cwd,
 				transcriptIdentity: target.identity,
+				transcriptParentIdentity: target.transcriptParentIdentity,
 				expectedArtifactsIdentity: active.expectedArtifactsIdentity,
+				artifactsAbsentAtAuthorization: active.artifactsAbsentAtAuthorization,
 				expectedArtifactsTree: active.expectedArtifactsTree,
 				detachedArtifactsPath: active.detachedArtifactsPath ?? observedPending?.detachedArtifactsPath,
 				detachedTranscriptPath:
@@ -3567,6 +3718,20 @@ export async function deleteManagedSessionCandidate(
 					: {}),
 			});
 			if (deletion.kind === "artifacts_removed") {
+				if (!cleanupRootsAbsent(tombstone, target, active, false))
+					return {
+						kind: "cleanup_pending",
+						tombstonePath: tombstone,
+						phase: "artifacts",
+						message: "Exact cleanup remains pending because artifact or side-path authority is retained.",
+					};
+				if (!cleanupTranscriptParentMatches(target, active))
+					return {
+						kind: "cleanup_pending",
+						tombstonePath: tombstone,
+						phase: "transcript",
+						message: "Exact cleanup remains pending because transcript parent identity changed before mutation.",
+					};
 				await publishCleanupArtifactsRemoved(scope, tombstone, active, lock);
 				deletion = await new FileSessionStorage().deleteSessionVerified({
 					sessionsRoot: scope.sessionsRoot,
@@ -3574,6 +3739,7 @@ export async function deleteManagedSessionCandidate(
 					sessionId: target.sessionId,
 					cwd: target.cwd,
 					transcriptIdentity: target.identity,
+					transcriptParentIdentity: target.transcriptParentIdentity,
 					plannedArtifactsPath: active.plannedArtifactsPath,
 					plannedTranscriptPath: active.plannedTranscriptPath,
 					detachedTranscriptPath: active.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
@@ -3598,53 +3764,21 @@ export async function deleteManagedSessionCandidate(
 				)
 					throw new Error("durability_failed");
 				const retry = nextCleanupReceipt(target, active);
-				const pendingEvidence = cleanupPendingEvidence(retry, active, deletion);
-				await publishCleanupPending(scope, tombstone, pendingEvidence, lock);
-				if (deletion.phase === "artifacts") {
-					if (!retainedArtifactPayloadAbsent(deletion.detachedArtifactsPath))
-						return {
-							kind: "cleanup_pending",
-							tombstonePath: tombstone,
-							phase: deletion.phase,
-							message: "Exact cleanup remains pending because descriptor-bound final deletion is unavailable.",
-						};
-					await publishCleanupArtifactsRemoved(scope, tombstone, pendingEvidence, lock);
-					deletion = await new FileSessionStorage().deleteSessionVerified({
-						sessionsRoot: scope.sessionsRoot,
-						transcriptPath: target.path,
-						sessionId: target.sessionId,
-						cwd: target.cwd,
-						transcriptIdentity: target.identity,
-						plannedArtifactsPath: pendingEvidence.plannedArtifactsPath,
-						plannedTranscriptPath: pendingEvidence.plannedTranscriptPath,
-						detachedTranscriptPath:
-							pendingEvidence.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
-						retainedArtifactsSuccessorPath: pendingEvidence.retainedArtifactsSuccessorPath,
-						retainedArtifactsPlaceholderPath: pendingEvidence.retainedArtifactsPlaceholderPath,
-						retainedArtifactsUnknownPath: pendingEvidence.retainedArtifactsUnknownPath,
-						retainedTranscriptSuccessorPath: pendingEvidence.retainedTranscriptSuccessorPath,
-						retainedTranscriptPlaceholderPath: pendingEvidence.retainedTranscriptPlaceholderPath,
-						retainedTranscriptUnknownPath: pendingEvidence.retainedTranscriptUnknownPath,
-						artifactsRemoved: true,
-					});
-					if (deletion.kind === "cleanup_pending") {
-						if (
-							deletion.phase !== "transcript" ||
-							deletion.detachedTranscriptPath !== pendingEvidence.plannedTranscriptPath
-						)
-							throw new Error("durability_failed");
-						const followup = nextCleanupReceipt(target, pendingEvidence);
-						await publishCleanupPending(
-							scope,
-							tombstone,
-							cleanupPendingEvidence(followup, pendingEvidence, deletion),
-							lock,
-						);
-					}
-				}
-				// A retained transcript quarantine proves canonical absence and remains
-				// identity-bound in the durable pending receipt.
+				await publishCleanupPending(scope, tombstone, cleanupPendingEvidence(retry, active, deletion), lock);
+				return {
+					kind: "cleanup_pending",
+					tombstonePath: tombstone,
+					phase: deletion.phase,
+					message: "Exact cleanup remains pending because descriptor-bound final deletion is unavailable.",
+				};
 			}
+			if (!cleanupRootsAbsent(tombstone, target, active))
+				return {
+					kind: "cleanup_pending",
+					tombstonePath: tombstone,
+					phase: "transcript",
+					message: "Exact cleanup remains pending because transcript or artifact authority is retained.",
+				};
 			fsyncManagedParent(target.path);
 			await publishCleanupCompleted(scope, tombstone, target, lock);
 		}
@@ -3653,6 +3787,6 @@ export async function deleteManagedSessionCandidate(
 		const code = expectedFailure(error);
 		return { kind: "error", code, message: error instanceof Error ? error.message : "Managed deletion failed." };
 	} finally {
-		if (lock) await lock.release();
+		if (lock) await lock.release().catch(() => undefined);
 	}
 }