@gajae-code/coding-agent 0.12.6 → 0.12.8

package/src/prompts/tools/bash.md

@@ -65,5 +65,5 @@ Use it only for sanctioned GJC workflow CLI persistence or state read/write/cont
 # Output minimizer
 
 - Bash stdout/stderr may be rewritten before you see it: long output keeps only the last 1 KiB by default to reduce noise and input-token use. Explicit `tools.artifactTailBytes` / `tools.artifactHeadBytes` settings can set the tail budget or retain both ends. Prefer focused commands and dedicated `search`/`find` tools over producing broad output. Test/lint runners (e.g. `bun test`, `cargo test`, ESLint) are also passed through heuristic filters that drop noise and keep failures.
-- When the local minimizer changes visible text, successful artifact storage appends a footer containing an `artifact://<id>` reference. Artifact allocation is best-effort on direct, async, and monitor paths, and only decimal session artifact ids are accepted. Native callback delivery bounds both the core-to-native relay and N-API queue with backpressure and preserves a 64 KiB terminal tail after its core stream budget, emitting at most one typed aggregate loss marker. Complete artifacts are labeled as full output; hard-capped artifacts, streams that lost bytes before Bash capture, reader/client captures that cannot prove completeness, and loss counters beyond JavaScript's exact integer range report incompleteness instead. If artifact allocation/storage is unavailable before a writer/save operation is attempted, truncation may have no reference or diagnostic. If an artifact writer/save operation is attempted and fails, a bounded diagnostic is emitted without inventing an artifact URI.
-- ACP/client-terminal output can arrive already truncated from the beginning. Terminal creation, kill, output-recovery, and release RPCs are settlement-bounded; stalled or failed exit/kill/output operations report source-capture uncertainty instead of hanging or claiming completeness. Treat any truncation notice or metadata as evidence that the visible tail is incomplete. Recover omitted output only when an `artifact://` footer or metadata reference is present; truncation evidence without a reference means the visible output is incomplete and no artifact is recoverable. Output with neither truncation evidence nor an artifact reference is the complete emitted output.
+- When the local minimizer changes visible text, successful artifact storage appends a footer containing an `artifact://<id>` reference. Complete artifacts are labeled as full output; hard-capped artifacts report omitted bytes instead. If artifact allocation/storage is unavailable before a writer/save operation is attempted, truncation may have no reference or diagnostic. If an artifact writer/save operation is attempted and fails, a bounded diagnostic is emitted without inventing an artifact URI.
+- ACP/client-terminal output can arrive already truncated from the beginning. Treat any truncation notice or metadata as evidence that the visible tail is incomplete. Recover omitted output only when an `artifact://` footer or metadata reference is present; truncation evidence without a reference means the visible output is incomplete and no artifact is recoverable. Output with neither truncation evidence nor an artifact reference is the complete emitted output.

package/src/sdk/acp/adapter.ts

@@ -42,9 +42,6 @@ export type AcpReconnectFailedHandler = (error: SdkClientError) => void;
 export type AcpFrameHandler = (frame: SdkFrame) => void;
 type ReverseRequest = {
 	state: "pending" | "cancelled";
-	connectionId?: string;
-	capability?: string;
-	leaseId?: string;
 	controller?: AbortController;
 	cancelTimer?: NodeJS.Timeout;
 };
@@ -68,15 +65,6 @@ function isLifecycleOperation(operation: string): boolean {
 	);
 }
 
-const MAX_PENDING_REVERSE_PROVIDER_CALLS = 64;
-
-type ProviderCallToken = {
-	method: string;
-	promise?: Promise<unknown>;
-};
-
-const PROVIDER_CLOSE_SETTLEMENT_MS = 1_000;
-
 /**
  * Pure ACP-to-SDK adapter. It deliberately owns neither an AgentSession nor an
  * ACP bridge: all session work is performed through authenticated v3 frames.
@@ -95,13 +83,10 @@ export class AcpSdkAdapter {
 	#reclaiming?: Promise<void>;
 	#reverseRequests = new Map<string, ReverseRequest>();
 	#reconnectFailedHandlers = new Set<AcpReconnectFailedHandler>();
-	#pendingReverseProviderCalls = new Set<ProviderCallToken>();
 	#frameHandlers = new Set<AcpFrameHandler>();
 
 	#reverseCancelTtlMs: number;
 	#closed = false;
-	#closePromise?: Promise<void>;
-	#terminalCleanupUncertain = false;
 
 	constructor(options: AcpSdkAdapterOptions) {
 		this.#client = options.client ?? new SdkClient(options.url, options.token);
@@ -155,16 +140,10 @@ export class AcpSdkAdapter {
 	}
 
 	async close(): Promise<void> {
-		this.#closePromise ??= this.#closeInternal();
-		await this.#closePromise;
-	}
-
-	async #closeInternal(): Promise<void> {
 		if (this.#closed) return;
 		this.#closed = true;
 		if (this.#heartbeat) clearInterval(this.#heartbeat);
-		for (const [id, request] of this.#reverseRequests) {
-			if (request.state === "pending") this.#sendReverseCancellation(id, request);
+		for (const request of this.#reverseRequests.values()) {
 			request.controller?.abort();
 			if (request.cancelTimer) clearTimeout(request.cancelTimer);
 		}
@@ -172,21 +151,7 @@ export class AcpSdkAdapter {
 		this.#unsubscribe?.();
 		this.#unsubscribeReconnect?.();
 		this.#unsubscribeReconnectFailed?.();
-
-		const terminalSettled = await this.#awaitTerminalProviderSettlement();
-		let clientError: unknown;
-		try {
-			await this.#client.close();
-		} catch (error) {
-			clientError = error;
-		}
-		if (!terminalSettled) {
-			throw new AcpSdkAdapterError(
-				"ownership_uncertain",
-				"ACP terminal provider cleanup did not settle before adapter close.",
-			);
-		}
-		if (clientError) throw clientError;
+		await this.#client.close();
 	}
 
 	async prompt(params: JsonObject | string): Promise<unknown> {
@@ -390,7 +355,7 @@ export class AcpSdkAdapter {
 		)
 			return;
 		const controller = new AbortController();
-		const active: ReverseRequest = { state: "pending", connectionId, capability, leaseId, controller };
+		const active: ReverseRequest = { state: "pending", controller };
 		this.#reverseRequests.set(id, active);
 		try {
 			const request = frame.payload as JsonObject | undefined;
@@ -458,175 +423,19 @@ export class AcpSdkAdapter {
 
 	#abortActiveReverseRequests(): void {
 		for (const [id, request] of this.#reverseRequests) {
-			if (request.state === "pending") this.#sendReverseCancellation(id, request);
 			request.state = "cancelled";
 			request.controller?.abort();
 			this.#finishReverse(id, request);
 		}
 	}
 
-	#sendReverseCancellation(id: string, request: ReverseRequest): void {
-		if (!request.connectionId || !request.leaseId) return;
-		try {
-			const cancellation = this.#client.send({
-				type: "reverse_cancel",
-				id,
-				connectionId: request.connectionId,
-				leaseId: request.leaseId,
-			});
-			void Promise.resolve(cancellation).catch(() => {});
-		} catch {
-			// Cancellation is best effort while local retirement remains authoritative.
-		}
-	}
-
-	async #awaitTerminalProviderSettlement(): Promise<boolean> {
-		const deadline = Date.now() + PROVIDER_CLOSE_SETTLEMENT_MS;
-		for (;;) {
-			const pending = [...this.#pendingReverseProviderCalls].filter(token =>
-				["terminal.create", "terminal.kill", "terminal.release"].includes(token.method),
-			);
-			if (pending.length === 0) return !this.#terminalCleanupUncertain;
-			const remaining = deadline - Date.now();
-			if (remaining <= 0) return false;
-			const promises = pending.flatMap(token => (token.promise ? [token.promise] : []));
-			if (promises.length === 0) {
-				await Bun.sleep(Math.min(remaining, 1));
-				continue;
-			}
-			await Promise.race([Promise.allSettled(promises), Bun.sleep(remaining)]);
-		}
-	}
-
-	#reserveProviderCalls(method: string): { call: ProviderCallToken; cleanup: ProviderCallToken[] } {
-		const cleanup =
-			method === "terminal.create"
-				? ([{ method: "terminal.kill" }, { method: "terminal.release" }] satisfies ProviderCallToken[])
-				: [];
-		const required = 1 + cleanup.length;
-		if (this.#pendingReverseProviderCalls.size + required > MAX_PENDING_REVERSE_PROVIDER_CALLS)
-			throw new AcpSdkAdapterError("acp_reverse_capacity", "ACP reverse provider call capacity reached.");
-		const call: ProviderCallToken = { method };
-		this.#pendingReverseProviderCalls.add(call);
-		for (const token of cleanup) this.#pendingReverseProviderCalls.add(token);
-		return { call, cleanup };
-	}
-
-	#releaseReservedProviderCalls(tokens: readonly ProviderCallToken[]): void {
-		for (const token of tokens) {
-			if (!token.promise) this.#pendingReverseProviderCalls.delete(token);
-		}
-	}
-
-	#startProviderCall(
-		method: string,
-		payload: JsonObject,
-		signal: AbortSignal | undefined,
-		token: ProviderCallToken,
-	): Promise<unknown> {
-		let providerCall: Promise<unknown>;
-		try {
-			if (!this.#connection) throw new AcpSdkAdapterError("acp_reverse_unavailable");
-			if (this.#connection.request)
-				providerCall = Promise.resolve(this.#connection.request(method, payload, { cancellationSignal: signal }));
-			else {
-				const target = this.#connection[method];
-				if (typeof target !== "function")
-					throw new AcpSdkAdapterError("acp_reverse_unsupported", `ACP client does not support ${method}.`);
-				providerCall = Promise.resolve((target as (params: JsonObject) => Promise<unknown>)(payload));
-			}
-		} catch (error) {
-			if (token.method === "terminal.kill" || token.method === "terminal.release")
-				this.#terminalCleanupUncertain = true;
-			this.#pendingReverseProviderCalls.delete(token);
-			return Promise.reject(error);
-		}
-		token.promise = providerCall;
-		void providerCall.then(
-			() => this.#pendingReverseProviderCalls.delete(token),
-			() => {
-				if (token.method === "terminal.kill" || token.method === "terminal.release")
-					this.#terminalCleanupUncertain = true;
-				this.#pendingReverseProviderCalls.delete(token);
-			},
-		);
-		return providerCall;
-	}
-
 	async #forwardReverse(method: string, payload: JsonObject, signal: AbortSignal): Promise<unknown> {
 		if (!method || !this.#connection) throw new AcpSdkAdapterError("acp_reverse_unavailable");
-		if (signal.aborted) throw new AcpSdkAdapterError("request_cancelled", "Reverse request was cancelled.");
-		const reservation = this.#reserveProviderCalls(method);
-		const providerCall = this.#startProviderCall(method, payload, signal, reservation.call);
-		const cancelled = Promise.withResolvers<{ status: "cancelled" }>();
-		const onAbort = () => cancelled.resolve({ status: "cancelled" });
-		signal.addEventListener("abort", onAbort, { once: true });
-		if (signal.aborted) cancelled.resolve({ status: "cancelled" });
-		let outcome:
-			| { status: "resolved"; result: unknown }
-			| { status: "rejected"; error: unknown }
-			| { status: "cancelled" };
-		try {
-			outcome = await Promise.race([
-				providerCall.then(
-					result => ({ status: "resolved" as const, result }),
-					error => ({ status: "rejected" as const, error }),
-				),
-				cancelled.promise,
-			]);
-		} finally {
-			signal.removeEventListener("abort", onAbort);
-		}
-		if (outcome.status === "cancelled" || signal.aborted) {
-			if (method === "terminal.create") {
-				void providerCall
-					.then(
-						result => this.#cleanupCancelledTerminalCreate(result, reservation.cleanup),
-						() => {
-							this.#releaseReservedProviderCalls(reservation.cleanup);
-						},
-					)
-					.catch(() => {
-						this.#terminalCleanupUncertain = true;
-						this.#releaseReservedProviderCalls(reservation.cleanup);
-					});
-			} else this.#releaseReservedProviderCalls(reservation.cleanup);
-			throw new AcpSdkAdapterError("request_cancelled", "Reverse request was cancelled.");
-		}
-		this.#releaseReservedProviderCalls(reservation.cleanup);
-		if (outcome.status === "rejected") throw outcome.error;
-		return outcome.result;
-	}
-
-	async #cleanupCancelledTerminalCreate(result: unknown, cleanupTokens: readonly ProviderCallToken[]): Promise<void> {
-		const terminalId =
-			result && typeof result === "object" && typeof (result as { terminalId?: unknown }).terminalId === "string"
-				? (result as { terminalId: string }).terminalId
-				: undefined;
-		if (!terminalId || !this.#connection) {
-			this.#terminalCleanupUncertain = true;
-			this.#releaseReservedProviderCalls(cleanupTokens);
-			return;
-		}
-		for (const [index, method] of (["terminal.kill", "terminal.release"] as const).entries()) {
-			const token = cleanupTokens[index];
-			if (!token) continue;
-			let providerCall: Promise<unknown>;
-			try {
-				providerCall = this.#startProviderCall(method, { terminalId }, AbortSignal.timeout(500), token);
-			} catch {
-				this.#terminalCleanupUncertain = true;
-				this.#releaseReservedProviderCalls([token]);
-				continue;
-			}
-			const cleanupOutcome = await Promise.race([
-				providerCall.then(
-					() => "settled" as const,
-					() => "failed" as const,
-				),
-				Bun.sleep(500).then(() => "timeout" as const),
-			]);
-			if (cleanupOutcome === "failed") this.#terminalCleanupUncertain = true;
-		}
+		if (this.#connection.request)
+			return await this.#connection.request(method, payload, { cancellationSignal: signal });
+		const target = this.#connection[method];
+		if (typeof target !== "function")
+			throw new AcpSdkAdapterError("acp_reverse_unsupported", `ACP client does not support ${method}.`);
+		return await (target as (params: JsonObject) => Promise<unknown>)(payload);
 	}
 }

package/src/sdk/broker/broker.ts

@@ -12,6 +12,7 @@ import {
 import {
 	BROKER_HEARTBEAT_TTL_MS,
 	type BrokerDiscovery,
+	type BrokerPublicationObservation,
 	brokerDiscoveryPath,
 	brokerProcessIncarnation,
 	heartbeatBrokerDiscoveryRetained,
@@ -396,6 +397,14 @@ type BrokerLockSnapshot = {
 
 const BROKER_PUBLICATION_CADENCE_MS = 5_000;
 const BROKER_PUBLICATION_GRACE_MS = 15_000;
+// A broker that cannot observe its own publication is not provably the root, but
+// ambiguity is also not proof of replacement, so it must not be treated as a
+// `lost-root` immediately. It must still be bounded: an indefinitely ambiguous
+// broker stops heartbeating, so peers discover it as stale and spawn replacements
+// while it keeps its port and memory forever. Ambiguity therefore accrues against
+// its own deadline, generous enough to absorb transient filesystem faults and far
+// longer than the loss grace.
+const BROKER_AMBIGUITY_GRACE_MS = 120_000;
 const BROKER_SETTLEMENT_MS = 2_000;
 type BrokerPublicationState =
 	| "healthy-owned"
@@ -406,6 +415,8 @@ type BrokerPublicationState =
 type BrokerStopMode = "owned-root" | "lost-root";
 
 const terminalPersistenceHooksForTest = new WeakMap<Broker, () => void>();
+const ambiguityGraceOverridesForTest = new WeakMap<Broker, number>();
+const publicationObservationOverridesForTest = new WeakMap<Broker, BrokerPublicationObservation>();
 
 export class Broker {
 	readonly settings: ResolvedBrokerSettings;
@@ -419,6 +430,7 @@ export class Broker {
 	#publication: RetainedBrokerDiscovery | null = null;
 	#publicationState: BrokerPublicationState = "healthy-owned";
 	#lossAt: bigint | null = null;
+	#ambiguousAt: bigint | null = null;
 	#stopping = false;
 	#transport: BrokerTransport | null = null;
 	#heartbeatTimer: NodeJS.Timeout | null = null;
@@ -565,6 +577,7 @@ export class Broker {
 		this.#stopping = false;
 		this.#publicationState = "healthy-owned";
 		this.#lossAt = null;
+		this.#ambiguousAt = null;
 		await Promise.all([this.ledger.assertSupportedStateVersions(), readBrokerDiscovery(this.settings.agentDir)]);
 		await fs.mkdir(path.dirname(this.#lock), { recursive: true, mode: 0o700 });
 		for (;;) {
@@ -648,16 +661,35 @@ export class Broker {
 	#fence(kind: "suspect-unpublished" | "observation-ambiguous" | "heartbeat-ambiguous"): void {
 		if (this.#publicationState === "stopping") return;
 		this.#publicationState = kind;
-		if (kind === "suspect-unpublished") this.#lossAt ??= process.hrtime.bigint();
-		else this.#lossAt = null;
+		if (kind === "suspect-unpublished") {
+			this.#lossAt ??= process.hrtime.bigint();
+			this.#ambiguousAt = null;
+		} else {
+			this.#lossAt = null;
+			this.#ambiguousAt ??= process.hrtime.bigint();
+		}
+	}
+	/**
+	 * Whether this broker has been unable to confirm it is the published root for
+	 * longer than the deadline for its current fence. Replacement is proven quickly
+	 * and ambiguity slowly, but neither may persist indefinitely: a permanently
+	 * fenced broker never heartbeats, so it is unreachable through discovery while
+	 * still holding its port and memory.
+	 */
+	#fencedBeyondDeadline(): boolean {
+		const now = process.hrtime.bigint();
+		if (this.#lossAt !== null && now - this.#lossAt >= BigInt(BROKER_PUBLICATION_GRACE_MS) * 1_000_000n) return true;
+		const ambiguityGraceMs = ambiguityGraceOverridesForTest.get(this) ?? BROKER_AMBIGUITY_GRACE_MS;
+		return this.#ambiguousAt !== null && now - this.#ambiguousAt >= BigInt(ambiguityGraceMs) * 1_000_000n;
 	}
 	async #watchPublication(writeHeartbeat = true): Promise<void> {
 		if (!this.#publication || this.#publicationState === "stopping") return;
 		let observation: ReturnType<RetainedBrokerDiscovery["observe"]>;
 		try {
-			observation = this.#publication.observe();
+			observation = publicationObservationOverridesForTest.get(this) ?? this.#publication.observe();
 		} catch {
 			this.#fence("observation-ambiguous");
+			if (this.#fencedBeyondDeadline()) void this.#complete("lost-root");
 			return;
 		}
 		if (observation === "owned") {
@@ -667,15 +699,12 @@ export class Broker {
 			}
 			this.#publicationState = "healthy-owned";
 			this.#lossAt = null;
+			this.#ambiguousAt = null;
 			if (writeHeartbeat) await this.#writeHeartbeat();
 			return;
 		}
 		this.#fence(observation === "ambiguous" ? "observation-ambiguous" : "suspect-unpublished");
-		if (
-			this.#lossAt !== null &&
-			process.hrtime.bigint() - this.#lossAt >= BigInt(BROKER_PUBLICATION_GRACE_MS) * 1_000_000n
-		)
-			void this.#complete("lost-root");
+		if (this.#fencedBeyondDeadline()) void this.#complete("lost-root");
 	}
 	async #writeHeartbeat(): Promise<void> {
 		if (!this.discovery || !this.#publication || this.#publicationState === "stopping") return;
@@ -691,6 +720,7 @@ export class Broker {
 		}
 		this.#publicationState = "healthy-owned";
 		this.#lossAt = null;
+		this.#ambiguousAt = null;
 		this.discovery = { ...this.discovery, heartbeatAt };
 	}
 	async heartbeat(): Promise<void> {
@@ -938,9 +968,8 @@ export class Broker {
 			});
 			if (isCleanupPending(response)) return response;
 			const persisted = await this.ledger.readTerminal(identity, requestHash);
-			const expectedResponseDigest = createHash("sha256").update(canonicalJson(response)).digest("hex");
 			const persistenceVerified =
-				persisted?.responseDigest === expectedResponseDigest &&
+				persisted !== undefined &&
 				canonicalJson(persisted.response) === canonicalJson(response) &&
 				canonicalJson(persisted.durableEffects) === canonicalJson(outcome.durableEffects) &&
 				canonicalJson(persisted.startupFailure) === canonicalJson(outcome.startupFailure);
@@ -972,3 +1001,18 @@ export function setTerminalPersistenceHookForTest(broker: Broker, hook: (() => v
 	if (hook) terminalPersistenceHooksForTest.set(broker, hook);
 	else terminalPersistenceHooksForTest.delete(broker);
 }
+
+/** Test-only hook for shortening the bounded ambiguity deadline. */
+export function setAmbiguityGraceForTest(broker: Broker, graceMs: number | undefined): void {
+	if (graceMs === undefined) ambiguityGraceOverridesForTest.delete(broker);
+	else ambiguityGraceOverridesForTest.set(broker, graceMs);
+}
+
+/** Test-only hook for forcing the observation the publication watchdog sees. */
+export function setPublicationObservationForTest(
+	broker: Broker,
+	observation: BrokerPublicationObservation | undefined,
+): void {
+	if (observation === undefined) publicationObservationOverridesForTest.delete(broker);
+	else publicationObservationOverridesForTest.set(broker, observation);
+}

package/src/sdk/broker/lifecycle-ledger.ts

@@ -666,7 +666,13 @@ export class LifecycleLedger {
 		return this.#mutate(async () => {
 			const previous = this.#byIdentity.get(identity);
 			if (!previous) throw new Error("Unknown lifecycle identity");
-			const next = { ...previous, ...fields, state, ts: Date.now() };
+			const next = {
+				...previous,
+				...fields,
+				state,
+				ts: Date.now(),
+				...(fields.response !== undefined ? { response: fields.response } : {}),
+			};
 			if (this.#isCleanupPending(next)) {
 				next.unresolvedCleanupResponse = undefined;
 				next.unresolvedCleanupResponseDigest = undefined;
@@ -796,4 +802,31 @@ export class LifecycleLedger {
 	get(identity: string): LifecycleLedgerEntry | undefined {
 		return this.#byIdentity.get(identity);
 	}
+
+	findPendingCleanupByTarget(
+		sessionId: string,
+		cwd: string,
+		transcriptPath: string,
+	): LifecycleLedgerEntry | undefined {
+		const expectedCwd = path.resolve(cwd);
+		const expectedTranscript = path.resolve(transcriptPath);
+		let latest: LifecycleLedgerEntry | undefined;
+		for (const entry of this.#byIdentity.values()) {
+			if (entry.state !== "effect_started" || !this.#isCleanupPending(entry)) continue;
+			const response = entry.response as {
+				error?: { cleanup?: { sessionId?: unknown; cwd?: unknown; transcriptPath?: unknown } };
+			};
+			const cleanup = response.error?.cleanup;
+			if (
+				cleanup?.sessionId !== sessionId ||
+				typeof cleanup.cwd !== "string" ||
+				typeof cleanup.transcriptPath !== "string" ||
+				path.resolve(cleanup.cwd) !== expectedCwd ||
+				path.resolve(cleanup.transcriptPath) !== expectedTranscript
+			)
+				continue;
+			if (!latest || entry.ts > latest.ts) latest = entry;
+		}
+		return latest;
+	}
 }

package/src/sdk/broker/lifecycle.ts

@@ -865,7 +865,7 @@ export async function writeSessionLifecycleReady(root: string, id: string, effec
 	const incarnation = processIncarnation(process.pid);
 	if (!incarnation) throw new Error("Lifecycle child has no readable OS incarnation.");
 	await fs.mkdir(path.join(root, "sdk"), { recursive: true, mode: 0o700 });
-	await fs.writeFile(lifecycleReadyPath(root, id), JSON.stringify({ pid: process.pid, effectMarker, incarnation }), {
+	await fs.writeFile(lifecycleReadyPath(root, id), canonicalJson({ pid: process.pid, effectMarker, incarnation }), {
 		mode: 0o600,
 	});
 }
@@ -1365,15 +1365,6 @@ function lifecycleMetadataReplayFiles(cleanup: CleanupEvidence): LifecycleCleanu
 	return cleanup.lifecycleFiles?.length ? cleanup.lifecycleFiles : undefined;
 }
 
-function absentLifecyclePath(file: string): boolean {
-	try {
-		fsSync.lstatSync(file);
-		return false;
-	} catch (error) {
-		return (error as NodeJS.ErrnoException).code === "ENOENT";
-	}
-}
-
 function isLifecycleCleanupResponse(value: LifecycleFileCapture | BrokerResponse | undefined): value is BrokerResponse {
 	return typeof value === "object" && value !== null && "ok" in value;
 }
@@ -1423,6 +1414,19 @@ function validateLifecycleMetadataReplay(cleanup: CleanupEvidence): BrokerRespon
 			try {
 				current = captureLifecycleFile(candidate, true, true);
 			} catch {
+				if (
+					file.completed &&
+					[file.detachedPath, file.plannedPath].some(
+						bound => bound && path.resolve(candidate) === path.resolve(bound),
+					)
+				) {
+					try {
+						const stat = fsSync.lstatSync(candidate);
+						if (stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1 && stat.size === 0) continue;
+					} catch (error) {
+						if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
+					}
+				}
 				return fail("terminal_uncertain", "Lifecycle metadata candidate could not be safely inspected.");
 			}
 			if (!current) continue;
@@ -1457,7 +1461,7 @@ function validateLifecycleMetadataReplay(cleanup: CleanupEvidence): BrokerRespon
 	if (!markerEntry)
 		return fail("terminal_uncertain", "Lifecycle readiness metadata lacks canonical marker authority.");
 	if (!marker) {
-		if (createHash("sha256").update(canonicalJson(readyMarker)).digest("hex") !== markerEntry.identity.sha256)
+		if (createHash("sha256").update(ready.bytes).digest("hex") !== markerEntry.identity.sha256)
 			return fail(
 				"terminal_uncertain",
 				"Lifecycle readiness metadata is not bound to the completed marker authority.",
@@ -1473,30 +1477,6 @@ function validateLifecycleMetadataReplay(cleanup: CleanupEvidence): BrokerRespon
 	return undefined;
 }
 
-function lifecycleMetadataReplayAbsent(cleanup: CleanupEvidence): boolean {
-	const files = lifecycleMetadataReplayFiles(cleanup);
-	if (!files) return true;
-	const root = path.resolve(cleanup.metadataRoot!);
-	const id = cleanup.sessionId!;
-	const required = new Set<string>([lifecycleMarkerPath(root, id), lifecycleReadyPath(root, id)]);
-	for (const file of files) for (const candidate of lifecycleCleanupCandidates(file)) required.add(candidate);
-	for (const candidate of required) {
-		if (absentLifecyclePath(candidate)) continue;
-		// A completed file's recorded retained quarantine is durable evidence, not a
-		// survivor — accept it only at its receipt-bound path and identity.
-		const owner = files.find(
-			file =>
-				file.completed === true &&
-				file.detachedPath !== undefined &&
-				path.resolve(file.detachedPath) === path.resolve(candidate),
-		);
-		if (!owner) return false;
-		const current = captureLifecycleFile(candidate, true, true);
-		if (!current || !sameLifecycleCleanupIdentity(current.identity, owner.identity)) return false;
-	}
-	return true;
-}
-
 /**
  * Base dev persisted metadata cleanup one file at a time. Accept only its
  * identity-bound marker receipt and translate it into the current replay plan.
@@ -1612,7 +1592,7 @@ function legacyMetadataCleanupPlan(cleanup: CleanupEvidence): CleanupEvidence |
 			return undefined;
 		}
 		if (marker && !sameEffectMarker(marker, readyMarker)) return undefined;
-		if (!marker && createHash("sha256").update(canonicalJson(readyMarker)).digest("hex") !== persistedIdentity.sha256)
+		if (!marker && createHash("sha256").update(ready.capture.bytes).digest("hex") !== persistedIdentity.sha256)
 			return undefined;
 	}
 
@@ -1785,11 +1765,11 @@ async function reconcileLifecycleCleanup(
 					file.detachedPath &&
 					path.resolve(candidate) === path.resolve(file.detachedPath) &&
 					stat.isFile() &&
-					!stat.isSymbolicLink()
-				) {
-					const current = captureLifecycleFile(candidate, true, true);
-					if (current && sameLifecycleCleanupIdentity(current.identity, file.identity)) continue;
-				}
+					!stat.isSymbolicLink() &&
+					stat.nlink === 1 &&
+					stat.size === 0
+				)
+					continue;
 				return fail(
 					"terminal_uncertain",
 					"Lifecycle cleanup receipt marks a target complete while an authorized candidate remains.",
@@ -1892,7 +1872,7 @@ async function reconcileLifecycleCleanup(
 			});
 		}
 		const lifecycleFiles = activeCleanup.lifecycleFiles!.map((candidate, candidateIndex) =>
-			candidateIndex === index ? { ...candidate, completed: true as const } : candidate,
+			candidateIndex === index ? { ...candidate, detachedPath: undefined, completed: true as const } : candidate,
 		);
 		activeCleanup = { ...activeCleanup, lifecycleFiles };
 		await broker.ledger.transition(identity, "effect_started", {
@@ -1900,8 +1880,6 @@ async function reconcileLifecycleCleanup(
 		});
 		lifecycleCleanupHooksForTest.get(broker)?.();
 	}
-	if (!lifecycleMetadataReplayAbsent(activeCleanup))
-		return fail("terminal_uncertain", "Lifecycle metadata replay left an authorized sibling behind.");
 	await syncDirectory(path.join(activeCleanup.metadataRoot!, "sdk"));
 	return completion;
 }
@@ -3463,6 +3441,21 @@ async function executeLifecycleResponse(
 				return (error as NodeJS.ErrnoException).code === "ENOENT";
 			}
 		};
+		try {
+			const currentTranscript = fsSync.lstatSync(cleanupTarget.transcriptPath, { bigint: true });
+			if (
+				currentTranscript.isFile() &&
+				!currentTranscript.isSymbolicLink() &&
+				currentTranscript.dev === cleanupTarget.transcriptIdentity.dev &&
+				currentTranscript.ino === cleanupTarget.transcriptIdentity.ino
+			)
+				cleanupTarget.transcriptIdentity = {
+					...cleanupTarget.transcriptIdentity,
+					nlink: currentTranscript.nlink,
+				};
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		}
 		const transcriptParentIdentity = cleanup?.transcriptParentIdentity ?? validated.transcriptParentIdentity;
 		const durableArtifactsPlan =
 			cleanup?.artifactTree?.plannedPath ?? cleanup?.plannedArtifactsPath ?? cleanupTarget.plannedArtifactsPath;
@@ -3687,11 +3680,17 @@ async function executeLifecycleResponse(
 		const retainedTranscriptReplayHasNoSideAuthority = retainedTranscriptSidePaths.every(
 			candidate => candidate === undefined,
 		);
-		const retainedTranscriptSideAuthorityIsProvenAbsent =
-			retainedTranscriptSidePaths.every(pathIsAbsent) &&
-			(cleanupTarget.detachedTranscriptPath ? true : retainedTranscriptIdentityIsAbsentFromParent());
 		if (cleanup && !retainedTranscriptReplayHasNoSideAuthority) {
-			if (!retainedTranscriptSideAuthorityIsProvenAbsent) return await publishRetainedTranscriptSideAuthority();
+			const successorOrUnknownRemains = [
+				cleanupTarget.retainedTranscriptSuccessorPath,
+				cleanupTarget.retainedTranscriptUnknownPath,
+			].some(candidate => candidate !== undefined && !pathIsAbsent(candidate));
+			if (
+				successorOrUnknownRemains ||
+				!pathIsAbsent(cleanupTarget.retainedTranscriptPlaceholderPath) ||
+				(!cleanupTarget.detachedTranscriptPath && !retainedTranscriptIdentityIsAbsentFromParent())
+			)
+				return await publishRetainedTranscriptSideAuthority();
 			cleanupTarget.retainedTranscriptSuccessorPath = undefined;
 			cleanupTarget.retainedTranscriptPlaceholderPath = undefined;
 			cleanupTarget.retainedTranscriptUnknownPath = undefined;
@@ -3861,8 +3860,6 @@ async function executeLifecycleResponse(
 				preauthorizedCleanup,
 				"Saved session cleanup is pending in artifacts: a planned quarantine alias remains before terminal completion.",
 			);
-		if (deleted.kind === "deleted" && !retainedTranscriptIdentityIsAbsentFromParent())
-			return await publishRetainedTranscriptSideAuthority();
 		const retainedRootArtifactsPlan = durableArtifactsPlan;
 		if (deleted.kind === "cleanup_pending")
 			return fail(