@gajae-code/coding-agent 0.13.0 → 0.13.1

package/src/session/agent-session.ts

@@ -107,9 +107,10 @@ import {
 	classifyContextOverflow,
 	getSupportedEfforts,
 	isContextOverflow,
+	isFastModeEffectiveForProvider,
 	isUsageLimitError,
+	modelSupportsServiceTier,
 	modelsAreEqual,
-	resolveServiceTier,
 	streamSimple,
 } from "@gajae-code/ai/core";
 import {
@@ -752,6 +753,13 @@ type AutoCompactionTerminalStatus =
 	| { kind: "skipped"; continuationScheduled?: boolean }
 	| { kind: "failed" };
 
+type ToolOutputPruneResult = {
+	prunedCount: number;
+	tokensSaved: number;
+	committed: boolean;
+	failure?: "artifact_persistence";
+};
+
 /**
  * R3.2 pre-submit seam: `build` assembles the attempt messages (Phase A once,
  * Phase B per attempt) and may throw the typed overflow error; `reset` drops the
@@ -3233,7 +3241,7 @@ export class AgentSession {
 	}
 
 	/** Restore a temporary scope, unwinding any auto-owned scopes above it. */
-	restoreTemporaryProviderSessionScope(token: TemporaryProviderSessionScope): boolean {
+	async restoreTemporaryProviderSessionScope(token: TemporaryProviderSessionScope): Promise<boolean> {
 		const scopeIndex = this.#temporaryProviderSessionScopes.findLastIndex(scope => scope.token === token);
 		if (
 			scopeIndex < 0 ||
@@ -3242,12 +3250,12 @@ export class AgentSession {
 			return false;
 		}
 		while (this.#temporaryProviderSessionScopes.length > scopeIndex) {
-			this.#restoreTopTemporaryProviderSessionScope();
+			await this.#restoreTopTemporaryProviderSessionScope();
 		}
 		return true;
 	}
 
-	#restoreTopTemporaryProviderSessionScope(): void {
+	async #restoreTopTemporaryProviderSessionScope(): Promise<void> {
 		const scope = this.#temporaryProviderSessionScopes.pop();
 		if (!scope) return;
 		this.#closeProviderSessionMap(this.#providerSessionState, "temporary scope restore");
@@ -3266,7 +3274,7 @@ export class AgentSession {
 		this.#pendingThinkingVisibilityControlFailure = undefined;
 		this.#thinkingLevel = scope.thinkingLevel;
 		this.agent.setThinkingLevel(toReasoningEffort(scope.thinkingLevel));
-		void this.#syncEditToolModeAfterModelChange(previousEditMode);
+		await this.#syncEditToolModeAfterModelChange(previousEditMode);
 	}
 
 	/** Promote a temporary scope. The suspended provider state is permanently closed. */
@@ -6787,17 +6795,9 @@ export class AgentSession {
 		return resolveEditMode(this.#getEditModeSession());
 	}
 
-	#resolveEditModeForModel(model: Model): EditMode {
-		return resolveEditMode({
-			settings: this.settings,
-			getActiveModelString: () => formatModelString(model),
-		});
-	}
-
 	async #prepareDefaultModelSelectionPrompt(model: Model): Promise<string[] | undefined> {
 		if (!this.#rebuildSystemPrompt) return undefined;
 		if (!this.getActiveToolNames().includes("edit")) return undefined;
-		if (this.#resolveActiveEditMode() === this.#resolveEditModeForModel(model)) return undefined;
 		const built = await this.#rebuildSystemPrompt(this.getActiveToolNames(), this.#toolRegistry, model);
 		return built.systemPrompt;
 	}
@@ -6836,11 +6836,8 @@ export class AgentSession {
 		this.#lastAppliedToolSignature = this.#computeAppliedToolSignature(activeToolNames, activeTools);
 	}
 
-	async #syncEditToolModeAfterModelChange(previousEditMode: EditMode): Promise<void> {
-		const currentEditMode = this.#resolveActiveEditMode();
-		if (previousEditMode !== currentEditMode && this.getActiveToolNames().includes("edit")) {
-			await this.refreshBaseSystemPrompt();
-		}
+	async #syncEditToolModeAfterModelChange(_previousEditMode: EditMode): Promise<void> {
+		if (this.getActiveToolNames().includes("edit")) await this.refreshBaseSystemPrompt();
 	}
 
 	getSelectedMCPToolNames(): string[] {
@@ -10912,8 +10909,31 @@ export class AgentSession {
 					await this.#settleOwnAsyncJobsBeforeArtifactRetirement();
 				} catch (error) {
 					const forkedFile = forkedManager.getSessionFile();
-					await forkedManager.close();
-					if (forkedFile) await previousManager.discardUncommittedSession(forkedFile);
+					const cleanupErrors: unknown[] = [];
+					try {
+						await forkedManager.close();
+					} catch (closeError) {
+						cleanupErrors.push(closeError);
+						logger.warn("Bounded fork successor close failed after initialization failure", {
+							error: closeError instanceof Error ? closeError.message : String(closeError),
+						});
+					}
+					if (forkedFile) {
+						try {
+							await previousManager.discardUncommittedSession(forkedFile);
+						} catch (cleanupError) {
+							cleanupErrors.push(cleanupError);
+							logger.warn("Bounded fork successor cleanup failed after initialization failure", {
+								error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError),
+							});
+						}
+					}
+					if (cleanupErrors.length > 0) {
+						throw new AggregateError(
+							[error, ...cleanupErrors],
+							"Bounded fork initialization and successor cleanup both failed.",
+						);
+					}
 					throw error;
 				}
 				this.sessionManager = forkedManager;
@@ -11450,7 +11470,7 @@ export class AgentSession {
 			currentAutoScope !== undefined &&
 			this.#temporaryProviderSessionScopes.at(-1) === currentAutoScope;
 		if (replaceAutoScope && currentAutoScope) {
-			this.#restoreTopTemporaryProviderSessionScope();
+			await this.#restoreTopTemporaryProviderSessionScope();
 		}
 		const scope = isTemporaryOperation
 			? (suppliedScope ??
@@ -11481,7 +11501,7 @@ export class AgentSession {
 			if (options?.persistAsSessionDefault === true) this.#clearActiveModelProfileForConcreteDefault(options?.cause);
 			await this.#syncEditToolModeAfterModelChange(previousEditMode);
 		} catch (error) {
-			if (ownsScope) this.restoreTemporaryProviderSessionScope(scope);
+			if (ownsScope) await this.restoreTemporaryProviderSessionScope(scope);
 			throw error;
 		}
 		return scope;
@@ -12196,17 +12216,12 @@ export class AgentSession {
 	}
 
 	/**
-	 * True when the configured `serviceTier` resolves to `"priority"` for the
-	 * given model `provider`. Returns false for scoped tiers that don't match
-	 * (e.g. `"openai-only"` on an anthropic provider) and when `provider` is
-	 * undefined. This is the canonical provider-aware fast-mode predicate.
+	 * True when the configured tier is realized as a fast-mode field on the
+	 * provider's wire protocol. Providers that silently drop unscoped priority
+	 * intent return false so UI indicators match the request that is sent.
 	 */
-	isFastForProvider(provider?: string): boolean {
-		// Fast mode applies to a concrete model's provider. With no provider
-		// (no model selected) it cannot apply, even under an unscoped `priority`
-		// tier that `resolveServiceTier` would otherwise pass through.
-		if (provider === undefined) return false;
-		return resolveServiceTier(this.serviceTier, provider) === "priority";
+	isFastForProvider(provider?: string, supportsServiceTier = false): boolean {
+		return isFastModeEffectiveForProvider(this.serviceTier, provider, supportsServiceTier);
 	}
 
 	/**
@@ -12223,14 +12238,11 @@ export class AgentSession {
 	}
 
 	/**
-	 * Provider-aware fast-mode predicate for task-tool subagent roles, evaluated
-	 * against the effective subagent tier (`task.serviceTier`) rather than the
-	 * main session tier. Use this for `task.agentModelOverrides` role rows so the
-	 * ⚡ glyph reflects the tier the subagent actually runs under.
+	 * Wire-effective fast-mode predicate for task-tool subagent roles, evaluated
+	 * against `task.serviceTier` rather than the main session tier.
 	 */
-	isFastForSubagentProvider(provider?: string): boolean {
-		if (provider === undefined) return false;
-		return resolveServiceTier(this.#subagentServiceTier(), provider) === "priority";
+	isFastForSubagentProvider(provider?: string, supportsServiceTier = false): boolean {
+		return isFastModeEffectiveForProvider(this.#subagentServiceTier(), provider, supportsServiceTier);
 	}
 
 	/**
@@ -12286,7 +12298,10 @@ export class AgentSession {
 	 */
 	isFastModeActive(): boolean {
 		const provider = this.model?.provider;
-		return this.isFastForProvider(provider) && !this.#isFastModeAutoDisabledForProvider(provider);
+		const supportsServiceTier = modelSupportsServiceTier(this.model);
+		return (
+			this.isFastForProvider(provider, supportsServiceTier) && !this.#isFastModeAutoDisabledForProvider(provider)
+		);
 	}
 
 	setServiceTier(serviceTier: ServiceTier | undefined): void {
@@ -12381,19 +12396,34 @@ export class AgentSession {
 		signal?: AbortSignal,
 		overThreshold = false,
 		options?: { commitGate?: (actual: { prunedCount: number; tokensSaved: number }) => boolean },
-	): Promise<{ prunedCount: number; tokensSaved: number; committed: boolean } | undefined> {
+	): Promise<ToolOutputPruneResult | undefined> {
 		const branchEntries = this.sessionManager.getBranch();
+		const artifactManager = await this.sessionManager.ensureArtifactManager();
+		// Over-threshold callers have already proven tool-output savings before entering
+		// this path. If exact persistence is unavailable, fail closed before hashing and
+		// planning large outputs so maintenance cannot drift into timeout-driven abort.
+		if (overThreshold && !artifactManager)
+			return { prunedCount: 0, tokensSaved: 0, committed: false, failure: "artifact_persistence" };
 		const plan = planToolOutputPrune(branchEntries, {
 			...DEFAULT_PRUNE_CONFIG,
 			minimumSavings: overThreshold ? 0 : DEFAULT_PRUNE_CONFIG.minimumSavings,
 		});
-		const artifactManager = await this.sessionManager.ensureArtifactManager();
 		const published = new Map<string, ToolOutputPruneEvictionHandle>();
 		// Fail closed when tool-output eviction is planned but no artifact store can be
 		// established: do not report a successful prune that skipped durable eviction.
 		if (!artifactManager && plan.digests.length > 0) {
-			return undefined;
+			return { prunedCount: 0, tokensSaved: 0, committed: false, failure: "artifact_persistence" };
 		}
+		const removePublishedArtifacts = async (): Promise<void> => {
+			for (const handle of published.values()) {
+				const removed = await artifactManager?.removeNamedBestEffort(`${handle.artifactId}.evicted.log`);
+				if (removed === false) {
+					logger.warn("Failed to remove unpublished tool-output eviction artifact", {
+						artifactId: handle.artifactId,
+					});
+				}
+			}
+		};
 
 		// Publish exact text one candidate at a time. The plan carries only digests and
 		// replacement proposals; original output bytes exist only in this iteration.
@@ -12416,22 +12446,19 @@ export class AgentSession {
 						outcome: outcome.outcome,
 						diagnostic: "diagnostic" in outcome ? outcome.diagnostic : undefined,
 					});
-					if (outcome.outcome === "failed") break;
+					if (outcome.outcome === "failed") {
+						await removePublishedArtifacts();
+						return {
+							prunedCount: published.size,
+							tokensSaved: 0,
+							committed: false,
+							failure: "artifact_persistence",
+						};
+					}
 				}
 			}
 		}
 
-		const removePublishedArtifacts = async (): Promise<void> => {
-			for (const handle of published.values()) {
-				const removed = await artifactManager?.removeNamedBestEffort(`${handle.artifactId}.evicted.log`);
-				if (removed === false) {
-					logger.warn("Failed to remove unpublished tool-output eviction artifact", {
-						artifactId: handle.artifactId,
-					});
-				}
-			}
-		};
-
 		// Evaluate non-tool pruning on a disposable copy so the gate runs before any
 		// live entry is mutated. This avoids retaining originals for rollback.
 		const estimateEntries = structuredClone(branchEntries) as typeof branchEntries;
@@ -13513,7 +13540,7 @@ export class AgentSession {
 				relaxedMinimum: 0,
 				artifactRefMaxChars: PRUNED_ARTIFACT_REF_MAX_CHARS,
 			});
-			let pruneResult: { prunedCount: number; tokensSaved: number; committed: boolean } | undefined;
+			let pruneResult: ToolOutputPruneResult | undefined;
 			if (
 				pruneEstimate.tokensSaved > 0 &&
 				!shouldCompact(
@@ -13525,6 +13552,7 @@ export class AgentSession {
 			) {
 				pruneResult = await this.#pruneToolOutputs(maintenanceSignal, true);
 				if (isAborted()) return result("aborted");
+				if (pruneResult?.failure === "artifact_persistence") return result("failed");
 				if (pruneResult) contextTokens = Math.max(0, contextTokens - pruneResult.tokensSaved);
 			}
 			if (!shouldCompact(contextTokens, contextWindow, compactionSettings, autoCompactionOutputReserveTokens)) {
@@ -14132,7 +14160,7 @@ export class AgentSession {
 				signal,
 			});
 			if (signal?.aborted) {
-				if (scope) this.restoreTemporaryProviderSessionScope(scope);
+				if (scope) await this.restoreTemporaryProviderSessionScope(scope);
 				return false;
 			}
 			logger.debug("Context promotion switched model on overflow", {
@@ -15641,8 +15669,10 @@ export class AgentSession {
 			controller.seedResolution(activeIndex, [...controller.skips, ...resolution.skips]);
 		}
 		if (!resolution.model) throw new Error(this.#fallbackExhaustionError(controller));
+		const previousEditMode = this.#resolveActiveEditMode();
 		this.#setModelAuthoritatively(resolution.model, "restore");
 		this.setThinkingLevel(resolution.explicitThinkingLevel ? resolution.thinkingLevel : this.thinkingLevel);
+		await this.#syncEditToolModeAfterModelChange(previousEditMode);
 	}
 
 	/**
@@ -15839,8 +15869,10 @@ export class AgentSession {
 			const from =
 				controller.tried.at(-1)?.selector ?? controller.chain.entries[controller.activeIndex - 1] ?? selector;
 			const to = selector;
+			const previousEditMode = this.#resolveActiveEditMode();
 			this.#setModelAuthoritatively(resolved.model, "fallback-switch");
 			this.setThinkingLevel(resolved.explicitThinkingLevel ? resolved.thinkingLevel : this.thinkingLevel);
+			await this.#syncEditToolModeAfterModelChange(previousEditMode);
 			if (from !== to) {
 				this.#emit({
 					type: "model_fallback_switched",
@@ -16158,18 +16190,27 @@ export class AgentSession {
 			this.#retryAbortController?.abort();
 			this.#retryAbortController = retryAbortController;
 			this.#retryNowRequested = false;
-			await this.#emitSessionEvent({
-				type: "auto_retry_start",
-				attempt: this.#retryAttempt,
-				maxAttempts: managedFallback
-					? controller.maxAttempts
-					: firstEventTimeout
-						? retrySettings.maxRetries + 1
-						: retrySettings.maxRetries,
-				delayMs,
-				errorMessage,
-				unbounded: managedFallback ? false : legacyUnbounded,
-			});
+			try {
+				await this.#emitSessionEvent({
+					type: "auto_retry_start",
+					attempt: this.#retryAttempt,
+					maxAttempts: managedFallback
+						? controller.maxAttempts
+						: firstEventTimeout
+							? retrySettings.maxRetries + 1
+							: retrySettings.maxRetries,
+					delayMs,
+					errorMessage,
+					unbounded: managedFallback ? false : legacyUnbounded,
+				});
+			} catch (error) {
+				if (this.#retryAbortController === retryAbortController) this.#retryAbortController = undefined;
+				retryAbortController.abort();
+				this.#failRetryRecovery(
+					`Retry start delivery failed: ${error instanceof Error ? error.message : String(error)}`,
+				);
+				throw error;
+			}
 
 			const messages = this.agent.state.messages;
 			if (messages.length > 0 && messages[messages.length - 1].role === "assistant") {
@@ -17658,6 +17699,7 @@ export class AgentSession {
 					: didReloadConversationChange
 						? "conversation-reload"
 						: undefined;
+				const previousEditMode = this.#resolveActiveEditMode();
 				await this.#restoreMCPSelectionsForSessionContext(sessionContext);
 
 				// The target session is loaded and MCP selections are restored: discard
@@ -17731,6 +17773,7 @@ export class AgentSession {
 					if (!this.model || !modelsAreEqual(this.model, resolution.model)) {
 						this.#setModelAuthoritatively(resolution.model, "restore");
 					}
+					await this.#syncEditToolModeAfterModelChange(previousEditMode);
 					if (resolution.explicitThinkingLevel && resolution.thinkingLevel !== undefined) {
 						this.setThinkingLevel(resolution.thinkingLevel);
 					}

package/src/session/blob-store.ts

@@ -2,6 +2,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
+import { exactUnlink } from "@gajae-code/natives";
 import { isEnoent, logger, postmortem } from "@gajae-code/utils";
 
 const BLOB_PREFIX = "blob:sha256:";
@@ -387,9 +388,35 @@ function removeResidentCacheTreeNoFollow(pathname: string): void {
 	fs.unlinkSync(pathname);
 }
 
-export function disposeVerifiedResidentCacheInstanceDir(instanceDir: string): void {
+function assertResidentCacheDisposalParent(instanceDir: string, parentDescriptor: number): void {
+	const parentDir = path.dirname(instanceDir);
+	try {
+		assertResidentCacheDirectoryPathMatchesDescriptor(parentDir, parentDescriptor, residentCacheOwnerUid(parentDir));
+	} catch (error) {
+		throw residentCacheTrustError("parent_authority_changed", instanceDir, error);
+	}
+}
+
+export function disposeVerifiedResidentCacheInstanceDir(instanceDir: string, parentDescriptor?: number): void {
 	const instanceKey = path.resolve(instanceDir);
 	const uid = residentCacheOwnerUid(instanceDir);
+	let parentVerified = false;
+	if (parentDescriptor !== undefined) {
+		assertResidentCacheDisposalParent(instanceDir, parentDescriptor);
+		parentVerified = true;
+	}
+	// ENOENT is authoritative only while the retained parent still names the
+	// directory or after this process has already retired its ownership record.
+	try {
+		fs.lstatSync(instanceDir);
+	} catch (error) {
+		if (errorCode(error) !== "ENOENT") throw residentCacheTrustError("directory_unverifiable", instanceDir, error);
+		if (parentDescriptor !== undefined) assertResidentCacheDisposalParent(instanceDir, parentDescriptor);
+		if (!parentVerified && ownedResidentCacheInstanceDirs.has(instanceKey))
+			throw residentCacheTrustError("directory_absence_unverified", instanceDir, error);
+		ownedResidentCacheInstanceDirs.delete(instanceKey);
+		return;
+	}
 	const quarantineDir = path.join(
 		path.dirname(instanceDir),
 		`${path.basename(instanceDir)}.dispose.${crypto.randomUUID()}`,
@@ -408,7 +435,9 @@ export function disposeVerifiedResidentCacheInstanceDir(instanceDir: string): vo
 		descriptor = openVerifiedResidentCacheDirectory(instanceDir, uid);
 		assertResidentCacheDirectoryPathMatchesDescriptor(instanceDir, descriptor, uid);
 		const expected = fs.fstatSync(descriptor);
+		if (parentDescriptor !== undefined) assertResidentCacheDisposalParent(instanceDir, parentDescriptor);
 		fs.renameSync(instanceDir, quarantineDir);
+		if (parentDescriptor !== undefined) assertResidentCacheDisposalParent(instanceDir, parentDescriptor);
 		const moved = fs.lstatSync(quarantineDir);
 		if (
 			!moved.isDirectory() ||
@@ -1051,6 +1080,7 @@ export class BlobStore {
 
 interface EphemeralBlobStoreOptions {
 	readonly adoptVerifiedDir?: boolean;
+	readonly disposalParentDescriptor?: number;
 }
 
 /**
@@ -1097,10 +1127,12 @@ export class EphemeralBlobStore extends BlobStore {
 	#bufferCacheBytes = 0;
 	#adoptedVerifiedDir = false;
 	#disposed = false;
+	#disposalParentDescriptor: number | null = null;
 
 	constructor(dir: string, options: EphemeralBlobStoreOptions = {}) {
 		super(dir);
 		this.#adoptedVerifiedDir = options.adoptVerifiedDir === true;
+		this.#disposalParentDescriptor = options.disposalParentDescriptor ?? null;
 		if (this.#adoptedVerifiedDir) return;
 		fs.rmSync(dir, { recursive: true, force: true });
 		fs.mkdirSync(dir, { recursive: true, mode: BLOB_DIR_MODE });
@@ -1114,10 +1146,15 @@ export class EphemeralBlobStore extends BlobStore {
 	static adoptVerifiedDir(dir: string): EphemeralBlobStore {
 		const uid = residentCacheOwnerUid(dir);
 		let descriptor: number | null = null;
+		let parentDescriptor: number | null = null;
 		let failure: unknown;
 		try {
 			descriptor = openVerifiedResidentCacheDirectory(dir, uid);
 			assertResidentCacheDirectoryPathMatchesDescriptor(dir, descriptor, uid);
+			const parentDir = path.dirname(dir);
+			const parentUid = residentCacheOwnerUid(parentDir);
+			parentDescriptor = openVerifiedResidentCacheDirectory(parentDir, parentUid);
+			assertResidentCacheDirectoryPathMatchesDescriptor(parentDir, parentDescriptor, parentUid);
 		} catch (error) {
 			failure = error;
 		}
@@ -1129,10 +1166,18 @@ export class EphemeralBlobStore extends BlobStore {
 			}
 		}
 		if (failure !== undefined) {
+			if (parentDescriptor !== null) {
+				try {
+					fs.closeSync(parentDescriptor);
+				} catch {
+					// Preserve the adoption failure.
+				}
+			}
 			removeEmptyResidentCacheInstanceDir(dir);
 			throw residentCacheTrustError("instance_adoption_failed", dir, failure);
 		}
-		return new EphemeralBlobStore(dir, { adoptVerifiedDir: true });
+		if (parentDescriptor === null) throw new ResidentCacheTrustError("parent_authority_unavailable", dir);
+		return new EphemeralBlobStore(dir, { adoptVerifiedDir: true, disposalParentDescriptor: parentDescriptor });
 	}
 
 	#cachePut(hash: string, data: Buffer): void {
@@ -1258,7 +1303,15 @@ export class EphemeralBlobStore extends BlobStore {
 		this.#bufferCache.clear();
 		this.#bufferCacheBytes = 0;
 		if (this.#adoptedVerifiedDir) {
-			disposeVerifiedResidentCacheInstanceDir(this.dir);
+			disposeVerifiedResidentCacheInstanceDir(this.dir, this.#disposalParentDescriptor ?? undefined);
+			if (this.#disposalParentDescriptor !== null) {
+				try {
+					fs.closeSync(this.#disposalParentDescriptor);
+				} catch {
+					// Disposal is already complete; descriptor cleanup cannot restore the tree.
+				}
+				this.#disposalParentDescriptor = null;
+			}
 			this.#disposed = true;
 			return;
 		}
@@ -1566,8 +1619,10 @@ export interface CanonicalBlobEntry {
 	readonly path: string;
 	readonly bytes: number;
 	readonly mtimeMs: number;
-	readonly dev: number;
-	readonly ino: number;
+	readonly mtimeNs: bigint;
+	readonly dev: bigint;
+	readonly ino: bigint;
+	readonly nlink: bigint;
 }
 
 const CANONICAL_BLOB_NAME = /^[0-9a-f]{64}$/;
@@ -1599,20 +1654,22 @@ export async function listCanonicalBlobs(dir: string): Promise<CanonicalBlobEntr
 	for (const name of names) {
 		if (!CANONICAL_BLOB_NAME.test(name)) continue;
 		const blobPath = path.join(dir, name);
-		let stat: fs.Stats;
+		let stat: fs.BigIntStats;
 		try {
-			stat = await fsp.lstat(blobPath);
+			stat = await fsp.lstat(blobPath, { bigint: true });
 		} catch {
 			continue;
 		}
-		if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) continue;
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1n) continue;
 		entries.push({
 			hash: name,
 			path: blobPath,
-			bytes: stat.size,
-			mtimeMs: stat.mtimeMs,
+			bytes: Number(stat.size),
+			mtimeMs: Number(stat.mtimeMs),
+			mtimeNs: stat.mtimeNs,
 			dev: stat.dev,
 			ino: stat.ino,
+			nlink: stat.nlink,
 		});
 	}
 	return entries;
@@ -1635,32 +1692,45 @@ export async function removeCanonicalBlob(
 	entry: CanonicalBlobEntry,
 	options: { beforeUnlink?: () => Promise<boolean> } = {},
 ): Promise<{ removed: true } | { removed: false; reason: string; failed?: true }> {
-	let stat: fs.Stats;
+	let stat: fs.BigIntStats;
 	try {
-		stat = await fsp.lstat(entry.path);
+		stat = await fsp.lstat(entry.path, { bigint: true });
 	} catch (error) {
 		if (isEnoent(error)) return { removed: false, reason: "blob_disappeared" };
 		return { removed: false, reason: `blob_unverifiable: ${String(error)}`, failed: true };
 	}
-	if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+	if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1n) {
 		return { removed: false, reason: "blob_not_plain_file" };
 	}
 	if (
 		stat.dev !== entry.dev ||
 		stat.ino !== entry.ino ||
-		stat.size !== entry.bytes ||
-		stat.mtimeMs !== entry.mtimeMs
+		stat.size !== BigInt(entry.bytes) ||
+		stat.mtimeNs !== entry.mtimeNs
 	) {
 		return { removed: false, reason: "blob_changed" };
 	}
 	if (options.beforeUnlink && !(await options.beforeUnlink())) {
 		return { removed: false, reason: "blob_reference_evidence_changed" };
 	}
-	try {
-		await fsp.unlink(entry.path);
-		return { removed: true };
-	} catch (error) {
-		if (isEnoent(error)) return { removed: false, reason: "blob_disappeared" };
-		return { removed: false, reason: `blob_unlink_failed: ${String(error)}`, failed: true };
+	const removed = exactUnlink(entry.path, {
+		dev: entry.dev,
+		ino: entry.ino,
+		nlink: entry.nlink,
+		size: BigInt(entry.bytes),
+		mtimeNs: entry.mtimeNs,
+		sha256: entry.hash,
+		quarantineName: `.gjc-gc-blob-${entry.hash}`,
+	});
+	if (removed.ok) return { removed: true };
+	if (removed.code === "cleanup_pending" && removed.detachedPath) {
+		try {
+			await fsp.unlink(removed.detachedPath);
+			return { removed: true };
+		} catch (error) {
+			return { removed: false, reason: `blob_cleanup_failed: ${String(error)}`, failed: true };
+		}
 	}
+	if (removed.code === "not_found") return { removed: false, reason: "blob_disappeared" };
+	return { removed: false, reason: `blob_unlink_failed: ${removed.code ?? "unknown"}`, failed: true };
 }