@gajae-code/coding-agent 0.13.1 → 0.13.3

package/src/modes/theme/defaults/index.ts

@@ -3,6 +3,7 @@ import claude_code from "./claude-code.json" with { type: "json" };
 import codex from "./codex.json" with { type: "json" };
 import gruvbox_dark from "./gruvbox-dark.json" with { type: "json" };
 import opencode from "./opencode.json" with { type: "json" };
+import ouroboros from "./ouroboros.json" with { type: "json" };
 import red_claw from "./red-claw.json" with { type: "json" };
 
 export const defaultThemes = {
@@ -11,5 +12,6 @@ export const defaultThemes = {
 	codex,
 	"gruvbox-dark": gruvbox_dark,
 	opencode,
+	ouroboros,
 	"red-claw": red_claw,
 };

package/src/modes/theme/defaults/ouroboros.json

@@ -0,0 +1,118 @@
+{
+	"$schema": "https://raw.githubusercontent.com/can1357/gajae-code/main/packages/coding-agent/theme-schema.json",
+	"name": "ouroboros",
+	"vars": {
+		"cyan": "#58d5c3",
+		"blue": "#7092be",
+		"green": "#78c878",
+		"red": "#ff667a",
+		"yellow": "#f2c94c",
+		"gray": "#a9bbb2",
+		"dimGray": "#5b756d",
+		"darkGray": "#29443f",
+		"accent": "#aee80e",
+		"selectedBg": "#1b3b3b",
+		"userMsgBg": "#102b30",
+		"toolPendingBg": "#0d252b",
+		"toolSuccessBg": "#163326",
+		"toolErrorBg": "#351923",
+		"customMsgBg": "#0d2130",
+		"abyss": "#050b18",
+		"deepNavy": "#0b1630",
+		"mantle": "#0d2130",
+		"surface": "#102b30",
+		"surfaceBright": "#1b3b3b",
+		"ouroTeal": "#38bfa7",
+		"serpentGreen": "#78c878",
+		"petLime": "#aee80e",
+		"ritualGold": "#f2c94c",
+		"eyeGold": "#ffe786",
+		"coolScale": "#7092be",
+		"foam": "#e7f1e9",
+		"mutedScale": "#a9bbb2",
+		"dimScale": "#5b756d",
+		"dangerRed": "#ff667a",
+		"diffRemovalRed": "#df5b6b"
+	},
+	"colors": {
+		"accent": "petLime",
+		"border": "ouroTeal",
+		"borderAccent": "ritualGold",
+		"borderMuted": "dimScale",
+		"success": "serpentGreen",
+		"error": "dangerRed",
+		"warning": "ritualGold",
+		"muted": "mutedScale",
+		"dim": "dimScale",
+		"text": "foam",
+		"thinkingText": "mutedScale",
+		"selectedBg": "surfaceBright",
+		"userMessageBg": "surface",
+		"userMessageText": "foam",
+		"customMessageBg": "mantle",
+		"customMessageText": "foam",
+		"customMessageLabel": "petLime",
+		"toolPendingBg": "mantle",
+		"toolSuccessBg": "#163326",
+		"toolErrorBg": "#351923",
+		"toolTitle": "foam",
+		"toolOutput": "mutedScale",
+		"mdHeading": "petLime",
+		"mdLink": "ouroTeal",
+		"mdLinkUrl": "dimScale",
+		"mdCode": "eyeGold",
+		"mdCodeBlock": "serpentGreen",
+		"mdCodeBlockBorder": "ouroTeal",
+		"mdQuote": "mutedScale",
+		"mdQuoteBorder": "ouroTeal",
+		"mdHr": "dimScale",
+		"mdListBullet": "ritualGold",
+		"toolDiffAdded": "serpentGreen",
+		"toolDiffRemoved": "diffRemovalRed",
+		"toolDiffContext": "mutedScale",
+		"syntaxComment": "dimScale",
+		"syntaxKeyword": "petLime",
+		"syntaxFunction": "eyeGold",
+		"syntaxVariable": "foam",
+		"syntaxString": "serpentGreen",
+		"syntaxNumber": "coolScale",
+		"syntaxType": "ouroTeal",
+		"syntaxOperator": "ritualGold",
+		"syntaxPunctuation": "mutedScale",
+		"thinkingOff": "dimScale",
+		"thinkingMinimal": "mutedScale",
+		"thinkingLow": "coolScale",
+		"thinkingMedium": "ouroTeal",
+		"thinkingHigh": "petLime",
+		"thinkingXhigh": "eyeGold",
+		"bashMode": "petLime",
+		"statusLineBg": "deepNavy",
+		"statusLineSep": "dimScale",
+		"statusLineModel": "petLime",
+		"statusLinePath": "ouroTeal",
+		"statusLineGitClean": "serpentGreen",
+		"statusLineGitDirty": "ritualGold",
+		"statusLineContext": "coolScale",
+		"statusLineSpend": "eyeGold",
+		"statusLineStaged": "serpentGreen",
+		"statusLineDirty": "ritualGold",
+		"statusLineUntracked": "diffRemovalRed",
+		"statusLineOutput": "foam",
+		"statusLineCost": "eyeGold",
+		"statusLineSubagents": "ouroTeal",
+		"pythonMode": "ritualGold"
+	},
+	"export": {
+		"pageBg": "#050b18",
+		"cardBg": "#0b1630",
+		"infoBg": "#102b30"
+	},
+	"symbols": {
+		"preset": "unicode",
+		"overrides": {
+			"icon.pi": "🐍",
+			"status.running": "∞",
+			"md.bullet": "◇"
+		}
+	}
+}

package/src/sdk/broker/process-incarnation.ts

@@ -40,7 +40,12 @@ export interface ProcessIncarnationOptions {
 
 function runProcessIncarnationCommand(command: string, args: readonly string[]): ProcessIncarnationCommandResult {
 	try {
-		const result = Bun.spawnSync([command, ...args], { stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+		const result = Bun.spawnSync([command, ...args], {
+			stdin: "ignore",
+			stdout: "pipe",
+			stderr: "ignore",
+			windowsHide: true,
+		});
 		return { exitCode: result.exitCode, stdout: Buffer.from(result.stdout).toString("utf8") };
 	} catch {
 		return undefined;

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -105,8 +105,10 @@ export const NOTIFICATION_PROTOCOL_VERSION = 3;
  * settles non-forum close responses. Generation 62 rejects replay-gap
  * authority claims that do not match the requested cursor, answer bounds,
  * and retained replay suffix.
+ * Generation 63 contains transient steady-heartbeat state and ownership-lock
+ * read failures and cleans every staged sidecar before retrying (#4200).
  */
-export const DAEMON_GENERATION = 62;
+export const DAEMON_GENERATION = 63;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 5

package/src/sdk/bus/telegram-daemon.ts

@@ -1419,38 +1419,38 @@ export async function renewOwnerHeartbeatSidecar(input: {
 		logger.warn(`notifications: heartbeat sidecar staging failed: ${sanitizeDiagnostic(String(error))}`);
 		return "publish_failed";
 	}
-	const lock = await readOwnershipLock(fsImpl, paths.lock);
-	if (!ownershipLockMatchesState(lock, state)) {
-		await fsImpl.unlink(tmp).catch(() => undefined);
-		return "not_owner";
-	}
-	for (let attempt = 1; ; attempt++) {
-		// Revalidate the exact lock after the temporary sidecar exists — and again
-		// before every retry — so a stale writer cannot publish after ownership
-		// moved during its write or its backoff.
-		const finalLock = await readOwnershipLock(fsImpl, paths.lock);
-		if (!ownershipLockMatchesState(finalLock, state)) {
-			await fsImpl.unlink(tmp).catch(() => undefined);
-			return "not_owner";
-		}
-		try {
-			await fsImpl.rename(tmp, paths.heartbeat);
-			return "renewed";
-		} catch (error) {
-			// Windows: a transient external lock on the destination (antivirus,
-			// indexer) surfaces as EPERM on rename and used to escape as an
-			// uncaught exception that killed the whole daemon (#4200). Retry a
-			// bounded number of times under the lock fence, then keep the daemon
-			// alive and let the next heartbeat cycle publish.
-			if (attempt >= HEARTBEAT_SIDECAR_PUBLISH_ATTEMPTS || !isTransientSidecarPublishError(error)) {
-				await fsImpl.unlink(tmp).catch(() => undefined);
-				logger.warn(
-					`notifications: heartbeat sidecar publication failed after ${attempt} attempt(s): ${sanitizeDiagnostic(String(error))}`,
-				);
-				return "publish_failed";
+	try {
+		const lock = await readOwnershipLock(fsImpl, paths.lock);
+		if (!ownershipLockMatchesState(lock, state)) return "not_owner";
+		for (let attempt = 1; ; attempt++) {
+			// Revalidate the exact lock after the temporary sidecar exists — and again
+			// before every retry — so a stale writer cannot publish after ownership
+			// moved during its write or its backoff.
+			const finalLock = await readOwnershipLock(fsImpl, paths.lock);
+			if (!ownershipLockMatchesState(finalLock, state)) return "not_owner";
+			try {
+				await fsImpl.rename(tmp, paths.heartbeat);
+				return "renewed";
+			} catch (error) {
+				// Windows: a transient external lock on the destination (antivirus,
+				// indexer) surfaces as EPERM on rename and used to escape as an
+				// uncaught exception that killed the whole daemon (#4200). Retry a
+				// bounded number of times under the lock fence, then keep the daemon
+				// alive and let the next heartbeat cycle publish.
+				if (attempt >= HEARTBEAT_SIDECAR_PUBLISH_ATTEMPTS || !isTransientSidecarPublishError(error)) {
+					logger.warn(
+						`notifications: heartbeat sidecar publication failed after ${attempt} attempt(s): ${sanitizeDiagnostic(String(error))}`,
+					);
+					return "publish_failed";
+				}
+				await Bun.sleep(HEARTBEAT_SIDECAR_PUBLISH_BACKOFF_MS * attempt);
 			}
-			await Bun.sleep(HEARTBEAT_SIDECAR_PUBLISH_BACKOFF_MS * attempt);
 		}
+	} finally {
+		// A thrown state or ownership-lock read after the staging write must not
+		// leak the live-PID staging file. After a successful rename the staging
+		// path no longer exists and this unlink is a no-op (#4200).
+		await fsImpl.unlink(tmp).catch(() => undefined);
 	}
 }
 
@@ -12490,19 +12490,27 @@ export class TelegramNotificationDaemon {
 			let idleSince = this.runtime.now();
 			while (this.running) {
 				if (await this.controlStopRequested()) break;
-				if (
-					(await renewOwnerHeartbeatSidecar({
-						settings: this.opts.settings,
-						ownerId: this.opts.ownerId,
-						acquisitionId: this.opts.ownerId,
-						fs: this.fsImpl,
-						now: this.opts.now,
-						pid: this.opts.pid ?? process.pid,
-						pidIncarnation: this.opts.pidIncarnation,
-						attachedEndpoints: this.attachedEndpointCount(),
-					})) === "not_owner"
-				)
-					break;
+				// Transient Windows state/lock read failures must not terminate the
+				// notification daemon. Only a proven ownership mismatch stops it.
+				let ownerHeld = true;
+				try {
+					ownerHeld =
+						(await renewOwnerHeartbeatSidecar({
+							settings: this.opts.settings,
+							ownerId: this.opts.ownerId,
+							acquisitionId: this.opts.ownerId,
+							fs: this.fsImpl,
+							now: this.opts.now,
+							pid: this.opts.pid ?? process.pid,
+							pidIncarnation: this.opts.pidIncarnation,
+							attachedEndpoints: this.attachedEndpointCount(),
+						})) !== "not_owner";
+				} catch (error) {
+					logger.warn(
+						`notifications: ownership heartbeat renewal threw; continuing: ${sanitizeDiagnostic(String(error))}`,
+					);
+				}
+				if (!ownerHeld) break;
 				await this.runScan();
 				if (await this.controlStopRequested()) break;
 				const idleElapsed = this.runtime.now() - idleSince >= (this.opts.idleTimeoutMs ?? 60_000);

package/src/session/agent-session.ts

@@ -954,6 +954,13 @@ type RetryErrorClassification =
 
 const BARE_DEFAULT_WATCHDOG_ERROR =
 	/^(?:[A-Za-z][A-Za-z0-9-]*(?: [A-Za-z][A-Za-z0-9-]*){0,3} )stream (?:timed out while waiting for the first event|stalled while waiting for the next event)$/;
+/**
+ * Consecutive same-model retries allowed for `escaped_arguments_discarded`
+ * managed outcomes before the run terminates. Mirrors the agent loop's
+ * escaped-non-ASCII resample budget on dev; enforced session-side here because
+ * a managed retry re-enters the loop as a fresh run.
+ */
+const MAX_ESCAPED_ARGUMENT_RETRIES = 2;
 const PROVIDER_FIRST_EVENT_TIMEOUT_ERROR = "Provider stream timed out while waiting for the first event";
 const WRAPPED_PROVIDER_FIRST_EVENT_TIMEOUT_ERROR = `Error: ${PROVIDER_FIRST_EVENT_TIMEOUT_ERROR}`;
 const PROVIDER_FIRST_EVENT_TIMEOUT_WITHOUT_ARTICLE_ERROR = "Provider stream timed out while waiting for first event";
@@ -2030,6 +2037,7 @@ export class AgentSession {
 	#retryPromise: Promise<void> | undefined = undefined;
 	#retryResolve: (() => void) | undefined = undefined;
 	#defaultFallbackController: FallbackChainController | undefined;
+	#consecutiveEscapedArgumentRetries = 0;
 	#overflowMaintenanceAttempts = 0;
 	#defaultFallbackExhaustedLastTurn = false;
 	#fallbackInvocationId = 0;
@@ -13690,6 +13698,7 @@ export class AgentSession {
 				sessionMemory.metadataResidentBytes,
 			tuiChatChildren: retainedMemory.tuiChatChildren ?? 0,
 			tuiCachedRenderBytes: retainedMemory.tuiCachedRenderBytes ?? 0,
+			transcriptFileBytes: this.sessionManager.getTranscriptFileBytes(),
 		};
 	}
 
@@ -15710,10 +15719,40 @@ export class AgentSession {
 	}
 
 	async #handleManagedAttemptOutcome(outcome: ManagedAttemptOutcome): Promise<ManagedAttemptDecision> {
+		if (outcome.type !== "escaped_arguments_discarded") this.#consecutiveEscapedArgumentRetries = 0;
 		if (outcome.type === "run_terminal") {
 			this.#defaultFallbackChain().resetAttemptBudget();
 			return { type: "terminal", terminal: { stopReason: outcome.reason } };
 		}
+		if (outcome.type === "escaped_arguments_discarded") {
+			// An escaped-non-ASCII wire defect is a sampling accident, not provider
+			// evidence: never charge the attempt, advance the chain, or suppress the
+			// selector. The loop already removed the defective turn from history, so
+			// this decision just re-issues the same request on the same model.
+			//
+			// The retry bound lives HERE, not in the loop: a managed retry re-enters
+			// the loop as a fresh run, so no loop-local budget survives it. After
+			// MAX_ESCAPED_ARGUMENT_RETRIES consecutive escaped-argument discards the
+			// run terminates with an error instead of ping-ponging forever against a
+			// model that deterministically emits escaped arguments. The counter
+			// resets on any other outcome.
+			this.#defaultFallbackChain().discardStartedAttempt();
+			this.#consecutiveEscapedArgumentRetries++;
+			if (this.#consecutiveEscapedArgumentRetries > MAX_ESCAPED_ARGUMENT_RETRIES) {
+				this.#consecutiveEscapedArgumentRetries = 0;
+				return {
+					type: "terminal",
+					terminal: { stopReason: "error", messages: [outcome.message] },
+				};
+			}
+			return {
+				type: "retry",
+				continuation: async ownership => {
+					if (!ownership.isCurrent() || ownership.lease.signal.aborted) return;
+					await this.agent.continue(this.#managedFallbackPromptOptions());
+				},
+			};
+		}
 		if (outcome.type === "context_overflow_discarded") {
 			// The provider invocation happened, but overflow is context maintenance rather
 			// than a fallback-policy failure. Keep the logical run owner and do not charge,

package/src/session/internal/managed-session-storage.ts

@@ -9,6 +9,7 @@ import type {
 	RecoveryFsIdentity,
 	RecoveryFsRoot,
 } from "@gajae-code/natives";
+import { isEnoent, logger } from "@gajae-code/utils";
 import type { SessionStorageRangeSnapshot, SessionStorageStat } from "../session-storage";
 import {
 	classifyNativePublishOutcome,
@@ -25,8 +26,10 @@ type NativeManagedSessionStorage = Pick<
 	| "exactReplacePath"
 	| "exactUnlink"
 	| "linkNoReplacePath"
+	| "linkNoReplacePathAsync"
 	| "openRecoveryFsRoot"
 	| "renameNoReplacePath"
+	| "renameNoReplacePathAsync"
 	| "repairOwnerOnlyPathSecurityExpected"
 	| "snapshotDirectoryTree"
 	| "verifyOwnerOnlyFdSecurity"
@@ -497,6 +500,22 @@ const SCRUBBED_REMNANT_PREFIXES = [
 /** In-flight protocol steps complete in milliseconds; anything older is abandoned. */
 const SCRUBBED_REMNANT_MIN_AGE_MS = 15 * 60 * 1000;
 
+/** Minimum interval between best-effort remnant reaps of one bound store directory. */
+const SCRUBBED_REMNANT_REAP_INTERVAL_MS = 60_000;
+
+export interface ScrubbedProtocolRemnantReapResult {
+	readonly reaped: number;
+	readonly failures: number;
+}
+
+function reportScrubbedProtocolRemnantReap(reaped: number, failures: number): ScrubbedProtocolRemnantReapResult {
+	if (failures > 0)
+		logger.warn("Managed session remnant reaping completed with failures", {
+			failureCount: failures,
+			reapedCount: reaped,
+		});
+	return { reaped, failures };
+}
 /**
  * Best-effort removal of scrubbed write-protocol remnants from one managed
  * directory. Only zero-length, single-link, non-symlink regular files whose
@@ -535,6 +554,48 @@ export function reapScrubbedProtocolRemnantsSync(
 	return reaped;
 }
 
+/** Number of candidate remnants inspected between event-loop yields. */
+const SCRUBBED_REMNANT_REAP_BATCH_SIZE = 256;
+
+/**
+ * Async twin of {@link reapScrubbedProtocolRemnantsSync} with the same safety
+ * filters (terminal remnant prefix, zero-length, single-link, non-symlink,
+ * older than the age gate), yielding between bounded batches. Long-lived
+ * processes reap per-session descendant directories through this path so a
+ * legacy oversized directory cannot starve timers or sibling subagents while
+ * it is being drained (issue #4394).
+ */
+export async function reapScrubbedProtocolRemnants(
+	directory: string,
+	minAgeMs: number = SCRUBBED_REMNANT_MIN_AGE_MS,
+): Promise<ScrubbedProtocolRemnantReapResult> {
+	let names: string[];
+	try {
+		names = await fsp.readdir(directory);
+	} catch (error) {
+		return reportScrubbedProtocolRemnantReap(0, isEnoent(error) ? 0 : 1);
+	}
+	const cutoff = Date.now() - minAgeMs;
+	let reaped = 0;
+	let failures = 0;
+	let scanned = 0;
+	for (const name of names) {
+		if (!SCRUBBED_REMNANT_PREFIXES.some(prefix => name.startsWith(prefix))) continue;
+		if (++scanned % SCRUBBED_REMNANT_REAP_BATCH_SIZE === 0) await Bun.sleep(0);
+		const pathname = path.join(directory, name);
+		try {
+			const named = await fsp.lstat(pathname);
+			if (!named.isFile() || named.isSymbolicLink() || named.nlink !== 1 || named.size !== 0) continue;
+			if (named.mtimeMs > cutoff) continue;
+			await fsp.unlink(pathname);
+			reaped += 1;
+		} catch (error) {
+			if (!isEnoent(error)) failures += 1;
+		}
+	}
+	return reportScrubbedProtocolRemnantReap(reaped, failures);
+}
+
 const ACL_FAILURE_CODES = new Set(["acl_denied", "acl_io_error", "acl_present", "acl_malformed", "acl_unknown"]);
 const ACL_CLEAR_EVIDENCE = new Set(["cleared", "already_absent", "unsupported", "not_run"]);
 const GENERAL_FAILURE_CODES = new Set([
@@ -895,6 +956,8 @@ export class ManagedSessionDescendantStore {
 	#ownsAuthority = false;
 	#closed = false;
 	#reconcilingReplacementCleanup = false;
+	#remnantReapInFlight = false;
+	#lastRemnantReapAttempt = 0;
 	readonly #authorityBaseDir: string;
 	/** Logical profile root inherited by nested managed session destinations. */
 	readonly #profileAgentDir: string;
@@ -1273,25 +1336,32 @@ export class ManagedSessionDescendantStore {
 			fsyncDirectory(this.#baseDir);
 			return;
 		}
-		if (outcome.reason === "destination_exists") {
-			const existing = captureManagedFilePrefixNoFollow(destination, REPLACEMENT_CLEANUP_RECEIPT_MAX_BYTES);
-			if (existing.identity.sha256 !== pending.identity.sha256)
-				throw new Error("managed_replace_cleanup_receipt_invalid");
-			const removed = nativeSessionStorage().exactUnlink(receiptPath, {
-				dev: pending.identity.dev,
-				ino: pending.identity.ino,
-				nlink: pending.identity.nlink,
-				parentDev: this.#subtreeRoot.dev,
-				parentIno: this.#subtreeRoot.ino,
-				size: BigInt(pending.identity.size),
-				mtimeNs: pending.identity.mtimeNs,
-				sha256: pending.identity.sha256,
-				quarantineName: `.gjc-receipt-pending-remove-${pending.identity.dev.toString(16)}-${pending.identity.ino.toString(16)}`,
-			});
-			if (!exactUnlinkCompleted(removed) && removed.code !== "not_found")
-				throw new Error(`managed_replace_receipt_cleanup_pending:${removed.code ?? "unknown"}`);
-			fsyncDirectory(this.#baseDir);
-			return;
+		if (outcome.reason === "destination_exists" || outcome.reason === "invalid_request") {
+			const captureIfPresent = (pathname: string): ManagedFileSnapshot | undefined => {
+				try {
+					return captureManagedFilePrefixNoFollow(pathname, REPLACEMENT_CLEANUP_RECEIPT_MAX_BYTES);
+				} catch (error) {
+					if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+					throw error;
+				}
+			};
+			const currentPending = captureIfPresent(receiptPath);
+			const existing = captureIfPresent(destination);
+			if (!currentPending && existing) {
+				if (
+					!sameReplacementIdentity(existing.identity, pending.identity) ||
+					existing.identity.sha256 !== pending.identity.sha256
+				)
+					throw new Error("managed_replace_cleanup_receipt_invalid");
+				fsyncDirectory(this.#baseDir);
+				return;
+			}
+			if (currentPending && !existing) throw publishFailure(outcome);
+			// Two names cannot both authoritatively represent the one receipt identity
+			// encoded in the canonical filename. A byte-identical copy has a different
+			// filesystem identity and would make the canonical receipt fail its next
+			// reconciliation, while a hard link violates the single-link capture fence.
+			throw new Error("managed_replace_cleanup_receipt_invalid");
 		}
 		throw publishFailure(outcome);
 	}
@@ -1340,6 +1410,30 @@ export class ManagedSessionDescendantStore {
 		this.#assertBound();
 		this.#reconcileReplacementCleanupReceipts();
 		this.#assertBound();
+		this.#scheduleRemnantReap();
+	}
+
+	/**
+	 * Best-effort asynchronous reaping of scrubbed write-protocol remnants in
+	 * this store's bound directory. Replacements leak zero-byte remnants on
+	 * platforms without retained authority (macOS), and scope-resolution reaping
+	 * never visits per-session descendant directories, so unbounded remnant
+	 * growth there degraded every namespace mutation and let one publication
+	 * stall the whole process (issue #4394). Reaping is throttled, serialized
+	 * per store, and never fails the triggering mutation.
+	 */
+	#scheduleRemnantReap(): void {
+		const now = Date.now();
+		if (this.#remnantReapInFlight || now - this.#lastRemnantReapAttempt < SCRUBBED_REMNANT_REAP_INTERVAL_MS) return;
+		this.#lastRemnantReapAttempt = now;
+		this.#remnantReapInFlight = true;
+		void reapScrubbedProtocolRemnants(this.#baseDir)
+			.catch((error: unknown) => {
+				logger.warn("Managed session remnant reaping failed", { error: String(error) });
+			})
+			.finally(() => {
+				this.#remnantReapInFlight = false;
+			});
 	}
 
 	ensureDirectory(relativePath = ""): ManagedDirectoryRoot {
@@ -2255,6 +2349,17 @@ function fsyncDirectory(pathname: string): void {
 	}
 }
 
+/** Async twin of {@link fsyncDirectory} for the off-loop publication path. */
+async function fsyncDirectoryAsync(pathname: string): Promise<void> {
+	if (!shouldFsyncManagedDirectory()) return;
+	const handle = await fsp.open(pathname, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY);
+	try {
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+}
+
 function bootId(): string | undefined {
 	try {
 		return fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
@@ -2536,7 +2641,7 @@ export async function publishManagedFileNoReplace(
 	const parent = path.dirname(destination);
 	ensureManagedDirectory(parent, root, policy);
 	const staging = path.join(parent, `.${path.basename(destination)}.${randomUUID()}.staging`);
-	let fd: number | undefined;
+	let handle: fsp.FileHandle | undefined;
 	let stagingIdentity: { dev: bigint; ino: bigint } | undefined;
 	let failure: unknown;
 	let outcome: NativePublishOutcome | undefined;
@@ -2545,36 +2650,47 @@ export async function publishManagedFileNoReplace(
 
 	try {
 		assertOwned?.();
-		fd = fs.openSync(
+		// The whole staging + publication chain is awaited off the resident event
+		// loop: FileHandle operations run on the libuv pool and the no-replace
+		// namespace publication crosses the async native boundary. A rename that
+		// stalls in the kernel — e.g. into an oversized APFS directory namespace,
+		// issue #4394 — blocks one pool thread instead of freezing the process:
+		// await timeouts, sibling subagents, and watchdogs keep running, and a
+		// hung publication degrades to one unresolved receipt.
+		handle = await fsp.open(
 			staging,
 			fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW,
 			0o600,
 		);
-		secureFileDescriptor(staging, fd, "apply");
+		secureFileDescriptor(staging, handle.fd, "apply");
 		let offset = 0;
-		while (offset < bytes.byteLength) offset += fs.writeSync(fd, bytes, offset, bytes.byteLength - offset);
-		fs.fsyncSync(fd);
-		secureFileDescriptor(staging, fd, "verify");
-		const staged = fs.fstatSync(fd, { bigint: true });
+		while (offset < bytes.byteLength) {
+			const { bytesWritten } = await handle.write(bytes, offset, bytes.byteLength - offset);
+			if (bytesWritten <= 0) throw new Error("managed_publish_failed");
+			offset += bytesWritten;
+		}
+		await handle.sync();
+		secureFileDescriptor(staging, handle.fd, "verify");
+		const staged = await handle.stat({ bigint: true });
 		stagingIdentity = { dev: staged.dev, ino: staged.ino };
 		assertOwned?.();
 
 		renameAttempted = true;
-		outcome = classifyNativePublishOutcome(nativeSessionStorage().renameNoReplacePath(staging, destination));
+		outcome = classifyNativePublishOutcome(
+			await nativeSessionStorage().renameNoReplacePathAsync(staging, destination),
+		);
 		if (renameFlagsUnsupported(outcome)) {
-			// linkat publishes the destination without consuming the staging name, so the
-			// secured staging descriptor stays authoritative across publication exactly as
-			// it does across a rename. The staging link is removed in the finally block
-			// below, after that descriptor is closed: unlinking a still-open name on NFS
-			// silly-renames it instead of removing it, which would leave a second link on
-			// the published inode.
-			outcome = classifyNativePublishOutcome(nativeSessionStorage().linkNoReplacePath(staging, destination));
+			// See publishManagedFileNoReplaceSync: the staging link outlives this
+			// publication and is removed only after the secured descriptor is closed.
+			outcome = classifyNativePublishOutcome(
+				await nativeSessionStorage().linkNoReplacePathAsync(staging, destination),
+			);
 			linkPublished = outcome.ok;
 		}
 
 		if (!outcome.ok) throw publishFailure(outcome);
 
-		const named = fs.lstatSync(destination, { bigint: true });
+		const named = await fsp.lstat(destination, { bigint: true });
 		if (
 			!named.isFile() ||
 			named.isSymbolicLink() ||
@@ -2583,15 +2699,21 @@ export async function publishManagedFileNoReplace(
 		) {
 			throw new Error("destination_identity_changed");
 		}
-		secureFileDescriptor(destination, fd, "verify");
-		fs.closeSync(fd);
-		fd = undefined;
+		secureFileDescriptor(destination, handle.fd, "verify");
+		await handle.close();
+		handle = undefined;
 
-		fsyncDirectory(parent);
+		await fsyncDirectoryAsync(parent);
 	} catch (error) {
 		failure = error;
 	} finally {
-		if (fd !== undefined) fs.closeSync(fd);
+		if (handle !== undefined) {
+			try {
+				await handle.close();
+			} catch (error) {
+				failure ??= error;
+			}
+		}
 
 		if (stagingIdentity && (linkPublished || !renameAttempted || (outcome && mayCleanCurrentStaging(outcome)))) {
 			await fsp