@gajae-code/coding-agent 0.15.6 → 0.16.0

package/src/config/file-lock.ts

@@ -1,9 +1,9 @@
 import * as crypto from "node:crypto";
-import type { BigIntStats, Stats } from "node:fs";
+import type { BigIntStats } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import type { NativeDirectoryTreeResult, NativeExactUnlinkResult } from "@gajae-code/natives";
-import { renameNoReplacePathAsync } from "@gajae-code/natives";
+import type { NativeDirectoryTreeResult, NativeExactUnlinkResult, NativeNoReplaceResult } from "@gajae-code/natives";
+import { renameDirectoryNoReplacePathAsync, renameNoReplacePathAsync } from "@gajae-code/natives";
 import { isEnoent } from "@gajae-code/utils/fs-error";
 import { nativeProcessBindings } from "@gajae-code/utils/native-process";
 
@@ -49,6 +49,10 @@ type LockInfo = FileLockOwnerToken;
 
 export const FileLockTestHooks: {
 	afterParentMkdir?: (lockPath: string) => void | Promise<void>;
+	nativePublicationBindings?: () => {
+		renameNoReplacePathAsync: typeof renameNoReplacePathAsync;
+		renameDirectoryNoReplacePathAsync: typeof renameDirectoryNoReplacePathAsync;
+	};
 	nativeQuarantineBindings?: () => NativeFileLockBindings;
 } = {};
 
@@ -423,6 +427,118 @@ async function ensureLockParent(directory: string): Promise<void> {
 	}
 }
 
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		!Array.isArray(value) &&
+		Object.getPrototypeOf(value) === Object.prototype
+	);
+}
+
+function isValidNativeNoReplaceResult(value: unknown): value is NativeNoReplaceResult {
+	if (!isPlainRecord(value)) return false;
+	const expectedKeys = [
+		"ok",
+		"code",
+		"mutationState",
+		"durabilityState",
+		"reason",
+		"primitive",
+		"phase",
+		"diagnostic",
+	];
+	if (Object.keys(value).some(key => !expectedKeys.includes(key))) return false;
+	if (
+		typeof value.ok !== "boolean" ||
+		(value.code !== undefined && (typeof value.code !== "string" || !/^[a-z0-9_]{1,64}$/.test(value.code))) ||
+		!(["not_committed", "committed", "unknown"] as const).includes(value.mutationState as never) ||
+		!(["not_attempted", "proven", "not_provable"] as const).includes(value.durabilityState as never) ||
+		!(
+			[
+				"none",
+				"destination_exists",
+				"atomic_unavailable",
+				"cross_device",
+				"permission_denied",
+				"io_failure",
+				"invalid_request",
+				"interrupted",
+				"identity_violation",
+				"durability_not_provable",
+				"unknown",
+			] as const
+		).includes(value.reason as never) ||
+		!(
+			[
+				"renameat2_noreplace",
+				"linkat_noreplace",
+				"mkdirat_renameat_noreplace",
+				"renameatx_np_excl",
+				"windows_rename_noreplace",
+				"unsupported",
+				"unknown",
+			] as const
+		).includes(value.primitive as never) ||
+		!(
+			[
+				"preflight",
+				"file_sync",
+				"rename",
+				"source_unlink",
+				"source_parent_sync",
+				"destination_parent_sync",
+				"terminal_identity",
+				"complete",
+				"unknown",
+			] as const
+		).includes(value.phase as never)
+	)
+		return false;
+	if (!isPlainRecord(value.diagnostic)) return false;
+	if (
+		Object.keys(value.diagnostic).some(
+			key => !["schemaVersion", "collectionState", "osCode", "syncFailures"].includes(key),
+		) ||
+		value.diagnostic.schemaVersion !== 1 ||
+		!(["complete", "partial", "unavailable"] as const).includes(value.diagnostic.collectionState as never) ||
+		(value.diagnostic.osCode !== undefined &&
+			(typeof value.diagnostic.osCode !== "number" || !Number.isInteger(value.diagnostic.osCode))) ||
+		(value.diagnostic.syncFailures !== undefined && !Array.isArray(value.diagnostic.syncFailures))
+	)
+		return false;
+	if (value.ok)
+		return (
+			value.mutationState === "committed" &&
+			value.reason === "none" &&
+			value.phase === "complete" &&
+			(value.durabilityState === "not_attempted" || value.durabilityState === "proven")
+		);
+	if (value.mutationState === "not_committed") return value.durabilityState === "not_attempted";
+	return value.mutationState === "unknown" && value.durabilityState === "not_provable";
+}
+
+/**
+ * Only a complete native envelope proving that no namespace mutation happened
+ * may authorize the directory fallback. A legacy or malformed result is
+ * treated as an unknown publication outcome and never followed by another
+ * mutating primitive.
+ */
+function isPreMutationUnsupportedRenameResult(value: unknown): value is NativeNoReplaceResult {
+	if (!isValidNativeNoReplaceResult(value)) return false;
+	if (
+		value.ok !== false ||
+		(value.code !== "invalid_request" && value.code !== "atomic_unavailable") ||
+		value.mutationState !== "not_committed" ||
+		value.durabilityState !== "not_attempted" ||
+		value.reason !== value.code ||
+		(value.primitive !== "renameat2_noreplace" && value.primitive !== "renameatx_np_excl") ||
+		(value.phase !== "preflight" && value.phase !== "rename")
+	)
+		return false;
+	return true;
+}
+
 async function localLockKey(lockPath: string): Promise<string> {
 	try {
 		return normalizeLockKey(await fs.realpath(lockPath));
@@ -452,17 +568,9 @@ function ownerIncarnationChanged(owner: FileLockOwnerToken, startTimeCache?: Map
 /** Outcome of a guarded lock-dir removal attempt (`removeFileLockDirForGc`). */
 export type FileLockGcRemoval = "removed" | "owner_changed" | "missing" | "cleanup_failed";
 
-interface LockDirStatToken {
-	dev: number;
-	ino: number;
-	mtimeMs: number;
-	ctimeMs: number;
-}
-
 type LockStaleSnapshot =
 	| { stale: false }
-	| { stale: true; owner: FileLockOwnerToken; identity: GenericFileLockDirIdentity }
-	| { stale: true; owner: null; stat: LockDirStatToken };
+	| { stale: true; owner: FileLockOwnerToken; identity: GenericFileLockDirIdentity };
 
 /** Identity evidence carried by the generic stale verdict into a later removal. */
 export interface GenericFileLockDirIdentity {
@@ -634,22 +742,9 @@ function ownerLiveness(pid: number): OwnerLiveness {
 	}
 }
 
-function statToken(stats: Stats): LockDirStatToken {
-	return {
-		dev: stats.dev,
-		ino: stats.ino,
-		mtimeMs: stats.mtimeMs,
-		ctimeMs: stats.ctimeMs,
-	};
-}
-
-function sameStatToken(a: LockDirStatToken, b: LockDirStatToken): boolean {
-	return a.dev === b.dev && a.ino === b.ino && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
-}
-
 async function staleLockSnapshot(
 	lockPath: string,
-	staleMs: number,
+	_staleMs: number,
 	ownerHostId?: string,
 	previousOwnerHostIds: readonly string[] = [],
 	startTimeCache?: Map<string, string | null>,
@@ -673,26 +768,12 @@ async function staleLockSnapshot(
 		if (isTransientReleaseError(error)) return { stale: false };
 		throw error;
 	}
-	if (!info && ownerHostId !== undefined) return { stale: false };
 	if (!info) {
-		// A present but malformed owner record is not equivalent to a lock directory
-		// caught between mkdir and metadata publication. Refuse stale fallback when the
-		// metadata path exists: an unreadable live holder must never be reclaimed by
-		// elapsed mtime alone.
-		try {
-			await fs.lstat(path.join(lockPath, "info"));
-			return { stale: false };
-		} catch (error) {
-			if (!isEnoent(error)) throw error;
-		}
-		try {
-			const stats = await fs.stat(lockPath);
-			if (Date.now() - stats.mtimeMs <= staleMs) return { stale: false };
-			return { stale: true, owner: null, stat: statToken(stats) };
-		} catch (err) {
-			if (isEnoent(err)) return { stale: false };
-			throw err;
-		}
+		// A directory without a valid owner record is either a contender between
+		// native mkdirat ownership and metadata publication, or malformed/foreign
+		// state. Neither case carries enough identity evidence for stale removal;
+		// elapsed mtime must never make this empty namespace reclaimable.
+		return { stale: false };
 	}
 
 	// A host-qualified lock may only be reclaimed after proving that its owner is
@@ -741,38 +822,7 @@ async function staleLockSnapshot(
 
 async function removeStaleLockForAcquire(lockPath: string, snapshot: LockStaleSnapshot): Promise<boolean> {
 	if (!snapshot.stale) return false;
-	if (snapshot.owner) {
-		return (await removeFileLockDirForGc(lockPath, snapshot.owner, snapshot.identity)) === "removed";
-	}
-
-	let currentInfo: LockInfo | null;
-	try {
-		currentInfo = await readLockInfo(lockPath);
-	} catch (error) {
-		if (isTransientReleaseError(error)) return false;
-		throw error;
-	}
-	if (currentInfo) return false;
-	try {
-		const currentStats = await fs.lstat(lockPath);
-		if (currentStats.isSymbolicLink() || !currentStats.isDirectory()) return false;
-		if (!sameStatToken(statToken(currentStats), snapshot.stat)) return false;
-		const nativeCapturePath = await canonicalLockPathPreservingFinal(lockPath);
-		const captured = nativeFileLockBindings().snapshotDirectoryTree(nativeCapturePath);
-		if (captured.code === "sharing_violation") throwTransientNativeResult(captured.code);
-		if (!captured.ok || !captured.snapshot) return false;
-		if (
-			captured.snapshot.rootDev !== String(currentStats.dev) ||
-			captured.snapshot.rootIno !== String(currentStats.ino)
-		)
-			return false;
-		const removed = nativeFileLockBindings().exactRemoveDirectoryTree(nativeCapturePath, captured.snapshot);
-		return removed.ok || removed.code === "not_found";
-	} catch (err) {
-		if (isEnoent(err)) return false;
-		if (isTransientReleaseError(err)) return false;
-		throw err;
-	}
+	return (await removeFileLockDirForGc(lockPath, snapshot.owner, snapshot.identity)) === "removed";
 }
 
 /**
@@ -812,7 +862,7 @@ export async function genericFileLockDirStaleVerdict(
 	ownerHostId?: string,
 ): Promise<GenericFileLockDirStaleVerdict> {
 	const verdict = await staleLockSnapshot(lockDir, staleMs, ownerHostId);
-	if (!verdict.stale || verdict.owner === null) return { stale: false };
+	if (!verdict.stale) return { stale: false };
 	return {
 		stale: true,
 		identity: verdict.identity,
@@ -841,11 +891,32 @@ async function tryAcquireLock(
 		// already-created staging entry and its parent before publication so aliases
 		// retain the same lock identity as the ordinary path.
 		const canonicalParent = await fs.realpath(path.dirname(lockPath));
-		const published = await renameNoReplacePathAsync(
-			await fs.realpath(pendingPath),
-			path.join(canonicalParent, path.basename(lockPath)),
-		);
-		if (!published.ok) {
+		const destinationPath = path.join(canonicalParent, path.basename(lockPath));
+		// Resolve only the stable parent: resolving the mutable staging final
+		// component would follow an attacker-replaced symlink before native no-follow
+		// validation gets a chance to reject it.
+		const canonicalPendingPath = path.join(canonicalParent, path.basename(pendingPath));
+		const publication = FileLockTestHooks.nativePublicationBindings?.() ?? {
+			renameNoReplacePathAsync,
+			renameDirectoryNoReplacePathAsync,
+		};
+		const published = await publication.renameNoReplacePathAsync(canonicalPendingPath, destinationPath);
+		let publishedSuccessfully = published.ok;
+		if (!published.ok && isPreMutationUnsupportedRenameResult(published)) {
+			const fallback = await publication.renameDirectoryNoReplacePathAsync(canonicalPendingPath, destinationPath);
+			if (fallback.ok) {
+				publishedSuccessfully = true;
+			} else if (fallback.reason === "destination_exists") {
+				return null;
+			} else {
+				const failure = new Error(
+					`Failed to publish file lock: ${fallback.code ?? fallback.reason ?? "unknown"}.`,
+				) as NodeJS.ErrnoException;
+				if (fallback.code) failure.code = fallback.code;
+				throw failure;
+			}
+		}
+		if (!publishedSuccessfully) {
 			if (published.reason === "destination_exists") return null;
 			const failure = new Error(
 				`Failed to publish file lock: ${published.code ?? published.reason ?? "unknown"}.`,
@@ -1103,6 +1174,10 @@ async function lockHolderDescription(lockPath: string): Promise<string> {
 }
 
 async function acquireLock(filePath: string, options: FileLockOptions = {}): Promise<() => Promise<void>> {
+	const requestedFilePath: unknown = filePath;
+	if (typeof requestedFilePath !== "string" || requestedFilePath.length === 0 || !path.isAbsolute(requestedFilePath))
+		throw new TypeError("filePath must be a non-empty absolute path");
+	if (requestedFilePath.includes("\0")) throw new TypeError("filePath must not contain NUL bytes");
 	if (options.ownerHostId !== undefined && !options.ownerHostId) throw new Error("ownerHostId must be non-empty");
 	if (options.previousOwnerHostIds?.some(hostId => !hostId))
 		throw new Error("previousOwnerHostIds must contain only non-empty identities");

package/src/config/model-preset-registry.ts

@@ -1167,11 +1167,7 @@ function recoverStateCopiesSync(
 		(!primaryEvidence.allGenerationsVerified || primaryEvidence.duplicateRevision)
 	)
 		if (!options.allowInvalidPrimaryFallback || !backupEvidence?.fullyVerified) {
-			try {
-				validateStateGenerations(primaryEvidence.state, trustedKeys);
-			} catch (error) {
-				throw error;
-			}
+			validateStateGenerations(primaryEvidence.state, trustedKeys);
 		}
 	if (
 		backupEvidence &&

package/src/config/model-profiles.ts

@@ -241,11 +241,11 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		architect: ["anthropic/claude-opus-5:xhigh", "anthropic/claude-opus-4-6:xhigh"],
 	}),
 	profile("claude-fable", ["anthropic"], {
-		default: "anthropic/claude-fable-5:xhigh",
+		default: "anthropic/claude-fable-5-1:xhigh",
 		executor: "anthropic/claude-sonnet-5",
-		planner: "anthropic/claude-fable-5:low",
-		critic: "anthropic/claude-fable-5:high",
-		architect: "anthropic/claude-fable-5:xhigh",
+		planner: "anthropic/claude-fable-5-1:low",
+		critic: "anthropic/claude-fable-5-1:high",
+		architect: "anthropic/claude-fable-5-1:xhigh",
 	}),
 	profile("glm-eco", ["zai"], {
 		default: "zai/glm-5.3-flash:low",
@@ -482,7 +482,7 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		architect: "openai-codex/gpt-5.6-sol:high",
 	}),
 	profile("fable-opus-codex", ["anthropic", "openai-codex"], {
-		default: "anthropic/claude-fable-5:high",
+		default: "anthropic/claude-fable-5-1:high",
 		executor: "openai-codex/gpt-5.6-terra:medium",
 		planner: "anthropic/claude-opus-5:medium",
 		critic: "anthropic/claude-opus-5:high",

package/src/config/model-registry.ts

@@ -1192,6 +1192,7 @@ type CustomModelOverlay = {
 	wireModelId?: string;
 	requestTransform?: ModelRequestTransform;
 	cacheRetention?: CacheRetention;
+	transport?: Model<Api>["transport"];
 	isOAuth?: boolean;
 };
 
@@ -1303,6 +1304,7 @@ function buildCustomModelOverlay(
 	providerRequestTransform: ModelRequestTransform | undefined,
 	providerAuth: ProviderAuthMode | undefined,
 	providerCacheRetention: CacheRetention | undefined,
+	providerTransport: Model<Api>["transport"] | undefined,
 	modelDef: CustomModelDefinitionLike,
 ): CustomModelOverlay | undefined {
 	const api = modelDef.api ?? providerApi;
@@ -1331,6 +1333,7 @@ function buildCustomModelOverlay(
 		contextPromotionTarget: modelDef.contextPromotionTarget,
 		premiumMultiplier: modelDef.premiumMultiplier,
 		cacheRetention: modelDef.cacheRetention ?? providerCacheRetention,
+		transport: providerTransport,
 		isOAuth: resolveCustomModelIsOAuth(api, providerAuth),
 	};
 }
@@ -1466,6 +1469,7 @@ function finalizeCustomModel(model: CustomModelOverlay, options: CustomModelBuil
 		wireModelId: resolvedModel.wireModelId,
 		requestTransform: resolvedModel.requestTransform,
 		cacheRetention: resolvedModel.cacheRetention ?? reference?.cacheRetention,
+		transport: resolvedModel.transport,
 		premiumMultiplier: resolvedModel.premiumMultiplier,
 		isOAuth: resolvedModel.isOAuth,
 	} as Model<Api>);
@@ -2291,6 +2295,7 @@ export class ModelRegistry {
 					// re-merge bundled transport metadata here.
 					headers: customModel.headers,
 					compat: customModel.compat,
+					transport: customModel.transport,
 					contextPromotionTarget: customModel.contextPromotionTarget ?? existingModel.contextPromotionTarget,
 					wireModelId: customModel.wireModelId,
 					requestTransform: customModel.requestTransform,
@@ -4452,6 +4457,7 @@ export class ModelRegistry {
 					providerConfig.requestTransform,
 					(providerConfig.auth as ProviderAuthMode | undefined) ?? undefined,
 					providerConfig.cacheRetention,
+					providerConfig.transport,
 					modelDef as CustomModelDefinitionLike,
 				);
 				if (!model) continue;
@@ -4584,6 +4590,22 @@ export class ModelRegistry {
 	autoroutingProviderOrder(): readonly string[] {
 		return projectCatalogProviderOrder(getConfiguredProviderOrderFromSettings(), this.#models);
 	}
+
+	/**
+	 * Provider priority for automatic model selection. Explicit provider order
+	 * wins first, followed by omitted OAuth providers, then other providers;
+	 * catalog order breaks ties within each policy band.
+	 */
+	automaticProviderOrder(sessionId?: string): readonly string[] {
+		const policy = this.#buildProviderSelectionPolicy(sessionId);
+		return [...policy.orderedProviders()].sort((left, right) => {
+			const rankDifference = policy.rank(left) - policy.rank(right);
+			return rankDifference !== 0
+				? rankDifference
+				: policy.providerCatalogIndex(left) - policy.providerCatalogIndex(right);
+		});
+	}
+
 	#providerRankMap(policy: ProviderSelectionPolicy): Map<string, number> {
 		const providerRank = new Map<string, number>();
 		for (const provider of policy.orderedProviders()) {
@@ -5608,6 +5630,7 @@ export class ModelRegistry {
 					config.requestTransform,
 					undefined,
 					undefined,
+					config.transport,
 					modelDef as CustomModelDefinitionLike,
 				);
 				if (!overlay) {

package/src/config/model-resolver.ts

@@ -1580,6 +1580,11 @@ export async function findInitialModel(options: {
 			thinkingLevel = resolveThinkingLevelForModel(found, defaultThinkingSelector);
 			return { model, thinkingLevel, fallbackMessage: undefined };
 		}
+		return {
+			model: undefined,
+			thinkingLevel: undefined,
+			fallbackMessage: `Model ${defaultProvider}/${defaultModelId} not found`,
+		};
 	}
 
 	// 4. Try first available model with valid API key

package/src/config/settings-schema.ts

@@ -421,6 +421,12 @@ export const SETTINGS_SCHEMA = {
 		description: "Hard maximum runtime for an SDK prompt from acceptance, bounding progress-aware renewals.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 86_400_000,
 	},
+	"sdk.masterOrphanGraceMs": {
+		type: "number",
+		default: 120_000,
+		description: "Grace period before a master-spawned child orphaned by confirmed master loss is closed.",
+		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 3_600_000,
+	},
 
 	// Notifications (shared daemon with Telegram/Discord/Slack presentation adapters)
 	"notifications.enabled": { type: "boolean", default: false },
@@ -745,7 +751,7 @@ export const SETTINGS_SCHEMA = {
 	// ────────────────────────────────────────────────────────────────────────
 	"ui.language": {
 		type: "enum",
-		values: ["en", "ko", "ja"] as const,
+		values: ["en", "ko", "zh", "ja"] as const,
 		default: "en",
 		ui: {
 			tab: "appearance",
@@ -754,6 +760,7 @@ export const SETTINGS_SCHEMA = {
 			options: [
 				{ value: "en", label: "English" },
 				{ value: "ko", label: "Korean (한국어)" },
+				{ value: "zh", label: "Chinese (简体中文)" },
 				{ value: "ja", label: "Japanese (日本語)" },
 			],
 		},

package/src/config/settings.ts

@@ -748,6 +748,11 @@ export class Settings implements NotificationSettingsReader {
 		return !this.#persist || !this.#hasRecoveredConfigSyntax;
 	}
 
+	/** Whether this instance can publish a mutation to a durable config file. */
+	canPersistDurableConfig(): boolean {
+		return this.#persist && !this.#hasRecoveredConfigSyntax;
+	}
+
 	/**
 	 * Set a setting value (sync).
 	 * Updates global settings and reserves its background persistence slot before

package/src/coordinator-mcp/projection-scan.ts

@@ -36,6 +36,8 @@ function projectionPlatform(): NodeJS.Platform {
 
 /** Post-filter parse-candidate cap. Exhaustion returns an explicit incomplete result. */
 export const COORDINATOR_JSON_SCAN_CAP = 10_000;
+/** Number of fresh authoritative attempts allowed for a scan that observed churn. */
+export const COORDINATOR_JSON_SCAN_RETRY_ATTEMPTS = 3;
 
 export interface ProjectionScanStat {
 	size: number | bigint;
@@ -569,3 +571,22 @@ export async function listCoordinatorJsonFiles(
 		await authority?.close().catch(() => undefined);
 	}
 }
+
+/**
+ * Retry only scans invalidated by observed directory/file churn. A candidate cap,
+ * unsupported authority, parse error, or any other failure remains fail-closed.
+ * Each attempt acquires a new authority, so no partial result crosses attempts.
+ */
+export async function listCoordinatorJsonFilesWithRetry(
+	dir: string,
+	io: ProjectionScanFs = defaultFs,
+	cap: number = COORDINATOR_JSON_SCAN_CAP,
+	maxAttempts: number = COORDINATOR_JSON_SCAN_RETRY_ATTEMPTS,
+): Promise<ProjectionScanResult> {
+	const attempts = Math.max(1, Math.floor(maxAttempts));
+	let scan = await listCoordinatorJsonFiles(dir, io, cap);
+	for (let attempt = 1; attempt < attempts && scan.incomplete && scan.raced > 0; attempt++) {
+		scan = await listCoordinatorJsonFiles(dir, io, cap);
+	}
+	return scan;
+}

package/src/coordinator-mcp/question-state.ts

@@ -1029,7 +1029,7 @@ function assertTransaction(transaction: CoordinatorSessionTransactionV1, namespa
 		const rejectedHistorical = request.phase === "rejected";
 		if (
 			rejectedHistorical
-				? !request.safe_receipt || request.safe_receipt.status !== "rejected"
+				? request.safe_receipt?.status !== "rejected"
 				: question.answer_request_id !== request.request_id ||
 					question.claim_fence_epoch !== request.claim_fence_epoch
 		)
@@ -1083,7 +1083,7 @@ function assertTransaction(transaction: CoordinatorSessionTransactionV1, namespa
 			event.transaction_revision > transaction.revision ||
 			typeof event.kind !== "string" ||
 			event.kind.length === 0 ||
-			!["turn", "question", "report", "session", "deletion"].includes(event.entity) ||
+			!isOutboxEntity(event.entity) ||
 			typeof event.entity_id !== "string" ||
 			event.entity_id.length === 0 ||
 			!isRecord(event.payload) ||
@@ -1296,7 +1296,7 @@ export async function listCanonicalActiveSessions(
 		paths.registryLock,
 		async () => {
 			const registry = await readJson<NamespaceRegistryV1>(paths.registry);
-			if (!registry || registry.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
+			if (registry?.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
 				throw new Error("state_corrupt");
 			return Object.values(registry.roster ?? {})
 				.filter(entry => entry.active || entry.dirty)
@@ -1333,7 +1333,7 @@ export async function readDeliveryDiscoveryCursor(
 		paths.registryLock,
 		async () => {
 			const registry = await readJson<NamespaceRegistryV1>(paths.registry);
-			if (!registry || registry.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
+			if (registry?.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
 				throw new Error("state_corrupt");
 			return registry.delivery_discovery_cursor ?? "";
 		},
@@ -1660,7 +1660,7 @@ export async function startCreationRemote(
 ): Promise<CreationRequestV1> {
 	return await withNamespaceRegistry(paths, async registry => {
 		const request = registry.creations[keyDigest];
-		if (!request || !request.sidecar_verifier) throw new Error("state_corrupt");
+		if (!request?.sidecar_verifier) throw new Error("state_corrupt");
 		if (
 			request.phase === "claimed" &&
 			(request.sidecar_verifier.key_id !== expectedVerifier.key_id ||
@@ -1687,8 +1687,7 @@ export async function reconcileCreationRemoteVerifier(
 ): Promise<CreationRequestV1> {
 	return await withNamespaceRegistry(paths, async registry => {
 		const request = registry.creations[keyDigest];
-		if (!request || !request.sidecar_verifier || request.phase !== "remote_started")
-			throw new Error("terminal_uncertain");
+		if (!request?.sidecar_verifier || request.phase !== "remote_started") throw new Error("terminal_uncertain");
 		if (!/^[a-f0-9]{64}$/.test(usedKeyId)) throw new Error("terminal_uncertain");
 		if (usedKeyId === candidate.key_id) request.sidecar_verifier = candidate;
 		else if (usedKeyId !== request.sidecar_verifier.key_id) throw new Error("terminal_uncertain");
@@ -2241,7 +2240,7 @@ export async function enumeratePublicDeliveries(
 		paths.registryLock,
 		async () => {
 			const registry = await readJson<NamespaceRegistryV1>(paths.registry);
-			if (!registry || registry.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
+			if (registry?.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
 				throw new Error("state_corrupt");
 			return [...new Set([...Object.keys(registry.roster ?? {}), ...Object.keys(registry.retained_sessions ?? {})])]
 				.filter(name => COORDINATOR_SESSION_ID_PATTERN.test(name))
@@ -2526,7 +2525,7 @@ export async function replaceCreationRetirementIntent(
 		if (request.phase !== "remote_started" && request.phase !== "uncertain" && request.phase !== "retired")
 			throw new Error("retire_not_allowed");
 		const staged = request.retirement_intent;
-		if (!staged || staged.phase !== "intent" || staged.broker_proof) throw new Error("state_corrupt");
+		if (staged?.phase !== "intent" || staged.broker_proof) throw new Error("state_corrupt");
 		if (staged.retirement_key_digest !== retirementKeyDigest) throw new Error("idempotency_conflict");
 		assertCreationRetirementProofMatches(request, proof, false);
 		staged.phase = "pre_effect_rejected";
@@ -2716,8 +2715,7 @@ export async function removeSessionTransaction(
 				// exporter lease expires instead of deleting an undelivered event.
 				if (Object.values(transaction.outbox).some(event => event.public_delivery.state !== "acknowledged"))
 					return false;
-				await fs.rm(file, { force: true });
-				await syncCoordinatorDirectory(path.dirname(file));
+				await removeCoordinatorStateFile(file);
 				delete registry.roster?.[sessionId];
 				delete registry.retained_sessions?.[sessionId];
 				return true;