@gajae-code/coding-agent 0.15.6 → 0.16.1

package/src/config/settings.ts

@@ -70,6 +70,7 @@ import {
 	type GroupPrefix,
 	type GroupTypeMap,
 	getDefault,
+	normalizeConfigSchemaVersion,
 	reconcileSettingsSchema,
 	SETTINGS_SCHEMA,
 	type SettingPath,
@@ -748,6 +749,11 @@ export class Settings implements NotificationSettingsReader {
 		return !this.#persist || !this.#hasRecoveredConfigSyntax;
 	}
 
+	/** Whether this instance can publish a mutation to a durable config file. */
+	canPersistDurableConfig(): boolean {
+		return this.#persist && !this.#hasRecoveredConfigSyntax;
+	}
+
 	/**
 	 * Set a setting value (sync).
 	 * Updates global settings and reserves its background persistence slot before
@@ -1520,15 +1526,19 @@ export class Settings implements NotificationSettingsReader {
 				this.#hasInvalidNotificationGlobal = true;
 			}
 		}
+		// ONE normalized marker feeds every version decision (future-schema,
+		// migration-pending, and the ordered registry in #migrateRawSettings): a
+		// malformed value must never be read as a future schema here — which would
+		// skip legacy migration entirely — and as unmigrated by the registry.
+		const configSchemaVersion = normalizeConfigSchemaVersion(parsedRaw.configSchemaVersion);
 		this.#futureSchemaVersion =
 			filePath === this.#configPath &&
-			typeof parsedRaw.configSchemaVersion === "number" &&
-			parsedRaw.configSchemaVersion > CONFIG_SCHEMA_VERSION;
+			configSchemaVersion !== undefined &&
+			configSchemaVersion > CONFIG_SCHEMA_VERSION;
 
-		const configSchemaVersion = parsedRaw.configSchemaVersion;
 		if (
 			filePath === this.#configPath &&
-			(typeof configSchemaVersion !== "number" || configSchemaVersion < CONFIG_SCHEMA_VERSION)
+			(configSchemaVersion === undefined || configSchemaVersion < CONFIG_SCHEMA_VERSION)
 		) {
 			this.#schemaMigrationPending = true;
 		}
@@ -2082,7 +2092,7 @@ export class Settings implements NotificationSettingsReader {
 						return false;
 					}
 					const schemaVersion = (root as Record<string, unknown> | null | undefined)?.configSchemaVersion;
-					if (typeof schemaVersion === "number" && schemaVersion > CONFIG_SCHEMA_VERSION) {
+					if ((normalizeConfigSchemaVersion(schemaVersion) ?? 0) > CONFIG_SCHEMA_VERSION) {
 						this.#warnLegacyFallbackMigration(
 							`Settings: database workflow migration skipped: ${this.#configPath} is a future config schema (configSchemaVersion ${schemaVersion} > ${CONFIG_SCHEMA_VERSION}); leaving legacy rows for the next load`,
 						);
@@ -2333,7 +2343,7 @@ export class Settings implements NotificationSettingsReader {
 				// sets #futureSchemaVersion, so it must check the target schema
 				// itself and never patch it or consume the legacy source.
 				const targetSchemaVersion = (tx.root as Record<string, unknown> | null | undefined)?.configSchemaVersion;
-				if (typeof targetSchemaVersion === "number" && targetSchemaVersion > CONFIG_SCHEMA_VERSION) {
+				if ((normalizeConfigSchemaVersion(targetSchemaVersion) ?? 0) > CONFIG_SCHEMA_VERSION) {
 					this.#warnLegacyFallbackMigration(
 						`Settings: config-root workflow migration skipped: ${target} is a future config schema (configSchemaVersion ${targetSchemaVersion} > ${CONFIG_SCHEMA_VERSION})`,
 					);
@@ -3575,7 +3585,7 @@ export class Settings implements NotificationSettingsReader {
 				// read-only across Settings; never patch it (mirrors the config-root
 				// migration guard) so a future schema cannot inherit stale keys.
 				const targetSchemaVersion = (tx.root as Record<string, unknown> | null | undefined)?.configSchemaVersion;
-				if (typeof targetSchemaVersion === "number" && targetSchemaVersion > CONFIG_SCHEMA_VERSION) {
+				if ((normalizeConfigSchemaVersion(targetSchemaVersion) ?? 0) > CONFIG_SCHEMA_VERSION) {
 					this.#warnLegacyFallbackMigration(
 						`Settings: project workflow migration skipped: ${target} is a future config schema (configSchemaVersion ${targetSchemaVersion} > ${CONFIG_SCHEMA_VERSION})`,
 					);
@@ -4092,7 +4102,7 @@ export class Settings implements NotificationSettingsReader {
 		markerPath = `${source}.fallback-invalid`,
 	): Promise<void> {
 		const targetSchemaVersion = (tx.root as Record<string, unknown> | null | undefined)?.configSchemaVersion;
-		if (typeof targetSchemaVersion === "number" && targetSchemaVersion > CONFIG_SCHEMA_VERSION) return;
+		if ((normalizeConfigSchemaVersion(targetSchemaVersion) ?? 0) > CONFIG_SCHEMA_VERSION) return;
 		if (tx.root !== undefined && (tx.root === null || typeof tx.root !== "object" || Array.isArray(tx.root))) {
 			return;
 		}
@@ -4821,7 +4831,7 @@ export class Settings implements NotificationSettingsReader {
 				// guard) would rewrite configuration an older binary treats as
 				// read-only.
 				const targetSchemaVersion = (tx.root as Record<string, unknown> | null | undefined)?.configSchemaVersion;
-				if (typeof targetSchemaVersion === "number" && targetSchemaVersion > CONFIG_SCHEMA_VERSION) {
+				if ((normalizeConfigSchemaVersion(targetSchemaVersion) ?? 0) > CONFIG_SCHEMA_VERSION) {
 					return;
 				}
 				// Unset only while the target still matches the migration's fallback
@@ -5399,11 +5409,41 @@ export class Settings implements NotificationSettingsReader {
 
 	/** Apply registered schema migrations once, using configSchemaVersion as the durable marker. */
 	#migrateRawSettings(raw: RawSettings): RawSettings {
-		const configuredVersion = raw.configSchemaVersion;
+		const rawVersion = raw.configSchemaVersion;
+		const configuredVersion = normalizeConfigSchemaVersion(rawVersion);
+		if (rawVersion !== undefined && rawVersion !== configuredVersion) {
+			logger.warn("Settings: config has a malformed configSchemaVersion; migrating from the normalized version", {
+				configSchemaVersion: String(rawVersion),
+				normalized: String(configuredVersion),
+			});
+		}
 		if (configuredVersion === CONFIG_SCHEMA_VERSION) return raw;
 		if (typeof configuredVersion === "number" && configuredVersion > CONFIG_SCHEMA_VERSION) return raw;
 
-		// Migration registry v0 -> v1.
+		// Ordered migration registry. Each step runs ONLY for files below its
+		// target version: the v0 steps are not all idempotent (ask.timeout's
+		// milliseconds-to-seconds conversion would re-divide a valid v1 value),
+		// so a v1 file must skip straight to the v2 step.
+		const fromVersion = typeof configuredVersion === "number" ? configuredVersion : 0;
+		if (fromVersion < 1) this.#migrateRawSettingsV0ToV1(raw);
+		// v1 -> v2: interruptMode -> toolInterruptPolicy.
+		if (fromVersion < 2 && "interruptMode" in raw) {
+			if (!("toolInterruptPolicy" in raw)) {
+				const legacy = raw.interruptMode;
+				if (legacy === "wait") raw.toolInterruptPolicy = "finish_tools";
+				else if (legacy === "immediate") raw.toolInterruptPolicy = "abort_tools";
+				// Any other value is malformed: drop it and let the schema default apply.
+			}
+			delete raw.interruptMode;
+		}
+
+		raw.configSchemaVersion = CONFIG_SCHEMA_VERSION;
+
+		return raw;
+	}
+
+	/** v0 -> v1 transforms. Runs only for files that predate schema version 1. */
+	#migrateRawSettingsV0ToV1(raw: RawSettings): void {
 		// queueMode -> steeringMode
 		normalizeSessionDirectoryMigration(raw);
 		if ("queueMode" in raw && !("steeringMode" in raw)) {
@@ -5568,10 +5608,6 @@ export class Settings implements NotificationSettingsReader {
 				delete providersObj.imageCustomKeyEnv;
 			}
 		}
-
-		raw.configSchemaVersion = CONFIG_SCHEMA_VERSION;
-
-		return raw;
 	}
 
 	// ─────────────────────────────────────────────────────────────────────────

package/src/coordinator-mcp/projection-scan.ts

@@ -36,6 +36,8 @@ function projectionPlatform(): NodeJS.Platform {
 
 /** Post-filter parse-candidate cap. Exhaustion returns an explicit incomplete result. */
 export const COORDINATOR_JSON_SCAN_CAP = 10_000;
+/** Number of fresh authoritative attempts allowed for a scan that observed churn. */
+export const COORDINATOR_JSON_SCAN_RETRY_ATTEMPTS = 3;
 
 export interface ProjectionScanStat {
 	size: number | bigint;
@@ -193,10 +195,10 @@ function trimProjectionRootPath(dir: string): string {
 }
 
 /**
- * Windows has no descriptor-relative `openat` binding in Node. Keep the root pathname
- * authoritative by checking its identity before and after every mutable-path operation.
+ * Node exposes no descriptor-relative `openat` binding on Windows or macOS. Keep the
+ * root pathname authoritative by checking its identity around every path operation.
  */
-async function openProjectionDirectoryWindowsSafe(dir: string): Promise<ProjectionScanDirectory> {
+async function openProjectionDirectoryPathBracketed(dir: string): Promise<ProjectionScanDirectory> {
 	const rootPath = trimProjectionRootPath(dir);
 	let opened: import("node:fs").BigIntStats;
 	try {
@@ -224,8 +226,8 @@ async function openProjectionDirectoryWindowsSafe(dir: string): Promise<Projecti
 	};
 
 	const entryPath = (entry: string): string => {
-		// Directory entries come from readdir and are therefore single components on
-		// Windows. Keep the invariant explicit so an injected or corrupted entry can
+		// Directory entries come from readdir and are therefore single components.
+		// Keep the invariant explicit so an injected or corrupted entry can
 		// never turn a child operation into mutable pathname traversal.
 		if (
 			entry.length === 0 ||
@@ -288,7 +290,7 @@ async function openProjectionDirectoryWindowsSafe(dir: string): Promise<Projecti
  */
 async function openProjectionDirectorySafe(dir: string): Promise<ProjectionScanDirectory> {
 	const platform = projectionPlatform();
-	if (platform === "win32") return openProjectionDirectoryWindowsSafe(dir);
+	if (platform === "win32" || platform === "darwin") return openProjectionDirectoryPathBracketed(dir);
 	if (platform !== "linux") throw new ProjectionScanUnsupportedError();
 	const noFollow = fs.constants.O_NOFOLLOW;
 	const nonBlock = fs.constants.O_NONBLOCK;
@@ -569,3 +571,22 @@ export async function listCoordinatorJsonFiles(
 		await authority?.close().catch(() => undefined);
 	}
 }
+
+/**
+ * Retry only scans invalidated by observed directory/file churn. A candidate cap,
+ * unsupported authority, parse error, or any other failure remains fail-closed.
+ * Each attempt acquires a new authority, so no partial result crosses attempts.
+ */
+export async function listCoordinatorJsonFilesWithRetry(
+	dir: string,
+	io: ProjectionScanFs = defaultFs,
+	cap: number = COORDINATOR_JSON_SCAN_CAP,
+	maxAttempts: number = COORDINATOR_JSON_SCAN_RETRY_ATTEMPTS,
+): Promise<ProjectionScanResult> {
+	const attempts = Math.max(1, Math.floor(maxAttempts));
+	let scan = await listCoordinatorJsonFiles(dir, io, cap);
+	for (let attempt = 1; attempt < attempts && scan.incomplete && scan.raced > 0; attempt++) {
+		scan = await listCoordinatorJsonFiles(dir, io, cap);
+	}
+	return scan;
+}

package/src/coordinator-mcp/question-state.ts

@@ -1029,7 +1029,7 @@ function assertTransaction(transaction: CoordinatorSessionTransactionV1, namespa
 		const rejectedHistorical = request.phase === "rejected";
 		if (
 			rejectedHistorical
-				? !request.safe_receipt || request.safe_receipt.status !== "rejected"
+				? request.safe_receipt?.status !== "rejected"
 				: question.answer_request_id !== request.request_id ||
 					question.claim_fence_epoch !== request.claim_fence_epoch
 		)
@@ -1083,7 +1083,7 @@ function assertTransaction(transaction: CoordinatorSessionTransactionV1, namespa
 			event.transaction_revision > transaction.revision ||
 			typeof event.kind !== "string" ||
 			event.kind.length === 0 ||
-			!["turn", "question", "report", "session", "deletion"].includes(event.entity) ||
+			!isOutboxEntity(event.entity) ||
 			typeof event.entity_id !== "string" ||
 			event.entity_id.length === 0 ||
 			!isRecord(event.payload) ||
@@ -1296,7 +1296,7 @@ export async function listCanonicalActiveSessions(
 		paths.registryLock,
 		async () => {
 			const registry = await readJson<NamespaceRegistryV1>(paths.registry);
-			if (!registry || registry.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
+			if (registry?.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
 				throw new Error("state_corrupt");
 			return Object.values(registry.roster ?? {})
 				.filter(entry => entry.active || entry.dirty)
@@ -1333,7 +1333,7 @@ export async function readDeliveryDiscoveryCursor(
 		paths.registryLock,
 		async () => {
 			const registry = await readJson<NamespaceRegistryV1>(paths.registry);
-			if (!registry || registry.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
+			if (registry?.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
 				throw new Error("state_corrupt");
 			return registry.delivery_discovery_cursor ?? "";
 		},
@@ -1660,7 +1660,7 @@ export async function startCreationRemote(
 ): Promise<CreationRequestV1> {
 	return await withNamespaceRegistry(paths, async registry => {
 		const request = registry.creations[keyDigest];
-		if (!request || !request.sidecar_verifier) throw new Error("state_corrupt");
+		if (!request?.sidecar_verifier) throw new Error("state_corrupt");
 		if (
 			request.phase === "claimed" &&
 			(request.sidecar_verifier.key_id !== expectedVerifier.key_id ||
@@ -1687,8 +1687,7 @@ export async function reconcileCreationRemoteVerifier(
 ): Promise<CreationRequestV1> {
 	return await withNamespaceRegistry(paths, async registry => {
 		const request = registry.creations[keyDigest];
-		if (!request || !request.sidecar_verifier || request.phase !== "remote_started")
-			throw new Error("terminal_uncertain");
+		if (!request?.sidecar_verifier || request.phase !== "remote_started") throw new Error("terminal_uncertain");
 		if (!/^[a-f0-9]{64}$/.test(usedKeyId)) throw new Error("terminal_uncertain");
 		if (usedKeyId === candidate.key_id) request.sidecar_verifier = candidate;
 		else if (usedKeyId !== request.sidecar_verifier.key_id) throw new Error("terminal_uncertain");
@@ -2241,7 +2240,7 @@ export async function enumeratePublicDeliveries(
 		paths.registryLock,
 		async () => {
 			const registry = await readJson<NamespaceRegistryV1>(paths.registry);
-			if (!registry || registry.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
+			if (registry?.schema_version !== 1 || registry.namespace_id !== path.basename(paths.root))
 				throw new Error("state_corrupt");
 			return [...new Set([...Object.keys(registry.roster ?? {}), ...Object.keys(registry.retained_sessions ?? {})])]
 				.filter(name => COORDINATOR_SESSION_ID_PATTERN.test(name))
@@ -2526,7 +2525,7 @@ export async function replaceCreationRetirementIntent(
 		if (request.phase !== "remote_started" && request.phase !== "uncertain" && request.phase !== "retired")
 			throw new Error("retire_not_allowed");
 		const staged = request.retirement_intent;
-		if (!staged || staged.phase !== "intent" || staged.broker_proof) throw new Error("state_corrupt");
+		if (staged?.phase !== "intent" || staged.broker_proof) throw new Error("state_corrupt");
 		if (staged.retirement_key_digest !== retirementKeyDigest) throw new Error("idempotency_conflict");
 		assertCreationRetirementProofMatches(request, proof, false);
 		staged.phase = "pre_effect_rejected";
@@ -2716,8 +2715,7 @@ export async function removeSessionTransaction(
 				// exporter lease expires instead of deleting an undelivered event.
 				if (Object.values(transaction.outbox).some(event => event.public_delivery.state !== "acknowledged"))
 					return false;
-				await fs.rm(file, { force: true });
-				await syncCoordinatorDirectory(path.dirname(file));
+				await removeCoordinatorStateFile(file);
 				delete registry.roster?.[sessionId];
 				delete registry.retained_sessions?.[sessionId];
 				return true;

package/src/coordinator-mcp/server.ts

@@ -83,7 +83,7 @@ import {
 	requireCoordinatorMutation,
 	safeOpenCoordinatorArtifact,
 } from "./policy";
-import { listCoordinatorJsonFiles } from "./projection-scan";
+import { listCoordinatorJsonFilesWithRetry } from "./projection-scan";
 import {
 	answerBindingMatches,
 	buildCoordinatorAskAnswerSchema,
@@ -484,6 +484,18 @@ interface CoordinatorEventInput {
 }
 
 const UNOBSERVED_COMPENSATION_CODE = "broker_compensation_unobserved";
+const OBSERVED_BROKER_FAILURE_CODES = new Set([
+	"worktree_preparation_timeout",
+	"dependency_preparation_timeout",
+	"readiness_timeout",
+	"spawn_failed",
+	"worktree_in_use",
+	"startup_admission_timeout",
+	"startup_admission_refused",
+	"incarnation_unavailable",
+	"invalid_input",
+	"broker_request_unavailable",
+]);
 
 const MISSING_FINAL_RESPONSE_ADVISORY = "completion_missing_final_response";
 const PROMPT_ACK_TIMEOUT_REASON = "runtime_prompt_ack_timeout";
@@ -835,7 +847,7 @@ function toolSchema(name: CoordinatorToolName): {
 				properties: {
 					after_seq: { type: "integer", minimum: 0 },
 					session_id: sessionId,
-					event_types: { type: "array", items: { type: "string" } },
+					event_types: { type: "array", items: { type: "string", enum: [...COORDINATOR_EVENT_KINDS] } },
 					timeout_ms: {
 						type: "number",
 						description: "Bounded event long-poll timeout in milliseconds, capped at 30 seconds.",
@@ -1216,6 +1228,14 @@ const PUBLIC_ERROR_MESSAGES: Record<string, string> = {
 	broker_discovery_unavailable: "SDK broker discovery is unavailable.",
 	broker_request_unavailable: "SDK broker request is unavailable.",
 	broker_transport_unavailable: "SDK broker transport is unavailable.",
+	startup_admission_timeout: "SDK host startup was not admitted before the queue wait cutoff.",
+	startup_admission_refused: "SDK host startup was refused because the broker no longer owns the session root.",
+	worktree_in_use: "The requested worktree is already held by another live session.",
+	worktree_preparation_timeout: "Worktree preparation exceeded its deadline before the session host was spawned.",
+	dependency_preparation_timeout: "Dependency preparation exceeded its deadline before the session host was spawned.",
+	spawn_failed: "Session host could not be spawned.",
+	readiness_timeout: "Session did not become ready before the SDK readiness deadline.",
+	incarnation_unavailable: "OS process incarnation authority is unavailable.",
 	session_closing: "Coordinator session is closing.",
 	session_unavailable: "Coordinator session is unavailable.",
 	session_not_activatable: "Coordinator session cannot be activated.",
@@ -1498,7 +1518,7 @@ function publicSdkAcknowledgement(result: RuntimePromptAcknowledgement): Record<
 }
 
 async function listJsonFiles(dir: string): Promise<unknown[]> {
-	const scan = await listCoordinatorJsonFiles(dir);
+	const scan = await listCoordinatorJsonFilesWithRetry(dir);
 	if (scan.capped) throw new Error("coordinator_projection_scan_incomplete");
 	if (scan.skippedEmpty > 0 || scan.skippedDebris > 0) {
 		logger.warn("Coordinator projection scan skipped debris", {
@@ -1530,7 +1550,10 @@ function brokerSessionId(record: Record<string, unknown>): string | null {
 }
 
 function brokerSessionScope(record: Record<string, unknown>): string | null {
-	return firstString(asRecord(record.locator) ?? {}, ["repo"]);
+	// Locator v2 records the canonical workspace directory as `cwd`; the removed
+	// `repo` field is never translated, so reading it here silently dropped every
+	// broker row and failed open with an empty scoped listing.
+	return firstString(asRecord(record.locator) ?? {}, ["cwd"]);
 }
 
 function sameCanonicalPath(left: string, right: string, platform: NodeJS.Platform): boolean {
@@ -2634,11 +2657,6 @@ async function writeActiveTurn(namespaceDir: string, turn: TurnRecord): Promise<
 	});
 }
 
-async function clearActiveTurn(namespaceDir: string, turn: TurnRecord): Promise<void> {
-	const active = asRecord(await readJsonFile(activeTurnFile(namespaceDir, turn.session_id)));
-	if (active?.turn_id === turn.turn_id) await removeCoordinatorFile(activeTurnFile(namespaceDir, turn.session_id));
-}
-
 async function readSessionState(namespaceDir: string, sessionId: string): Promise<CoordinatorSessionState | null> {
 	return (await readJsonFile(sessionStateFile(namespaceDir, sessionId))) as CoordinatorSessionState | null;
 }
@@ -2658,9 +2676,6 @@ async function writeSessionStateUnlocked(
 	} = {},
 ): Promise<CoordinatorSessionState> {
 	const persisted = await readSessionState(namespaceDir, sessionId);
-	const session = asRecord(
-		await readJsonFile(path.join(namespaceDir, "sessions", `${safeExternalId("session", sessionId)}.json`)),
-	);
 	// An overwrite is a canonical lifecycle repair, not proof that tool activity ended.
 	const previous = options.overwrite ? null : persisted;
 	const hasCurrentTurn = Object.hasOwn(options, "currentTurnId");
@@ -5044,6 +5059,58 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 		const keyDigest = createHash("sha256").update(idempotencyKey).digest("hex");
 		return path.join(namespaceDir, "idempotency", `${keyDigest}.json`);
 	}
+	const idempotencyFlights = new Map<string, { requestDigest: string; promise: Promise<Record<string, unknown>> }>();
+	type IdempotencyFlightAdmission =
+		| { kind: "conflict"; response: Record<string, unknown> }
+		| { kind: "joined"; promise: Promise<Record<string, unknown>> }
+		| { kind: "owner"; run: (operation: Promise<Record<string, unknown>>) => Promise<Record<string, unknown>> };
+	function admitIdempotencyFlight(
+		tool: string,
+		idempotencyKey: string,
+		canonicalArgs: Record<string, unknown>,
+	): IdempotencyFlightAdmission {
+		const keyDigest = createHash("sha256").update(idempotencyKey).digest("hex");
+		const requestDigest = createHash("sha256")
+			.update(canonicalJson({ tool, args: canonicalArgs }))
+			.digest("hex");
+		const existingFlight = idempotencyFlights.get(keyDigest);
+		if (existingFlight) {
+			if (existingFlight.requestDigest !== requestDigest)
+				return {
+					kind: "conflict",
+					response: {
+						ok: false,
+						error: { code: "idempotency_conflict", message: "idempotency key was used with a different request" },
+					},
+				};
+			return { kind: "joined", promise: existingFlight.promise };
+		}
+		const result = Promise.withResolvers<Record<string, unknown>>();
+		const flight = { requestDigest, promise: result.promise };
+		idempotencyFlights.set(keyDigest, flight);
+		return {
+			kind: "owner",
+			run: async operation => {
+				void operation.then(result.resolve, result.reject);
+				try {
+					return await result.promise;
+				} finally {
+					if (idempotencyFlights.get(keyDigest) === flight) idempotencyFlights.delete(keyDigest);
+				}
+			},
+		};
+	}
+	async function withIdempotencyFlight(
+		tool: string,
+		idempotencyKey: string,
+		canonicalArgs: Record<string, unknown>,
+		operation: () => Promise<Record<string, unknown>>,
+	): Promise<Record<string, unknown>> {
+		const admission = admitIdempotencyFlight(tool, idempotencyKey, canonicalArgs);
+		if (admission.kind === "conflict") return admission.response;
+		if (admission.kind === "joined") return await admission.promise;
+		return await admission.run(operation());
+	}
 	async function withOrderedSessionStateLocks<T>(
 		lockFiles: readonly string[],
 		operation: () => Promise<T>,
@@ -5075,6 +5142,7 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 		recoverInProgress = false,
 		isNonterminal: (response: Record<string, unknown>) => boolean = isRouterRequestAmbiguous,
 		lockAlreadyHeld = false,
+		flightAlreadyOwned = false,
 	): Promise<Record<string, unknown>> {
 		const keyDigest = createHash("sha256").update(idempotencyKey).digest("hex");
 		const requestDigest = createHash("sha256")
@@ -5179,7 +5247,11 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			});
 			return response;
 		};
-		return lockAlreadyHeld ? execute() : withSessionStateLock(lockFile, execute);
+		const executeWithLock = async (): Promise<Record<string, unknown>> =>
+			lockAlreadyHeld ? await execute() : await withSessionStateLock(lockFile, execute);
+		return flightAlreadyOwned
+			? await executeWithLock()
+			: await withIdempotencyFlight(tool, idempotencyKey, canonicalArgs, executeWithLock);
 	}
 
 	async function brokerSession(
@@ -5268,7 +5340,7 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 		} catch (error) {
 			const sessionId = remoteSession.value;
 			if (!sessionId) {
-				if (error instanceof SdkClientError && error.code === "broker_request_unavailable") throw error;
+				if (error instanceof SdkClientError && OBSERVED_BROKER_FAILURE_CODES.has(error.code)) throw error;
 				throw new SdkClientError(
 					UNOBSERVED_COMPENSATION_CODE,
 					"Coordinator creation outcome could not be identified for cleanup.",
@@ -5281,11 +5353,28 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 					sessionId,
 				);
 			} catch (closeError) {
-				throw new SdkClientError(
-					UNOBSERVED_COMPENSATION_CODE,
-					`Coordinator creation failed after remote session ${sessionId} was created, and compensation failed.`,
-					{ primary: error, compensation: closeError, session_id: sessionId },
-				);
+				let listed: Record<string, unknown>;
+				try {
+					listed = await paginatedBrokerSessionList(cwd, { cwd });
+				} catch (listError) {
+					throw new SdkClientError(
+						UNOBSERVED_COMPENSATION_CODE,
+						`Coordinator creation failed after remote session ${sessionId} was created, and compensation failed.`,
+						{ primary: error, compensation: closeError, list: listError, session_id: sessionId },
+					);
+				}
+				const rows = jsonRecords(Array.isArray(listed.sessions) ? listed.sessions : []);
+				const row = rows.find(candidate => brokerSessionId(candidate) === sessionId);
+				const deadUncertain =
+					row !== undefined &&
+					row.live !== true &&
+					(row.terminalUncertain === true || (row as Record<string, unknown>).terminal_uncertain === true);
+				if (!deadUncertain)
+					throw new SdkClientError(
+						UNOBSERVED_COMPENSATION_CODE,
+						`Coordinator creation failed after remote session ${sessionId} was created, and compensation failed.`,
+						{ primary: error, compensation: closeError, session_id: sessionId },
+					);
 			}
 			throw error;
 		}
@@ -6713,7 +6802,7 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 					// any stale pointer directly: once the turn projection is rewritten
 					// terminal, readActiveTurn() intentionally rejects it and cannot
 					// discover the legacy active-turn file to clear.
-					await fs.rm(activeTurnFile(namespaceDir, sessionId), { force: true });
+					await removeCoordinatorFile(activeTurnFile(namespaceDir, sessionId));
 				}
 				// A runtime sidecar can advance a live session while the canonical WAL still
 				// needs projection repair. Preserve that observed lifecycle state (and its
@@ -8780,7 +8869,10 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 						code === "live_session"
 					);
 				};
-				return await withOrderedSessionStateLocks(
+				const flight = admitIdempotencyFlight(name, retirementKey, canonicalArgs);
+				if (flight.kind === "conflict") return flight.response;
+				if (flight.kind === "joined") return await flight.promise;
+				const retirementOperation = withOrderedSessionStateLocks(
 					[idempotencyLockFile(creationKey), idempotencyLockFile(retirementKey)],
 					async () =>
 						await withToolIdempotency(
@@ -8964,8 +9056,10 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 							true,
 							isRetirementRetryable,
 							true,
+							true,
 						),
 				);
+				return await flight.run(retirementOperation);
 			}
 			if (name === "gjc_coordinator_activate_session") {
 				requireCoordinatorMutation(config, "sessions", args);

package/src/crash/index-store.ts

@@ -613,6 +613,7 @@ export function applyCrashEvent(index: CrashIndex, event: CrashEvent, now: numbe
 	}
 
 	// occurrence
+	if (event.provenance === "eval" || event.provenance === "bun_test") return false;
 	// Clear before deduplication: a replayed occurrence after main-index publish
 	// but before retirement-sidecar publish must still supersede a stale tombstone.
 	index.retiredFingerprints = index.retiredFingerprints.filter(fingerprint => fingerprint !== event.fingerprint);
@@ -698,6 +699,7 @@ async function recoverAndRecomputeRetainedCounts(index: CrashIndex, crashLogPath
 	const recordsByFingerprint = new Map<string, LoadedCrashRecord[]>();
 	const seenRecordIds = new Set<string>();
 	for (const record of parseRecoverableCrashRecords(contents)) {
+		if (record.provenance === "eval" || record.provenance === "bun_test") continue;
 		if (seenRecordIds.has(record.recordId)) continue;
 		seenRecordIds.add(record.recordId);
 		const records = recordsByFingerprint.get(record.fingerprint) ?? [];

package/src/crash/record-loader.ts

@@ -15,6 +15,7 @@ import {
 	CRASH_FINGERPRINT_VERSION,
 	CRASH_RECORD_MARKER,
 	type CrashFingerprint,
+	type CrashProvenance,
 	computeCrashFingerprint,
 	parseCrashRecordMarker,
 } from "@gajae-code/utils";
@@ -33,6 +34,7 @@ export interface LoadedCrashRecord {
 	readonly body: string;
 	/** The `Name: message` part of the header line. */
 	readonly headline: string;
+	readonly provenance?: CrashProvenance;
 }
 
 interface ParsedCrashRecord {
@@ -78,6 +80,7 @@ function parseCandidates(contents: string): ParsedCrashRecord[] {
 	let at = 0;
 	let buffer: string[] = [];
 	let started = false;
+	let provenance: CrashProvenance | undefined;
 	let pending: ParsedCrashRecord | undefined;
 	for (const line of contents.split("\n")) {
 		if (pending) {
@@ -92,6 +95,12 @@ function parseCandidates(contents: string): ParsedCrashRecord[] {
 				continue;
 			}
 			headline = header[2] ?? "";
+			const label = line.slice(line.indexOf("[") + 1, line.indexOf("]"));
+			const provenanceValue = label
+				.split(";")
+				.find(part => part.startsWith("provenance="))
+				?.slice(11);
+			provenance = provenanceValue === "eval" || provenanceValue === "bun_test" ? provenanceValue : undefined;
 			at = parsedAt;
 			buffer = [];
 			started = true;
@@ -116,6 +125,7 @@ function parseCandidates(contents: string): ParsedCrashRecord[] {
 						messageClass: fingerprint?.messageClass ?? "",
 						body: lines.join("\n").trimEnd(),
 						headline,
+						...(provenance === undefined ? {} : { provenance }),
 					},
 					complete: false,
 					bound: marker.version === CRASH_FINGERPRINT_VERSION && fingerprint !== undefined,

package/src/defaults/gjc/skills/deep-interview/SKILL.md

@@ -378,7 +378,7 @@ Auto-answer has a clarity cap: unless the architect confidence is `high` and unc
 
 When the user's answer is free-text that carries reasoning, constraints, or scope decisions, do not forward it to scoring as a lossy one-line label. First structure it into a compact interpretation using the canonical sections — **Decision**, **Reasoning**, **Constraints (user-stated)**, **Out of scope (user-stated)**, and **Codebase context (verified)** (omit empty sections). Then confirm with exactly one `ask` that nothing is lost or misrepresented: the `ask` question body MUST render the full structured interpretation — every non-empty canonical section, verbatim — before the confirmation prompt. The user is approving that specific interpretation, so it must be visible inside the question body; never ask "does this capture it?" / "이 해석이 맞아?" without first displaying the interpretation itself. A confirmation `ask` whose body omits the interpretation it is asking about is a hard error: re-issue it with the interpretation shown. Apply `language.instruction` when present.
 
-Offer options such as **Send as-is**, **Add a constraint**, **Mark something out of scope**, **Add context**, and **Rewrite**, plus free-text. If the user picks anything other than "Send as-is", collect the exact missing text with one follow-up `ask` (never infer it from the option label), fold it into the structured interpretation, and re-confirm. Do not advance to scoring while the user is still saying something is missing.
+Offer options such as **Send as-is**, **Add a constraint**, **Mark something out of scope**, **Add context**, and **Rewrite**, plus free-text through the Ask UI's automatic Other/custom-input control. Never add the automatic custom-input label or a pseudo-option that imitates it, such as **Other (type your own)**, **Other (specify)**, **type your own**, **custom input**, **직접 입력**, or **직접 입력으로 추가**; a plain domain value such as **Other** is valid when it is a genuine answer, not a request for free text, and none of these custom-input labels may receive `recommended`. If the user picks anything other than "Send as-is", collect the exact missing text with one follow-up `ask` whose question body asks for the text and whose options are only real non-custom choices such as cancel/keep-current (never infer it from the option label), fold it into the structured interpretation, and re-confirm. Do not advance to scoring while the user is still saying something is missing.
 
 Skip Refine for short answers with no attached reasoning (e.g. "Yes" / "No" / a single proper noun), for pre-built option picks where the structure is already explicit, for auto-confirmed code/brownfield facts, and for architect auto-answers (already structured by Step 2b′). A refined answer counts as direct user judgment: record the round in `refined_rounds` and reset `auto_answer_streak` to 0. Feed the confirmed structured interpretation — not the raw free text — into Step 2c scoring and established-facts maintenance.