@gajae-code/coding-agent 0.15.6 → 0.16.1

package/src/config/billing-path.ts

@@ -0,0 +1,42 @@
+/**
+ * Billing path for a resolved binding's credential source — audit-reversible.
+ * Derived from (model.api, credential-provenance) where the binding actually
+ * resolves credentials, not from a provider-name allowlist.
+ */
+import type { Api } from "@gajae-code/ai/core";
+import type { EffectiveProviderAuth } from "./provider-selection-policy";
+
+/**
+ * Label shown in the selector row + active-model line. Only the category is
+ * disclosed (never the key material or project id).
+ */
+export type BillingPathKind = "metered-api" | "cloud-project" | "bundled";
+
+export interface BillingPath {
+	kind: BillingPathKind;
+	/** Stable per-credential-source key for one-time notice dismissal. */
+	dismissKey: string;
+	label: string;
+}
+
+/**
+ * Derive from the concrete binding (api + credential provenance).
+ * - oauth/keyless/unknown => bundled (plan/proxied/kNoAuth-like)
+ * - key + cloud-project api (google-vertex / bedrock) => cloud-project
+ * - key + any other api (including custom OpenAI-compatible) => metered-api
+ */
+export function deriveBillingPath(
+	provider: string,
+	api: Api | string | undefined,
+	effectiveAuth: EffectiveProviderAuth,
+): BillingPath | undefined {
+	if (effectiveAuth === "oauth" || effectiveAuth === "keyless" || effectiveAuth === "unknown") return undefined;
+	if (effectiveAuth !== "key") return undefined;
+	const apiKind = typeof api === "string" ? api : undefined;
+	const cloudApis = new Set(["google-vertex", "bedrock-converse-stream"]);
+	const isCloud = apiKind ? cloudApis.has(apiKind) : false;
+	const kind: BillingPathKind = isCloud ? "cloud-project" : "metered-api";
+	const label = kind === "cloud-project" ? "cloud-project billing" : "metered API";
+	const dismissKey = `${kind}:${provider.trim().toLowerCase()}`;
+	return { kind, dismissKey, label };
+}

package/src/config/config-schema-version.ts

@@ -7,4 +7,21 @@
  * this dependency-light module so the resolver can import it without pulling in
  * the TUI/AI-heavy settings schema.
  */
-export const CONFIG_SCHEMA_VERSION = 1;
+export const CONFIG_SCHEMA_VERSION = 2;
+
+/**
+ * Normalize a durable `configSchemaVersion` marker into a comparable version.
+ *
+ * Every version decision (future-schema detection, migration-pending state, and
+ * the ordered migration registry) must read the SAME normalized value: a
+ * malformed marker read as a future schema by one guard and as unmigrated by
+ * the next would skip legacy migrations while still re-running v0 transforms.
+ * A finite malformed value floors to the nearest completed version; a
+ * non-finite or non-numeric one carries no version information and normalizes
+ * to 0 (fully unmigrated). `undefined` stays `undefined` (no marker written).
+ */
+export function normalizeConfigSchemaVersion(value: unknown): number | undefined {
+	if (value === undefined) return undefined;
+	if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+	return Math.max(0, Math.floor(value));
+}

package/src/config/file-lock.ts

@@ -1,9 +1,9 @@
 import * as crypto from "node:crypto";
-import type { BigIntStats, Stats } from "node:fs";
+import type { BigIntStats } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import type { NativeDirectoryTreeResult, NativeExactUnlinkResult } from "@gajae-code/natives";
-import { renameNoReplacePathAsync } from "@gajae-code/natives";
+import type { NativeDirectoryTreeResult, NativeExactUnlinkResult, NativeNoReplaceResult } from "@gajae-code/natives";
+import { renameDirectoryNoReplacePathAsync, renameNoReplacePathAsync } from "@gajae-code/natives";
 import { isEnoent } from "@gajae-code/utils/fs-error";
 import { nativeProcessBindings } from "@gajae-code/utils/native-process";
 
@@ -49,6 +49,10 @@ type LockInfo = FileLockOwnerToken;
 
 export const FileLockTestHooks: {
 	afterParentMkdir?: (lockPath: string) => void | Promise<void>;
+	nativePublicationBindings?: () => {
+		renameNoReplacePathAsync: typeof renameNoReplacePathAsync;
+		renameDirectoryNoReplacePathAsync: typeof renameDirectoryNoReplacePathAsync;
+	};
 	nativeQuarantineBindings?: () => NativeFileLockBindings;
 } = {};
 
@@ -423,6 +427,118 @@ async function ensureLockParent(directory: string): Promise<void> {
 	}
 }
 
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		!Array.isArray(value) &&
+		Object.getPrototypeOf(value) === Object.prototype
+	);
+}
+
+function isValidNativeNoReplaceResult(value: unknown): value is NativeNoReplaceResult {
+	if (!isPlainRecord(value)) return false;
+	const expectedKeys = [
+		"ok",
+		"code",
+		"mutationState",
+		"durabilityState",
+		"reason",
+		"primitive",
+		"phase",
+		"diagnostic",
+	];
+	if (Object.keys(value).some(key => !expectedKeys.includes(key))) return false;
+	if (
+		typeof value.ok !== "boolean" ||
+		(value.code !== undefined && (typeof value.code !== "string" || !/^[a-z0-9_]{1,64}$/.test(value.code))) ||
+		!(["not_committed", "committed", "unknown"] as const).includes(value.mutationState as never) ||
+		!(["not_attempted", "proven", "not_provable"] as const).includes(value.durabilityState as never) ||
+		!(
+			[
+				"none",
+				"destination_exists",
+				"atomic_unavailable",
+				"cross_device",
+				"permission_denied",
+				"io_failure",
+				"invalid_request",
+				"interrupted",
+				"identity_violation",
+				"durability_not_provable",
+				"unknown",
+			] as const
+		).includes(value.reason as never) ||
+		!(
+			[
+				"renameat2_noreplace",
+				"linkat_noreplace",
+				"mkdirat_renameat_noreplace",
+				"renameatx_np_excl",
+				"windows_rename_noreplace",
+				"unsupported",
+				"unknown",
+			] as const
+		).includes(value.primitive as never) ||
+		!(
+			[
+				"preflight",
+				"file_sync",
+				"rename",
+				"source_unlink",
+				"source_parent_sync",
+				"destination_parent_sync",
+				"terminal_identity",
+				"complete",
+				"unknown",
+			] as const
+		).includes(value.phase as never)
+	)
+		return false;
+	if (!isPlainRecord(value.diagnostic)) return false;
+	if (
+		Object.keys(value.diagnostic).some(
+			key => !["schemaVersion", "collectionState", "osCode", "syncFailures"].includes(key),
+		) ||
+		value.diagnostic.schemaVersion !== 1 ||
+		!(["complete", "partial", "unavailable"] as const).includes(value.diagnostic.collectionState as never) ||
+		(value.diagnostic.osCode !== undefined &&
+			(typeof value.diagnostic.osCode !== "number" || !Number.isInteger(value.diagnostic.osCode))) ||
+		(value.diagnostic.syncFailures !== undefined && !Array.isArray(value.diagnostic.syncFailures))
+	)
+		return false;
+	if (value.ok)
+		return (
+			value.mutationState === "committed" &&
+			value.reason === "none" &&
+			value.phase === "complete" &&
+			(value.durabilityState === "not_attempted" || value.durabilityState === "proven")
+		);
+	if (value.mutationState === "not_committed") return value.durabilityState === "not_attempted";
+	return value.mutationState === "unknown" && value.durabilityState === "not_provable";
+}
+
+/**
+ * Only a complete native envelope proving that no namespace mutation happened
+ * may authorize the directory fallback. A legacy or malformed result is
+ * treated as an unknown publication outcome and never followed by another
+ * mutating primitive.
+ */
+function isPreMutationUnsupportedRenameResult(value: unknown): value is NativeNoReplaceResult {
+	if (!isValidNativeNoReplaceResult(value)) return false;
+	if (
+		value.ok !== false ||
+		(value.code !== "invalid_request" && value.code !== "atomic_unavailable") ||
+		value.mutationState !== "not_committed" ||
+		value.durabilityState !== "not_attempted" ||
+		value.reason !== value.code ||
+		(value.primitive !== "renameat2_noreplace" && value.primitive !== "renameatx_np_excl") ||
+		(value.phase !== "preflight" && value.phase !== "rename")
+	)
+		return false;
+	return true;
+}
+
 async function localLockKey(lockPath: string): Promise<string> {
 	try {
 		return normalizeLockKey(await fs.realpath(lockPath));
@@ -452,17 +568,9 @@ function ownerIncarnationChanged(owner: FileLockOwnerToken, startTimeCache?: Map
 /** Outcome of a guarded lock-dir removal attempt (`removeFileLockDirForGc`). */
 export type FileLockGcRemoval = "removed" | "owner_changed" | "missing" | "cleanup_failed";
 
-interface LockDirStatToken {
-	dev: number;
-	ino: number;
-	mtimeMs: number;
-	ctimeMs: number;
-}
-
 type LockStaleSnapshot =
 	| { stale: false }
-	| { stale: true; owner: FileLockOwnerToken; identity: GenericFileLockDirIdentity }
-	| { stale: true; owner: null; stat: LockDirStatToken };
+	| { stale: true; owner: FileLockOwnerToken; identity: GenericFileLockDirIdentity };
 
 /** Identity evidence carried by the generic stale verdict into a later removal. */
 export interface GenericFileLockDirIdentity {
@@ -634,22 +742,9 @@ function ownerLiveness(pid: number): OwnerLiveness {
 	}
 }
 
-function statToken(stats: Stats): LockDirStatToken {
-	return {
-		dev: stats.dev,
-		ino: stats.ino,
-		mtimeMs: stats.mtimeMs,
-		ctimeMs: stats.ctimeMs,
-	};
-}
-
-function sameStatToken(a: LockDirStatToken, b: LockDirStatToken): boolean {
-	return a.dev === b.dev && a.ino === b.ino && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
-}
-
 async function staleLockSnapshot(
 	lockPath: string,
-	staleMs: number,
+	_staleMs: number,
 	ownerHostId?: string,
 	previousOwnerHostIds: readonly string[] = [],
 	startTimeCache?: Map<string, string | null>,
@@ -673,26 +768,12 @@ async function staleLockSnapshot(
 		if (isTransientReleaseError(error)) return { stale: false };
 		throw error;
 	}
-	if (!info && ownerHostId !== undefined) return { stale: false };
 	if (!info) {
-		// A present but malformed owner record is not equivalent to a lock directory
-		// caught between mkdir and metadata publication. Refuse stale fallback when the
-		// metadata path exists: an unreadable live holder must never be reclaimed by
-		// elapsed mtime alone.
-		try {
-			await fs.lstat(path.join(lockPath, "info"));
-			return { stale: false };
-		} catch (error) {
-			if (!isEnoent(error)) throw error;
-		}
-		try {
-			const stats = await fs.stat(lockPath);
-			if (Date.now() - stats.mtimeMs <= staleMs) return { stale: false };
-			return { stale: true, owner: null, stat: statToken(stats) };
-		} catch (err) {
-			if (isEnoent(err)) return { stale: false };
-			throw err;
-		}
+		// A directory without a valid owner record is either a contender between
+		// native mkdirat ownership and metadata publication, or malformed/foreign
+		// state. Neither case carries enough identity evidence for stale removal;
+		// elapsed mtime must never make this empty namespace reclaimable.
+		return { stale: false };
 	}
 
 	// A host-qualified lock may only be reclaimed after proving that its owner is
@@ -741,38 +822,7 @@ async function staleLockSnapshot(
 
 async function removeStaleLockForAcquire(lockPath: string, snapshot: LockStaleSnapshot): Promise<boolean> {
 	if (!snapshot.stale) return false;
-	if (snapshot.owner) {
-		return (await removeFileLockDirForGc(lockPath, snapshot.owner, snapshot.identity)) === "removed";
-	}
-
-	let currentInfo: LockInfo | null;
-	try {
-		currentInfo = await readLockInfo(lockPath);
-	} catch (error) {
-		if (isTransientReleaseError(error)) return false;
-		throw error;
-	}
-	if (currentInfo) return false;
-	try {
-		const currentStats = await fs.lstat(lockPath);
-		if (currentStats.isSymbolicLink() || !currentStats.isDirectory()) return false;
-		if (!sameStatToken(statToken(currentStats), snapshot.stat)) return false;
-		const nativeCapturePath = await canonicalLockPathPreservingFinal(lockPath);
-		const captured = nativeFileLockBindings().snapshotDirectoryTree(nativeCapturePath);
-		if (captured.code === "sharing_violation") throwTransientNativeResult(captured.code);
-		if (!captured.ok || !captured.snapshot) return false;
-		if (
-			captured.snapshot.rootDev !== String(currentStats.dev) ||
-			captured.snapshot.rootIno !== String(currentStats.ino)
-		)
-			return false;
-		const removed = nativeFileLockBindings().exactRemoveDirectoryTree(nativeCapturePath, captured.snapshot);
-		return removed.ok || removed.code === "not_found";
-	} catch (err) {
-		if (isEnoent(err)) return false;
-		if (isTransientReleaseError(err)) return false;
-		throw err;
-	}
+	return (await removeFileLockDirForGc(lockPath, snapshot.owner, snapshot.identity)) === "removed";
 }
 
 /**
@@ -812,7 +862,7 @@ export async function genericFileLockDirStaleVerdict(
 	ownerHostId?: string,
 ): Promise<GenericFileLockDirStaleVerdict> {
 	const verdict = await staleLockSnapshot(lockDir, staleMs, ownerHostId);
-	if (!verdict.stale || verdict.owner === null) return { stale: false };
+	if (!verdict.stale) return { stale: false };
 	return {
 		stale: true,
 		identity: verdict.identity,
@@ -841,11 +891,32 @@ async function tryAcquireLock(
 		// already-created staging entry and its parent before publication so aliases
 		// retain the same lock identity as the ordinary path.
 		const canonicalParent = await fs.realpath(path.dirname(lockPath));
-		const published = await renameNoReplacePathAsync(
-			await fs.realpath(pendingPath),
-			path.join(canonicalParent, path.basename(lockPath)),
-		);
-		if (!published.ok) {
+		const destinationPath = path.join(canonicalParent, path.basename(lockPath));
+		// Resolve only the stable parent: resolving the mutable staging final
+		// component would follow an attacker-replaced symlink before native no-follow
+		// validation gets a chance to reject it.
+		const canonicalPendingPath = path.join(canonicalParent, path.basename(pendingPath));
+		const publication = FileLockTestHooks.nativePublicationBindings?.() ?? {
+			renameNoReplacePathAsync,
+			renameDirectoryNoReplacePathAsync,
+		};
+		const published = await publication.renameNoReplacePathAsync(canonicalPendingPath, destinationPath);
+		let publishedSuccessfully = published.ok;
+		if (!published.ok && isPreMutationUnsupportedRenameResult(published)) {
+			const fallback = await publication.renameDirectoryNoReplacePathAsync(canonicalPendingPath, destinationPath);
+			if (fallback.ok) {
+				publishedSuccessfully = true;
+			} else if (fallback.reason === "destination_exists") {
+				return null;
+			} else {
+				const failure = new Error(
+					`Failed to publish file lock: ${fallback.code ?? fallback.reason ?? "unknown"}.`,
+				) as NodeJS.ErrnoException;
+				if (fallback.code) failure.code = fallback.code;
+				throw failure;
+			}
+		}
+		if (!publishedSuccessfully) {
 			if (published.reason === "destination_exists") return null;
 			const failure = new Error(
 				`Failed to publish file lock: ${published.code ?? published.reason ?? "unknown"}.`,
@@ -1103,6 +1174,10 @@ async function lockHolderDescription(lockPath: string): Promise<string> {
 }
 
 async function acquireLock(filePath: string, options: FileLockOptions = {}): Promise<() => Promise<void>> {
+	const requestedFilePath: unknown = filePath;
+	if (typeof requestedFilePath !== "string" || requestedFilePath.length === 0 || !path.isAbsolute(requestedFilePath))
+		throw new TypeError("filePath must be a non-empty absolute path");
+	if (requestedFilePath.includes("\0")) throw new TypeError("filePath must not contain NUL bytes");
 	if (options.ownerHostId !== undefined && !options.ownerHostId) throw new Error("ownerHostId must be non-empty");
 	if (options.previousOwnerHostIds?.some(hostId => !hostId))
 		throw new Error("previousOwnerHostIds must contain only non-empty identities");

package/src/config/model-preset-registry.ts

@@ -47,6 +47,7 @@ const MODEL_PRESET_REGISTRY_MAX_STATE_BYTES = 32 * 1024 * 1024;
 const MODEL_PRESET_REGISTRY_MAX_HISTORY = 4;
 const MODEL_PRESET_REGISTRY_MAX_RETENTION_ANCESTRY = 64;
 const MODEL_PRESET_REGISTRY_MAX_ERROR_BYTES = 1024;
+const MODEL_PRESET_REGISTRY_IDENTITY_SKELETON_CACHE_MAX = 200_000;
 const MODEL_PRESET_REGISTRY_FETCH_TIMEOUT_MS = 8_000;
 const REVISION_PATTERN = /^[0-9]{8}$/;
 const SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -592,10 +593,23 @@ function assertSafeRegistryDocument(value: unknown, location = "$"): void {
 	}
 }
 
+/**
+ * Confusable folding is a pure string function evaluated once per identity per
+ * document, and startup validates the same catalog identities repeatedly. The
+ * bounded memo keeps the fold cost proportional to the distinct identity count
+ * instead of the number of validation passes.
+ */
+const identitySkeletonCache = new Map<string, string>();
+
 function identitySkeleton(value: string): string {
-	return [...value.normalize("NFKD").replace(/\p{M}/gu, "").toLowerCase()]
+	const cached = identitySkeletonCache.get(value);
+	if (cached !== undefined) return cached;
+	const skeleton = [...value.normalize("NFKD").replace(/\p{M}/gu, "").toLowerCase()]
 		.map(character => IDENTITY_HOMOGLYPHS.get(character) ?? character)
 		.join("");
+	if (identitySkeletonCache.size >= MODEL_PRESET_REGISTRY_IDENTITY_SKELETON_CACHE_MAX) identitySkeletonCache.clear();
+	identitySkeletonCache.set(value, skeleton);
+	return skeleton;
 }
 
 function assertUniqueRegistryNames(values: readonly string[], label: string): void {
@@ -824,23 +838,21 @@ function assertProfilePresetReferences(
 	}
 }
 
-function validateGeneration(
+function validateGenerationUncached(
 	generation: AcceptedGeneration,
 	trustedKeys: ReadonlyMap<string, ModelPresetRegistryTrustedKey>,
-	allowRevoked = false,
-): AcceptedGeneration {
-	const manifest = ModelPresetRegistryManifestSchema.parse(generation.manifest);
+	allowRevoked: boolean,
+): void {
+	const { manifest, snapshot, profiles, presets } = generation;
 	assertSafeRegistryDocument(manifest);
 	verifyManifest(manifest, trustedKeys, allowRevoked);
 	assertManifestBindings(manifest);
-	const snapshotBytes = new TextEncoder().encode(canonicalModelPresetRegistryJson(generation.snapshot));
+	const snapshotBytes = new TextEncoder().encode(canonicalModelPresetRegistryJson(snapshot));
 	assertContentDescriptor(snapshotBytes, manifest.signed.snapshot, "Cached registry snapshot");
-	const snapshot = ModelPresetRegistrySnapshotSchema.parse(generation.snapshot);
 	assertSafeRegistryDocument(snapshot);
 	assertSnapshotBindings(manifest, snapshot);
-	const profileBytes = new TextEncoder().encode(canonicalModelPresetRegistryJson(generation.profiles));
+	const profileBytes = new TextEncoder().encode(canonicalModelPresetRegistryJson(profiles));
 	assertContentDescriptor(profileBytes, manifest.signed.contents.profiles, "Cached registry profiles");
-	const profiles = ModelPresetRegistryProfilesSchema.parse(generation.profiles);
 	assertSafeRegistryDocument(profiles);
 	assertRegistryIdentityPolicy(profiles);
 	if (
@@ -848,9 +860,8 @@ function validateGeneration(
 		profiles.profiles.length !== manifest.signed.contents.profiles.count
 	)
 		throw new Error("Cached registry profile identity is invalid.");
-	const presetBytes = new TextEncoder().encode(canonicalModelPresetRegistryJson(generation.presets));
+	const presetBytes = new TextEncoder().encode(canonicalModelPresetRegistryJson(presets));
 	assertContentDescriptor(presetBytes, manifest.signed.contents.presets, "Cached registry presets");
-	const presets = ModelPresetRegistryPresetsSchema.parse(generation.presets);
 	assertSafeRegistryDocument(presets);
 	assertRegistryIdentityPolicy(presets);
 	if (
@@ -859,24 +870,73 @@ function validateGeneration(
 	)
 		throw new Error("Cached registry preset identity is invalid.");
 	assertProfilePresetReferences(profiles, presets);
-	const manifestSha256 = sha256(canonicalModelPresetRegistryJson(manifest));
-	if (manifestSha256 !== generation.manifestSha256) throw new Error("Cached registry manifest digest is invalid.");
+	if (sha256(canonicalModelPresetRegistryJson(manifest)) !== generation.manifestSha256)
+		throw new Error("Cached registry manifest digest is invalid.");
 	assertSafeRegistryDocument(generation.retainedProfiles);
 	assertSafeRegistryDocument(generation.retainedPresets);
 	assertSafeRegistryDocument(generation.retainedDynamicProviders);
-	const effectiveProfiles = ModelPresetRegistryProfilesSchema.parse({
+	const effectiveProfiles: ModelPresetRegistryProfiles = {
 		...profiles,
 		dynamicProviders: [...generation.retainedDynamicProviders, ...profiles.dynamicProviders],
 		profiles: [...generation.retainedProfiles, ...profiles.profiles],
-	});
-	const effectivePresets = ModelPresetRegistryPresetsSchema.parse({
+	};
+	const effectivePresets: ModelPresetRegistryPresets = {
 		...presets,
 		presets: [...generation.retainedPresets, ...presets.presets],
-	});
+	};
 	assertRegistryIdentityPolicy(effectiveProfiles);
 	assertRegistryIdentityPolicy(effectivePresets);
 	assertProfilePresetReferences(effectiveProfiles, effectivePresets);
-	return { ...generation, manifest, snapshot, profiles, presets, manifestSha256 };
+}
+
+/**
+ * Signature and binding verification is a pure function of the generation, the
+ * trusted key set, and the revocation allowance, and one accepted-registry read
+ * verifies the same generation objects from several recovery angles. The memo
+ * records both outcomes per (generation, keys, allowance) so a startup read
+ * verifies each cached generation exactly once instead of once per angle.
+ */
+type GenerationValidationOutcome = { ok: true } | { ok: false; error: unknown };
+
+const generationValidationCache = new WeakMap<
+	AcceptedGeneration,
+	WeakMap<ReadonlyMap<string, ModelPresetRegistryTrustedKey>, Map<boolean, GenerationValidationOutcome>>
+>();
+
+/**
+ * Every caller supplies a generation whose documents were already schema-parsed
+ * (cache reads through `parseState`, refresh through `parseCanonicalDocument`),
+ * so this asserts the cryptographic and structural bindings and returns the
+ * input rather than re-deriving an identical parse.
+ */
+function validateGeneration(
+	generation: AcceptedGeneration,
+	trustedKeys: ReadonlyMap<string, ModelPresetRegistryTrustedKey>,
+	allowRevoked = false,
+): AcceptedGeneration {
+	let byKeys = generationValidationCache.get(generation);
+	if (!byKeys) {
+		byKeys = new WeakMap();
+		generationValidationCache.set(generation, byKeys);
+	}
+	let byAllowance = byKeys.get(trustedKeys);
+	if (!byAllowance) {
+		byAllowance = new Map();
+		byKeys.set(trustedKeys, byAllowance);
+	}
+	const memoized = byAllowance.get(allowRevoked);
+	if (memoized) {
+		if (!memoized.ok) throw memoized.error;
+		return generation;
+	}
+	try {
+		validateGenerationUncached(generation, trustedKeys, allowRevoked);
+	} catch (error) {
+		byAllowance.set(allowRevoked, { ok: false, error });
+		throw error;
+	}
+	byAllowance.set(allowRevoked, { ok: true });
+	return generation;
 }
 
 function readJsonSync(file: string): unknown | undefined {
@@ -1167,11 +1227,7 @@ function recoverStateCopiesSync(
 		(!primaryEvidence.allGenerationsVerified || primaryEvidence.duplicateRevision)
 	)
 		if (!options.allowInvalidPrimaryFallback || !backupEvidence?.fullyVerified) {
-			try {
-				validateStateGenerations(primaryEvidence.state, trustedKeys);
-			} catch (error) {
-				throw error;
-			}
+			validateStateGenerations(primaryEvidence.state, trustedKeys);
 		}
 	if (
 		backupEvidence &&
@@ -1492,9 +1548,92 @@ function acceptedRegistryFromState(
 	};
 }
 
+/**
+ * Accepted-registry reads are pure over the on-disk state, backup, and control
+ * files, and a single launch resolves the registry from several subsystems.
+ * The memo keys on the content digest of those inputs, so any byte change from
+ * any writer (refresh, rollback, pin, tampering) is re-verified from scratch
+ * while an unchanged launch pays the verification cost once. Digesting the
+ * inputs is bounded by their size cap and stays far below the signature,
+ * schema, and canonical-form work it replaces.
+ */
+const acceptedRegistryReadCache = new Map<string, { fingerprint: string; value: AcceptedModelPresetRegistry }>();
+
+function cloneAcceptedModelPresetRegistry(value: AcceptedModelPresetRegistry): AcceptedModelPresetRegistry {
+	return {
+		...value,
+		profiles: new Map(
+			[...value.profiles].map(([id, profile]) => [id, structuredClone(profile)] as [string, ModelProfileDefinition]),
+		),
+		presets: structuredClone(value.presets),
+		dynamicProviders: [...value.dynamicProviders],
+		retainedProfiles: [...value.retainedProfiles],
+		retainedPresets: [...value.retainedPresets],
+	};
+}
+
+function registryFileFingerprint(file: string): string {
+	try {
+		return sha256(fsSync.readFileSync(file));
+	} catch {
+		return "absent";
+	}
+}
+
+function acceptedRegistryFingerprint(
+	agentDir: string,
+	dependencies: Omit<ModelPresetRegistryDependencies, "agentDir">,
+): string {
+	const paths = registryPaths(agentDir);
+	return [
+		refreshDependencyId(effectiveTrustedKeys(dependencies, agentDir) as object),
+		...[paths.state, paths.backup, paths.control].map(registryFileFingerprint),
+	].join("|");
+}
+
+async function registryFileFingerprintAsync(file: string): Promise<string> {
+	try {
+		return sha256(new Uint8Array(await Bun.file(file).arrayBuffer()));
+	} catch {
+		return "absent";
+	}
+}
+
+async function acceptedRegistryFingerprintAsync(
+	agentDir: string,
+	dependencies: Omit<ModelPresetRegistryDependencies, "agentDir">,
+): Promise<string> {
+	const paths = registryPaths(agentDir);
+	const files = await Promise.all(
+		[paths.state, paths.backup, paths.control].map(file => registryFileFingerprintAsync(file)),
+	);
+	return [refreshDependencyId(effectiveTrustedKeys(dependencies, agentDir) as object), ...files].join("|");
+}
+
+/** Only the dependency-free startup read is memoized; injected dependencies always recompute. */
+function acceptedRegistryReadIsCacheable(dependencies: Omit<ModelPresetRegistryDependencies, "agentDir">): boolean {
+	return Object.keys(dependencies).length === 0;
+}
+
 export function loadAcceptedModelPresetRegistry(
 	agentDir = getAgentDir(),
 	dependencies: Omit<ModelPresetRegistryDependencies, "agentDir"> = {},
+): AcceptedModelPresetRegistry {
+	if (!acceptedRegistryReadIsCacheable(dependencies) || environmentDisabled())
+		return loadAcceptedModelPresetRegistryUncached(agentDir, dependencies);
+	const fingerprint = acceptedRegistryFingerprint(agentDir, dependencies);
+	const cached = acceptedRegistryReadCache.get(agentDir);
+	if (cached && cached.fingerprint === fingerprint) return cloneAcceptedModelPresetRegistry(cached.value);
+	const value = loadAcceptedModelPresetRegistryUncached(agentDir, dependencies);
+	const verifiedFingerprint = acceptedRegistryFingerprint(agentDir, dependencies);
+	if (verifiedFingerprint !== fingerprint) return loadAcceptedModelPresetRegistryUncached(agentDir, dependencies);
+	acceptedRegistryReadCache.set(agentDir, { fingerprint, value });
+	return cloneAcceptedModelPresetRegistry(value);
+}
+
+function loadAcceptedModelPresetRegistryUncached(
+	agentDir: string,
+	dependencies: Omit<ModelPresetRegistryDependencies, "agentDir">,
 ): AcceptedModelPresetRegistry {
 	if (environmentDisabled())
 		return {
@@ -1555,6 +1694,22 @@ export function loadAcceptedModelPresetRegistry(
 export async function loadAcceptedModelPresetRegistryAsync(
 	agentDir = getAgentDir(),
 	dependencies: Omit<ModelPresetRegistryDependencies, "agentDir"> = {},
+): Promise<AcceptedModelPresetRegistry> {
+	if (!acceptedRegistryReadIsCacheable(dependencies) || environmentDisabled())
+		return loadAcceptedModelPresetRegistryAsyncUncached(agentDir, dependencies);
+	const fingerprint = await acceptedRegistryFingerprintAsync(agentDir, dependencies);
+	const cached = acceptedRegistryReadCache.get(agentDir);
+	if (cached && cached.fingerprint === fingerprint) return cloneAcceptedModelPresetRegistry(cached.value);
+	const value = await loadAcceptedModelPresetRegistryAsyncUncached(agentDir, dependencies);
+	const verifiedFingerprint = await acceptedRegistryFingerprintAsync(agentDir, dependencies);
+	if (verifiedFingerprint !== fingerprint) return loadAcceptedModelPresetRegistryAsyncUncached(agentDir, dependencies);
+	acceptedRegistryReadCache.set(agentDir, { fingerprint, value });
+	return cloneAcceptedModelPresetRegistry(value);
+}
+
+async function loadAcceptedModelPresetRegistryAsyncUncached(
+	agentDir: string,
+	dependencies: Omit<ModelPresetRegistryDependencies, "agentDir">,
 ): Promise<AcceptedModelPresetRegistry> {
 	if (environmentDisabled())
 		return {