@gajae-code/coding-agent 0.16.3 → 0.16.6

package/src/runtime-mcp/transports/stdio.ts

@@ -13,6 +13,7 @@ import type {
 	JsonRpcRequest,
 	JsonRpcResponse,
 	MCPRequestOptions,
+	MCPStdioPreparedLaunch,
 	MCPStdioServerConfig,
 	MCPTransport,
 } from "../../runtime-mcp/types";
@@ -56,6 +57,22 @@ function buildMinimalStdioEnv(explicit?: Record<string, string>): Record<string,
 	return { ...env, ...explicit };
 }
 
+function combinedOperationAndCleanupFailure(operationError: unknown, cleanupError: unknown): MCPExpectedFailure {
+	return new MCPExpectedFailure(
+		new AggregateError(
+			[operationError, cleanupError],
+			"MCP stdio operation failed and subprocess cleanup also failed",
+		),
+	);
+}
+
+type StdioConnectAttempt = {
+	generation: number;
+	revoked: boolean;
+	settled: boolean;
+	completion: Promise<void>;
+};
+
 export class StdioTransport implements MCPTransport {
 	#process: OwnedProcess | null = null;
 	#pendingRequests = new Map<
@@ -69,6 +86,10 @@ export class StdioTransport implements MCPTransport {
 	#readLoop: Promise<void> | null = null;
 	#stderrLoop: Promise<void> | null = null;
 	#closePromise: Promise<void> | null = null;
+	#connectGeneration = 0;
+	#connectAttempt: StdioConnectAttempt | null = null;
+	/** Retained until the per-attempt cleanup resolves successfully. */
+	#afterProcessExit: (() => Promise<void>) | null = null;
 
 	onClose?: () => void;
 	onError?: (error: Error) => void;
@@ -85,33 +106,122 @@ export class StdioTransport implements MCPTransport {
 		return true;
 	}
 
+	#registerCleanup(attempt: StdioConnectAttempt, cleanup: () => Promise<void>): void {
+		if (this.#connectAttempt !== attempt) {
+			throw new Error("MCP stdio attempt registered cleanup after its ownership ended");
+		}
+		if (this.#afterProcessExit && this.#afterProcessExit !== cleanup) {
+			throw new Error("MCP stdio attempt registered conflicting cleanup owners");
+		}
+		this.#afterProcessExit = cleanup;
+	}
+
+	#assertConnectAttemptActive(attempt: StdioConnectAttempt): void {
+		if (attempt.revoked || this.#connectAttempt !== attempt || this.#connectGeneration !== attempt.generation) {
+			throw new Error("MCP stdio connection attempt was closed");
+		}
+	}
+
+	#revokeConnectAttempt(): StdioConnectAttempt | null {
+		const attempt = this.#connectAttempt;
+		if (attempt && !attempt.revoked) {
+			attempt.revoked = true;
+			this.#connectGeneration++;
+		}
+		return attempt;
+	}
+
 	/**
 	 * Start the subprocess and begin reading.
 	 */
 	async connect(): Promise<void> {
 		if (this.#connected) return;
-		if (this.#closePromise || this.#process) {
+		if (this.#closePromise) {
+			throw new MCPExpectedFailure(new Error("MCP stdio child teardown is incomplete"));
+		}
+		if (this.#connectAttempt) {
+			if (!this.#connectAttempt.settled) return this.#connectAttempt.completion;
+			if (this.#process || this.#afterProcessExit) {
+				throw new MCPExpectedFailure(new Error("MCP stdio child teardown is incomplete"));
+			}
+			this.#connectAttempt = null;
+		}
+		if (this.#process || this.#afterProcessExit) {
 			throw new MCPExpectedFailure(new Error("MCP stdio child teardown is incomplete"));
 		}
 
-		const args = this.config.args ?? [];
+		const { promise, resolve, reject } = Promise.withResolvers<void>();
+		const attempt: StdioConnectAttempt = {
+			generation: ++this.#connectGeneration,
+			revoked: false,
+			settled: false,
+			completion: promise,
+		};
+		this.#connectAttempt = attempt;
+		void this.#finishConnect(attempt).then(
+			() => {
+				attempt.settled = true;
+				resolve();
+			},
+			error => {
+				attempt.settled = true;
+				reject(error);
+			},
+		);
+		void promise.catch(() => {});
+		return promise;
+	}
+
+	async #finishConnect(attempt: StdioConnectAttempt): Promise<void> {
+		let launch: MCPStdioPreparedLaunch = {
+			command: this.config.command,
+			args: Object.freeze([...(this.config.args ?? [])]),
+			cwd: this.config.cwd ?? process.cwd(),
+			registerCleanup: cleanup => this.#registerCleanup(attempt, cleanup),
+		};
 		const env = this.config.noInheritEnv
 			? buildMinimalStdioEnv(this.config.env)
 			: {
 					...Bun.env,
 					...this.config.env,
 				};
-		const cwd = this.config.cwd ?? process.cwd();
-
 		try {
-			this.#process = spawnOwnedProcess([this.config.command, ...args], {
-				cwd,
+			this.#assertConnectAttemptActive(attempt);
+			if (this.config.prepareSpawn) launch = await this.config.prepareSpawn(launch);
+			if (launch.afterProcessExit) this.#registerCleanup(attempt, launch.afterProcessExit);
+			else if (!this.#afterProcessExit && this.config.afterProcessExit) {
+				this.#registerCleanup(attempt, this.config.afterProcessExit);
+			}
+			this.#assertConnectAttemptActive(attempt);
+			await this.config.spawnGuard?.(launch);
+			this.#assertConnectAttemptActive(attempt);
+			await this.config.afterSpawnGuardForTest?.();
+			this.#assertConnectAttemptActive(attempt);
+			const process = spawnOwnedProcess([launch.command, ...launch.args], {
+				cwd: launch.cwd,
 				env,
 				stdin: "pipe",
 				gracefulMs: CLOSE_WAIT_MS,
-				name: `mcp-stdio:${this.config.command}`,
+				name: `mcp-stdio:${launch.command}`,
 			});
+			if (attempt.revoked) {
+				const teardown = await process.dispose();
+				await process.awaitExit({ timeoutMs: CLOSE_WAIT_MS }).catch(() => ({ exited: false, code: null }));
+				if (teardown.status !== "terminated") {
+					this.#process = process;
+					throw new MCPExpectedFailure(new Error(`stdio child teardown ${teardown.status}`));
+				}
+				throw new Error("MCP stdio connection attempt was closed");
+			}
+			this.#process = process;
 		} catch (error) {
+			if (!this.#process) {
+				try {
+					await this.#runAfterProcessExit();
+				} catch (cleanupError) {
+					throw combinedOperationAndCleanupFailure(error, cleanupError);
+				}
+			}
 			throw new MCPExpectedFailure(error);
 		}
 
@@ -367,19 +477,32 @@ export class StdioTransport implements MCPTransport {
 		}
 	}
 
+	async #runAfterProcessExit(): Promise<void> {
+		const cleanup = this.#afterProcessExit;
+		if (!cleanup) return;
+		await cleanup();
+		if (this.#afterProcessExit === cleanup) this.#afterProcessExit = null;
+	}
+
 	async close(): Promise<void> {
 		await this.#closeInternal(false);
 	}
 
 	#closeInternal(fromReadLoop: boolean, failure?: MCPExpectedFailure): Promise<void> {
 		if (this.#closePromise) return this.#closePromise;
-		this.#closePromise = this.#finishClose(fromReadLoop, failure).finally(() => {
+		const connectAttempt = this.#revokeConnectAttempt();
+		this.#closePromise = this.#finishClose(fromReadLoop, failure, connectAttempt).finally(() => {
+			if (this.#connectAttempt === connectAttempt) this.#connectAttempt = null;
 			this.#closePromise = null;
 		});
 		return this.#closePromise;
 	}
 
-	async #finishClose(fromReadLoop: boolean, failure?: MCPExpectedFailure): Promise<void> {
+	async #finishClose(
+		fromReadLoop: boolean,
+		failure: MCPExpectedFailure | undefined,
+		connectAttempt: StdioConnectAttempt | null,
+	): Promise<void> {
 		const wasConnected = this.#connected;
 		this.#connected = false;
 
@@ -388,16 +511,36 @@ export class StdioTransport implements MCPTransport {
 		}
 		this.#pendingRequests.clear();
 
+		let primaryFailure: unknown = failure;
+		if (connectAttempt) {
+			try {
+				await connectAttempt.completion;
+			} catch (error) {
+				if (primaryFailure === undefined && this.#process) primaryFailure = error;
+			}
+		}
 		const stdin = this.#getStdin();
 		const process = this.#process;
 		if (process) {
-			stdin?.end();
-			const teardown = await process.dispose();
-			await process.awaitExit({ timeoutMs: CLOSE_WAIT_MS }).catch(() => ({ exited: false, code: null }));
-			if (teardown.status !== "terminated") {
-				throw new MCPExpectedFailure(new Error(`stdio child teardown ${teardown.status}`));
+			try {
+				stdin?.end();
+				const teardown = await process.dispose();
+				await process.awaitExit({ timeoutMs: CLOSE_WAIT_MS }).catch(() => ({ exited: false, code: null }));
+				if (teardown.status !== "terminated") {
+					throw new MCPExpectedFailure(new Error(`stdio child teardown ${teardown.status}`));
+				}
+				this.#process = null;
+			} catch (cleanupError) {
+				if (primaryFailure) throw combinedOperationAndCleanupFailure(primaryFailure, cleanupError);
+				throw cleanupError;
 			}
-			this.#process = null;
+		}
+
+		try {
+			await this.#runAfterProcessExit();
+		} catch (cleanupError) {
+			if (primaryFailure) throw combinedOperationAndCleanupFailure(primaryFailure, cleanupError);
+			throw cleanupError;
 		}
 
 		if (!fromReadLoop && this.#readLoop) {
@@ -413,12 +556,3 @@ export class StdioTransport implements MCPTransport {
 		if (wasConnected) this.onClose?.();
 	}
 }
-
-/**
- * Create and connect a stdio transport.
- */
-export async function createStdioTransport(config: MCPStdioServerConfig): Promise<StdioTransport> {
-	const transport = new StdioTransport(config);
-	await transport.connect();
-	return transport;
-}

package/src/runtime-mcp/types.ts

@@ -95,6 +95,22 @@ export interface MCPServerConfigBase {
 }
 
 /** Stdio server configuration */
+export interface MCPStdioSpawnLaunch {
+	command: string;
+	args: readonly string[];
+	cwd: string;
+	/** Transport-supplied registrar for retryable cleanup before preparation allocates resources. */
+	registerCleanup?: (cleanup: () => Promise<void>) => void;
+}
+
+export interface MCPStdioPreparedLaunch extends MCPStdioSpawnLaunch {
+	/**
+	 * Per-attempt cleanup run after confirmed child exit or failed spawn. The same
+	 * callback may already have been registered during preparation.
+	 */
+	afterProcessExit?: () => Promise<void>;
+}
+
 export interface MCPStdioServerConfig extends MCPServerConfigBase {
 	type?: "stdio"; // Default if not specified
 	command: string;
@@ -108,6 +124,14 @@ export interface MCPStdioServerConfig extends MCPServerConfigBase {
 	 */
 	noInheritEnv?: boolean;
 	cwd?: string;
+	/** Internal trusted-boundary preparation of immutable per-spawn authority. */
+	prepareSpawn?: (launch: MCPStdioSpawnLaunch) => Promise<MCPStdioPreparedLaunch>;
+	/** Internal trusted-boundary check run immediately before process creation. */
+	spawnGuard?: (launch: MCPStdioSpawnLaunch) => Promise<void>;
+	/** Internal cleanup run only after the owned stdio child is confirmed exited. */
+	afterProcessExit?: () => Promise<void>;
+	/** Test seam for deterministic mutation after the guard and before process creation. */
+	afterSpawnGuardForTest?: () => Promise<void>;
 }
 
 /** HTTP server configuration (Streamable HTTP transport) */

package/src/sdk/broker/broker.ts

@@ -41,7 +41,9 @@ import {
 	executeLifecycle,
 	isCanonicalSessionId,
 	prepareSpawnChildHostLaunch,
+	readSessionLifecycleFailure,
 	validateBrokerModelPresetSync,
+	writeEffectMarker,
 } from "./lifecycle";
 import {
 	type LifecycleDurableEffectsReceipt,
@@ -724,6 +726,7 @@ function credentialFreeLifecycleResponse(value: unknown): unknown {
 type LifecycleReplayEndpoint = {
 	endpoint: Record<string, unknown>;
 	endpointGeneration: number;
+	endpointIncarnation: string;
 	pid: number;
 	endpointMtimeMs: number;
 };
@@ -1588,12 +1591,34 @@ export class Broker {
 					).claim;
 					return spawnFailureError(failure);
 				}
+				const { pid, processIncarnation: incarnation } = launched.proof;
+				if (pid === undefined || incarnation === undefined) {
+					const failure: SpawnSubstrateFailure = {
+						substrateKind: launched.proof.substrateKind,
+						code: "substrate_proof_failed",
+						message: "session.spawn substrate lacks lifecycle process authority",
+					};
+					await this.#releaseUnownedSubstrate(provider, launchedProof);
+					launchedProof = undefined;
+					current = (
+						await store.persistTransition(lifecycleIdentity, {
+							claimId: current.claimId,
+							from: "substrate_starting",
+							to: "pre_send_rejected",
+							failure,
+						})
+					).claim;
+					return spawnFailureError(failure);
+				}
+				const marker = { pid, incarnation, effectMarker: prep.effectMarker };
+				await writeEffectMarker(prep.stateRoot, prep.childId, marker);
 				const registration = await this.#spawnPromptLayer.awaitRegistration({
 					childId: prep.childId,
 					cwd: prep.cwd,
 					stateRoot: prep.stateRoot,
 				});
 				if (!registration.ok) {
+					const startupFailure = await readSessionLifecycleFailure(prep.stateRoot, prep.childId, marker);
 					await this.#releaseUnownedSubstrate(provider, launchedProof);
 					launchedProof = undefined;
 					current = (
@@ -1603,7 +1628,11 @@ export class Broker {
 							to: "uncertain",
 						})
 					).claim;
-					return error("terminal_uncertain", "session.spawn child registration is uncertain");
+					return error(
+						"terminal_uncertain",
+						"session.spawn child registration is uncertain" +
+							(startupFailure ? ` (${startupFailure.phase}/${startupFailure.reason})` : ""),
+					);
 				}
 				pinnedRegistration = registration.registration;
 				const now = Date.now();
@@ -2404,26 +2433,35 @@ export class Broker {
 		)
 			return;
 
-		// Snapshot validation and the deterministic instance suffix protect successor locks.
-		const tombstone = path.join(
-			path.dirname(this.#lock),
-			`.broker.lock.stale-${createHash("sha256").update(snapshot.lockIdentity).digest("hex")}`,
-		);
-		try {
-			await fs.rename(this.#lock, tombstone);
-		} catch (e) {
-			const code = (e as NodeJS.ErrnoException).code;
-			if (["ENOENT", "EEXIST", "ENOTEMPTY", "EISDIR", "ENOTDIR"].includes(code ?? "")) return;
-			if (code === "EPERM") {
-				try {
-					await fs.lstat(tombstone);
-					return;
-				} catch (statError) {
-					if ((statError as NodeJS.ErrnoException).code !== "ENOENT") throw statError;
+		// Give every reclaimed generation a fresh quarantine name. Older brokers
+		// used only the lock inode hash; if that tombstone survived a crash, the
+		// deterministic name collided forever and left the dead canonical lock in
+		// place. The random suffix preserves no-replace rename semantics without
+		// letting retained cleanup debris block takeover.
+		for (let attempt = 0; attempt < 8; attempt++) {
+			const tombstone = path.join(
+				path.dirname(this.#lock),
+				`.broker.lock.stale-${createHash("sha256").update(snapshot.lockIdentity).digest("hex")}-${randomBytes(8).toString("hex")}`,
+			);
+			try {
+				await fs.rename(this.#lock, tombstone);
+				return;
+			} catch (e) {
+				const code = (e as NodeJS.ErrnoException).code;
+				if (code === "EEXIST" || code === "ENOTEMPTY") continue;
+				if (["ENOENT", "EISDIR", "ENOTDIR"].includes(code ?? "")) return;
+				if (code === "EPERM") {
+					try {
+						await fs.lstat(tombstone);
+						continue;
+					} catch (statError) {
+						if ((statError as NodeJS.ErrnoException).code !== "ENOENT") throw statError;
+					}
 				}
+				throw e;
 			}
-			throw e;
 		}
+		throw new Error(`Broker lock quarantine namespace is saturated for ${this.#lock}`);
 	}
 	async #releaseOwnedLock(): Promise<void> {
 		try {
@@ -2549,6 +2587,11 @@ export class Broker {
 				startedAt: now,
 				heartbeatAt: now,
 			};
+			// Readiness must not be externally visible until the initial session
+			// checkpoint settles. The bootstrap watchdog owns this pre-publication
+			// interval; publishing first allowed it to kill an endpoint already handed
+			// to callers when a legitimate index-lock wait outlived the fence.
+			await this.#checkpointSessionHeartbeats();
 			this.#publication = await publishBrokerDiscovery(this.settings.agentDir, this.discovery);
 			this.#publicationState = "healthy-owned";
 			this.#publishedAt = process.hrtime.bigint();
@@ -2560,7 +2603,6 @@ export class Broker {
 				void this.#watchPublication();
 				void this.#reapSpawnOrphans();
 			}, cadenceMs);
-			await this.#checkpointSessionHeartbeats();
 			return this.discovery;
 		} catch (error) {
 			await this.#transport?.stop();
@@ -2862,6 +2904,8 @@ export class Broker {
 			endpointMtimeMs <= 0
 		)
 			return error("endpoint_stale", "session endpoint authority is incomplete");
+		const currentIncarnation = endpointIncarnation(record, sessionId);
+		if (!currentIncarnation) return error("endpoint_stale", "session endpoint incarnation is unavailable");
 		const endpoint = await this.#readEndpoint(record, {});
 		if (!endpoint.ok) return endpoint;
 		if (endpoint.result === null || typeof endpoint.result !== "object" || Array.isArray(endpoint.result))
@@ -2869,6 +2913,7 @@ export class Broker {
 		return {
 			endpoint: endpoint.result as Record<string, unknown>,
 			endpointGeneration: record.endpointGeneration,
+			endpointIncarnation: currentIncarnation,
 			pid: record.pid,
 			endpointMtimeMs,
 		};
@@ -3041,16 +3086,21 @@ export class Broker {
 			if (this.#chains.get(target) === chain) this.#chains.delete(target);
 		}
 	}
-	#storeSessionListCursor(cursor: SessionListCursor, replacingToken?: string): string | BrokerResponse {
+	#storeSessionListCursor(cursor: SessionListCursor, replacingToken?: string): string {
 		const now = Date.now();
 		for (const [token, stored] of this.#sessionListCursors) {
 			if (stored.expiresAt <= now) this.#sessionListCursors.delete(token);
 		}
-		const replacing = replacingToken !== undefined && this.#sessionListCursors.has(replacingToken);
-		if (!replacing && this.#sessionListCursors.size >= SESSION_LIST_MAX_CURSORS)
-			return error("invalid_input", "session.list cursor capacity is exhausted");
-		const token = randomBytes(24).toString("base64url");
 		if (replacingToken !== undefined) this.#sessionListCursors.delete(replacingToken);
+		// Pagination cursors are a paging convenience, not durable state (#5370).
+		// Evict the oldest cursor when the budget is full so abandoned or partial
+		// paginations degrade gracefully instead of failing unrelated session ops.
+		while (this.#sessionListCursors.size >= SESSION_LIST_MAX_CURSORS) {
+			const oldest = this.#sessionListCursors.keys().next();
+			if (oldest.done) break;
+			this.#sessionListCursors.delete(oldest.value);
+		}
+		const token = randomBytes(24).toString("base64url");
 		this.#sessionListCursors.set(token, cursor);
 		return token;
 	}
@@ -3095,11 +3145,12 @@ export class Broker {
 		}
 		const limit = stored?.limit ?? requestedLimit ?? SESSION_LIST_DEFAULT_LIMIT;
 		const observedAt = stored?.observedAt ?? (scope === undefined ? undefined : new Date().toISOString());
+		const resolveSessionId = typeof input.resolveSessionId === "string" ? input.resolveSessionId : undefined;
 		const snapshot = stored ?? {
-			sessions:
-				scope === undefined
-					? [...result.sessions]
-					: result.sessions.filter(session => scopeMatchesLocator(scope, session.locator)),
+			sessions: (scope === undefined
+				? [...result.sessions]
+				: result.sessions.filter(session => scopeMatchesLocator(scope, session.locator))
+			).filter(session => resolveSessionId === undefined || session.sessionId === resolveSessionId),
 			indexSeq: result.indexSeq,
 			warnings: [...result.warnings],
 			limit,
@@ -3120,7 +3171,6 @@ export class Broker {
 						{ ...snapshot, offset, expiresAt: Date.now() + SESSION_LIST_CURSOR_TTL_MS },
 						typeof cursor === "string" ? cursor : undefined,
 					);
-		if (isBrokerResponse(continuationCursor)) return continuationCursor;
 		return {
 			ok: true,
 			result: {
@@ -3325,15 +3375,32 @@ export class Broker {
 						(operation === "session.create" || operation === "session.fork" || operation === "session.resume") &&
 						typeof (replay.result as { sessionId?: unknown } | undefined)?.sessionId === "string"
 					) {
-						const refreshed = await this.#readLifecycleReplayEndpoint(
-							(replay.result as { sessionId: string }).sessionId,
-						);
+						const replayResult = objectRecord(replay.result);
+						const replaySessionId = (replay.result as { sessionId: string }).sessionId;
+						const replayIncarnation =
+							typeof replayResult?.endpointIncarnation === "string" &&
+							/^[a-f0-9]{64}$/.test(replayResult.endpointIncarnation)
+								? replayResult.endpointIncarnation
+								: endpointIncarnation(
+										{
+											endpointGeneration: replayResult?.endpointGeneration as number,
+											endpointMtimeMs: replayResult?.endpointMtimeMs as number,
+											pid: replayResult?.pid as number,
+										},
+										replaySessionId,
+									);
+						if (!replayIncarnation)
+							return error("endpoint_stale", "lifecycle replay lacks original endpoint authority");
+						const refreshed = await this.#readLifecycleReplayEndpoint(replaySessionId);
 						if (isBrokerResponse(refreshed)) return refreshed;
+						if (refreshed.endpointIncarnation !== replayIncarnation)
+							return error("endpoint_stale", "lifecycle replay target was replaced");
 						return {
 							ok: true,
 							result: {
 								...(replay.result as Record<string, unknown>),
 								endpointGeneration: refreshed.endpointGeneration,
+								endpointIncarnation: refreshed.endpointIncarnation,
 								pid: refreshed.pid,
 								endpointMtimeMs: refreshed.endpointMtimeMs,
 								endpoint: refreshed.endpoint,
@@ -3346,6 +3413,12 @@ export class Broker {
 				const response = outcome.response;
 				const storedResponse = credentialFreeLifecycleResponse(response) as BrokerResponse;
 				await this.ledger.transition(identity, lifecycleResponseState(response), {
+					...(operation === "session.delete" &&
+					typeof input.sessionId === "string" &&
+					lifecycleResponseState(response) === "terminal_uncertain" &&
+					!pendingCleanupSessionId(response)
+						? { intendedSessionId: input.sessionId }
+						: {}),
 					response: storedResponse,
 					responseDigest: createHash("sha256").update(canonicalJson(storedResponse)).digest("hex"),
 					...(outcome.durableEffects ? { durableEffects: outcome.durableEffects } : {}),
@@ -3365,6 +3438,12 @@ export class Broker {
 				const storedResponse = credentialFreeLifecycleResponse(response) as BrokerResponse;
 				await this.ledger.transition(identity, lifecycleResponseState(response), {
 					...(pendingCleanupSessionId(response) ? { intendedSessionId: pendingCleanupSessionId(response) } : {}),
+					...(operation === "session.delete" &&
+					typeof input.sessionId === "string" &&
+					lifecycleResponseState(response) === "terminal_uncertain" &&
+					!pendingCleanupSessionId(response)
+						? { intendedSessionId: input.sessionId }
+						: {}),
 					response: storedResponse,
 					responseDigest: createHash("sha256").update(canonicalJson(storedResponse)).digest("hex"),
 					...(outcome.durableEffects ? { durableEffects: outcome.durableEffects } : {}),
@@ -3376,8 +3455,21 @@ export class Broker {
 			const outcome = await executeLifecycle(this, operation, input, identity);
 			const response = outcome.response;
 			const storedResponse = credentialFreeLifecycleResponse(response) as BrokerResponse;
+			// Record the refusal's own target session so the fence it may leave
+			// is scoped to that session. Without this, a session.delete refusal
+			// for X persists as an unbound terminal_uncertain row and fences
+			// every later delete for unrelated sessions (#5364). A refusal that
+			// truly cannot name its target fences nothing (see
+			// hasUncertainCleanupForSession).
+			const refusalSessionId =
+				operation === "session.delete" && typeof input.sessionId === "string" ? input.sessionId : undefined;
 			await this.ledger.transition(identity, lifecycleResponseState(response), {
 				...(pendingCleanupSessionId(response) ? { intendedSessionId: pendingCleanupSessionId(response) } : {}),
+				...(refusalSessionId !== undefined &&
+				lifecycleResponseState(response) === "terminal_uncertain" &&
+				!pendingCleanupSessionId(response)
+					? { intendedSessionId: refusalSessionId }
+					: {}),
 				resultSessionId:
 					response.ok && typeof (response.result as { sessionId?: unknown } | undefined)?.sessionId === "string"
 						? (response.result as { sessionId: string }).sessionId