@gajae-code/coding-agent 0.16.7 → 0.17.1

package/src/coordinator-mcp/server.ts

@@ -25,6 +25,7 @@ import {
 import { listMcpDelegateHostContexts } from "../hooks/mcp-delegate-host-context";
 import type { WorkflowGate, WorkflowGateQueryRecord } from "../modes/shared/agent-wire/workflow-gate-types";
 import type { BrokerDiscovery } from "../sdk/broker/discovery";
+import { endpointIncarnation } from "../sdk/broker/endpoint-authority";
 import { type EnsureBrokerSettings, ensureBroker } from "../sdk/broker/ensure";
 import { lifecycleRequestTimeoutMs } from "../sdk/broker/startup-budget";
 import { UnsupportedStateVersionError } from "../sdk/broker/state-version";
@@ -139,6 +140,7 @@ import {
 	reconcileCreationRemoteVerifier,
 	recordCreationRetirementBrokerProof,
 	recordCreationRetirementIntent,
+	recordDeletionIntent,
 	recoverExpiredPublicDelivery,
 	releasePublicDeliveryClaim,
 	removeSessionTransaction,
@@ -542,7 +544,10 @@ function textResult(
 	};
 }
 
-function toolSchema(name: CoordinatorToolName): {
+function toolSchema(
+	name: CoordinatorToolName,
+	platform: NodeJS.Platform,
+): {
 	name: CoordinatorToolName;
 	description: string;
 	inputSchema: Record<string, unknown>;
@@ -684,7 +689,7 @@ function toolSchema(name: CoordinatorToolName): {
 		return {
 			name,
 			description:
-				"Close and reap a coordinator delegate-created (ephemeral) SDK session through broker lifecycle control. Non-ephemeral user-registered sessions require both force and the force-stop capability.",
+				"Close and reap a coordinator-created (ephemeral) SDK session through broker lifecycle control. Non-ephemeral user-registered sessions require both force and the force-stop capability.",
 			inputSchema: {
 				type: "object",
 				properties: {
@@ -803,7 +808,9 @@ function toolSchema(name: CoordinatorToolName): {
 	if (name === "gjc_coordinator_read_artifact") {
 		return {
 			name,
-			description: coordinatorArtifactCapability().available
+			// Controllers detect capability from tools/list (docs/hermes-mcp-bridge.md), so the
+			// advertisement must use the same resolved platform as the handler refusal.
+			description: coordinatorArtifactCapability(platform).available
 				? "Read one bounded artifact from configured safe roots."
 				: "Unavailable on this platform: artifact reads require Linux identity-bound handle authorization.",
 			inputSchema: { type: "object", properties: { path: pathField }, required: ["path"] },
@@ -1376,7 +1383,7 @@ function boundedPublicValue(value: unknown, budget: { remaining: number }, depth
 	const output: Record<string, unknown> = {};
 	for (const key of Object.keys(value as Record<string, unknown>).slice(0, 128)) {
 		const field = (value as Record<string, unknown>)[key];
-		if (key === "error") {
+		if (key === "error" && field !== null) {
 			const rawCode =
 				field && typeof field === "object" && !Array.isArray(field)
 					? (field as Record<string, unknown>).code
@@ -4438,6 +4445,8 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				eventId: string;
 			}> = [];
 			let q12Admitted = true;
+			let liveInFlightAskAdmitted = false;
+			let liveInFlightCandidate = false;
 			await withAdmittedSessionTransaction(
 				questionPaths,
 				sessionId,
@@ -4445,6 +4454,39 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 					const liveState = await readSessionState(namespaceDir, sessionId);
 					const waitingToken = admissionToken;
 					const waitingTurn = waitingToken ? transaction.canonical.turns[waitingToken.coordinator_turn_id] : null;
+					const liveTurn = admission.active_turn_id
+						? transaction.canonical.turns[admission.active_turn_id]
+						: undefined;
+					// The Q12 query runs outside this transaction. Re-check the turn that
+					// admission observed so cancellation or terminal reconciliation cannot
+					// make an in-flight empty snapshot look like a healthy running result.
+					if (
+						admission.active_turn_id &&
+						(!liveTurn || TERMINAL_TURN_STATUSES.has(liveTurn.status as TurnStatus))
+					) {
+						q12Admitted = false;
+						return;
+					}
+					// A headless ask opens a durable Q12 gate before the runtime has a
+					// distinct needs_user_input lifecycle marker. Admit that narrow,
+					// observable in-flight state only when the sidecar, active turn, and
+					// accepted runtime receipt all identify the same turn. This is waiting
+					// evidence, not a terminal observation; all terminal paths remain
+					// subject to the existing receipt and terminal-fence checks.
+					liveInFlightCandidate = Boolean(
+						liveState?.schema_version === 1 &&
+							liveState.session_id === sessionId &&
+							liveState?.source === "agent_session_event" &&
+							liveState.live === true &&
+							liveState.state === "running" &&
+							liveState.current_turn_id !== null &&
+							Number.isFinite(Date.parse(liveState.updated_at)) &&
+							hasExactRuntimeWriterIdentity(liveState, transaction.canonical.session.broker) &&
+							liveState.current_turn_id === admission.active_turn_id &&
+							liveTurn &&
+							ACTIVE_TURN_STATUSES.has(liveTurn.status as TurnStatus) &&
+							hasAcceptedRuntimeReceipt(liveTurn),
+					);
 					if (
 						waitingToken &&
 						(!liveState ||
@@ -4464,10 +4506,19 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 						q12Admitted = false;
 						return;
 					}
+					if (
+						liveState?.source === "agent_session_event" &&
+						(liveState.state === "completed" || liveState.state === "errored") &&
+						!admission.terminal
+					) {
+						q12Admitted = false;
+						return;
+					}
 					if (
 						liveState?.source === "agent_session_event" &&
 						liveState.live === true &&
-						(liveState.state !== "needs_user_input" || liveState.current_turn_id !== admission.active_turn_id)
+						(liveState.state !== "needs_user_input" || liveState.current_turn_id !== admission.active_turn_id) &&
+						!liveInFlightCandidate
 					) {
 						q12Admitted = false;
 						return;
@@ -4581,6 +4632,13 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 								};
 								authority.outcome = { state: "deferred_link", first_seen_at: authority.first_seen_at };
 								authority.updated_at = observedAt;
+								// The runtime already published this gate, but no coordinator turn owns
+								// it yet, so the question stays unmaterialized. Reporting nothing here
+								// made a blocked agent indistinguishable from an idle one: `list_questions`
+								// answered a healthy empty snapshot for the whole deferral window while
+								// the ask behind the gate was waiting for an answer no operator could see
+								// (#5475). The deferral itself is unchanged — only the silence is.
+								diagnostic("pending_registration", null, gate.gate_id);
 								continue;
 							}
 							authority.outcome =
@@ -4596,6 +4654,12 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 							continue;
 						}
 						const turn = owners[0]!;
+						if (liveInFlightCandidate && turn.turn_id !== admission.active_turn_id) {
+							authority.outcome = { state: "ownership_conflict", reason: "ownership_conflict" };
+							authority.updated_at = observedAt;
+							diagnostic("ownership_conflict", turn.turn_id, gate.gate_id);
+							continue;
+						}
 						const provenance = runtimeProvenanceToken(sessionId, transaction, turn, gate);
 						if (!turn.runtime_provenance || canonicalJson(turn.runtime_provenance) !== canonicalJson(provenance))
 							turn.runtime_provenance = provenance;
@@ -4691,6 +4755,8 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 								},
 							};
 						}
+						if (liveInFlightCandidate && turn.turn_id === admission.active_turn_id)
+							liveInFlightAskAdmitted = true;
 					}
 					if (complete)
 						for (const [authorityId, authority] of Object.entries(transaction.canonical.gate_authorities))
@@ -4712,7 +4778,11 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				},
 				options,
 			);
-			if (!q12Admitted)
+			// A complete empty Q12 snapshot proves no pending gate at this revision,
+			// even while an authenticated, acknowledged turn is still running.
+			// Nonempty snapshots still require an admitted ask; all writer, waiting
+			// token and terminal fences above remain authoritative.
+			if (!q12Admitted || (liveInFlightCandidate && items.length > 0 && !liveInFlightAskAdmitted))
 				return {
 					ok: true,
 					schema_version: 1,
@@ -5633,9 +5703,19 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			endpointMtimeMs <= 0
 		)
 			return null;
-		return createHash("sha256")
-			.update(canonicalJson({ endpointGeneration, endpointMtimeMs, pid, sessionId }))
-			.digest("hex");
+		// Single canonical producer lives in endpoint-authority.ts (#5376
+		// follow-up): never reimplement the digest recipe here.
+		return (
+			endpointIncarnation(
+				{
+					endpointGeneration,
+					endpointMtimeMs,
+					pid,
+					...(typeof session.endpointFileId === "string" ? { endpointFileId: session.endpointFileId } : {}),
+				},
+				sessionId,
+			) ?? null
+		);
 	}
 
 	type BrokerSessionAuthority = {
@@ -5701,13 +5781,31 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 
 	async function listSessions(cwd?: string): Promise<Array<Record<string, unknown>>> {
 		const roots = cwd ? [cwd] : config.allowedRoots;
+		const uniqueRoots = [
+			...new Map(
+				roots.map(root => {
+					let canonical = path.resolve(root);
+					try {
+						canonical = nodeFs.realpathSync.native(canonical);
+					} catch {
+						// Preserve the configured path when the root is not materialized yet.
+					}
+					return [normalizePathForComparison(canonical, platform), root] as const;
+				}),
+			).values(),
+		];
 		const listings = await Promise.all(
-			roots.map(async root => {
+			uniqueRoots.map(async root => {
 				const listing = await paginatedBrokerSessionList(root, { cwd: root });
 				return scopedBrokerSessions(Array.isArray(listing.sessions) ? listing.sessions : [], root, platform);
 			}),
 		);
-		return listings.flat();
+		const uniqueSessions = new Map<string, Record<string, unknown>>();
+		for (const session of listings.flat()) {
+			const id = brokerSessionId(session);
+			if (id !== null) uniqueSessions.set(id, session);
+		}
+		return [...uniqueSessions.values()];
 	}
 	function sessionFile(sessionId: unknown): string {
 		return path.join(namespaceDir, "sessions", `${safeExternalId("session", sessionId)}.json`);
@@ -5848,6 +5946,41 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 		);
 		return true;
 	}
+	/**
+	 * True when the broker row for this session is the terminal-uncertain claim a
+	 * forced stale-worktree release recorded against exactly this authority. The
+	 * claim is only accepted as close proof while the row is still that identity:
+	 * a rotated successor, an ambiguous row, or an unreadable listing all fall
+	 * back to the ordinary close.
+	 */
+	async function forcedStaleReleaseProven(
+		sessionId: string,
+		workspace: string | null,
+		endpointGeneration: number,
+		endpointIncarnation: string,
+	): Promise<boolean> {
+		if (!workspace) return false;
+		let matches: Array<Record<string, unknown>>;
+		try {
+			const canonicalWorkspace = await canonicalBrokerWorkspace(workspace);
+			const listing = await paginatedBrokerSessionList(canonicalWorkspace, { cwd: canonicalWorkspace });
+			matches = jsonRecords(Array.isArray(listing.sessions) ? listing.sessions : []).filter(
+				row => brokerSessionId(row) === sessionId,
+			);
+		} catch {
+			return false;
+		}
+		if (matches.length !== 1) return false;
+		const row = matches[0]!;
+		return (
+			row.ambiguous !== true &&
+			(row.terminalUncertain === true || row.terminal_uncertain === true) &&
+			(row.forcedStaleRelease === true || row.forced_stale_release === true) &&
+			brokerEndpointGeneration(row) === endpointGeneration &&
+			brokerEndpointIncarnation(row, sessionId) === endpointIncarnation
+		);
+	}
+
 	async function recoverIntentDeletion(entry: NamespaceDeletionEntryV1): Promise<void> {
 		const session = asRecord(await readJsonFile(sessionFile(entry.session_id)));
 		if (!session) throw new SdkClientError("state_corrupt", "Close intent has no session authority record.");
@@ -5860,19 +5993,33 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				: null;
 		if (!cwd || endpointGeneration === null)
 			throw new SdkClientError("state_corrupt", "Close intent authority is incomplete.");
-		strictBrokerSessionClose(
-			await brokerSession(
-				cwd,
-				"session.close",
-				{
-					sessionId: entry.session_id,
-					endpointGeneration,
-					endpointIncarnation: entry.endpoint_incarnation,
-				},
-				`coordinator-reap:${entry.session_id}:${entry.endpoint_incarnation}`,
-			),
-			entry.session_id,
-		);
+		// #5581: a forced stop that admitted this deletion and then lost its endpoint
+		// already released the worktree by recording a terminal-uncertain claim bound
+		// to this exact authority. The broker refuses an ordinary `session.close`
+		// against such a row (`terminal_uncertain`), so retrying one here would park
+		// the manifest at `intent` forever. The claim is itself the teardown proof:
+		// advance on it instead, exactly as the success path does.
+		if (
+			!(await forcedStaleReleaseProven(
+				entry.session_id,
+				optionalString(session.broker_workspace),
+				endpointGeneration,
+				entry.endpoint_incarnation,
+			))
+		)
+			strictBrokerSessionClose(
+				await brokerSession(
+					cwd,
+					"session.close",
+					{
+						sessionId: entry.session_id,
+						endpointGeneration,
+						endpointIncarnation: entry.endpoint_incarnation,
+					},
+					`coordinator-reap:${entry.session_id}:${entry.endpoint_incarnation}`,
+				),
+				entry.session_id,
+			);
 		await advanceDeletion(questionPaths, entry.deletion_id, "broker_closed", undefined, {
 			ok: true,
 			closed: true,
@@ -5969,22 +6116,49 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			const persistedIncarnation = optionalString(session.endpoint_incarnation);
 			if (!cwd || !persistedWorkspace || persistedGeneration === null || !persistedIncarnation)
 				return { ok: false, reason: "endpoint_stale", closed: false };
+			// #5581: a forced stop of a session whose endpoint has gone stale (its
+			// coordinator service vanished mid-run) cannot prove teardown, so it
+			// returns endpoint_stale below. The worktree release must still happen
+			// first: ask the broker to record a terminal-uncertain claim so the row
+			// stops holding its checkout. Best-effort — the endpoint_stale signal the
+			// caller depends on is returned regardless of whether release succeeds.
+			// The persisted endpoint authority is passed so the broker acts on exactly
+			// this stale identity: a live successor incarnation fails the close
+			// authority check and is never touched, so a legitimately re-held worktree
+			// stays occupied.
+			const releaseStaleWorktreeOnForce = async (): Promise<void> => {
+				if (opts.force !== true) return;
+				try {
+					await brokerSession(cwd, "session.close", {
+						sessionId: id,
+						endpointGeneration: persistedGeneration,
+						endpointIncarnation: persistedIncarnation,
+						forceReleaseStaleWorktree: true,
+					});
+				} catch {
+					// Advisory release; a later launch simply re-observes the row and retries.
+				}
+			};
 			// Endpoint identity is the authority for any lifecycle mutation. Check it
 			// before consulting a possibly stale active-turn projection so a successor
 			// incarnation cannot be blocked by old local state.
 			let preflightWorkspace: string;
 			try {
-				preflightWorkspace = await canonicalBrokerWorkspace(cwd);
+				preflightWorkspace = await canonicalBrokerWorkspace(persistedWorkspace);
 				const authority = await exactBrokerSessionAuthority(id, preflightWorkspace);
 				if (
 					!sameCanonicalPath(authority.workspace, persistedWorkspace, platform) ||
 					authority.endpointGeneration !== persistedGeneration ||
 					authority.endpointIncarnation !== persistedIncarnation
-				)
+				) {
+					await releaseStaleWorktreeOnForce();
 					return { ok: false, reason: "endpoint_stale", closed: false };
+				}
 			} catch (error) {
-				if (error instanceof SdkClientError && (error.code === "not_found" || error.code === "endpoint_stale"))
+				if (error instanceof SdkClientError && (error.code === "not_found" || error.code === "endpoint_stale")) {
+					await releaseStaleWorktreeOnForce();
 					return { ok: false, reason: "endpoint_stale", closed: false };
+				}
 				throw error;
 			}
 			if (session.ephemeral !== true && opts.force !== true)
@@ -6078,7 +6252,7 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			const closeAlreadyProven = deletionPhase === "broker_closed" || deletionPhase === "cleanup_pending";
 			let workspace = "";
 			try {
-				workspace = await canonicalBrokerWorkspace(cwd);
+				workspace = await canonicalBrokerWorkspace(persistedWorkspace);
 				let authority: BrokerSessionAuthority | null = null;
 				if (!closeAlreadyProven) {
 					authority = await exactBrokerSessionAuthority(id, workspace);
@@ -6086,8 +6260,10 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 						!sameCanonicalPath(authority.workspace, persistedWorkspace, platform) ||
 						authority.endpointGeneration !== persistedGeneration ||
 						authority.endpointIncarnation !== persistedIncarnation
-					)
+					) {
+						await releaseStaleWorktreeOnForce();
 						return { ok: false, reason: "endpoint_stale", closed: false };
+					}
 				}
 				await ensureQuestionStateReady();
 				await ensureQuestionTransaction(id);
@@ -6127,6 +6303,15 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 					});
 				}
 			} catch (error) {
+				// #5581: a forced stop can clear the second authority check yet lose the
+				// endpoint before `session.close` reaches the broker, so the close throws
+				// a stale/absent code. The deletion is already admitted as remote_started
+				// but never proven closed, leaving the indexed row holding its worktree.
+				// Record the same identity-bound terminal-uncertain claim before surfacing
+				// the unproven close. Only stale/absent codes qualify: a live endpoint
+				// failing transiently must keep its checkout.
+				if (error instanceof SdkClientError && (error.code === "endpoint_stale" || error.code === "not_found"))
+					await releaseStaleWorktreeOnForce();
 				return {
 					ok: false,
 					reason: "close_failed",
@@ -6211,6 +6396,164 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 		});
 	}
 
+	/**
+	 * Prove a stored endpoint identity (workspace + generation + incarnation) is no
+	 * longer current against the live broker index. Returns true only when the
+	 * broker row is absent (not_found) or its generation/incarnation/workspace has
+	 * rotated away from the stored triple. A transient authority-read failure
+	 * returns false: we cannot prove the endpoint recovered, but we also must not
+	 * force-evict on a flake — the normal reap path will retry.
+	 */
+	async function brokerEndpointIdentityStale(
+		id: string,
+		persistedWorkspace: string,
+		persistedGeneration: number,
+		persistedIncarnation: string,
+	): Promise<boolean> {
+		try {
+			const workspace = await canonicalBrokerWorkspace(persistedWorkspace);
+			const authority = await exactBrokerSessionAuthority(id, workspace);
+			return (
+				!sameCanonicalPath(authority.workspace, persistedWorkspace, platform) ||
+				authority.endpointGeneration !== persistedGeneration ||
+				authority.endpointIncarnation !== persistedIncarnation
+			);
+		} catch (error) {
+			if (error instanceof SdkClientError && (error.code === "not_found" || error.code === "endpoint_stale"))
+				return true;
+			return false;
+		}
+	}
+
+	/**
+	 * True when the session's endpoint authority can no longer be proven current.
+	 * Mirrors the reap preflight so force eviction only fires against a genuinely
+	 * stale endpoint. When the projection carries a full endpoint identity we prove
+	 * staleness against it directly. When the projection identity is missing/corrupt
+	 * (or the projection is absent), an absent field is NOT itself proof of a stale
+	 * endpoint: a partial write can drop `endpoint_incarnation` while the broker
+	 * session is still live. We therefore recover the canonical WAL's own broker
+	 * identity and prove absence/mismatch against that authority instead. If neither
+	 * the projection nor the WAL yields a usable identity, we return false and leave
+	 * the state for the safe repair path rather than destructively evicting a
+	 * possibly-live session.
+	 */
+	async function isSessionEndpointStale(session: Record<string, unknown> | null, id: string): Promise<boolean> {
+		const persistedWorkspace = optionalString(session?.broker_workspace);
+		const persistedGeneration =
+			typeof session?.endpoint_generation === "number" &&
+			Number.isSafeInteger(session.endpoint_generation) &&
+			session.endpoint_generation > 0
+				? session.endpoint_generation
+				: null;
+		const persistedIncarnation = optionalString(session?.endpoint_incarnation);
+		if (persistedWorkspace && persistedGeneration !== null && persistedIncarnation)
+			return await brokerEndpointIdentityStale(id, persistedWorkspace, persistedGeneration, persistedIncarnation);
+		// Projection identity is missing — fall back to the canonical WAL authority.
+		const canonicalTransaction = await readSessionTransaction(questionPaths, id);
+		const broker = canonicalTransaction?.canonical.session.broker;
+		const walWorkspace = optionalString(broker?.workspace);
+		const walGeneration =
+			typeof broker?.endpoint_generation === "number" &&
+			Number.isSafeInteger(broker.endpoint_generation) &&
+			broker.endpoint_generation > 0
+				? broker.endpoint_generation
+				: null;
+		const walIncarnation = optionalString(broker?.endpoint_incarnation);
+		if (!walWorkspace || walGeneration === null || !walIncarnation) return false;
+		return await brokerEndpointIdentityStale(id, walWorkspace, walGeneration, walIncarnation);
+	}
+
+	/**
+	 * Confirm no turn is active for the session, reading the durable authority
+	 * (canonical WAL) and the legacy active-turn projection. `listSessions`
+	 * captures reap candidates before the per-session transition lock is held, so
+	 * a turn can begin in the gap before eviction — this must be re-checked under
+	 * the lock immediately before any irreversible removal.
+	 */
+	async function sessionHasActiveTurn(id: string): Promise<boolean> {
+		const canonicalTransaction = await readSessionTransaction(questionPaths, id);
+		const canonicalActiveTurn = canonicalTransaction
+			? Object.values(canonicalTransaction.canonical.turns).some(turn =>
+					ACTIVE_TURN_STATUSES.has(turn.status as TurnStatus),
+				)
+			: false;
+		return canonicalActiveTurn || (await readActiveTurn(namespaceDir, id)) !== null;
+	}
+
+	/**
+	 * Recovery-safe force eviction for a session whose endpoint is stale. A stale
+	 * endpoint has no live broker to close against, but the session's durable
+	 * footprint must not be orphaned: removing only the projection rows would leak
+	 * the canonical WAL, retained public-delivery claims, and the scheduler/index
+	 * registry hints. We instead write a durable deletion (retirement) record and
+	 * run the same cleanup the normal reap path uses — drain retained deliveries,
+	 * remove the WAL (which also deregisters roster/retained scheduler hints),
+	 * remove projections, and emit the reaped event. If any step cannot finish yet
+	 * the record stays in `cleanup_pending`, so a subsequent reapSession() for this
+	 * id (selected by session_id, not deletion_id) resumes and completes it.
+	 */
+	async function forceEvictStaleSession(sessionId: string): Promise<void> {
+		await ensureQuestionStateReady();
+		// Recover the session by id from the canonical WAL — not just the projection.
+		// A crash/partial-write, or a malformed/legacy projection, can leave canonical
+		// state committed while the projection has lost its endpoint_incarnation.
+		// Keying force eviction off the projection alone would then retire only the
+		// projection files and orphan the WAL, retained public-delivery claims,
+		// registry (roster/retained) hints, and scheduler markers indefinitely: after
+		// three stale sweeps the projection disappears and the normal
+		// deletion-intent/completeDeletionCleanup path can no longer select the id.
+		const canonicalTransaction = await readSessionTransaction(questionPaths, sessionId);
+		if (!canonicalTransaction) {
+			// Canonical state confirmed absent (this also covers the malformed/absent
+			// projection case): the only durable footprint left is the projection, so
+			// best-effort projection removal is all that remains.
+			await removeReapedProjection(sessionId, [], []);
+			return;
+		}
+		// Endpoint authority for the durable retirement comes from the canonical WAL,
+		// never the projection: removeSessionTransaction fences the delete on
+		// `canonicalTransaction.endpoint.incarnation`, so a present-but-stale
+		// projection incarnation would make cleanup fail with endpoint_stale and
+		// orphan the WAL, retained deliveries, and registry state. Using the WAL's
+		// own incarnation guarantees the fence matches.
+		const persistedIncarnation = optionalString(canonicalTransaction.endpoint?.incarnation);
+		if (!persistedIncarnation) {
+			// The WAL exists but never observed an endpoint incarnation, so there is
+			// no authority to fence a durable retirement against. Leave the state for
+			// the normal reap path rather than orphaning the WAL with a
+			// projection-only delete.
+			return;
+		}
+		const deletionId = `force-evict:${sessionId}:${persistedIncarnation}`;
+		const deletionKey = createHash("sha256").update(deletionId).digest("hex");
+		const now = new Date().toISOString();
+		const entry: NamespaceDeletionEntryV1 = {
+			deletion_id: deletionId,
+			session_id: sessionId,
+			endpoint_incarnation: persistedIncarnation,
+			operation_id: deletionId,
+			key_digest: deletionKey,
+			request_digest: deletionKey,
+			close_key: deletionId,
+			phase: "cleanup_pending",
+			cleanup: {
+				wal: false,
+				turns: false,
+				reports: false,
+				session: false,
+				events: false,
+				turn_ids: canonicalTransaction ? Object.keys(canonicalTransaction.canonical.turns) : [],
+				report_ids: canonicalTransaction ? Object.keys(canonicalTransaction.canonical.reports) : [],
+			},
+			authority_digest: deletionKey,
+			created_at: now,
+			updated_at: now,
+		};
+		await recordDeletionIntent(questionPaths, entry);
+		await completeDeletionCleanup(entry, "idle_reaper_force_evict", true);
+	}
+
 	const sessionReaper: SessionReaper = createSessionReaper(
 		{
 			listSessions: async (): Promise<ReapableSession[]> => {
@@ -6261,6 +6604,23 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				const result = await reapSession(sessionId, { reason: "idle_reaper" });
 				if (!result.ok) throw new Error(result.reason ?? "session_reap_failed");
 			},
+			markSessionDead: async (sessionId: string): Promise<void> => {
+				// Force-evict a session that cannot be reaped normally (endpoint_stale
+				// repeated MAX_REAP_FAILURES times). The candidate was selected before
+				// this transition acquired its per-session lock, so revalidate the
+				// durable authority under the lock: a turn may have started, or the
+				// endpoint may have recovered, since listSessions() ran.
+				await withSessionTransition(sessionId, async () => {
+					if (await sessionHasActiveTurn(sessionId)) return;
+					const session = asRecord(await readJsonFile(sessionFile(sessionId)));
+					// Prove endpoint staleness before any destructive eviction, even when the
+					// projection is absent: isSessionEndpointStale falls back to the canonical
+					// WAL authority to confirm broker absence/mismatch, so a missing or
+					// partially-written projection can no longer force-evict a live broker.
+					if (!(await isSessionEndpointStale(session, sessionId))) return;
+					await forceEvictStaleSession(sessionId);
+				});
+			},
 			now: () => Date.now(),
 		},
 		{ idleTtlMs: config.sessionIdleTtlMs, sweepIntervalMs: config.sessionSweepIntervalMs },
@@ -7924,7 +8284,8 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 						};
 					await reconcileSessionRuntime(canonicalSessionId, { observeQuestions: false });
 					try {
-						let indexedSession = (await listSessions(cwd)).find(
+						const brokerWorkspace = optionalString(session.broker_workspace) ?? cwd;
+						let indexedSession = (await listSessions(brokerWorkspace)).find(
 							candidate => brokerSessionId(candidate) === canonicalSessionId,
 						);
 						// Windows broker locators may differ in drive-letter casing or separator
@@ -7932,7 +8293,7 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 						// the coordinator path. The scoped listing request is still authoritative;
 						// only its local path filter is relaxed for the exact requested session.
 						if (!indexedSession && platform === "win32") {
-							const listing = await paginatedBrokerSessionList(cwd, { cwd });
+							const listing = await paginatedBrokerSessionList(brokerWorkspace, { cwd: brokerWorkspace });
 							indexedSession = jsonRecords(Array.isArray(listing.sessions) ? listing.sessions : []).find(
 								candidate => brokerSessionId(candidate) === canonicalSessionId,
 							);
@@ -7987,8 +8348,14 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			}
 			if (name === "gjc_coordinator_list_questions") return await listQuestions(args);
 			if (name === "gjc_coordinator_list_artifacts") return { ok: true, roots: config.allowedRoots };
-			if (name === "gjc_coordinator_read_artifact")
+			if (name === "gjc_coordinator_read_artifact") {
+				// Advertised capability (tools/list) and refusal must agree on the resolved
+				// platform. This can only add a refusal: safeOpenCoordinatorArtifact keeps
+				// the host-real capability and /proc/self/fd identity checks.
+				if (!coordinatorArtifactCapability(platform).available)
+					return publicError(new Error("artifact_unavailable"));
 				return await readCoordinatorArtifact(config, { path: args.path });
+			}
 			if (name === "gjc_coordinator_read_coordination_status") {
 				const scopedSessionId = args.session_id == null ? null : safeExternalId("session", args.session_id);
 				if (scopedSessionId) await ensureQuestionTransaction(scopedSessionId);
@@ -9041,6 +9408,7 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 								session = normalizeSession({
 									session_id: sessionId,
 									cwd: sessionCwd,
+									ephemeral: true,
 									...(mpresetResolution.mpreset ? { mpreset: mpresetResolution.mpreset } : {}),
 									...(modelResolution.model ? { model: modelResolution.model } : {}),
 									broker_workspace: binding.workspace,
@@ -9758,10 +10126,9 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 
 						const admission = await reconcileSessionRuntime(sessionId, { observeQuestions: true });
 						const admissionToken = admission.waiting_token;
-						const liveAdmissionRequired =
-							admission.session_state?.source === "agent_session_event" &&
-							admission.session_state.live === true &&
-							admission.session_state.state === "needs_user_input";
+						const agentRuntimeAdmissionRequired =
+							admission.session_state?.source === "agent_session_event" && admission.session_state.live === true;
+						const liveAdmissionRequired = admission.session_state?.state === "needs_user_input";
 						if (liveAdmissionRequired && !admissionToken)
 							return {
 								ok: false,
@@ -9778,6 +10145,7 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 							};
 						let translated: unknown;
 						let session: Record<string, unknown> | null = null;
+						let liveInFlightAnswerAdmitted = false;
 						const claimed = await withAdmittedSessionTransaction(questionPaths, sessionId, async transaction => {
 							const liveState = await readSessionState(namespaceDir, sessionId);
 							const question = transaction.canonical.questions[questionId];
@@ -9858,10 +10226,30 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 								authority?.observation.kind === "valid"
 									? authority.observation.first_provenance.runtime_turn_id
 									: null;
+							const liveInFlightAskOwned = Boolean(
+								liveState?.schema_version === 1 &&
+									liveState.session_id === sessionId &&
+									liveState?.source === "agent_session_event" &&
+									liveState.live === true &&
+									liveState.state === "running" &&
+									liveState.current_turn_id === turnId &&
+									Number.isFinite(Date.parse(liveState.updated_at)) &&
+									hasExactRuntimeWriterIdentity(liveState, transaction.canonical.session.broker) &&
+									canonicalTurn &&
+									ACTIVE_TURN_STATUSES.has(canonicalTurn.status as TurnStatus) &&
+									hasAcceptedRuntimeReceipt(canonicalTurn) &&
+									authority?.outcome?.state === "pending" &&
+									authority.outcome.turn_id === turnId &&
+									authority.observation.kind === "valid" &&
+									runtimeTurnId === canonicalTurn.delivery.runtime_turn_id,
+							);
 							const liveWaitingOwned =
-								liveState?.source !== "agent_session_event" ||
-								liveState.live !== true ||
-								(liveState.state === "needs_user_input" && liveState.current_turn_id === turnId);
+								liveState?.source !== "agent_session_event"
+									? true
+									: liveState.live === true &&
+										((liveState.state === "needs_user_input" && liveState.current_turn_id === turnId) ||
+											liveInFlightAskOwned);
+							liveInFlightAnswerAdmitted = liveInFlightAskOwned;
 							const provenanceMatches =
 								admissionToken === null ||
 								(Boolean(canonicalTurn?.runtime_provenance) &&
@@ -9873,7 +10261,8 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 								!liveWaitingOwned ||
 								(liveState?.source === "agent_session_event" &&
 									liveState.live === true &&
-									canonicalTurn?.status !== "waiting_for_answer") ||
+									canonicalTurn?.status !== "waiting_for_answer" &&
+									!liveInFlightAskOwned) ||
 								!authority ||
 								authority.observation.kind !== "valid" ||
 								!canonicalTurn ||
@@ -9985,17 +10374,103 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 						const latestAdmission = await reconcileSessionRuntime(sessionId, { observeQuestions: true });
 						const latestState = latestAdmission.session_state;
 						const latestToken = latestAdmission.waiting_token;
-						const latestLiveRequired =
-							latestState?.source === "agent_session_event" &&
-							latestState.live === true &&
-							latestState.state === "needs_user_input";
-						if (
-							latestAdmission.terminal ||
-							(latestLiveRequired && (!latestToken || latestToken.coordinator_turn_id !== turnId)) ||
+						const latestQuestions = await reconcileQuestions(sessionId);
+						const latestSession = asRecord(await readJsonFile(sessionFile(sessionId)));
+						const latestSnapshot = latestSession ? await readCompleteQ12Snapshot(latestSession) : null;
+						let latestFreshGate: (WorkflowGateQueryRecord & WorkflowGate) | undefined;
+						if (latestSnapshot?.complete === true) {
+							latestFreshGate = (latestSnapshot.items as unknown[]).find(row => {
+								if (!row || typeof row !== "object") return false;
+								const record = row as Record<string, unknown>;
+								return record.tag === "pending" && record.gate_id === gateId;
+							}) as (WorkflowGateQueryRecord & WorkflowGate) | undefined;
+						}
+						const latestQ12Proof =
+							latestQuestions.reconciliation.complete &&
+							latestSnapshot?.complete === true &&
+							latestFreshGate !== undefined &&
+							(await withSessionTransaction(questionPaths, sessionId, async transaction => {
+								const canonicalQuestion = transaction.canonical.questions[questionId];
+								const canonicalTurn = transaction.canonical.turns[turnId];
+								const authority = canonicalQuestion
+									? transaction.canonical.gate_authorities[canonicalQuestion.authority_id]
+									: undefined;
+								if (!canonicalQuestion || !canonicalTurn || !authority || !latestFreshGate) return false;
+								const freshProvenance = runtimeProvenanceToken(
+									sessionId,
+									transaction,
+									canonicalTurn,
+									latestFreshGate,
+								);
+								return Boolean(
+									canonicalQuestion.session_id === sessionId &&
+										canonicalQuestion.turn_id === turnId &&
+										(canonicalQuestion.status === "pending" || canonicalQuestion.status === "resolving") &&
+										ACTIVE_TURN_STATUSES.has(canonicalTurn.status as TurnStatus) &&
+										hasAcceptedRuntimeReceipt(canonicalTurn) &&
+										latestFreshGate.gate_id === authority.authority.gate_id &&
+										latestFreshGate.runtime_turn_id === canonicalTurn.delivery.runtime_turn_id &&
+										authority.outcome.state === "pending" &&
+										authority.outcome.turn_id === turnId &&
+										authority.outcome.question_id === questionId &&
+										authority.observation.kind === "valid" &&
+										canonicalTurn.runtime_provenance &&
+										canonicalJson(authority.observation.first_provenance) ===
+											canonicalJson(freshProvenance) &&
+										canonicalJson(canonicalTurn.runtime_provenance) === canonicalJson(freshProvenance) &&
+										!canonicalTurn.terminal_fence,
+								);
+							}));
+						const latestLiveInFlightAsk =
+							!latestAdmission.terminal &&
+							latestAdmission.active_turn_id === turnId &&
+							latestQ12Proof &&
+							(await withSessionTransaction(questionPaths, sessionId, async transaction => {
+								const runtimeState = await readSessionState(namespaceDir, sessionId);
+								const canonicalQuestion = transaction.canonical.questions[questionId];
+								const canonicalTurn = transaction.canonical.turns[turnId];
+								const authority = canonicalQuestion
+									? transaction.canonical.gate_authorities[canonicalQuestion.authority_id]
+									: undefined;
+								const authorityRuntimeTurnId =
+									authority?.observation.kind === "valid"
+										? authority.observation.first_provenance.runtime_turn_id
+										: null;
+								return Boolean(
+									runtimeState?.schema_version === 1 &&
+										runtimeState.session_id === sessionId &&
+										runtimeState.source === "agent_session_event" &&
+										runtimeState.live === true &&
+										runtimeState.state === "running" &&
+										runtimeState.current_turn_id === turnId &&
+										Number.isFinite(Date.parse(runtimeState.updated_at)) &&
+										hasExactRuntimeWriterIdentity(runtimeState, transaction.canonical.session.broker) &&
+										canonicalTurn &&
+										ACTIVE_TURN_STATUSES.has(canonicalTurn.status as TurnStatus) &&
+										hasAcceptedRuntimeReceipt(canonicalTurn) &&
+										canonicalQuestion &&
+										(canonicalQuestion.status === "pending" || canonicalQuestion.status === "resolving") &&
+										authority?.outcome.state === "pending" &&
+										authority.outcome.turn_id === turnId &&
+										authority.observation.kind === "valid" &&
+										canonicalTurn.delivery.runtime_turn_id === authorityRuntimeTurnId &&
+										canonicalTurn.runtime_provenance &&
+										canonicalJson(canonicalTurn.runtime_provenance) ===
+											canonicalJson(authority.observation.first_provenance) &&
+										!canonicalTurn.terminal_fence,
+								);
+							}));
+						const latestAgentRuntimeAdmitted =
+							!agentRuntimeAdmissionRequired ||
 							(latestState?.source === "agent_session_event" &&
 								latestState.live === true &&
-								(latestState.state !== "needs_user_input" || latestState.current_turn_id !== turnId))
-						) {
+								latestState.current_turn_id === turnId &&
+								((liveInFlightAnswerAdmitted && latestState.state === "running" && latestLiveInFlightAsk) ||
+									(!liveInFlightAnswerAdmitted &&
+										latestState.state === "needs_user_input" &&
+										latestToken?.coordinator_turn_id === turnId &&
+										latestQ12Proof)));
+						if (latestAdmission.terminal || !latestQ12Proof || !latestAgentRuntimeAdmitted) {
 							// No remote call has occurred. Undo the durable dispatch claim so this
 							// outer request remains retryable rather than stranding the question in
 							// remote_started/resolving.
@@ -10510,7 +10985,11 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			return { jsonrpc: "2.0", id, result: {} };
 		}
 		if (request.method === "tools/list") {
-			return { jsonrpc: "2.0", id, result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(toolSchema) } };
+			return {
+				jsonrpc: "2.0",
+				id,
+				result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(name => toolSchema(name, platform)) },
+			};
 		}
 		if (request.method === "prompts/list") {
 			return { jsonrpc: "2.0", id, result: { prompts: [] } };
@@ -10564,7 +11043,11 @@ export async function handleCoordinatorMcpRequest(
 		};
 	}
 	if (request.method === "tools/list") {
-		return { jsonrpc: "2.0", id: request.id ?? null, result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(toolSchema) } };
+		return {
+			jsonrpc: "2.0",
+			id: request.id ?? null,
+			result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(name => toolSchema(name, process.platform)) },
+		};
 	}
 	if (request.method === "prompts/list") {
 		return { jsonrpc: "2.0", id: request.id ?? null, result: { prompts: [] } };