@gajae-code/coding-agent 0.17.2 → 0.17.4

package/src/config/model-registry.ts

@@ -44,6 +44,9 @@ import { fetchModelsDevPayload } from "@gajae-code/ai/provider-models/openai-com
 import { isDirectXaiReasoningEffortModel } from "@gajae-code/ai/providers/openai-completions-compat";
 import {
 	detectDiscoveredApiFamily,
+	isSafeCatalogModelId,
+	MODELS_LIST_REQUEST_TIMEOUT_MS,
+	readBoundedModelsJson,
 	resolveLoopbackOpenAIBaseUrl,
 } from "@gajae-code/ai/utils/discovery/openai-compatible";
 
@@ -144,6 +147,36 @@ function redactDiscoveryUrl(value: string | URL): string {
 	}
 }
 
+/**
+ * Scrub resolved credential material from a discovery failure before it is
+ * published to discovery state, cache provenance, or the logger. Mutates
+ * Error messages and stacks in place to preserve class/identity; wraps non-Errors.
+ */
+export function scrubDiscoveryError(error: unknown, secrets: ReadonlyArray<string | undefined>): unknown {
+	const redact = (text: string): string => {
+		let scrubbed = text;
+		for (const secret of secrets) {
+			if (secret) scrubbed = scrubbed.split(secret).join("[redacted]");
+		}
+		return scrubbed;
+	};
+	if (error instanceof Error) {
+		const seen = new Set<Error>();
+		const scrubError = (current: Error): void => {
+			if (seen.has(current)) return;
+			seen.add(current);
+			current.message = redact(current.message);
+			if (typeof current.stack === "string") current.stack = redact(current.stack);
+			if (current.cause instanceof Error) scrubError(current.cause);
+			else if (typeof current.cause === "string") current.cause = redact(current.cause);
+		};
+		scrubError(error);
+		return error;
+	}
+	if (typeof error === "string") return redact(error);
+	return error;
+}
+
 /** Whether a structured transport code proves that no listener accepted the connection. */
 function isConnectionRefusedDiscoveryCode(value: unknown): boolean {
 	if (typeof value === "string") {
@@ -742,13 +775,26 @@ function registryModelMetadataWithoutApiSpecificFields(model: Model<Api>): Parti
 	return metadata;
 }
 
-function registrySelectorResolvesToModel(selector: string, models: readonly Model<Api>[]): boolean {
-	if (models.some(model => model.id === selector || `${model.provider}/${model.id}` === selector)) return true;
-	const suffix = splitSelectorThinkingSuffix(selector);
-	const baseSelector = suffix.thinkingLevel === undefined ? selector : suffix.selector;
+export function registrySelectorResolvesToModel(selector: string, models: readonly Model<Api>[]): boolean {
+	const normalizedSelector = selector.trim().toLowerCase();
+	if (
+		models.some(
+			model =>
+				model.id.toLowerCase() === normalizedSelector ||
+				`${model.provider}/${model.id}`.toLowerCase() === normalizedSelector,
+		)
+	)
+		return true;
+	const suffix = splitSelectorThinkingSuffix(normalizedSelector);
+	const baseSelector = suffix.thinkingLevel === undefined ? normalizedSelector : suffix.selector;
 	const parsed = parseModelString(baseSelector);
-	if (parsed) return models.some(model => model.provider === parsed.provider && model.id === parsed.id);
-	return models.some(model => model.id === baseSelector || model.id.endsWith(`/${baseSelector}`));
+	if (parsed)
+		return models.some(
+			model => model.provider.toLowerCase() === parsed.provider && model.id.toLowerCase() === parsed.id,
+		);
+	return models.some(
+		model => model.id.toLowerCase() === baseSelector || model.id.toLowerCase().endsWith(`/${baseSelector}`),
+	);
 }
 
 function filterMaterializedRegistryProfiles(
@@ -3249,7 +3295,7 @@ export class ModelRegistry {
 			);
 			if (
 				evidence !== undefined &&
-				state?.status === "ok" &&
+				(state?.status === "ok" || state?.status === "empty") &&
 				discovery.fetched &&
 				currentAuthGeneration === evidence.authGeneration &&
 				currentEndpoint === evidence.endpoint
@@ -3287,8 +3333,8 @@ export class ModelRegistry {
 	}
 
 	#profileAvailabilityEvidenceFingerprint(): string {
-		return JSON.stringify(
-			[...this.#descriptorDiscoveryEvidence.entries()]
+		return JSON.stringify({
+			descriptor: [...this.#descriptorDiscoveryEvidence.entries()]
 				.sort(([left], [right]) => left.localeCompare(right))
 				.map(([provider, evidence]) => [
 					provider,
@@ -3300,7 +3346,15 @@ export class ModelRegistry {
 					[...evidence.modelIds].sort(),
 					evidence.profileModelIds === undefined ? undefined : [...evidence.profileModelIds].sort(),
 				]),
-		);
+			configured: [...this.#configuredDiscoveryEvidence.entries()]
+				.sort(([left], [right]) => left.localeCompare(right))
+				.map(([provider, evidence]) => [
+					provider,
+					evidence.authGeneration,
+					evidence.endpoint,
+					[...evidence.modelIds].sort(),
+				]),
+		});
 	}
 
 	#mergeDiscoveredModels(discovered: readonly Model<Api>[]): void {
@@ -3496,8 +3550,14 @@ export class ModelRegistry {
 						await this.#discoverModelsByProviderType(provider, apiKey),
 					);
 				} catch (error) {
-					discoveryFailureEvidence = error;
-					throw error;
+					// ONE credential-safe discovery error boundary: transport
+					// layers may echo request details (including the bearer)
+					// in failure text. Scrub resolved credential material
+					// before the error reaches discovery state, cache
+					// provenance, or the logger below.
+					const scrubbedError = scrubDiscoveryError(error, [apiKey, preflightApiKey]);
+					discoveryFailureEvidence = scrubbedError;
+					throw scrubbedError;
 				}
 			},
 			getEvidenceGeneration: provider => this.#getProviderEvidenceGeneration(provider.provider, preflightApiKey),
@@ -3569,24 +3629,35 @@ export class ModelRegistry {
 		};
 	}
 
-	#discoverModelsByProviderType(
+	async #discoverModelsByProviderType(
 		providerConfig: DiscoveryProviderConfig,
 		apiKey: string | undefined,
 	): Promise<Model<Api>[]> {
+		let models: Model<Api>[];
 		switch (providerConfig.discovery.type) {
 			case "ollama":
-				return this.#discoverOllamaModels(providerConfig, apiKey);
+				models = await this.#discoverOllamaModels(providerConfig, apiKey);
+				break;
 			case "llama.cpp":
-				return this.#discoverLlamaCppModels(providerConfig, apiKey);
+				models = await this.#discoverLlamaCppModels(providerConfig, apiKey);
+				break;
 			case "lm-studio":
 			case "omlx":
 			case "vllm":
 			case "sglang":
 			case "openai-models-list":
-				return this.#discoverOpenAIModelsList(providerConfig, apiKey);
+				models = await this.#discoverOpenAIModelsList(providerConfig, apiKey);
+				break;
 			case "models-dev":
-				return this.#discoverModelsDevProvider(providerConfig);
+				models = await this.#discoverModelsDevProvider(providerConfig);
+				break;
+		}
+		if (providerConfig.discovery.type === "openai-models-list" && models.length === 0) {
+			throw new Error(
+				`Model discovery for ${redactDiscoveryUrl(providerConfig.baseUrl ?? "")} returned no models; add --model <id> or fix the endpoint catalog.`,
+			);
 		}
+		return models;
 	}
 
 	async #discoverBuiltInProviderModels(
@@ -4222,7 +4293,7 @@ export class ModelRegistry {
 			...(providerConfig.discovery.type === "vllm" || providerConfig.discovery.type === "sglang"
 				? { redirect: "error" as const }
 				: {}),
-			signal: AbortSignal.timeout(hardenedLocalDiscovery ? 500 : 5_000),
+			signal: AbortSignal.timeout(hardenedLocalDiscovery ? 500 : MODELS_LIST_REQUEST_TIMEOUT_MS),
 		});
 		if (!response.ok) {
 			if (response.status === 401 || response.status === 403) {
@@ -4234,16 +4305,31 @@ export class ModelRegistry {
 			}
 			throw new Error(`HTTP ${response.status} from ${redactDiscoveryUrl(modelsUrl)}`);
 		}
-		const payload: unknown = await response.json();
+		// Shared 1MB bounded reader (same as the setup probe): a timeout
+		// bounds wall clock, not bytes buffered.
+		let payload: unknown;
+		try {
+			payload = await readBoundedModelsJson(response);
+		} catch {
+			throw new Error(`Malformed OpenAI models-list response from ${redactDiscoveryUrl(modelsUrl)}`);
+		}
 		if (!isRecord(payload) || !Array.isArray(payload.data)) {
 			throw new Error(`Malformed OpenAI models-list response from ${redactDiscoveryUrl(modelsUrl)}`);
 		}
 		const models = payload.data;
 		const discovered: Model<Api>[] = [];
 		for (const item of models) {
-			if (!isRecord(item) || typeof item.id !== "string" || !item.id.trim()) continue;
-			const id = item.id;
+			// Shared catalog admission: the setup probe applies the same
+			// check, so IDs that appear only between requests cannot enter
+			// the live catalog or cache unsanitized.
+			if (!isRecord(item) || !isSafeCatalogModelId(item.id)) continue;
+			const id = item.id.trim();
 			const referenceModel = resolveCustomModelReference(id);
+			// Names render directly in the model selector: apply the same
+			// text-safety admission, falling back to the reference name or
+			// the safe ID.
+			const rawName = typeof item.name === "string" ? item.name.trim() : "";
+			const name = rawName && isSafeCatalogModelId(rawName) ? rawName : (referenceModel?.name ?? id);
 			const discoveredMaxTokens = firstPositiveDiscoveryNumber(
 				item.max_completion_tokens,
 				item.max_tokens,
@@ -4253,7 +4339,7 @@ export class ModelRegistry {
 			discovered.push(
 				enrichModelThinking({
 					id,
-					name: typeof item.name === "string" ? item.name : (referenceModel?.name ?? id),
+					name,
 					api,
 					provider: providerConfig.provider,
 					baseUrl: requestBaseUrl,
@@ -5226,8 +5312,10 @@ export class ModelRegistry {
 	}
 
 	/**
-	 * Get only models that have auth configured.
-	 * This is a fast check that doesn't refresh OAuth tokens.
+	 * Get selectable models with auth configured.
+	 * This is a fast check that doesn't refresh OAuth tokens. A current,
+	 * authoritative live catalog also limits each provider to its enrolled ids;
+	 * bundled entries remain the fallback until that evidence exists.
 	 */
 	getAvailable(): Model<Api>[] {
 		this.#synchronizeEnvironmentCredentials();
@@ -5241,12 +5329,82 @@ export class ModelRegistry {
 		) {
 			return this.#availableModelsCache;
 		}
-		this.#availableModelsCache = this.#models.filter(model => this.#isModelAvailable(model, disabledProviders));
+		const authoritativeDiscoveryIds = new Map<string, ReadonlySet<string> | undefined>();
+		const bundledIdsByProvider = new Map<string, Set<string>>();
+		this.#availableModelsCache = this.#models.filter(model => {
+			if (!this.#isModelAvailable(model, disabledProviders)) return false;
+
+			let liveIds = authoritativeDiscoveryIds.get(model.provider);
+			if (!authoritativeDiscoveryIds.has(model.provider)) {
+				liveIds = this.#getAuthoritativeDiscoveredModelIds(model.provider);
+				authoritativeDiscoveryIds.set(model.provider, liveIds);
+			}
+			// Undefined means discovery has not run successfully for the current
+			// provider context. Keep the bundled catalog as the explicit fallback.
+			if (liveIds === undefined) return true;
+			if (this.#hasCustomModelOverlay(model.provider, model.id)) return true;
+
+			const activity = this.#providerActivity.get(model.provider);
+			if (!activity?.staticModelIds.has(model.id)) return liveIds.has(model.id);
+
+			let bundledIds = bundledIdsByProvider.get(model.provider);
+			if (!bundledIds) {
+				bundledIds = new Set(
+					(getBundledModels(model.provider as Parameters<typeof getBundledModels>[0]) as Model<Api>[]).map(
+						candidate => candidate.id,
+					),
+				);
+				bundledIdsByProvider.set(model.provider, bundledIds);
+			}
+			return !bundledIds.has(model.id) || liveIds.has(model.id);
+		});
 		this.#availableModelsDisabledProviders = disabledProviderKey;
 		this.#availableModelsEnvFingerprint = envFingerprint;
 		return this.#availableModelsCache;
 	}
 
+	/**
+	 * Return the current live model ids only when discovery produced an
+	 * authoritative catalog for the provider and endpoint. An unavailable or
+	 * failed discovery returns undefined so callers retain the bundled fallback.
+	 */
+	#getAuthoritativeDiscoveredModelIds(provider: string): ReadonlySet<string> | undefined {
+		const descriptorEvidence = this.#descriptorDiscoveryEvidence.get(provider);
+		if (descriptorEvidence?.profileFresh && descriptorEvidence.profileModelIds !== undefined) {
+			try {
+				if (
+					descriptorEvidence.authGeneration === this.#getProviderEvidenceGeneration(provider) &&
+					descriptorEvidence.profileEndpoint ===
+						this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(provider) ?? "")
+				) {
+					return descriptorEvidence.profileModelIds;
+				}
+			} catch {
+				// A provider context that can no longer be verified must use its fallback.
+			}
+		}
+
+		const configuredEvidence = this.#configuredDiscoveryEvidence.get(provider);
+		if (!configuredEvidence) return undefined;
+		const discoveryState = this.#discoveryManager.getState(provider);
+		if (
+			discoveryState?.status !== "ok" &&
+			discoveryState?.status !== "cached" &&
+			discoveryState?.status !== "empty"
+		) {
+			return undefined;
+		}
+		try {
+			return configuredEvidence.authGeneration === this.#getProviderEvidenceGeneration(provider) &&
+				configuredEvidence.endpoint ===
+					this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(provider) ?? "")
+				? configuredEvidence.modelIds
+				: undefined;
+		} catch {
+			return undefined;
+		}
+	}
+
 	#synchronizeEnvironmentCredentials(): void {
 		// Runtime registrations own a provider while their credential is present.
 		// Refresh them first so a missing runtime env key can hand ownership back to

package/src/config/settings-schema.ts

@@ -369,6 +369,24 @@ const AUTOROUTING_PROVENANCE_JSON_SCHEMA: JsonSchemaObject = {
 	required: ["schema", "source", "declarationFingerprint", "tiersFingerprint"],
 };
 
+// SDK prompt deadline defaults. The `sdk.promptDeadlineMs` /
+// `sdk.promptMaxRuntimeMs` schema entries below and the SDK bus/host lease
+// fallbacks read these same constants, so a Settings lookup that misses — no
+// settings object, an unwritten key, a non-finite value — cannot arm a deadline
+// that disagrees with the declared default (#5583).
+export const DEFAULT_SDK_PROMPT_DEADLINE_MS = 3_600_000;
+export const DEFAULT_SDK_PROMPT_MAX_RUNTIME_MS = 21_600_000;
+
+/** Resolve a `sdk.promptDeadlineMs` lookup, falling back on any non-finite value. */
+export function resolveSdkPromptDeadlineMs(value: unknown): number {
+	return typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_SDK_PROMPT_DEADLINE_MS;
+}
+
+/** Resolve a `sdk.promptMaxRuntimeMs` lookup, falling back on any non-finite value. */
+export function resolveSdkPromptMaxRuntimeMs(value: unknown): number {
+	return typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_SDK_PROMPT_MAX_RUNTIME_MS;
+}
+
 export const SETTINGS_SCHEMA = {
 	// ────────────────────────────────────────────────────────────────────────
 	// General settings (no UI)
@@ -416,16 +434,22 @@ export const SETTINGS_SCHEMA = {
 	// SDK-owned prompt deadline. Hidden from the UI; ACP has no separate timeout.
 	"sdk.promptDeadlineMs": {
 		type: "number",
-		default: 3_600_000,
+		default: DEFAULT_SDK_PROMPT_DEADLINE_MS,
 		description: "SDK-owned prompt deadline; ACP has no separate timeout.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 86_400_000,
 	},
 	"sdk.promptMaxRuntimeMs": {
 		type: "number",
-		default: 21_600_000,
+		default: DEFAULT_SDK_PROMPT_MAX_RUNTIME_MS,
 		description: "Hard maximum runtime for an SDK prompt from acceptance, bounding progress-aware renewals.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 86_400_000,
 	},
+	"sdk.flushWorktreeOnDeadline": {
+		type: "boolean",
+		default: true,
+		description:
+			"Autosave uncommitted changes in the session's linked worktree by default as a WIP commit when a prompt deadline retires a prompt; primary checkouts require an explicit true opt-in.",
+	},
 	"sdk.masterOrphanGraceMs": {
 		type: "number",
 		default: 120_000,

package/src/coordinator-mcp/policy.ts

@@ -275,11 +275,16 @@ export async function assertCoordinatorSessionLocations(
 	]);
 	// Reauthorize both persisted locations independently. A managed worktree may
 	// differ from the requested cwd, but neither may escape the current roots.
-	if (
-		!roots.some(root => isInsideCanonicalRoot(canonicalCwd, root, platform)) ||
-		!roots.some(root => isInsideCanonicalRoot(canonicalWorkspace, root, platform))
-	)
-		throw new Error("coordinator_workdir_outside_allowed_roots");
+	const escaped: string[] = [];
+	if (!roots.some(root => isInsideCanonicalRoot(canonicalCwd, root, platform))) escaped.push(`cwd ${canonicalCwd}`);
+	if (!roots.some(root => isInsideCanonicalRoot(canonicalWorkspace, root, platform)))
+		escaped.push(`workspace ${canonicalWorkspace}`);
+	if (escaped.length > 0)
+		// The message stays exact because isSessionAuthorityError() in server.ts matches it
+		// verbatim; the escaping location rides in `cause` so a caller that logs can name it.
+		throw new Error("coordinator_workdir_outside_allowed_roots", {
+			cause: new Error(`outside allowed roots: ${escaped.join(", ")}`),
+		});
 }
 
 export async function assertCoordinatorArtifactPath(

package/src/coordinator-mcp/question-gate-codec.ts

@@ -184,6 +184,23 @@ export function buildCoordinatorAskAnswerSchema(
 	return {
 		title: "CoordinatorQuestionAnswerV1",
 		type: "object",
+		// `additionalProperties: false` is scoped by the SIBLING `properties` map, not by
+		// the `oneOf` branches: a standards-compliant validator evaluates the keyword
+		// against this node alone. Without this map every answer field was "additional",
+		// so selection, custom-answer, and clarification payloads were all rejected
+		// client-side before the server saw them (#5801). Each branch stays closed too,
+		// so the union still rejects field combinations this map alone would allow.
+		properties: {
+			selected: selectedBase,
+			other: { type: "boolean", description: "set true to provide a free-text answer in `custom`" },
+			custom: boundedAnswerText("free-text answer; required when `other` is true"),
+			action: {
+				type: "string",
+				enum: ["answer", "clarify"],
+				description: "set to `clarify` to ask about the choices without answering the round",
+			},
+			question: boundedAnswerText("clarification question; required when action is `clarify`"),
+		},
 		additionalProperties: false,
 		oneOf: [
 			{

package/src/coordinator-mcp/question-state.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { logger } from "@gajae-code/utils";
 import { withFileLock } from "../config/file-lock";
 import { ensureCoordinatorDirectory, syncCoordinatorDirectory, writeCoordinatorAtomic } from "./durability";
 import type { PrivateAskGateCodecV1, PublicReason } from "./question-gate-codec";
@@ -567,7 +568,7 @@ async function readTransactionJson<T>(file: string): Promise<T | null> {
 		source = await fs.readFile(file, "utf8");
 	} catch (error) {
 		if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
-		throw new Error("state_corrupt");
+		throw error;
 	}
 	try {
 		const value: unknown = JSON.parse(source);
@@ -605,6 +606,71 @@ function migrateLegacyTransactionV1(transaction: CoordinatorSessionTransactionV1
 	}
 	const authorities = canonical.gate_authorities;
 	const endpointIncarnation = typeof broker?.endpoint_incarnation === "string" ? broker.endpoint_incarnation : null;
+	// Report ids predate COORDINATOR_REPORT_ID_PATTERN. A legacy id is rejected by
+	// the reader forever, and because the reader is the namespace-wide scan, one
+	// historical report bricks every coordination read. Rekey legacy reports onto
+	// the canonical digest form instead of leaving the WAL permanently unreadable.
+	const reports = canonical.reports;
+	const migratedReportIds = new Map<string, string>();
+	if (reports && typeof reports === "object" && !Array.isArray(reports)) {
+		const table = reports as Record<string, Record<string, unknown>>;
+		for (const [reportId, report] of Object.entries(table)) {
+			if (COORDINATOR_REPORT_ID_PATTERN.test(reportId)) continue;
+			if (!report || typeof report !== "object" || Array.isArray(report)) continue;
+			const operationId = typeof report.operation_id === "string" ? report.operation_id : reportId;
+			let migratedId = `report-${digest(`legacy-report\0${record.session_id}\0${operationId}`)}`;
+			const existing = table[migratedId];
+			if (existing) {
+				const existingOperationId = typeof existing.operation_id === "string" ? existing.operation_id : null;
+				if (existingOperationId !== operationId) {
+					// A malformed legacy WAL can collide with the operation-derived digest.
+					// Preserve both records under distinct canonical ids rather than silently
+					// discarding an unrelated report.
+					migratedId = `report-${digest(`legacy-report\0${record.session_id}\0${operationId}\0${reportId}`)}`;
+				}
+			}
+			if (table[migratedId]) {
+				// The canonical report already wins this deterministic collision. The
+				// operation/outbox rewrites below keep every surviving reference coherent.
+				logger.warn("Coordinator legacy report id collision resolved", {
+					sessionId: record.session_id,
+					legacyReportId: reportId,
+					canonicalReportId: migratedId,
+					operationId,
+				});
+				migratedReportIds.set(reportId, migratedId);
+				delete table[reportId];
+				continue;
+			}
+			report.report_id = migratedId;
+			table[migratedId] = report;
+			migratedReportIds.set(reportId, migratedId);
+			delete table[reportId];
+		}
+	}
+	if (migratedReportIds.size > 0) {
+		const requests = record.requests as Record<string, unknown>;
+		const operations = requests.operations;
+		if (operations && typeof operations === "object" && !Array.isArray(operations)) {
+			for (const operation of Object.values(operations as Record<string, Record<string, unknown>>)) {
+				if (!operation || typeof operation !== "object" || Array.isArray(operation)) continue;
+				if (typeof operation.local_id === "string")
+					operation.local_id = migratedReportIds.get(operation.local_id) ?? operation.local_id;
+			}
+		}
+		const outbox = record.outbox as Record<string, Record<string, unknown>>;
+		for (const event of Object.values(outbox)) {
+			if (!event || typeof event !== "object" || Array.isArray(event) || event.entity !== "report") continue;
+			if (typeof event.entity_id === "string")
+				event.entity_id = migratedReportIds.get(event.entity_id) ?? event.entity_id;
+			const payload = event.payload;
+			if (payload && typeof payload === "object" && !Array.isArray(payload)) {
+				const reportId = (payload as Record<string, unknown>).report_id;
+				if (typeof reportId === "string")
+					(payload as Record<string, unknown>).report_id = migratedReportIds.get(reportId) ?? reportId;
+			}
+		}
+	}
 	if (authorities && typeof authorities === "object" && !Array.isArray(authorities)) {
 		for (const authority of Object.values(authorities as Record<string, unknown>)) {
 			if (!authority || typeof authority !== "object" || Array.isArray(authority)) continue;
@@ -1322,9 +1388,16 @@ export async function listCanonicalActiveSessions(
 	const active: string[] = [];
 	for (const sessionId of sessionIds) {
 		if (options.signal?.aborted) throw options.signal.reason ?? new Error("aborted");
-		const transaction = await readTransactionJson<CoordinatorSessionTransactionV1>(transactionPath(paths, sessionId));
-		if (!transaction) continue;
-		assertTransaction(transaction, path.basename(paths.root), sessionId);
+		let transaction: CoordinatorSessionTransactionV1 | null;
+		try {
+			transaction = await readTransactionJson<CoordinatorSessionTransactionV1>(transactionPath(paths, sessionId));
+			if (!transaction) continue;
+			assertTransaction(transaction, path.basename(paths.root), sessionId);
+		} catch (error) {
+			if (!(error instanceof Error) || error.message !== "state_corrupt") throw error;
+			logger.warn("Coordinator active-session scan skipped corrupt WAL", { sessionId });
+			continue;
+		}
 		const hasActiveTurn = Object.values(transaction.canonical.turns).some(turn =>
 			["queued", "delivering", "active", "waiting_for_answer", "completing"].includes(turn.status),
 		);
@@ -1418,14 +1491,74 @@ export async function advanceSchedulerCursor(
 export async function readSessionTransaction(
 	paths: CoordinatorStatePaths,
 	sessionId: string,
+	options: { signal?: AbortSignal } = {},
 ): Promise<CoordinatorSessionTransactionV1 | null> {
+	options.signal?.throwIfAborted();
 	const transaction = await readTransactionJson<CoordinatorSessionTransactionV1>(transactionPath(paths, sessionId));
+	options.signal?.throwIfAborted();
 	if (!transaction) return null;
+	// Atomic WAL replacement permits lock-free snapshots. Normalize only in
+	// memory; durable report migration belongs to explicit projection recovery.
 	assertTransaction(transaction, path.basename(paths.root), sessionId);
-	normalizeOutbox(transaction);
 	return transaction;
 }
 
+export async function repairLegacyReportIds(
+	paths: CoordinatorStatePaths,
+	sessionId: string,
+	options: { signal?: AbortSignal } = {},
+): Promise<CoordinatorSessionTransactionV1 | null> {
+	options.signal?.throwIfAborted();
+	const file = transactionPath(paths, sessionId);
+	const snapshot = await readTransactionJson<CoordinatorSessionTransactionV1>(file);
+	options.signal?.throwIfAborted();
+	if (!snapshot) return null;
+	const hasLegacyReports = Object.keys(snapshot.canonical?.reports ?? {}).some(
+		reportId => !COORDINATOR_REPORT_ID_PATTERN.test(reportId),
+	);
+	if (!hasLegacyReports) {
+		// Atomic WAL replacement permits lock-free snapshots. In-memory schema
+		// normalization alone must never turn an observation into a durable write.
+		assertTransaction(snapshot, path.basename(paths.root), sessionId);
+		return snapshot;
+	}
+	// Only legacy report rekeying needs a durable repair. Re-read under the lock
+	// so a concurrent writer cannot be overwritten; never wait behind that writer
+	// during namespace observation. The caller can skip a contended peer and retry.
+	return await withFileLock(
+		transactionLockPath(paths, sessionId),
+		async () => {
+			const transaction = await readTransactionJson<CoordinatorSessionTransactionV1>(file);
+			if (!transaction) return null;
+			const legacyReportIds = Object.keys(transaction.canonical?.reports ?? {}).filter(
+				reportId => !COORDINATOR_REPORT_ID_PATTERN.test(reportId),
+			);
+			assertTransaction(transaction, path.basename(paths.root), sessionId);
+			normalizeOutbox(transaction);
+			if (legacyReportIds.some(reportId => !Object.hasOwn(transaction.canonical.reports, reportId))) {
+				// Legacy report ids and their references are repaired as one durable WAL
+				// transaction. Bump the revision so scheduler/projection consumers cannot
+				// mistake the repaired image for the pre-migration one.
+				transaction.revision += 1;
+				transaction.projection.scheduler_pending_revision = transaction.revision;
+				transaction.projection.scheduler_digest = digest(
+					JSON.stringify({
+						session_id: transaction.session_id,
+						revision: transaction.revision,
+						active: transaction.canonical.queue.active_turn_id !== null,
+						state: transaction.canonical.desired_session_state,
+					}),
+				);
+				assertTransaction(transaction, path.basename(paths.root), sessionId);
+				options.signal?.throwIfAborted();
+				await writeAtomic(file, transaction);
+			}
+			return transaction;
+		},
+		{ ...lockOptions(options.signal), retries: 1, retryDelayMs: 0 },
+	);
+}
+
 export async function withSessionTransaction<T>(
 	paths: CoordinatorStatePaths,
 	sessionId: string,
@@ -2303,10 +2436,19 @@ export async function enumeratePublicDeliveries(
 					after_order_key: afterOrderKey,
 				});
 			} catch (error) {
-				if (!(error instanceof Error) || error.message !== "resource_gone") throw error;
+				if (error instanceof Error && (error.message === "resource_gone" || error.message === "state_corrupt")) {
+					if (error.message === "state_corrupt")
+						logger.warn("Coordinator delivery scan skipped corrupt WAL", { sessionId });
+				} else throw error;
+			}
+			let endpointIncarnation: string | undefined;
+			try {
+				endpointIncarnation = (await readSessionTransaction(paths, sessionId))?.canonical.session.broker
+					.endpoint_incarnation;
+			} catch (error) {
+				if (!(error instanceof Error) || error.message !== "state_corrupt") throw error;
+				logger.warn("Coordinator delivery scan skipped corrupt WAL", { sessionId });
 			}
-			const endpointIncarnation = (await readSessionTransaction(paths, sessionId))?.canonical.session.broker
-				.endpoint_incarnation;
 			for (const claim of batch)
 				claims.push({
 					...claim,
@@ -2349,6 +2491,30 @@ export function compactTransaction(transaction: CoordinatorSessionTransactionV1,
 	);
 	const pinnedRequests = new Set<object>(pinnedPrompts);
 	const pinnedTurns = new Set(pinnedPrompts.map(request => request.coordinator_turn_id));
+	// An active acknowledged turn proves its runtime receipt through the prompt
+	// request that carries it. Dropping that request on retention leaves the WAL
+	// failing its own `assertTransaction` receipt invariant on the next read, so
+	// the session — and every namespace-wide scan that touches it — is corrupt
+	// forever. Retention must never outrank an invariant the reader enforces.
+	const activeTurnStatuses = new Set(["delivering", "active", "waiting_for_answer", "completing"]);
+	const receiptBearingPromptIds = new Set(
+		Object.entries(transaction.requests.prompts)
+			.filter(([, request]) => {
+				const turn = request.coordinator_turn_id
+					? transaction.canonical.turns[request.coordinator_turn_id]
+					: undefined;
+				if (!turn || !activeTurnStatuses.has(turn.status)) return false;
+				const delivery = turn.delivery as Record<string, unknown>;
+				if (delivery.prompt_acknowledged !== true) return false;
+				return (
+					["accepted", "linked", "terminal", "completed"].includes(request.phase) &&
+					request.runtime_receipt?.accepted === true &&
+					request.runtime_receipt.command_id === delivery.runtime_command_id &&
+					request.runtime_receipt.turn_id === delivery.runtime_turn_id
+				);
+			})
+			.map(([id]) => id),
+	);
 	for (const [id, event] of Object.entries(transaction.outbox))
 		if (
 			event.emitted &&
@@ -2362,6 +2528,7 @@ export function compactTransaction(transaction: CoordinatorSessionTransactionV1,
 			if (
 				request.phase === "completed" &&
 				!pinnedRequests.has(request) &&
+				!receiptBearingPromptIds.has(id) &&
 				old(request.updated_at) &&
 				JSON.stringify(transaction.canonical).includes(id) === false
 			)