@gajae-code/coding-agent 0.18.5 → 0.18.7

package/src/session/blob-store.ts

@@ -4,6 +4,7 @@ import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import { exactUnlink } from "@gajae-code/natives";
 import { isEnoent, logger, postmortem } from "@gajae-code/utils";
+import { readLinuxProcStartTimeSync } from "../gjc-runtime/linux-proc";
 
 const BLOB_PREFIX = "blob:sha256:";
 const CANONICAL_BLOB_NAME = /^[0-9a-f]{64}$/;
@@ -46,10 +47,21 @@ const RESIDENT_CACHE_SWEEP_EXPECTED_IO_CODES = new Set([
 ]);
 const ownedResidentCacheInstanceDirs = new Set<string>();
 const activeResidentCacheRootSweeps = new Set<string>();
-let ownResidentCacheProcessStartTimeMs: number | null | undefined;
+let ownResidentCacheProcessStart: ResidentCacheProcessStart | undefined;
 
-/** Marks `startTimeMs` as an absolute instant parsed from a UTC-pinned `ps` render. */
-const RESIDENT_CACHE_START_TIME_BASIS = "utc";
+/** Marks `startTimeMs` as an absolute instant parsed from a UTC-pinned `ps` render (non-Linux). */
+const RESIDENT_CACHE_UTC_START_TIME_BASIS = "utc";
+/**
+ * Prefix for a Linux start identity: `startTimeMs` holds `/proc/<pid>/stat` field 22
+ * (clock ticks since boot) and the suffix is the kernel `boot_id`. Ticks are immune
+ * to wall-clock adjustment; the boot id scopes them to one kernel boot.
+ */
+const RESIDENT_CACHE_LINUX_START_TIME_BASIS_PREFIX = "linux-proc-ticks:";
+
+interface ResidentCacheProcessStart {
+	readonly startTimeMs: number | null;
+	readonly basis: string;
+}
 
 interface ResidentCacheOwnerToken {
 	readonly pid: number;
@@ -240,19 +252,47 @@ function assertResidentCacheDirectoryPathMatchesDescriptor(pathname: string, des
 	assertResidentCacheDirectoryDescriptor(pathname, current, descriptor, uid);
 }
 
-function residentCacheProcessStartTimeMs(pid: number): number | null {
-	if (pid === process.pid && ownResidentCacheProcessStartTimeMs !== undefined) {
-		return ownResidentCacheProcessStartTimeMs;
-	}
+let residentCacheLinuxBootId: string | null | undefined;
 
-	// Mirror file-lock's `ps`-based process incarnation probe, but pin the locale
-	// AND the zone. `lstart` is a zoneless local wall clock rendered by `ps` from
-	// /etc/localtime, while `Date.parse` of a zoneless string binds it to the JS
-	// runtime's own zone. Those are two independent resolutions, so a reader whose
-	// runtime resolves UTC while `ps` renders UTC+9 derives an epoch nine hours off
-	// for the very same live process — and this value's only job is to detect PID
-	// reuse, so a disagreeing reader reports every live owner as reused and the GC
-	// reaps a running session's cache. Pinning TZ on the child fixes the rendering
+function readResidentCacheLinuxBootId(): string | null {
+	if (residentCacheLinuxBootId !== undefined) return residentCacheLinuxBootId;
+	let bootId: string | null = null;
+	try {
+		const text = fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+		if (/^[0-9a-f-]{36}$/.test(text)) bootId = text;
+	} catch {
+		// Without a boot id, tick counts cannot be scoped to one boot.
+	}
+	residentCacheLinuxBootId = bootId;
+	return bootId;
+}
+
+function residentCacheProcessStart(pid: number): ResidentCacheProcessStart {
+	if (pid === process.pid && ownResidentCacheProcessStart !== undefined) return ownResidentCacheProcessStart;
+	const start = process.platform === "linux" ? residentCacheLinuxProcessStart(pid) : residentCacheUtcProcessStart(pid);
+	if (pid === process.pid) ownResidentCacheProcessStart = start;
+	return start;
+}
+
+// `ps -o lstart` is NOT a stable identity on Linux: procps renders it as
+// `btime + starttime_ticks`, and `btime` is re-derived from the current wall clock
+// minus uptime. On hosts whose clock is continuously slewed (WSL2 is the common
+// case) `btime` drifts, so the very same live process reports a start time that
+// moves by seconds to minutes over a session. Any drift reads as PID reuse and the
+// GC reaps a running session's cache. The raw tick count never moves.
+function residentCacheLinuxProcessStart(pid: number): ResidentCacheProcessStart {
+	const bootId = readResidentCacheLinuxBootId();
+	if (bootId === null) return { startTimeMs: null, basis: RESIDENT_CACHE_LINUX_START_TIME_BASIS_PREFIX };
+	const basis = `${RESIDENT_CACHE_LINUX_START_TIME_BASIS_PREFIX}${bootId}`;
+	const ticks = readLinuxProcStartTimeSync(pid);
+	const startTimeMs = ticks === null ? Number.NaN : Number(ticks);
+	return { startTimeMs: Number.isSafeInteger(startTimeMs) ? startTimeMs : null, basis };
+}
+
+function residentCacheUtcProcessStart(pid: number): ResidentCacheProcessStart {
+	// Pin the locale AND the zone. `lstart` is a zoneless local wall clock rendered
+	// by `ps` from /etc/localtime, while `Date.parse` of a zoneless string binds it
+	// to the JS runtime's own zone. Pinning TZ on the child fixes the rendering
 	// side; the explicit GMT suffix fixes the parsing side.
 	let startTimeMs: number | null = null;
 	try {
@@ -269,8 +309,7 @@ function residentCacheProcessStartTimeMs(pid: number): number | null {
 	} catch {
 		// An unavailable process-start source cannot prove PID reuse.
 	}
-	if (pid === process.pid) ownResidentCacheProcessStartTimeMs = startTimeMs;
-	return startTimeMs;
+	return { startTimeMs, basis: RESIDENT_CACHE_UTC_START_TIME_BASIS };
 }
 
 type ResidentCacheOwnerLiveness = "alive" | "dead" | "unknown";
@@ -376,10 +415,11 @@ function readResidentCacheOwnerSnapshot(instanceDir: string, uid: number): Resid
 function writeResidentCacheOwnerToken(instanceDir: string, uid: number): void {
 	const nonce = path.basename(instanceDir).slice("i-".length);
 	if (!nonce) throw new ResidentCacheTrustError("instance_nonce_missing", instanceDir);
+	const ownStart = residentCacheProcessStart(process.pid);
 	const owner: ResidentCacheOwnerToken = {
 		pid: process.pid,
-		startTimeMs: residentCacheProcessStartTimeMs(process.pid),
-		startTimeBasis: RESIDENT_CACHE_START_TIME_BASIS,
+		startTimeMs: ownStart.startTimeMs,
+		startTimeBasis: ownStart.basis,
 		nonce,
 		createdAt: Date.now(),
 	};
@@ -579,26 +619,31 @@ function residentCacheSweepLimit(value: number | undefined, ceiling: number): nu
 	return Math.max(0, Math.min(Math.floor(value), ceiling));
 }
 
-function cachedResidentCacheProcessStartTimeMs(pid: number, cache: Map<number, number | null>): number | null {
-	if (cache.has(pid)) return cache.get(pid) ?? null;
-	const startTimeMs = residentCacheProcessStartTimeMs(pid);
-	cache.set(pid, startTimeMs);
-	return startTimeMs;
+function cachedResidentCacheProcessStart(
+	pid: number,
+	cache: Map<number, ResidentCacheProcessStart>,
+): ResidentCacheProcessStart {
+	const cached = cache.get(pid);
+	if (cached !== undefined) return cached;
+	const start = residentCacheProcessStart(pid);
+	cache.set(pid, start);
+	return start;
 }
 
 function residentCacheOwnerIsStale(
 	owner: ResidentCacheOwnerToken,
-	startTimeCache: Map<number, number | null>,
+	startTimeCache: Map<number, ResidentCacheProcessStart>,
 ): boolean {
 	const liveness = residentCacheOwnerLiveness(owner.pid);
 	if (liveness === "dead") return true;
 	if (liveness !== "alive" || owner.startTimeMs === null) return false;
-	// A token from before the UTC pin carries a zone-dependent wall clock. Comparing
-	// it against an absolute instant would read an ordinary timezone offset as PID
-	// reuse and reap a live owner, so an unlabelled basis leaves reuse unproven.
-	if (owner.startTimeBasis !== RESIDENT_CACHE_START_TIME_BASIS) return false;
-	const currentStartTimeMs = cachedResidentCacheProcessStartTimeMs(owner.pid, startTimeCache);
-	return currentStartTimeMs !== null && currentStartTimeMs !== owner.startTimeMs;
+	const current = cachedResidentCacheProcessStart(owner.pid, startTimeCache);
+	// Start times are comparable only on the same basis (and, on Linux, the same
+	// boot). A token from an older writer (unlabelled zone-dependent wall clock, or
+	// the drifting `ps` render) or another basis leaves reuse unproven, so a live
+	// owner is never reaped on a basis mismatch.
+	if (owner.startTimeBasis !== current.basis) return false;
+	return current.startTimeMs !== null && current.startTimeMs !== owner.startTimeMs;
 }
 
 function reapResidentCacheInstanceDir(
@@ -681,7 +726,7 @@ export async function sweepResidentCacheRoot(root: string, options: ResidentCach
 			// cache state behind.
 			rootDescriptor = openVerifiedResidentCacheDirectory(root, uid);
 			assertResidentCacheDirectoryPathMatchesDescriptor(root, rootDescriptor, uid);
-			const startTimeCache = new Map<number, number | null>();
+			const startTimeCache = new Map<number, ResidentCacheProcessStart>();
 			const entries = fs.opendirSync(root);
 			try {
 				let examined = 0;
@@ -746,7 +791,7 @@ function openVerifiedCacheInstanceDir(root: string, instanceName?: string): stri
 					const staleInstance = readResidentCacheOwnerSnapshot(candidate, uid);
 					if (
 						staleInstance === null ||
-						!residentCacheOwnerIsStale(staleInstance.owner, new Map<number, number | null>()) ||
+						!residentCacheOwnerIsStale(staleInstance.owner, new Map<number, ResidentCacheProcessStart>()) ||
 						!reapResidentCacheInstanceDir(root, rootDescriptor, candidate, staleInstance, uid)
 					) {
 						throw error;

package/src/session/internal/managed-session-storage.ts

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import type {
 	NativeDirectoryTreeSnapshot,
@@ -11,6 +12,7 @@ import type {
 	RecoveryFsRoot,
 } from "@gajae-code/natives";
 import { isEnoent, logger } from "@gajae-code/utils";
+import { isProcessIncarnation, observeProcessIncarnation } from "../../sdk/broker/process-incarnation";
 import type { SessionStorageRangeSnapshot, SessionStorageStat } from "../session-storage";
 import {
 	classifyNativePublishOutcome,
@@ -370,8 +372,69 @@ type ReplacementCleanupReceipt = {
 	destination: string;
 	successor: SerializedReplacementIdentity;
 	predecessor: SerializedReplacementIdentity;
+	publisher?: ReplacementReceiptPublisher;
 };
 
+type ReplacementReceiptPublisher = {
+	attemptId: string;
+	ownerId: string;
+	pid: number;
+	incarnation: string;
+	host: string;
+};
+
+// A process can contain multiple JS isolates. Only this exact owner may infer
+// that an absent local attempt has settled; another isolate's empty set is not
+// evidence that its sibling has finished publishing.
+const replacementPublisherOwnerId = randomUUID();
+const activeReplacementAttempts = new Set<string>();
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+function replacementReceiptPublisher(bytes: Uint8Array): ReplacementReceiptPublisher | undefined {
+	let record: Record<string, unknown> | undefined;
+	try {
+		record = asRecord(JSON.parse(Buffer.from(bytes).toString("utf8")));
+	} catch {
+		return undefined;
+	}
+	if (!record || !Object.hasOwn(record, "publisher")) return undefined;
+	const publisher = asRecord(record.publisher);
+	if (
+		!publisher ||
+		typeof publisher.attemptId !== "string" ||
+		!UUID_PATTERN.test(publisher.attemptId) ||
+		typeof publisher.ownerId !== "string" ||
+		!UUID_PATTERN.test(publisher.ownerId) ||
+		!Number.isSafeInteger(publisher.pid) ||
+		Number(publisher.pid) <= 0 ||
+		Number(publisher.pid) > 0x7fff_ffff ||
+		!isProcessIncarnation(publisher.incarnation) ||
+		typeof publisher.host !== "string" ||
+		!publisher.host ||
+		typeof record.destination !== "string" ||
+		typeof record.staging !== "string" ||
+		path.resolve(record.staging) !==
+			path.join(
+				path.dirname(path.resolve(record.destination)),
+				`.${path.basename(record.destination)}.${publisher.attemptId}.replacement`,
+			)
+	)
+		throw new Error("managed_replace_cleanup_receipt_invalid");
+	return publisher as ReplacementReceiptPublisher;
+}
+
+/** Unknown/remote/stopped owners retain their receipt; elapsed time is not death proof. */
+function replacementReceiptIsOwned(bytes: Uint8Array): boolean {
+	const publisher = replacementReceiptPublisher(bytes);
+	if (!publisher) return false;
+	if (publisher.host !== os.hostname()) return true;
+	if (publisher.pid === process.pid && publisher.ownerId === replacementPublisherOwnerId)
+		return activeReplacementAttempts.has(publisher.attemptId);
+	const observed = observeProcessIncarnation(publisher.pid);
+	if (observed.status === "absent") return false;
+	return observed.status !== "present" || observed.incarnation === publisher.incarnation;
+}
+
 type LegacyReplacementCleanupIdentity = {
 	dev: bigint;
 	ino: bigint;
@@ -1411,6 +1474,7 @@ export class ManagedSessionDescendantStore {
 		retained?: { authority: RecoveryFsRoot; authorityBaseDir: string },
 		policy?: ManagedSessionSecurityPolicy,
 		profileAgentDir?: string,
+		expectedSubtreeRoot?: ManagedDirectoryRoot,
 	) {
 		managedRelativePath(root, baseDir);
 
@@ -1449,13 +1513,46 @@ export class ManagedSessionDescendantStore {
 				});
 			}
 			this.#authority = retained.authority;
+			if (
+				expectedSubtreeRoot &&
+				(expectedSubtreeRoot.canonicalPath !== this.#baseDir ||
+					expectedSubtreeRoot.dev !== this.#subtreeRoot.dev ||
+					expectedSubtreeRoot.ino !== this.#subtreeRoot.ino)
+			)
+				throw new Error("Managed subtree authority changed during establishment");
 			this.#assertBound();
 
 			return;
 		}
 		assertManagedDirectoryRoot(root);
-		ensureManagedDirectory(this.#baseDir, root, this.#policy);
+		if (expectedSubtreeRoot) {
+			if (expectedSubtreeRoot.canonicalPath !== this.#baseDir)
+				throw new Error("Managed subtree authority path mismatch");
+			assertManagedDirectoryRoot(expectedSubtreeRoot);
+			const verified = validateNativeSecurityResult(
+				process.platform === "win32"
+					? nativeSessionStorage().verifyOwnerOnlyPathSecurityExpected(
+							this.#baseDir,
+							"directory",
+							expectedSubtreeRoot.dev,
+							expectedSubtreeRoot.ino,
+						)
+					: nativeSessionStorage().verifyOwnerOnlyPathSecurity(this.#baseDir, "directory"),
+				"verify",
+				"directory",
+			);
+			if (!verified.ok) throw securityError(this.#baseDir, verified);
+			assertManagedDirectoryRoot(expectedSubtreeRoot);
+		} else {
+			ensureManagedDirectory(this.#baseDir, root, this.#policy);
+		}
 		const subtreeStat = fs.lstatSync(this.#baseDir, { bigint: true });
+		if (
+			expectedSubtreeRoot &&
+			(canonicalFileId(subtreeStat.dev) !== expectedSubtreeRoot.dev ||
+				canonicalFileId(subtreeStat.ino) !== expectedSubtreeRoot.ino)
+		)
+			throw new Error("Managed subtree authority changed during establishment");
 		this.#subtreeRoot = Object.freeze({
 			canonicalPath: this.#baseDir,
 			dev: canonicalFileId(subtreeStat.dev),
@@ -1571,6 +1668,50 @@ export class ManagedSessionDescendantStore {
 		}
 		this.#assertBound();
 	}
+
+	/** Capture a directory identity through this store's retained managed root without repairing it. */
+	captureDirectoryIdentity(relativePath: string): { dev: string; ino: string } {
+		this.#assertBound();
+		const resolved = this.#resolve(relativePath);
+		if (!this.#authority) this.#assertPathBackedDirectoryChain(resolved);
+		const named = fs.lstatSync(resolved, { bigint: true });
+		if (!named.isDirectory() || named.isSymbolicLink()) throw new Error("managed_directory_identity_unavailable");
+		const dev = canonicalFileId(named.dev);
+		const ino = canonicalFileId(named.ino);
+		if (dev !== this.#subtreeRoot.dev) throw new Error("managed_directory_identity_unavailable");
+		if (this.#authority) {
+			const retainedRelative = this.#relative(resolved);
+			if (retainedRelative === "") {
+				if (dev !== this.#subtreeRoot.dev || ino !== this.#subtreeRoot.ino)
+					throw new Error("Managed descendant root binding changed");
+			} else {
+				const retained = this.#authority.retainManagedDirectory(retainedRelative, dev.toString(), ino.toString());
+				try {
+					const identity = retained.identity();
+					if (
+						!identity.ok ||
+						!identity.identity ||
+						identity.identity.dev !== dev.toString() ||
+						identity.identity.ino !== ino.toString()
+					)
+						throw new Error(identity.code ?? "managed_directory_identity_unavailable");
+				} finally {
+					retained.close();
+				}
+			}
+		}
+		const after = fs.lstatSync(resolved, { bigint: true });
+		if (
+			!after.isDirectory() ||
+			after.isSymbolicLink() ||
+			canonicalFileId(after.dev) !== dev ||
+			canonicalFileId(after.ino) !== ino
+		)
+			throw new Error("managed_directory_identity_changed");
+		this.#assertBound();
+		return { dev: dev.toString(), ino: ino.toString() };
+	}
+
 	#assertBound(): void {
 		if (!this.#authority) {
 			const named = fs.statSync(this.#baseDir, { bigint: true });
@@ -1668,6 +1809,7 @@ export class ManagedSessionDescendantStore {
 			if (this.#recoverReplacementCleanupPlaceholder(receiptPath, binding, receipt)) return;
 			throw new Error("managed_replace_cleanup_receipt_invalid");
 		}
+		if (replacementReceiptIsOwned(receipt.bytes)) return;
 		const predecessor = binding.predecessor;
 		const quarantineName = replacementReceiptRetirementName(receipt.identity, predecessor);
 		const detached = nativeSessionStorage().exactUnlink(receiptPath, {
@@ -1770,7 +1912,14 @@ export class ManagedSessionDescendantStore {
 	}
 
 	#reconcilePendingReplacementReceipt(receiptPath: string): void {
-		const pending = captureManagedFilePrefixNoFollow(receiptPath, REPLACEMENT_CLEANUP_RECEIPT_MAX_BYTES);
+		let pending: ManagedFileSnapshot;
+		try {
+			pending = captureManagedFilePrefixNoFollow(receiptPath, REPLACEMENT_CLEANUP_RECEIPT_MAX_BYTES);
+		} catch (error) {
+			// Directory enumeration is not a claim on a peer's receipt name.
+			if (isEnoent(error)) return;
+			throw error;
+		}
 		const parsed = parseReplacementCleanupReceipt(pending.bytes);
 		const predecessor = parsed ? parseReplacementIdentity(parsed.predecessor) : undefined;
 		if (
@@ -1780,6 +1929,7 @@ export class ManagedSessionDescendantStore {
 			path.dirname(path.resolve(parsed.destination)) !== this.#baseDir
 		)
 			throw new Error("managed_replace_cleanup_receipt_invalid");
+		if (replacementReceiptIsOwned(pending.bytes)) return;
 		const destination = replacementReceiptPath(this.#baseDir, predecessor, pending.identity);
 		const outcome = classifyNativePublishOutcome(
 			nativeSessionStorage().renameNoReplacePath(receiptPath, destination),
@@ -1788,7 +1938,11 @@ export class ManagedSessionDescendantStore {
 			fsyncDirectory(this.#baseDir);
 			return;
 		}
-		if (outcome.reason === "destination_exists" || outcome.reason === "invalid_request") {
+		if (
+			outcome.reason === "destination_exists" ||
+			outcome.reason === "invalid_request" ||
+			(outcome.reason === "identity_violation" && outcome.mutationState === "not_committed")
+		) {
 			const captureIfPresent = (pathname: string): ManagedFileSnapshot | undefined => {
 				try {
 					return captureManagedFilePrefixNoFollow(pathname, REPLACEMENT_CLEANUP_RECEIPT_MAX_BYTES);
@@ -2943,6 +3097,34 @@ export class ManagedSessionDescendantStore {
 		if (!removed.ok) throw new Error(removed.code ?? "managed_remove_failed");
 		this.#assertBound();
 	}
+
+	/** Remove one exact managed tree through the parent-identity-bound native protocol. */
+	removeTreeExpectedWithParentIdentity(
+		relativePath: string,
+		expected: NativeDirectoryTreeSnapshot,
+		parentIdentity: { dev: bigint; ino: bigint },
+	): NativeExactUnlinkResult {
+		this.#beforeMutation();
+		this.#assertBound();
+		const resolved = this.#resolve(relativePath);
+		const parentPath = path.dirname(resolved);
+		const parentRelative = path.relative(this.#baseDir, parentPath);
+		if (path.isAbsolute(parentRelative) || parentRelative === ".." || parentRelative.startsWith(`..${path.sep}`))
+			throw new Error("managed_remove_parent_outside_store");
+		const currentParent = this.captureDirectoryIdentity(parentRelative);
+		if (
+			currentParent.dev !== canonicalFileId(parentIdentity.dev).toString() ||
+			currentParent.ino !== canonicalFileId(parentIdentity.ino).toString()
+		)
+			throw new Error("managed_remove_parent_identity_mismatch");
+		const removed = nativeSessionStorage().exactRemoveDirectoryTree(resolved, expected, {
+			dev: BigInt(currentParent.dev),
+			ino: BigInt(currentParent.ino),
+		});
+		this.#assertBound();
+		return removed;
+	}
+
 	fsyncTree(): NativeDirectoryTreeSnapshot {
 		this.#beforeMutation();
 		this.#assertBound();
@@ -3524,7 +3706,21 @@ function replaceManagedFileGeneratedSync(
 ): ManagedFileSnapshot["identity"] {
 	const parent = path.dirname(destination);
 	ensureManagedDirectory(parent, root, policy);
-	const staging = path.join(parent, `.${path.basename(destination)}.${randomUUID()}.replacement`);
+	const attemptId = randomUUID();
+	const staging = path.join(parent, `.${path.basename(destination)}.${attemptId}.replacement`);
+	const publisherObservation = expectedDestination ? observeProcessIncarnation(process.pid) : undefined;
+	if (expectedDestination && publisherObservation?.status !== "present")
+		throw new Error("managed_replace_publisher_identity_unavailable");
+	const publisher: ReplacementReceiptPublisher | undefined =
+		publisherObservation?.status === "present"
+			? {
+					attemptId,
+					ownerId: replacementPublisherOwnerId,
+					pid: process.pid,
+					incarnation: publisherObservation.incarnation,
+					host: os.hostname(),
+				}
+			: undefined;
 	let fd: number | undefined;
 	let stagedIdentity: { dev: bigint; ino: bigint } | undefined;
 	let preserveStaging = false;
@@ -3542,6 +3738,7 @@ function replaceManagedFileGeneratedSync(
 	let publicationDurable = false;
 	let publicationCommitted = false;
 	let expectedSuccessor: ManagedFileSnapshot["identity"] | undefined;
+	activeReplacementAttempts.add(attemptId);
 	try {
 		fd = fs.openSync(
 			staging,
@@ -3578,6 +3775,7 @@ function replaceManagedFileGeneratedSync(
 						destination,
 						successor: serializeReplacementIdentity(successor),
 						predecessor: serializeReplacementIdentity(expectedDestination),
+						publisher,
 					} satisfies ReplacementCleanupReceipt),
 				),
 				root,
@@ -3733,6 +3931,7 @@ function replaceManagedFileGeneratedSync(
 				}
 			}
 		}
+		activeReplacementAttempts.delete(attemptId);
 	}
 	if (failure !== undefined && !(acceptCommittedCleanupFailure && publicationDurable && publishedIdentity))
 		throw failure;