dominds 1.16.1 → 1.16.2

package/dist/persistence.js

@@ -40,6 +40,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DialogPersistence = exports.DiskFileDialogStore = void 0;
+exports.setDialogsQuarantinedBroadcaster = setDialogsQuarantinedBroadcaster;
+exports.setPrepareDialogQuarantineHook = setPrepareDialogQuarantineHook;
+exports.setFinalizeDialogQuarantineHook = setFinalizeDialogQuarantineHook;
 const language_1 = require("@longrun-ai/kernel/types/language");
 const storage_1 = require("@longrun-ai/kernel/types/storage");
 const time_1 = require("@longrun-ai/kernel/utils/time");
@@ -48,12 +51,45 @@ const node_crypto_1 = require("node:crypto");
 const path = __importStar(require("path"));
 const yaml = __importStar(require("yaml"));
 const dialog_1 = require("./dialog");
+const dialog_interruption_1 = require("./dialog-interruption");
 const evt_registry_1 = require("./evt-registry");
 const log_1 = require("./log");
+const persistence_errors_1 = require("./persistence-errors");
 const async_fifo_mutex_1 = require("./runtime/async-fifo-mutex");
 const reply_prompt_copy_1 = require("./runtime/reply-prompt-copy");
 const tool_1 = require("./tool");
 const registry_1 = require("./tools/registry");
+let dialogsQuarantinedBroadcaster = null;
+let prepareDialogQuarantineHook = null;
+let finalizeDialogQuarantineHook = null;
+const quarantiningRootDialogs = new Set();
+const PERSISTABLE_DIALOG_STATUSES = ['running', 'completed', 'archived'];
+const RUN_STATUS_DIR = 'run';
+const DONE_STATUS_DIR = 'done';
+const ARCHIVE_STATUS_DIR = 'archive';
+function assertPersistableDialogStatus(status, context) {
+    if (status === 'quarantining') {
+        throw new Error(`${context} does not support status 'quarantining'`);
+    }
+    return status;
+}
+function getPersistableStatusDirName(status, context) {
+    const persistableStatus = assertPersistableDialogStatus(status, context);
+    if (persistableStatus === 'running')
+        return RUN_STATUS_DIR;
+    if (persistableStatus === 'completed')
+        return DONE_STATUS_DIR;
+    return ARCHIVE_STATUS_DIR;
+}
+function setDialogsQuarantinedBroadcaster(fn) {
+    dialogsQuarantinedBroadcaster = fn;
+}
+function setPrepareDialogQuarantineHook(fn) {
+    prepareDialogQuarantineHook = fn;
+}
+function setFinalizeDialogQuarantineHook(fn) {
+    finalizeDialogQuarantineHook = fn;
+}
 function isTellaskBusinessCallName(value) {
     return (value === 'tellask' ||
         value === 'tellaskSessionless' ||
@@ -83,6 +119,19 @@ function isSuppressedTellaskPlaceholderFuncResult(args) {
     }
     return false;
 }
+function isYamlUnexpectedEofLikeError(error) {
+    const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+    return (message.includes('unexpected eof') ||
+        message.includes('unexpected end') ||
+        message.includes('end of the stream') ||
+        message.includes('unexpected end of document'));
+}
+function isJsonUnexpectedEofLikeError(error) {
+    const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+    return (message.includes('unterminated string in json') ||
+        message.includes('unexpected end of json input') ||
+        message.includes('unexpected eof'));
+}
 function buildTellaskResultRoute(route, fallback) {
     const effective = route ?? fallback;
     if (!effective)
@@ -133,6 +182,79 @@ function getErrorCode(error) {
     const maybeCode = error.code;
     return typeof maybeCode === 'string' ? maybeCode : undefined;
 }
+function isGenericUnexpectedEofLikeError(error) {
+    const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+    return message.includes('unexpected eof') || message.includes('unexpected end');
+}
+function isPersistenceFileUnexpectedEofLikeError(error, format) {
+    if (format === 'yaml') {
+        return isYamlUnexpectedEofLikeError(error) || isGenericUnexpectedEofLikeError(error);
+    }
+    if (format === 'json' || format === 'jsonl') {
+        return isJsonUnexpectedEofLikeError(error) || isGenericUnexpectedEofLikeError(error);
+    }
+    return isGenericUnexpectedEofLikeError(error);
+}
+function buildInvalidPersistenceFileError(args) {
+    return new persistence_errors_1.DomindsPersistenceFileError({
+        message: `Invalid ${path.basename(args.filePath)} in ${args.filePath}`,
+        source: args.source,
+        operation: 'parse',
+        format: args.format,
+        filePath: args.filePath,
+        eofLike: args.cause === undefined
+            ? false
+            : isPersistenceFileUnexpectedEofLikeError(args.cause, args.format),
+        ...(args.lineNumber !== undefined ? { lineNumber: args.lineNumber } : {}),
+        ...(args.cause !== undefined ? { cause: args.cause } : {}),
+    });
+}
+async function readPersistenceTextFile(args) {
+    try {
+        return await fs.promises.readFile(args.filePath, 'utf-8');
+    }
+    catch (error) {
+        if (getErrorCode(error) === 'ENOENT') {
+            throw error;
+        }
+        throw new persistence_errors_1.DomindsPersistenceFileError({
+            message: `Failed to read ${path.basename(args.filePath)} in ${args.filePath}`,
+            source: args.source,
+            operation: 'read',
+            format: args.format,
+            filePath: args.filePath,
+            eofLike: isPersistenceFileUnexpectedEofLikeError(error, args.format),
+            cause: error,
+        });
+    }
+}
+function parsePersistenceYaml(args) {
+    try {
+        return yaml.parse(args.content);
+    }
+    catch (error) {
+        throw buildInvalidPersistenceFileError({
+            source: args.source,
+            format: 'yaml',
+            filePath: args.filePath,
+            cause: error,
+        });
+    }
+}
+function parsePersistenceJson(args) {
+    try {
+        return JSON.parse(args.content);
+    }
+    catch (error) {
+        throw buildInvalidPersistenceFileError({
+            source: args.source,
+            format: args.lineNumber === undefined ? 'json' : 'jsonl',
+            filePath: args.filePath,
+            cause: error,
+            ...(args.lineNumber !== undefined ? { lineNumber: args.lineNumber } : {}),
+        });
+    }
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
@@ -164,6 +286,21 @@ function parseDialogRetryDisplay(value) {
         summaryTextI18n,
     };
 }
+function parseDialogLlmRetryRecoveryAction(value) {
+    if (value === undefined) {
+        return { kind: 'none' };
+    }
+    if (!isRecord(value) || typeof value.kind !== 'string')
+        return null;
+    switch (value.kind) {
+        case 'none':
+            return { kind: 'none' };
+        case 'diligence_push_once':
+            return { kind: 'diligence_push_once' };
+        default:
+            return null;
+    }
+}
 function parseDialogInterruptionReason(value) {
     if (!isRecord(value) || typeof value.kind !== 'string')
         return null;
@@ -180,7 +317,12 @@ function parseDialogInterruptionReason(value) {
             const detail = value.detail;
             if (typeof detail !== 'string')
                 return null;
-            return { kind: 'system_stop', detail };
+            const i18nStopReason = parseDisplayTextI18n(value.i18nStopReason);
+            if (i18nStopReason === null)
+                return null;
+            return i18nStopReason
+                ? { kind: 'system_stop', detail, i18nStopReason }
+                : { kind: 'system_stop', detail };
         }
         case 'llm_retry_stopped': {
             const error = value.error;
@@ -189,10 +331,14 @@ function parseDialogInterruptionReason(value) {
             const display = parseDialogRetryDisplay(value.display);
             if (display === null)
                 return null;
+            const recoveryAction = parseDialogLlmRetryRecoveryAction(value.recoveryAction);
+            if (recoveryAction === null)
+                return null;
             return {
                 kind: 'llm_retry_stopped',
                 error,
                 display,
+                recoveryAction,
             };
         }
         default:
@@ -200,7 +346,7 @@ function parseDialogInterruptionReason(value) {
     }
 }
 function resolveStoppedContinueEnabled(reason) {
-    return reason.kind !== 'llm_retry_stopped';
+    return (0, dialog_interruption_1.isInterruptionReasonManualResumeEligible)(reason);
 }
 function serializeReminderSnapshot(reminder) {
     return {
@@ -948,6 +1094,67 @@ function isSubdialogResponseRecord(value) {
         return false;
     return true;
 }
+function isReminderPriority(value) {
+    return value === 'high' || value === 'medium' || value === 'low';
+}
+function isReminderScope(value) {
+    return value === 'dialog' || value === 'personal' || value === 'agent_shared';
+}
+function isReminderStateFile(value) {
+    if (!isRecord(value))
+        return false;
+    if (!Array.isArray(value.reminders))
+        return false;
+    if (typeof value.updatedAt !== 'string')
+        return false;
+    return value.reminders.every((entry) => {
+        if (!isRecord(entry))
+            return false;
+        if (typeof entry.id !== 'string')
+            return false;
+        if (typeof entry.content !== 'string')
+            return false;
+        if (entry.ownerName !== undefined && typeof entry.ownerName !== 'string')
+            return false;
+        if (entry.echoback !== undefined && typeof entry.echoback !== 'boolean')
+            return false;
+        if (entry.scope !== undefined && !isReminderScope(entry.scope))
+            return false;
+        if (typeof entry.createdAt !== 'string')
+            return false;
+        if (!isReminderPriority(entry.priority))
+            return false;
+        return true;
+    });
+}
+function isHumanQuestion(value) {
+    if (!isRecord(value))
+        return false;
+    if (typeof value.id !== 'string')
+        return false;
+    if (typeof value.tellaskContent !== 'string')
+        return false;
+    if (typeof value.askedAt !== 'string')
+        return false;
+    if (typeof value.callId !== 'string')
+        return false;
+    if (!isRecord(value.callSiteRef))
+        return false;
+    if (typeof value.callSiteRef.course !== 'number')
+        return false;
+    if (typeof value.callSiteRef.messageIndex !== 'number')
+        return false;
+    return true;
+}
+function isQuestions4HumanFile(value) {
+    if (!isRecord(value))
+        return false;
+    if (!Array.isArray(value.questions))
+        return false;
+    if (typeof value.updatedAt !== 'string')
+        return false;
+    return value.questions.every(isHumanQuestion);
+}
 // Remove old type definitions - now using kernel/types/storage.ts
 const id_1 = require("./utils/id");
 function parseReplayTellaskCall(record) {
@@ -1115,7 +1322,6 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
             },
         };
         await DialogPersistence.saveSubdialogMetadata(subdialogId, metadata);
-        await DialogPersistence.saveDialogMetadata(subdialogId, metadata);
         const rootAnchor = resolveRootGenerationAnchor(callerDialog);
         const parentCourse = callerDialog.activeGenCourseOrUndefined ?? callerDialog.currentCourse;
         const subdialogCreatedRecord = {
@@ -2876,6 +3082,15 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
     }
 }
 exports.DiskFileDialogStore = DiskFileDialogStore;
+class DialogWriteBackCanceledError extends Error {
+    constructor(token, phase) {
+        super(`Dialog writeback canceled for ${token.rootDialogId} (${token.status}) during ${phase}`);
+        this.name = 'DialogWriteBackCanceledError';
+    }
+}
+function isDialogWriteBackCanceledError(error) {
+    return error instanceof DialogWriteBackCanceledError;
+}
 /**
  * Utility class for managing dialog persistence
  */
@@ -2926,6 +3141,71 @@ class DialogPersistence {
     static getPendingSubdialogsWriteBackKey(rootDialogId, status) {
         return `${this.getDialogsRootDir()}|${status}|${rootDialogId.valueOf()}|pending-subdialogs`;
     }
+    static getRootDialogWriteBackCancelScopeKey(rootDialogId, status) {
+        return `${this.getDialogsRootDir()}|${status}|${rootDialogId.selfId}|writeback-cancel`;
+    }
+    static createRootDialogWriteBackCancellationToken(dialogId, status) {
+        const rootDialogId = dialogId.rootId === dialogId.selfId ? dialogId : new dialog_1.DialogID(dialogId.rootId);
+        const scopeKey = this.getRootDialogWriteBackCancelScopeKey(rootDialogId, status);
+        return {
+            scopeKey,
+            generation: this.rootDialogWriteBackCancelGenerations.get(scopeKey) ?? 0,
+            rootDialogId: rootDialogId.selfId,
+            status,
+        };
+    }
+    static assertRootDialogWriteBackNotCanceled(token, phase) {
+        if (this.quarantinedRootDialogScopes.has(token.scopeKey)) {
+            throw new DialogWriteBackCanceledError(token, phase);
+        }
+        const currentGeneration = this.rootDialogWriteBackCancelGenerations.get(token.scopeKey) ?? 0;
+        if (currentGeneration !== token.generation) {
+            throw new DialogWriteBackCanceledError(token, phase);
+        }
+    }
+    static async rethrowWriteBackPathMissingAsCanceled(error, dialogPath, cancellationToken, phase) {
+        if (getErrorCode(error) !== 'ENOENT') {
+            throw error;
+        }
+        if (cancellationToken) {
+            this.assertRootDialogWriteBackNotCanceled(cancellationToken, phase);
+            if (!(await this.pathExists(dialogPath))) {
+                throw new DialogWriteBackCanceledError(cancellationToken, `${phase}:dialog-path-missing`);
+            }
+        }
+        throw error;
+    }
+    static cancelRootDialogWriteBacks(rootDialogId, status) {
+        const scopeKey = this.getRootDialogWriteBackCancelScopeKey(rootDialogId, status);
+        const nextGeneration = (this.rootDialogWriteBackCancelGenerations.get(scopeKey) ?? 0) + 1;
+        this.rootDialogWriteBackCancelGenerations.set(scopeKey, nextGeneration);
+        this.clearWriteBackEntriesForRootDialog(rootDialogId, status);
+    }
+    static getDialogMetadataPath(dialogId, status) {
+        const dialogPath = dialogId.rootId === dialogId.selfId
+            ? this.getRootDialogPath(dialogId, status)
+            : this.getSubdialogPath(dialogId, status);
+        return path.join(dialogPath, 'dialog.yaml');
+    }
+    static async assertDialogMetadataExistsForAppend(dialogId, status, cancellationToken, phase) {
+        this.assertRootDialogWriteBackNotCanceled(cancellationToken, phase);
+        const metadataPath = this.getDialogMetadataPath(dialogId, status);
+        try {
+            await fs.promises.access(metadataPath);
+        }
+        catch (error) {
+            if (getErrorCode(error) === 'ENOENT') {
+                this.assertRootDialogWriteBackNotCanceled(cancellationToken, `${phase}:metadata-missing`);
+                throw new Error(`Refusing to append events for dialog ${dialogId.valueOf()}: missing dialog metadata at ${metadataPath}`);
+            }
+            throw error;
+        }
+    }
+    static async cleanupCanceledAppendPlaceholder(dialogId, status) {
+        const rootDialogId = dialogId.rootId === dialogId.selfId ? dialogId : new dialog_1.DialogID(dialogId.rootId);
+        const rootPath = this.getRootDialogPath(rootDialogId, status);
+        await fs.promises.rm(rootPath, { recursive: true, force: true });
+    }
     static clonePendingSubdialogRecords(records) {
         return records.map((record) => ({
             ...record,
@@ -3000,58 +3280,6 @@ class DialogPersistence {
     static getDialogsRootDir() {
         return path.join(process.cwd(), this.DIALOGS_DIR);
     }
-    /**
-     * Save dialog state to JSON file for persistence (internal use only)
-     */
-    static async saveDialogState(state) {
-        try {
-            const dialogPath = await this.ensureRootDialogDirectory(new dialog_1.DialogID(state.metadata.id));
-            // Save state as JSON file
-            const stateFile = path.join(dialogPath, 'state.json');
-            await fs.promises.writeFile(stateFile, JSON.stringify({
-                metadata: state.metadata,
-                currentCourse: state.currentCourse,
-                messages: state.messages,
-                reminders: state.reminders,
-                savedAt: (0, time_1.formatUnifiedTimestamp)(new Date()),
-            }, null, 2), 'utf-8');
-        }
-        catch (error) {
-            log_1.log.error(`Failed to save dialog state for ${state.metadata.id}:`, error);
-            throw error;
-        }
-    }
-    /**
-     * Load dialog state from JSON file
-     */
-    static async loadDialogState(dialogId) {
-        try {
-            const dialogPath = this.getRootDialogPath(dialogId, 'running');
-            const stateFile = path.join(dialogPath, 'state.json');
-            // Check if state file exists
-            try {
-                await fs.promises.access(stateFile);
-            }
-            catch {
-                log_1.log.warn(`No state file found for dialog ${dialogId.selfId}, returning null`);
-                return null;
-            }
-            const stateData = JSON.parse(await fs.promises.readFile(stateFile, 'utf-8'));
-            const currentCourse = typeof stateData.currentCourse === 'number'
-                ? stateData.currentCourse
-                : 1;
-            return {
-                metadata: stateData.metadata,
-                currentCourse,
-                messages: stateData.messages,
-                reminders: stateData.reminders || [],
-            };
-        }
-        catch (error) {
-            log_1.log.error(`Failed to load dialog state for root ${dialogId.selfId}:`, error);
-            return null;
-        }
-    }
     /**
      * Get the full path for a dialog directory
      */
@@ -3059,16 +3287,7 @@ class DialogPersistence {
         if (dialogId.rootId !== dialogId.selfId) {
             throw new Error('Expected root dialog id');
         }
-        let statusDir;
-        if (status === 'running') {
-            statusDir = this.RUN_DIR;
-        }
-        else if (status === 'completed') {
-            statusDir = this.DONE_DIR;
-        }
-        else {
-            statusDir = this.ARCHIVE_DIR;
-        }
+        const statusDir = getPersistableStatusDirName(status, 'DialogPersistence.getRootDialogPath');
         return path.join(this.getDialogsRootDir(), statusDir, dialogId.selfId);
     }
     /**
@@ -3092,11 +3311,6 @@ class DialogPersistence {
         const rootPath = this.getRootDialogPath(new dialog_1.DialogID(dialogId.rootId), status);
         return path.join(rootPath, this.SUBDIALOGS_DIR, dialogId.selfId);
     }
-    static isMalformedDialogLoadError(error) {
-        return (error instanceof Error &&
-            (error.message.startsWith('Invalid latest.yaml in ') ||
-                error.message.startsWith('Invalid dialog metadata in ')));
-    }
     static getMalformedRootDialogPath(dialogId, status) {
         if (dialogId.rootId !== dialogId.selfId) {
             throw new Error('Expected root dialog id');
@@ -3104,6 +3318,82 @@ class DialogPersistence {
         void status;
         return path.join(this.getDialogsRootDir(), this.MALFORMED_DIR, dialogId.selfId);
     }
+    static inferRootDialogIdFromMetadataRelativeDir(relativeDir) {
+        const dir = relativeDir.trim();
+        if (dir === '' || dir === '.' || dir === path.sep) {
+            return null;
+        }
+        const segments = dir.split(path.sep).filter((seg) => seg.length > 0 && seg !== '.');
+        if (segments.length === 0) {
+            return null;
+        }
+        const subdialogsIndex = segments.indexOf(this.SUBDIALOGS_DIR);
+        const rootSegments = subdialogsIndex === -1 ? segments : segments.slice(0, subdialogsIndex);
+        if (rootSegments.length === 0) {
+            return null;
+        }
+        return new dialog_1.DialogID(rootSegments.join('/'));
+    }
+    static inferExpectedDialogIdFromMetadataRelativeDir(relativeDir) {
+        const dir = relativeDir.trim();
+        if (dir === '' || dir === '.' || dir === path.sep) {
+            return null;
+        }
+        const segments = dir.split(path.sep).filter((seg) => seg.length > 0 && seg !== '.');
+        if (segments.length === 0) {
+            return null;
+        }
+        const subdialogsIndex = segments.indexOf(this.SUBDIALOGS_DIR);
+        if (subdialogsIndex === -1) {
+            return segments.join('/');
+        }
+        const subdialogSegments = segments.slice(subdialogsIndex + 1);
+        if (subdialogSegments.length === 0) {
+            return null;
+        }
+        return subdialogSegments.join('/');
+    }
+    static async listSubdialogIdsUnderRoot(rootDialogId, status) {
+        const subdialogsPath = path.join(this.getRootDialogPath(rootDialogId, status), this.SUBDIALOGS_DIR);
+        const subdialogIds = new Set();
+        const visit = async (dirPath, relativePath = '') => {
+            let entries;
+            try {
+                entries = await fs.promises.readdir(dirPath, { withFileTypes: true });
+            }
+            catch (error) {
+                if (getErrorCode(error) === 'ENOENT') {
+                    return;
+                }
+                throw error;
+            }
+            for (const entry of entries) {
+                if (!entry.isDirectory()) {
+                    continue;
+                }
+                const fullPath = path.join(dirPath, entry.name);
+                const entryRelativePath = relativePath ? path.join(relativePath, entry.name) : entry.name;
+                const dialogYamlPath = path.join(fullPath, 'dialog.yaml');
+                try {
+                    await fs.promises.access(dialogYamlPath);
+                    const inferredId = this.inferExpectedDialogIdFromMetadataRelativeDir(path.join(this.SUBDIALOGS_DIR, entryRelativePath));
+                    if (!inferredId) {
+                        throw new Error(`Failed to infer subdialog id from relative path ${entryRelativePath} under root ${rootDialogId.selfId}`);
+                    }
+                    subdialogIds.add(inferredId);
+                    continue;
+                }
+                catch (error) {
+                    if (getErrorCode(error) !== 'ENOENT') {
+                        throw error;
+                    }
+                }
+                await visit(fullPath, entryRelativePath);
+            }
+        };
+        await visit(subdialogsPath);
+        return [...subdialogIds];
+    }
     static async pathExists(targetPath) {
         try {
             await fs.promises.access(targetPath);
@@ -3125,40 +3415,139 @@ class DialogPersistence {
         this.latestWriteBack.delete(key);
         this.latestWriteBackMutexes.delete(key);
     }
-    static async quarantineMalformedRootDialog(dialogId, status, reason, error) {
-        if (dialogId.rootId !== dialogId.selfId) {
-            throw error;
+    static clearWriteBackEntriesForRootDialog(rootDialogId, status) {
+        const basePrefix = `${this.getDialogsRootDir()}|${status}|${rootDialogId.selfId}`;
+        const matchesRootDialogKey = (key) => key === basePrefix || key.startsWith(`${basePrefix}#`) || key.startsWith(`${basePrefix}|`);
+        for (const [key, entry] of this.latestWriteBack.entries()) {
+            if (!matchesRootDialogKey(key))
+                continue;
+            if (entry.kind === 'scheduled') {
+                clearTimeout(entry.timer);
+            }
+            this.latestWriteBack.delete(key);
         }
-        const sourcePath = this.getRootDialogPath(dialogId, status);
-        if (!(await this.pathExists(sourcePath))) {
-            return;
+        for (const key of this.latestWriteBackMutexes.keys()) {
+            if (matchesRootDialogKey(key)) {
+                this.latestWriteBackMutexes.delete(key);
+            }
         }
-        let destinationPath = this.getMalformedRootDialogPath(dialogId, status);
-        if (await this.pathExists(destinationPath)) {
-            destinationPath = path.join(this.getDialogsRootDir(), this.MALFORMED_DIR, `${dialogId.selfId}__${(0, node_crypto_1.randomUUID)()}`);
+        for (const [key, entry] of this.q4hWriteBack.entries()) {
+            if (!matchesRootDialogKey(key))
+                continue;
+            if (entry.kind === 'scheduled') {
+                clearTimeout(entry.timer);
+            }
+            this.q4hWriteBack.delete(key);
+        }
+        for (const key of this.q4hWriteBackMutexes.keys()) {
+            if (matchesRootDialogKey(key)) {
+                this.q4hWriteBackMutexes.delete(key);
+            }
+        }
+        for (const [key, entry] of this.pendingSubdialogsWriteBack.entries()) {
+            if (!matchesRootDialogKey(key))
+                continue;
+            if (entry.kind === 'scheduled') {
+                clearTimeout(entry.timer);
+            }
+            this.pendingSubdialogsWriteBack.delete(key);
+        }
+        for (const key of this.pendingSubdialogsWriteBackMutexes.keys()) {
+            if (matchesRootDialogKey(key)) {
+                this.pendingSubdialogsWriteBackMutexes.delete(key);
+            }
+        }
+        for (const key of this.courseAppendMutexes.keys()) {
+            if (matchesRootDialogKey(key)) {
+                this.courseAppendMutexes.delete(key);
+            }
         }
-        await fs.promises.mkdir(path.dirname(destinationPath), { recursive: true });
-        await fs.promises.rename(sourcePath, destinationPath);
-        this.clearLatestWriteBackState(dialogId, status);
-        log_1.log.warn(`Quarantined malformed root dialog ${dialogId.selfId}`, undefined, {
-            status,
-            reason,
-            sourcePath,
-            destinationPath,
-            errorMessage: error.message,
-        });
     }
-    static parseDialogLatestYaml(content, latestFilePath) {
-        let parsed;
+    static async quarantineMalformedDialog(dialogId, status, reason, error) {
+        const rootDialogId = dialogId.rootId === dialogId.selfId ? dialogId : new dialog_1.DialogID(dialogId.rootId);
+        const quarantineKey = `${status}|${rootDialogId.selfId}`;
+        if (quarantiningRootDialogs.has(quarantineKey)) {
+            return;
+        }
+        quarantiningRootDialogs.add(quarantineKey);
+        let quarantined = false;
         try {
-            parsed = yaml.parse(content);
+            await prepareDialogQuarantineHook?.({
+                dialogId,
+                rootDialogId,
+                status,
+                reason,
+                error,
+            });
+            this.quarantinedRootDialogScopes.add(this.getRootDialogWriteBackCancelScopeKey(rootDialogId, status));
+            this.cancelRootDialogWriteBacks(rootDialogId, status);
+            const sourcePath = this.getRootDialogPath(rootDialogId, status);
+            if (!(await this.pathExists(sourcePath))) {
+                return;
+            }
+            let destinationPath = this.getMalformedRootDialogPath(rootDialogId, status);
+            if (await this.pathExists(destinationPath)) {
+                destinationPath = path.join(this.getDialogsRootDir(), this.MALFORMED_DIR, `${rootDialogId.selfId}__${(0, node_crypto_1.randomUUID)()}`);
+            }
+            await fs.promises.mkdir(path.dirname(destinationPath), { recursive: true });
+            await fs.promises.rename(sourcePath, destinationPath);
+            quarantined = true;
+            log_1.log.warn(`Quarantined malformed dialog ${rootDialogId.selfId}`, undefined, {
+                status,
+                reason,
+                sourcePath,
+                destinationPath,
+                errorMessage: error.message,
+                dialogId: dialogId.valueOf(),
+                rootDialogId: rootDialogId.valueOf(),
+            });
+            dialogsQuarantinedBroadcaster?.({
+                type: 'dialogs_quarantined',
+                status: 'quarantining',
+                fromStatus: assertPersistableDialogStatus(status, 'DialogPersistence.quarantineMalformedDialog(fromStatus)'),
+                rootId: rootDialogId.selfId,
+                dialogId: dialogId.selfId,
+                reason,
+                timestamp: (0, time_1.formatUnifiedTimestamp)(new Date()),
+            });
         }
-        catch {
-            throw new Error(`Invalid latest.yaml in ${latestFilePath}`);
+        finally {
+            try {
+                await finalizeDialogQuarantineHook?.({
+                    dialogId,
+                    rootDialogId,
+                    status,
+                    reason,
+                    error,
+                    quarantined,
+                });
+            }
+            finally {
+                quarantiningRootDialogs.delete(quarantineKey);
+            }
+        }
+    }
+    static async rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, reason, error) {
+        const persistenceError = (0, persistence_errors_1.findDomindsPersistenceFileError)(error);
+        if (persistenceError) {
+            await this.quarantineMalformedDialog(dialogId, status, reason, persistenceError);
+            throw persistenceError;
         }
+        throw error;
+    }
+    static parseDialogLatestYaml(content, latestFilePath) {
+        const parsed = parsePersistenceYaml({
+            content,
+            filePath: latestFilePath,
+            source: 'dialog_latest',
+        });
         const latest = parseDialogLatestFile(parsed);
         if (!latest) {
-            throw new Error(`Invalid latest.yaml in ${latestFilePath}`);
+            throw buildInvalidPersistenceFileError({
+                source: 'dialog_latest',
+                format: 'yaml',
+                filePath: latestFilePath,
+            });
         }
         return latest;
     }
@@ -3212,16 +3601,17 @@ class DialogPersistence {
         }
     }
     /**
-     * List all dialog IDs by scanning for dialog.yaml files and validating their IDs
+     * List candidate root dialog IDs by scanning `dialog.yaml`.
+     *
+     * This scanner intentionally stays lightweight: it only validates the path<->id identity needed
+     * for safe enumeration, and leaves full metadata shape validation to the subsequent lazy-load
+     * step. Callers iterating these candidate IDs must therefore tolerate per-dialog load failures
+     * and continue after a malformed dialog is quarantined.
      */
     static async listDialogs(status = 'running') {
         try {
             const statusDir = this.getDialogsRootDir();
-            const specificDir = path.join(statusDir, status === 'running'
-                ? this.RUN_DIR
-                : status === 'completed'
-                    ? this.DONE_DIR
-                    : this.ARCHIVE_DIR);
+            const specificDir = path.join(statusDir, getPersistableStatusDirName(status, 'DialogPersistence.listDialogs'));
             const validDialogIds = [];
             // Recursively find all dialog.yaml files
             const findDialogYamls = async (dirPath, relativePath = '') => {
@@ -3235,36 +3625,75 @@ class DialogPersistence {
                             await findDialogYamls(fullPath, entryRelativePath);
                         }
                         else if (entry.name === 'dialog.yaml') {
-                            // Found a dialog.yaml file, record its ID regardless of nesting structure
+                            // Found a dialog.yaml file. We only validate path<->id identity here; full metadata
+                            // shape remains lazy-loaded by the caller-specific read path.
                             try {
-                                const content = await fs.promises.readFile(fullPath, 'utf-8');
-                                const parsed = yaml.parse(content);
-                                if (parsed?.id && typeof parsed.id === 'string') {
-                                    validDialogIds.push(parsed.id);
+                                const content = await readPersistenceTextFile({
+                                    filePath: fullPath,
+                                    source: 'dialog_metadata',
+                                    format: 'yaml',
+                                });
+                                const parsed = parsePersistenceYaml({
+                                    content,
+                                    filePath: fullPath,
+                                    source: 'dialog_metadata',
+                                });
+                                if (!isRecord(parsed) || typeof parsed.id !== 'string' || parsed.id.trim() === '') {
+                                    throw buildInvalidPersistenceFileError({
+                                        source: 'dialog_metadata',
+                                        format: 'yaml',
+                                        filePath: fullPath,
+                                    });
                                 }
+                                const expectedDialogId = this.inferExpectedDialogIdFromMetadataRelativeDir(path.dirname(entryRelativePath));
+                                if (expectedDialogId === null || parsed.id !== expectedDialogId) {
+                                    throw buildInvalidPersistenceFileError({
+                                        source: 'dialog_metadata',
+                                        format: 'yaml',
+                                        filePath: fullPath,
+                                    });
+                                }
+                                validDialogIds.push(parsed.id);
                             }
                             catch (yamlError) {
+                                const persistenceError = (0, persistence_errors_1.findDomindsPersistenceFileError)(yamlError);
+                                if (persistenceError) {
+                                    const rootDialogId = this.inferRootDialogIdFromMetadataRelativeDir(path.dirname(entryRelativePath));
+                                    if (rootDialogId) {
+                                        await this.quarantineMalformedDialog(rootDialogId, status, 'listDialogs', persistenceError);
+                                    }
+                                }
                                 log_1.log.warn(`🔍 listDialogs: Failed to parse dialog.yaml at ${fullPath}:`, yamlError);
                             }
                         }
                     }
                 }
                 catch (error) {
+                    // Directory enumeration failures are filesystem-level access/I/O problems, not evidence
+                    // that a specific dialog record is malformed. If we cannot even read this directory,
+                    // attempting to quarantine a child dialog via move/rename is unlikely to be reliable.
                     log_1.log.warn(`🔍 listDialogs: Error reading directory ${dirPath}:`, error);
                 }
             };
             try {
-                // Check if directory exists before trying to read it
-                const dirExists = await fs.promises
-                    .stat(specificDir)
-                    .then(() => true)
-                    .catch(() => false);
-                if (dirExists) {
-                    await findDialogYamls(specificDir);
+                // Only ENOENT means "status directory absent". Other stat failures are loud environment
+                // errors and must flow into the warning path below instead of being silently downgraded.
+                try {
+                    await fs.promises.stat(specificDir);
+                }
+                catch (error) {
+                    if (getErrorCode(error) === 'ENOENT') {
+                        return validDialogIds;
+                    }
+                    throw error;
                 }
+                await findDialogYamls(specificDir);
                 return validDialogIds;
             }
             catch (error) {
+                // Same rationale as the inner readdir catch above: keep the failure loud in logs, but do
+                // not pretend we have actionable malformed-dialog evidence when the status directory itself
+                // is not readable.
                 log_1.log.warn(`🔍 listDialogs: Error processing directory ${specificDir}:`, error);
                 return [];
             }
@@ -3278,14 +3707,14 @@ class DialogPersistence {
      * List all dialog IDs (root + subdialogs) together with their root IDs.
      * This is the only safe way to enumerate subdialogs because their directory names
      * are not guaranteed to be their selfId.
+     *
+     * Like `listDialogs()`, this is a candidate scanner rather than a full metadata validator.
+     * Callers must treat later metadata/latest loads as lazy, per-dialog operations that can still
+     * quarantine one dialog without invalidating the rest of the enumeration.
      */
     static async listAllDialogIds(status = 'running') {
         const statusDir = this.getDialogsRootDir();
-        const specificDir = path.join(statusDir, status === 'running'
-            ? this.RUN_DIR
-            : status === 'completed'
-                ? this.DONE_DIR
-                : this.ARCHIVE_DIR);
+        const specificDir = path.join(statusDir, getPersistableStatusDirName(status, 'DialogPersistence.listAllDialogIds'));
         const result = [];
         const rootDialogIdByDialogYamlPath = new Map();
         const readDialogYamlId = async (dialogYamlPath) => {
@@ -3293,22 +3722,44 @@ class DialogPersistence {
             if (cached !== undefined)
                 return cached;
             try {
-                const content = await fs.promises.readFile(dialogYamlPath, 'utf-8');
-                const parsed = yaml.parse(content);
+                const content = await readPersistenceTextFile({
+                    filePath: dialogYamlPath,
+                    source: 'dialog_metadata',
+                    format: 'yaml',
+                });
+                const parsed = parsePersistenceYaml({
+                    content,
+                    filePath: dialogYamlPath,
+                    source: 'dialog_metadata',
+                });
                 if (typeof parsed !== 'object' || parsed === null) {
-                    rootDialogIdByDialogYamlPath.set(dialogYamlPath, null);
-                    return null;
+                    throw buildInvalidPersistenceFileError({
+                        source: 'dialog_metadata',
+                        format: 'yaml',
+                        filePath: dialogYamlPath,
+                    });
                 }
                 const idValue = parsed.id;
                 if (typeof idValue !== 'string' || idValue.trim() === '') {
-                    rootDialogIdByDialogYamlPath.set(dialogYamlPath, null);
-                    return null;
+                    throw buildInvalidPersistenceFileError({
+                        source: 'dialog_metadata',
+                        format: 'yaml',
+                        filePath: dialogYamlPath,
+                    });
                 }
                 const normalized = idValue.trim();
                 rootDialogIdByDialogYamlPath.set(dialogYamlPath, normalized);
                 return normalized;
             }
-            catch {
+            catch (error) {
+                const persistenceError = (0, persistence_errors_1.findDomindsPersistenceFileError)(error);
+                if (persistenceError) {
+                    const relativeDir = path.relative(specificDir, path.dirname(dialogYamlPath));
+                    const rootDialogId = this.inferRootDialogIdFromMetadataRelativeDir(relativeDir);
+                    if (rootDialogId) {
+                        await this.quarantineMalformedDialog(rootDialogId, status, 'listAllDialogIds:readDialogYamlId', persistenceError);
+                    }
+                }
                 rootDialogIdByDialogYamlPath.set(dialogYamlPath, null);
                 return null;
             }
@@ -3343,6 +3794,9 @@ class DialogPersistence {
                 entries = await fs.promises.readdir(dirPath, { withFileTypes: true });
             }
             catch (err) {
+                // This is an environment/filesystem failure rather than confirmed dialog corruption. We log
+                // loudly and keep enumeration partial instead of fabricating a quarantine target that may
+                // not even be reachable through the same broken directory path.
                 log_1.log.warn(`🔍 listAllDialogIds: Error reading directory ${dirPath}:`, err);
                 return;
             }
@@ -3360,26 +3814,64 @@ class DialogPersistence {
                 if (!rootId)
                     continue;
                 try {
-                    const content = await fs.promises.readFile(fullPath, 'utf-8');
-                    const parsed = yaml.parse(content);
-                    if (typeof parsed !== 'object' || parsed === null)
-                        continue;
+                    const content = await readPersistenceTextFile({
+                        filePath: fullPath,
+                        source: 'dialog_metadata',
+                        format: 'yaml',
+                    });
+                    const parsed = parsePersistenceYaml({
+                        content,
+                        filePath: fullPath,
+                        source: 'dialog_metadata',
+                    });
+                    if (typeof parsed !== 'object' || parsed === null) {
+                        throw buildInvalidPersistenceFileError({
+                            source: 'dialog_metadata',
+                            format: 'yaml',
+                            filePath: fullPath,
+                        });
+                    }
                     const idValue = parsed.id;
-                    if (typeof idValue !== 'string' || idValue.trim() === '')
-                        continue;
+                    if (typeof idValue !== 'string' || idValue.trim() === '') {
+                        throw buildInvalidPersistenceFileError({
+                            source: 'dialog_metadata',
+                            format: 'yaml',
+                            filePath: fullPath,
+                        });
+                    }
+                    const expectedDialogId = this.inferExpectedDialogIdFromMetadataRelativeDir(relDir);
+                    if (expectedDialogId === null || idValue !== expectedDialogId) {
+                        throw buildInvalidPersistenceFileError({
+                            source: 'dialog_metadata',
+                            format: 'yaml',
+                            filePath: fullPath,
+                        });
+                    }
                     result.push(new dialog_1.DialogID(idValue, rootId));
                 }
                 catch (yamlError) {
+                    const persistenceError = (0, persistence_errors_1.findDomindsPersistenceFileError)(yamlError);
+                    if (persistenceError) {
+                        const rootDialogId = this.inferRootDialogIdFromMetadataRelativeDir(relDir);
+                        if (rootDialogId) {
+                            await this.quarantineMalformedDialog(rootDialogId, status, 'listAllDialogIds', persistenceError);
+                        }
+                    }
                     log_1.log.warn(`🔍 listAllDialogIds: Failed to parse dialog.yaml at ${fullPath}:`, yamlError);
                 }
             }
         };
-        const dirExists = await fs.promises
-            .stat(specificDir)
-            .then(() => true)
-            .catch(() => false);
-        if (!dirExists)
-            return [];
+        try {
+            // Only ENOENT is the benign "no dialogs under this status" case. Permission/I/O failures
+            // must stay loud so operators can tell the difference between "missing" and "inaccessible".
+            await fs.promises.stat(specificDir);
+        }
+        catch (error) {
+            if (getErrorCode(error) === 'ENOENT') {
+                return [];
+            }
+            throw error;
+        }
         await findDialogYamls(specificDir);
         return result;
     }
@@ -3390,20 +3882,27 @@ class DialogPersistence {
     static async appendEvents(dialogId, course, events, status = 'running') {
         const appendMutexKey = this.getCourseAppendMutexKey(dialogId, course, status);
         const release = await this.getCourseAppendMutex(appendMutexKey).acquire();
+        const cancellationToken = this.createRootDialogWriteBackCancellationToken(dialogId, status);
         try {
             if (events.length === 0) {
                 return;
             }
+            await this.assertDialogMetadataExistsForAppend(dialogId, status, cancellationToken, 'appendEvents:start');
             const dialogPath = this.getDialogEventsPath(dialogId, status);
             const courseFilename = this.getCourseFilename(course);
             const courseFilePath = path.join(dialogPath, courseFilename);
-            // Ensure directory exists
-            await fs.promises.mkdir(dialogPath, { recursive: true });
             // Serialize appends per dialog+course file. Concurrent `appendFile` calls can interleave and
             // corrupt JSONL lines (e.g. tool results appended in parallel), which later manifests as
             // `Unterminated string in JSON ...` during resume.
             const serialized = events.map((event) => JSON.stringify(event)).join('\n') + '\n';
-            await fs.promises.appendFile(courseFilePath, serialized, 'utf-8');
+            try {
+                await fs.promises.appendFile(courseFilePath, serialized, 'utf-8');
+            }
+            catch (error) {
+                await this.rethrowWriteBackPathMissingAsCanceled(error, dialogPath, cancellationToken, 'appendEvents:append-file');
+                throw error;
+            }
+            await this.assertDialogMetadataExistsForAppend(dialogId, status, cancellationToken, 'appendEvents:after-append');
             // Update latest.yaml with new lastModified timestamp
             await this.mutateDialogLatest(dialogId, () => ({
                 kind: 'patch',
@@ -3411,9 +3910,13 @@ class DialogPersistence {
                     lastModified: (0, time_1.formatUnifiedTimestamp)(new Date()),
                     currentCourse: course,
                 },
-            }), status);
+            }), status, cancellationToken);
         }
         catch (error) {
+            if (isDialogWriteBackCanceledError(error)) {
+                await this.cleanupCanceledAppendPlaceholder(dialogId, status);
+                return;
+            }
             log_1.log.error(`Failed to append events to dialog ${dialogId} course ${course}:`, error);
             throw error;
         }
@@ -3518,7 +4021,11 @@ class DialogPersistence {
             const dialogPath = this.getDialogEventsPath(dialogId, status);
             const courseFilePath = path.join(dialogPath, this.getCourseFilename(course));
             try {
-                const content = await fs.promises.readFile(courseFilePath, 'utf-8');
+                const content = await readPersistenceTextFile({
+                    filePath: courseFilePath,
+                    source: 'dialog_course_events',
+                    format: 'jsonl',
+                });
                 const events = [];
                 const lines = content.split('\n');
                 for (let i = 0; i < lines.length; i++) {
@@ -3526,7 +4033,12 @@ class DialogPersistence {
                     if (!line.trim())
                         continue;
                     try {
-                        events.push(JSON.parse(line));
+                        events.push(parsePersistenceJson({
+                            content: line,
+                            filePath: courseFilePath,
+                            source: 'dialog_course_events',
+                            lineNumber: i + 1,
+                        }));
                     }
                     catch (err) {
                         const isLastNonEmptyLine = (() => {
@@ -3536,16 +4048,27 @@ class DialogPersistence {
                             }
                             return true;
                         })();
+                        const persistenceFileError = err instanceof persistence_errors_1.DomindsPersistenceFileError ? err : undefined;
                         const msg = err instanceof Error ? err.message : String(err);
                         // If the last JSONL line was truncated (e.g. process crash mid-append), ignore it so
                         // dialogs remain resumable. Do not mask corruption in the middle of the file.
                         if (isLastNonEmptyLine &&
-                            (msg.includes('Unterminated string in JSON') ||
+                            (persistenceFileError?.eofLike === true ||
+                                msg.includes('Unterminated string in JSON') ||
                                 msg.includes('Unexpected end of JSON input'))) {
                             log_1.log.warn(`Ignoring truncated JSONL tail for dialog ${dialogId} course ${course} at line ${i + 1}: ${msg}`);
                             break;
                         }
-                        throw err;
+                        if (persistenceFileError) {
+                            throw persistenceFileError;
+                        }
+                        throw buildInvalidPersistenceFileError({
+                            source: 'dialog_course_events',
+                            format: 'jsonl',
+                            filePath: courseFilePath,
+                            lineNumber: i + 1,
+                            cause: err,
+                        });
                     }
                 }
                 return events;
@@ -3596,7 +4119,6 @@ class DialogPersistence {
     static async _saveReminderState(dialogId, reminders, status = 'running') {
         try {
             const dialogPath = this.getDialogEventsPath(dialogId, status);
-            await fs.promises.mkdir(dialogPath, { recursive: true });
             const remindersFilePath = path.join(dialogPath, 'reminders.json');
             const reminderState = {
                 reminders: reminders.map((r) => ({
@@ -3615,7 +4137,7 @@ class DialogPersistence {
             const jsonContent = JSON.stringify(reminderState, null, 2);
             const tempFile = path.join(dialogPath, `.${path.basename(remindersFilePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
             await fs.promises.writeFile(tempFile, jsonContent, 'utf-8');
-            await this.renameWithRetry(tempFile, remindersFilePath, jsonContent);
+            await this.renameWithRetry(tempFile, remindersFilePath);
         }
         catch (error) {
             log_1.log.error(`Failed to save reminder state for dialog ${dialogId}:`, error);
@@ -3630,8 +4152,23 @@ class DialogPersistence {
             const dialogPath = this.getDialogEventsPath(dialogId, status);
             const remindersFilePath = path.join(dialogPath, 'reminders.json');
             try {
-                const content = await fs.promises.readFile(remindersFilePath, 'utf-8');
-                const reminderState = JSON.parse(content);
+                const content = await readPersistenceTextFile({
+                    filePath: remindersFilePath,
+                    source: 'reminder_state',
+                    format: 'json',
+                });
+                const reminderState = parsePersistenceJson({
+                    content,
+                    filePath: remindersFilePath,
+                    source: 'reminder_state',
+                });
+                if (!isReminderStateFile(reminderState)) {
+                    throw buildInvalidPersistenceFileError({
+                        source: 'reminder_state',
+                        format: 'json',
+                        filePath: remindersFilePath,
+                    });
+                }
                 return reminderState.reminders.map((r) => {
                     const ownerNameFromFile = typeof r.ownerName === 'string' ? r.ownerName : undefined;
                     // Reminder metadata is owner-private. Rebind strictly through persisted ownerName.
@@ -3657,8 +4194,8 @@ class DialogPersistence {
             }
         }
         catch (error) {
-            log_1.log.error(`Failed to load reminder state for dialog ${dialogId}:`, error);
-            return [];
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'loadReminderState', error);
+            throw new Error('unreachable after loadReminderState persistence rethrow');
         }
     }
     /**
@@ -3683,82 +4220,32 @@ class DialogPersistence {
             return await this.loadQuestions4HumanStateFromDisk(dialogId, status);
         }
         catch (error) {
-            log_1.log.error(`Failed to load q4h.yaml for dialog ${dialogId}:`, error);
-            return [];
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'loadQuestions4HumanState', error);
+            throw new Error('unreachable after loadQuestions4HumanState persistence rethrow');
         }
     }
     static async loadQuestions4HumanStateFromDisk(dialogId, status) {
         const dialogPath = this.getDialogEventsPath(dialogId, status);
         const questionsFilePath = path.join(dialogPath, 'q4h.yaml');
         try {
-            const content = await fs.promises.readFile(questionsFilePath, 'utf-8');
-            try {
-                const parsed = yaml.parse(content);
-                if (typeof parsed === 'object' &&
-                    parsed !== null &&
-                    'questions' in parsed &&
-                    Array.isArray(parsed.questions)) {
-                    return parsed.questions;
-                }
-                log_1.log.warn(`q4h.yaml has unexpected shape for dialog ${dialogId}`, undefined, {
+            const content = await readPersistenceTextFile({
+                filePath: questionsFilePath,
+                source: 'questions4human_state',
+                format: 'yaml',
+            });
+            const parsed = parsePersistenceYaml({
+                content,
+                filePath: questionsFilePath,
+                source: 'questions4human_state',
+            });
+            if (!isQuestions4HumanFile(parsed)) {
+                throw buildInvalidPersistenceFileError({
+                    source: 'questions4human_state',
+                    format: 'yaml',
                     filePath: questionsFilePath,
                 });
-                return [];
-            }
-            catch (parseError) {
-                // Attempt to auto-repair the common corruption pattern where extra trailing lines are appended
-                // due to concurrent writers clobbering a shared temp file.
-                const lines = content.split(/\r?\n/);
-                let repairedQuestions = null;
-                for (let cut = lines.length - 1; cut > 0 && lines.length - cut <= 12; cut--) {
-                    const candidate = lines.slice(0, cut).join('\n');
-                    if (candidate.trim() === '')
-                        continue;
-                    try {
-                        const candidateState = yaml.parse(candidate);
-                        if (typeof candidateState === 'object' &&
-                            candidateState !== null &&
-                            'questions' in candidateState &&
-                            Array.isArray(candidateState.questions)) {
-                            repairedQuestions = candidateState.questions;
-                            break;
-                        }
-                    }
-                    catch {
-                        // keep trimming
-                    }
-                }
-                if (repairedQuestions) {
-                    log_1.log.warn(`Repaired corrupted q4h.yaml for dialog ${dialogId}`, undefined, {
-                        filePath: questionsFilePath,
-                    });
-                    const repairedFile = {
-                        questions: repairedQuestions,
-                        updatedAt: (0, time_1.formatUnifiedTimestamp)(new Date()),
-                    };
-                    try {
-                        await this.writeQ4HStateToDisk(dialogId, { kind: 'file', file: repairedFile }, status);
-                    }
-                    catch (repairSaveError) {
-                        log_1.log.warn(`Failed to persist repaired q4h.yaml for dialog ${dialogId}`, repairSaveError);
-                    }
-                    return repairedQuestions;
-                }
-                // Quarantine the bad file to avoid repeated parse errors, then treat as "no questions".
-                try {
-                    const quarantinePath = `${questionsFilePath}.corrupt-${(0, node_crypto_1.randomUUID)()}`;
-                    await fs.promises.rename(questionsFilePath, quarantinePath);
-                    log_1.log.warn(`Quarantined corrupted q4h.yaml for dialog ${dialogId}`, undefined, {
-                        filePath: questionsFilePath,
-                        quarantinePath,
-                    });
-                }
-                catch (quarantineError) {
-                    log_1.log.warn(`Failed to quarantine corrupted q4h.yaml for dialog ${dialogId}`, quarantineError);
-                }
-                log_1.log.warn(`Failed to parse q4h.yaml for dialog ${dialogId}`, parseError);
-                return [];
             }
+            return parsed.questions;
         }
         catch (error) {
             if (getErrorCode(error) === 'ENOENT')
@@ -3886,7 +4373,8 @@ class DialogPersistence {
                 if (entry.kind !== 'scheduled')
                     return;
                 clearTimeout(entry.timer);
-                const inFlight = this.writeQ4HStateToDisk(entry.dialogId, entry.state, entry.status);
+                const cancellationToken = this.createRootDialogWriteBackCancellationToken(entry.dialogId, entry.status);
+                const inFlight = this.writeQ4HStateToDisk(entry.dialogId, entry.state, entry.status, cancellationToken);
                 captured = {
                     dialogId: entry.dialogId,
                     status: entry.status,
@@ -3921,6 +4409,10 @@ class DialogPersistence {
                     return;
                 if (entry.inFlight !== captured.inFlight)
                     return;
+                if (isDialogWriteBackCanceledError(error)) {
+                    this.q4hWriteBack.delete(key);
+                    return;
+                }
                 const timer = setTimeout(() => {
                     void this.flushQ4HWriteBack(key);
                 }, this.Q4H_WRITEBACK_WINDOW_MS);
@@ -3965,18 +4457,26 @@ class DialogPersistence {
             release();
         }
     }
-    static async writeQ4HStateToDisk(dialogId, state, status) {
+    static async writeQ4HStateToDisk(dialogId, state, status, cancellationToken) {
+        if (cancellationToken) {
+            this.assertRootDialogWriteBackNotCanceled(cancellationToken, 'writeQ4HStateToDisk:start');
+        }
         const dialogPath = this.getDialogEventsPath(dialogId, status);
         const questionsFilePath = path.join(dialogPath, 'q4h.yaml');
-        await fs.promises.mkdir(dialogPath, { recursive: true });
         if (state.kind === 'deleted') {
             await fs.promises.rm(questionsFilePath, { force: true });
             return;
         }
         const yamlContent = yaml.stringify(state.file);
         const tempFile = path.join(dialogPath, `.${path.basename(questionsFilePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
-        await fs.promises.writeFile(tempFile, yamlContent, 'utf-8');
-        await this.renameWithRetry(tempFile, questionsFilePath, yamlContent);
+        try {
+            await fs.promises.writeFile(tempFile, yamlContent, 'utf-8');
+        }
+        catch (error) {
+            await this.rethrowWriteBackPathMissingAsCanceled(error, dialogPath, cancellationToken, 'writeQ4HStateToDisk:write-temp');
+            throw error;
+        }
+        await this.renameWithRetry(tempFile, questionsFilePath, 5, cancellationToken);
     }
     /**
      * Load all Q4H questions from all running dialogs (for global Q4H display)
@@ -4057,8 +4557,8 @@ class DialogPersistence {
             return await this.loadPendingSubdialogsFromDisk(rootDialogId, status);
         }
         catch (error) {
-            log_1.log.error(`Failed to load pending subdialogs for dialog ${rootDialogId}:`, error);
-            return [];
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(rootDialogId, status, 'loadPendingSubdialogs', error);
+            throw new Error('unreachable after loadPendingSubdialogs persistence rethrow');
         }
     }
     static isPendingSubdialogRecord(value) {
@@ -4118,11 +4618,24 @@ class DialogPersistence {
         const dialogPath = this.getDialogResponsesPath(rootDialogId, status);
         const filePath = path.join(dialogPath, 'pending-subdialogs.json');
         try {
-            const content = await fs.promises.readFile(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            if (!Array.isArray(parsed))
-                return [];
-            return parsed.filter(this.isPendingSubdialogRecord);
+            const content = await readPersistenceTextFile({
+                filePath,
+                source: 'pending_subdialogs',
+                format: 'json',
+            });
+            const parsed = parsePersistenceJson({
+                content,
+                filePath,
+                source: 'pending_subdialogs',
+            });
+            if (!Array.isArray(parsed) || !parsed.every((item) => this.isPendingSubdialogRecord(item))) {
+                throw buildInvalidPersistenceFileError({
+                    source: 'pending_subdialogs',
+                    format: 'json',
+                    filePath,
+                });
+            }
+            return parsed;
         }
         catch (error) {
             if (getErrorCode(error) === 'ENOENT')
@@ -4227,7 +4740,8 @@ class DialogPersistence {
                 if (entry.kind !== 'scheduled')
                     return;
                 clearTimeout(entry.timer);
-                const inFlight = this.writePendingSubdialogsToDisk(entry.dialogId, entry.state, entry.status);
+                const cancellationToken = this.createRootDialogWriteBackCancellationToken(entry.dialogId, entry.status);
+                const inFlight = this.writePendingSubdialogsToDisk(entry.dialogId, entry.state, entry.status, cancellationToken);
                 captured = {
                     dialogId: entry.dialogId,
                     status: entry.status,
@@ -4252,7 +4766,7 @@ class DialogPersistence {
         try {
             await captured.inFlight;
         }
-        catch {
+        catch (error) {
             const release = await mutex.acquire();
             try {
                 const entry = this.pendingSubdialogsWriteBack.get(key);
@@ -4262,6 +4776,10 @@ class DialogPersistence {
                     return;
                 if (entry.inFlight !== captured.inFlight)
                     return;
+                if (isDialogWriteBackCanceledError(error)) {
+                    this.pendingSubdialogsWriteBack.delete(key);
+                    return;
+                }
                 const timer = setTimeout(() => {
                     void this.flushPendingSubdialogsWriteBack(key);
                 }, this.PENDING_SUBDIALOGS_WRITEBACK_WINDOW_MS);
@@ -4306,9 +4824,11 @@ class DialogPersistence {
             release();
         }
     }
-    static async writePendingSubdialogsToDisk(rootDialogId, state, status) {
+    static async writePendingSubdialogsToDisk(rootDialogId, state, status, cancellationToken) {
+        if (cancellationToken) {
+            this.assertRootDialogWriteBackNotCanceled(cancellationToken, 'writePendingSubdialogsToDisk:start');
+        }
         const dialogPath = this.getDialogResponsesPath(rootDialogId, status);
-        await fs.promises.mkdir(dialogPath, { recursive: true });
         const filePath = path.join(dialogPath, 'pending-subdialogs.json');
         if (state.kind === 'deleted') {
             await fs.promises.rm(filePath, { force: true });
@@ -4316,8 +4836,14 @@ class DialogPersistence {
         }
         const jsonContent = JSON.stringify(state.records, null, 2);
         const tempFile = path.join(dialogPath, `.${path.basename(filePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
-        await fs.promises.writeFile(tempFile, jsonContent, 'utf-8');
-        await this.renameWithRetry(tempFile, filePath, jsonContent);
+        try {
+            await fs.promises.writeFile(tempFile, jsonContent, 'utf-8');
+        }
+        catch (error) {
+            await this.rethrowWriteBackPathMissingAsCanceled(error, dialogPath, cancellationToken, 'writePendingSubdialogsToDisk:write-temp');
+            throw error;
+        }
+        await this.renameWithRetry(tempFile, filePath, 5, cancellationToken);
     }
     /**
      * Get the path for storing subdialog responses (supports both root and subdialog parents).
@@ -4343,13 +4869,12 @@ class DialogPersistence {
     static async saveSubdialogResponses(rootDialogId, responses, rootAnchor, status = 'running') {
         try {
             const dialogPath = this.getDialogResponsesPath(rootDialogId, status);
-            await fs.promises.mkdir(dialogPath, { recursive: true });
             const filePath = path.join(dialogPath, 'subdialog-responses.json');
             // Atomic write operation
             const jsonContent = JSON.stringify(responses, null, 2);
             const tempFile = path.join(dialogPath, `.${path.basename(filePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
             await fs.promises.writeFile(tempFile, jsonContent, 'utf-8');
-            await this.renameWithRetry(tempFile, filePath, jsonContent);
+            await this.renameWithRetry(tempFile, filePath);
             if (rootAnchor) {
                 await this.appendSubdialogResponsesReconciledRecord(rootDialogId, responses, rootAnchorWriteTarget(rootAnchor), status);
             }
@@ -4371,9 +4896,24 @@ class DialogPersistence {
                 const results = [];
                 const tryReadArray = async (p) => {
                     try {
-                        const content = await fs.promises.readFile(p, 'utf-8');
-                        const parsed = JSON.parse(content);
-                        return Array.isArray(parsed) ? parsed : [];
+                        const content = await readPersistenceTextFile({
+                            filePath: p,
+                            source: 'subdialog_responses',
+                            format: 'json',
+                        });
+                        const parsed = parsePersistenceJson({
+                            content,
+                            filePath: p,
+                            source: 'subdialog_responses',
+                        });
+                        if (!Array.isArray(parsed)) {
+                            throw buildInvalidPersistenceFileError({
+                                source: 'subdialog_responses',
+                                format: 'json',
+                                filePath: p,
+                            });
+                        }
+                        return parsed;
                     }
                     catch (error) {
                         if (getErrorCode(error) === 'ENOENT') {
@@ -4385,9 +4925,14 @@ class DialogPersistence {
                 const primary = await tryReadArray(filePath);
                 const inflight = await tryReadArray(inflightPath);
                 for (const item of [...primary, ...inflight]) {
-                    if (isSubdialogResponseRecord(item)) {
-                        results.push(item);
+                    if (!isSubdialogResponseRecord(item)) {
+                        throw buildInvalidPersistenceFileError({
+                            source: 'subdialog_responses',
+                            format: 'json',
+                            filePath,
+                        });
                     }
+                    results.push(item);
                 }
                 // Deduplicate by responseId (primary wins over inflight order is irrelevant)
                 const byId = new Map();
@@ -4404,26 +4949,39 @@ class DialogPersistence {
             }
         }
         catch (error) {
-            log_1.log.error(`Failed to load subdialog responses for dialog ${rootDialogId}:`, error);
-            return [];
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(rootDialogId, status, 'loadSubdialogResponses', error);
+            throw new Error('unreachable after loadSubdialogResponses persistence rethrow');
         }
     }
     static async loadSubdialogResponsesQueue(dialogId, status = 'running') {
         try {
             const dialogPath = this.getDialogResponsesPath(dialogId, status);
             const filePath = path.join(dialogPath, 'subdialog-responses.json');
-            const content = await fs.promises.readFile(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            if (!Array.isArray(parsed)) {
-                return [];
+            const content = await readPersistenceTextFile({
+                filePath,
+                source: 'subdialog_responses',
+                format: 'json',
+            });
+            const parsed = parsePersistenceJson({
+                content,
+                filePath,
+                source: 'subdialog_responses',
+            });
+            if (!Array.isArray(parsed) || !parsed.every((item) => isSubdialogResponseRecord(item))) {
+                throw buildInvalidPersistenceFileError({
+                    source: 'subdialog_responses',
+                    format: 'json',
+                    filePath,
+                });
             }
-            return parsed.filter(isSubdialogResponseRecord);
+            return parsed;
         }
         catch (error) {
             if (getErrorCode(error) === 'ENOENT') {
                 return [];
             }
-            throw error;
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'loadSubdialogResponsesQueue', error);
+            throw new Error('unreachable after loadSubdialogResponsesQueue persistence rethrow');
         }
     }
     static async appendSubdialogResponse(dialogId, response, rootAnchor, status = 'running') {
@@ -4432,40 +4990,56 @@ class DialogPersistence {
         await this.saveSubdialogResponses(dialogId, existing, rootAnchor, status);
     }
     static async takeSubdialogResponses(dialogId, status = 'running') {
-        const dialogPath = this.getDialogResponsesPath(dialogId, status);
-        await fs.promises.mkdir(dialogPath, { recursive: true });
-        const filePath = path.join(dialogPath, 'subdialog-responses.json');
-        const inflightPath = path.join(dialogPath, 'subdialog-responses.processing.json');
-        // If a previous processing file exists, merge it back so it will be re-processed.
-        try {
-            await fs.promises.access(inflightPath);
-            await this.rollbackTakenSubdialogResponses(dialogId, status);
-        }
-        catch {
-            // no-op
-        }
         try {
-            await fs.promises.rename(filePath, inflightPath);
-        }
-        catch (error) {
-            if (getErrorCode(error) === 'ENOENT') {
-                return [];
+            const dialogPath = this.getDialogResponsesPath(dialogId, status);
+            const filePath = path.join(dialogPath, 'subdialog-responses.json');
+            const inflightPath = path.join(dialogPath, 'subdialog-responses.processing.json');
+            // If a previous processing file exists, merge it back so it will be re-processed.
+            try {
+                await fs.promises.access(inflightPath);
             }
-            throw error;
-        }
-        try {
-            const raw = await fs.promises.readFile(inflightPath, 'utf-8');
-            const parsed = JSON.parse(raw);
-            if (!Array.isArray(parsed)) {
-                return [];
+            catch (error) {
+                if (getErrorCode(error) !== 'ENOENT') {
+                    throw error;
+                }
             }
-            return parsed.filter(isSubdialogResponseRecord);
+            if (await this.pathExists(inflightPath)) {
+                await this.rollbackTakenSubdialogResponses(dialogId, status);
+            }
+            try {
+                await fs.promises.rename(filePath, inflightPath);
+            }
+            catch (error) {
+                if (getErrorCode(error) === 'ENOENT') {
+                    return [];
+                }
+                throw error;
+            }
+            const raw = await readPersistenceTextFile({
+                filePath: inflightPath,
+                source: 'subdialog_responses',
+                format: 'json',
+            });
+            const parsed = parsePersistenceJson({
+                content: raw,
+                filePath: inflightPath,
+                source: 'subdialog_responses',
+            });
+            if (!Array.isArray(parsed) || !parsed.every((item) => isSubdialogResponseRecord(item))) {
+                throw buildInvalidPersistenceFileError({
+                    source: 'subdialog_responses',
+                    format: 'json',
+                    filePath: inflightPath,
+                });
+            }
+            return parsed;
         }
         catch (error) {
             if (getErrorCode(error) === 'ENOENT') {
                 return [];
             }
-            throw error;
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'takeSubdialogResponses', error);
+            throw new Error('unreachable after takeSubdialogResponses persistence rethrow');
         }
     }
     static async commitTakenSubdialogResponses(dialogId, status = 'running') {
@@ -4474,44 +5048,79 @@ class DialogPersistence {
         await fs.promises.rm(inflightPath, { force: true });
     }
     static async rollbackTakenSubdialogResponses(dialogId, status = 'running') {
-        const dialogPath = this.getDialogResponsesPath(dialogId, status);
-        await fs.promises.mkdir(dialogPath, { recursive: true });
-        const filePath = path.join(dialogPath, 'subdialog-responses.json');
-        const inflightPath = path.join(dialogPath, 'subdialog-responses.processing.json');
-        let inflight = [];
         try {
-            const raw = await fs.promises.readFile(inflightPath, 'utf-8');
-            const parsed = JSON.parse(raw);
-            inflight = Array.isArray(parsed) ? parsed : [];
-        }
-        catch (error) {
-            if (getErrorCode(error) === 'ENOENT') {
-                return;
+            const dialogPath = this.getDialogResponsesPath(dialogId, status);
+            const filePath = path.join(dialogPath, 'subdialog-responses.json');
+            const inflightPath = path.join(dialogPath, 'subdialog-responses.processing.json');
+            let inflight = [];
+            try {
+                const raw = await readPersistenceTextFile({
+                    filePath: inflightPath,
+                    source: 'subdialog_responses',
+                    format: 'json',
+                });
+                const parsed = parsePersistenceJson({
+                    content: raw,
+                    filePath: inflightPath,
+                    source: 'subdialog_responses',
+                });
+                if (!Array.isArray(parsed) || !parsed.every((item) => isSubdialogResponseRecord(item))) {
+                    throw buildInvalidPersistenceFileError({
+                        source: 'subdialog_responses',
+                        format: 'json',
+                        filePath: inflightPath,
+                    });
+                }
+                inflight = parsed;
             }
-            throw error;
-        }
-        let primary = [];
-        try {
-            const raw = await fs.promises.readFile(filePath, 'utf-8');
-            const parsed = JSON.parse(raw);
-            primary = Array.isArray(parsed) ? parsed : [];
-        }
-        catch (error) {
-            if (getErrorCode(error) !== 'ENOENT') {
+            catch (error) {
+                if (getErrorCode(error) === 'ENOENT') {
+                    return;
+                }
                 throw error;
             }
+            let primary = [];
+            try {
+                const raw = await readPersistenceTextFile({
+                    filePath,
+                    source: 'subdialog_responses',
+                    format: 'json',
+                });
+                const parsed = parsePersistenceJson({
+                    content: raw,
+                    filePath,
+                    source: 'subdialog_responses',
+                });
+                if (!Array.isArray(parsed) || !parsed.every((item) => isSubdialogResponseRecord(item))) {
+                    throw buildInvalidPersistenceFileError({
+                        source: 'subdialog_responses',
+                        format: 'json',
+                        filePath,
+                    });
+                }
+                primary = parsed;
+            }
+            catch (error) {
+                if (getErrorCode(error) !== 'ENOENT') {
+                    throw error;
+                }
+            }
+            const merged = [...inflight, ...primary];
+            const byId = new Map();
+            for (const r of merged) {
+                byId.set(r.responseId, r);
+            }
+            const result = Array.from(byId.values());
+            const jsonContent = JSON.stringify(result, null, 2);
+            const tempFile = path.join(dialogPath, `.${path.basename(filePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
+            await fs.promises.writeFile(tempFile, jsonContent, 'utf-8');
+            await this.renameWithRetry(tempFile, filePath);
+            await fs.promises.rm(inflightPath, { force: true });
         }
-        const merged = [...inflight, ...primary].filter(isSubdialogResponseRecord);
-        const byId = new Map();
-        for (const r of merged) {
-            byId.set(r.responseId, r);
+        catch (error) {
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'rollbackTakenSubdialogResponses', error);
+            throw new Error('unreachable after rollbackTakenSubdialogResponses persistence rethrow');
         }
-        const result = Array.from(byId.values());
-        const jsonContent = JSON.stringify(result, null, 2);
-        const tempFile = path.join(dialogPath, `.${path.basename(filePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
-        await fs.promises.writeFile(tempFile, jsonContent, 'utf-8');
-        await this.renameWithRetry(tempFile, filePath, jsonContent);
-        await fs.promises.rm(inflightPath, { force: true });
     }
     /**
      * Save root dialog metadata (write-once pattern)
@@ -4526,7 +5135,7 @@ class DialogPersistence {
             const yamlContent = yaml.stringify(metadata);
             const tempFile = path.join(dialogPath, `.${path.basename(metadataFilePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
             await fs.promises.writeFile(tempFile, yamlContent, 'utf-8');
-            await this.renameWithRetry(tempFile, metadataFilePath, yamlContent);
+            await this.renameWithRetry(tempFile, metadataFilePath);
         }
         catch (error) {
             log_1.log.error(`Failed to save dialog YAML for dialog ${dialogId}:`, error);
@@ -4563,11 +5172,12 @@ class DialogPersistence {
         try {
             const subPath = this.getSubdialogPath(dialogId, status);
             const metadataFilePath = path.join(subPath, 'dialog.yaml');
-            await fs.promises.mkdir(subPath, { recursive: true });
+            // Creation sites must ensure the directory exists first. Update paths intentionally do not
+            // recreate missing directories so quarantine can use "directory disappeared" as cancellation.
             const yamlContent = yaml.stringify(metadata);
             const tempFile = path.join(subPath, `.${path.basename(metadataFilePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
             await fs.promises.writeFile(tempFile, yamlContent, 'utf-8');
-            await this.renameWithRetry(tempFile, metadataFilePath, yamlContent);
+            await this.renameWithRetry(tempFile, metadataFilePath);
         }
         catch (error) {
             log_1.log.error(`Failed to save subdialog YAML for ${dialogId.selfId} under root dialog ${dialogId.rootId}:`, error);
@@ -4576,7 +5186,6 @@ class DialogPersistence {
     }
     /**
      * Update assignmentFromSup for an existing subdialog.
-     * Persists both subdialog metadata locations for consistency.
      */
     static async updateSubdialogAssignment(dialogId, assignment, status = 'running') {
         if (dialogId.rootId === dialogId.selfId) {
@@ -4591,7 +5200,6 @@ class DialogPersistence {
             assignmentFromSup: assignment,
         };
         await this.saveSubdialogMetadata(dialogId, next, status);
-        await this.saveDialogMetadata(dialogId, next, status);
     }
     /**
      * Load root dialog metadata
@@ -4601,21 +5209,30 @@ class DialogPersistence {
             const dialogPath = this.getRootDialogPath(dialogId, status);
             const metadataFilePath = path.join(dialogPath, 'dialog.yaml');
             try {
-                const content = await fs.promises.readFile(metadataFilePath, 'utf-8');
-                let parsed;
-                try {
-                    parsed = yaml.parse(content);
-                }
-                catch {
-                    throw new Error(`Invalid dialog metadata in ${metadataFilePath}`);
-                }
+                const content = await readPersistenceTextFile({
+                    filePath: metadataFilePath,
+                    source: 'dialog_metadata',
+                    format: 'yaml',
+                });
+                const parsed = parsePersistenceYaml({
+                    content,
+                    filePath: metadataFilePath,
+                    source: 'dialog_metadata',
+                });
                 if (!isDialogMetadataFile(parsed)) {
-                    throw new Error(`Invalid dialog metadata in ${metadataFilePath}`);
+                    throw buildInvalidPersistenceFileError({
+                        source: 'dialog_metadata',
+                        format: 'yaml',
+                        filePath: metadataFilePath,
+                    });
                 }
                 // Validate that the ID in the file matches the expected dialogId
                 if (parsed.id !== dialogId.selfId) {
-                    log_1.log.warn(`Dialog ID mismatch in ${metadataFilePath}: expected ${dialogId.selfId}, got ${parsed.id}`);
-                    return null;
+                    throw buildInvalidPersistenceFileError({
+                        source: 'dialog_metadata',
+                        format: 'yaml',
+                        filePath: metadataFilePath,
+                    });
                 }
                 return parsed;
             }
@@ -4623,16 +5240,13 @@ class DialogPersistence {
                 if (getErrorCode(error) === 'ENOENT') {
                     return null;
                 }
-                if (this.isMalformedDialogLoadError(error)) {
-                    await this.quarantineMalformedRootDialog(dialogId, status, 'loadRootDialogMetadata', error);
-                    return null;
-                }
-                throw error;
+                await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'loadRootDialogMetadata', error);
+                throw new Error('unreachable after loadRootDialogMetadata persistence rethrow');
             }
         }
         catch (error) {
             log_1.log.error(`Failed to load dialog YAML for dialog ${dialogId.selfId}:`, error);
-            return null;
+            throw error;
         }
     }
     /**
@@ -4648,10 +5262,22 @@ class DialogPersistence {
         const subdialogPath = this.getSubdialogPath(dialogId, status);
         const metadataFilePath = path.join(subdialogPath, 'dialog.yaml');
         try {
-            const content = await fs.promises.readFile(metadataFilePath, 'utf-8');
-            const parsed = yaml.parse(content);
+            const content = await readPersistenceTextFile({
+                filePath: metadataFilePath,
+                source: 'dialog_metadata',
+                format: 'yaml',
+            });
+            const parsed = parsePersistenceYaml({
+                content,
+                filePath: metadataFilePath,
+                source: 'dialog_metadata',
+            });
             if (!isDialogMetadataFile(parsed)) {
-                throw new Error(`Invalid dialog metadata in ${metadataFilePath}`);
+                throw buildInvalidPersistenceFileError({
+                    source: 'dialog_metadata',
+                    format: 'yaml',
+                    filePath: metadataFilePath,
+                });
             }
             return parsed;
         }
@@ -4659,28 +5285,39 @@ class DialogPersistence {
             if (getErrorCode(error) === 'ENOENT') {
                 return null;
             }
-            throw error;
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'loadDialogMetadata', error);
+            throw new Error('unreachable after loadDialogMetadata persistence rethrow');
         }
     }
     /**
      * Save latest.yaml with current course and lastModified info
      */
-    static async writeDialogLatestToDisk(dialogId, latest, status = 'running') {
+    static async writeDialogLatestToDisk(dialogId, latest, status = 'running', cancellationToken) {
         try {
+            if (cancellationToken) {
+                this.assertRootDialogWriteBackNotCanceled(cancellationToken, 'writeDialogLatestToDisk:start');
+            }
             const dialogPath = this.getDialogEventsPath(dialogId, status);
             const latestFilePath = path.join(dialogPath, 'latest.yaml');
-            // Ensure directory exists before writing (handles race conditions and new dialogs)
-            await fs.promises.mkdir(dialogPath, { recursive: true });
             // NOTE: Use a unique temp file name to avoid collisions when multiple updates
             // happen concurrently for the same dialog (e.g., parallel tool responses).
             const tempFile = path.join(dialogPath, `.${path.basename(latestFilePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
             const yamlContent = yaml.stringify(latest);
-            await fs.promises.writeFile(tempFile, yamlContent, 'utf-8');
+            try {
+                await fs.promises.writeFile(tempFile, yamlContent, 'utf-8');
+            }
+            catch (error) {
+                await this.rethrowWriteBackPathMissingAsCanceled(error, dialogPath, cancellationToken, 'writeDialogLatestToDisk:write-temp');
+                throw error;
+            }
             // Rename with retry logic for filesystem sync issues
-            await this.renameWithRetry(tempFile, latestFilePath, yamlContent);
+            await this.renameWithRetry(tempFile, latestFilePath, 5, cancellationToken);
             // todo: publish CourseEvent here or where more suitable?
         }
         catch (error) {
+            if (isDialogWriteBackCanceledError(error)) {
+                throw error;
+            }
             log_1.log.error(`Failed to save latest.yaml for dialog ${dialogId.selfId}:`, error);
             throw error;
         }
@@ -4688,26 +5325,21 @@ class DialogPersistence {
     /**
      * Rename with retry logic to handle filesystem sync issues
      */
-    static async renameWithRetry(source, destination, yamlContent, maxRetries = 5) {
+    static async renameWithRetry(source, destination, maxRetries = 5, cancellationToken) {
         let lastError;
-        const destinationDir = path.dirname(destination);
         for (let attempt = 1; attempt <= maxRetries; attempt++) {
             try {
-                // Ensure directory exists (handles race conditions)
-                await fs.promises.mkdir(destinationDir, { recursive: true });
-                // Check if source file exists, re-create if missing
-                try {
-                    await fs.promises.access(source);
-                }
-                catch {
-                    // Source file missing - re-create it
-                    await fs.promises.writeFile(source, yamlContent, 'utf-8');
+                if (cancellationToken) {
+                    this.assertRootDialogWriteBackNotCanceled(cancellationToken, `renameWithRetry:${path.basename(destination)}:before-rename`);
                 }
                 await fs.promises.rename(source, destination);
                 return;
             }
             catch (error) {
-                lastError = error;
+                if (isDialogWriteBackCanceledError(error)) {
+                    throw error;
+                }
+                lastError = error instanceof Error ? error : new Error(String(error));
                 if (getErrorCode(error) !== 'ENOENT' || attempt === maxRetries) {
                     throw error;
                 }
@@ -4729,18 +5361,19 @@ class DialogPersistence {
             }
             const dialogPath = this.getDialogEventsPath(dialogId, status);
             const latestFilePath = path.join(dialogPath, 'latest.yaml');
-            const content = await fs.promises.readFile(latestFilePath, 'utf-8');
+            const content = await readPersistenceTextFile({
+                filePath: latestFilePath,
+                source: 'dialog_latest',
+                format: 'yaml',
+            });
             return this.parseDialogLatestYaml(content, latestFilePath);
         }
         catch (error) {
             if (getErrorCode(error) === 'ENOENT') {
                 return null;
             }
-            if (dialogId.rootId === dialogId.selfId && this.isMalformedDialogLoadError(error)) {
-                await this.quarantineMalformedRootDialog(dialogId, status, 'loadDialogLatest', error);
-                return null;
-            }
-            throw error;
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'loadDialogLatest', error);
+            throw new Error('unreachable after loadDialogLatest persistence rethrow');
         }
     }
     /**
@@ -4750,11 +5383,13 @@ class DialogPersistence {
      * staged state (or disk fallback). This avoids read-modify-write races in user code
      * and allows lock-free-ish coalescing to disk via the write-back buffer.
      */
-    static async mutateDialogLatest(dialogId, mutator, status = 'running') {
+    static async mutateDialogLatest(dialogId, mutator, status = 'running', cancellationToken) {
         const key = this.getLatestWriteBackKey(dialogId, status);
         const mutex = this.getLatestWriteBackMutex(key);
+        const effectiveCancellationToken = cancellationToken ?? this.createRootDialogWriteBackCancellationToken(dialogId, status);
         const release = await mutex.acquire();
         try {
+            this.assertRootDialogWriteBackNotCanceled(effectiveCancellationToken, 'mutateDialogLatest');
             const staged = this.latestWriteBack.get(key);
             const existing = (staged
                 ? staged.latest
@@ -4785,6 +5420,7 @@ class DialogPersistence {
                 const _exhaustive = mutation;
                 throw new Error(`Unhandled dialog latest mutation: ${String(_exhaustive)}`);
             }
+            this.assertRootDialogWriteBackNotCanceled(effectiveCancellationToken, 'mutateDialogLatest:before-stage');
             const pending = this.latestWriteBack.get(key);
             if (!pending) {
                 const timer = setTimeout(() => {
@@ -4814,18 +5450,19 @@ class DialogPersistence {
         try {
             const dialogPath = this.getDialogEventsPath(dialogId, status);
             const latestFilePath = path.join(dialogPath, 'latest.yaml');
-            const content = await fs.promises.readFile(latestFilePath, 'utf-8');
+            const content = await readPersistenceTextFile({
+                filePath: latestFilePath,
+                source: 'dialog_latest',
+                format: 'yaml',
+            });
             return this.parseDialogLatestYaml(content, latestFilePath);
         }
         catch (error) {
             if (getErrorCode(error) === 'ENOENT') {
                 return null;
             }
-            if (dialogId.rootId === dialogId.selfId && this.isMalformedDialogLoadError(error)) {
-                await this.quarantineMalformedRootDialog(dialogId, status, 'loadDialogLatestFromDisk', error);
-                return null;
-            }
-            throw error;
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(dialogId, status, 'loadDialogLatestFromDisk', error);
+            throw new Error('unreachable after loadDialogLatestFromDisk persistence rethrow');
         }
     }
     static async flushLatestWriteBack(key) {
@@ -4843,7 +5480,8 @@ class DialogPersistence {
                     return;
                 clearTimeout(entry.timer);
                 const latestToWrite = entry.latest;
-                const inFlight = this.writeDialogLatestToDisk(entry.dialogId, latestToWrite, entry.status);
+                const cancellationToken = this.createRootDialogWriteBackCancellationToken(entry.dialogId, entry.status);
+                const inFlight = this.writeDialogLatestToDisk(entry.dialogId, latestToWrite, entry.status, cancellationToken);
                 captured = {
                     dialogId: entry.dialogId,
                     status: entry.status,
@@ -4878,6 +5516,10 @@ class DialogPersistence {
                     return;
                 if (entry.inFlight !== captured.inFlight)
                     return;
+                if (isDialogWriteBackCanceledError(error)) {
+                    this.latestWriteBack.delete(key);
+                    return;
+                }
                 const timer = setTimeout(() => {
                     void this.flushLatestWriteBack(key);
                 }, this.LATEST_WRITEBACK_WINDOW_MS);
@@ -4980,18 +5622,8 @@ class DialogPersistence {
      */
     static async countAllSubdialogsUnderRoot(rootDialogId, status = 'running') {
         try {
-            const rootPath = this.getRootDialogPath(rootDialogId, status);
-            const subdialogsPath = path.join(rootPath, this.SUBDIALOGS_DIR);
-            try {
-                const entries = await fs.promises.readdir(subdialogsPath, { withFileTypes: true });
-                return entries.filter((entry) => entry.isDirectory()).length;
-            }
-            catch (error) {
-                if (getErrorCode(error) === 'ENOENT') {
-                    return 0;
-                }
-                throw error;
-            }
+            const subdialogIds = await this.listSubdialogIdsUnderRoot(rootDialogId, status);
+            return subdialogIds.length;
         }
         catch (error) {
             log_1.log.error(`Failed to count all subdialogs under root ${rootDialogId.selfId}:`, error);
@@ -5010,18 +5642,7 @@ class DialogPersistence {
                 return null;
             }
             // Recursively restore subdialogs
-            const rootPath = this.getRootDialogPath(rootDialogId, status);
-            const subdialogsPath = path.join(rootPath, this.SUBDIALOGS_DIR);
-            let subdialogIds = [];
-            try {
-                const entries = await fs.promises.readdir(subdialogsPath, { withFileTypes: true });
-                subdialogIds = entries.filter((e) => e.isDirectory()).map((e) => e.name);
-            }
-            catch (err) {
-                if (getErrorCode(err) !== 'ENOENT') {
-                    throw err;
-                }
-            }
+            const subdialogIds = await this.listSubdialogIdsUnderRoot(rootDialogId, status);
             for (const subdialogId of subdialogIds) {
                 await this.restoreDialogTree(new dialog_1.DialogID(subdialogId, rootDialogId.rootId), status);
             }
@@ -5278,27 +5899,19 @@ class DialogPersistence {
      */
     static async moveDialogStatus(dialogId, fromStatus, toStatus) {
         try {
-            const fromPath = path.join(this.getDialogsRootDir(), fromStatus === 'running'
-                ? this.RUN_DIR
-                : fromStatus === 'completed'
-                    ? this.DONE_DIR
-                    : this.ARCHIVE_DIR, dialogId.selfId);
-            const toPath = path.join(this.getDialogsRootDir(), toStatus === 'running'
-                ? this.RUN_DIR
-                : toStatus === 'completed'
-                    ? this.DONE_DIR
-                    : this.ARCHIVE_DIR, dialogId.selfId);
-            // Ensure destination directory exists
-            await fs.promises.mkdir(toPath, { recursive: true });
-            // Move all files and directories
-            const entries = await fs.promises.readdir(fromPath, { withFileTypes: true });
-            for (const entry of entries) {
-                const srcPath = path.join(fromPath, entry.name);
-                const destPath = path.join(toPath, entry.name);
-                await fs.promises.rename(srcPath, destPath);
+            const fromPath = path.join(this.getDialogsRootDir(), getPersistableStatusDirName(fromStatus, 'DialogPersistence.moveDialogStatus(fromStatus)'), dialogId.selfId);
+            const toPath = path.join(this.getDialogsRootDir(), getPersistableStatusDirName(toStatus, 'DialogPersistence.moveDialogStatus(toStatus)'), dialogId.selfId);
+            await fs.promises.mkdir(path.dirname(toPath), { recursive: true });
+            try {
+                await fs.promises.access(toPath);
+                throw new Error(`Refusing to move dialog ${dialogId.valueOf()} from ${fromStatus} to ${toStatus}: destination already exists at ${toPath}`);
+            }
+            catch (error) {
+                if (getErrorCode(error) !== 'ENOENT') {
+                    throw error;
+                }
             }
-            // Remove the (now-empty) source directory so the dialog is not detected under both statuses.
-            await fs.promises.rm(fromPath, { recursive: true, force: true });
+            await fs.promises.rename(fromPath, toPath);
         }
         catch (error) {
             log_1.log.error(`Failed to move dialog ${dialogId} from ${fromStatus} to ${toStatus}:`, error);
@@ -5318,12 +5931,8 @@ class DialogPersistence {
             return false;
         // Best-effort cleanup: remove the dialog from all status directories to avoid leaving behind
         // orphaned placeholder paths (e.g. `run/<id>/latest.yaml`) after a delete.
-        const allStatuses = [
-            'running',
-            'completed',
-            'archived',
-        ];
-        for (const candidate of allStatuses) {
+        for (const candidate of PERSISTABLE_DIALOG_STATUSES) {
+            this.cancelRootDialogWriteBacks(rootDialogId, candidate);
             const candidatePath = this.getRootDialogPath(rootDialogId, candidate);
             await fs.promises.rm(candidatePath, { recursive: true, force: true });
         }
@@ -5337,7 +5946,6 @@ class DialogPersistence {
         try {
             const dialogPath = this.getDialogResponsesPath(rootDialogId, status);
             const registryFilePath = path.join(dialogPath, 'registry.yaml');
-            await fs.promises.mkdir(dialogPath, { recursive: true });
             const serializableEntries = entries.map((entry) => ({
                 key: entry.key,
                 subdialogId: entry.subdialogId.selfId,
@@ -5347,7 +5955,7 @@ class DialogPersistence {
             const yamlContent = yaml.stringify({ entries: serializableEntries });
             const tempFile = path.join(dialogPath, `.${path.basename(registryFilePath)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
             await fs.promises.writeFile(tempFile, yamlContent, 'utf-8');
-            await this.renameWithRetry(tempFile, registryFilePath, yamlContent);
+            await this.renameWithRetry(tempFile, registryFilePath);
         }
         catch (error) {
             log_1.log.error(`Failed to save subdialog registry for dialog ${rootDialogId}:`, error);
@@ -5361,15 +5969,34 @@ class DialogPersistence {
         try {
             const dialogPath = this.getDialogResponsesPath(rootDialogId, status);
             const registryFilePath = path.join(dialogPath, 'registry.yaml');
-            const content = await fs.promises.readFile(registryFilePath, 'utf-8');
-            const parsed = yaml.parse(content);
+            const content = await readPersistenceTextFile({
+                filePath: registryFilePath,
+                source: 'subdialog_registry',
+                format: 'yaml',
+            });
+            const parsed = parsePersistenceYaml({
+                content,
+                filePath: registryFilePath,
+                source: 'subdialog_registry',
+            });
             if (!isRecord(parsed) || !Array.isArray(parsed.entries)) {
-                log_1.log.warn(`Invalid registry.yaml format for dialog ${rootDialogId}`);
-                return [];
+                throw buildInvalidPersistenceFileError({
+                    source: 'subdialog_registry',
+                    format: 'yaml',
+                    filePath: registryFilePath,
+                });
             }
             const entries = parsed.entries.map((entry) => {
-                if (!isRecord(entry)) {
-                    throw new Error('Invalid registry entry');
+                if (!isRecord(entry) ||
+                    typeof entry.key !== 'string' ||
+                    typeof entry.subdialogId !== 'string' ||
+                    typeof entry.agentId !== 'string' ||
+                    (entry.sessionSlug !== undefined && typeof entry.sessionSlug !== 'string')) {
+                    throw buildInvalidPersistenceFileError({
+                        source: 'subdialog_registry',
+                        format: 'yaml',
+                        filePath: registryFilePath,
+                    });
                 }
                 return {
                     key: entry.key,
@@ -5384,8 +6011,8 @@ class DialogPersistence {
             if (getErrorCode(error) === 'ENOENT') {
                 return [];
             }
-            log_1.log.error(`Failed to load subdialog registry for dialog ${rootDialogId}:`, error);
-            return [];
+            await this.rethrowAfterQuarantiningDialogPersistenceProblem(rootDialogId, status, 'loadSubdialogRegistry', error);
+            throw new Error('unreachable after loadSubdialogRegistry persistence rethrow');
         }
     }
 }
@@ -5396,6 +6023,7 @@ DialogPersistence.RUN_DIR = 'run';
 DialogPersistence.DONE_DIR = 'done';
 DialogPersistence.ARCHIVE_DIR = 'archive';
 DialogPersistence.SUBDIALOGS_DIR = 'subdialogs';
+DialogPersistence.quarantinedRootDialogScopes = new Set();
 DialogPersistence.LATEST_WRITEBACK_WINDOW_MS = 300;
 DialogPersistence.Q4H_WRITEBACK_WINDOW_MS = 300;
 DialogPersistence.PENDING_SUBDIALOGS_WRITEBACK_WINDOW_MS = 300;
@@ -5406,3 +6034,4 @@ DialogPersistence.q4hWriteBack = new Map();
 DialogPersistence.pendingSubdialogsWriteBackMutexes = new Map();
 DialogPersistence.pendingSubdialogsWriteBack = new Map();
 DialogPersistence.courseAppendMutexes = new Map();
+DialogPersistence.rootDialogWriteBackCancelGenerations = new Map();