I think you should check both, e.g.
      if (has_cookie("koan_spared") && !npc_dead("Koan")) then

As I understand, if you only check if he is alive, the quest could be completed
immediately after obtaining the quest from Duncan - since Koan is alive before
beeing spared, too.