@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/server/sse-frame-buffer.ts

@@ -1,13 +1,14 @@
 import { isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
+import { sseDataPayload } from "./sse-payload-rewrite";
 
 export const MAX_CLIENT_SSE_FRAME_BYTES = 4 * 1024 * 1024;
 
 export const EMPTY_BYTES = new Uint8Array(0);
 
-const LF_LF = Uint8Array.of(10, 10);
-const LF_CR_LF = Uint8Array.of(10, 13, 10);
-const CR_LF_LF = Uint8Array.of(13, 10, 10);
-const CR_LF_CR_LF = Uint8Array.of(13, 10, 13, 10);
+// Intern every legal pair; a split CRLF may leave a framing-only LF continuation.
+const DELIMITERS = new Map([
+  "\n", "\n\n", "\n\r", "\n\r\n", "\r\r", "\r\r\n", "\r\n\n", "\r\n\r", "\r\n\r\n",
+].map(text => [text, Uint8Array.from(text, char => char.charCodeAt(0))]));
 
 export class SseFrameTooLargeError extends Error {
   readonly maxBytes: number;
@@ -32,6 +33,8 @@ export class SseFrameCountLimitError extends Error {
 export type BoundedSseFrame = {
   block: Uint8Array;
   delimiter: Uint8Array;
+  /** A late LF extending a previously returned CR; no new event. */
+  continuation?: true;
 };
 
 /**
@@ -40,29 +43,22 @@ export type BoundedSseFrame = {
  * Returns the delimiter length in bytes, `0` when `index` does not start a
  * delimiter, and `undefined` when more bytes are required to decide.
  */
-function delimiterLengthAt(
+export function sseDelimiterLengthAt(
   index: number,
   length: number,
   byteAt: (index: number) => number,
 ): number | undefined {
   const first = byteAt(index);
-  if (first === 10) {
-    if (index + 1 >= length) return undefined;
-    const second = byteAt(index + 1);
-    if (second === 10) return 2;
-    if (second !== 13) return 0;
-    if (index + 2 >= length) return undefined;
-    return byteAt(index + 2) === 10 ? 3 : 0;
-  }
-  if (first !== 13) return 0;
-  if (index + 1 >= length) return undefined;
-  if (byteAt(index + 1) !== 10) return 0;
-  if (index + 2 >= length) return undefined;
-  const third = byteAt(index + 2);
-  if (third === 10) return 3;
-  if (third !== 13) return 0;
-  if (index + 3 >= length) return undefined;
-  return byteAt(index + 3) === 10 ? 4 : 0;
+  if (first !== 10 && first !== 13) return 0;
+  let next = index + 1;
+  if (next >= length) return undefined;
+  if (first === 13 && byteAt(next) === 10) next += 1;
+  if (next >= length) return undefined;
+  const second = byteAt(next);
+  if (second !== 10 && second !== 13) return 0;
+  next += 1;
+  if (second === 13 && next < length && byteAt(next) === 10) next += 1;
+  return next - index;
 }
 
 function delimiterBytesAt(
@@ -70,9 +66,9 @@ function delimiterBytesAt(
   delimiterLength: number,
   byteAt: (index: number) => number,
 ): Uint8Array {
-  if (delimiterLength === 2) return LF_LF;
-  if (delimiterLength === 4) return CR_LF_CR_LF;
-  return byteAt(index) === 10 ? LF_CR_LF : CR_LF_LF;
+  let text = "";
+  for (let offset = 0; offset < delimiterLength; offset++) text += String.fromCharCode(byteAt(index + offset));
+  return DELIMITERS.get(text)!;
 }
 
 function copyRange(
@@ -100,14 +96,8 @@ function copyRange(
  * cost on ordinary framing.
  */
 function isResponsesTerminalFrame(block: Uint8Array): boolean {
-  const data: string[] = [];
-  for (const line of new TextDecoder().decode(block).split(/\r?\n/)) {
-    if (!line.startsWith("data:")) continue;
-    const value = line.slice(5);
-    data.push(value.startsWith(" ") ? value.slice(1) : value);
-  }
-  if (data.length === 0) return false;
-  const payload = data.join("\n");
+  const payload = sseDataPayload(new TextDecoder().decode(block));
+  if (payload === null) return false;
   if (payload === "[DONE]") return false;
   try {
     const parsed = JSON.parse(payload) as {
@@ -161,6 +151,7 @@ export class BoundedSseFrameBuffer {
   private candidate: Uint8Array = EMPTY_BYTES;
   private candidateBytes = 0;
   private disposed = false;
+  private pendingLineFeed = false;
 
   constructor(maxFrameBytes = MAX_CLIENT_SSE_FRAME_BYTES) {
     if (!Number.isSafeInteger(maxFrameBytes) || maxFrameBytes <= 0) {
@@ -177,6 +168,7 @@ export class BoundedSseFrameBuffer {
     this.delimiterTail = EMPTY_BYTES;
     this.candidate = EMPTY_BYTES;
     this.candidateBytes = 0;
+    this.pendingLineFeed = false;
   }
 
   private ensureCapacity(requiredBytes: number): void {
@@ -226,6 +218,7 @@ export class BoundedSseFrameBuffer {
     if (chunk.byteLength === 0) return [];
 
     const frames: BoundedSseFrame[] = [];
+    let completedFrames = 0;
     const previousTail = this.delimiterTail;
     this.delimiterTail = EMPTY_BYTES;
     const tailLength = previousTail.byteLength;
@@ -245,12 +238,19 @@ export class BoundedSseFrameBuffer {
 
     try {
       let index = 0;
-      let retainedThrough = 0;
+      if (this.pendingLineFeed && byteAt(0) === 10) {
+        // The prior event was already dispatched on CR. Preserve its later LF without
+        // charging it to the next event or letting it pair with another line ending.
+        frames.push({ block: EMPTY_BYTES, delimiter: DELIMITERS.get("\n")!, continuation: true });
+        index = 1;
+      }
+      this.pendingLineFeed = false;
+      let retainedThrough = index;
       while (index < totalLength) {
-        const delimiterLength = delimiterLengthAt(index, totalLength, byteAt);
+        const delimiterLength = sseDelimiterLengthAt(index, totalLength, byteAt);
         if (delimiterLength === undefined) break;
         if (delimiterLength > 0) {
-          if (frames.length >= this.maxFramesPerFeed) {
+          if (completedFrames >= this.maxFramesPerFeed) {
             this.clear();
             this.disposed = true;
             throw new SseFrameCountLimitError(this.maxFramesPerFeed);
@@ -259,7 +259,9 @@ export class BoundedSseFrameBuffer {
           const block = this.takeCandidate();
           const delimiter = delimiterBytesAt(index, delimiterLength, byteAt);
           frames.push({ block, delimiter });
+          completedFrames += 1;
           index += delimiterLength;
+          this.pendingLineFeed = index === totalLength && byteAt(index - 1) === 13;
           retainedThrough = index;
           continue;
         }

package/src/server/sse-payload-rewrite.ts

@@ -65,7 +65,8 @@ export function composeSseBlockRewrites(...rewrites: SseBlockRewrite[]): SseBloc
 
 /** Split one complete SSE event block while retaining its original blank-line delimiter. */
 export function nextSseBlock(buffer: string): { block: string; delimiter: string; rest: string } | null {
-  const match = buffer.match(/\r?\n\r?\n/);
+  // The negative lookahead prevents backtracking from splitting one CRLF into two endings.
+  const match = buffer.match(/(?:\r\n|\r(?!\n)|\n){2}/);
   if (!match || match.index === undefined) return null;
   return {
     block: buffer.slice(0, match.index),
@@ -87,6 +88,7 @@ export function createSseBlockBuffer(
   append(fragment: string): void;
   next(): { block: string; delimiter: string } | null;
   tail(): string;
+  isEmpty(): boolean;
   compact(): void;
   clear(): void;
 } {
@@ -95,6 +97,7 @@ export function createSseBlockBuffer(
   let offset = 0;
   let scanOffset = 0;
   let bufferBytes = 0;
+  const delimiterPattern = /(?:\r\n|\r(?!\n)|\n){2}/g;
 
   const compact = (): void => {
     if (offset === 0) return;
@@ -128,43 +131,33 @@ export function createSseBlockBuffer(
       }
     },
     next() {
-      for (;;) {
-        const newline = buffer.indexOf("\n", scanOffset);
-        if (newline < 0) {
-          scanOffset = buffer.length;
-          return null;
-        }
-        let end = newline + 1;
-        if (buffer[end] === "\r") end += 1;
-        if (end === buffer.length) {
-          // Keep the candidate first newline until its possible blank-line delimiter arrives.
-          scanOffset = newline;
-          return null;
-        }
-        if (buffer[end] !== "\n") {
-          scanOffset = newline + 1;
-          continue;
-        }
-        end += 1;
-        const start = newline > offset && buffer[newline - 1] === "\r" ? newline - 1 : newline;
-        const block = buffer.slice(offset, start);
-        const delimiter = buffer.slice(start, end);
-        const nextBytes = bufferBytes - Buffer.byteLength(block, "utf8") - delimiter.length;
-        const reservation = budget.reserveTransient(nextBytes, scope);
-        reservation.commitRetained();
-        budget.releaseRetained(bufferBytes, scope);
-        bufferBytes = nextBytes;
-        offset = end;
-        scanOffset = end;
-        if (offset === buffer.length) {
-          buffer = "";
-          offset = 0;
-          scanOffset = 0;
-        }
-        return { block, delimiter };
+      delimiterPattern.lastIndex = scanOffset;
+      const match = delimiterPattern.exec(buffer);
+      if (!match) {
+        // A delimiter is at most four code units. Revisit only its possible split prefix.
+        scanOffset = Math.max(offset, buffer.length - 3);
+        return null;
       }
+      const start = match.index;
+      const end = start + match[0].length;
+      const block = buffer.slice(offset, start);
+      const delimiter = buffer.slice(start, end);
+      const nextBytes = bufferBytes - Buffer.byteLength(block, "utf8") - delimiter.length;
+      const reservation = budget.reserveTransient(nextBytes, scope);
+      reservation.commitRetained();
+      budget.releaseRetained(bufferBytes, scope);
+      bufferBytes = nextBytes;
+      offset = end;
+      scanOffset = end;
+      if (offset === buffer.length) {
+        buffer = "";
+        offset = 0;
+        scanOffset = 0;
+      }
+      return { block, delimiter };
     },
     tail: () => buffer.slice(offset),
+    isEmpty: () => offset === buffer.length,
     compact,
     clear() {
       budget.releaseRetained(bufferBytes, scope);
@@ -184,11 +177,11 @@ export function sseDataPayload(block: string): string | null {
   const len = block.length;
 
   while (lineStart < len) {
-    const nextNewline = block.indexOf("\n", lineStart);
-    let lineEnd = nextNewline === -1 ? len : nextNewline;
-    const nextStart = nextNewline === -1 ? len : nextNewline + 1;
-    if (lineEnd > lineStart && block.charCodeAt(lineEnd - 1) === 13) {
-      lineEnd -= 1;
+    let lineEnd = lineStart;
+    while (lineEnd < len && block.charCodeAt(lineEnd) !== 13 && block.charCodeAt(lineEnd) !== 10) lineEnd += 1;
+    let nextStart = lineEnd;
+    if (nextStart < len) {
+      nextStart += block.charCodeAt(lineEnd) === 13 && block.charCodeAt(lineEnd + 1) === 10 ? 2 : 1;
     }
 
     const lineLen = lineEnd - lineStart;
@@ -218,10 +211,19 @@ export function sseDataPayload(block: string): string | null {
   return found ? result : null;
 }
 
+/** Shared line rules for field-mutating repairs; identity paths keep the original block. */
+export function sseLineEnding(block: string): "\r\n" | "\r" | "\n" {
+  return block.match(/\r\n|\r|\n/)?.[0] as "\r\n" | "\r" | "\n" ?? "\n";
+}
+
+export function splitSseBlock(block: string): { newline: string; lines: string[] } {
+  return { newline: sseLineEnding(block), lines: block.split(/\r\n|\r|\n/) };
+}
+
 /** Replace an SSE event's data field while preserving non-data fields and newline style. */
 export function replaceSseDataPayload(block: string, payload: string): string {
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
-  const lines = block.split(/\r?\n/);
+  if (sseDataPayload(block) === payload) return block;
+  const { newline, lines } = splitSseBlock(block);
   const rewritten: string[] = [];
   let replaced = false;
   for (const line of lines) {
@@ -230,7 +232,7 @@ export function replaceSseDataPayload(block: string, payload: string): string {
       continue;
     }
     if (!replaced) {
-      rewritten.push(...payload.split(/\r?\n/).map(line => `data: ${line}`));
+      rewritten.push(...payload.split(/\r\n|\r|\n/).map(line => `data: ${line}`));
       replaced = true;
     }
   }
@@ -278,6 +280,8 @@ export function relaySseWithBlockRewrite(
   // Relays have several independent teardown paths; disposal is exactly once.
   let disposed = false;
   let cancelled = false;
+  let pendingLineFeed = false;
+  let pendingLineFeedVisible = false;
   const disposeRewrite = (): void => {
     if (disposed) return;
     disposed = true;
@@ -308,10 +312,18 @@ export function relaySseWithBlockRewrite(
     let emitted = 0;
     let next: { block: string; delimiter: string } | null;
     while (!cancelled && (next = buffer.next())) {
-      const outBlocks = rewrite(next.block);
+      const { block, delimiter } = next;
+      // A CR followed by buffered text is already settled; only an end-of-buffer CR
+      // can still receive the LF that extends its delimiter in the next fragment.
+      pendingLineFeed = delimiter.endsWith("\r") && buffer.isEmpty();
+      const outBlocks = rewrite(block);
+      pendingLineFeedVisible = outBlocks.length > 0;
       if (cancelled) return emitted;
-      for (const outBlock of outBlocks) {
-        enqueueText(controller, outBlock + next.delimiter);
+      for (let index = 0; index < outBlocks.length; index++) {
+        // Synthetic earlier blocks need a settled delimiter; only the final one can
+        // inherit an upstream LF in a later chunk. Completing CR as CRLF is equivalent.
+        const settled = index < outBlocks.length - 1 && delimiter.endsWith("\r") ? delimiter + "\n" : delimiter;
+        enqueueText(controller, outBlocks[index]! + settled);
         emitted += 1;
       }
     }
@@ -332,6 +344,23 @@ export function relaySseWithBlockRewrite(
     return emitted;
   };
 
+  const appendFragment = (controller: ReadableStreamDefaultController<Uint8Array>, fragment: string): number => {
+    let continuation = false;
+    if (pendingLineFeed && fragment.length > 0) {
+      continuation = fragment.startsWith("\n");
+      pendingLineFeed = false;
+      if (continuation) fragment = fragment.slice(1);
+    }
+    // Consume a late LF before scanning, so it cannot pair with a new LF to create
+    // a phantom empty callback. Any following line ending stays in the input buffer.
+    buffer.append(fragment);
+    if (continuation && pendingLineFeedVisible) {
+      enqueueText(controller, "\n");
+      return 1;
+    }
+    return 0;
+  };
+
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
@@ -346,7 +375,7 @@ export function relaySseWithBlockRewrite(
           // after its disposal (#893 review).
           if (cancelled) return;
           if (done) {
-            buffer.append(decoder.decode());
+            appendFragment(controller, decoder.decode());
             emitProcessedBlocks(controller, true);
             if (cancelled) return;
             buffer.clear();
@@ -354,8 +383,8 @@ export function relaySseWithBlockRewrite(
             controller.close();
             return;
           }
-          buffer.append(decoder.decode(value, { stream: true }));
-          const emitted = emitProcessedBlocks(controller);
+          const continuation = appendFragment(controller, decoder.decode(value, { stream: true }));
+          const emitted = continuation + emitProcessedBlocks(controller);
           if (cancelled || emitted > 0) return;
         }
       } catch (error) {

package/src/server/ws-bridge.ts

@@ -8,6 +8,7 @@ import type { ResponsesTerminalStatus } from "../bridge";
 import type { DataPlaneAdmission } from "./auth-cors";
 import type { AdmissionLease, AdmissionReservation } from "../lib/admission";
 import { BoundedSseFrameBuffer } from "./sse-frame-buffer";
+import { sseDataPayload as parseSseBlock } from "./sse-payload-rewrite";
 import { safeResponseHeaders } from "./safe-response-headers";
 import type { AudioSocketTarget } from "./audio-dictation";
 
@@ -183,17 +184,6 @@ export function buildWsErrorFrame(
   };
 }
 
-function parseSseBlock(block: string): string | null {
-  const data: string[] = [];
-  for (const line of block.split(/\r?\n/)) {
-    if (line.startsWith("data:")) {
-      const value = line.slice(5);
-      data.push(value.startsWith(" ") ? value.slice(1) : value);
-    }
-  }
-  return data.length > 0 ? data.join("\n") : null;
-}
-
 function payloadType(payload: string): string | null {
   try {
     const json = JSON.parse(payload) as { type?: unknown };

package/src/service/cli.ts

@@ -16,7 +16,8 @@ import { resolveServiceListenPort, reportServiceServing } from "./health";
 import { platformOps, proxyStillLiveAfterStop, stopTrackedProxyForServiceCommand, installServiceSafely, installFreshWindowsSchedulerSafely, removeServiceInstallState, isServiceInstalled } from "./orchestration";
 import { repairService } from "./repair";
 import type { ServiceRepairVerb } from "./repair";
-import { TASK, plistPath, readServiceBackend, releaseServiceOwner, resolveServiceOwnership } from "./state";
+import { TASK, plistPath, readServiceBackend, releaseServiceOwner, resolveServiceOwnership, serviceStatePaths } from "./state";
+import { ownershipMutationLeaseStatusLine } from "./ownership-mutation-lease.mjs";
 import { foreignServiceOwnerRefusal, unknownServiceOwnerRefusal } from "./repair";
 import type { ServiceBackend } from "./state";
 import { unitPath } from "./systemd";
@@ -419,6 +420,10 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
         // subsumes the not-installed case and adds the serving / stale-plist split.
         console.log(await serviceStatusReport());
       }
+      // A busy lease is why a supervised start can keep failing while the line above only
+      // says "not running"; report its recorded PID with unverified identity and lease age here.
+      const lease = ownershipMutationLeaseStatusLine(serviceStatePaths());
+      if (lease) console.log(lease);
       console.log(`Diagnostics: ${serviceDiagnosticsSummary()}`);
       break;
     }

package/src/service/ownership-mutation-lease.d.mts

@@ -5,6 +5,22 @@ export interface OwnershipMutationLeaseOptions {
   readonly processAlive?: (pid: number) => boolean;
   readonly beforeRelease?: (lockPath: string) => void;
   readonly joinToken?: string;
+  /** Names the current executable at the recorded PID, identity unverified; defaults to `tasklist` or `ps`. */
+  readonly processImage?: (pid: number) => string | null;
+}
+
+/** The recorded lease owner, identity unverified, read for diagnostics; never used to reclaim it. */
+export interface OwnershipMutationLeaseHolder {
+  readonly path: string;
+  /** The recorded PID; null when the directory holds no parseable owner. */
+  readonly pid: number | null;
+  /** Liveness of the current process at the recorded PID; identity is not verified. */
+  readonly alive: boolean | null;
+  /** The current executable at the recorded PID when alive and readable; identity is not verified. */
+  readonly image: string | null;
+  /** Milliseconds since the owner was written, on the clock stale recovery uses. */
+  readonly ageMs: number | null;
+  readonly record: "complete" | "incomplete" | "empty" | "unreadable";
 }
 
 export interface OwnershipMutationLease { readonly token: string; release(): void }
@@ -30,3 +46,13 @@ export declare function withOwnershipMutationLease<T>(
   run: () => T,
   options?: OwnershipMutationLeaseOptions,
 ): T;
+
+export declare function inspectOwnershipMutationLease(
+  statePaths: readonly string[],
+  options?: Pick<OwnershipMutationLeaseOptions, "now" | "processAlive" | "processImage">,
+): OwnershipMutationLeaseHolder | null;
+
+export declare function ownershipMutationLeaseStatusLine(
+  statePaths: readonly string[],
+  options?: Pick<OwnershipMutationLeaseOptions, "now" | "processAlive" | "processImage">,
+): string | null;

package/src/service/ownership-mutation-lease.mjs

@@ -1,3 +1,4 @@
+import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import {
   closeSync,
@@ -108,6 +109,73 @@ function readIncompleteOwner(path) {
   } catch { return null; }
 }
 
+/** The current executable at the recorded PID, identity unverified; null if unreadable within a second. */
+function processImage(pid) {
+  try {
+    if (process.platform === "win32") {
+      const listed = spawnSync("tasklist", ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"], {
+        encoding: "utf8", timeout: 1_000, windowsHide: true,
+      });
+      const match = /^"([^"]+)","(\d+)"/.exec((listed.stdout ?? "").trim());
+      return listed.status === 0 && match && Number(match[2]) === pid ? match[1] : null;
+    }
+    const listed = spawnSync("ps", ["-o", "comm=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000 });
+    const command = (listed.stdout ?? "").trim();
+    return listed.status === 0 && command ? basename(command) : null;
+  } catch { return null; }
+}
+
+/**
+ * The recorded owner of the lease directory at `path`, read as stale recovery reads it, or null
+ * when no lock directory exists. `pid` is null when the directory has no parseable owner; `age`
+ * uses the same clock as reclamation (the later of the record's creation and its file mtime).
+ * Liveness and image describe the current process at the recorded PID; its identity is not verified.
+ */
+function leaseHolder(path, now, alive, image) {
+  if (!existsSync(path)) return null;
+  const observed = readOwner(path);
+  const incomplete = observed ? null : readIncompleteOwner(path);
+  // Neither reader matched: the holder may have released between these reads. Report a free
+  // lease then, not an unreadable one.
+  if (!observed && !incomplete && !existsSync(path)) return null;
+  const pid = observed?.record.pid ?? incomplete?.pid ?? null;
+  const since = observed ? Math.max(observed.record.createdAt, observed.mtimeMs) : incomplete?.mtimeMs ?? null;
+  const live = pid === null ? null : alive(pid);
+  return {
+    path,
+    pid,
+    alive: live,
+    image: live ? image(pid) : null,
+    ageMs: since === null ? null : Math.max(0, now() - since),
+    record: observed ? "complete" : incomplete?.ownerPath ? "incomplete" : incomplete ? "empty" : "unreadable",
+  };
+}
+
+function describeHolder(holder) {
+  const age = holder.ageMs === null ? "" : `, lease age ${Math.round(holder.ageMs / 1_000)}s`;
+  if (holder.record === "unreadable") return "holder unknown: the lock directory does not hold exactly one owner file";
+  if (holder.record === "empty") return `no owner file written yet${age}`;
+  const state = holder.alive ? ["alive", ...(holder.image ? [holder.image] : [])].join(", ") : "not alive";
+  const partial = holder.record === "incomplete" ? ", owner record incomplete" : "";
+  return `recorded PID ${holder.pid} [${state}, identity unverified${partial}]${age}`;
+}
+
+const RECLAIM_HINT = `stale leases are reclaimed after ${STALE_MS / 1_000}s once the recorded PID is no longer alive`;
+
+/** The recorded lease owner for `statePaths`, identity unverified, or null if free. Reads only; never reclaims. */
+export function inspectOwnershipMutationLease(statePaths, options = {}) {
+  return leaseHolder(leasePath(statePaths), options.now ?? Date.now, options.processAlive ?? processAlive,
+    options.processImage ?? processImage);
+}
+
+/** One status line naming the recorded PID, identity unverified, or null when the lease is free. */
+export function ownershipMutationLeaseStatusLine(statePaths, options = {}) {
+  const holder = inspectOwnershipMutationLease(statePaths, options);
+  if (!holder) return null;
+  return `Runtime mutation lease busy at ${holder.path} (${describeHolder(holder)}); `
+    + `opencodex waits for it to start or change service state, and ${RECLAIM_HINT}.`;
+}
+
 function reclaim(path, now, alive) {
   const observed = readOwner(path);
   const incomplete = observed ? null : readIncompleteOwner(path);
@@ -182,7 +250,14 @@ export function acquireOwnershipMutationLease(
       }
       if (error?.code !== "EEXIST") throw error;
       if (reclaim(path, now, alive)) continue;
-      if (now() >= deadline) throw new Error(`another process owns the runtime mutation lease at ${path}`);
+      if (now() >= deadline) {
+        const holder = leaseHolder(path, now, alive, options.processImage ?? processImage);
+        const error = new Error(`another process owns the runtime mutation lease at ${path}`
+          + (holder ? ` (${describeHolder(holder)}; ${RECLAIM_HINT})` : ""));
+        error.code = "OWNERSHIP_MUTATION_LEASE_BUSY";
+        error.holder = holder;
+        throw error;
+      }
       (options.sleep ?? sleep)(POLL_MS);
     }
   }

package/src/service/windows-taskxml.ts

@@ -154,7 +154,6 @@ export function buildWindowsServiceScript(
     '    if exist "%OCX_PKG_DIR%" rmdir /s /q "%OCX_PKG_DIR%" 2>nul',
     '    move "%OCX_PKG_DIR%\\..\\%%B\\opencodex" "%OCX_PKG_DIR%" >nul 2>&1',
     '    if exist "%OCX_PKG_DIR%\\package.json" (',
-    '      set "OCX_RESTORED_BACKUP=%%B"',
     "      goto backup_restored",
     "    )",
     "  )",
@@ -162,7 +161,7 @@ export function buildWindowsServiceScript(
     '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] no restorable backup found',
     "goto :eof",
     ":backup_restored",
-    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from %OCX_RESTORED_BACKUP%',
+    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from transactional-update backup',
     "goto :eof",
   ].filter((line): line is string => Boolean(line));
   return `${lines.join("\r\n")}\r\n`;

package/src/service-manager-probe.ts

@@ -29,6 +29,7 @@ import {
 import { decodeWindowsTextBytes } from "./lib/windows-text";
 import { WINSW_SERVICE_ID } from "./lib/winsw";
 import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV } from "./lib/bun-runtime";
+import { REAL_BUN_MIN_BYTES } from "./lib/bun-binary-validator.mjs";
 import { WINDOWS_WRAPPER_PROTOCOL_ENV, WINDOWS_WRAPPER_STAY_OUT_EXIT_CODE } from "./service/windows-wrapper-exit";
 import { buildWindowsServiceScript, windowsTaskActionMatches } from "./service/windows-taskxml";
 import { inspectServiceStateEvidence, serviceStatePathsForOpenCodexHome } from "./service/state";
@@ -613,8 +614,41 @@ function matchesGeneratedStandaloneControlFlow(body: string, port: number): bool
     scriptLines.filter((line, index) => index >= end || line === 'set "ERRORLEVEL="' || !line.startsWith('set "'));
   const actualFlow = withoutPrefixSets(lines, boundary);
   const generatedFlow = withoutPrefixSets(expected, expectedBoundary);
-  return actualFlow.length === generatedFlow.length
-    && actualFlow.every((line, index) => line === generatedFlow[index]);
+  // Read-only recognition of the exact previous generator output keeps installed
+  // standalone services identifiable across the backup-log hardening update.
+  // Never emit or execute this legacy variant; every other control line still matches.
+  const legacyFlow = generatedFlow.flatMap(line => {
+    if (line === "      goto backup_restored") return ['      set "OCX_RESTORED_BACKUP=%%B"', line];
+    if (line === '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from transactional-update backup') {
+      return ['>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from %OCX_RESTORED_BACKUP%'];
+    }
+    return [line];
+  });
+  // Also recognize the exact pre-placeholder version, not a partial size-gate
+  // hybrid. Only remove these complete known blocks from trusted generator output.
+  const beforePlaceholderGate = (flow: string[]): string[] | null => {
+    const blocks = [
+      ['set "OCX_BUN_BYTES="', 'for %%F in ("%OCX_BUN%") do set "OCX_BUN_BYTES=%%~zF"',
+        'if not defined OCX_BUN_BYTES goto bun_not_ready', `if %OCX_BUN_BYTES% LSS ${REAL_BUN_MIN_BYTES} goto bun_not_ready`],
+      [":bun_not_ready",
+        '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] bundled Bun is not ready (%OCX_BUN_BYTES% bytes, npm placeholder or mid-install); waiting for its postinstall, retrying in 5s - if this persists, reinstall opencodex with bun scripts allowed',
+        "ping -n 6 127.0.0.1 >nul", "goto loop"],
+    ];
+    let earlier = flow;
+    for (const block of blocks) {
+      const at = earlier.indexOf(block[0]!);
+      if (at < 0 || !block.every((line, offset) => earlier[at + offset] === line)) return null;
+      earlier = [...earlier.slice(0, at), ...earlier.slice(at + block.length)];
+    }
+    return earlier;
+  };
+  const recognized = [generatedFlow, legacyFlow];
+  for (const flow of [...recognized]) {
+    const earlier = beforePlaceholderGate(flow);
+    if (earlier) recognized.push(earlier);
+  }
+  return recognized.some(expectedFlow => actualFlow.length === expectedFlow.length
+    && actualFlow.every((line, index) => line === expectedFlow[index]));
 }
 
 /** Validate the generated launch shape before interpreting omitted optional homes. */

package/src/types/config.ts

@@ -219,6 +219,8 @@ export interface OcxClaudeCodeConfig {
    * definition. Unset inherits the parent session effort.
    */
   subagentEffort?: "low" | "medium" | "high" | "xhigh" | "max";
+  /** Optional roster-style model forced on subagents at the next routed Claude Code launch. */
+  subagentModelForce?: string;
   /** Claude-originated web-search override. Unset fields inherit the global sidecar settings. */
   webSearchSidecar?: { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa"; model?: string };
   /** Claude-originated vision override. Unset fields inherit the global sidecar settings. */
@@ -750,6 +752,8 @@ export interface OcxConfig {
   modelPinnedEfforts?: Record<string, string>;
   compactionRouting?: {
     model: string;
+    /** Incoming model allowlist: exact selectors or provider/*; omitted means all models. */
+    sourceModels?: string[];
     reasoningEffort?: string;
     /** Compaction triggers this override covers; omission means `["manual"]`. */
     triggers?: ("manual" | "auto")[];
@@ -1214,6 +1218,8 @@ export interface OcxConfig {
    */
   anthropicAccountPool?: {
     enabled?: boolean;
+    /** Preserve native Claude Messages while the pool is enabled. Default true; false selects legacy translation. */
+    nativeMessages?: boolean;
     /** Usage % threshold for new-session auto-pick. Default 80. 0 = disabled (affinity/active only). */
     autoSwitchThreshold?: number;
     /** New-session rotation strategy. Default quota (today's behaviour). */