@bybrawe/opencode-loop 0.6.6 → 0.6.8

package/scripts/host-goal-coexistence-canary.mjs

@@ -7,11 +7,12 @@ import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promis
 import os from "node:os"
 import path from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
+import { waitForSessionBootstrap } from "./host-goal-bootstrap.mjs"
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const isWindows = process.platform === "win32"
 const SERVER_READY_TIMEOUT_MS = isWindows ? 60_000 : 30_000
-const API_BOOTSTRAP_TIMEOUT_MS = isWindows ? 90_000 : 30_000
+const API_BOOTSTRAP_TIMEOUT_MS = isWindows ? 180_000 : 60_000
 const PREWARM_TIMEOUT_MS = isWindows ? 120_000 : 60_000
 const GOAL_OBJECTIVE = "prove dedicated Goal owns continuation over Loop"
 const GOAL_PROMPT_MARKER = "Continue working toward the active OpenCode goal."
@@ -341,7 +342,15 @@ async function main() {
       }
     }
 
-    const sessionsPayload = await api("/session", { method: "GET" })
+    // A Windows cold host may accept TCP before its session/project/plugin
+    // services are ready. Probe readiness in bounded requests rather than
+    // hanging for 90 seconds on one socket and attributing it to Goal/Loop.
+    const sessionsPayload = await waitForSessionBootstrap({
+      baseURL,
+      workspace,
+      timeoutMs: API_BOOTSTRAP_TIMEOUT_MS,
+      fetchImpl: fetch,
+    })
     assert.ok(Array.isArray(sessionsPayload?.data ?? sessionsPayload), "GET /session bootstrap did not return an array")
     const createdPayload = await api("/session", { method: "POST", body: JSON.stringify({ title: "Loop + Goal ownership canary" }) })
     const session = createdPayload?.data ?? createdPayload

package/scripts/install-with-goals.mjs

@@ -83,6 +83,17 @@ function printCompanionHelp() {
 }
 
 async function main() {
+  if (rawArgs[0] === "--desktop-diagnostics") {
+    // Diagnostic mode must not run either installer or modify any configuration.
+    const { runDesktopDiagnosticCli } = await import("./desktop-command-diagnostics.mjs")
+    process.exitCode = await runDesktopDiagnosticCli(rawArgs.slice(1))
+    return
+  }
+  if (rawArgs.includes("--desktop-diagnostics")) {
+    console.error("--desktop-diagnostics must be the first argument.")
+    process.exitCode = 2
+    return
+  }
   if (withGoals && loopOnly) {
     console.error("Use either --with-goals or --loop-only, not both.")
     process.exitCode = 2

package/scripts/native-plugin-lifetime-test.mjs

@@ -5,8 +5,10 @@ import os from "node:os"
 import path from "node:path"
 import plugin from "../src/source/opencode2/native-plugin.js"
 
-function fixture(directory, { failCleanup = false } = {}) {
+function fixture(directory, { failCleanup = false, captureCommands = false } = {}) {
   const released = []
+  const commands = new Map()
+  const prompts = []
   let releaseRead, signal
   let streamClosed = false
   const end = () => releaseRead?.()
@@ -18,10 +20,17 @@ function fixture(directory, { failCleanup = false } = {}) {
     location: { directory }, options: {}, app: { version: "2.0.18" },
     session: {
       get: async ({ sessionID }) => ({ id: sessionID, location: { directory } }),
-      prompt: async () => { throw new Error("cleanup must not dispatch a prompt") },
+      prompt: async (request) => {
+        if (!captureCommands) throw new Error("cleanup must not dispatch a prompt")
+        prompts.push(request)
+        return { id: "test-prompt" }
+      },
       hook: async (name) => registration(name),
     },
-    command: { transform: async () => registration("commands") },
+    command: { transform: async (register) => {
+      if (captureCommands) await register({ add: ({ name, execute }) => commands.set(name, execute) })
+      return registration("commands")
+    } },
     event: { subscribe(options = {}) {
       signal = options.signal
       return (async function* () {
@@ -35,7 +44,7 @@ function fixture(directory, { failCleanup = false } = {}) {
       })()
     } },
   }
-  return { ctx, end, released, signal: () => signal, streamClosed: () => streamClosed }
+  return { ctx, end, released, commands, prompts, signal: () => signal, streamClosed: () => streamClosed }
 }
 
 async function bounded(promise) {
@@ -100,19 +109,22 @@ test("native Loop cleanup is shared and drains all registrations after an error"
   }
 })
 
-test("native Loop never probes undocumented SessionDomain shell compact or inbox fields", async () => {
+test("native Loop never probes undocumented SessionDomain shell or inbox fields", async () => {
   const directory = await mkdtemp(path.join(os.tmpdir(), "loop-v2-public-session-"))
   const host = fixture(directory)
   let dispose
   try {
-    for (const field of ["shell", "compact", "inbox"]) {
+    for (const field of ["shell", "inbox"]) {
       Object.defineProperty(host.ctx.session, field, {
         configurable: true,
         get() { throw new Error(`undocumented session.${field} was accessed`) },
       })
     }
+    const calls = []
+    host.ctx.session.compact = async (input) => { calls.push(input); return { id: input.id } }
     dispose = await plugin.setup(host.ctx)
     assert.equal(typeof dispose, "function")
+    assert.deepEqual(calls, [], "public compact is invoked only for scheduled work")
   } finally {
     host.end()
     await dispose?.().catch(() => {})
@@ -123,3 +135,24 @@ test("native Loop never probes undocumented SessionDomain shell compact or inbox
 test("native Loop uses the same public plugin identity as the package entry", () => {
   assert.equal(plugin.id, "@bybrawe/opencode-loop", "native entry must share canonical plugin identity")
 })
+
+test("native /loop-help reflects public V2 compaction rather than obsolete unsupported guidance", async () => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "loop-v2-help-compaction-"))
+  const host = fixture(directory, { captureCommands: true })
+  host.ctx.session.compact = async () => ({ id: "unused-compaction" })
+  let dispose
+  try {
+    dispose = await plugin.setup(host.ctx)
+    const help = host.commands.get("loop-help")
+    assert.equal(typeof help, "function")
+    await help({ sessionID: "ses-help" })
+    assert.equal(host.prompts.length, 1)
+    assert.match(host.prompts[0].text, /public session\.compact/)
+    assert.match(host.prompts[0].text, /inputID/)
+    assert.doesNotMatch(host.prompts[0].text, /does not expose manual session compaction/)
+  } finally {
+    host.end()
+    await dispose?.().catch(() => {})
+    await rm(directory, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 })
+  }
+})

package/scripts/native-release.mjs

@@ -7,12 +7,12 @@ export function validateRelease(request, pkg, env) {
   assert.equal(env.GITHUB_REPOSITORY, "ByBrawe/opencode-loop", "wrong release repository")
   assert.equal(env.GITHUB_REF, "refs/heads/main", "npm release must come from main")
   assert.match(env.GITHUB_SHA ?? "", /^[a-f0-9]{40}$/, "immutable release SHA required")
-  assert.equal(request?.version, "0.6.6", "release version is not authorized")
+  assert.equal(request?.version, "0.6.8", "release version is not authorized")
   assert.equal(request?.name, "@bybrawe/opencode-loop")
   assert.equal(pkg.name, request.name)
   assert.equal(pkg.version, request.version)
-  assert.equal(request.predecessor, "0.6.5")
-  assert.equal(request.goal?.version, "1.3.47")
+  assert.equal(request.predecessor, "0.6.7")
+  assert.equal(request.goal?.version, "1.3.49")
   assert.match(request.goal?.sha ?? "", /^[a-f0-9]{40}$/)
   return request
 }

package/scripts/native-v2-test.mjs

@@ -215,13 +215,75 @@ await test("compaction cadence does not charge a logical run", async (f) => {
   await f.complete()
   assert.equal(f.compacts.length, 1)
   assert.equal((await f.state()).jobs[0].runCount, 1)
-  await f.event("compaction", "started")
-  await f.event("compaction", "ended")
+  await f.event("compaction", "started", { reason: "auto" })
+  await f.event("compaction", "ended", { reason: "auto" })
+  await f.event("session", "idle")
+  assert.equal(f.prompts.length, 1, "an unrelated automatic compaction cannot settle a Loop request")
+  await f.event("compaction", "started", { reason: "manual", inputID: f.compacts[0].id })
+  await f.event("compaction", "ended", { reason: "manual" })
   await f.event("session", "idle")
   assert.equal(f.prompts.length, 2)
   assert.equal((await f.state()).jobs[0].runCount, 2)
 })
 
+await test("manual compaction needs delivered inbox and completed host boundary", async (f) => {
+  await f.control("loop-compact", "0s --now --max-runs 1")
+  await f.wake()
+  assert.equal(f.compacts.length, 1)
+  assert.equal(f.compacts[0].delivery, "queue")
+  assert.ok(f.compacts[0].id)
+  await f.event("compaction", "started", { reason: "manual", inputID: "a-different-compaction" })
+  await f.event("compaction", "ended", { reason: "manual" })
+  await f.event("session", "idle")
+  assert.ok((await f.state()).jobs[0].v2Run, "a different compaction must not finish the scheduled request")
+  await f.event("compaction", "started", { reason: "manual", inputID: f.compacts[0].id })
+  await f.event("compaction", "ended", { reason: "manual" })
+  await f.event("session", "idle")
+  assert.equal((await f.state()).jobs[0].v2Run, undefined)
+  assert.equal((await f.state()).jobs[0].runCount, 1)
+})
+
+await test("foreign host compaction failure cannot pause or consume a pending Loop compact", async (f) => {
+  await f.control("loop-compact", "0s --now --max-runs 1")
+  await f.wake()
+  const jobID = f.compacts[0].id
+  await f.event("compaction", "started", { reason: "manual", inputID: "another-user-input" })
+  await f.event("compaction", "failed", {
+    reason: "manual", inputID: "another-user-input",
+    error: "Not our compaction",
+  })
+  await f.event("session", "idle")
+  const waiting = (await f.state()).jobs[0]
+  assert.equal(waiting.paused, false, "foreign compaction failure must not pause our pending operation")
+  assert.ok(waiting.v2Run, "foreign event must not erase the pending compact request")
+  assert.equal(waiting.runCount, 1, "a confirmed host admission is charged once; foreign failure cannot change its accounting")
+
+  await f.event("compaction", "started", { reason: "manual", inputID: jobID })
+  await f.event("compaction", "failed", {
+    reason: "manual", inputID: jobID,
+    error: "Summary did not match the template\nwith details",
+  })
+  const failed = (await f.state()).jobs[0]
+  assert.equal(failed.paused, true)
+  assert.match(failed.pauseReason, /^compaction-failed: Summary did not match the template/)
+  assert.equal(failed.pauseReason.includes("\n"), false, "provider messages cannot inject log newlines")
+  assert.equal(failed.v2Run, undefined, "confirmed owned host failure must release pending work")
+  assert.equal(failed.runCount, 1, "a failed host compact preserves the one already-admitted logical run")
+  await f.event("session", "idle")
+  assert.equal((await f.state()).jobs[0].paused, true)
+})
+
+await test("unowned automatic host compaction failure leaves unrelated Loop jobs enabled", async (f) => {
+  await f.add("every 1h delayed task --max-runs 1")
+  await f.event("compaction", "started", { reason: "auto" })
+  await f.event("compaction", "failed", { reason: "auto", error: "host model unavailable" })
+  await f.event("session", "idle")
+  const job = (await f.state()).jobs[0]
+  assert.equal(job.paused, false)
+  assert.equal(job.runCount, 0)
+  assert.equal(job.v2Run, undefined)
+})
+
 await test("a failed delivered execution is paused and can be explicitly resumed", async (f) => {
   await f.add("0s task --max-runs 3")
   await f.wake()

package/scripts/opencode2-loop-canary.mjs

@@ -118,7 +118,7 @@ function streamText(res, content, sequence) {
 }
 
 function startProvider() {
-  const stats = { chatRequests: 0, loopRequests: 0, paths: [] }
+  const stats = { chatRequests: 0, loopRequests: 0, compactionRequests: 0, paths: [] }
   const server = createServer(async (req, res) => {
     const url = new URL(req.url ?? "/", "http://127.0.0.1")
     stats.paths.push(`${req.method} ${url.pathname}`)
@@ -137,6 +137,18 @@ function startProvider() {
     for await (const chunk of req) raw += String(chunk)
     const body = raw ? JSON.parse(raw) : {}
     stats.chatRequests += 1
+    // The real host requires a structured checkpoint. A plain "OK" response
+    // triggers its retried summary validation and fails for test reasons,
+    // unrelated to Loop's durable compaction lifecycle.
+    const compactionPrompt = JSON.stringify(body.messages ?? [])
+    if (
+      compactionPrompt.includes("## Objective")
+      && compactionPrompt.includes("Do not continue the task or call tools.")
+    ) {
+      stats.compactionRequests += 1
+      streamText(res, "## Objective\n- Preserve the verified native Loop job and provider canary context.\n\n## Requirements\n- Continue only the configured user work.", stats.chatRequests)
+      return
+    }
     const text = lastUserText(body)
     if (text.includes("AUTONOMOUS OPENCODE LOOP ITERATION")) {
       stats.loopRequests += 1
@@ -478,6 +490,48 @@ async function main() {
       }, "native shell terminal correlation", diagnostics, 20_000)
       assert.equal(await readFile(path.join(workspace, "native-preflight.txt"), "utf8"), "PP")
       await sendControl("loop-clear")
+
+      // OpenCode 2.0.22+ exposes public session.compact. Unlike prompt items,
+      // a host compaction control does not produce session.inbox.delivered.
+      // Exercise a REAL manual compaction and correlate its started.inputID
+      // with the request admitted by this Loop job before accepting completion.
+      if (process.env.OPENCODE2_NATIVE_COMPACT_CANARY === "1") {
+        await sendControl("loop-compact", "0s --now --max-runs 1 --name native-compact")
+        await waitFor(async () => {
+          const job = await jobNamed("native-compact")
+          return Boolean(
+            job?.runCount === 1
+            && !job.v2Run
+            && job.enabled === false
+            && typeof job.lastCompactAt === "number"
+            && job.lastCompactAt > 0
+          )
+        }, "real host-owned manual compaction completion", diagnostics, 90_000)
+
+        assert.ok(provider.stats.compactionRequests >= 1,
+          `host compaction never called the structured-summary model\n${await diagnostics()}`)
+        const recorded = (await readFile(eventTrace, "utf8"))
+          .split("\n").filter(Boolean).map((line) => JSON.parse(line))
+          .filter((event) => event?.data?.sessionID === sessionID)
+        const manualStart = recorded.find((event) =>
+          event.type === "session.compaction.started"
+          && event.data?.reason === "manual"
+          && typeof event.data?.inputID === "string"
+          && event.data.inputID.length > 0
+        )
+        const manualEnd = recorded.find((event) =>
+          event.type === "session.compaction.ended"
+          && event.data?.reason === "manual"
+          && manualStart
+          && event.id !== undefined
+        ) ?? recorded.find((event) =>
+          event.type === "session.compaction.ended" && event.data?.reason === "manual"
+        )
+        assert.ok(manualStart, `real V2 host never started the manual inbox compaction\n${await diagnostics()}`)
+        assert.ok(manualEnd, `real V2 host never completed the manual inbox compaction\n${await diagnostics()}`)
+        assert.equal(server.exitCode, null)
+        await sendControl("loop-clear")
+      }
       const beforePresets = provider.stats.loopRequests
       await sendControl("loop-init")
       assert.match(await readFile(path.join(workspace, "progress.md"), "utf8"), /^# Progress\n/)

package/scripts/package-native-smoke.mjs

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict"
 import { spawnSync } from "node:child_process"
-import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises"
+import { mkdtemp, mkdir, rm, symlink, writeFile } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import path from "node:path"
 import { fileURLToPath } from "node:url"
@@ -9,9 +9,14 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const npmCLI = process.env.npm_execpath
 assert.ok(npmCLI, "run this through npm run package:smoke")
 function run(command, args, cwd) {
-  const result = spawnSync(command, args, { cwd, encoding: "utf8", timeout: 360_000, maxBuffer: 8 * 1024 * 1024, windowsHide: true })
-  if (result.error) throw result.error
-  assert.equal(result.status, 0, [result.stdout, result.stderr].filter(Boolean).join("\n"))
+  const result = spawnSync(command, args, {
+    cwd, encoding: "utf8", timeout: 180_000, maxBuffer: 8 * 1024 * 1024,
+    windowsHide: true,
+    env: { ...process.env, npm_config_fetch_retries: "1", npm_config_fetch_timeout: "90000" },
+  })
+  const output = [result.stdout, result.stderr].filter(Boolean).join("\n")
+  if (result.error) throw new Error(`npm smoke subprocess failed: ${result.error.message}\n${output}`, { cause: result.error })
+  assert.equal(result.status, 0, output)
   return result.stdout
 }
 const temp = await mkdtemp(path.join(tmpdir(), "loop native package "))
@@ -23,7 +28,37 @@ try {
   const consumer = path.join(temp, "consumer with spaces")
   await mkdir(consumer)
   await writeFile(path.join(consumer, "package.json"), JSON.stringify({ private: true, type: "module" }))
-  run(process.execPath, [npmCLI, "install", "--ignore-scripts", "--omit=dev", "--omit=peer", "--no-audit", "--no-fund", path.join(temp, packed[0].filename)], consumer)
+  const packedTarball = path.join(temp, packed[0].filename)
+  const installArgs = ["install", "--ignore-scripts", "--omit=dev", "--omit=peer", "--no-audit", "--no-fund"]
+  try {
+    // npm ci populated this job's npm cache from the lockfile. A cache-only
+    // install remains an exact, clean npm consumer when all metadata is present.
+    run(process.execPath, [npmCLI, ...installArgs, "--offline", packedTarball], consumer)
+    console.log("Clean tarball npm install from local cache PASS")
+  } catch (error) {
+    if (!/ENOTCACHED|cache mode is .only-if-cached./i.test(String(error))) throw error
+    if (process.platform !== "win32" || process.env.OPENCODE_PACKAGE_SMOKE_REQUIRE_INSTALL === "1") {
+      console.warn("Offline cache incomplete: performing strict bounded online npm consumer install")
+      run(process.execPath, [npmCLI, ...installArgs, "--prefer-offline", packedTarball], consumer)
+    } else {
+      // GitHub Windows runners sporadically hang for minutes while npm fetches
+      // transient dependency packuments. We still check the EXACT production
+      // archive and isolated V2 imports on Windows, using the already-verified
+      // npm-ci dependency tree. Linux continues to gate a real clean npm install.
+      // This is intentionally NOT labelled a successful Windows npm install.
+      const packageRoot = path.join(consumer, "node_modules", "@bybrawe", "opencode-loop")
+      await mkdir(packageRoot, { recursive: true })
+      run("tar", ["-xzf", packedTarball, "-C", packageRoot, "--strip-components=1"], temp)
+      const scope = path.join(consumer, "node_modules", "@opencode")
+      await mkdir(scope, { recursive: true })
+      await symlink(
+        path.join(root, "node_modules", "@opencode", "plugin"),
+        path.join(scope, "plugin"),
+        "junction",
+      )
+      console.warn("Windows npm cache lacks package metadata; testing packed archive with preinstalled dependency tree (not a clean npm install)")
+    }
+  }
   console.log(run(process.execPath, [path.join(root, "scripts/native-entry-test.mjs"), consumer], root).trim())
   console.log("Production tarball native entry isolation and lazy legacy delegation PASS")
 } finally {

package/scripts/publish-workflow-test.mjs

@@ -43,15 +43,19 @@ for (const block of workflow.split(/- uses: actions\/checkout@/).slice(1)) asser
 const publisher = workflow.slice(workflow.indexOf("  publish:\n"), workflow.indexOf("  github-release:\n"))
 assert.doesNotMatch(publisher, /contents:\s*write/, "OIDC publisher must not gain repository mutation privileges")
 
+assert.match(workflow, /for attempt in \{1\.\.12\}/, "clean published npm consumer must retry version propagation")
+assert.ok(workflow.includes('--prefer-online --cache "$VERIFY_DIR/npm-cache-$attempt"'), "consumer retries must not reuse a stale npm cache")
+assert.ok(workflow.includes("Published Loop+Goal clean-install validation did not converge"), "clean consumer must remain a hard release gate")
+
 const sha = "a".repeat(40)
-const request = { name: "@bybrawe/opencode-loop", version: "0.6.6", predecessor: "0.6.5", goal: { version: "1.3.47", sha: "b".repeat(40) } }
+const request = { name: "@bybrawe/opencode-loop", version: "0.6.8", predecessor: "0.6.7", goal: { version: "1.3.49", sha: "b".repeat(40) } }
 const pkg = { name: request.name, version: request.version }
 const env = { GITHUB_REPOSITORY: "ByBrawe/opencode-loop", GITHUB_REF: "refs/heads/main", GITHUB_SHA: sha }
 assert.strictEqual(validateRelease(request, pkg, env), request)
 for (const change of [{ GITHUB_REPOSITORY: "someone/fork" }, { GITHUB_REF: "refs/heads/release" }, { GITHUB_SHA: "main" }]) assert.throws(() => validateRelease(request, pkg, { ...env, ...change }))
 assert.throws(() => validateRelease({ ...request, version: "9.0.0" }, pkg, env))
 assert.throws(() => validateRelease(request, { ...pkg, version: "0.6.5" }, env))
-assert.equal(releaseDecision(404, null, request, sha, "0.6.5"), true)
+assert.equal(releaseDecision(404, null, request, sha, "0.6.7"), true)
 for (const status of [401, 403, 429, 500, 503]) assert.throws(() => releaseDecision(status, null, request, sha, "0.6.0"))
 assert.throws(() => releaseDecision(404, null, request, sha, "0.7.0"))
 const manifest = { ...pkg, gitHead: sha }

package/scripts/state-exfat-lock-test.mjs

@@ -0,0 +1,99 @@
+import assert from "node:assert/strict"
+import { spawn, spawnSync } from "node:child_process"
+import { randomUUID } from "node:crypto"
+import { promises as fs } from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import { readState, writeState, stateDir } from "../src/source/core/state.js"
+
+const source = fileURLToPath(import.meta.url)
+const originalLink = fs.link
+const linkError = (code) => Object.assign(new Error(`synthetic unsupported hard link: ${code}`), { code })
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+async function exists(file) { try { await fs.access(file); return true } catch (error) { if (error?.code === "ENOENT") return false; throw error } }
+async function until(fn) { for (let i = 0; i < 500; i++) { if (await fn()) return; await wait(20) } throw new Error("worker barrier timeout") }
+
+if (process.argv[2] === "--worker") {
+  fs.link = async () => { throw linkError("EISDIR") }
+  try {
+    const [, , , root, sessionID, label, gate] = process.argv
+    const snapshot = await readState(root, sessionID)
+    await fs.writeFile(`${gate}.${label}.ready`, "ready")
+    await until(() => exists(gate))
+    snapshot.jobs[0][label] = label
+    await writeState(root, sessionID, snapshot)
+  } finally { fs.link = originalLink }
+} else {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "loop-exfat-lock-"))
+  const sessionID = "exfat-session"
+  const canonical = path.join(stateDir(root), `${sessionID}.json.lock`)
+  fs.link = async () => { throw linkError("EISDIR") }
+  try {
+    const original = await readState(root, sessionID)
+    original.jobs = [{ id: "one", round: 1 }]
+    await writeState(root, sessionID, original)
+
+    // Workers each simulate an exFAT runtime: independent Node processes with
+    // no usable hard-link support must still merge their distinct writes.
+    const gate = path.join(root, "go")
+    const workers = []
+    for (let i = 0; i < 4; i++) {
+      const label = `worker${i}`
+      const child = spawn(process.execPath, [source, "--worker", root, sessionID, label, gate], { stdio: ["ignore", "ignore", "pipe"] })
+      let stderr = ""
+      child.stderr.on("data", (chunk) => { stderr += chunk.toString() })
+      workers.push({
+        label,
+        done: new Promise((resolve, reject) => {
+          child.once("error", reject)
+          child.once("close", (code) => code === 0 ? resolve() : reject(new Error(`exFAT worker ${label} failed: ${stderr}`)))
+        }),
+      })
+    }
+    await until(async () => (await Promise.all(workers.map(w => exists(`${gate}.${w.label}.ready`)))).every(Boolean))
+    await fs.writeFile(gate, "go")
+    await Promise.all(workers.map(w => w.done))
+    const saved = (await readState(root, sessionID)).jobs[0]
+    for (const w of workers) assert.equal(saved[w.label], w.label)
+    assert.equal(await exists(canonical), false)
+
+    // Simulate an abandoned primary lock and an orphaned cleanup election,
+    // both written without hard links. Neither may prevent dead-PID recovery.
+    const dead = spawnSync(process.execPath, ["-e", "process.exit(0)"])
+    assert.equal(dead.status, 0)
+    const deadOwner = () => {
+      const token = randomUUID()
+      return { schemaVersion: 1, pid: dead.pid, token, acquiredAt: Date.now(),
+        candidateName: `.loop-lock-${dead.pid}-${token}.json` }
+    }
+    for (const suffix of ["", ".cleanup"]) {
+      const owner = deadOwner()
+      await fs.writeFile(path.join(stateDir(root), owner.candidateName), JSON.stringify(owner))
+      await fs.writeFile(`${canonical}${suffix}`, JSON.stringify(owner))
+    }
+    const revived = await readState(root, sessionID)
+    revived.jobs[0].recovered = true
+    await writeState(root, sessionID, revived)
+    assert.equal((await readState(root, sessionID)).jobs[0].recovered, true)
+    assert.equal(await exists(canonical), false)
+    assert.equal(await exists(`${canonical}.cleanup`), false)
+
+    await fs.writeFile(canonical, "invalid owner")
+    const corrupt = await readState(root, sessionID)
+    corrupt.jobs[0].forbidden = "never commit"
+    await assert.rejects(writeState(root, sessionID, corrupt), /state lock invalid_owner/)
+    assert.equal((await readState(root, sessionID)).jobs[0].forbidden, undefined)
+    await fs.rm(canonical)
+
+    // Unexpected failures must not be turned into 'contention' or ignored.
+    fs.link = async () => { throw linkError("ENOSPC") }
+    await assert.rejects(writeState(root, sessionID, await readState(root, sessionID)), { code: "ENOSPC" })
+    assert.equal(await exists(canonical), false)
+
+    console.log("Loop exFAT-style exclusive lock, process merge, dead-owner election and corrupt-state protections passed")
+  } finally {
+    fs.link = originalLink
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 })
+  }
+}

package/scripts/state-integrity-test.mjs

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict"
+import { mkdtemp, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises"
+import os from "node:os"
+import path from "node:path"
+import { readState, writeState, stateDir } from "../src/source/core/state.js"
+
+// An unreadable existing session is not a new/empty session. The old fallback
+// silently returned zero jobs and let the next ordinary write replace all work.
+const root = await mkdtemp(path.join(os.tmpdir(), "opencode-loop-state-integrity-"))
+const sessionID = "persisted-session"
+const file = path.join(stateDir(root), `${sessionID}.json`)
+try {
+  const missing = await readState(root, sessionID)
+  assert.deepEqual(missing.jobs, [], "only ENOENT is a new empty session")
+
+  const started = await readState(root, sessionID)
+  started.jobs = [{ id: "keep-this-job", enabled: true, runCount: 7 }]
+  await writeState(root, sessionID, started)
+  const oldSnapshot = await readState(root, sessionID)
+  assert.equal(oldSnapshot.jobs.length, 1)
+  assert.equal(oldSnapshot.jobs[0].runCount, 7)
+
+  const corrupt = '{"version":4,"jobs":['
+  await mkdir(stateDir(root), { recursive: true })
+  await writeFile(file, corrupt)
+  await assert.rejects(readState(root, sessionID), /could not be read; refusing to replace persisted jobs/)
+  assert.equal(await readFile(file, "utf8"), corrupt, "read must not reset the original state")
+  const backups = (await readdir(stateDir(root))).filter((name) => name.startsWith(`${sessionID}.json.corrupt-`))
+  assert.ok(backups.length >= 1, "corrupted bytes should be backed up for investigation")
+  assert.equal(await readFile(path.join(stateDir(root), backups[0]), "utf8"), corrupt)
+
+  await writeFile(file, JSON.stringify({ version: 4, jobs: { invalid: "shape" } }))
+  await assert.rejects(readState(root, sessionID), /could not be read; refusing to replace persisted jobs/)
+  assert.equal(JSON.parse(await readFile(file, "utf8")).jobs.invalid, "shape")
+  await writeFile(file, corrupt)
+
+  oldSnapshot.jobs[0].runCount = 8
+  await assert.rejects(
+    writeState(root, sessionID, oldSnapshot),
+    /could not be read; refusing to replace persisted jobs/,
+    "a stale snapshot must not replace a corrupt persisted session",
+  )
+  assert.equal(await readFile(file, "utf8"), corrupt)
+  console.log("Loop corrupt-state fail-closed and no-lost-jobs regression passed")
+} finally {
+  await rm(root, { recursive: true, force: true })
+}