@bybrawe/opencode-loop 0.6.7 → 0.6.9

package/scripts/loopd.mjs

@@ -181,9 +181,11 @@ async function selectHost(project, options = {}) {
 async function listSessions(host, project, limit) {
   const argv = ["session", "list", "--format", "json", "-n", String(limit)]
   if (host.server) argv.push("--server", host.server)
+  // macOS aliases /var -> /private/var. OpenCode 2 needs the canonical
+  // project PWD to agree with process.cwd() and the native session location.
   const result = await run(host.binary, argv, project, {
     capture: true, timeoutMs: 15_000,
-    ...(host.major === 2 ? { env: { ...process.env, PWD: project } } : {}),
+    ...(host.major === 2 ? { env: { ...process.env, PWD: process.platform === "win32" ? project : fs.realpathSync.native(project) } } : {}),
   })
   if (result.code !== 0 || result.timedOut) throw new Error("OpenCode session list failed; refusing to guess a session")
   return projectSessions(result.stdout, project, host.major === 2)
@@ -286,7 +288,7 @@ async function daemon(options = {}) {
     // Keep native runs project-bound and non-interactive without changing V1.
     const result = await run(host.binary, runArgs, project, {
       timeoutMs, closeStdin: host.major === 2,
-      ...(host.major === 2 ? { env: { ...process.env, PWD: project } } : {}),
+      ...(host.major === 2 ? { env: { ...process.env, PWD: process.platform === "win32" ? project : fs.realpathSync.native(project) } } : {}),
     })
     const code = result.timedOut ? 124 : result.code
     const moreRunsRemain = maxRuns === 0 || count < maxRuns

package/scripts/native-cli-io-test.mjs

@@ -1,7 +1,7 @@
 import test from "node:test"
 import assert from "node:assert/strict"
 import { spawn } from "node:child_process"
-import { mkdtemp, mkdir, writeFile, readFile, rm } from "node:fs/promises"
+import { mkdtemp, mkdir, writeFile, readFile, realpath, rm } from "node:fs/promises"
 import os from "node:os"
 import path from "node:path"
 import { fileURLToPath } from "node:url"
@@ -47,9 +47,12 @@ process.stdin.resume();
     assert.equal(result.code, 0, `${mode}: ${result.stdout}\n${result.stderr}`)
     const calls = (await readFile(log, "utf8")).trim().split(/\r?\n/).map(JSON.parse)
     if (mode === "pwd") {
+      // macOS /var/folders is an alias of /private/var/folders; the V2 host
+      // compares project PWD with the physical cwd, not the original alias.
+      const canonical = process.platform === "win32" ? project : await realpath(project)
       for (const call of calls.filter(call => ["session", "run"].includes(call.args[0]))) {
-        assert.equal(call.pwd, project, "native lookup and run must use the selected project, not the caller's PWD")
-        assert.equal(call.cwd, project)
+        assert.equal(call.pwd, canonical, "native lookup and run must use the canonical selected project, not the caller's PWD")
+        assert.equal(call.cwd, canonical)
       }
     }
     if (mode === "stdin") assert.match(result.stdout, /INPUT=\r?\n/)

package/scripts/native-entry-test.mjs

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict"
 import { spawnSync } from "node:child_process"
-import { readFileSync } from "node:fs"
+import { readFileSync, realpathSync } from "node:fs"
 import path from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 
@@ -11,7 +11,9 @@ assert.ok(process.argv.length <= 3, "expected at most one consumer directory")
 const loop = pkg.name === "@bybrawe/opencode-loop"
 const cwd = process.argv[2] ? path.resolve(process.argv[2]) : root
 const packageRoot = process.argv[2] ? path.join(cwd, "node_modules", ...pkg.name.split("/")) : root
-const url = (relative) => pathToFileURL(path.join(packageRoot, relative)).href
+// Node resolves ESM file URLs to real paths on macOS, where /var aliases /private/var.
+// Guard and delegated V1 entry identities must use the same canonical URLs as the loader.
+const url = (relative) => pathToFileURL(realpathSync.native(path.join(packageRoot, relative))).href
 const legacyEntries = loop ? [url("src/v1.js"), url("src/source/v1.js")] : [url("dist/legacy-v1.js")]
 const blocked = loop
   ? [...legacyEntries, url("src/index.js"), url("src/source/legacy-v1.js")]
@@ -23,15 +25,23 @@ const serverEntries = loop ? [`${pkg.name}/server`, url("src/source/server.js")]
 function probe(mode) {
   const stub = "globalThis.__legacyModuleLoads = (globalThis.__legacyModuleLoads || 0) + 1; export default async (...args) => { if (args[0]?.failure) throw args[0].failure; return { args }; }"
   const loader = `
-    const blocked = ${JSON.stringify(blocked)};
-    const legacyEntries = ${JSON.stringify(legacyEntries)};
+    import { realpathSync } from "node:fs";
+    import { fileURLToPath } from "node:url";
+    const physical = (url) => {
+      if (!url.startsWith("file:")) return url;
+      const name = realpathSync.native(fileURLToPath(url));
+      return process.platform === "win32" ? name.toLowerCase() : name;
+    };
+    const blocked = new Set(${JSON.stringify(blocked)}.map(physical));
+    const legacyEntries = new Set(${JSON.stringify(legacyEntries)}.map(physical));
     export async function resolve(specifier, context, nextResolve) {
       if (specifier.startsWith("@opencode-ai/")) throw new Error("V2_LEGACY_IMPORT: " + specifier);
       const result = await nextResolve(specifier, context);
-      if (${JSON.stringify(mode)} === "delegate" && legacyEntries.includes(result.url)) {
+      const actual = physical(result.url);
+      if (${JSON.stringify(mode)} === "delegate" && legacyEntries.has(actual)) {
         return { url: ${JSON.stringify(`data:text/javascript,${encodeURIComponent(stub)}`)}, shortCircuit: true };
       }
-      if (blocked.includes(result.url)) throw new Error("V2_LEGACY_IMPORT: " + result.url);
+      if (blocked.has(actual)) throw new Error("V2_LEGACY_IMPORT: " + result.url);
       return result;
     }
   `

package/scripts/native-release.mjs

@@ -7,12 +7,12 @@ export function validateRelease(request, pkg, env) {
   assert.equal(env.GITHUB_REPOSITORY, "ByBrawe/opencode-loop", "wrong release repository")
   assert.equal(env.GITHUB_REF, "refs/heads/main", "npm release must come from main")
   assert.match(env.GITHUB_SHA ?? "", /^[a-f0-9]{40}$/, "immutable release SHA required")
-  assert.equal(request?.version, "0.6.7", "release version is not authorized")
+  assert.equal(request?.version, "0.6.9", "release version is not authorized")
   assert.equal(request?.name, "@bybrawe/opencode-loop")
   assert.equal(pkg.name, request.name)
   assert.equal(pkg.version, request.version)
-  assert.equal(request.predecessor, "0.6.6")
-  assert.equal(request.goal?.version, "1.3.48")
+  assert.equal(request.predecessor, "0.6.8")
+  assert.equal(request.goal?.version, "1.3.49")
   assert.match(request.goal?.sha ?? "", /^[a-f0-9]{40}$/)
   return request
 }

package/scripts/native-v2-test.mjs

@@ -47,6 +47,67 @@ async function test(name, run, extra) {
   finally { await f.close() }
 }
 
+await test("explicit checklist stop prevents the next V2 model turn", async (f) => {
+  await writeFile(path.join(f.directory, "TASK.md"), "- [ ] implement\n- [x] setup\n")
+  const added = await f.add("0s --progress-file TASK.md --until-checklist-complete implement --max-runs 3")
+  assert.equal(added.accepted, true)
+  await f.wake()
+  assert.equal(f.prompts.length, 1)
+  await writeFile(path.join(f.directory, "TASK.md"), "- [x] implement\n- [x] setup\n")
+  await f.complete()
+  const job = (await f.state()).jobs[0]
+  assert.equal(f.prompts.length, 1, "no redundant model prompt after host checks TASK.md")
+  assert.equal(job.enabled, false)
+  assert.equal(job.paused, true)
+  assert.equal(job.pauseReason, "checklist-complete")
+  assert.deepEqual(job.checklistStatus, { status: "complete", total: 2, pending: 0 })
+})
+
+await test("explicit checklist refuses missing project file instead of spending tokens", async (f) => {
+  assert.equal((await f.add("0s --progress-file MISSING.md --until-checklist-complete implement")).accepted, true)
+  await f.wake()
+  const job = (await f.state()).jobs[0]
+  assert.equal(f.prompts.length, 0)
+  assert.equal(job.paused, true)
+  assert.equal(job.pauseReason, "checklist-unavailable")
+  assert.equal(job.lastChecklistError, "file-missing")
+})
+
+await test("an already-complete checklist still requires host verification when requested", async (f) => {
+  await writeFile(path.join(f.directory, "TASK.md"), "- [x] done\n")
+  await f.add('0s --progress-file TASK.md --until-checklist-complete --verify "npm test" check work --max-runs 2')
+  await f.wake()
+  assert.equal(f.prompts.length, 1, "unobserved verify must not pass by default")
+  await f.complete()
+  const job = (await f.state()).jobs[0]
+  assert.equal(f.hooks.length, 1)
+  assert.equal(f.hooks[0], "npm test")
+  assert.equal(f.prompts.length, 1, "observed verify pass stops before another turn")
+  assert.equal(job.enabled, false)
+  assert.equal(job.pauseReason, "checklist-complete")
+  assert.equal(job.lastVerifyCode, 0)
+})
+
+await test("progress-file without opt-in still follows existing finite or infinite semantics", async (f) => {
+  await writeFile(path.join(f.directory, "TASK.md"), "- [x] all done\n")
+  await f.add("0s --progress-file TASK.md task --max-runs 1")
+  await f.wake()
+  assert.equal(f.prompts.length, 1)
+  assert.equal((await f.state()).jobs[0].untilChecklistComplete, false)
+})
+
+await test("native checklist flag requires explicit progress file and status reveals stop controls", async (f) => {
+  const rejected = await f.add("0s --until-checklist-complete implement")
+  assert.equal(rejected.accepted, false)
+  assert.match(rejected.error, /--progress-file/)
+  await writeFile(path.join(f.directory, "TASK.md"), "- [ ] todo\n")
+  await f.add("0s --progress-file TASK.md --until-checklist-complete implement --max-runs 3")
+  const status = await f.control("loop-status")
+  assert.match(status.status.text, /checklist-stop:TASK\.md/)
+  assert.match(status.status.text, /\/loop-stop/)
+  assert.match(status.status.text, /\/loop-clear/)
+})
+
 await test("one durable prompt under concurrent idle notifications", async (f) => {
   assert.equal((await f.add("0s keep working --max-runs 2")).accepted, true)
   await Promise.all(Array.from({ length: 12 }, () => f.wake()))

package/scripts/opencode2-loop-canary.mjs

@@ -224,7 +224,8 @@ function commandNames(payload) {
 }
 
 async function main() {
-  assert.equal(process.platform, "linux", "the real OpenCode 2 Loop canary is intentionally Ubuntu-only")
+  const supported = process.platform === "linux" || (process.platform === "darwin" && process.env.OPENCODE2_MACOS_NATIVE_CANARY === "1")
+  assert.ok(supported, "real OpenCode 2 canary supports Linux or explicitly opted-in macOS CI only")
 
   const workspace = await mkdtemp(path.join(os.tmpdir(), "opencode-loop-v2-e2e-"))
   const home = path.join(workspace, ".home")

package/scripts/package-native-smoke.mjs

@@ -8,9 +8,9 @@ import { fileURLToPath } from "node:url"
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const npmCLI = process.env.npm_execpath
 assert.ok(npmCLI, "run this through npm run package:smoke")
-function run(command, args, cwd) {
+function run(command, args, cwd, timeout = 180_000) {
   const result = spawnSync(command, args, {
-    cwd, encoding: "utf8", timeout: 180_000, maxBuffer: 8 * 1024 * 1024,
+    cwd, encoding: "utf8", timeout, maxBuffer: 8 * 1024 * 1024,
     windowsHide: true,
     env: { ...process.env, npm_config_fetch_retries: "1", npm_config_fetch_timeout: "90000" },
   })
@@ -30,22 +30,54 @@ try {
   await writeFile(path.join(consumer, "package.json"), JSON.stringify({ private: true, type: "module" }))
   const packedTarball = path.join(temp, packed[0].filename)
   const installArgs = ["install", "--ignore-scripts", "--omit=dev", "--omit=peer", "--no-audit", "--no-fund"]
+  const strictInstall = process.env.OPENCODE_PACKAGE_SMOKE_REQUIRE_INSTALL === "1"
+  // A cache-only npm install should finish quickly. On Windows, a cache miss
+  // sometimes blocks inside npm for the entire 180-second subprocess deadline.
+  // Bound the best-effort offline attempt; strict opt-in keeps the full gate.
+  const offlineTimeout = process.platform === "win32" && !strictInstall ? 30_000 : 180_000
+  async function strictCleanOnlineInstall() {
+    // Busy Windows runners can stall fetching npm metadata even after npm ci.
+    // Retry once on subprocess ETIMEDOUT using a *new* empty consumer.
+    // This path never accepts the tar archive or CI-installed dependency tree
+    // as a substitute for a real npm install.
+    const maxAttempts = process.platform === "win32" ? 2 : 1
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        const timeoutMs = process.platform === "win32" && attempt === 2 ? 270_000 : 180_000
+        run(process.execPath, [npmCLI, ...installArgs, "--prefer-offline", packedTarball], consumer, timeoutMs)
+        console.log("Strict clean npm tarball consumer install PASS")
+        return
+      } catch (error) {
+        if (attempt >= maxAttempts || error?.cause?.code !== "ETIMEDOUT") throw error
+        console.warn("Strict Windows npm install timed out; retrying once from a fresh empty consumer, not a fallback")
+        await rm(consumer, { recursive: true, force: true, maxRetries: 8, retryDelay: 150 })
+        await mkdir(consumer, { recursive: true })
+        await writeFile(path.join(consumer, "package.json"), JSON.stringify({ private: true, type: "module" }))
+      }
+    }
+  }
   try {
     // npm ci populated this job's npm cache from the lockfile. A cache-only
     // install remains an exact, clean npm consumer when all metadata is present.
-    run(process.execPath, [npmCLI, ...installArgs, "--offline", packedTarball], consumer)
+    run(process.execPath, [npmCLI, ...installArgs, "--offline", packedTarball], consumer, offlineTimeout)
     console.log("Clean tarball npm install from local cache PASS")
   } catch (error) {
-    if (!/ENOTCACHED|cache mode is .only-if-cached./i.test(String(error))) throw error
-    if (process.platform !== "win32" || process.env.OPENCODE_PACKAGE_SMOKE_REQUIRE_INSTALL === "1") {
+    const cacheMissing = /ENOTCACHED|cache mode is .only-if-cached./i.test(String(error))
+    const windowsOfflineTimeout = process.platform === "win32" && !strictInstall && error?.cause?.code === "ETIMEDOUT"
+    if (!cacheMissing && !windowsOfflineTimeout) throw error
+    if (process.platform !== "win32" || strictInstall) {
       console.warn("Offline cache incomplete: performing strict bounded online npm consumer install")
-      run(process.execPath, [npmCLI, ...installArgs, "--prefer-offline", packedTarball], consumer)
+      if (strictInstall) await strictCleanOnlineInstall()
+      else run(process.execPath, [npmCLI, ...installArgs, "--prefer-offline", packedTarball], consumer)
     } else {
       // GitHub Windows runners sporadically hang for minutes while npm fetches
       // transient dependency packuments. We still check the EXACT production
       // archive and isolated V2 imports on Windows, using the already-verified
       // npm-ci dependency tree. Linux continues to gate a real clean npm install.
       // This is intentionally NOT labelled a successful Windows npm install.
+      // An interrupted npm process may have left a partial consumer tree.
+      // Never combine that unverified tree with the deterministic archive test.
+      await rm(path.join(consumer, "node_modules"), { recursive: true, force: true, maxRetries: 8, retryDelay: 150 })
       const packageRoot = path.join(consumer, "node_modules", "@bybrawe", "opencode-loop")
       await mkdir(packageRoot, { recursive: true })
       run("tar", ["-xzf", packedTarball, "-C", packageRoot, "--strip-components=1"], temp)
@@ -56,7 +88,9 @@ try {
         path.join(scope, "plugin"),
         "junction",
       )
-      console.warn("Windows npm cache lacks package metadata; testing packed archive with preinstalled dependency tree (not a clean npm install)")
+      console.warn(windowsOfflineTimeout
+        ? "Windows offline npm install exceeded 30s; checking the production archive with pinned CI dependencies (NOT a clean npm install)"
+        : "Windows npm cache lacks package metadata; checking the production archive with pinned CI dependencies (NOT a clean npm install)")
     }
   }
   console.log(run(process.execPath, [path.join(root, "scripts/native-entry-test.mjs"), consumer], root).trim())

package/scripts/publish-workflow-test.mjs

@@ -20,6 +20,7 @@ assert.match(workflow, /needs:\s*\[native-regressions, real-native-pair\]/)
 assert.match(workflow, /node scripts\/native-release\.mjs ci/)
 assert.match(workflow, /git diff --exit-code -- src\/index.js src\/server.js src\/native.js/)
 assert.match(workflow, /npm run package:smoke/)
+assert.match(workflow, /OPENCODE_PACKAGE_SMOKE_REQUIRE_INSTALL:\s*\x271\x27/, "Windows/Linux npm release gate must require a strict clean consumer install, never a tarball fallback")
 assert.match(workflow, /windows-latest/)
 assert.match(workflow, /Decide whether npm publish is needed/)
 assert.match(workflow, /steps\.npm-state\.outputs\.publish == 'true'/)
@@ -48,14 +49,14 @@ assert.ok(workflow.includes('--prefer-online --cache "$VERIFY_DIR/npm-cache-$att
 assert.ok(workflow.includes("Published Loop+Goal clean-install validation did not converge"), "clean consumer must remain a hard release gate")
 
 const sha = "a".repeat(40)
-const request = { name: "@bybrawe/opencode-loop", version: "0.6.7", predecessor: "0.6.6", goal: { version: "1.3.48", sha: "b".repeat(40) } }
+const request = { name: "@bybrawe/opencode-loop", version: "0.6.9", predecessor: "0.6.8", goal: { version: "1.3.49", sha: "b".repeat(40) } }
 const pkg = { name: request.name, version: request.version }
 const env = { GITHUB_REPOSITORY: "ByBrawe/opencode-loop", GITHUB_REF: "refs/heads/main", GITHUB_SHA: sha }
 assert.strictEqual(validateRelease(request, pkg, env), request)
 for (const change of [{ GITHUB_REPOSITORY: "someone/fork" }, { GITHUB_REF: "refs/heads/release" }, { GITHUB_SHA: "main" }]) assert.throws(() => validateRelease(request, pkg, { ...env, ...change }))
 assert.throws(() => validateRelease({ ...request, version: "9.0.0" }, pkg, env))
 assert.throws(() => validateRelease(request, { ...pkg, version: "0.6.5" }, env))
-assert.equal(releaseDecision(404, null, request, sha, "0.6.6"), true)
+assert.equal(releaseDecision(404, null, request, sha, "0.6.8"), true)
 for (const status of [401, 403, 429, 500, 503]) assert.throws(() => releaseDecision(status, null, request, sha, "0.6.0"))
 assert.throws(() => releaseDecision(404, null, request, sha, "0.7.0"))
 const manifest = { ...pkg, gitHead: sha }

package/scripts/run-admission-test.mjs

@@ -1,6 +1,9 @@
 import assert from "node:assert/strict"
 import path from "node:path"
+import os from "node:os"
+import { mkdtemp, writeFile, rm } from "node:fs/promises"
 import { createRunAdmissionRuntime } from "../src/source/runtime/run-admission.js"
+import { inspectTaskChecklist } from "../src/source/runtime/checklist-completion.js"
 
 assert.throws(() => createRunAdmissionRuntime({}), /untilReached/)
 assert.throws(() => createRunAdmissionRuntime({ untilReached: async () => false }), /scheduleDueWork/)
@@ -130,4 +133,48 @@ assert.equal(admitted.paused, undefined)
 assert.equal(admitted.runNowRequestedAt, clock)
 assert.equal(logs.findLast((entry) => entry[1] === "preflight")?.[2].code, 0)
 
+const project = await mkdtemp(path.join(os.tmpdir(), "loop-admission-checklist-"))
+try {
+  await writeFile(path.join(project, "TASK.md"), "- [ ] code\n- [x] plan\n")
+  const checklistJob = { id: "checklist-job", enabled: true, progressFile: "TASK.md", untilChecklistComplete: true }
+  const checklistState = { jobs: [checklistJob] }
+  assert.equal((await runtime.admitJob(project, {}, "session-checklist", checklistState, checklistJob)).admitted, true)
+  assert.deepEqual(checklistJob.checklistStatus, { status: "pending", total: 2, pending: 1 })
+
+  await writeFile(path.join(project, "TASK.md"), "- [x] code\n- [x] plan\n")
+  assert.deepEqual(await runtime.admitJob(project, {}, "session-checklist", checklistState, checklistJob),
+    { admitted: false, reason: "checklist_complete" })
+  assert.equal(checklistState.jobs.length, 0)
+  assert.equal(notifications.at(-1)[2], "checklist_complete")
+
+  const verifyJob = { id: "verify-checklist", enabled: true, progressFile: "TASK.md",
+    untilChecklistComplete: true, verifyCommand: "npm test" }
+  const verifyState = { jobs: [verifyJob] }
+  assert.equal((await runtime.admitJob(project, {}, "session-verify", verifyState, verifyJob)).admitted, true,
+    "unchecked host verification cannot imply completion")
+  verifyJob.lastVerifyCode = 1
+  verifyJob.lastVerifyAt = clock
+  assert.equal((await runtime.admitJob(project, {}, "session-verify", verifyState, verifyJob)).admitted, true,
+    "failed host verification cannot imply completion")
+  verifyJob.lastVerifyCode = 0
+  assert.equal((await runtime.admitJob(project, {}, "session-verify", verifyState, verifyJob)).admitted, true,
+    "successful verify without recorded checklist fingerprint is not authoritative")
+  verifyJob.lastVerifyChecklistDigest = (await inspectTaskChecklist(project, "TASK.md")).digest
+  await writeFile(path.join(project, "TASK.md"), "- [x] code\n- [x] plan\n- [x] later task\n")
+  assert.equal((await runtime.admitJob(project, {}, "session-verify", verifyState, verifyJob)).admitted, true,
+    "verification for older checklist bytes cannot certify newly changed work")
+  verifyJob.lastVerifyChecklistDigest = (await inspectTaskChecklist(project, "TASK.md")).digest
+  assert.equal((await runtime.admitJob(project, {}, "session-verify", verifyState, verifyJob)).reason, "checklist_complete")
+
+  const missingJob = { id: "missing-checklist", enabled: true, progressFile: "MISSING.md", untilChecklistComplete: true }
+  const missingState = { jobs: [missingJob] }
+  const missing = await runtime.admitJob(project, {}, "session-missing", missingState, missingJob)
+  assert.deepEqual(missing, { admitted: false, reason: "checklist_unavailable" })
+  assert.equal(missingJob.paused, true)
+  assert.equal(missingJob.lastChecklistError, "file-missing")
+  assert.equal(missingState.jobs.length, 1, "preserve job for explicit recovery")
+} finally {
+  await rm(project, { force: true, recursive: true })
+}
+
 console.log("run admission runtime tests passed")

package/scripts/state-exfat-lock-test.mjs

@@ -0,0 +1,99 @@
+import assert from "node:assert/strict"
+import { spawn, spawnSync } from "node:child_process"
+import { randomUUID } from "node:crypto"
+import { promises as fs } from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import { readState, writeState, stateDir } from "../src/source/core/state.js"
+
+const source = fileURLToPath(import.meta.url)
+const originalLink = fs.link
+const linkError = (code) => Object.assign(new Error(`synthetic unsupported hard link: ${code}`), { code })
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+async function exists(file) { try { await fs.access(file); return true } catch (error) { if (error?.code === "ENOENT") return false; throw error } }
+async function until(fn) { for (let i = 0; i < 500; i++) { if (await fn()) return; await wait(20) } throw new Error("worker barrier timeout") }
+
+if (process.argv[2] === "--worker") {
+  fs.link = async () => { throw linkError("EISDIR") }
+  try {
+    const [, , , root, sessionID, label, gate] = process.argv
+    const snapshot = await readState(root, sessionID)
+    await fs.writeFile(`${gate}.${label}.ready`, "ready")
+    await until(() => exists(gate))
+    snapshot.jobs[0][label] = label
+    await writeState(root, sessionID, snapshot)
+  } finally { fs.link = originalLink }
+} else {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "loop-exfat-lock-"))
+  const sessionID = "exfat-session"
+  const canonical = path.join(stateDir(root), `${sessionID}.json.lock`)
+  fs.link = async () => { throw linkError("EISDIR") }
+  try {
+    const original = await readState(root, sessionID)
+    original.jobs = [{ id: "one", round: 1 }]
+    await writeState(root, sessionID, original)
+
+    // Workers each simulate an exFAT runtime: independent Node processes with
+    // no usable hard-link support must still merge their distinct writes.
+    const gate = path.join(root, "go")
+    const workers = []
+    for (let i = 0; i < 4; i++) {
+      const label = `worker${i}`
+      const child = spawn(process.execPath, [source, "--worker", root, sessionID, label, gate], { stdio: ["ignore", "ignore", "pipe"] })
+      let stderr = ""
+      child.stderr.on("data", (chunk) => { stderr += chunk.toString() })
+      workers.push({
+        label,
+        done: new Promise((resolve, reject) => {
+          child.once("error", reject)
+          child.once("close", (code) => code === 0 ? resolve() : reject(new Error(`exFAT worker ${label} failed: ${stderr}`)))
+        }),
+      })
+    }
+    await until(async () => (await Promise.all(workers.map(w => exists(`${gate}.${w.label}.ready`)))).every(Boolean))
+    await fs.writeFile(gate, "go")
+    await Promise.all(workers.map(w => w.done))
+    const saved = (await readState(root, sessionID)).jobs[0]
+    for (const w of workers) assert.equal(saved[w.label], w.label)
+    assert.equal(await exists(canonical), false)
+
+    // Simulate an abandoned primary lock and an orphaned cleanup election,
+    // both written without hard links. Neither may prevent dead-PID recovery.
+    const dead = spawnSync(process.execPath, ["-e", "process.exit(0)"])
+    assert.equal(dead.status, 0)
+    const deadOwner = () => {
+      const token = randomUUID()
+      return { schemaVersion: 1, pid: dead.pid, token, acquiredAt: Date.now(),
+        candidateName: `.loop-lock-${dead.pid}-${token}.json` }
+    }
+    for (const suffix of ["", ".cleanup"]) {
+      const owner = deadOwner()
+      await fs.writeFile(path.join(stateDir(root), owner.candidateName), JSON.stringify(owner))
+      await fs.writeFile(`${canonical}${suffix}`, JSON.stringify(owner))
+    }
+    const revived = await readState(root, sessionID)
+    revived.jobs[0].recovered = true
+    await writeState(root, sessionID, revived)
+    assert.equal((await readState(root, sessionID)).jobs[0].recovered, true)
+    assert.equal(await exists(canonical), false)
+    assert.equal(await exists(`${canonical}.cleanup`), false)
+
+    await fs.writeFile(canonical, "invalid owner")
+    const corrupt = await readState(root, sessionID)
+    corrupt.jobs[0].forbidden = "never commit"
+    await assert.rejects(writeState(root, sessionID, corrupt), /state lock invalid_owner/)
+    assert.equal((await readState(root, sessionID)).jobs[0].forbidden, undefined)
+    await fs.rm(canonical)
+
+    // Unexpected failures must not be turned into 'contention' or ignored.
+    fs.link = async () => { throw linkError("ENOSPC") }
+    await assert.rejects(writeState(root, sessionID, await readState(root, sessionID)), { code: "ENOSPC" })
+    assert.equal(await exists(canonical), false)
+
+    console.log("Loop exFAT-style exclusive lock, process merge, dead-owner election and corrupt-state protections passed")
+  } finally {
+    fs.link = originalLink
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 })
+  }
+}