@gajae-code/coding-agent 0.18.11 → 0.18.12

package/src/gjc-runtime/launch-worktree.test.ts

@@ -9,6 +9,7 @@ import {
 	ensureLaunchWorktree,
 	evacuatePreWorktreeTarget,
 	isReplaceableWorktreeTarget,
+	removeOwnedLaunchWorktree,
 	restorePreWorktreeGjc,
 } from "./launch-worktree";
 
@@ -246,3 +247,150 @@ describe("acquireTargetLock", () => {
 		expect(fs.existsSync(path.join(worktreePath, ".git"))).toBe(true);
 	});
 });
+
+function ownedReceipt(): { created: true; reused: false; createdBranch: false } {
+	return { created: true, reused: false, createdBranch: false };
+}
+
+function detachedPlan(repoRoot: string, worktreePath: string): GjcLaunchWorktreePlan {
+	return {
+		enabled: true,
+		repoRoot,
+		worktreePath,
+		detached: true,
+		baseRef: "HEAD",
+		branchName: null,
+	};
+}
+
+/** Replace a real worktree directory with a symlink to a directory that copies its `.git` file. */
+function swapWorktreeForForgedGitdir(worktreePath: string, forgeDir: string): void {
+	const gitFile = fs.readFileSync(path.join(worktreePath, ".git"), "utf8");
+	fs.mkdirSync(forgeDir, { recursive: true });
+	fs.writeFileSync(path.join(forgeDir, ".git"), gitFile.endsWith("\n") ? gitFile : `${gitFile}\n`);
+	fs.writeFileSync(path.join(forgeDir, "needle.txt"), "KEEP-NEEDLE\n");
+	fs.rmSync(worktreePath, { recursive: true, force: true });
+	fs.symlinkSync(forgeDir, worktreePath, "dir");
+}
+
+describe("removeOwnedLaunchWorktree", () => {
+	test("still removes a real directory worktree", () => {
+		const repo = initRepo("gjc-rm-real-repo-");
+		const bucket = makeTempDir("gjc-rm-real-bucket-");
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		fs.writeFileSync(path.join(worktreePath, "needle.txt"), "inside\n");
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.existsSync(worktreePath)).toBe(false);
+		expect(countRegisteredWorktrees(repo)).toBe(1);
+	});
+
+	test("still removes a worktree reached through an in-repo directory symlink", () => {
+		const repo = initRepo("gjc-rm-inside-link-repo-");
+		const inside = path.join(repo, "inside");
+		fs.mkdirSync(inside);
+		fs.symlinkSync(inside, path.join(repo, ".worktrees"), "dir");
+		const worktreePath = path.join(repo, ".worktrees", "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.existsSync(path.join(inside, "wt"))).toBe(false);
+		expect(fs.lstatSync(path.join(repo, ".worktrees")).isSymbolicLink()).toBe(true);
+		expect(countRegisteredWorktrees(repo)).toBe(1);
+	});
+
+	test("does not delete the referent when the worktree path is a symlink to a forged gitdir", () => {
+		const repo = initRepo("gjc-rm-forge-repo-");
+		const bucket = makeTempDir("gjc-rm-forge-bucket-");
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		const forge = makeTempDir("gjc-rm-forge-target-");
+		swapWorktreeForForgedGitdir(worktreePath, forge);
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.readFileSync(path.join(forge, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.lstatSync(path.join(forge, ".git")).isFile()).toBe(true);
+		expect(fs.existsSync(worktreePath)).toBe(false);
+	});
+
+	test("still leaves an outside symlink when an in-repo bucket is retargeted", () => {
+		const repo = initRepo("gjc-rm-outlink-repo-");
+		const bucket = path.join(repo, ".worktrees");
+		fs.mkdirSync(bucket);
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		fs.rmSync(bucket, { recursive: true, force: true });
+		const outside = makeTempDir("gjc-rm-outlink-outside-");
+		const vault = makeTempDir("gjc-rm-outlink-vault-");
+		fs.writeFileSync(path.join(vault, "needle.txt"), "KEEP-NEEDLE\n");
+		const outsideLink = path.join(outside, "wt");
+		fs.symlinkSync(vault, outsideLink, "dir");
+		fs.symlinkSync(outside, bucket, "dir");
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.lstatSync(outsideLink).isSymbolicLink()).toBe(true);
+		expect(fs.readlinkSync(outsideLink)).toBe(vault);
+		expect(fs.readFileSync(path.join(vault, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.lstatSync(bucket).isSymbolicLink()).toBe(true);
+	});
+
+	test("does not delete a directory outside the repo when an in-repo bucket symlink is retargeted", () => {
+		const repo = initRepo("gjc-rm-retarget-repo-");
+		const bucket = path.join(repo, ".worktrees");
+		fs.mkdirSync(bucket);
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		const gitFile = fs.readFileSync(path.join(worktreePath, ".git"), "utf8");
+		fs.rmSync(bucket, { recursive: true, force: true });
+		const outside = makeTempDir("gjc-rm-retarget-outside-");
+		const outsideWt = path.join(outside, "wt");
+		fs.mkdirSync(outsideWt);
+		fs.writeFileSync(path.join(outsideWt, ".git"), gitFile.endsWith("\n") ? gitFile : `${gitFile}\n`);
+		fs.writeFileSync(path.join(outsideWt, "needle.txt"), "KEEP-NEEDLE\n");
+		fs.symlinkSync(outside, bucket, "dir");
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.readFileSync(path.join(outsideWt, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.lstatSync(bucket).isSymbolicLink()).toBe(true);
+	});
+});
+
+describe("commitPreWorktreeRestore symlink rollback", () => {
+	test("rolls back a symlinked worktree without deleting the forged referent", () => {
+		const repo = initRepo("gjc-rb-forge-repo-");
+		const bucket = makeTempDir("gjc-rb-forge-bucket-");
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		const forge = makeTempDir("gjc-rb-forge-target-");
+		swapWorktreeForForgedGitdir(worktreePath, forge);
+		const stashPath = path.join(bucket, ".gjc-pre-wt-wt");
+		fs.mkdirSync(stashPath, { recursive: true });
+		fs.writeFileSync(path.join(stashPath, "launcher.txt"), "config");
+
+		let message = "";
+		try {
+			commitPreWorktreeRestore(
+				{
+					restore: () => {
+						throw new Error("overlay exploded");
+					},
+					stashPath,
+				},
+				detachedPlan(repo, worktreePath),
+			);
+			throw new Error("expected commitPreWorktreeRestore to throw");
+		} catch (error) {
+			message = error instanceof Error ? error.message : String(error);
+		}
+
+		expect(message).toMatch(/worktree_gjc_restore_failed/);
+		expect(fs.readFileSync(path.join(forge, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.existsSync(path.join(stashPath, "launcher.txt"))).toBe(true);
+	});
+});

package/src/gjc-runtime/launch-worktree.ts

@@ -244,9 +244,34 @@ function resolveWorktreeBucket(repoRoot: string): string {
 	return resolveWorktreeBucketForPath(repoRoot, trustedWorktreeBucketEnv(process.env), os.homedir(), path);
 }
 
+function throwIfBucketRealpathEscapesRepository(repoRoot: string, bucketPath: string): void {
+	let realBucket: string;
+	try {
+		realBucket = fs.realpathSync(bucketPath);
+	} catch (error) {
+		// A missing bucket is created later. A dangling link is classified by inspectBucketDir.
+		if (fileSystemErrorCode(error) === "ENOENT") return;
+		throw error;
+	}
+	const relativeReal = path.relative(fs.realpathSync(repoRoot), realBucket);
+	if (relativeReal.startsWith(`..${path.sep}`) || relativeReal === ".." || path.isAbsolute(relativeReal)) {
+		throw new Error(
+			[
+				"worktree_bucket_escapes_repository",
+				"The GJC launch worktree bucket resolves outside the repository.",
+				`Path: ${formatBucketPath(bucketPath)}`,
+				"Safe remediation: replace the path with a real directory inside the repository, or set GJC_WORKTREE_DIR to a directory outside the repository. GJC did not create a worktree.",
+			].join("\n"),
+		);
+	}
+}
+
 function ensureRepositoryBucketIgnored(repoRoot: string, bucketPath: string): void {
 	const relativeBucket = path.relative(repoRoot, bucketPath);
+	// Lexical paths outside the repo are the operator override and stay allowed.
 	if (relativeBucket.startsWith(`..${path.sep}`) || relativeBucket === ".." || path.isAbsolute(relativeBucket)) return;
+	// git check-ignore accepts a gitignored symlink without looking at its target.
+	throwIfBucketRealpathEscapesRepository(repoRoot, bucketPath);
 	const ignoreProbe = path.join(relativeBucket, ".gjc-worktree-probe");
 	for (const candidate of [relativeBucket, ignoreProbe]) {
 		const result = Bun.spawnSync(["git", "check-ignore", "--quiet", "--", candidate], {
@@ -702,17 +727,87 @@ function tryRestore(restore: () => void): void {
 	}
 }
 
-/** Best-effort removal of a worktree GJC just created, used when a later step must roll it back. */
-function rollbackCreatedWorktree(plan: GjcLaunchWorktreePlan): void {
+function lexicalPathInsideRepository(repoRoot: string, targetPath: string): boolean {
+	const relative = path.relative(path.resolve(repoRoot), path.resolve(targetPath));
+	return !(relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative));
+}
+
+function realpathEscapesRepository(repoRoot: string, targetPath: string): boolean {
+	let realTarget: string;
+	try {
+		realTarget = fs.realpathSync(targetPath);
+	} catch (error) {
+		// A missing path is not an escape. Anything else is not safe to hand to remove --force.
+		if (fileSystemErrorCode(error) === "ENOENT") return false;
+		return true;
+	}
+	const relativeReal = path.relative(fs.realpathSync(repoRoot), realTarget);
+	return relativeReal.startsWith(`..${path.sep}`) || relativeReal === ".." || path.isAbsolute(relativeReal);
+}
+
+function pruneWorktreeRegistration(repoRoot: string): void {
 	try {
-		runGit(plan.repoRoot, ["worktree", "remove", "--force", plan.worktreePath]);
+		runGit(repoRoot, ["worktree", "prune"]);
 	} catch {
+		// Best-effort. Callers report their own failure.
+	}
+}
+
+/**
+ * Remove a launch worktree this process just created.
+ *
+ * `git worktree remove --force` follows a symlink and deletes the referent when a
+ * copied `.git` gitdir file passes validation. Unlink that link only when its
+ * parent stays inside the repository, or when the path is an explicit external
+ * worktree. An in-repo path whose parent resolves outside the repository is
+ * left untouched. A real directory is still removed with `--force`.
+ */
+function removeCreatedWorktree(repoRoot: string, worktreePath: string): void {
+	let stat: fs.Stats | undefined;
+	try {
+		stat = fs.lstatSync(worktreePath);
+	} catch (error) {
+		if (fileSystemErrorCode(error) !== "ENOENT") {
+			pruneWorktreeRegistration(repoRoot);
+			return;
+		}
+	}
+	// A retargeted in-repo bucket can place this path's parent outside the repository.
+	// Do not unlink that outside entry. An explicit external worktree is not this case.
+	if (
+		lexicalPathInsideRepository(repoRoot, worktreePath) &&
+		realpathEscapesRepository(repoRoot, path.dirname(worktreePath))
+	) {
+		pruneWorktreeRegistration(repoRoot);
+		return;
+	}
+	if (stat?.isSymbolicLink()) {
 		try {
-			runGit(plan.repoRoot, ["worktree", "prune"]);
+			fs.unlinkSync(worktreePath);
 		} catch {
-			// Best-effort rollback; the restore failure below is the actionable error.
+			// The link may already be gone.
 		}
+		pruneWorktreeRegistration(repoRoot);
+		return;
+	}
+	if (
+		stat?.isDirectory() &&
+		lexicalPathInsideRepository(repoRoot, worktreePath) &&
+		realpathEscapesRepository(repoRoot, worktreePath)
+	) {
+		pruneWorktreeRegistration(repoRoot);
+		return;
 	}
+	try {
+		runGit(repoRoot, ["worktree", "remove", "--force", worktreePath]);
+	} catch {
+		pruneWorktreeRegistration(repoRoot);
+	}
+}
+
+/** Best-effort removal of a worktree GJC just created, used when a later step must roll it back. */
+function rollbackCreatedWorktree(plan: GjcLaunchWorktreePlan): void {
+	removeCreatedWorktree(plan.repoRoot, plan.worktreePath);
 }
 
 /**
@@ -1205,15 +1300,7 @@ export function removeOwnedLaunchWorktree(
 	receipt: { created: boolean; reused: boolean; createdBranch: boolean },
 ): void {
 	if (!receipt.created || receipt.reused) return;
-	try {
-		runGit(plan.repoRoot, ["worktree", "remove", "--force", plan.worktreePath]);
-	} catch {
-		try {
-			runGit(plan.repoRoot, ["worktree", "prune"]);
-		} catch {
-			// Proof stays on the ledger; leftover classify is best-effort after abort.
-		}
-	}
+	removeCreatedWorktree(plan.repoRoot, plan.worktreePath);
 	if (receipt.createdBranch && plan.branchName) {
 		try {
 			runGit(plan.repoRoot, ["branch", "-D", plan.branchName]);

package/src/gjc-runtime/managed-owner-admission.ts

@@ -2,8 +2,10 @@ import { Buffer } from "node:buffer";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { canonicalEnvKey, type ProjectEnvSnapshot, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import type { ManagedOwnerBinding, ManagedOwnerSigabrtReceipt } from "./managed-owner-supervisor";
 import { assertSafePathComponent } from "./session-layout";
+import { trustedCoordinatorEnv } from "./sidecar-bootstrap-env";
 import { lifecyclePaths } from "./tmux-owner-isolation";
 import {
 	persistUltragoalRecoveryDecision,
@@ -23,6 +25,48 @@ export const MANAGED_OWNER_PREDECESSOR_GENERATION_ENV = "GJC_MANAGED_OWNER_PREDE
 export const MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_RUN_ID";
 export const MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_INCARNATION";
 export const MANAGED_OWNER_TRANSCRIPT_PATH_ENV = "GJC_MANAGED_OWNER_TRANSCRIPT_PATH";
+const MANAGED_OWNER_SESSION_FILE_ENV = "GJC_SESSION_FILE";
+
+/**
+ * Operator environment only. A project dotenv value, including a dynamic
+ * declaration, must not choose the recovery transcript. A static
+ * `GJC_SESSION_FILE` declaration is the same source: the launcher copies it
+ * into the transcript variable. The operator bytes are kept, including
+ * surrounding whitespace; provenance is not path normalization.
+ */
+function operatorOwnedEnvValue(name: string, raw: string | undefined, snapshot: ProjectEnvSnapshot): string {
+	if (!raw) return "";
+	const key = canonicalEnvKey(name);
+	const declared = snapshot.values[key];
+	if (declared !== undefined && (snapshot.dynamic.has(key) || declared === raw)) return "";
+	const verdict = trustedCoordinatorEnv(name, { [name]: raw }, snapshot);
+	if (verdict === undefined && raw.trim().length > 0) return "";
+	return raw;
+}
+
+export function trustedManagedOwnerTranscriptPath(env: NodeJS.ProcessEnv = process.env, cwd = process.cwd()): string {
+	const snapshot = projectEnvSnapshot(cwd);
+	const raw = operatorOwnedEnvValue(
+		MANAGED_OWNER_TRANSCRIPT_PATH_ENV,
+		env[MANAGED_OWNER_TRANSCRIPT_PATH_ENV],
+		snapshot,
+	);
+	if (!raw) return "";
+	const sessionKey = canonicalEnvKey(MANAGED_OWNER_SESSION_FILE_ENV);
+	if (snapshot.dynamic.has(sessionKey)) return raw;
+	const declared = snapshot.values[sessionKey];
+	if (declared !== undefined && raw === declared) return "";
+	return raw;
+}
+
+/** Session file forwarded to a replacement child. Same provenance rule. */
+export function trustedManagedOwnerLaunchSessionFile(env: NodeJS.ProcessEnv, cwd: string): string {
+	return operatorOwnedEnvValue(
+		MANAGED_OWNER_SESSION_FILE_ENV,
+		env[MANAGED_OWNER_SESSION_FILE_ENV],
+		projectEnvSnapshot(cwd),
+	);
+}
 
 export interface ManagedOwnerRecoveryContext {
 	root: string;
@@ -295,7 +339,7 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 		},
 		receipt,
 		admission,
-		transcriptPath: process.env[MANAGED_OWNER_TRANSCRIPT_PATH_ENV] ?? "",
+		transcriptPath: trustedManagedOwnerTranscriptPath(),
 	});
 	await persistUltragoalRecoveryDecision({
 		cwd: process.cwd(),
@@ -330,7 +374,7 @@ export async function completeManagedOwnerRecovery(
 		binding: recoveryBinding,
 		receipt: context.receipt,
 		admission: context.admission,
-		transcriptPath: process.env[MANAGED_OWNER_TRANSCRIPT_PATH_ENV] ?? "",
+		transcriptPath: trustedManagedOwnerTranscriptPath(),
 		protectedPaths: context.decision.snapshot?.protectedPaths,
 		sanctionedDeltas: context.decision.snapshot?.sanctionedDeltas,
 		absentArtifacts: context.decision.snapshot?.absentArtifacts,

package/src/gjc-runtime/session-resolution.ts

@@ -29,6 +29,14 @@ import {
 /** Window within which two activity timestamps are treated as an ambiguous tie. */
 export const LATEST_SESSION_TIE_WINDOW_MS = 1000;
 
+/**
+ * Local writers stamp `Date.now()`. A parsed `updated_at` further ahead than this
+ * is planted marker content, not activity, and is not a candidate. Marker mtime
+ * is not used in that case: a checkout or touch refreshes mtime without rewriting
+ * a future timestamp.
+ */
+const ACTIVITY_FUTURE_SKEW_MS = 2 * 60 * 1000;
+
 export interface SessionIdSources {
 	/** Raw `--session-id` value: `undefined` = flag absent; `""` = present-but-blank (invalid). */
 	flagValue?: string | undefined;
@@ -46,8 +54,12 @@ export class SessionResolutionError extends Error {
 	}
 }
 
+function isUnsafeResolvedSessionId(sessionId: string): boolean {
+	return sessionId === "." || sessionId === ".." || /[/\\]/.test(sessionId);
+}
+
 function assertSafeResolvedSessionId(sessionId: string): void {
-	if (sessionId === "." || sessionId === ".." || /[/\\]/.test(sessionId)) {
+	if (isUnsafeResolvedSessionId(sessionId)) {
 		throw new SessionResolutionError(
 			"session id must be a single path component (no separators or traversal)",
 			"unsafe_session",
@@ -135,8 +147,17 @@ interface SessionCandidate {
  * or an ambiguous tie.
  */
 export async function detectLatestSession(cwd: string): Promise<GjcSessionContext> {
-	const candidates = await collectActiveSessionCandidates(cwd);
+	const found = await collectActiveSessionCandidates(cwd);
+	const candidates = found.candidates;
 	if (candidates.length === 0) {
+		// No safe session was selectable. Keep the unsafe-id error when a crafted
+		// directory was the reason nothing could be chosen, matching explicit ids.
+		if (found.sawUnsafe) {
+			throw new SessionResolutionError(
+				"session id must be a single path component (no separators or traversal)",
+				"unsafe_session",
+			);
+		}
 		throw new SessionResolutionError(
 			"no active GJC session found: pass --session-id or set GJC_SESSION_ID",
 			"no_session",
@@ -156,19 +177,27 @@ export async function detectLatestSession(cwd: string): Promise<GjcSessionContex
 	return { gjcSessionId: first.gjcSessionId, sessionRoot: first.sessionRoot, source: "latest" };
 }
 
-async function collectActiveSessionCandidates(cwd: string): Promise<SessionCandidate[]> {
+async function collectActiveSessionCandidates(
+	cwd: string,
+): Promise<{ candidates: SessionCandidate[]; sawUnsafe: boolean }> {
 	const root = gjcRoot(cwd);
 	let entries: import("node:fs").Dirent[];
 	try {
 		entries = await fs.readdir(root, { withFileTypes: true });
 	} catch {
-		return [];
+		return { candidates: [], sawUnsafe: false };
 	}
 	const candidates: SessionCandidate[] = [];
+	let sawUnsafe = false;
 	for (const entry of entries) {
 		if (!entry.isDirectory()) continue;
 		const gjcSessionId = sessionIdFromDirName(entry.name);
 		if (!gjcSessionId) continue;
+		// Skip; throwing here would stop discovery for every other session.
+		if (isUnsafeResolvedSessionId(gjcSessionId)) {
+			sawUnsafe = true;
+			continue;
+		}
 		assertSafeResolvedSessionId(gjcSessionId);
 		const dir = path.join(root, entry.name);
 		const activityMs = await readActivityMs(path.join(dir, GJC_SESSION_ACTIVITY_FILE));
@@ -177,7 +206,7 @@ async function collectActiveSessionCandidates(cwd: string): Promise<SessionCandi
 		if (activityMs === undefined) continue;
 		candidates.push({ gjcSessionId, sessionRoot: dir, activityMs });
 	}
-	return candidates;
+	return { candidates, sawUnsafe };
 }
 
 async function readActivityMs(markerPath: string): Promise<number | undefined> {
@@ -191,7 +220,10 @@ async function readActivityMs(markerPath: string): Promise<number | undefined> {
 		const parsed = JSON.parse(raw) as { updated_at?: unknown };
 		if (typeof parsed.updated_at === "string") {
 			const ms = Date.parse(parsed.updated_at);
-			if (!Number.isNaN(ms)) return ms;
+			if (!Number.isNaN(ms)) {
+				if (ms > Date.now() + ACTIVITY_FUTURE_SKEW_MS) return undefined;
+				return ms;
+			}
 		}
 	} catch {
 		// fall through to mtime

package/src/gjc-runtime/session-state-lock.ts

@@ -300,9 +300,12 @@ async function repairPendingOwnerRecord(pending: PendingOwnerRepair): Promise<bo
 	const handle = pending.repairHandle;
 	if (!handle || pending.repairBytes === undefined) return true;
 	try {
-		await writeOwnerBytes(handle, Buffer.from(pending.repairBytes, "utf8"));
+		const written = await writeOwnerBytes(handle, Buffer.from(pending.repairBytes, "utf8"), undefined);
 		const stat = await handle.stat({ bigint: true });
-		pending.repairSnapshot = ownerSnapshotFrom(stat, Buffer.from(pending.repairBytes, "utf8"));
+		// The rewritten record may have been padded back to its previous length, so the
+		// identity that authorizes later cleanup is the bytes that landed, not the bytes
+		// requested.
+		pending.repairSnapshot = ownerSnapshotFrom(stat, written);
 		await handle.close();
 		pending.repairHandle = undefined;
 		return true;
@@ -533,6 +536,8 @@ export const SessionStateLockTestHooks: {
 	afterCurrentOwnerValidation?: (file: string) => void | Promise<void>;
 	/** @internal Fault seam immediately before a held owner record rewrite mutates bytes. */
 	beforeOwnerRecordRewrite?: (file: string) => void | Promise<void>;
+	/** @internal Fault seam immediately before the pre-rewrite fstat on the owner record handle. */
+	beforeOwnerRecordPrewriteStat?: (file: string) => void | Promise<void>;
 	/** @internal Fault seam immediately before final transition-generation validation. */
 	beforeTransitionReleaseLstat?: (transitionDir: string) => void | Promise<void>;
 	/** @internal Fault seam immediately before setup generation capture. */
@@ -1491,13 +1496,21 @@ async function createOwnerLock(
 	// pair names the record this call brought into existence and nothing else.
 	let created: OpenOwnerIdentity | null = null;
 	try {
-		await handle.chmod(0o600);
 		created = await openOwnerIdentity(handle);
 		await SessionStateLockTestHooks.ownerRecordWriteFault?.(file);
+		// The record's bytes land before anything else is asked of this descriptor. A
+		// freshly created record is empty until they do, and an empty record carries no
+		// `owner_host_id`, so every syscall placed in front of this write is a window in
+		// which a kill leaves debris no later contender may reclaim. `chmod` is the one
+		// that can actually stall — it is a metadata round-trip that a File Provider,
+		// NFS, or CIFS mount may hold for seconds — so it moves behind the write. The
+		// unrestricted mode it corrected for is already excluded by the create's own
+		// mode argument, so the descriptor is never more permissive than 0o600 here.
 		await handle.writeFile(bytes);
 		const stat = await handle.stat({ bigint: true });
 		if (!stat.isFile() || stat.size !== BigInt(bytes.byteLength))
 			throw new SessionStateLockUnavailableError(new Error("Owner record did not land as a regular file."));
+		await handle.chmod(0o600);
 		return ownerSnapshotFrom(stat, bytes);
 	} catch (error) {
 		// Deliberately BEFORE any close: releasing the descriptor first would free the
@@ -1520,16 +1533,48 @@ const POSIX_OWNER_REWRITE_FLAGS = POSIX_NOFOLLOW_AVAILABLE
 	? fsSync.constants.O_RDWR | fsSync.constants.O_NONBLOCK | fsSync.constants.O_NOFOLLOW
 	: undefined;
 
-async function writeOwnerBytes(handle: fs.FileHandle, bytes: Buffer): Promise<void> {
-	await handle.truncate(0);
+/**
+ * The one writer of an owner record's bytes: overwrite in place, never shorter.
+ *
+ * `truncate(0)` followed by a write looks atomic and is not. The bytes a truncate
+ * publishes are EMPTY, and an empty record carries no `owner_host_id` at all, so a
+ * process that dies inside that window (a repeated Ctrl-C reaches `postmortem.quit`,
+ * which deliberately performs no lock release) leaves a record with no attributable
+ * owner. `malformedOwnerProvenance` classifies it `unprovenanced`, the reclaim refuses
+ * it, and every later contender fails closed forever: `transition_claim_timeout` with
+ * `claim_or_owner_unreadable`, and coordinator state persistence for that session is
+ * lost for good — the failure class #5159 and #5216 both land on.
+ *
+ * So the replacement is written over the HEAD of the record and the previous byte
+ * length is kept instead of discarded. A JSON document ignores trailing whitespace, so
+ * a padded record is the same record to every reader — `JSON.parse`, `validLockOwner`,
+ * `malformedOwnerProvenance`, and the identity-bound unlink all see exactly the
+ * replacement — while the bytes on disk always carry the full ownership preamble. That
+ * leaves a torn single write (which needs the kernel to short-write a ~200 byte payload)
+ * as the only state the record cannot be attributed from, instead of the guaranteed
+ * empty window between two syscalls.
+ *
+ * @returns the exact bytes now on disk. A padded record's size and SHA-256 are the
+ * padded bytes', so this — not the requested payload — is what identifies the record
+ * for every later capture, comparison, and replay.
+ */
+async function writeOwnerBytes(handle: fs.FileHandle, bytes: Buffer, file?: string): Promise<Buffer> {
+	if (file) await SessionStateLockTestHooks.beforeOwnerRecordPrewriteStat?.(file);
+	const previous = await handle.stat({ bigint: true });
+	const previousSize = previous.isFile() === true ? Number(previous.size) : 0;
+	const padding = Math.max(0, previousSize - bytes.byteLength);
+	const payload = padding === 0 ? bytes : Buffer.concat([bytes, Buffer.alloc(padding, 0x20)]);
 	let offset = 0;
-	while (offset < bytes.byteLength) {
-		const { bytesWritten } = await handle.write(bytes, offset, bytes.byteLength - offset, offset);
+	while (offset < payload.byteLength) {
+		const { bytesWritten } = await handle.write(payload, offset, payload.byteLength - offset, offset);
 		if (bytesWritten <= 0) throw new Error("Owner record rewrite made no progress.");
 		offset += bytesWritten;
 	}
-	await handle.truncate(bytes.byteLength);
+	// `payload` is never shorter than the record already was, so this can only remove a
+	// tail that outgrew the bytes just written; it can never cut the record itself.
+	await handle.truncate(payload.byteLength);
 	await handle.sync();
+	return payload;
 }
 
 async function rewriteHeldOwnerRecord(
@@ -1581,15 +1626,15 @@ async function rewriteHeldOwnerRecord(
 		mutationStarted = true;
 		await SessionStateLockTestHooks.beforeOwnerRecordRewrite?.(file);
 		rewriteHookPassed = true;
-		await writeOwnerBytes(handle, replacementBytes);
+		const writtenBytes = await writeOwnerBytes(handle, replacementBytes, file);
 		const canonical = await captureRegularLockOwner(file);
-		// On Windows, an in-place truncate/write can expose refreshed descriptor
+		// On Windows, an in-place rewrite can expose refreshed descriptor
 		// metadata even though the file object is unchanged. The descriptor opened
 		// before mutation is the stable identity bracket; the path capture still
 		// proves that the pathname resolves to that same object after the rewrite.
 		if (!canonical || canonical.dev !== opened.dev || canonical.ino !== opened.ino)
 			throw new SessionStateLockUnavailableError(new Error("Owner pathname changed after rewrite."));
-		if (canonical.bytes !== replacementBytes.toString("utf8")) {
+		if (canonical.bytes !== writtenBytes.toString("utf8")) {
 			let successor: unknown;
 			try {
 				successor = JSON.parse(canonical.bytes);
@@ -1602,7 +1647,7 @@ async function rewriteHeldOwnerRecord(
 		return canonical;
 	} catch (error) {
 		// Keep the descriptor as the repair authority until the held bytes have
-		// been restored. A truncate/write/fsync fault may leave a malformed or
+		// been restored. A write/fsync fault may leave a malformed or
 		// partially committed record; closing first would force recovery to trust
 		// an unproven pathname and can wedge a successor behind the transition.
 		let repairNeeded = mutationStarted;
@@ -1616,9 +1661,9 @@ async function rewriteHeldOwnerRecord(
 		if (repairNeeded) {
 			let repaired: LockOwnerSnapshot;
 			try {
-				await writeOwnerBytes(handle, Buffer.from(held.bytes, "utf8"));
+				const restored = await writeOwnerBytes(handle, Buffer.from(held.bytes, "utf8"), file);
 				const repairedStat = await handle.stat({ bigint: true });
-				repaired = ownerSnapshotFrom(repairedStat, Buffer.from(held.bytes, "utf8"));
+				repaired = ownerSnapshotFrom(repairedStat, restored);
 			} catch (repairError) {
 				const aggregate = new AggregateError(
 					[error, repairError],