@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/gjc-runtime/ralplan-current-final.ts

@@ -0,0 +1,294 @@
+/**
+ * Validate the exact current ralplan final that an execution approval may target.
+ *
+ * The Ultragoal ask guard blocks every `ask` while a goal is incomplete or
+ * review-blocked, which is correct for ordinary questions but also deadlocks the
+ * one question that can legitimately unblock the work: the execution approval for
+ * an already-reviewed ralplan final (issue #6578). Granting that route needs proof
+ * that the final being approved is the current one and that its reviewers really
+ * passed it — never a caller-declared tag.
+ *
+ * The proof is reconstructed from what ralplan already persists:
+ *
+ *   - `<session plans>/ralplan/<run-id>/index.jsonl` rows `{stage, stage_n, path, sha256}`
+ *   - the artifact files those rows name, re-hashed here
+ *   - the run state (`<session state>/ralplan-state.json`) for run id and phase
+ *   - the resolved `autoHandoff` target, which must be `off`
+ *
+ * Anything missing, stale, rewritten, out of order, or outside this session's run
+ * directory is a typed refusal. This module only reads and hashes; it never
+ * mutates state and never grants anything by itself.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { isEnoent } from "@gajae-code/utils";
+import { resolveRalplanAutoHandoff } from "./ralplan-runtime";
+import { modeStatePath, sessionPlansDir } from "./session-layout";
+
+/** Stages that open a consensus iteration; a final is only valid after one. */
+const ITERATION_OPENER_STAGES: ReadonlySet<string> = new Set(["planner", "revision"]);
+
+/** Reviewer stages whose verdicts must join the same iteration as the final. */
+const REVIEW_LANE_STAGES: readonly string[] = ["architect", "critic"];
+
+export interface RalplanIndexRow {
+	stage: string;
+	stageN: number;
+	path: string;
+	sha256: string;
+}
+
+export interface RalplanCurrentFinalDescriptor {
+	/** Run id the final belongs to. */
+	runId: string;
+	/** Absolute path of the final artifact. */
+	finalPath: string;
+	/** sha256 recorded for the final and re-verified against its bytes. */
+	finalSha256: string;
+	/** sha256 of the iteration-opening planner (or revision) artifact. */
+	plannerSha256: string;
+	/** Reviewer verdict hashes that joined this iteration. */
+	reviewerSha256: Record<string, string>;
+	/** Session that owns the run; a foreign session can never be granted. */
+	sessionId: string;
+}
+
+export type RalplanCurrentFinalRefusalCode =
+	| "missing_state"
+	| "run_not_final"
+	| "auto_handoff_enabled"
+	| "missing_index"
+	| "malformed_index"
+	| "no_iteration_opener"
+	| "final_not_last"
+	| "missing_reviewers"
+	| "artifact_missing"
+	| "artifact_outside_run"
+	| "hash_mismatch";
+
+export interface RalplanCurrentFinalRefusal {
+	code: RalplanCurrentFinalRefusalCode;
+	/** Human-readable reason suitable for a guard error message. */
+	reason: string;
+}
+
+export type RalplanCurrentFinalResolution =
+	| { ok: true; descriptor: RalplanCurrentFinalDescriptor }
+	| { ok: false; refusal: RalplanCurrentFinalRefusal };
+
+export interface RalplanCurrentFinalInput {
+	cwd: string;
+	/** Caller session id; the run must belong to it. */
+	sessionId: string;
+	/** Optional agent dir for settings resolution. */
+	agentDir?: string;
+}
+
+/**
+ * Whether the pending `ask` payload selects the ralplan execution-approval gate.
+ *
+ * This is a selector, not authority: it only decides which validation runs. The
+ * descriptor it leads to is the proof.
+ */
+export function selectsRalplanApprovalGate(pendingQuestions: unknown): boolean {
+	const questions = (pendingQuestions as { questions?: unknown } | undefined)?.questions;
+	if (!Array.isArray(questions)) return false;
+	return questions.some(question => {
+		if (!question || typeof question !== "object" || Array.isArray(question)) return false;
+		const gate = (question as { workflowGate?: unknown }).workflowGate;
+		if (!gate || typeof gate !== "object" || Array.isArray(gate)) return false;
+		const record = gate as { stage?: unknown; kind?: unknown };
+		return record.stage === "ralplan" && record.kind === "approval";
+	});
+}
+
+function refusal(code: RalplanCurrentFinalRefusalCode, reason: string): RalplanCurrentFinalRefusal {
+	return { code, reason };
+}
+
+function parseIndexRow(line: string): RalplanIndexRow | undefined {
+	const trimmed = line.trim();
+	if (!trimmed) return undefined;
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return undefined;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+	const record = parsed as Record<string, unknown>;
+	const { stage, path: artifactPath, sha256 } = record;
+	const stageN = record.stage_n;
+	if (typeof stage !== "string" || !stage.trim()) return undefined;
+	if (typeof stageN !== "number" || !Number.isInteger(stageN) || stageN <= 0) return undefined;
+	if (typeof artifactPath !== "string" || !artifactPath.trim()) return undefined;
+	if (typeof sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(sha256)) return undefined;
+	return { stage: stage.trim(), stageN, path: artifactPath.trim(), sha256: sha256.toLowerCase() };
+}
+
+async function readRunState(statePath: string): Promise<{ runId: string; phase: string } | RalplanCurrentFinalRefusal> {
+	let text: string;
+	try {
+		text = await fs.readFile(statePath, "utf-8");
+	} catch (error) {
+		if (isEnoent(error)) return refusal("missing_state", `no ralplan run state at ${statePath}`);
+		return refusal("missing_state", `failed to read ralplan run state at ${statePath}`);
+	}
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return refusal("malformed_index", `ralplan run state at ${statePath} is not valid JSON`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+		return refusal("malformed_index", `ralplan run state at ${statePath} is not an object`);
+	}
+	const record = parsed as Record<string, unknown>;
+	const runId = typeof record.run_id === "string" ? record.run_id.trim() : "";
+	const phase = typeof record.current_phase === "string" ? record.current_phase.trim().toLowerCase() : "";
+	if (!runId) return refusal("malformed_index", `ralplan run state at ${statePath} has no run_id`);
+	return { runId, phase };
+}
+
+/**
+ * Resolve and verify the current ralplan final for `sessionId`.
+ *
+ * Fails closed: every check returns a refusal instead of degrading to a weaker
+ * proof, because the caller uses a success to lift the Ultragoal ask guard.
+ */
+export async function resolveRalplanCurrentFinal(
+	input: RalplanCurrentFinalInput,
+): Promise<RalplanCurrentFinalResolution> {
+	const sessionId = input.sessionId.trim();
+	if (!sessionId) return { ok: false, refusal: refusal("missing_state", "no caller session id") };
+
+	const state = await readRunState(modeStatePath(input.cwd, sessionId, "ralplan"));
+	if (!("runId" in state)) return { ok: false, refusal: state };
+	if (state.phase !== "final" && state.phase !== "handoff") {
+		return {
+			ok: false,
+			refusal: refusal("run_not_final", `ralplan run ${state.runId} is in phase "${state.phase}", not final`),
+		};
+	}
+
+	// A final that would hand off automatically is not waiting for approval.
+	const autoHandoff = await resolveRalplanAutoHandoff(input.cwd, { agentDir: input.agentDir });
+	if (autoHandoff.effectiveTarget !== "off") {
+		return {
+			ok: false,
+			refusal: refusal(
+				"auto_handoff_enabled",
+				`ralplan autoHandoff is "${autoHandoff.effectiveTarget}"; a current final is only approvable while handoff is off`,
+			),
+		};
+	}
+
+	const runDir = path.join(sessionPlansDir(input.cwd, sessionId), "ralplan", state.runId);
+	const indexPath = path.join(runDir, "index.jsonl");
+	let indexText: string;
+	try {
+		indexText = await fs.readFile(indexPath, "utf-8");
+	} catch (error) {
+		if (isEnoent(error)) return { ok: false, refusal: refusal("missing_index", `no ralplan index at ${indexPath}`) };
+		return { ok: false, refusal: refusal("missing_index", `failed to read ralplan index at ${indexPath}`) };
+	}
+
+	const rows: RalplanIndexRow[] = [];
+	for (const line of indexText.split("\n")) {
+		if (!line.trim()) continue;
+		const row = parseIndexRow(line);
+		if (!row) {
+			return { ok: false, refusal: refusal("malformed_index", `malformed ralplan index row in ${indexPath}`) };
+		}
+		rows.push(row);
+	}
+	if (rows.length === 0)
+		return { ok: false, refusal: refusal("missing_index", `ralplan index ${indexPath} is empty`) };
+
+	const finalRow = rows.reduce((latest, row) => (row.stageN > latest.stageN ? row : latest));
+	if (finalRow.stage !== "final") {
+		return {
+			ok: false,
+			refusal: refusal("final_not_last", `the newest ralplan stage is "${finalRow.stage}", not "final"`),
+		};
+	}
+
+	const earlierRows = rows.filter(row => row.stageN < finalRow.stageN);
+	const opener = earlierRows
+		.filter(row => ITERATION_OPENER_STAGES.has(row.stage))
+		.reduce<RalplanIndexRow | undefined>(
+			(latest, row) => (!latest || row.stageN > latest.stageN ? row : latest),
+			undefined,
+		);
+	if (!opener) {
+		return {
+			ok: false,
+			refusal: refusal("no_iteration_opener", "the final has no planner or revision stage before it"),
+		};
+	}
+
+	const reviewers: Record<string, string> = {};
+	for (const lane of REVIEW_LANE_STAGES) {
+		const laneRow = earlierRows
+			.filter(row => row.stage === lane && row.stageN > opener.stageN)
+			.reduce<RalplanIndexRow | undefined>(
+				(latest, row) => (!latest || row.stageN > latest.stageN ? row : latest),
+				undefined,
+			);
+		if (!laneRow) {
+			return {
+				ok: false,
+				refusal: refusal(
+					"missing_reviewers",
+					`no ${lane} verdict between the ${opener.stage} stage and the final; the final is not reviewed`,
+				),
+			};
+		}
+		reviewers[lane] = laneRow.sha256;
+	}
+
+	// Hash every referenced artifact and require it to live inside this run.
+	for (const row of rows) {
+		const resolved = path.resolve(row.path);
+		const relative = path.relative(runDir, resolved);
+		if (relative.startsWith("..") || path.isAbsolute(relative)) {
+			return {
+				ok: false,
+				refusal: refusal("artifact_outside_run", `ralplan stage artifact ${row.path} is outside ${runDir}`),
+			};
+		}
+		let bytes: Buffer;
+		try {
+			bytes = await Bun.file(resolved)
+				.arrayBuffer()
+				.then(buffer => Buffer.from(buffer));
+		} catch (error) {
+			if (isEnoent(error)) {
+				return { ok: false, refusal: refusal("artifact_missing", `ralplan stage artifact ${row.path} is missing`) };
+			}
+			return { ok: false, refusal: refusal("artifact_missing", `cannot read ralplan stage artifact ${row.path}`) };
+		}
+		const actual = new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+		if (actual !== row.sha256) {
+			return {
+				ok: false,
+				refusal: refusal(
+					"hash_mismatch",
+					`ralplan stage artifact ${path.basename(row.path)} does not match its recorded hash`,
+				),
+			};
+		}
+	}
+
+	return {
+		ok: true,
+		descriptor: {
+			runId: state.runId,
+			finalPath: path.resolve(finalRow.path),
+			finalSha256: finalRow.sha256,
+			plannerSha256: opener.sha256,
+			reviewerSha256: reviewers,
+			sessionId,
+		},
+	};
+}

package/src/gjc-runtime/ralplan-runtime.ts

@@ -4,6 +4,7 @@ import * as fssync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isSettingsInitialized, Settings } from "../config/settings";
+import { sanitizeImportedString } from "../session-import/redact";
 import { syncSkillActiveState } from "../skill-state/active-state";
 import { buildRalplanHudSummary } from "../skill-state/workflow-hud";
 import { WORKFLOW_STATE_VERSION } from "../skill-state/workflow-state-contract";
@@ -2319,6 +2320,97 @@ function buildIndexedReviewArtifacts(indexText: string | undefined): Map<string,
 	return map;
 }
 
+function scrubImported(value: string): string {
+	return sanitizeImportedString(value);
+}
+
+/** Scrub, then trim the same way the disposition parser does. An empty result is not an id. */
+function canonicalDispositionId(value: string): string {
+	const canonical = scrubImported(value).trim();
+	if (canonical === "") {
+		throw new RalplanCommandError(
+			2,
+			"refusing to persist ralplan disposition: credential scrub removed an identifier",
+		);
+	}
+	return canonical;
+}
+
+/**
+ * Scrub a validated disposition, then rebuild conflict ids from the scrubbed
+ * finding and target ids. Only `sourceReceipt.path` and `sourceReceipt.sha256`
+ * stay literal. A result that no longer parses is refused instead of stored.
+ */
+function scrubDispositionDocument(normalized: string): string {
+	const doc = parseReviewConflictDocument(normalized);
+	const findingIds = new Map(
+		doc.findings.map(finding => [finding.findingId, canonicalDispositionId(finding.findingId)]),
+	);
+	const targetIds = new Map<string, string>();
+	const originalsByScrubbedTarget = new Map<string, string>();
+	for (const finding of doc.findings) {
+		const canonical = canonicalDispositionId(finding.targetId);
+		const prior = originalsByScrubbedTarget.get(canonical);
+		if (prior !== undefined && prior !== finding.targetId) {
+			throw new RalplanCommandError(
+				2,
+				"refusing to persist ralplan disposition: distinct target ids collapse after credential scrub",
+			);
+		}
+		originalsByScrubbedTarget.set(canonical, finding.targetId);
+		targetIds.set(finding.targetId, canonical);
+	}
+	const priorConflicts = doc.conflicts.map(conflict => ({
+		conflictId: conflict.conflictId,
+		targetId: conflict.targetId,
+		findingIds: [...conflict.findingIds] as [string, string],
+	}));
+	for (const finding of doc.findings) {
+		finding.findingId = findingIds.get(finding.findingId) ?? finding.findingId;
+		finding.targetId = targetIds.get(finding.targetId) ?? finding.targetId;
+		finding.evidence = scrubImported(finding.evidence);
+		if (finding.proposedOwner !== undefined) finding.proposedOwner = scrubImported(finding.proposedOwner);
+	}
+	for (const disposition of doc.dispositions) {
+		const prior = priorConflicts.find(conflict => conflict.conflictId === disposition.conflictId);
+		if (!prior) {
+			throw new RalplanCommandError(2, "refusing to persist ralplan disposition: conflict id did not survive scrub");
+		}
+		const targetId = targetIds.get(prior.targetId) ?? canonicalDispositionId(prior.targetId);
+		const mapped = prior.findingIds.map(id => findingIds.get(id) ?? canonicalDispositionId(id));
+		const [left, right] = mapped[0]! <= mapped[1]! ? [mapped[0]!, mapped[1]!] : [mapped[1]!, mapped[0]!];
+		disposition.conflictId = `conflict:${targetId}:${left}:${right}`;
+		disposition.rationale = scrubImported(disposition.rationale);
+		disposition.decisionOwner = scrubImported(disposition.decisionOwner);
+		disposition.affectedSections = disposition.affectedSections.map(section => scrubImported(section));
+		if (disposition.dispositionedAt !== undefined)
+			disposition.dispositionedAt = scrubImported(disposition.dispositionedAt);
+	}
+	const raw = JSON.parse(serializeReviewConflictDocument(doc)) as Record<string, unknown>;
+	delete raw.conflicts;
+	let rewritten: ReturnType<typeof parseReviewConflictDocument>;
+	try {
+		rewritten = parseReviewConflictDocument(`${JSON.stringify(raw, null, 2)}\n`);
+	} catch (error) {
+		throw new RalplanCommandError(
+			2,
+			`refusing to persist ralplan disposition: credential scrub broke the document (${error instanceof Error ? error.message : String(error)})`,
+		);
+	}
+	return serializeReviewConflictDocument(rewritten);
+}
+
+/**
+ * Credential scrub for a ralplan stage body. The result is what
+ * `gjc ralplan --write` hashes and stores.
+ */
+export function scrubRalplanPersistedBody(stage: string, content: string): string {
+	const normalized = content.endsWith("\n") ? content : `${content}\n`;
+	if (stage === "disposition") return scrubDispositionDocument(normalized);
+	const scrubbed = sanitizeImportedString(normalized);
+	return scrubbed.endsWith("\n") ? scrubbed : `${scrubbed}\n`;
+}
+
 async function handleArtifactWrite(
 	args: readonly string[],
 	cwd: string,
@@ -2380,7 +2472,9 @@ async function handleArtifactWrite(
 		resolved.stage === "disposition"
 			? normalizeDispositionArtifact(resolved.artifact, resolved.stageN, indexLoad.rawText)
 			: resolved.artifact;
-	const content = normalizedArtifact.endsWith("\n") ? normalizedArtifact : `${normalizedArtifact}\n`;
+	// Scrub before the content hash. The ledger, dedupe, and pending-approval copy
+	// all trust this digest, so it has to name the bytes that actually land on disk.
+	const content = scrubRalplanPersistedBody(resolved.stage, normalizedArtifact);
 	const sha256 = createHash("sha256").update(content).digest("hex");
 
 	// Duplicate-write guard: a second `--write` for the same (stage, stage_n) must not

package/src/gjc-runtime/session-resolution.ts

@@ -29,6 +29,14 @@ import {
 /** Window within which two activity timestamps are treated as an ambiguous tie. */
 export const LATEST_SESSION_TIE_WINDOW_MS = 1000;
 
+/**
+ * Local writers stamp `Date.now()`. A parsed `updated_at` further ahead than this
+ * is planted marker content, not activity, and is not a candidate. Marker mtime
+ * is not used in that case: a checkout or touch refreshes mtime without rewriting
+ * a future timestamp.
+ */
+const ACTIVITY_FUTURE_SKEW_MS = 2 * 60 * 1000;
+
 export interface SessionIdSources {
 	/** Raw `--session-id` value: `undefined` = flag absent; `""` = present-but-blank (invalid). */
 	flagValue?: string | undefined;
@@ -46,8 +54,12 @@ export class SessionResolutionError extends Error {
 	}
 }
 
+function isUnsafeResolvedSessionId(sessionId: string): boolean {
+	return sessionId === "." || sessionId === ".." || /[/\\]/.test(sessionId);
+}
+
 function assertSafeResolvedSessionId(sessionId: string): void {
-	if (sessionId === "." || sessionId === ".." || /[/\\]/.test(sessionId)) {
+	if (isUnsafeResolvedSessionId(sessionId)) {
 		throw new SessionResolutionError(
 			"session id must be a single path component (no separators or traversal)",
 			"unsafe_session",
@@ -135,8 +147,17 @@ interface SessionCandidate {
  * or an ambiguous tie.
  */
 export async function detectLatestSession(cwd: string): Promise<GjcSessionContext> {
-	const candidates = await collectActiveSessionCandidates(cwd);
+	const found = await collectActiveSessionCandidates(cwd);
+	const candidates = found.candidates;
 	if (candidates.length === 0) {
+		// No safe session was selectable. Keep the unsafe-id error when a crafted
+		// directory was the reason nothing could be chosen, matching explicit ids.
+		if (found.sawUnsafe) {
+			throw new SessionResolutionError(
+				"session id must be a single path component (no separators or traversal)",
+				"unsafe_session",
+			);
+		}
 		throw new SessionResolutionError(
 			"no active GJC session found: pass --session-id or set GJC_SESSION_ID",
 			"no_session",
@@ -156,19 +177,27 @@ export async function detectLatestSession(cwd: string): Promise<GjcSessionContex
 	return { gjcSessionId: first.gjcSessionId, sessionRoot: first.sessionRoot, source: "latest" };
 }
 
-async function collectActiveSessionCandidates(cwd: string): Promise<SessionCandidate[]> {
+async function collectActiveSessionCandidates(
+	cwd: string,
+): Promise<{ candidates: SessionCandidate[]; sawUnsafe: boolean }> {
 	const root = gjcRoot(cwd);
 	let entries: import("node:fs").Dirent[];
 	try {
 		entries = await fs.readdir(root, { withFileTypes: true });
 	} catch {
-		return [];
+		return { candidates: [], sawUnsafe: false };
 	}
 	const candidates: SessionCandidate[] = [];
+	let sawUnsafe = false;
 	for (const entry of entries) {
 		if (!entry.isDirectory()) continue;
 		const gjcSessionId = sessionIdFromDirName(entry.name);
 		if (!gjcSessionId) continue;
+		// Skip; throwing here would stop discovery for every other session.
+		if (isUnsafeResolvedSessionId(gjcSessionId)) {
+			sawUnsafe = true;
+			continue;
+		}
 		assertSafeResolvedSessionId(gjcSessionId);
 		const dir = path.join(root, entry.name);
 		const activityMs = await readActivityMs(path.join(dir, GJC_SESSION_ACTIVITY_FILE));
@@ -177,7 +206,7 @@ async function collectActiveSessionCandidates(cwd: string): Promise<SessionCandi
 		if (activityMs === undefined) continue;
 		candidates.push({ gjcSessionId, sessionRoot: dir, activityMs });
 	}
-	return candidates;
+	return { candidates, sawUnsafe };
 }
 
 async function readActivityMs(markerPath: string): Promise<number | undefined> {
@@ -191,7 +220,10 @@ async function readActivityMs(markerPath: string): Promise<number | undefined> {
 		const parsed = JSON.parse(raw) as { updated_at?: unknown };
 		if (typeof parsed.updated_at === "string") {
 			const ms = Date.parse(parsed.updated_at);
-			if (!Number.isNaN(ms)) return ms;
+			if (!Number.isNaN(ms)) {
+				if (ms > Date.now() + ACTIVITY_FUTURE_SKEW_MS) return undefined;
+				return ms;
+			}
 		}
 	} catch {
 		// fall through to mtime

package/src/gjc-runtime/session-state-lock.ts

@@ -300,9 +300,12 @@ async function repairPendingOwnerRecord(pending: PendingOwnerRepair): Promise<bo
 	const handle = pending.repairHandle;
 	if (!handle || pending.repairBytes === undefined) return true;
 	try {
-		await writeOwnerBytes(handle, Buffer.from(pending.repairBytes, "utf8"));
+		const written = await writeOwnerBytes(handle, Buffer.from(pending.repairBytes, "utf8"), undefined);
 		const stat = await handle.stat({ bigint: true });
-		pending.repairSnapshot = ownerSnapshotFrom(stat, Buffer.from(pending.repairBytes, "utf8"));
+		// The rewritten record may have been padded back to its previous length, so the
+		// identity that authorizes later cleanup is the bytes that landed, not the bytes
+		// requested.
+		pending.repairSnapshot = ownerSnapshotFrom(stat, written);
 		await handle.close();
 		pending.repairHandle = undefined;
 		return true;
@@ -533,6 +536,8 @@ export const SessionStateLockTestHooks: {
 	afterCurrentOwnerValidation?: (file: string) => void | Promise<void>;
 	/** @internal Fault seam immediately before a held owner record rewrite mutates bytes. */
 	beforeOwnerRecordRewrite?: (file: string) => void | Promise<void>;
+	/** @internal Fault seam immediately before the pre-rewrite fstat on the owner record handle. */
+	beforeOwnerRecordPrewriteStat?: (file: string) => void | Promise<void>;
 	/** @internal Fault seam immediately before final transition-generation validation. */
 	beforeTransitionReleaseLstat?: (transitionDir: string) => void | Promise<void>;
 	/** @internal Fault seam immediately before setup generation capture. */
@@ -1491,13 +1496,21 @@ async function createOwnerLock(
 	// pair names the record this call brought into existence and nothing else.
 	let created: OpenOwnerIdentity | null = null;
 	try {
-		await handle.chmod(0o600);
 		created = await openOwnerIdentity(handle);
 		await SessionStateLockTestHooks.ownerRecordWriteFault?.(file);
+		// The record's bytes land before anything else is asked of this descriptor. A
+		// freshly created record is empty until they do, and an empty record carries no
+		// `owner_host_id`, so every syscall placed in front of this write is a window in
+		// which a kill leaves debris no later contender may reclaim. `chmod` is the one
+		// that can actually stall — it is a metadata round-trip that a File Provider,
+		// NFS, or CIFS mount may hold for seconds — so it moves behind the write. The
+		// unrestricted mode it corrected for is already excluded by the create's own
+		// mode argument, so the descriptor is never more permissive than 0o600 here.
 		await handle.writeFile(bytes);
 		const stat = await handle.stat({ bigint: true });
 		if (!stat.isFile() || stat.size !== BigInt(bytes.byteLength))
 			throw new SessionStateLockUnavailableError(new Error("Owner record did not land as a regular file."));
+		await handle.chmod(0o600);
 		return ownerSnapshotFrom(stat, bytes);
 	} catch (error) {
 		// Deliberately BEFORE any close: releasing the descriptor first would free the
@@ -1520,16 +1533,48 @@ const POSIX_OWNER_REWRITE_FLAGS = POSIX_NOFOLLOW_AVAILABLE
 	? fsSync.constants.O_RDWR | fsSync.constants.O_NONBLOCK | fsSync.constants.O_NOFOLLOW
 	: undefined;
 
-async function writeOwnerBytes(handle: fs.FileHandle, bytes: Buffer): Promise<void> {
-	await handle.truncate(0);
+/**
+ * The one writer of an owner record's bytes: overwrite in place, never shorter.
+ *
+ * `truncate(0)` followed by a write looks atomic and is not. The bytes a truncate
+ * publishes are EMPTY, and an empty record carries no `owner_host_id` at all, so a
+ * process that dies inside that window (a repeated Ctrl-C reaches `postmortem.quit`,
+ * which deliberately performs no lock release) leaves a record with no attributable
+ * owner. `malformedOwnerProvenance` classifies it `unprovenanced`, the reclaim refuses
+ * it, and every later contender fails closed forever: `transition_claim_timeout` with
+ * `claim_or_owner_unreadable`, and coordinator state persistence for that session is
+ * lost for good — the failure class #5159 and #5216 both land on.
+ *
+ * So the replacement is written over the HEAD of the record and the previous byte
+ * length is kept instead of discarded. A JSON document ignores trailing whitespace, so
+ * a padded record is the same record to every reader — `JSON.parse`, `validLockOwner`,
+ * `malformedOwnerProvenance`, and the identity-bound unlink all see exactly the
+ * replacement — while the bytes on disk always carry the full ownership preamble. That
+ * leaves a torn single write (which needs the kernel to short-write a ~200 byte payload)
+ * as the only state the record cannot be attributed from, instead of the guaranteed
+ * empty window between two syscalls.
+ *
+ * @returns the exact bytes now on disk. A padded record's size and SHA-256 are the
+ * padded bytes', so this — not the requested payload — is what identifies the record
+ * for every later capture, comparison, and replay.
+ */
+async function writeOwnerBytes(handle: fs.FileHandle, bytes: Buffer, file?: string): Promise<Buffer> {
+	if (file) await SessionStateLockTestHooks.beforeOwnerRecordPrewriteStat?.(file);
+	const previous = await handle.stat({ bigint: true });
+	const previousSize = previous.isFile() === true ? Number(previous.size) : 0;
+	const padding = Math.max(0, previousSize - bytes.byteLength);
+	const payload = padding === 0 ? bytes : Buffer.concat([bytes, Buffer.alloc(padding, 0x20)]);
 	let offset = 0;
-	while (offset < bytes.byteLength) {
-		const { bytesWritten } = await handle.write(bytes, offset, bytes.byteLength - offset, offset);
+	while (offset < payload.byteLength) {
+		const { bytesWritten } = await handle.write(payload, offset, payload.byteLength - offset, offset);
 		if (bytesWritten <= 0) throw new Error("Owner record rewrite made no progress.");
 		offset += bytesWritten;
 	}
-	await handle.truncate(bytes.byteLength);
+	// `payload` is never shorter than the record already was, so this can only remove a
+	// tail that outgrew the bytes just written; it can never cut the record itself.
+	await handle.truncate(payload.byteLength);
 	await handle.sync();
+	return payload;
 }
 
 async function rewriteHeldOwnerRecord(
@@ -1581,15 +1626,15 @@ async function rewriteHeldOwnerRecord(
 		mutationStarted = true;
 		await SessionStateLockTestHooks.beforeOwnerRecordRewrite?.(file);
 		rewriteHookPassed = true;
-		await writeOwnerBytes(handle, replacementBytes);
+		const writtenBytes = await writeOwnerBytes(handle, replacementBytes, file);
 		const canonical = await captureRegularLockOwner(file);
-		// On Windows, an in-place truncate/write can expose refreshed descriptor
+		// On Windows, an in-place rewrite can expose refreshed descriptor
 		// metadata even though the file object is unchanged. The descriptor opened
 		// before mutation is the stable identity bracket; the path capture still
 		// proves that the pathname resolves to that same object after the rewrite.
 		if (!canonical || canonical.dev !== opened.dev || canonical.ino !== opened.ino)
 			throw new SessionStateLockUnavailableError(new Error("Owner pathname changed after rewrite."));
-		if (canonical.bytes !== replacementBytes.toString("utf8")) {
+		if (canonical.bytes !== writtenBytes.toString("utf8")) {
 			let successor: unknown;
 			try {
 				successor = JSON.parse(canonical.bytes);
@@ -1602,7 +1647,7 @@ async function rewriteHeldOwnerRecord(
 		return canonical;
 	} catch (error) {
 		// Keep the descriptor as the repair authority until the held bytes have
-		// been restored. A truncate/write/fsync fault may leave a malformed or
+		// been restored. A write/fsync fault may leave a malformed or
 		// partially committed record; closing first would force recovery to trust
 		// an unproven pathname and can wedge a successor behind the transition.
 		let repairNeeded = mutationStarted;
@@ -1616,9 +1661,9 @@ async function rewriteHeldOwnerRecord(
 		if (repairNeeded) {
 			let repaired: LockOwnerSnapshot;
 			try {
-				await writeOwnerBytes(handle, Buffer.from(held.bytes, "utf8"));
+				const restored = await writeOwnerBytes(handle, Buffer.from(held.bytes, "utf8"), file);
 				const repairedStat = await handle.stat({ bigint: true });
-				repaired = ownerSnapshotFrom(repairedStat, Buffer.from(held.bytes, "utf8"));
+				repaired = ownerSnapshotFrom(repairedStat, restored);
 			} catch (repairError) {
 				const aggregate = new AggregateError(
 					[error, repairError],