gentle-pi 4.3.0 → 4.5.0

package/tests/session-profile-disk-reader-pi.test.ts

@@ -0,0 +1,183 @@
+// Run only in the parent's isolated snapshot with supported existing Pi deps.
+// Public API fixtures, never providers or production flush/rollback workarounds.
+import assert from "node:assert/strict";
+import {
+	appendFileSync,
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	renameSync,
+	rmSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { test, type TestContext } from "node:test";
+import { fileURLToPath } from "node:url";
+import { SessionManager } from "@earendil-works/pi-coding-agent";
+import { readSessionProfileDisk } from "../lib/session-profile-disk-reader.ts";
+import { SESSION_PROFILE_CUSTOM_TYPE as customType } from "../lib/session-profile-persistence.ts";
+
+const packagePath = join(
+	dirname(fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"))),
+	"..",
+	"package.json",
+);
+const version: string = JSON.parse(readFileSync(packagePath, "utf8")).version;
+// Fail closed rather than silently skipping tests against stale feature deps.
+assert.match(version, /^\d+\.\d+\.\d+$/);
+assert.ok(
+	Number(version.split(".")[0]) >= 1,
+	`Pi >=1.0.0 required, installed ${version}`,
+);
+console.info(
+	`Public SessionManager fixture API: ${version}; minimum tested baseline 1.0.0`,
+);
+
+function fixture(t: TestContext) {
+	const root = mkdtempSync(join(tmpdir(), "profile-reader-pi-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	const sessions = join(root, "sessions");
+	const manager = SessionManager.create(root, sessions);
+	return { manager, sessions };
+}
+function bind(name: string) {
+	return {
+		kind: "bind",
+		origin: "user",
+		name,
+		modelProfiles: { worker: { model: `offline/${name}` } },
+	};
+}
+function flushFixture(manager: SessionManager) {
+	// An ordinary test-owned conversation message triggers Pi's normal persistence.
+	manager.appendMessage({
+		role: "user",
+		content: "isolated reader fixture",
+		timestamp: Date.now(),
+	});
+}
+function expectBound(manager: SessionManager, name: string) {
+	const result = readSessionProfileDisk(manager);
+	assert.equal(result.status, "bound");
+	if (result.status !== "bound")
+		throw new Error("Expected corroborated binding");
+	assert.equal(result.binding.name, name);
+}
+
+test("custom-only public session cannot restore memory; ordinary fixture flush corroborates", (t) => {
+	const { manager } = fixture(t);
+	manager.appendCustomEntry(customType, bind("initial"));
+	const path = manager.getSessionFile();
+	assert.ok(path);
+	assert.equal(existsSync(path), false);
+	assert.equal(readSessionProfileDisk(manager).status, "indeterminate");
+	flushFixture(manager);
+	expectBound(manager, "initial");
+});
+
+test("malformed line Pi skips on open does not block corroboration", (t) => {
+	const { manager, sessions } = fixture(t);
+	manager.appendCustomEntry(customType, bind("before"));
+	flushFixture(manager);
+	const path = manager.getSessionFile();
+	assert.ok(path);
+	appendFileSync(path, '{"type":"custom","id":"torn\n');
+	const reopened = SessionManager.open(path, sessions);
+	expectBound(reopened, "before");
+	reopened.appendCustomEntry(customType, bind("after"));
+	flushFixture(reopened);
+	expectBound(reopened, "after");
+});
+
+test("public selected branch, sibling and extracted session stay separated", (t) => {
+	const { manager, sessions } = fixture(t);
+	manager.appendCustomEntry(customType, bind("base"));
+	flushFixture(manager);
+	const base = manager.getLeafId();
+	assert.ok(base);
+	manager.appendCustomEntry(customType, bind("left"));
+	const left = manager.getLeafId();
+	assert.ok(left);
+	manager.branch(base);
+	manager.appendCustomEntry(customType, bind("right"));
+	expectBound(manager, "right");
+	manager.branch(left);
+	expectBound(manager, "left");
+	const originalFile = manager.getSessionFile();
+	const extracted = manager.createBranchedSession(left);
+	assert.ok(extracted);
+	assert.notEqual(extracted, originalFile);
+	const reopened = SessionManager.open(extracted, sessions);
+	expectBound(reopened, "left");
+	assert.equal(
+		reopened
+			.getBranch()
+			.some(
+				(row) =>
+					row.type === "custom" && (row.data as { name?: string })?.name === "right",
+			),
+		false,
+	);
+});
+
+for (const recovery of ["bind", "clear"] as const) {
+	test(`real EISDIR ghost quarantined; new ${recovery} corroborates missing parent even after reopen`, (t) => {
+		const { manager, sessions } = fixture(t);
+		manager.appendCustomEntry(customType, bind("good"));
+		flushFixture(manager);
+		const file = manager.getSessionFile();
+		assert.ok(file);
+		const saved = `${file}.saved`;
+		renameSync(file, saved);
+		mkdirSync(file);
+		assert.throws(
+			() => manager.appendCustomEntry(customType, bind("failed")),
+			(error: unknown) => {
+				assert.equal((error as NodeJS.ErrnoException).code, "EISDIR");
+				return true;
+			},
+		);
+		const failedId = manager.getLeafId();
+		assert.ok(failedId);
+		assert.equal(readSessionProfileDisk(manager).status, "indeterminate");
+		renameSync(file, `${file}.fault-directory`);
+		renameSync(saved, file);
+		assert.equal(readSessionProfileDisk(manager).status, "indeterminate");
+		const knownFailedEntryIds = new Set([failedId]);
+		const old = readSessionProfileDisk(manager, { knownFailedEntryIds });
+		assert.equal(old.status, "bound");
+		if (old.status === "bound") assert.equal(old.binding.name, "good");
+		manager.appendCustomEntry(
+			customType,
+			recovery === "bind" ? bind("recovered") : { kind: "clear" },
+		);
+		const latest = manager.getBranch().at(-1);
+		assert.ok(latest);
+		assert.equal(latest.parentId, failedId);
+		const disk = readFileSync(file, "utf8")
+			.trim()
+			.split("\n")
+			.map((line) => JSON.parse(line));
+		assert.equal(
+			disk.some((row) => row.id === failedId),
+			false,
+		);
+		assert.deepEqual(
+			disk.find((row) => row.id === latest.id),
+			JSON.parse(JSON.stringify(latest)),
+		);
+		assert.equal(
+			readSessionProfileDisk(manager, { knownFailedEntryIds }).status,
+			recovery === "bind" ? "bound" : "cleared",
+		);
+		const reopened = SessionManager.open(file, sessions);
+		assert.equal(reopened.getBranch().length, 1);
+		assert.equal(reopened.getBranch()[0].id, latest.id);
+		assert.equal(
+			readSessionProfileDisk(reopened).status,
+			recovery === "bind" ? "bound" : "cleared",
+		);
+		if (recovery === "bind") expectBound(reopened, "recovered");
+	});
+}

package/tests/session-profile-disk-reader.test.ts

@@ -0,0 +1,311 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test, type TestContext } from "node:test";
+import {
+	type DiskProfileIndeterminateReason,
+	readSessionProfileDisk,
+} from "../lib/session-profile-disk-reader.ts";
+import { SESSION_PROFILE_CUSTOM_TYPE as customType } from "../lib/session-profile-persistence.ts";
+
+const header = { type: "session", id: "session", version: 3 };
+function entry(id = "selected", data: unknown = { kind: "clear" }) {
+	return {
+		type: "custom",
+		id,
+		parentId: null,
+		timestamp: "2026-10-05T00:00:00Z",
+		customType,
+		data,
+	};
+}
+function fixture(
+	t: TestContext,
+	branch: unknown[] = [],
+	rows: unknown[] = [header, ...branch],
+) {
+	const root = mkdtempSync(join(tmpdir(), "profile-reader-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	const path = join(root, "session.jsonl");
+	writeFileSync(
+		path,
+		rows
+			.map((row) => (typeof row === "string" ? row : JSON.stringify(row)))
+			.join("\n") + "\n",
+	);
+	const source = {
+		getSessionId: () => "session",
+		getSessionFile: (): string | undefined => path,
+		getBranch: () => branch,
+	};
+	return { path, source, read: () => readSessionProfileDisk(source) };
+}
+
+test("header only establishes absence", (t) => {
+	assert.deepEqual(fixture(t).read(), { status: "absent" });
+});
+
+test("ordinary branch without family remains absent despite disk sibling", (t) => {
+	const message = {
+		type: "message",
+		id: "message",
+		parentId: null,
+		timestamp: "fixture",
+	};
+	assert.deepEqual(
+		fixture(t, [message], [header, message, entry("sibling")]).read(),
+		{ status: "absent" },
+	);
+});
+
+test("omitted data is terminal invalid or unsupported, never older resurrection", (t) => {
+	for (const identifier of [customType, "gentle-pi.session-profile/v9"]) {
+		const selected = { ...entry(), customType: identifier, data: undefined };
+		const result = fixture(t, [entry("older"), selected]).read();
+		assert.equal(
+			result.status,
+			identifier === customType ? "invalid" : "unsupported",
+		);
+	}
+});
+
+for (const [label, data, status] of [
+	["clear", { kind: "clear" }, "cleared"],
+	[
+		"empty",
+		{ kind: "bind", origin: "user", name: "chosen", modelProfiles: {} },
+		"bound",
+	],
+	["invalid", { kind: "broken" }, "invalid"],
+] as const) {
+	test(`corroborated ${label} retains semantic state and original positions`, (t) => {
+		const selected = entry("selected", data);
+		const message = {
+			type: "message",
+			id: "message",
+			parentId: null,
+			timestamp: "fixture",
+		};
+		const f = fixture(t, [message, selected], [header, "", message, selected]);
+		const result = f.read();
+		assert.equal(result.status, status);
+		assert.equal(result.entryIndex, 1);
+		assert.equal(result.lineNumber, 4);
+	});
+}
+
+test("future newest is terminal; sibling records never win", (t) => {
+	const older = entry("older");
+	const future = {
+		...entry("future"),
+		customType: "gentle-pi.session-profile/v2",
+	};
+	const f = fixture(
+		t,
+		[older, future],
+		[header, older, future, entry("sibling")],
+	);
+	assert.equal(f.read().status, "unsupported");
+});
+
+test("unknown unwritten newest never falls back; trusted failed evidence excludes only its ID", (t) => {
+	const older = entry("older");
+	const ghost = entry("ghost");
+	const f = fixture(t, [older, ghost], [header, older]);
+	assert.equal(f.read().status, "indeterminate");
+	const options = { knownFailedEntryIds: new Set(["ghost"]) };
+	assert.equal(readSessionProfileDisk(f.source, options).status, "cleared");
+	writeFileSync(
+		f.path,
+		[header, older, ghost].map((row) => JSON.stringify(row)).join("\n"),
+	);
+	assert.equal(readSessionProfileDisk(f.source, options).entryIndex, 0);
+	assert.equal(
+		readSessionProfileDisk(f.source, {
+			knownFailedEntryIds: new Set(["unrelated"]),
+		}).entryIndex,
+		1,
+	);
+});
+
+for (const [label, rows] of [
+	["wrong session", [{ ...header, id: "other" }, entry()]],
+	["wrong header", [{ ...header, type: "message" }, entry()]],
+	["duplicate ID", [header, entry(), entry()]],
+	["malformed", [header, "{secret"]],
+	["truncated", [header, '{"type":']],
+	["data mismatch", [header, entry("selected", { kind: "broken" })]],
+	["parent mismatch", [header, { ...entry(), parentId: "other" }]],
+	["metadata mismatch", [header, { ...entry(), timestamp: "other" }]],
+	["custom type mismatch", [header, { ...entry(), customType: "other" }]],
+	["extra metadata mismatch", [header, { ...entry(), extra: "changed" }]],
+	["nonobject record", [header, "null"]],
+	["empty file", []],
+	[
+		"missing metadata",
+		[
+			header,
+			{ type: "custom", id: "selected", customType, data: { kind: "clear" } },
+		],
+	],
+] as const) {
+	test(`${label} is explicitly indeterminate`, (t) => {
+		const result = fixture(t, [entry()], [...rows]).read();
+		assert.equal(result.status, "indeterminate");
+		assert.ok(!JSON.stringify(result).includes("secret"));
+	});
+}
+
+test("malformed lines are skipped like Pi's session parser, keeping physical line numbers", (t) => {
+	const selected = entry();
+	for (const rows of [
+		[header, "{bad private contents", selected],
+		["{bad private contents", header, selected],
+		[header, selected, '{"type":"custom","id":"torn'],
+	]) {
+		const result = fixture(t, [selected], rows).read();
+		assert.equal(result.status, "cleared");
+		assert.equal(result.lineNumber, rows.indexOf(selected) + 1);
+	}
+});
+
+test("malformed selected record is missing, never admitted", (t) => {
+	const result = fixture(t, [entry()], [header, "{secret"]).read();
+	assert.deepEqual(result, {
+		status: "indeterminate",
+		reason: "selected-record-missing",
+	});
+});
+
+test("file with only blank or malformed lines has no header", (t) => {
+	for (const rows of [[], ["", "{bad"]]) {
+		assert.deepEqual(fixture(t, [entry()], rows).read(), {
+			status: "indeterminate",
+			reason: "missing-header",
+		});
+	}
+});
+
+test("non-string customType is ordinary, non-string kind and empty agent name are invalid", (t) => {
+	const ordinary = { ...entry(), customType: 7 };
+	assert.deepEqual(fixture(t, [ordinary]).read(), { status: "absent" });
+	for (const data of [
+		{ kind: 1 },
+		{ kind: ["clear"] },
+		{
+			kind: "bind",
+			origin: "user",
+			name: "chosen",
+			modelProfiles: { "": "provider/model" },
+		},
+	]) {
+		const selected = entry("selected", data);
+		assert.equal(fixture(t, [selected]).read().status, "invalid");
+	}
+});
+
+test("every indeterminate reason is a named literal", () => {
+	const reasons = {
+		"missing-source": true,
+		"invalid-candidate-metadata": true,
+		"unreadable-file": true,
+		"source-changed": true,
+		"invalid-record": true,
+		"session-header-mismatch": true,
+		"duplicate-id": true,
+		"missing-header": true,
+		"selected-record-missing": true,
+		"selected-record-mismatch": true,
+		"unserializable-source": true,
+	} satisfies Record<DiskProfileIndeterminateReason, true>;
+	assert.equal(Object.keys(reasons).length, 11);
+});
+
+test("missing, undefined and unreadable paths are conservative", (t) => {
+	const f = fixture(t);
+	rmSync(f.path);
+	assert.equal(f.read().status, "indeterminate");
+	f.source.getSessionFile = () => undefined;
+	assert.equal(f.read().status, "indeterminate");
+	f.source.getSessionFile = () => f.path;
+	assert.equal(
+		readSessionProfileDisk(f.source, {
+			readFile: () => {
+				throw new Error("private");
+			},
+		}).status,
+		"indeterminate",
+	);
+});
+
+for (const change of ["id", "path", "branch"] as const) {
+	test(`source ${change} change during read invalidates authority`, (t) => {
+		const f = fixture(t, [entry()]);
+		const result = readSessionProfileDisk(f.source, {
+			readFile: (path) => {
+				const text = readFileSync(path, "utf8");
+				if (change === "id") f.source.getSessionId = () => "changed";
+				if (change === "path") f.source.getSessionFile = () => "changed";
+				if (change === "branch") f.source.getBranch().push(entry("changed"));
+				return text;
+			},
+		});
+		assert.equal(result.status, "indeterminate");
+	});
+}
+
+test("JSON key order and omitted undefined follow serialization; orphan parent is allowed", (t) => {
+	const selected = { ...entry(), parentId: "missing-failed", extra: undefined };
+	const reversed = Object.fromEntries(Object.entries(selected).reverse());
+	assert.equal(
+		fixture(t, [selected], [header, reversed]).read().status,
+		"cleared",
+	);
+});
+
+test("unserializable memory and malformed own candidate metadata fail closed", (t) => {
+	const circular: any = entry();
+	circular.extra = circular;
+	assert.equal(
+		fixture(t, [circular], [header, entry()]).read().status,
+		"indeterminate",
+	);
+	for (const field of ["id", "parentId", "timestamp"]) {
+		const candidate: any = entry();
+		delete candidate[field];
+		assert.equal(
+			fixture(t, [candidate], [header, candidate]).read().status,
+			"indeterminate",
+		);
+	}
+});
+
+test("all origins, legacy routes and orchestrator are detached and preserved", (t) => {
+	for (const origin of ["user", "local", "repo", "global"]) {
+		const selected = entry("selected", {
+			kind: "bind",
+			origin,
+			name: "chosen",
+			modelProfiles: {
+				worker: "provider/model",
+				orchestrator: { effort: "high" },
+			},
+		});
+		const f = fixture(t, [selected]);
+		const result = f.read();
+		assert.equal(result.status, "bound");
+		if (result.status !== "bound") throw new Error("expected binding");
+		assert.equal(result.binding.origin, origin);
+		assert.deepEqual(result.binding.modelProfiles.orchestrator, {
+			thinking: "high",
+		});
+		result.binding.modelProfiles.worker = { model: "changed" };
+		const next = f.read();
+		assert.equal(next.status, "bound");
+		if (next.status === "bound")
+			assert.deepEqual(next.binding.modelProfiles.worker, {
+				model: "provider/model",
+			});
+	}
+});

package/tests/session-profile-freeze.test.ts

@@ -282,14 +282,14 @@ test("drift notice: shown once per distinct change of the defaults", () => {
 	f.pinLocal("local");
 	assert.equal(
 		inheritedProfileDriftNotice(opts),
-		'el Gentleman: the default profile changed to "local" (local), this session keeps "frontier" (local). Press Enter on a profile in /gentle:profiles to adopt it.',
+		'el Gentleman: the default profile changed to "local" (local), this session keeps "frontier" (local). Open /gentle:profiles and choose Use in this session to adopt one.',
 	);
 	assert.equal(inheritedProfileDriftNotice(opts), undefined, "the same change is not repeated");
 	f.pinLocal(undefined);
 	f.setActive("team");
 	assert.equal(
 		inheritedProfileDriftNotice(opts),
-		'el Gentleman: the default profile changed to "team" (global), this session keeps "frontier" (local). Press Enter on a profile in /gentle:profiles to adopt it.',
+		'el Gentleman: the default profile changed to "team" (global), this session keeps "frontier" (local). Open /gentle:profiles and choose Use in this session to adopt one.',
 	);
 	assert.equal(inheritedProfileDriftNotice(opts), undefined);
 	assert.equal(readFrozenInheritedProfile("session-a")?.profile?.name, "frontier", "the notice never adopts the new default");
@@ -305,6 +305,8 @@ test("drift notice: an explicit binding learns its profile definition changed in
 	const notice = inheritedProfileDriftNotice(opts);
 	assert.match(notice ?? "", /the profile definition changed to "team"/);
 	assert.match(notice ?? "", /this session keeps the binding from selection/);
+	assert.match(notice ?? "", /Open \/gentle:profiles and choose Use in this session to adopt one\.$/, "the notice names the current adoption action");
+	assert.doesNotMatch(notice ?? "", /Press Enter/, "the retired Enter instruction never comes back");
 	assert.equal(inheritedProfileDriftNotice(opts), undefined, "the same change is not repeated");
 
 	f.editProfile("team", { worker: { model: "openai/older" } });
@@ -344,14 +346,14 @@ test("drift notice covers a session frozen without a profile and a default that
 	f.pinLocal("frontier");
 	assert.equal(
 		inheritedProfileDriftNotice(none),
-		'el Gentleman: the default profile changed to "frontier" (local), this session keeps no profile. Press Enter on a profile in /gentle:profiles to adopt it.',
+		'el Gentleman: the default profile changed to "frontier" (local), this session keeps no profile. Open /gentle:profiles and choose Use in this session to adopt one.',
 	);
 	const kept = options(f, "session-kept");
 	freezeSessionProfileAtStartup(kept);
 	f.pinLocal(undefined);
 	assert.equal(
 		inheritedProfileDriftNotice(kept),
-		'el Gentleman: the default profile changed to no profile, this session keeps "frontier" (local). Press Enter on a profile in /gentle:profiles to adopt it.',
+		'el Gentleman: the default profile changed to no profile, this session keeps "frontier" (local). Open /gentle:profiles and choose Use in this session to adopt one.',
 	);
 });
 

package/tests/session-scratch.test.ts

@@ -1,13 +1,13 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import test, { type TestContext } from "node:test";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { createSessionScratchExtension, SCRATCH_COMMAND_USAGE } from "../extensions/session-scratch.ts";
 import * as scratchLib from "../lib/session-scratch.ts";
-import { gitArtifactTargets, LEDGER_VERSION, type ScratchLedger } from "../lib/session-scratch.ts";
+import { gitArtifactTargets, LEDGER_ARTIFACTS_CAP, LEDGER_VERSION, type ScratchLedger } from "../lib/session-scratch.ts";
 
 // Session scratch and artifact ledger (odd/tasks/session-scratch-ledger.md):
 // the runtime owns the parent session's TMPDIR and the clones/worktrees it
@@ -943,3 +943,69 @@ test("advisories S7: the reference documents the advisory rules", () => {
 		"changed in the last minute", "recorded `inherited` values", "not a `gpXXXXXX` directory",
 	]) assert.ok(section.includes(term), `scratch reference missing ${term}`);
 });
+
+// Perf (long-session audit): the ledger file I/O must not grow with the number
+// of retained ledgers or artifacts. `listLedgers` and `writeLedger` use only
+// the async fs seam, and `capture` keeps at most `LEDGER_ARTIFACTS_CAP`
+// artifacts, evicting the oldest first. Old pre-cap ledgers still read.
+
+test("perf: pushing beyond the cap keeps the ledger bounded and keeps the newest artifacts", async (t) => {
+	const fx = fixture(t);
+	const s = session(fx);
+	await s.start();
+	for (let i = 0; i < LEDGER_ARTIFACTS_CAP + 6; i++) {
+		await s.bash(`cd ${fx.work} && git clone x d${i}`, () => mkdirSync(join(fx.work, `d${i}`)));
+	}
+	const ledger = readLedger(fx, "s-1");
+	assert.equal(ledger.artifacts.length, LEDGER_ARTIFACTS_CAP, "the ledger file stays bounded at the cap");
+	assert.equal(basename(ledger.artifacts[0].path), `d6`, "eviction is oldest-first");
+	assert.equal(basename(ledger.artifacts.at(-1)!.path), `d${LEDGER_ARTIFACTS_CAP + 5}`, "the newest artifacts are kept");
+	assert.ok(!ledger.artifacts.some((artifact) => basename(artifact.path) === "d0"));
+	await s.shutdown();
+	// An old ledger written before the cap still reads, whole, by the pre-cap reader.
+	writeForeignLedger(fx, { sessionId: "pre-cap", artifacts: Array.from({ length: LEDGER_ARTIFACTS_CAP + 10 }, (_, i) => ({ kind: "clone" as const, path: join(fx.work, `old${i}`), command: "git clone", recordedAt: new Date(0).toISOString() })) });
+	const preCap = scratchLib.readLedger(ledgerFile(fx, "pre-cap"));
+	assert.equal(preCap?.artifacts.length, LEDGER_ARTIFACTS_CAP + 10, "a pre-cap ledger is read without pruning");
+	const stored = await scratchLib.listLedgers(fx.configHome);
+	assert.equal(stored.find(({ ledger: found }) => found.sessionId === "pre-cap")?.ledger.artifacts.length, LEDGER_ARTIFACTS_CAP + 10);
+	const out = await s.run("list");
+	assert.match(out, /old0 \(session pre-cap, ended\)/);
+});
+
+test("perf: listLedgers and writeLedger run on the async fs seam only", async (t) => {
+	const fx = fixture(t);
+	assert.equal(scratchLib.writeLedger.constructor.name, "AsyncFunction", "writeLedger is async");
+	assert.equal(scratchLib.listLedgers.constructor.name, "AsyncFunction", "listLedgers is async");
+	const saved = { ...scratchLib.ledgerFs };
+	const calls: Record<string, number> = {};
+	t.after(() => Object.assign(scratchLib.ledgerFs, saved));
+	for (const name of Object.keys(scratchLib.ledgerFs) as (keyof typeof scratchLib.ledgerFs)[]) {
+		(scratchLib.ledgerFs as Record<string, unknown>)[name] = async (...args: unknown[]) => {
+			calls[name] = (calls[name] ?? 0) + 1;
+			return await (saved[name] as (...rest: unknown[]) => unknown)(...args);
+		};
+	}
+	const ledger: ScratchLedger = { version: LEDGER_VERSION, sessionId: "async", pid: 1, processStartedAt: new Date(0).toISOString(), cwd: fx.cwd, tempRoot: null, inherited: {}, scratchDir: null, artifacts: [] };
+	await scratchLib.writeLedger(ledgerFile(fx, "async"), ledger);
+	for (const name of ["mkdir", "writeFile", "rename"]) assert.ok(calls[name], `writeLedger goes through the seam: ${name}`);
+	const stored = await scratchLib.listLedgers(fx.configHome);
+	assert.equal(stored.length, 1);
+	assert.equal(stored[0].ledger.sessionId, "async");
+	for (const name of ["readdir", "readFile", "stat"]) assert.ok(calls[name], `listLedgers goes through the seam: ${name}`);
+});
+
+test("perf: a failed ledger write leaves the previous ledger file intact", async (t) => {
+	if (process.getuid?.() === 0) { t.skip("a write never fails for root"); return; }
+	const fx = fixture(t);
+	const path = ledgerFile(fx, "intact");
+	const ledger: ScratchLedger = { version: LEDGER_VERSION, sessionId: "intact", pid: 1, processStartedAt: new Date(0).toISOString(), cwd: fx.cwd, tempRoot: null, inherited: {}, scratchDir: null, artifacts: [{ kind: "clone", path: join(fx.work, "kept"), command: "git clone", recordedAt: new Date(0).toISOString() }] };
+	await scratchLib.writeLedger(path, ledger);
+	chmodSync(dirname(path), 0o500);
+	try {
+		await assert.rejects(() => scratchLib.writeLedger(path, { ...ledger, sessionId: "lost" }));
+		assert.equal(scratchLib.readLedger(path)?.sessionId, "intact", "the previous ledger file survives the failed write");
+		assert.deepEqual(readdirSync(dirname(path)).filter((name) => name.endsWith(".tmp")), [], "no temp file is left behind");
+	} finally {
+		chmodSync(dirname(path), 0o700);
+	}
+});

package/tests/session-worktree-registry.test.ts

@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
-import { SessionWorktreeRegistry, clearSessionWorktreeMemo, memoizeWorktreeResolver, resolveSessionWorktree, resolveSessionWorktreeWithGit, SESSION_WORKTREE_ENTRY, toolWorktreePath, worktreeGitEnvironment } from "../lib/session-worktree-registry.ts";
+import { SessionWorktreeRegistry, clearSessionWorktreeMemo, memoizeWorktreeResolver, resolveSessionWorktree, resolveSessionWorktreeWithGit, SESSION_WORKTREE_ENTRY, nativeRootSpelling, toolWorktreePath, worktreeGitEnvironment } from "../lib/session-worktree-registry.ts";
 import { sessionRepositoryAuthority } from "../lib/bounded-writer-admission.ts";
 
 // All Git and session writes belong to unique fixtures, never the live clone.
@@ -306,3 +306,15 @@ test("memoized identity still observes removal, nested repositories and expiry",
 	counted(join(f.dir, "empty"), f.dir);
 	assert.equal(calls, 4, "a missing repository is never memoized, so bootstrap is observed at once");
 });
+
+test("Windows root spelling accepts forward slashes as the native separator only (gentle-shell#2314)", () => {
+	// Git prints C:/repo while realpath returns C:\\repo; both name the same root.
+	assert.equal(nativeRootSpelling("C:/path/to/sibling-repo", "win32"), "C:\\path\\to\\sibling-repo");
+	assert.equal(nativeRootSpelling("C:\\path\\to\\sibling-repo", "win32"), "C:\\path\\to\\sibling-repo");
+	// Only separators change: dot segments and trailing separators stay non-canonical.
+	assert.equal(nativeRootSpelling("C:/repo/.", "win32"), "C:\\repo\\.");
+	assert.equal(nativeRootSpelling("C:/repo/", "win32"), "C:\\repo\\");
+	// POSIX spelling is untouched; a backslash is an ordinary filename character there.
+	assert.equal(nativeRootSpelling("/srv/repo", "linux"), "/srv/repo");
+	assert.equal(nativeRootSpelling("/srv/re\\po", "darwin"), "/srv/re\\po");
+});