muse-crew 0.4.5 → 0.4.7

package/lib/publish-npm.sh

@@ -23,6 +23,9 @@
 # On success: print the markers below, exit 0. The final marker is
 # PUBLISH_COMPLETE=<version> — the Publish agent pastes it verbatim into its
 # summary as the script's completion marker.
+# When no merge lock is held (empty-diff Integrate), the publish path is
+# skipped gracefully: PUBLISH_SKIPPED=no-lock-held is printed, no version
+# is written or published, and PUBLISH_COMPLETE is omitted.
 
 set -euo pipefail
 
@@ -65,115 +68,143 @@ if { [ "$HEAD_MSG" = "release: $PKG@$TARGET_VERSION ($TASK_ID)" ] \
   echo "PUBLISH_VERIFIED=$TARGET_VERSION"
 fi
 
+NO_LOCK_HELD=0
 if [ "$ALREADY_PUBLISHED" = "0" ]; then
-  # 5. Refresh the merge lock (held from Integrate through post-deploy).
-  LOCK_OUT="$(CREW_REPO="$REPO_PATH" bash "${LIFECYCLE:?LIFECYCLE is required}" refresh-lock "$TASK_ID" 2>&1)" \
-    || fail "lock-refresh" "$LOCK_OUT"
-
-  # 6. Install/activate the immutable release.
-  REL_OUT="$(bash "${RELEASE_SCRIPT:?RELEASE_SCRIPT is required}" deploy "$REPO_PATH" 2>&1)" \
-    || fail "release-deploy" "$REL_OUT"
-  case "$REL_OUT" in
-    *INSTALLED*ACTIVATED*|*EXISTS*ACTIVATED*) ;;
-    *) fail "release-deploy" "unexpected output: $REL_OUT" ;;
-  esac
-
-  # 7. Read the old version (audit only — TARGET_VERSION stays authoritative).
-  OLD="$(git -C "$REPO_PATH" show "HEAD:package.json" \
-    | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version")" \
-    || fail "read-base" "could not read version from HEAD:package.json"
-  echo "PUBLISH_BASE=$OLD"
-
-  # 8. Write TARGET_VERSION into package.json (`version` field only) via
-  # byte-preserving text substitution. A JSON.parse/stringify round-trip is
-  # forbidden here: it expands unicode escapes (e.g. the \u2014 escape in
-  # the description field) into literal characters, producing a two-line
-  # diff that trips the preservation check below (canary 5a027278). The
-  # substitution touches exactly one line; a missed substitution yields an
-  # empty diff and fails closed at the numstat check.
-  # STEP-8-ANCHOR: version write (escape-preserving)
-  PKG_JSON="$REPO_PATH/package.json"
-  ESCAPED_VER="$(printf '%s' "$TARGET_VERSION" | sed 's/[&\\]/\\&/g')"
-  sed -i -E 's/^([[:space:]]*"version"[[:space:]]*:[[:space:]]*)"[^"]*"/\1"'"$ESCAPED_VER"'"/' "$PKG_JSON" \
-    || fail "version-write" "sed could not write $TARGET_VERSION into package.json"
-  # Read-only verification: parse package.json and confirm .version equals
-  # TARGET_VERSION. (Parse only — no rewrite, so no clock/randomness.)
-  NEW_VER="$(PKG_JSON="$PKG_JSON" node -p "JSON.parse(require('fs').readFileSync(process.env.PKG_JSON,'utf8')).version")" \
-    || fail "version-write" "could not parse package.json after write"
-  [ "$NEW_VER" = "$TARGET_VERSION" ] \
-    || fail "version-write" "package.json version is $NEW_VER, expected $TARGET_VERSION"
-  echo "PUBLISH_DIFF:"
-  git -C "$REPO_PATH" diff -- package.json
-  ADD_DEL="$(git -C "$REPO_PATH" diff --numstat -- package.json | tr '\t' ' ')"
-  [ "$ADD_DEL" = "1 1 package.json" ] \
-    || fail "version-diff" "expected a single-line version change, got: $ADD_DEL"
-  # STEP-8-END
-
-  # 9. Commit only if changed (retried run leaves the commit in place).
-  if git -C "$REPO_PATH" diff --quiet -- package.json; then
-    echo "PUBLISH_COMMIT_EXISTS"
+  # STEP-5-ANCHOR: lock-state gate (empty-diff Integrate takes no lock).
+  # An empty-diff Integrate (MERGED_EMPTY) intentionally takes no merge
+  # lock: nothing merged, nothing to ship. When no lock is held, Publish
+  # skips the publish path gracefully instead of failing closed on
+  # refresh-lock (park 2026-09-11). UNLOCKED is explicit state, not prose.
+  # The anchor sits inside the ALREADY_PUBLISHED=0 branch, so the skip
+  # marker prints only on a genuinely unheld lock — a resumed run whose
+  # post-deploy already released the lock prints nothing here; its
+  # PUBLISHED_ALREADY/PUBLISH_VERIFIED markers already say it all.
+  LOCK_STATE="$(CREW_REPO="$REPO_PATH" bash "${LIFECYCLE:?LIFECYCLE is required}" lock-status "$TASK_ID" 2>&1)" \
+    || fail "lock-status" "$LOCK_STATE"
+  if [ "$LOCK_STATE" = "UNLOCKED" ]; then
+    NO_LOCK_HELD=1
+    echo "PUBLISH_SKIPPED=no-lock-held"
   else
-    git -C "$REPO_PATH" add package.json \
-      || fail "commit" "git add package.json failed"
-    git -C "$REPO_PATH" commit -m "release: $PKG@$TARGET_VERSION ($TASK_ID)" >/dev/null \
-      || fail "commit" "git commit failed"
-    echo "PUBLISH_COMMIT=$(git -C "$REPO_PATH" rev-parse HEAD)"
+    # 5b. Refresh the merge lock (held from Integrate through post-deploy).
+    LOCK_OUT="$(CREW_REPO="$REPO_PATH" bash "${LIFECYCLE:?LIFECYCLE is required}" refresh-lock "$TASK_ID" 2>&1)" \
+      || fail "lock-refresh" "$LOCK_OUT"
   fi
-
-  # 10. Pack and sanity-check the tarball's embedded version.
-  cd "$REPO_PATH" || fail "pack" "cannot cd to $REPO_PATH"
-  npm pack >/dev/null 2>&1 || fail "pack" "npm pack failed"
-  TGZ="$REPO_PATH/$PKG-$TARGET_VERSION.tgz"
-  [ -f "$TGZ" ] || fail "pack" "expected tarball $TGZ not produced"
-  TGZ_VER="$(tar -xzOf "$TGZ" package/package.json \
-    | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version")" \
-    || fail "pack-version-mismatch" "could not read version from tarball $TGZ"
-  [ "$TGZ_VER" = "$TARGET_VERSION" ] \
-    || fail "pack-version-mismatch" "tarball has $TGZ_VER, expected $TARGET_VERSION"
-
-  # 11. Publish. "previously published versions" means a retried Publish
-  # already landed this version (the merge lock guarantees no other task
-  # picked it) — continue. Any other failure is fatal.
-  if PUB_OUT="$(python3 "$NPM_PUBLISH_PY" "$TGZ" 2>&1)"; then
-    echo "PUBLISHED=$TARGET_VERSION"
-  else
-    case "$PUB_OUT" in
-      *"previously published versions"*)
-        echo "PUBLISHED_ALREADY=$TARGET_VERSION"
-        ;;
-      *)
-        rm -f "$TGZ"
-        fail "publish" "$(printf '%s\n' "$PUB_OUT" | tail -5)"
-        ;;
+  # STEP-5-END
+
+    if [ "$NO_LOCK_HELD" = "0" ]; then
+    # 6. Install/activate the immutable release.
+    REL_OUT="$(bash "${RELEASE_SCRIPT:?RELEASE_SCRIPT is required}" deploy "$REPO_PATH" 2>&1)" \
+      || fail "release-deploy" "$REL_OUT"
+    case "$REL_OUT" in
+      *INSTALLED*ACTIVATED*|*EXISTS*ACTIVATED*) ;;
+      *) fail "release-deploy" "unexpected output: $REL_OUT" ;;
     esac
-  fi
-  rm -f "$TGZ"
-
-  # 12. Verify: ground truth is the registry, not any agent's summary.
-  # The registry is eventually consistent: a publish followed by an
-  # immediate read can observe the pre-publish version (canary 5a027278
-  # hit a stale read replica ~6s after publish). A single stale read must
-  # never park a landed publish, so this block retries with backoff and
-  # client cache-busting instead of failing on the first mismatch.
-  # STEP-12-ANCHOR: publish verification (retry-tolerant)
-  VERIFY_ATTEMPTS="${VERIFY_ATTEMPTS:-12}"
-  VERIFY_SLEEP_SECS="${VERIFY_SLEEP_SECS:-10}"
-  REG=""
-  for attempt in $(seq 1 "$VERIFY_ATTEMPTS"); do
-    # --prefer-online busts npm's client-side packument cache; the retry
-    # loop absorbs server-side replica lag. A non-zero exit is a miss,
-    # not an immediate failure.
-    REG="$(npm view "$PKG" version --prefer-online 2>/dev/null || true)"
-    [ "$REG" = "$TARGET_VERSION" ] && break
-    echo "PUBLISH_VERIFY_RETRY=$attempt registry=$REG"
-    [ "$attempt" -lt "$VERIFY_ATTEMPTS" ] && sleep "$VERIFY_SLEEP_SECS"
-  done
-  [ "$REG" = "$TARGET_VERSION" ] \
-    || fail "verify" "registry=$REG after $VERIFY_ATTEMPTS attempts"
-  echo "PUBLISH_VERIFIED=$TARGET_VERSION"
-  # STEP-12-END
+
+    # 7. Read the old version (audit only — TARGET_VERSION stays authoritative).
+    OLD="$(git -C "$REPO_PATH" show "HEAD:package.json" \
+      | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version")" \
+      || fail "read-base" "could not read version from HEAD:package.json"
+    echo "PUBLISH_BASE=$OLD"
+
+    # 8. Write TARGET_VERSION into package.json (`version` field only) via
+    # byte-preserving text substitution. A JSON.parse/stringify round-trip is
+    # forbidden here: it expands unicode escapes (e.g. the \u2014 escape in
+    # the description field) into literal characters, producing a two-line
+    # diff that trips the preservation check below (canary 5a027278). The
+    # substitution touches exactly one line; a missed substitution yields an
+    # empty diff and fails closed at the numstat check.
+    # STEP-8-ANCHOR: version write (escape-preserving)
+    PKG_JSON="$REPO_PATH/package.json"
+    ESCAPED_VER="$(printf '%s' "$TARGET_VERSION" | sed 's/[&\\]/\\&/g')"
+    sed -i -E 's/^([[:space:]]*"version"[[:space:]]*:[[:space:]]*)"[^"]*"/\1"'"$ESCAPED_VER"'"/' "$PKG_JSON" \
+      || fail "version-write" "sed could not write $TARGET_VERSION into package.json"
+    # Read-only verification: parse package.json and confirm .version equals
+    # TARGET_VERSION. (Parse only — no rewrite, so no clock/randomness.)
+    NEW_VER="$(PKG_JSON="$PKG_JSON" node -p "JSON.parse(require('fs').readFileSync(process.env.PKG_JSON,'utf8')).version")" \
+      || fail "version-write" "could not parse package.json after write"
+    [ "$NEW_VER" = "$TARGET_VERSION" ] \
+      || fail "version-write" "package.json version is $NEW_VER, expected $TARGET_VERSION"
+    echo "PUBLISH_DIFF:"
+    git -C "$REPO_PATH" diff -- package.json
+    ADD_DEL="$(git -C "$REPO_PATH" diff --numstat -- package.json | tr '\t' ' ')"
+    [ "$ADD_DEL" = "1 1 package.json" ] \
+      || fail "version-diff" "expected a single-line version change, got: $ADD_DEL"
+    # STEP-8-END
+
+    # 9. Commit only if changed (retried run leaves the commit in place).
+    if git -C "$REPO_PATH" diff --quiet -- package.json; then
+      echo "PUBLISH_COMMIT_EXISTS"
+    else
+      git -C "$REPO_PATH" add package.json \
+        || fail "commit" "git add package.json failed"
+      git -C "$REPO_PATH" commit -m "release: $PKG@$TARGET_VERSION ($TASK_ID)" >/dev/null \
+        || fail "commit" "git commit failed"
+      echo "PUBLISH_COMMIT=$(git -C "$REPO_PATH" rev-parse HEAD)"
+    fi
+
+    # 10. Pack and sanity-check the tarball's embedded version.
+    cd "$REPO_PATH" || fail "pack" "cannot cd to $REPO_PATH"
+    npm pack >/dev/null 2>&1 || fail "pack" "npm pack failed"
+    TGZ="$REPO_PATH/$PKG-$TARGET_VERSION.tgz"
+    [ -f "$TGZ" ] || fail "pack" "expected tarball $TGZ not produced"
+    TGZ_VER="$(tar -xzOf "$TGZ" package/package.json \
+      | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version")" \
+      || fail "pack-version-mismatch" "could not read version from tarball $TGZ"
+    [ "$TGZ_VER" = "$TARGET_VERSION" ] \
+      || fail "pack-version-mismatch" "tarball has $TGZ_VER, expected $TARGET_VERSION"
+
+    # 11. Publish. "previously published versions" means a retried Publish
+    # already landed this version (the merge lock guarantees no other task
+    # picked it) — continue. Any other failure is fatal.
+    if PUB_OUT="$(python3 "$NPM_PUBLISH_PY" "$TGZ" 2>&1)"; then
+      echo "PUBLISHED=$TARGET_VERSION"
+    else
+      case "$PUB_OUT" in
+        *"previously published versions"*)
+          echo "PUBLISHED_ALREADY=$TARGET_VERSION"
+          ;;
+        *)
+          rm -f "$TGZ"
+          fail "publish" "$(printf '%s\n' "$PUB_OUT" | tail -5)"
+          ;;
+      esac
+    fi
+    rm -f "$TGZ"
+
+    # 12. Verify: ground truth is the registry, not any agent's summary.
+    # The registry is eventually consistent: a publish followed by an
+    # immediate read can observe the pre-publish version (canary 5a027278
+    # hit a stale read replica ~6s after publish). A single stale read must
+    # never park a landed publish, so this block retries with backoff and
+    # client cache-busting instead of failing on the first mismatch.
+    # STEP-12-ANCHOR: publish verification (retry-tolerant)
+    VERIFY_ATTEMPTS="${VERIFY_ATTEMPTS:-12}"
+    VERIFY_SLEEP_SECS="${VERIFY_SLEEP_SECS:-10}"
+    REG=""
+    for attempt in $(seq 1 "$VERIFY_ATTEMPTS"); do
+      # --prefer-online busts npm's client-side packument cache; the retry
+      # loop absorbs server-side replica lag. A non-zero exit is a miss,
+      # not an immediate failure.
+      REG="$(npm view "$PKG" version --prefer-online 2>/dev/null || true)"
+      [ "$REG" = "$TARGET_VERSION" ] && break
+      echo "PUBLISH_VERIFY_RETRY=$attempt registry=$REG"
+      [ "$attempt" -lt "$VERIFY_ATTEMPTS" ] && sleep "$VERIFY_SLEEP_SECS"
+    done
+    [ "$REG" = "$TARGET_VERSION" ] \
+      || fail "verify" "registry=$REG after $VERIFY_ATTEMPTS attempts"
+    echo "PUBLISH_VERIFIED=$TARGET_VERSION"
+    # STEP-12-END
+  fi  # NO_LOCK_HELD=0: skip the mutation path when no lock is held
 fi
 
+# 12b. Refresh the merge lock again — release-deploy, pack, publish, and the
+# verify retry loop can together consume more than half the lease on a slow
+# registry. The push and the post-deploy below must happen under our lock;
+# if the refresh fails (expired lease, someone else holds it), stop — never
+# push a version-bump commit or release a lock we no longer own.
+LOCK_OUT2="$(CREW_REPO="$REPO_PATH" bash "${LIFECYCLE:?LIFECYCLE is required}" refresh-lock "$TASK_ID" 2>&1)" \
+  || fail "lock-refresh" "$LOCK_OUT2"
+
 # 13. Push the version-bump commit (idempotent: no-op if already pushed).
 PUSH_OUT="$(git -C "$REPO_PATH" push origin main 2>&1)" \
   || fail "push" "$PUSH_OUT"
@@ -187,5 +218,10 @@ case "$FIN_OUT" in
   *) fail "post-deploy" "missing DEPLOYED marker: $FIN_OUT" ;;
 esac
 
-# Final marker: the full publish path completed.
-echo "PUBLISH_COMPLETE=$TARGET_VERSION"
+# Final marker. On the skip path (no lock held) there was nothing to
+# publish: PUBLISH_SKIPPED=no-lock-held is the completion marker and
+# PUBLISH_COMPLETE is deliberately not printed — the phase completed,
+# the publish did not happen.
+if [ "$NO_LOCK_HELD" = "0" ]; then
+  echo "PUBLISH_COMPLETE=$TARGET_VERSION"
+fi

package/lib/test-merge-lock.sh

@@ -2,9 +2,12 @@
 # test-merge-lock.sh — regression tests for merge-lock.sh
 #
 # Self-contained: uses a temp CREW_REPO and drives lib/merge-lock.sh through
-# acquire/release/status. Tests the self-healing acquire: a lock held by a
-# dead PID is reclaimed automatically; a lock held by a live PID reports HELD.
-# Exits 0 only if every case passes.
+# acquire/refresh/release/status. Tests the time-based lease model (bug
+# 2fc8f52f): an unexpired lease blocks contenders even when no holder
+# process is alive (PID liveness is never consulted); an expired lease is
+# reclaimed with logging; refresh extends the lease; release is
+# holder-only; status emits parseable holder/age/remaining fields; every
+# op appends to the merge-lock audit log. Exits 0 only if every case passes.
 
 set -uo pipefail
 
@@ -20,49 +23,89 @@ TMPBASE="$(mktemp -d)"
 trap 'rm -rf "$TMPBASE"' EXIT
 
 export CREW_REPO="$TMPBASE/repo"
+export CREW_HOME="$TMPBASE/home"
+export MERGE_LOCK_LEASE_SECONDS=600
 mkdir -p "$CREW_REPO/.worktrees"
 
-# --- Case 1: acquire on unlocked succeeds ---
-# Use $$ (this shell's PID) which is definitely alive.
-out=$("$LOCK" acquire task-1 $$ 2>&1); code=$?
-[ "$code" -eq 0 ] && [[ "$out" == *"ACQUIRED by task-1"* ]] && ok "1: acquire on unlocked succeeds" || no "1: exit $code, out: $out"
+# --- Case 1: acquire on unlocked succeeds (opaque holder, not a PID) ---
+out=$("$LOCK" acquire task-1 "task-1/run-aaa" 2>&1); code=$?
+[ "$code" -eq 0 ] && [[ "$out" == *"ACQUIRED by task-1"* ]] && [[ "$out" == *"task-1/run-aaa"* ]] \
+  && ok "1: acquire on unlocked succeeds with opaque holder" || no "1: exit $code, out: $out"
 
-# --- Case 2: second acquire with live PID reports HELD ---
-out=$("$LOCK" acquire task-2 99999 2>&1); code=$?
-[ "$code" -eq 1 ] && [[ "$out" == *"HELD by task-1"* ]] && ok "2: acquire with live holder PID reports HELD" || no "2: exit $code, out: $out"
+# --- Case 2: contender blocked while lease unexpired (no PID involved) ---
+out=$("$LOCK" acquire task-2 "task-2/run-bbb" 2>&1); code=$?
+[ "$code" -eq 1 ] && [[ "$out" == *"HELD by task-1"* ]] \
+  && ok "2: unexpired lease blocks contender" || no "2: exit $code, out: $out"
 
-# --- Case 3: release by owner succeeds ---
-out=$("$LOCK" release task-1 2>&1); code=$?
-[ "$code" -eq 0 ] && [[ "$out" == *"RELEASED by task-1"* ]] && ok "3: release by owner succeeds" || no "3: exit $code, out: $out"
-
-# --- Case 4: status reports UNLOCKED after release ---
+# --- Case 3: status emits parseable holder/age/remaining fields ---
 out=$("$LOCK" status 2>&1); code=$?
-[ "$code" -eq 0 ] && [[ "$out" == "UNLOCKED" ]] && ok "4: status UNLOCKED after release" || no "4: exit $code, out: $out"
+[ "$code" -eq 0 ] \
+  && [[ "$out" == *"locked=true"* ]] \
+  && [[ "$out" == *"task_id=task-1"* ]] \
+  && [[ "$out" == *"holder=task-1/run-aaa"* ]] \
+  && [[ "$out" == *"age_seconds="* ]] \
+  && [[ "$out" == *"remaining_seconds="* ]] \
+  && ok "3: status has holder/age/remaining fields" || no "3: exit $code, out: $out"
+
+# --- Case 4: refresh extends the lease (holder-only) ---
+# Sleep long enough that integer-second lease math must show decay; a
+# refresh then resets the clock and the remaining lease grows again.
+sleep 3
+just_before=$("$LOCK" status | sed -n 's/^remaining_seconds=//p')
+"$LOCK" refresh task-1 >/dev/null 2>&1; code=$?
+just_after=$("$LOCK" status | sed -n 's/^remaining_seconds=//p')
+[ "$code" -eq 0 ] && [ "$just_after" -gt "$just_before" ] \
+  && ok "4: refresh extends the lease" || no "4: code $code, before $just_before, after $just_after"
+
+# --- Case 5: refresh by non-holder fails ---
+out=$("$LOCK" refresh task-2 2>&1); code=$?
+[ "$code" -eq 1 ] && [[ "$out" == *"held by task-1"* ]] \
+  && ok "5: refresh by non-holder fails" || no "5: exit $code, out: $out"
 
-# --- Case 5: stale lock (dead PID) is reclaimed on acquire ---
-# Write a lock file with a PID that is certainly dead (99999999).
-echo "stale-task 2026-09-10T06:21:15Z 99999999" > "$CREW_REPO/.worktrees/.merge-lock"
-out=$("$LOCK" acquire task-3 22222 2>&1); code=$?
-[ "$code" -eq 0 ] && [[ "$out" == *"reclaimed stale lock from stale-task"* ]] && ok "5: stale lock (dead PID) reclaimed on acquire" || no "5: exit $code, out: $out"
+# --- Case 6: release by non-holder fails ---
+out=$("$LOCK" release task-2 2>&1); code=$?
+[ "$code" -eq 1 ] && [[ "$out" == *"held by task-1"* ]] \
+  && ok "6: release by non-holder fails" || no "6: exit $code, out: $out"
 
-# --- Case 6: after reclaim, the new holder owns the lock ---
+# --- Case 7: release by holder succeeds and removes the lock ---
+out=$("$LOCK" release task-1 2>&1); code=$?
+[ "$code" -eq 0 ] && [[ "$out" == *"RELEASED by task-1"* ]] && [ ! -f "$CREW_REPO/.worktrees/.merge-lock" ] \
+  && ok "7: release by holder removes lock file" || no "7: exit $code, out: $out"
+
+# --- Case 8: status reports UNLOCKED after release ---
 out=$("$LOCK" status 2>&1); code=$?
-[ "$code" -eq 0 ] && [[ "$out" == *"LOCKED by task-3"* ]] && ok "6: reclaimed lock owned by new task" || no "6: exit $code, out: $out"
+[ "$code" -eq 0 ] && [ "$out" = "UNLOCKED" ] \
+  && ok "8: status UNLOCKED after release" || no "8: exit $code, out: $out"
+
+# --- Case 9: expired lease is reclaimed (logged) by a contender ---
+# Write a lock file whose lease expired long ago (epoch 2020, lease 600s).
+printf 'task_id=old-task\nholder=old-task/run-old\nacquired_at=1577836800\nlease_seconds=600\n' \
+  > "$CREW_REPO/.worktrees/.merge-lock"
+out=$("$LOCK" acquire task-3 "task-3/run-ccc" 2>&1); code=$?
+[ "$code" -eq 0 ] && [[ "$out" == *"ACQUIRED by task-3"* ]] && [[ "$out" == *"reclaimed expired lease from old-task"* ]] \
+  && ok "9: expired lease reclaimed by contender" || no "9: exit $code, out: $out"
+[ -f "$TMPBASE/home/.merge-lock.log" ] && grep -q "op=acquire.*result=STALE-BREAK.*previous_task=old-task" "$TMPBASE/home/.merge-lock.log" \
+  && ok "9b: reclaim logged to the audit log" || no "9b: no STALE-BREAK line in audit log"
 
-# --- Case 7: release by non-owner fails ---
-out=$("$LOCK" release wrong-task 2>&1); code=$?
-[ "$code" -eq 1 ] && [[ "$out" == *"ERROR: lock held by task-3"* ]] && ok "7: release by non-owner fails" || no "7: exit $code, out: $out"
+# --- Case 10: malformed lock file is treated as expired and reclaimed ---
+printf 'garbage without any key=value\n' > "$CREW_REPO/.worktrees/.merge-lock"
+out=$("$LOCK" acquire task-4 "task-4/run-ddd" 2>&1); code=$?
+[ "$code" -eq 0 ] && [[ "$out" == *"ACQUIRED by task-4"* ]] \
+  && ok "10: malformed lock reclaimed" || no "10: exit $code, out: $out"
 
-# --- Case 8: release by owner cleans up ---
-out=$("$LOCK" release task-3 2>&1); code=$?
-[ "$code" -eq 0 ] && [ ! -f "$CREW_REPO/.worktrees/.merge-lock" ] && ok "8: release removes lock file" || no "8: exit $code, out: $out"
+# --- Case 11: every op appends to the audit log ---
+lines=$(wc -l < "$TMPBASE/home/.merge-lock.log")
+[ "$lines" -ge 8 ] && ok "11: audit log has $lines lines" || no "11: audit log has only $lines lines"
 
-# --- Case 9: lock with missing PID field is treated as stale ---
-# A lock file with "-" as PID (or empty) should be reclaimable.
-echo "old-task 2026-09-10T06:21:15Z -" > "$CREW_REPO/.worktrees/.merge-lock"
-out=$("$LOCK" acquire task-4 33333 2>&1); code=$?
-[ "$code" -eq 0 ] && [[ "$out" == *"reclaimed stale lock from old-task"* ]] && ok "9: lock with '-' PID reclaimed as stale" || no "9: exit $code, out: $out"
+# --- Case 12: concurrent acquirers serialize — exactly one wins ---
 "$LOCK" release task-4 >/dev/null 2>&1
+for n in $(seq 1 20); do
+  ( "$LOCK" acquire "racer-$n" "racer-$n/run" >/dev/null 2>&1 ) &
+done
+wait
+holder_count=$("$LOCK" status | grep -c '^task_id=racer-' || true)
+[ "$holder_count" -eq 1 ] && ok "12: exactly one concurrent acquirer holds the lock" || no "12: holder_count=$holder_count"
+grep -q "result=ACQUIRED" "$TMPBASE/home/.merge-lock.log" && ok "12b: at least one ACQUIRED logged" || no "12b: no ACQUIRED in audit log"
 
 echo ""
 echo "merge-lock: $pass passed, $fail failed"

package/lib/test-orphan-sweep.sh

@@ -22,6 +22,9 @@ no() { echo "FAIL: $1"; fail=$((fail + 1)); }
 TMPBASE="$(mktemp -d)"
 trap 'rm -rf "$TMPBASE"' EXIT
 
+# Keep merge-lock.sh's audit log out of the real $CREW_HOME during tests.
+export CREW_HOME="$TMPBASE/home"
+
 # new_fixture <name> — fresh git repo, one commit on main; exports CREW_REPO.
 new_fixture() {
   local dir="$TMPBASE/$1"
@@ -90,21 +93,32 @@ echo "$out" | grep -q "→ FAILED" && ok "4: FAILED line printed (no false 'remo
 [ -d .worktrees/T4 ] && ok "4: failed worktree left in place" || no "4: worktree gone despite failed removal"
 git worktree unlock .worktrees/T4 2>/dev/null || true
 
-# --- Case 5: lock path ---
+# --- Case 5: lock path (lease-based; bug 2fc8f52f) ---
 new_fixture case5
 mkdir -p .worktrees
-printf 'T5 2020-01-01T00:00:00Z 999999\n' > .worktrees/.merge-lock
+# 5a: expired lease, no running session → released (logged to the audit log).
+printf 'task_id=T5\nholder=T5/run-old\nacquired_at=1577836800\nlease_seconds=600\n' > .worktrees/.merge-lock
 out=$(CREW_ACTIVE_TASKS="" "$SWEEP" clean 2>&1); code=$?
-[ ! -f .worktrees/.merge-lock ] && ok "5a: stale lock released" || no "5a: stale lock file still present"
-echo "$out" | grep -q "released (dead PID)" && ok "5a: release reported" || no "5a: no release line in output"
+[ ! -f .worktrees/.merge-lock ] && ok "5a: expired-lease lock released" || no "5a: lock file still present"
+echo "$out" | grep -q "STALE_LOCK" && ok "5a: STALE_LOCK line printed" || no "5a: no STALE_LOCK line in output"
+echo "$out" | grep -q "released (lease expired)" && ok "5a: release reported" || no "5a: no release line in output"
 [ "$code" -eq 0 ] && ok "5a: exit 0" || no "5a: exit $code, want 0"
 
-printf '%s 2020-01-01T00:00:00Z 999999\n' "$UUID_LOCK" > .worktrees/.merge-lock
+# 5b: valid lease held by an active run → untouched regardless of lease age.
+now=$(date +%s)
+printf 'task_id=%s\nholder=%s/run-live\nacquired_at=%s\nlease_seconds=600\n' "$UUID_LOCK" "$UUID_LOCK" "$now" > .worktrees/.merge-lock
 out=$(CREW_ACTIVE_TASKS="$UUID_LOCK" "$SWEEP" clean 2>&1); code=$?
 [ -f .worktrees/.merge-lock ] && ok "5b: active holder's lock not released" || no "5b: active holder's lock was released"
 echo "$out" | grep -q "ACTIVE_LOCK" && ok "5b: ACTIVE_LOCK line printed" || no "5b: no ACTIVE_LOCK line in output"
 [ "$code" -eq 0 ] && ok "5b: exit 0" || no "5b: exit $code, want 0"
 
+# 5c: valid lease, no running session → held, NOT released (lease not expired).
+printf 'task_id=T6\nholder=T6/run-live\nacquired_at=%s\nlease_seconds=600\n' "$now" > .worktrees/.merge-lock
+out=$(CREW_ACTIVE_TASKS="" "$SWEEP" clean 2>&1); code=$?
+[ -f .worktrees/.merge-lock ] && ok "5c: unexpired-lease lock not released" || no "5c: unexpired-lease lock was released"
+echo "$out" | grep -q "HELD_LOCK" && ok "5c: HELD_LOCK line printed" || no "5c: no HELD_LOCK line in output"
+[ "$code" -eq 0 ] && ok "5c: exit 0" || no "5c: exit $code, want 0"
+
 # --- Case 6: report mode without active data ---
 new_fixture case6
 merged_worktree T7