oh-my-codex 0.20.1 → 0.20.3

package/dist/hooks/__tests__/session.test.js

@@ -1,10 +1,12 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
 import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, readFile, readdir, rename, rm, rmdir, symlink, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { resetSessionMetrics, reconcileNativeSessionStart, writeSessionStart, writeSessionEnd, readSessionState, readUsableSessionState, isSessionStale, } from '../session.js';
+import { __createDefaultPidProbeForTests, appendPromptSessionProvenanceRejection, __resetSessionPointerTransactionDependenciesForTests, __setSessionPointerTransactionDependenciesForTests, inspectSessionPointerLock, isSessionPointerLaunchAbort, isSessionStale, readSessionPointer, readSessionState, readUsableSessionState, reconcileNativeSessionStart, recoverSessionPointerLock, resetSessionMetrics, resolveSessionPointerContext, writeSessionEnd, writeSessionStart, } from '../session.js';
 function todayIsoDate() {
     return new Date().toISOString().slice(0, 10);
 }
@@ -17,6 +19,66 @@ function makeState(overrides = {}) {
         ...overrides,
     };
 }
+const TEST_TOKEN = 'transaction_token_123456';
+const FOREIGN_TOKEN = 'foreign_token_123456789';
+const SUCCESSOR_TOKEN = 'successor_token_123456789';
+function codedError(code) {
+    return Object.assign(new Error(code), { code });
+}
+async function withPointerDependencies(overrides, run) {
+    __setSessionPointerTransactionDependenciesForTests(overrides);
+    try {
+        await run();
+    }
+    finally {
+        __resetSessionPointerTransactionDependenciesForTests();
+    }
+}
+async function withOwnerEnvironment(sessionId, run) {
+    const previous = process.env.OMX_SESSION_ID;
+    if (sessionId === undefined)
+        delete process.env.OMX_SESSION_ID;
+    else
+        process.env.OMX_SESSION_ID = sessionId;
+    try {
+        await run();
+    }
+    finally {
+        if (previous === undefined)
+            delete process.env.OMX_SESSION_ID;
+        else
+            process.env.OMX_SESSION_ID = previous;
+    }
+}
+function matchingProcessIdentity() {
+    return { status: 'matching', startTicks: 1 };
+}
+async function writeLockOwner(cwd, owner) {
+    const context = resolveSessionPointerContext(cwd);
+    await mkdir(context.lockPath, { recursive: true });
+    await writeFile(join(context.lockPath, 'owner.json'), JSON.stringify(owner), 'utf-8');
+    return context.lockPath;
+}
+function validLockOwner(overrides = {}) {
+    return {
+        version: 1,
+        token: TEST_TOKEN,
+        pid: process.pid,
+        platform: 'linux',
+        pid_start_ticks: 1,
+        created_at: '2026-07-14T00:00:00.000Z',
+        ...overrides,
+    };
+}
+async function linuxProcessStartTicks(pid) {
+    const stat = await readFile(`/proc/${pid}/stat`, 'utf-8');
+    const closingParen = stat.lastIndexOf(')');
+    assert.notEqual(closingParen, -1);
+    const fieldsAfterCommand = stat.slice(closingParen + 2).trim().split(/\s+/);
+    const startTicks = Number.parseInt(fieldsAfterCommand[19] ?? '', 10);
+    assert.equal(Number.isInteger(startTicks), true);
+    return startTicks;
+}
 describe('session lifecycle manager', () => {
     it('resets session metrics files with zeroed counters', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-session-metrics-'));
@@ -104,6 +166,55 @@ describe('session lifecycle manager', () => {
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('emits the session-end warning only after successful end finalization', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-end-durability-'));
+        const originalWrite = process.stderr.write;
+        const warnings = [];
+        process.stderr.write = ((value) => {
+            warnings.push(value);
+            return true;
+        });
+        try {
+            await writeSessionEnd(cwd, 'sess-end-durability', {
+                platform: 'win32',
+                regularFileSync: async () => { throw codedError('EPERM'); },
+            });
+            assert.deepEqual(warnings, [
+                '[omx] warning: Windows EPERM regular-file fsync unsupported in session pointer end; operation succeeded with degraded durability.\n',
+            ]);
+        }
+        finally {
+            process.stderr.write = originalWrite;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('keeps session-end durability warnings silent when finalization or release fails', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-end-durability-failure-'));
+        const originalWrite = process.stderr.write;
+        const warnings = [];
+        process.stderr.write = ((value) => {
+            warnings.push(value);
+            return true;
+        });
+        const regularFileSync = async () => { throw codedError('EPERM'); };
+        try {
+            await withPointerDependencies({
+                fs: {
+                    rmdir: async () => { throw new Error('release failure'); },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionEnd(cwd, 'sess-end-release-failure', {
+                    platform: 'win32',
+                    regularFileSync,
+                }));
+            });
+            assert.deepEqual(warnings, []);
+        }
+        finally {
+            process.stderr.write = originalWrite;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it('does not delete the current session pointer when ending a different session', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-session-end-owner-'));
         try {
@@ -249,7 +360,7 @@ describe('session lifecycle manager', () => {
                 nativeSessionId: 'codex-native-old',
             });
             await reconcileNativeSessionStart(cwd, 'codex-native-new', {
-                pid: 54321,
+                pid: process.pid,
                 platform: 'win32',
             });
             await writeSessionEnd(cwd, 'omx-owner-session');
@@ -356,22 +467,26 @@ describe('session lifecycle manager', () => {
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('falls back to a fresh canonical session when reconciling without authoritative launch state', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-native-fallback-'));
+    it('preserves foreign selected-pointer evidence instead of replacing it during native reconciliation', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-native-foreign-'));
         try {
             const statePath = join(cwd, '.omx', 'state', 'session.json');
             await resetSessionMetrics(cwd);
             await writeFile(statePath, JSON.stringify({
                 session_id: 'sess-other-worktree',
                 cwd: join(cwd, '..', 'different-worktree'),
+                pid: process.pid,
+                platform: 'win32',
             }), 'utf-8');
-            const reconciled = await reconcileNativeSessionStart(cwd, 'codex-fallback-1', {
-                pid: 67890,
+            await assert.rejects(reconcileNativeSessionStart(cwd, 'codex-fallback-1', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                && error.code === 'session_pointer_unusable'
+                && error.pointerStatus === 'foreign-cwd');
+            assert.equal(await readFile(statePath, 'utf-8'), JSON.stringify({
+                session_id: 'sess-other-worktree',
+                cwd: join(cwd, '..', 'different-worktree'),
+                pid: process.pid,
                 platform: 'win32',
-            });
-            assert.equal(reconciled.session_id, 'codex-fallback-1');
-            assert.equal(reconciled.native_session_id, 'codex-fallback-1');
-            assert.equal(reconciled.pid, 67890);
+            }));
         }
         finally {
             await rm(cwd, { recursive: true, force: true });
@@ -501,4 +616,756 @@ describe('isSessionStale', () => {
         assert.equal(stale, false);
     });
 });
+describe('session pointer transaction', () => {
+    it('makes root resolution failures pathless typed launch aborts', async () => {
+        await assert.rejects(writeSessionStart('bad\0cwd', 'sess-context'), (error) => isSessionPointerLaunchAbort(error)
+            && error.code === 'session_pointer_context_failure'
+            && error.operation === 'pointer-context-resolve'
+            && !('pointerPath' in error));
+    });
+    it('classifies only the exact selected pointer as absent, usable, stale, indeterminate, malformed, or foreign', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-pointer-status-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await withPointerDependencies({
+                probePid: () => 'alive',
+                readProcessIdentity: () => matchingProcessIdentity(),
+            }, async () => {
+                assert.equal((await readSessionPointer(context)).status, 'absent');
+                await mkdir(context.baseStateDir, { recursive: true });
+                await writeFile(context.sessionPath, JSON.stringify({
+                    session_id: 'sess-usable',
+                    started_at: '2026-07-14T00:00:00.000Z',
+                    cwd,
+                    pid: process.pid,
+                    platform: 'linux',
+                    pid_start_ticks: 1,
+                }), 'utf-8');
+                assert.equal((await readSessionPointer(context)).status, 'usable');
+                __setSessionPointerTransactionDependenciesForTests({
+                    probePid: () => 'dead',
+                    readProcessIdentity: () => matchingProcessIdentity(),
+                });
+                assert.equal((await readSessionPointer(context)).status, 'stale-dead');
+                __setSessionPointerTransactionDependenciesForTests({
+                    probePid: () => 'indeterminate',
+                    readProcessIdentity: () => matchingProcessIdentity(),
+                });
+                assert.equal((await readSessionPointer(context)).status, 'identity-indeterminate');
+                await writeFile(context.sessionPath, '{ not-json', 'utf-8');
+                assert.equal((await readSessionPointer(context)).status, 'malformed');
+                await writeFile(context.sessionPath, JSON.stringify({
+                    session_id: 'sess-foreign',
+                    started_at: '2026-07-14T00:00:00.000Z',
+                    cwd: join(cwd, '..', 'foreign-worktree'),
+                    pid: process.pid,
+                    platform: 'win32',
+                }), 'utf-8');
+                assert.equal((await readSessionPointer(context)).status, 'foreign-cwd');
+            });
+        }
+        finally {
+            __resetSessionPointerTransactionDependenciesForTests();
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('maps only ESRCH to a definitely dead default PID probe', () => {
+        const alive = __createDefaultPidProbeForTests(() => { });
+        const esrch = __createDefaultPidProbeForTests(() => { throw codedError('ESRCH'); });
+        const eperm = __createDefaultPidProbeForTests(() => { throw codedError('EPERM'); });
+        const unknown = __createDefaultPidProbeForTests(() => { throw codedError('EACCES'); });
+        const noCode = __createDefaultPidProbeForTests(() => { throw new Error('unknown'); });
+        const primitive = __createDefaultPidProbeForTests(() => { throw 'unknown'; });
+        assert.equal(alive(1), 'alive');
+        assert.equal(esrch(1), 'dead');
+        assert.equal(eperm(1), 'indeterminate');
+        assert.equal(unknown(1), 'indeterminate');
+        assert.equal(noCode(1), 'indeterminate');
+        assert.equal(primitive(1), 'indeterminate');
+    });
+    it('never reaps dead, reused, indeterminate, missing, or malformed lock evidence', async () => {
+        const cases = [
+            { name: 'dead', owner: validLockOwner(), probePid: 'dead', expected: 'dead' },
+            { name: 'reused', owner: validLockOwner(), probePid: 'alive', identity: { status: 'reused', startTicks: 2 }, expected: 'reused' },
+            { name: 'indeterminate-probe', owner: validLockOwner(), probePid: 'indeterminate', expected: 'identity-indeterminate' },
+            { name: 'indeterminate-identity', owner: validLockOwner(), probePid: 'alive', identity: { status: 'indeterminate' }, expected: 'identity-indeterminate' },
+            { name: 'unsubstantiated-reuse', owner: validLockOwner(), probePid: 'alive', identity: { status: 'reused', startTicks: 1 }, expected: 'identity-indeterminate' },
+            { name: 'missing-required-hash', owner: validLockOwner({ pid_cmdline_hash: 'a'.repeat(64) }), probePid: 'alive', identity: matchingProcessIdentity(), expected: 'identity-indeterminate' },
+            { name: 'missing', probePid: 'alive', expected: 'missing' },
+            { name: 'malformed', owner: { version: 1 }, probePid: 'alive', expected: 'malformed' },
+        ];
+        for (const testCase of cases) {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-session-lock-${testCase.name}-`));
+            try {
+                const context = resolveSessionPointerContext(cwd);
+                await mkdir(context.lockPath, { recursive: true });
+                if (testCase.owner) {
+                    await writeFile(join(context.lockPath, 'owner.json'), JSON.stringify(testCase.owner), 'utf-8');
+                }
+                const before = await readdir(context.lockPath);
+                await withPointerDependencies({
+                    token: () => TEST_TOKEN,
+                    probePid: () => testCase.probePid,
+                    readProcessIdentity: () => testCase.identity ?? matchingProcessIdentity(),
+                }, async () => {
+                    await assert.rejects(writeSessionStart(cwd, 'sess-lock', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                        && error.code === 'session_pointer_lock_recovery_required'
+                        && error.lockOwnerStatus === testCase.expected);
+                });
+                assert.deepEqual(await readdir(context.lockPath), before);
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        }
+    });
+    it('atomically quarantines dead pre-rename temporary owner evidence and stays idempotent', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-recovery-dead-temp-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await mkdir(context.lockPath, { recursive: true });
+            await writeFile(join(context.lockPath, `owner.${TEST_TOKEN}.tmp`), JSON.stringify(validLockOwner()), 'utf-8');
+            await withPointerDependencies({ token: () => SUCCESSOR_TOKEN, probePid: () => 'dead' }, async () => {
+                const inspected = await inspectSessionPointerLock(cwd);
+                assert.equal(inspected.status, 'dead');
+                assert.equal(inspected.evidenceSource, 'owner-temp');
+                assert.equal(inspected.safeToRecover, true);
+                const recovered = await recoverSessionPointerLock(cwd);
+                assert.equal(recovered.recovered, true);
+                assert.equal(recovered.action, 'quarantined');
+                assert.equal(existsSync(context.lockPath), false);
+                assert.equal(existsSync(recovered.quarantinePath), true);
+                const repeated = await recoverSessionPointerLock(cwd);
+                assert.equal(repeated.recovered, false);
+                assert.equal(repeated.action, 'none');
+                assert.equal(repeated.status, 'absent');
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not recover a dead canonical owner because owner.json is not an exact acquisition claim', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-recovery-dead-canonical-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await writeLockOwner(cwd, validLockOwner());
+            await withPointerDependencies({ token: () => SUCCESSOR_TOKEN, probePid: () => 'dead' }, async () => {
+                const recovered = await recoverSessionPointerLock(cwd);
+                assert.equal(recovered.status, 'dead');
+                assert.equal(recovered.evidenceSource, 'owner.json');
+                assert.equal(recovered.safeToRecover, false);
+                assert.equal(recovered.recovered, false);
+                assert.equal(recovered.action, 'none');
+                assert.equal(existsSync(context.lockPath), true);
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('distinguishes a paused live pre-rename owner from the same owner after SIGKILL', async (t) => {
+        if (process.platform !== 'linux') {
+            t.skip('Linux process start identity is required for deterministic PID reuse protection.');
+            return;
+        }
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-recovery-sigkill-'));
+        const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1_000)'], { stdio: 'ignore' });
+        try {
+            assert.ok(child.pid);
+            await once(child, 'spawn');
+            const context = resolveSessionPointerContext(cwd);
+            await mkdir(context.lockPath, { recursive: true });
+            await writeFile(join(context.lockPath, `owner.${TEST_TOKEN}.tmp`), JSON.stringify(validLockOwner({
+                pid: child.pid,
+                pid_start_ticks: await linuxProcessStartTicks(child.pid),
+            })), 'utf-8');
+            const paused = await recoverSessionPointerLock(cwd);
+            assert.equal(paused.status, 'live');
+            assert.equal(paused.recovered, false);
+            assert.equal(paused.action, 'none');
+            assert.equal(existsSync(context.lockPath), true);
+            child.kill('SIGKILL');
+            const [exitCode, signal] = await once(child, 'exit');
+            assert.equal(exitCode, null);
+            assert.equal(signal, 'SIGKILL');
+            const orphaned = await recoverSessionPointerLock(cwd);
+            assert.equal(orphaned.status, 'dead');
+            assert.equal(orphaned.recovered, true);
+            assert.equal(orphaned.action, 'quarantined');
+            assert.equal(existsSync(context.lockPath), false);
+        }
+        finally {
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill('SIGKILL');
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('fails closed for live pre-rename, PID reuse, malformed, and ambiguous lock evidence', async () => {
+        const cases = [
+            { name: 'live-temp', files: [[`owner.${TEST_TOKEN}.tmp`, JSON.stringify(validLockOwner())]], probePid: 'alive', identity: matchingProcessIdentity() },
+            { name: 'reused', files: [['owner.json', JSON.stringify(validLockOwner())]], probePid: 'alive', identity: { status: 'matching', startTicks: 2 } },
+            { name: 'malformed', files: [['owner.json', '{']], probePid: 'dead' },
+            { name: 'ambiguous', files: [['owner.json', JSON.stringify(validLockOwner())], [`owner.${SUCCESSOR_TOKEN}.tmp`, JSON.stringify(validLockOwner({ token: SUCCESSOR_TOKEN }))]], probePid: 'dead' },
+        ];
+        for (const testCase of cases) {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-session-lock-recovery-${testCase.name}-`));
+            try {
+                const context = resolveSessionPointerContext(cwd);
+                await mkdir(context.lockPath, { recursive: true });
+                await Promise.all(testCase.files.map(async ([name, contents]) => await writeFile(join(context.lockPath, name), contents, 'utf-8')));
+                await withPointerDependencies({
+                    token: () => SUCCESSOR_TOKEN,
+                    probePid: () => testCase.probePid,
+                    readProcessIdentity: () => testCase.identity ?? matchingProcessIdentity(),
+                }, async () => {
+                    const before = await readdir(context.lockPath);
+                    const recovered = await recoverSessionPointerLock(cwd);
+                    assert.equal(recovered.recovered, false);
+                    assert.equal(recovered.action, 'none');
+                    assert.equal(recovered.safeToRecover, false);
+                    assert.deepEqual(await readdir(context.lockPath), before);
+                });
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        }
+    });
+    it('claims stale evidence before quarantine so a successor cannot be mistaken for it', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-recovery-race-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await mkdir(context.lockPath, { recursive: true });
+            await writeFile(join(context.lockPath, `owner.${TEST_TOKEN}.tmp`), JSON.stringify(validLockOwner()), 'utf-8');
+            const renames = [];
+            let successorBlocked = false;
+            await withPointerDependencies({
+                token: () => SUCCESSOR_TOKEN,
+                probePid: () => 'dead',
+                fs: {
+                    rename: async (from, to) => {
+                        renames.push([from, to]);
+                        await rename(from, to);
+                        if (from.endsWith(`owner.${TEST_TOKEN}.tmp`)) {
+                            await assert.rejects(mkdir(context.lockPath), { code: 'EEXIST' });
+                            successorBlocked = true;
+                        }
+                    },
+                },
+            }, async () => {
+                const recovered = await recoverSessionPointerLock(cwd);
+                assert.equal(recovered.recovered, true);
+            });
+            assert.equal(successorBlocked, true);
+            assert.match(renames[0][0], /owner\.transaction_token_123456\.tmp$/);
+            assert.match(renames[0][1], new RegExp(`owner\\.${TEST_TOKEN}\\.${SUCCESSOR_TOKEN}\\.recovery$`));
+            assert.match(renames[1][0], new RegExp(`owner\\.${TEST_TOKEN}\\.${SUCCESSOR_TOKEN}\\.recovery$`));
+            assert.equal(renames[1][1].includes('.quarantine.'), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not claim a successor lock when the inspected orphan is displaced before the exact temp rename', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-recovery-successor-race-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            const staleTemp = join(context.lockPath, `owner.${TEST_TOKEN}.tmp`);
+            const successorTemp = join(context.lockPath, `owner.${SUCCESSOR_TOKEN}.tmp`);
+            const displacedPath = `${context.lockPath}.displaced`;
+            await mkdir(context.lockPath, { recursive: true });
+            await writeFile(staleTemp, JSON.stringify(validLockOwner()), 'utf-8');
+            let displaced = false;
+            await withPointerDependencies({
+                token: () => SUCCESSOR_TOKEN,
+                probePid: () => 'dead',
+                fs: {
+                    rename: async (from, to) => {
+                        if (!displaced && from === staleTemp) {
+                            displaced = true;
+                            await rename(context.lockPath, displacedPath);
+                            await mkdir(context.lockPath);
+                            await writeFile(successorTemp, JSON.stringify(validLockOwner({ token: SUCCESSOR_TOKEN })), 'utf-8');
+                        }
+                        await rename(from, to);
+                    },
+                },
+            }, async () => {
+                const recovered = await recoverSessionPointerLock(cwd);
+                assert.equal(recovered.recovered, false);
+                assert.equal(recovered.action, 'none');
+                assert.match(recovered.reason, /changed before recovery claim/i);
+            });
+            assert.equal(displaced, true);
+            assert.deepEqual(await readdir(context.lockPath), [`owner.${SUCCESSOR_TOKEN}.tmp`]);
+            assert.equal(await readFile(successorTemp, 'utf-8'), JSON.stringify(validLockOwner({ token: SUCCESSOR_TOKEN })));
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('does not quarantine a successor live lock displaced into the canonical path after claim revalidation', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-recovery-post-claim-race-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            const staleTemp = join(context.lockPath, `owner.${TEST_TOKEN}.tmp`);
+            const successorTemp = join(context.lockPath, `owner.${SUCCESSOR_TOKEN}.tmp`);
+            const displacedPath = `${context.lockPath}.claimed-displaced`;
+            await mkdir(context.lockPath, { recursive: true });
+            await writeFile(staleTemp, JSON.stringify(validLockOwner()), 'utf-8');
+            let displaced = false;
+            await withPointerDependencies({
+                token: () => SUCCESSOR_TOKEN,
+                probePid: () => 'dead',
+                fs: {
+                    rmdir: async (path) => {
+                        if (!displaced && path === context.lockPath) {
+                            displaced = true;
+                            await rename(context.lockPath, displacedPath);
+                            await mkdir(context.lockPath);
+                            await writeFile(successorTemp, JSON.stringify(validLockOwner({ token: SUCCESSOR_TOKEN })), 'utf-8');
+                        }
+                        await rmdir(path);
+                    },
+                },
+            }, async () => {
+                const recovered = await recoverSessionPointerLock(cwd);
+                assert.equal(recovered.recovered, false);
+                assert.equal(recovered.action, 'none');
+                assert.match(recovered.reason, /canonical lock directory was not empty/i);
+                assert.ok(recovered.quarantinePath);
+            });
+            assert.equal(displaced, true);
+            assert.deepEqual(await readdir(context.lockPath), [`owner.${SUCCESSOR_TOKEN}.tmp`]);
+            assert.equal(await readFile(successorTemp, 'utf-8'), JSON.stringify(validLockOwner({ token: SUCCESSOR_TOKEN })));
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('retries a positively matching live owner with the bounded 25/50/100 schedule before timing out', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-timeout-'));
+        try {
+            await writeLockOwner(cwd, validLockOwner());
+            const delays = [];
+            let now = 0;
+            await withPointerDependencies({
+                nowMs: () => now,
+                sleep: async (ms) => { delays.push(ms); now += ms; },
+                token: () => TEST_TOKEN,
+                probePid: () => 'alive',
+                readProcessIdentity: () => matchingProcessIdentity(),
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-timeout', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_lock_timeout'
+                    && error.lockOwnerStatus === 'live');
+            });
+            assert.deepEqual(delays.slice(0, 3), [25, 50, 100]);
+            assert.equal(delays.at(-1), 25);
+            assert.equal(existsSync(resolveSessionPointerContext(cwd).lockPath), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('rolls back only its unpublished owner artifacts and reports rollback ambiguity', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-owner-publish-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        if (path.endsWith(`owner.${TEST_TOKEN}.tmp`))
+                            throw new Error('owner write failure');
+                        await writeFile(path, data, options);
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-owner-publish', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_io_failure'
+                    && error.operation === 'lock-owner-publish');
+            });
+            assert.equal(existsSync(context.lockPath), false);
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        if (path.endsWith(`owner.${TEST_TOKEN}.tmp`))
+                            throw new Error('owner write failure');
+                        await writeFile(path, data, options);
+                    },
+                    rmdir: async (path) => {
+                        if (path === context.lockPath)
+                            throw new Error('keep lock evidence');
+                        await rm(path, { recursive: false });
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-owner-residue', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_lock_recovery_required'
+                    && error.primaryOperation === 'lock-owner-publish'
+                    && error.secondaryFailures?.[0]?.phase === 'remove-unpublished-lock');
+            });
+            assert.equal(existsSync(context.lockPath), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('publishes the owner and pointer on Windows when regular-file fsync reports EPERM', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-windows-eperm-'));
+        let syncCalls = 0;
+        const regularFileSync = async (platform) => {
+            assert.equal(platform, 'win32');
+            syncCalls += 1;
+            throw codedError('EPERM');
+        };
+        try {
+            const state = await writeSessionStart(cwd, 'sess-windows-eperm', {
+                platform: 'win32',
+                regularFileSync,
+            });
+            const context = resolveSessionPointerContext(cwd);
+            assert.equal(state.session_id, 'sess-windows-eperm');
+            assert.equal(syncCalls, 2, 'owner publication and pointer publication must both attempt fsync');
+            assert.equal(existsSync(join(context.lockPath, 'owner.json')), false, 'lock owner is removed after commit');
+            assert.equal(JSON.parse(await readFile(context.sessionPath, 'utf8')).session_id, 'sess-windows-eperm');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('emits one post-release warning for a degraded session start and stays silent for synced or failed transactions', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-durability-warning-'));
+        const originalWrite = process.stderr.write;
+        const warnings = [];
+        process.stderr.write = ((value) => {
+            warnings.push({ value, lockExists: existsSync(resolveSessionPointerContext(cwd).lockPath) });
+            return true;
+        });
+        const regularFileSync = async () => { throw codedError('EPERM'); };
+        try {
+            await writeSessionStart(cwd, 'sess-degraded-start', { platform: 'win32', regularFileSync });
+            assert.deepEqual(warnings, [{
+                    value: '[omx] warning: Windows EPERM regular-file fsync unsupported in session pointer start/reconcile; operation succeeded with degraded durability.\n',
+                    lockExists: false,
+                }]);
+            warnings.length = 0;
+            await writeSessionStart(cwd, 'sess-degraded-start', { platform: 'win32' });
+            assert.deepEqual(warnings, []);
+            await withPointerDependencies({
+                fs: {
+                    rename: async (from, to) => {
+                        if (to === resolveSessionPointerContext(cwd).sessionPath)
+                            throw new Error('rename failure');
+                        await rename(from, to);
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-degraded-start', { platform: 'win32', regularFileSync }));
+            });
+            assert.deepEqual(warnings, []);
+        }
+        finally {
+            process.stderr.write = originalWrite;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('types state-directory, pointer-read, owner-sync, owner-rename, and invalid-token failures before commit', async () => {
+        const failures = [
+            {
+                name: 'state-dir',
+                operation: 'state-dir-create',
+                dependencies: (context) => ({
+                    fs: {
+                        mkdir: async (path, options) => {
+                            if (path === context.baseStateDir)
+                                throw new Error('state directory failure');
+                            await mkdir(path, options);
+                        },
+                    },
+                }),
+            },
+            {
+                name: 'pointer-read',
+                operation: 'pointer-read',
+                dependencies: (context) => ({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        readFile: async (path, encoding) => {
+                            if (path === context.sessionPath)
+                                throw new Error('pointer read failure');
+                            return await readFile(path, encoding);
+                        },
+                    },
+                }),
+            },
+            {
+                name: 'owner-sync',
+                operation: 'lock-owner-publish',
+                dependencies: (context) => ({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        openAndSync: async (path) => {
+                            if (path === join(context.lockPath, `owner.${TEST_TOKEN}.tmp`))
+                                throw new Error('owner sync failure');
+                            return 'synced';
+                        },
+                    },
+                }),
+            },
+            {
+                name: 'owner-rename',
+                operation: 'lock-owner-publish',
+                dependencies: (context) => ({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        rename: async (from, to) => {
+                            if (from === join(context.lockPath, `owner.${TEST_TOKEN}.tmp`))
+                                throw new Error('owner rename failure');
+                            await rename(from, to);
+                        },
+                    },
+                }),
+            },
+        ];
+        for (const failure of failures) {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-session-${failure.name}-`));
+            try {
+                const context = resolveSessionPointerContext(cwd);
+                await withPointerDependencies(failure.dependencies(context), async () => {
+                    await assert.rejects(writeSessionStart(cwd, 'sess-precommit', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                        && error.code === 'session_pointer_io_failure'
+                        && error.operation === failure.operation);
+                });
+                assert.equal(existsSync(context.lockPath), false);
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        }
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-invalid-token-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await withPointerDependencies({ token: () => 'bad' }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-invalid-token', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_io_failure'
+                    && error.operation === 'lock-owner-publish');
+            });
+            assert.equal(existsSync(context.lockPath), false);
+            assert.equal(existsSync(`${context.sessionPath}.tmp-bad`), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('types pointer write, sync, and rename failures and removes only the owned temporary file', async () => {
+        const phases = [
+            { operation: 'pointer-temp-write', fail: 'write' },
+            { operation: 'pointer-fsync', fail: 'sync' },
+            { operation: 'pointer-rename', fail: 'rename' },
+        ];
+        for (const phase of phases) {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-session-${phase.fail}-`));
+            try {
+                const context = resolveSessionPointerContext(cwd);
+                const tempPath = `${context.sessionPath}.tmp-${TEST_TOKEN}`;
+                await withPointerDependencies({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        writeFile: async (path, data, options) => {
+                            await writeFile(path, data, options);
+                            if (phase.fail === 'write' && path === tempPath)
+                                throw new Error('pointer write failure');
+                        },
+                        openAndSync: async (path) => {
+                            if (phase.fail === 'sync' && path === tempPath)
+                                throw new Error('pointer sync failure');
+                            return 'synced';
+                        },
+                        rename: async (from, to) => {
+                            if (phase.fail === 'rename' && from === tempPath && to === context.sessionPath) {
+                                throw new Error('pointer rename failure');
+                            }
+                            await rename(from, to);
+                        },
+                    },
+                }, async () => {
+                    await assert.rejects(writeSessionStart(cwd, 'sess-failure', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                        && error.code === 'session_pointer_io_failure'
+                        && error.operation === phase.operation);
+                });
+                assert.equal(existsSync(tempPath), false);
+                assert.equal(existsSync(context.lockPath), false);
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        }
+    });
+    it('preserves owned pointer residue and ordered cleanup evidence when cleanup or release cannot complete', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-pointer-residue-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            const tempPath = `${context.sessionPath}.tmp-${TEST_TOKEN}`;
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        await writeFile(path, data, options);
+                        if (path === tempPath)
+                            throw new Error('pointer write failure');
+                    },
+                    unlink: async (path) => {
+                        if (path === tempPath)
+                            throw new Error('pointer temp cleanup failure');
+                        await rm(path, { force: false });
+                    },
+                    rmdir: async (path) => {
+                        if (path.endsWith(`.release-${TEST_TOKEN}`))
+                            throw new Error('release cleanup failure');
+                        await rm(path, { recursive: false });
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-residue', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_lock_recovery_required'
+                    && error.primaryOperation === 'pointer-temp-write'
+                    && error.secondaryFailures?.map((failure) => failure.phase).join(',') === 'remove-pointer-temp,remove-release-dir'
+                    && error.secondaryFailures?.[0]?.evidencePath === tempPath);
+            });
+            assert.equal(existsSync(tempPath), true);
+            assert.equal(existsSync(`${context.lockPath}.release-${TEST_TOKEN}`), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('leaves foreign pointer temps inert and a successor commits after explicit lock recovery', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-pointer-successor-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            const ownTempPath = `${context.sessionPath}.tmp-${TEST_TOKEN}`;
+            const foreignTempPath = `${context.sessionPath}.tmp-${FOREIGN_TOKEN}`;
+            await mkdir(context.baseStateDir, { recursive: true });
+            await writeFile(foreignTempPath, 'foreign transaction evidence', 'utf-8');
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        await writeFile(path, data, options);
+                        if (path === ownTempPath)
+                            throw new Error('pointer write failure');
+                    },
+                    unlink: async (path) => {
+                        if (path === ownTempPath)
+                            throw new Error('keep own residue');
+                        await rm(path, { force: false });
+                    },
+                    rename: async (from, to) => {
+                        if (from === context.lockPath)
+                            throw new Error('preserve canonical lock');
+                        await rename(from, to);
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-first', { platform: 'win32' }), isSessionPointerLaunchAbort);
+            });
+            assert.equal(existsSync(foreignTempPath), true);
+            assert.equal(existsSync(context.lockPath), true);
+            // This is documented stopped-session operator recovery, deliberately not
+            // product transaction behavior.
+            await rm(context.lockPath, { recursive: true, force: true });
+            await withPointerDependencies({ token: () => SUCCESSOR_TOKEN }, async () => {
+                await writeSessionStart(cwd, 'sess-successor', { platform: 'win32' });
+            });
+            assert.equal((await readSessionState(cwd))?.session_id, 'sess-successor');
+            assert.equal(existsSync(ownTempPath), true);
+            assert.equal(existsSync(foreignTempPath), true);
+            assert.equal(existsSync(context.lockPath), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('binds an owner alias only on a verified same-native/absent transition and never during replacement', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-owner-alias-'));
+        try {
+            const nativeOnly = await reconcileNativeSessionStart(cwd, 'native-first', {
+                platform: 'win32',
+                ownerOmxSessionId: 'omx-owner',
+            });
+            assert.equal(nativeOnly.owner_omx_session_id, undefined);
+            await withOwnerEnvironment('omx-owner', async () => {
+                const bound = await reconcileNativeSessionStart(cwd, 'native-first', {
+                    platform: 'win32',
+                    ownerAliasVerified: true,
+                });
+                assert.equal(bound.session_id, 'native-first');
+                assert.equal(bound.owner_omx_session_id, 'omx-owner');
+                const replacement = await reconcileNativeSessionStart(cwd, 'native-second', {
+                    platform: 'win32',
+                    ownerAliasVerified: true,
+                });
+                assert.equal(replacement.session_id, 'native-second');
+                assert.equal(replacement.owner_omx_session_id, 'omx-owner');
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('preserves pointer evidence when history cannot be appended and rejects unusable end states before history or HUD cleanup', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-end-preserve-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await writeSessionStart(cwd, 'sess-history', { platform: 'win32' });
+            await mkdir(join(cwd, '.omx', 'logs'), { recursive: true });
+            await rm(join(cwd, '.omx', 'logs'), { recursive: true, force: true });
+            await writeFile(join(cwd, '.omx', 'logs'), 'not-a-directory', 'utf-8');
+            await assert.rejects(writeSessionEnd(cwd, 'sess-history'));
+            assert.equal((await readSessionState(cwd))?.session_id, 'sess-history');
+            await rm(join(cwd, '.omx', 'logs'), { force: true });
+            await writeFile(context.sessionPath, '{ malformed', 'utf-8');
+            await assert.rejects(writeSessionEnd(cwd, 'sess-history'), (error) => isSessionPointerLaunchAbort(error)
+                && error.code === 'session_pointer_unusable'
+                && error.pointerStatus === 'malformed');
+            assert.equal(await readFile(context.sessionPath, 'utf-8'), '{ malformed');
+            assert.equal(existsSync(join(cwd, '.omx', 'logs', 'session-history.jsonl')), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+});
+describe('prompt provenance diagnostics', () => {
+    it('writes exactly one redacted record at the supplied selected root', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-provenance-log-'));
+        try {
+            const stateDir = join(cwd, 'selected', '.omx', 'state');
+            await appendPromptSessionProvenanceRejection({
+                cwd,
+                baseStateDir: stateDir,
+                rootSource: 'cwd-default',
+                sessionPath: join(stateDir, 'session.json'),
+                lockPath: join(stateDir, 'session.json.lock'),
+            }, {
+                reason: 'payload_session_invalid',
+                producer: 'native',
+                selectedRootStatus: 'malformed',
+                timestamp: '2026-07-14T00:00:00.000Z',
+            });
+            const log = await readFile(join(cwd, 'selected', '.omx', 'logs', `omx-${todayIsoDate()}.jsonl`), 'utf-8');
+            assert.equal(log.trim().split('\n').length, 1);
+            assert.match(log, /"event":"prompt_session_provenance_rejected"/);
+            assert.equal(log.includes(cwd), false);
+            assert.equal(existsSync(join(cwd, '.omx', 'logs', `omx-${todayIsoDate()}.jsonl`)), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+});
 //# sourceMappingURL=session.test.js.map