oh-my-codex 0.20.2 → 0.20.3

package/dist/team/__tests__/state.test.js

@@ -1,17 +1,21 @@
 import { afterEach, beforeEach, describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { chmod, mkdtemp, rm, writeFile, readFile, mkdir, utimes } from 'fs/promises';
+import { chmod, mkdtemp, rm, writeFile, readFile, mkdir, open, rename, utimes, symlink } from 'fs/promises';
 import { join } from 'path';
 import { tmpdir } from 'os';
 import { existsSync, readFileSync } from 'fs';
-import { ABSOLUTE_MAX_WORKERS, DEFAULT_MAX_WORKERS, cleanupTeamState, createTask, claimTask, computeTaskReadiness, getTeamSummary, initTeamState, listTasks, migrateV1ToV2, readTask, readTeamConfig, readTeamManifestV2, transitionTaskStatus, releaseTaskClaim, reclaimExpiredTaskClaim, sendDirectMessage, broadcastMessage, markMessageDelivered, markMessageNotified, listMailboxMessages, writeTaskApproval, readTaskApproval, readWorkerHeartbeat, readWorkerStatus, updateTask, updateWorkerHeartbeat, writeAtomic, setWriteAtomicRenameForTests, resetWriteAtomicRenameForTests, writeWorkerInbox, enqueueDispatchRequest, listDispatchRequests, markDispatchRequestNotified, markDispatchRequestDelivered, transitionDispatchRequest, readDispatchRequest, readMonitorSnapshot, resolveDispatchLockTimeoutMs, writeTeamManifestV2, } from '../state.js';
+import { ABSOLUTE_MAX_WORKERS, DEFAULT_MAX_WORKERS, cleanupTeamState, createTask, claimTask, computeTaskReadiness, getTeamSummary, initTeamState, listTasks, migrateV1ToV2, readTask, readTeamConfig, saveTeamConfig, recoverTeamMembershipTaskTransaction, commitTeamMembershipTaskTransaction, withTeamTaskBarrier, readTeamManifestV2, transitionTaskStatus, releaseTaskClaim, reclaimExpiredTaskClaim, sendDirectMessage, broadcastMessage, markMessageDelivered, markMessageNotified, listMailboxMessages, writeTaskApproval, readTaskApproval, readWorkerHeartbeat, readWorkerStatus, updateTask, updateWorkerHeartbeat, writeAtomic, setWriteAtomicRenameForTests, resetWriteAtomicRenameForTests, setWriteAtomicOpenForTests, resetWriteAtomicOpenForTests, setWriteAtomicPlatformForTests, resetWriteAtomicPlatformForTests, writeWorkerInbox, enqueueDispatchRequest, listDispatchRequests, markDispatchRequestNotified, markDispatchRequestDelivered, transitionDispatchRequest, readDispatchRequest, readMonitorSnapshot, resolveDispatchLockTimeoutMs, writeTeamManifestV2, removeDispatchRequestsForWorkers, withScalingLock, } from '../state.js';
 import { normalizeDispatchRequest } from '../state/dispatch.js';
+import { claimTask as claimTaskWithDeps } from '../state/tasks.js';
+import { withScalingLock as withScalingLeaseLock, withTeamLock } from '../state/locks.js';
 const ORIGINAL_OMX_TEAM_STATE_ROOT = process.env.OMX_TEAM_STATE_ROOT;
 beforeEach(() => {
     delete process.env.OMX_TEAM_STATE_ROOT;
 });
 afterEach(() => {
     resetWriteAtomicRenameForTests();
+    resetWriteAtomicOpenForTests();
+    resetWriteAtomicPlatformForTests();
     if (typeof ORIGINAL_OMX_TEAM_STATE_ROOT === 'string')
         process.env.OMX_TEAM_STATE_ROOT = ORIGINAL_OMX_TEAM_STATE_ROOT;
     else
@@ -66,6 +70,8 @@ if (argv[0] === 'schema') {
       'mark-delivered',
       'mark-failed',
       'request-replay',
+      'remove-dispatch-records',
+
       'capture-snapshot',
     ],
     events: [],
@@ -133,6 +139,21 @@ switch (command.command) {
     process.stdout.write(JSON.stringify({ event: 'DispatchFailed', request_id: command.request_id, reason: command.reason }) + '\\n');
     process.exit(0);
   }
+  case 'RemoveDispatchRecords': {
+    const ids = new Set(command.request_ids || []);
+    if (process.env.OMX_TEST_ACK_RETAIN_DISPATCH !== '1') {
+      dispatch.records = dispatch.records.filter((entry) => !ids.has(entry.request_id));
+      writeJson(dispatchPath, dispatch);
+    }
+    process.stdout.write(JSON.stringify({ event: 'DispatchRecordsRemoved', request_ids: command.request_ids || [] }) + '\\n');
+    process.exit(0);
+  }
+  case 'CaptureSnapshot': {
+    if (process.env.OMX_TEST_SKIP_SNAPSHOT_COMPAT_WRITE !== '1') writeJson(dispatchPath, dispatch);
+    process.stdout.write(JSON.stringify({ event: 'SnapshotCaptured' }) + '\\n');
+    process.exit(0);
+  }
+
   case 'CreateMailboxMessage': {
     mailbox.records.push({
       message_id: command.message_id,
@@ -198,6 +219,8 @@ describe('team state', () => {
             assert.equal(diskCfg.tmux_session, 'omx-team-team-1');
             assert.equal(diskCfg.lifecycle_profile, 'default');
             assert.equal(diskCfg.leader_pane_id, null);
+            assert.equal(diskCfg.leader_pane_pid, null);
+            assert.equal(diskCfg.hud_pane_pid, null);
             assert.equal(diskCfg.hud_pane_id, null);
             assert.equal(diskCfg.resize_hook_name, null);
             assert.equal(diskCfg.resize_hook_target, null);
@@ -209,6 +232,126 @@ describe('team state', () => {
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('rejects a stale full config save without overwriting a newer canonical generation', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-config-generation-'));
+        try {
+            await initTeamState('team-generation', 'generation test', 'executor', 1, cwd);
+            const first = await readTeamConfig('team-generation', cwd);
+            const stale = await readTeamConfig('team-generation', cwd);
+            assert.ok(first);
+            assert.ok(stale);
+            if (!first || !stale)
+                throw new Error('missing config');
+            first.task = 'newer canonical value';
+            await saveTeamConfig(first, cwd);
+            stale.task = 'stale overwrite';
+            await assert.rejects(() => saveTeamConfig(stale, cwd), /team_config_stale_generation:team-generation:0:1/);
+            assert.equal((await readTeamConfig('team-generation', cwd))?.task, 'newer canonical value');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('recovers an interrupted config-first save to one old generation before exposing state', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-config-pair-recovery-'));
+        try {
+            const teamName = 'config-pair-recovery';
+            await initTeamState(teamName, 'old task', 'executor', 1, cwd);
+            const teamRoot = join(cwd, '.omx', 'state', 'team', teamName);
+            const manifestPath = join(teamRoot, 'manifest.v2.json');
+            const config = await readTeamConfig(teamName, cwd);
+            assert.ok(config);
+            if (!config)
+                throw new Error('missing config');
+            config.task = 'new task';
+            setWriteAtomicRenameForTests(async (from, to) => {
+                if (to === manifestPath)
+                    throw new Error('injected_manifest_publish_failure');
+                await rename(from, to);
+            });
+            await assert.rejects(() => saveTeamConfig(config, cwd), /injected_manifest_publish_failure/);
+            assert.equal(existsSync(join(teamRoot, '.membership-task-transaction.json')), true);
+            resetWriteAtomicRenameForTests();
+            const [recoveredConfig, recoveredManifest] = await Promise.all([
+                readTeamConfig(teamName, cwd),
+                readTeamManifestV2(teamName, cwd),
+            ]);
+            assert.equal(recoveredConfig?.task, 'old task');
+            assert.equal(recoveredConfig?.config_generation ?? 0, 0);
+            assert.equal(recoveredManifest?.task, 'old task');
+            assert.equal(recoveredManifest?.config_generation ?? 0, 0);
+            assert.equal(existsSync(join(teamRoot, '.membership-task-transaction.json')), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('rejects a stale membership transaction without overwriting the accepted generation', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-membership-generation-'));
+        try {
+            await initTeamState('membership-generation', 'generation test', 'executor', 1, cwd);
+            const teamRoot = join(cwd, '.omx', 'state', 'team', 'membership-generation');
+            const [oldConfig, oldManifest] = await Promise.all([
+                readFile(join(teamRoot, 'config.json'), 'utf8'),
+                readFile(join(teamRoot, 'manifest.v2.json'), 'utf8'),
+            ]);
+            const accepted = await readTeamConfig('membership-generation', cwd);
+            assert.ok(accepted);
+            if (!accepted)
+                throw new Error('missing config');
+            accepted.task = 'accepted update';
+            await saveTeamConfig(accepted, cwd);
+            const staleConfig = { ...JSON.parse(oldConfig), worker_count: 0, workers: [] };
+            const staleManifest = { ...JSON.parse(oldManifest), worker_count: 0, workers: [] };
+            await assert.rejects(withTeamTaskBarrier('membership-generation', cwd, () => commitTeamMembershipTaskTransaction('membership-generation', cwd, {
+                baseGeneration: 0,
+                tasks: [],
+                config: { oldBytes: oldConfig, newBytes: JSON.stringify(staleConfig, null, 2) },
+                manifest: { oldBytes: oldManifest, newBytes: JSON.stringify(staleManifest, null, 2) },
+            })), /team_membership_stale_generation:membership-generation:0:1/);
+            const [config, manifest] = await Promise.all([
+                readTeamConfig('membership-generation', cwd),
+                readTeamManifestV2('membership-generation', cwd),
+            ]);
+            assert.equal(config?.task, 'accepted update');
+            assert.equal(config?.config_generation, 1);
+            assert.equal(manifest?.config_generation, 1);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('serializes concurrent scale and shutdown membership generations', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-membership-concurrent-generation-'));
+        try {
+            await initTeamState('membership-concurrent', 'generation test', 'executor', 1, cwd);
+            const teamRoot = join(cwd, '.omx', 'state', 'team', 'membership-concurrent');
+            const [oldConfig, oldManifest] = await Promise.all([
+                readFile(join(teamRoot, 'config.json'), 'utf8'),
+                readFile(join(teamRoot, 'manifest.v2.json'), 'utf8'),
+            ]);
+            const commit = (task) => withTeamTaskBarrier('membership-concurrent', cwd, () => commitTeamMembershipTaskTransaction('membership-concurrent', cwd, {
+                baseGeneration: 0,
+                tasks: [],
+                config: { oldBytes: oldConfig, newBytes: JSON.stringify({ ...JSON.parse(oldConfig), task }, null, 2) },
+                manifest: { oldBytes: oldManifest, newBytes: JSON.stringify({ ...JSON.parse(oldManifest), task }, null, 2) },
+            }));
+            const results = await Promise.allSettled([commit('scale update'), commit('shutdown update')]);
+            assert.equal(results.filter((result) => result.status === 'fulfilled').length, 1);
+            assert.equal(results.filter((result) => result.status === 'rejected').length, 1);
+            const [config, manifest] = await Promise.all([
+                readTeamConfig('membership-concurrent', cwd),
+                readTeamManifestV2('membership-concurrent', cwd),
+            ]);
+            assert.equal(config?.config_generation, 1);
+            assert.equal(manifest?.config_generation, 1);
+            assert.ok(config?.task === 'scale update' || config?.task === 'shutdown update');
+            assert.equal(manifest?.task, config?.task);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it('initTeamState persists the default lifecycle profile', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-lifecycle-profile-'));
         try {
@@ -242,24 +385,26 @@ describe('team state', () => {
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('backfills missing or blank tmux pane owner ids in legacy manifests', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-pane-owner-backfill-'));
+    it('preserves missing or blank tmux pane owner ids as unavailable in legacy manifests', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-pane-owner-unavailable-'));
         try {
-            await initTeamState('team-pane-owner-backfill', 't', 'executor', 1, cwd);
-            const manifestPath = join(cwd, '.omx', 'state', 'team', 'team-pane-owner-backfill', 'manifest.v2.json');
+            await initTeamState('team-pane-owner-unavailable', 't', 'executor', 1, cwd);
+            const manifestPath = join(cwd, '.omx', 'state', 'team', 'team-pane-owner-unavailable', 'manifest.v2.json');
             const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
             delete manifest.tmux_pane_owner_id;
             await writeFile(manifestPath, JSON.stringify(manifest, null, 2));
-            const loadedManifest = await readTeamManifestV2('team-pane-owner-backfill', cwd);
-            const loadedConfig = await readTeamConfig('team-pane-owner-backfill', cwd);
-            assert.equal(loadedManifest?.tmux_pane_owner_id, 'team:team-pane-owner-backfill');
-            assert.equal(loadedConfig?.tmux_pane_owner_id, 'team:team-pane-owner-backfill');
+            const loadedManifest = await readTeamManifestV2('team-pane-owner-unavailable', cwd);
+            const loadedConfig = await readTeamConfig('team-pane-owner-unavailable', cwd);
+            assert.equal(loadedManifest?.tmux_pane_owner_id, undefined);
+            assert.equal(loadedConfig?.tmux_pane_owner_id, undefined);
             await writeTeamManifestV2({
                 ...loadedManifest,
                 tmux_pane_owner_id: '   ',
             }, cwd);
-            const blankNormalized = await readTeamManifestV2('team-pane-owner-backfill', cwd);
-            assert.equal(blankNormalized?.tmux_pane_owner_id, 'team:team-pane-owner-backfill');
+            const blankNormalized = await readTeamManifestV2('team-pane-owner-unavailable', cwd);
+            assert.equal(blankNormalized?.tmux_pane_owner_id, undefined);
+            const persisted = JSON.parse(await readFile(manifestPath, 'utf8'));
+            assert.equal(persisted.tmux_pane_owner_id, undefined);
         }
         finally {
             await rm(cwd, { recursive: true, force: true });
@@ -319,15 +464,20 @@ describe('team state', () => {
             const fakeBinDir = join(cwd, 'fake-bin');
             const runtimeLogPath = join(cwd, 'runtime.log');
             await mkdir(fakeBinDir, { recursive: true });
+            await writeFile(join(cwd, '.omx', 'state', 'dispatch.json'), JSON.stringify({ records: [] }));
             await writeFile(join(fakeBinDir, 'omx-runtime'), `#!/usr/bin/env bash
 set -eu
 printf '%s\n' "$*" >> "${runtimeLogPath}"
 if [[ "\${1:-}" == "schema" ]]; then
-  printf '{"schema_version":1,"commands":["acquire-authority","renew-authority","queue-dispatch","mark-notified","mark-delivered","mark-failed","request-replay","capture-snapshot"],"events":[],"transport":"tmux"}\n'
+  printf '{"schema_version":1,"commands":["acquire-authority","renew-authority","queue-dispatch","mark-notified","mark-delivered","mark-failed","remove-dispatch-records","request-replay","capture-snapshot"],"events":[],"transport":"tmux"}\n'
   exit 0
 fi
 if [[ "\${1:-}" == "exec" ]]; then
-  printf '{"event":"DispatchQueued","request_id":"ok","target":"worker-1"}\n'
+  if [[ "$*" == *'"command":"CaptureSnapshot"'* ]]; then
+    printf '{"event":"SnapshotCaptured"}\n'
+  else
+    printf '{"event":"DispatchQueued","request_id":"ok","target":"worker-1"}\n'
+  fi
   exit 0
 fi
 exit 1
@@ -358,36 +508,43 @@ exit 1
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('dispatch request store enqueues, dedupes, and transitions idempotently', async () => {
+    it('coalesces mailbox wakes only for an exact target proof and releases on acknowledgement', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-dispatch-store-'));
         try {
-            await initTeamState('team-dispatch', 't', 'executor', 1, cwd);
-            const first = await enqueueDispatchRequest('team-dispatch', {
-                kind: 'mailbox',
-                to_worker: 'worker-1',
-                message_id: 'msg-1',
-                trigger_message: 'check mailbox',
-                intent: 'pending-mailbox-review',
-            }, cwd);
-            assert.equal(first.deduped, false);
-            const dup = await enqueueDispatchRequest('team-dispatch', {
+            await initTeamState('team-dispatch', 't', 'executor', 2, cwd);
+            await initTeamState('team-dispatch-other', 't', 'executor', 1, cwd);
+            const input = (to_worker, message_id, pane_id = 'pane-1', intent = 'pending-mailbox-review') => ({
                 kind: 'mailbox',
-                to_worker: 'worker-1',
-                message_id: 'msg-1',
+                to_worker,
+                pane_id,
+                message_id,
                 trigger_message: 'check mailbox',
-            }, cwd);
-            assert.equal(dup.deduped, true);
-            assert.equal(dup.request.request_id, first.request.request_id);
+                intent,
+            });
+            const first = await enqueueDispatchRequest('team-dispatch', input('worker-1', 'msg-1'), cwd);
+            const pendingSibling = await enqueueDispatchRequest('team-dispatch', input('worker-1', 'msg-2'), cwd);
+            assert.equal(pendingSibling.deduped, true);
+            assert.equal(pendingSibling.request.request_id, first.request.request_id);
             const notified = await markDispatchRequestNotified('team-dispatch', first.request.request_id, {}, cwd);
             assert.equal(notified?.status, 'notified');
-            const notifiedAgain = await markDispatchRequestNotified('team-dispatch', first.request.request_id, {}, cwd);
-            assert.equal(notifiedAgain?.status, 'notified');
+            const notifiedSibling = await enqueueDispatchRequest('team-dispatch', input('worker-1', 'msg-3'), cwd);
+            assert.equal(notifiedSibling.deduped, true);
+            assert.equal(notifiedSibling.request.request_id, first.request.request_id);
+            const differentWorker = await enqueueDispatchRequest('team-dispatch', input('worker-2', 'msg-4'), cwd);
+            const differentPane = await enqueueDispatchRequest('team-dispatch', input('worker-1', 'msg-5', 'pane-2'), cwd);
+            const differentIntent = await enqueueDispatchRequest('team-dispatch', input('worker-1', 'msg-6', 'pane-1', 'followup-relaunch'), cwd);
+            const differentTeam = await enqueueDispatchRequest('team-dispatch-other', input('worker-1', 'msg-7'), cwd);
+            assert.equal(differentWorker.deduped, false);
+            assert.equal(differentPane.deduped, false);
+            assert.equal(differentIntent.deduped, false);
+            assert.equal(differentTeam.deduped, false);
             const delivered = await markDispatchRequestDelivered('team-dispatch', first.request.request_id, {}, cwd);
             assert.equal(delivered?.status, 'delivered');
-            const listed = await listDispatchRequests('team-dispatch', cwd);
-            assert.equal(listed.length, 1);
-            assert.equal(listed[0]?.message_id, 'msg-1');
-            assert.equal(listed[0]?.intent, 'pending-mailbox-review');
+            const successor = await enqueueDispatchRequest('team-dispatch', input('worker-1', 'msg-8'), cwd);
+            assert.equal(successor.deduped, false);
+            assert.notEqual(successor.request.request_id, first.request.request_id);
+            const listed = await listDispatchRequests('team-dispatch', cwd, { kind: 'mailbox' });
+            assert.equal(listed.length, 5);
         }
         finally {
             await rm(cwd, { recursive: true, force: true });
@@ -431,9 +588,195 @@ exit 1
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('preserves legacy rollback evidence when authoritative dispatch absence verification is unavailable', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-dispatch-authority-unavailable-'));
+        const previousRuntimeBinary = process.env.OMX_RUNTIME_BINARY;
+        const previousRuntimeBridge = process.env.OMX_RUNTIME_BRIDGE;
+        const previousSkipSnapshotWrite = process.env.OMX_TEST_SKIP_SNAPSHOT_COMPAT_WRITE;
+        try {
+            const teamName = 'dispatch-unavailable';
+            await initTeamState(teamName, 't', 'executor', 1, cwd);
+            const fakeBinDir = join(cwd, 'fake-bin');
+            await mkdir(fakeBinDir, { recursive: true });
+            const runtimePath = join(fakeBinDir, 'omx-runtime');
+            await writeCompatRuntimeFixture(runtimePath, join(cwd, 'runtime.log'));
+            process.env.OMX_RUNTIME_BINARY = runtimePath;
+            process.env.OMX_RUNTIME_BRIDGE = '1';
+            process.env.OMX_TEST_SKIP_SNAPSHOT_COMPAT_WRITE = '1';
+            const legacyPath = join(cwd, '.omx', 'state', 'team', teamName, 'dispatch', 'requests.json');
+            const legacyBytes = JSON.stringify([{
+                    request_id: 'legacy-preserved',
+                    kind: 'inbox',
+                    team_name: teamName,
+                    to_worker: 'worker-1',
+                    trigger_message: 'preserve rollback evidence',
+                    transport_preference: 'hook_preferred_with_fallback',
+                    fallback_allowed: true,
+                    status: 'pending',
+                    attempt_count: 0,
+                    created_at: '2026-01-01T00:00:00.000Z',
+                    updated_at: '2026-01-01T00:00:00.000Z',
+                }], null, 2);
+            await writeFile(legacyPath, legacyBytes);
+            const dispatchPath = join(cwd, '.omx', 'state', 'dispatch.json');
+            const unavailableFixtures = [
+                async () => { await rm(dispatchPath, { recursive: true, force: true }); },
+                async () => { await rm(dispatchPath, { recursive: true, force: true }); await writeFile(dispatchPath, '{'); },
+                async () => { await rm(dispatchPath, { recursive: true, force: true }); await writeFile(dispatchPath, JSON.stringify({ records: [{}] })); },
+                async () => { await rm(dispatchPath, { recursive: true, force: true }); await mkdir(dispatchPath); },
+            ];
+            for (const arrange of unavailableFixtures) {
+                await arrange();
+                await assert.rejects(() => removeDispatchRequestsForWorkers(teamName, ['worker-1'], cwd), /dispatch compatibility output/);
+                assert.equal(await readFile(legacyPath, 'utf8'), legacyBytes);
+            }
+        }
+        finally {
+            if (typeof previousRuntimeBinary === 'string')
+                process.env.OMX_RUNTIME_BINARY = previousRuntimeBinary;
+            else
+                delete process.env.OMX_RUNTIME_BINARY;
+            if (typeof previousRuntimeBridge === 'string')
+                process.env.OMX_RUNTIME_BRIDGE = previousRuntimeBridge;
+            else
+                delete process.env.OMX_RUNTIME_BRIDGE;
+            if (typeof previousSkipSnapshotWrite === 'string')
+                process.env.OMX_TEST_SKIP_SNAPSHOT_COMPAT_WRITE = previousSkipSnapshotWrite;
+            else
+                delete process.env.OMX_TEST_SKIP_SNAPSHOT_COMPAT_WRITE;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('scopes bridge rollback IDs to the target team legacy file and preserves same-target foreign records', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-dispatch-rollback-scope-'));
+        const previousRuntimeBinary = process.env.OMX_RUNTIME_BINARY;
+        const previousRuntimeBridge = process.env.OMX_RUNTIME_BRIDGE;
+        try {
+            await initTeamState('team-rollback-a', 't', 'executor', 1, cwd);
+            await initTeamState('team-rollback-b', 't', 'executor', 1, cwd);
+            const fakeBinDir = join(cwd, 'fake-bin');
+            const runtimeLogPath = join(cwd, 'runtime.log');
+            await mkdir(fakeBinDir, { recursive: true });
+            await writeCompatRuntimeFixture(join(fakeBinDir, 'omx-runtime'), runtimeLogPath);
+            process.env.OMX_RUNTIME_BINARY = join(fakeBinDir, 'omx-runtime');
+            process.env.OMX_RUNTIME_BRIDGE = '1';
+            process.env.OMX_RUNTIME_BRIDGE = '0';
+            const scopedRequest = await enqueueDispatchRequest('team-rollback-a', {
+                kind: 'inbox',
+                to_worker: 'worker-1',
+                trigger_message: 'rollback scoped request',
+            }, cwd);
+            process.env.OMX_RUNTIME_BRIDGE = '1';
+            const teamRoot = join(cwd, '.omx', 'state', 'team');
+            const legacyPath = join(teamRoot, 'team-rollback-a', 'dispatch', 'requests.json');
+            const rootDispatchPath = join(cwd, '.omx', 'state', 'dispatch.json');
+            const scopedRequestId = scopedRequest.request.request_id;
+            await writeFile(rootDispatchPath, JSON.stringify({ records: [
+                    { request_id: scopedRequestId, target: 'worker-1', status: 'pending', created_at: new Date().toISOString(), notified_at: null, delivered_at: null, failed_at: null, reason: null, metadata: { team_name: 'team-rollback-a' } },
+                    { request_id: 'team-b-worker-1', target: 'worker-1', status: 'pending', created_at: new Date().toISOString(), notified_at: null, delivered_at: null, failed_at: null, reason: null, metadata: { team_name: 'team-rollback-b' } },
+                    { request_id: 'unscoped-worker-1', target: 'worker-1', status: 'pending', created_at: new Date().toISOString(), notified_at: null, delivered_at: null, failed_at: null, reason: null, metadata: null },
+                ] }, null, 2));
+            await removeDispatchRequestsForWorkers('team-rollback-a', ['worker-1'], cwd);
+            assert.deepEqual(JSON.parse(await readFile(legacyPath, 'utf8')), []);
+            const runtimeLog = await readFile(runtimeLogPath, 'utf8');
+            const removalLine = runtimeLog.split('\n').find((line) => line.startsWith('exec {"command":"RemoveDispatchRecords"'));
+            assert.ok(removalLine);
+            const removalPayload = JSON.parse(removalLine.slice(removalLine.indexOf('{'), removalLine.lastIndexOf(' --state-dir=')));
+            assert.deepEqual(removalPayload.request_ids, [scopedRequestId]);
+            assert.match(runtimeLog, /CaptureSnapshot/);
+        }
+        finally {
+            if (typeof previousRuntimeBinary === 'string')
+                process.env.OMX_RUNTIME_BINARY = previousRuntimeBinary;
+            else
+                delete process.env.OMX_RUNTIME_BINARY;
+            if (typeof previousRuntimeBridge === 'string')
+                process.env.OMX_RUNTIME_BRIDGE = previousRuntimeBridge;
+            else
+                delete process.env.OMX_RUNTIME_BRIDGE;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('preserves malformed legacy rollback evidence byte-for-byte', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-dispatch-legacy-malformed-'));
+        const previousRuntimeBridge = process.env.OMX_RUNTIME_BRIDGE;
+        try {
+            const teamName = 'dispatch-legacy-malformed';
+            process.env.OMX_RUNTIME_BRIDGE = '0';
+            await initTeamState(teamName, 't', 'executor', 1, cwd);
+            const legacyPath = join(cwd, '.omx', 'state', 'team', teamName, 'dispatch', 'requests.json');
+            const legacyBytes = '{\n  "records": "not-an-array"\n}\n';
+            await writeFile(legacyPath, legacyBytes);
+            await assert.rejects(() => removeDispatchRequestsForWorkers(teamName, ['worker-1'], cwd), /legacy dispatch rollback evidence is malformed or unrecognized/);
+            assert.equal(await readFile(legacyPath, 'utf8'), legacyBytes);
+        }
+        finally {
+            if (typeof previousRuntimeBridge === 'string')
+                process.env.OMX_RUNTIME_BRIDGE = previousRuntimeBridge;
+            else
+                delete process.env.OMX_RUNTIME_BRIDGE;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('rejects an acknowledged retained dispatch ID even when its scope fields changed', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-dispatch-retained-id-'));
+        const previousRuntimeBinary = process.env.OMX_RUNTIME_BINARY;
+        const previousRuntimeBridge = process.env.OMX_RUNTIME_BRIDGE;
+        const previousAckRetain = process.env.OMX_TEST_ACK_RETAIN_DISPATCH;
+        try {
+            const teamName = 'dispatch-retained-id';
+            await initTeamState(teamName, 't', 'executor', 1, cwd);
+            const fakeBinDir = join(cwd, 'fake-bin');
+            await mkdir(fakeBinDir, { recursive: true });
+            const runtimePath = join(fakeBinDir, 'omx-runtime');
+            await writeCompatRuntimeFixture(runtimePath, join(cwd, 'runtime.log'));
+            process.env.OMX_RUNTIME_BINARY = runtimePath;
+            process.env.OMX_RUNTIME_BRIDGE = '0';
+            const queued = await enqueueDispatchRequest(teamName, {
+                kind: 'inbox',
+                to_worker: 'worker-1',
+                trigger_message: 'remove by exact ID',
+            }, cwd);
+            const legacyPath = join(cwd, '.omx', 'state', 'team', teamName, 'dispatch', 'requests.json');
+            const legacyBytes = await readFile(legacyPath, 'utf8');
+            const dispatchPath = join(cwd, '.omx', 'state', 'dispatch.json');
+            await writeFile(dispatchPath, JSON.stringify({ records: [{
+                        request_id: queued.request.request_id,
+                        target: 'worker-renamed',
+                        status: 'pending',
+                        created_at: '2026-01-01T00:00:00.000Z',
+                        notified_at: null,
+                        delivered_at: null,
+                        failed_at: null,
+                        reason: null,
+                        metadata: { team_name: 'different-team' },
+                    }] }, null, 2));
+            process.env.OMX_RUNTIME_BRIDGE = '1';
+            process.env.OMX_TEST_ACK_RETAIN_DISPATCH = '1';
+            await assert.rejects(() => removeDispatchRequestsForWorkers(teamName, ['worker-1'], cwd), /authoritative_dispatch_rollback_verification_failed/);
+            assert.equal(await readFile(legacyPath, 'utf8'), legacyBytes);
+        }
+        finally {
+            if (typeof previousRuntimeBinary === 'string')
+                process.env.OMX_RUNTIME_BINARY = previousRuntimeBinary;
+            else
+                delete process.env.OMX_RUNTIME_BINARY;
+            if (typeof previousRuntimeBridge === 'string')
+                process.env.OMX_RUNTIME_BRIDGE = previousRuntimeBridge;
+            else
+                delete process.env.OMX_RUNTIME_BRIDGE;
+            if (typeof previousAckRetain === 'string')
+                process.env.OMX_TEST_ACK_RETAIN_DISPATCH = previousAckRetain;
+            else
+                delete process.env.OMX_TEST_ACK_RETAIN_DISPATCH;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it('dispatch request store keeps failed requests failed while allowing reason patches', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-dispatch-store-failed-'));
+        const previousRuntimeBridge = process.env.OMX_RUNTIME_BRIDGE;
         try {
+            process.env.OMX_RUNTIME_BRIDGE = '0';
             await initTeamState('team-dispatch-failed', 't', 'executor', 1, cwd);
             const queued = await enqueueDispatchRequest('team-dispatch-failed', {
                 kind: 'inbox',
@@ -452,6 +795,10 @@ exit 1
             assert.equal(reread?.last_reason, 'fallback_confirmed_after_failed_receipt:tmux_send_keys_sent');
         }
         finally {
+            if (typeof previousRuntimeBridge === 'string')
+                process.env.OMX_RUNTIME_BRIDGE = previousRuntimeBridge;
+            else
+                delete process.env.OMX_RUNTIME_BRIDGE;
             await rm(cwd, { recursive: true, force: true });
         }
     });
@@ -476,6 +823,8 @@ exit 1
             assert.deepEqual(manifest?.worktree_mode, { enabled: true, detached: false, name: 'feature/team-meta' });
             assert.equal(manifest?.lifecycle_profile, 'default');
             assert.equal(manifest?.leader_pane_id, null);
+            assert.equal(manifest?.leader_pane_pid, null);
+            assert.equal(manifest?.hud_pane_pid, null);
             assert.equal(manifest?.hud_pane_id, null);
             assert.equal(manifest?.resize_hook_name, null);
             assert.equal(manifest?.resize_hook_target, null);
@@ -605,6 +954,72 @@ exit 1
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('claimTask revalidates a stale member under its claim lock when expectedVersion is null', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-claim-member-boundary-'));
+        try {
+            const teamName = 'team-claim-member-boundary';
+            await initTeamState(teamName, 't', 'executor', 2, cwd);
+            const task = await createTask(teamName, { subject: 'a', description: 'd', status: 'pending' }, cwd);
+            const claim = await claimTaskWithDeps(task.id, 'worker-2', null, {
+                teamName,
+                cwd,
+                readTask,
+                readTeamConfig,
+                withTaskClaimLock: async (_teamName, _taskId, _cwd, fn) => {
+                    const config = await readTeamConfig(teamName, cwd);
+                    assert.ok(config);
+                    config.workers = config.workers.filter((worker) => worker.name !== 'worker-2');
+                    await saveTeamConfig(config, cwd);
+                    return { ok: true, value: await fn() };
+                },
+                normalizeTask: (current) => current,
+                isTerminalTaskStatus: (status) => status === 'completed' || status === 'failed',
+                taskFilePath: (_teamName, taskId, _cwd) => join(cwd, '.omx', 'state', 'team', teamName, 'tasks', `task-${taskId}.json`),
+                writeAtomic,
+            });
+            assert.deepEqual(claim, { ok: false, error: 'worker_not_found' });
+            const persisted = await readTask(teamName, task.id, cwd);
+            assert.equal(persisted?.status, 'pending');
+            assert.equal(persisted?.owner, undefined);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('claimTask rejects a removed worker for a task created after the scale-down snapshot', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-claim-post-snapshot-'));
+        try {
+            const teamName = 'team-claim-post-snapshot';
+            await initTeamState(teamName, 't', 'executor', 2, cwd);
+            const scaleDownSnapshot = await readTeamConfig(teamName, cwd);
+            assert.ok(scaleDownSnapshot?.workers.some((worker) => worker.name === 'worker-2'));
+            const postSnapshotTask = await createTask(teamName, { subject: 'post snapshot', description: 'd', status: 'pending' }, cwd);
+            const claim = await claimTaskWithDeps(postSnapshotTask.id, 'worker-2', null, {
+                teamName,
+                cwd,
+                readTask,
+                readTeamConfig,
+                withTaskClaimLock: async (_teamName, _taskId, _cwd, fn) => {
+                    const config = await readTeamConfig(teamName, cwd);
+                    assert.ok(config);
+                    config.workers = config.workers.filter((worker) => worker.name !== 'worker-2');
+                    await saveTeamConfig(config, cwd);
+                    return { ok: true, value: await fn() };
+                },
+                normalizeTask: (current) => current,
+                isTerminalTaskStatus: (status) => status === 'completed' || status === 'failed',
+                taskFilePath: (_teamName, taskId, _cwd) => join(cwd, '.omx', 'state', 'team', teamName, 'tasks', `task-${taskId}.json`),
+                writeAtomic,
+            });
+            assert.deepEqual(claim, { ok: false, error: 'worker_not_found' });
+            const persisted = await readTask(teamName, postSnapshotTask.id, cwd);
+            assert.equal(persisted?.status, 'pending');
+            assert.equal(persisted?.owner, undefined);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it('claimTask recovers a stale task claim lock and proceeds', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-claim-stale-lock-'));
         try {
@@ -1653,6 +2068,216 @@ exit 1
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    for (const code of ['EINVAL', 'ENOTSUP', 'EISDIR']) {
+        it(`writeAtomic tolerates unsupported parent directory sync ${code} after fsyncing the file`, async () => {
+            const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
+            try {
+                const p = join(cwd, `atomic-parent-sync-${code}.txt`);
+                let fileSyncs = 0;
+                setWriteAtomicOpenForTests(async (...args) => {
+                    const [path] = args;
+                    const handle = await open(...args);
+                    const sync = handle.sync.bind(handle);
+                    handle.sync = async () => {
+                        if (path === cwd) {
+                            const error = new Error(`unsupported parent sync: ${code}`);
+                            error.code = code;
+                            throw error;
+                        }
+                        fileSyncs += 1;
+                        await sync();
+                    };
+                    return handle;
+                });
+                await writeAtomic(p, 'durable data');
+                assert.equal(fileSyncs, 1);
+                assert.equal(readFileSync(p, 'utf8'), 'durable data');
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        });
+    }
+    it('writeAtomic tolerates Windows EPERM opening the parent directory after fsyncing the file', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
+        try {
+            const p = join(cwd, 'atomic-parent-open-eperm.txt');
+            let fileSyncs = 0;
+            setWriteAtomicPlatformForTests('win32');
+            setWriteAtomicOpenForTests(async (...args) => {
+                const [path] = args;
+                if (path === cwd) {
+                    const error = new Error('Windows cannot open directory for sync');
+                    error.code = 'EPERM';
+                    throw error;
+                }
+                const handle = await open(...args);
+                const sync = handle.sync.bind(handle);
+                handle.sync = async () => {
+                    fileSyncs += 1;
+                    await sync();
+                };
+                return handle;
+            });
+            await writeAtomic(p, 'durable data');
+            assert.equal(fileSyncs, 1);
+            assert.equal(readFileSync(p, 'utf8'), 'durable data');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('writeAtomic tolerates Windows EPERM syncing the parent directory after fsyncing the file', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
+        try {
+            const p = join(cwd, 'atomic-parent-sync-eperm.txt');
+            let fileSyncs = 0;
+            setWriteAtomicPlatformForTests('win32');
+            setWriteAtomicOpenForTests(async (...args) => {
+                const [path] = args;
+                const handle = await open(...args);
+                const sync = handle.sync.bind(handle);
+                handle.sync = async () => {
+                    if (path === cwd) {
+                        const error = new Error('Windows cannot sync directory');
+                        error.code = 'EPERM';
+                        throw error;
+                    }
+                    fileSyncs += 1;
+                    await sync();
+                };
+                return handle;
+            });
+            await writeAtomic(p, 'durable data');
+            assert.equal(fileSyncs, 1);
+            assert.equal(readFileSync(p, 'utf8'), 'durable data');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('writeAtomic surfaces POSIX EPERM opening the parent directory after fsyncing the file', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
+        try {
+            const p = join(cwd, 'atomic-parent-open-posix-eperm.txt');
+            let fileSyncs = 0;
+            setWriteAtomicPlatformForTests('linux');
+            setWriteAtomicOpenForTests(async (...args) => {
+                const [path] = args;
+                if (path === cwd) {
+                    const error = new Error('POSIX parent open denied');
+                    error.code = 'EPERM';
+                    throw error;
+                }
+                const handle = await open(...args);
+                const sync = handle.sync.bind(handle);
+                handle.sync = async () => {
+                    fileSyncs += 1;
+                    await sync();
+                };
+                return handle;
+            });
+            await assert.rejects(() => writeAtomic(p, 'durable data'), (error) => {
+                return error.code === 'EPERM';
+            });
+            assert.equal(fileSyncs, 1);
+            assert.equal(readFileSync(p, 'utf8'), 'durable data');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('writeAtomic surfaces POSIX EPERM syncing the parent directory after fsyncing the file', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
+        try {
+            const p = join(cwd, 'atomic-parent-sync-posix-eperm.txt');
+            let fileSyncs = 0;
+            setWriteAtomicPlatformForTests('linux');
+            setWriteAtomicOpenForTests(async (...args) => {
+                const [path] = args;
+                const handle = await open(...args);
+                const sync = handle.sync.bind(handle);
+                handle.sync = async () => {
+                    if (path === cwd) {
+                        const error = new Error('POSIX parent sync denied');
+                        error.code = 'EPERM';
+                        throw error;
+                    }
+                    fileSyncs += 1;
+                    await sync();
+                };
+                return handle;
+            });
+            await assert.rejects(() => writeAtomic(p, 'durable data'), (error) => {
+                return error.code === 'EPERM';
+            });
+            assert.equal(fileSyncs, 1);
+            assert.equal(readFileSync(p, 'utf8'), 'durable data');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('writeAtomic surfaces unexpected parent directory open failures after fsyncing the file', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
+        try {
+            const p = join(cwd, 'atomic-parent-open-unexpected.txt');
+            let fileSyncs = 0;
+            setWriteAtomicOpenForTests(async (...args) => {
+                const [path] = args;
+                if (path === cwd) {
+                    const error = new Error('parent open failed');
+                    error.code = 'EIO';
+                    throw error;
+                }
+                const handle = await open(...args);
+                const sync = handle.sync.bind(handle);
+                handle.sync = async () => {
+                    fileSyncs += 1;
+                    await sync();
+                };
+                return handle;
+            });
+            await assert.rejects(() => writeAtomic(p, 'durable data'), (error) => {
+                return error.code === 'EIO';
+            });
+            assert.equal(fileSyncs, 1);
+            assert.equal(readFileSync(p, 'utf8'), 'durable data');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('writeAtomic surfaces unexpected parent directory sync failures after fsyncing the file', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
+        try {
+            const p = join(cwd, 'atomic-parent-sync-unexpected.txt');
+            let fileSyncs = 0;
+            setWriteAtomicOpenForTests(async (...args) => {
+                const [path] = args;
+                const handle = await open(...args);
+                const sync = handle.sync.bind(handle);
+                handle.sync = async () => {
+                    if (path === cwd) {
+                        const error = new Error('parent sync failed');
+                        error.code = 'EIO';
+                        throw error;
+                    }
+                    fileSyncs += 1;
+                    await sync();
+                };
+                return handle;
+            });
+            await assert.rejects(() => writeAtomic(p, 'durable data'), (error) => {
+                return error.code === 'EIO';
+            });
+            assert.equal(fileSyncs, 1);
+            assert.equal(readFileSync(p, 'utf8'), 'durable data');
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it('readWorkerStatus returns {state:\'unknown\'} on missing file', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-team-state-'));
         try {
@@ -1961,5 +2586,148 @@ exit 1
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('heartbeats live scaling and membership leases while reclaiming stale crashed locks', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-lock-lease-'));
+        const teamName = 'team-lock-lease';
+        const staleMs = 90;
+        const deps = {
+            teamDir: (name, root) => join(root, '.omx', 'state', 'team', name),
+            taskClaimLockDir: (name, taskId, root) => join(root, '.omx', 'state', 'team', name, 'claims', `task-${taskId}.lock`),
+            mailboxLockDir: (name, worker, root) => join(root, '.omx', 'state', 'team', name, 'mailboxes', `${worker}.lock`),
+        };
+        const locks = [
+            {
+                label: 'scaling',
+                lockDir: join(cwd, '.omx', 'state', '.team-locks', `${teamName}.scaling`),
+                acquire: (fn) => withScalingLeaseLock(teamName, cwd, staleMs, deps, fn),
+            },
+            {
+                label: 'membership',
+                lockDir: join(cwd, '.omx', 'state', '.team-locks', `${teamName}.membership`),
+                acquire: (fn) => withTeamLock(teamName, cwd, staleMs, deps, fn),
+            },
+        ];
+        try {
+            for (const lock of locks) {
+                let releaseHeld;
+                const heldRelease = new Promise((resolve) => { releaseHeld = resolve; });
+                let heldEntered;
+                const heldEnteredPromise = new Promise((resolve) => { heldEntered = resolve; });
+                const held = lock.acquire(async () => {
+                    heldEntered();
+                    await heldRelease;
+                });
+                await heldEnteredPromise;
+                let contenderEntered = false;
+                const contender = lock.acquire(async () => { contenderEntered = true; });
+                await new Promise((resolve) => setTimeout(resolve, staleMs * 3));
+                assert.equal(contenderEntered, false, `live ${lock.label} lock must not be reclaimed after its directory mtime becomes stale`);
+                releaseHeld();
+                await Promise.all([held, contender]);
+                await mkdir(lock.lockDir, { recursive: true });
+                await writeFile(join(lock.lockDir, 'owner'), 'crashed-owner');
+                await writeFile(join(lock.lockDir, 'lease'), 'crashed-owner');
+                const staleTime = new Date(Date.now() - staleMs * 2);
+                await utimes(lock.lockDir, staleTime, staleTime);
+                await utimes(join(lock.lockDir, 'lease'), staleTime, staleTime);
+                let reclaimed = false;
+                await lock.acquire(async () => { reclaimed = true; });
+                assert.equal(reclaimed, true, `stale ${lock.label} lock must be reclaimed after its lease expires`);
+            }
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('serializes cleanup with concurrent scaling and claims without recreating team state', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-team-cleanup-lock-race-'));
+        const teamName = 'team-cleanup-lock-race';
+        const teamRoot = join(cwd, '.omx', 'state', 'team', teamName);
+        let releaseScale;
+        const scaleReleased = new Promise((resolve) => { releaseScale = resolve; });
+        let scaleEntered;
+        const scaleEnteredPromise = new Promise((resolve) => { scaleEntered = resolve; });
+        try {
+            await initTeamState(teamName, 't', 'executor', 1, cwd);
+            const task = await createTask(teamName, { subject: 'racy', description: 'd', status: 'pending' }, cwd);
+            const scale = withScalingLock(teamName, cwd, async () => {
+                scaleEntered();
+                await scaleReleased;
+            });
+            await scaleEnteredPromise;
+            const cleanup = cleanupTeamState(teamName, cwd);
+            const claim = await claimTask(teamName, task.id, 'worker-1', task.version, cwd);
+            assert.equal(claim.ok, true, 'claim must finish before the queued cleanup deletes canonical state');
+            releaseScale();
+            await Promise.all([scale, cleanup]);
+            assert.equal(existsSync(teamRoot), false);
+            await assert.rejects(() => createTask(teamName, { subject: 'must not recreate', description: 'd', status: 'pending' }, cwd), /Team team-cleanup-lock-race not found/);
+            const afterCleanupClaim = await claimTask(teamName, task.id, 'worker-1', null, cwd);
+            assert.deepEqual(afterCleanupClaim, { ok: false, error: 'task_not_found' });
+            assert.equal(existsSync(teamRoot), false, 'post-cleanup operations must not recreate a fake team root');
+        }
+        finally {
+            releaseScale?.();
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+});
+describe('membership transaction recovery path authority', () => {
+    it('rejects foreign absolute paths before mutating any victim or canonical file', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-membership-foreign-path-'));
+        try {
+            const teamName = 'foreign-path';
+            await initTeamState(teamName, 'task', 'executor', 1, cwd);
+            const teamDir = join(cwd, '.omx', 'state', 'team', teamName);
+            const configPath = join(teamDir, 'config.json');
+            const configBytes = await readFile(configPath, 'utf8');
+            const victimPath = join(cwd, 'victim.txt');
+            await writeFile(victimPath, 'ORIGINAL');
+            await writeFile(join(teamDir, '.membership-task-transaction.json'), JSON.stringify({
+                schemaVersion: 1,
+                phase: 'committed',
+                files: [
+                    { path: configPath, oldBytes: configBytes, newBytes: configBytes },
+                    { path: victimPath, oldBytes: 'ORIGINAL', newBytes: 'PWNED' },
+                ],
+            }));
+            await assert.rejects(recoverTeamMembershipTaskTransaction(teamName, cwd), /escapes expected team files/);
+            assert.equal(await readFile(victimPath, 'utf8'), 'ORIGINAL');
+            assert.equal(await readFile(configPath, 'utf8'), configBytes);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('rejects a symlinked tasks directory before writing through it', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-membership-symlink-path-'));
+        try {
+            const teamName = 'symlink-path';
+            await initTeamState(teamName, 'task', 'executor', 1, cwd);
+            const teamDir = join(cwd, '.omx', 'state', 'team', teamName);
+            const configPath = join(teamDir, 'config.json');
+            const configBytes = await readFile(configPath, 'utf8');
+            const tasksDir = join(teamDir, 'tasks');
+            const outsideTasksDir = join(cwd, 'outside-tasks');
+            await rm(tasksDir, { recursive: true, force: true });
+            await mkdir(outsideTasksDir);
+            await writeFile(join(outsideTasksDir, 'task-1.json'), 'ORIGINAL');
+            await symlink(outsideTasksDir, tasksDir, 'dir');
+            await writeFile(join(teamDir, '.membership-task-transaction.json'), JSON.stringify({
+                schemaVersion: 1,
+                phase: 'committed',
+                files: [
+                    { path: configPath, oldBytes: configBytes, newBytes: configBytes },
+                    { path: join(tasksDir, 'task-1.json'), oldBytes: 'ORIGINAL', newBytes: 'PWNED' },
+                ],
+            }));
+            await assert.rejects(recoverTeamMembershipTaskTransaction(teamName, cwd), /tasks root escapes canonical team root/);
+            assert.equal(await readFile(join(outsideTasksDir, 'task-1.json'), 'utf8'), 'ORIGINAL');
+            assert.equal(await readFile(configPath, 'utf8'), configBytes);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
 });
 //# sourceMappingURL=state.test.js.map