oh-my-codex 0.20.3 → 0.21.0

package/dist/team/__tests__/scaling.test.js

@@ -4,14 +4,15 @@ import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { mkdtemp, rm, readFile, writeFile, mkdir, chmod, readdir, symlink } from 'fs/promises';
 import { join, posix, relative, win32 } from 'path';
-import { tmpdir } from 'os';
-import { existsSync, readFileSync } from 'fs';
+import { tmpdir as osTmpdir } from 'os';
+import { existsSync, readFileSync, realpathSync } from 'fs';
 import { initTeamState, createTask, claimTask, readTask, readTeamConfig, saveTeamConfig, readWorkerStatus, writeWorkerStatus, withScalingLock, recoverTeamMembershipTaskTransaction, commitTeamMembershipTaskTransaction, withTeamTaskBarrier, DEFAULT_MAX_WORKERS, listDispatchRequests, readTeamManifestV2, } from '../state.js';
 import { isSameOrInsidePath, isScalingEnabled, reconcileScaleDownCleanupDebt, scaleUp, scaleDown } from '../scaling.js';
 import { resolveCanonicalTeamStateRoot } from '../state-root.js';
 import { resolvePersistedApprovedTeamExecutionContinuityState, writePersistedApprovedTeamExecutionBinding, } from '../approved-execution.js';
 import { TEAM_WORKER_INHERITED_MODEL_ENV } from '../model-contract.js';
 import { buildWorkerProcessLaunchSpec } from '../tmux-session.js';
+const tmpdir = () => realpathSync(osTmpdir());
 delete process.env.OMX_TEAM_STATE_ROOT;
 process.env.OMX_RUNTIME_BRIDGE = '0';
 async function initCommittedGitRepo(cwd) {
@@ -31,6 +32,18 @@ async function initRepo() {
     execFileSync('git', ['commit', '-m', 'init'], { cwd, stdio: 'ignore' });
     return cwd;
 }
+/* Deadline-based appearance wait: unlike a fixed attempt-count poll, the budget
+ * scales with wall-clock time, so CI-load delays before the artifact is written
+ * do not expire the wait prematurely (issue #3548). Fails loudly on timeout. */
+async function waitForFileToAppear(path, timeoutMs = 5_000, pollIntervalMs = 5) {
+    const deadline = Date.now() + timeoutMs;
+    while (!existsSync(path)) {
+        if (Date.now() >= deadline) {
+            throw new Error(`timed out after ${timeoutMs}ms waiting for ${path} to appear`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+}
 function computeGitBlobSha1(content) {
     const buffer = Buffer.from(content, 'utf-8');
     const header = Buffer.from(`blob ${buffer.length}\0`, 'utf-8');
@@ -146,50 +159,88 @@ async function writeContextPack(cwd, slug, prdPath, testSpecPath, roles) {
 async function writeReadyContextPack(cwd, slug, prdPath, testSpecPath) {
     await writeContextPack(cwd, slug, prdPath, testSpecPath, ['scope', 'build', 'verify']);
 }
-async function writeSuccessfulScaleUpTmuxStub(fakeBinDir, tmuxLogPath) {
+async function writeSuccessfulScaleUpTmuxStub(fakeBinDir, tmuxLogPath, failGuardedSendKeys = false) {
     const tmuxStubPath = join(fakeBinDir, 'tmux');
     await writeFile(tmuxStubPath, [
         '#!/bin/sh',
         'set -eu',
         `printf '%s\n' "$*" >> "${tmuxLogPath}"`,
         'case "${1:-}" in',
-        '  show-option) echo "team:scale-up" ;;',
         '  -V)',
         '    echo "tmux 3.2a"',
         '    ;;',
-        '  split-window)',
-        '    echo "%31"',
-        '    ;;',
-        '  list-panes)',
+        '  display-message)',
         '    case "$*" in',
-        '      *"#{pane_id}\t#{pane_dead}\t#{pane_pid}"*)',
-        "        printf '%s\t%s\t%s\n' '%11' '0' '42411'",
-        "        printf '%s\t%s\t%s\n' '%21' '0' '42421'",
-        `        if [ ! -f "${join(fakeBinDir, 'killed-%31')}" ]; then printf '%s\\t%s\\t%s\\n' '%31' '0' '42424'; fi`,
-        '        ;;',
-        '      *)',
-        '        echo "42424"',
+        '      *"-t %32 "*) echo "%32\\t42425\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
+        '      *"-t %33 "*) echo "%33\\t42426\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
+        '      *"-t %31 "*) echo "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
+        '      *"-t %21 "*) echo "%21\\t42421\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
+        '      *) echo "%11\\t42411\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
+        '    esac',
+        '    ;;',
+        '  if-shell)',
+        '    case "${2:-}" in',
+        '      -F)',
+        '        if [ "${3:-}" = "-t" ]; then',
+        '          target="${4:-}"',
+        '          condition="${5:-}"',
+        '          success="${6:-}"',
+        '        else',
+        '          target=""',
+        '          condition="${3:-}"',
+        '          success="${4:-}"',
+        '        fi',
         '        ;;',
+        '      *) exit 1 ;;',
+        '    esac',
+        '    case "$target:$condition" in',
+        '      %21:*) ;;',
+        '      %31:*) ;;',
+        '      %32:*) ;;',
+        '      %33:*) ;;',
+        '      *) exit 1 ;;',
+        '    esac',
+        "    receipt=\"$(printf '%s' \"$success\" | sed -En 's/.*(omx-scale-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}).*/\\1/p')\"",
+        '    [ -n "$receipt" ] || exit 1',
+        '    case "$success" in',
+        `      *split-window*) case "$target" in %21) : > "${join(fakeBinDir, 'created-%31')}"; printf '%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n' '%31' '42424' 'omx-team-scale-up' '$1' '@1' "$receipt" ;; %31) : > "${join(fakeBinDir, 'created-%32')}"; printf '%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n' '%32' '42425' 'omx-team-scale-up' '$1' '@1' "$receipt" ;; %32) : > "${join(fakeBinDir, 'created-%33')}"; printf '%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n' '%33' '42426' 'omx-team-scale-up' '$1' '@1' "$receipt" ;; *) exit 1 ;; esac ;;`,
+        ...(failGuardedSendKeys ? ['      *send-keys*) exit 1 ;;'] : []),
+        '      *"\'set-option\'"*|*"\'send-keys\'"*|*"\'kill-pane\'"*|*set-option*|*send-keys*|*kill-pane*) printf "%s\\n" "$receipt" ;;',
+        '      *) exit 1 ;;',
         '    esac',
         '    ;;',
+        '  split-window)',
+        '    case "$*" in',
+        `      *"-t %21 "*) : > "${join(fakeBinDir, 'created-%31')}"; echo "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1" ;;`,
+        `      *"-t %31 "*) : > "${join(fakeBinDir, 'created-%32')}"; echo "%32\\t42425\\tomx-team-scale-up\\t\\$1\\t@1" ;;`,
+        `      *"-t %32 "*) : > "${join(fakeBinDir, 'created-%33')}"; echo "%33\\t42426\\tomx-team-scale-up\\t\\$1\\t@1" ;;`,
+        '      *) exit 1 ;;',
+        '    esac',
+        '    ;;',
+        '  list-panes)',
+        "    printf '%s\\t%s\\t%s\\n' '%11' '0' '42411'",
+        "    printf '%s\\t%s\\t%s\\n' '%21' '0' '42421'",
+        `    if [ -f "${join(fakeBinDir, 'created-%31')}" ] && [ ! -f "${join(fakeBinDir, 'killed-%31')}" ]; then printf '%s\\t%s\\t%s\\n' '%31' '0' '42424'; fi`,
+        `    if [ -f "${join(fakeBinDir, 'created-%32')}" ] && [ ! -f "${join(fakeBinDir, 'killed-%32')}" ]; then printf '%s\\t%s\\t%s\\n' '%32' '0' '42425'; fi`,
+        `    if [ -f "${join(fakeBinDir, 'created-%33')}" ] && [ ! -f "${join(fakeBinDir, 'killed-%33')}" ]; then printf '%s\\t%s\\t%s\\n' '%33' '0' '42426'; fi`,
+        '    ;;',
         '  show-option)',
         '    case "$*" in',
         '      *"@omx_team_pane_owner_id"*) echo "team:scale-up" ;;',
         '      *) exit 1 ;;',
         '    esac',
         '    ;;',
-        '  send-keys)',
-        '    ;;',
+        '  set-option) ;;',
+        '  send-keys) ;;',
         '  kill-pane)',
         `    : > "${join(fakeBinDir, 'killed-')}$3"`,
         '    ;;',
-        '  capture-pane)',
-        '    echo ""',
-        '    ;;',
+        '  capture-pane) echo "" ;;',
         'esac',
         'exit 0',
         '',
     ].join('\n'));
+    execFileSync('sh', ['-n', tmuxStubPath], { stdio: 'pipe' });
     await chmod(tmuxStubPath, 0o755);
     await writeFile(tmuxLogPath, '');
 }
@@ -199,7 +250,7 @@ async function configureScaleUpTeamForDirectDispatch(teamName, cwd) {
     if (!config) {
         throw new Error(`missing team config for ${teamName}`);
     }
-    config.tmux_session = `omx-team-${teamName}`;
+    config.tmux_session = 'omx-team-scale-up';
     config.tmux_pane_owner_id = 'team:scale-up';
     config.leader_pane_id = '%11';
     config.tmux_pane_owner_id = 'team:scale-up';
@@ -224,6 +275,15 @@ async function readScaleUpTmuxLogCommands(tmuxLogPath) {
     const trimmed = content.trim();
     return trimmed === '' ? [] : trimmed.split('\n');
 }
+function isGuardedScaleMutation(command, mutation, target) {
+    return command.startsWith('if-shell -F -t ')
+        && command.includes(mutation)
+        && (target === undefined || command.includes(`-t '${target}'`) || command.includes(`-t ${target}`))
+        && /omx-scale-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.test(command);
+}
+function guardedScaleSplitCount(commands) {
+    return commands.filter((command) => isGuardedScaleMutation(command, 'split-window')).length;
+}
 async function readScaleUpTaskPayloads(teamName, cwd) {
     const tasksDir = join(cwd, '.omx', 'state', 'team', teamName, 'tasks');
     if (!existsSync(tasksDir)) {
@@ -664,47 +724,9 @@ exit 0
         const cwd = await mkdtemp(join(tmpdir(), 'omx-scale-up-role-'));
         const fakeBinDir = await mkdtemp(join(tmpdir(), 'omx-scale-up-role-bin-'));
         const tmuxLogPath = join(fakeBinDir, 'tmux.log');
-        const tmuxStubPath = join(fakeBinDir, 'tmux');
         const previousPath = process.env.PATH;
         try {
-            await writeFile(tmuxStubPath, [
-                '#!/bin/sh',
-                'set -eu',
-                `printf '\%s\n' "$*" >> "${tmuxLogPath}"`,
-                'case "${1:-}" in',
-                '  show-option) echo "team:scale-up-role" ;;',
-                '  -V)',
-                '    echo "tmux 3.2a"',
-                '    ;;',
-                '  split-window)',
-                '    echo "%31"',
-                '    ;;',
-                '  list-panes)',
-                '    case "$*" in',
-                '      *"#{pane_id}\t#{pane_dead}\t#{pane_pid}"*)',
-                "        printf '%s\\t%s\\t%s\\n' '%11' '0' '42411'",
-                "        printf '%s\\t%s\\t%s\\n' '%21' '0' '42421'",
-                `        if [ ! -f "${join(fakeBinDir, 'scale-up-role-killed-%31')}" ]; then printf '%s\\t%s\\t%s\\n' '%31' '0' '42424'; fi`,
-                '        ;;',
-                '      *)',
-                '        echo "42424"',
-                '        ;;',
-                '    esac',
-                '    ;;',
-                '  send-keys)',
-                '    ;;',
-                '  kill-pane)',
-                `    : > "${join(fakeBinDir, 'scale-up-role-killed-')}$3"`,
-                '    ;;',
-                '  capture-pane)',
-                '    echo ""',
-                '    ;;',
-                'esac',
-                'exit 0',
-                '',
-            ].join('\n'));
-            await chmod(tmuxStubPath, 0o755);
-            await writeFile(tmuxLogPath, '');
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, tmuxLogPath);
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             await mkdir(join(cwd, '.codex', 'prompts'), { recursive: true });
             await writeFile(join(cwd, '.codex', 'prompts', 'writer.md'), '<identity>You are Writer.</identity>');
@@ -721,9 +743,9 @@ exit 0
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = 'omx-team-scale-up-role';
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
-            config.tmux_pane_owner_id = 'team:scale-up-role';
+            config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
             config.workers[0].pid = 42421;
             await saveTeamConfig(config, cwd);
@@ -735,7 +757,7 @@ exit 0
             };
             await writeFile(manifestPath, JSON.stringify(manifest, null, 2));
             const result = await scaleUp('scale-up-role', 1, 'executor', [{ subject: 'document routing report only', description: 'document routing report only', owner: 'worker-2', role: 'writer' }], cwd, { OMX_TEAM_SCALING_ENABLED: '1', OMX_TEAM_SKIP_READY_WAIT: '1' });
-            assert.equal(result.ok, true);
+            assert.equal(result.ok, true, result.ok ? 'ok' : result.error);
             if (!result.ok)
                 return;
             const createdTask = await readTask('scale-up-role', '2', cwd);
@@ -747,7 +769,8 @@ exit 0
             assert.match(inbox, /Task 2/);
             assert.match(inbox, /Role: writer/);
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-            assert.ok(tmuxCommands.some((command) => (command === 'set-option -p -t %31 @omx_team_pane_owner_id team:scale-up-role')));
+            assert.ok(tmuxCommands.some((command) => (isGuardedScaleMutation(command, 'set-option', '%31')
+                && command.includes('@omx_team_pane_owner_id'))));
         }
         finally {
             if (typeof previousPath === 'string')
@@ -866,8 +889,27 @@ printf '%s\\n' "$@" > '${capturePath}'
                 '  -V)',
                 '    echo "tmux 3.2a"',
                 '    ;;',
+                '  display-message)',
+                '    case "$*" in',
+                '      *"-t %31 "*) echo "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up-owner-tag-rollback" ;;',
+                '      *"-t %21 "*) echo "%21\\t42421\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up-owner-tag-rollback" ;;',
+                '      *) exit 1 ;;',
+                '    esac',
+                '    ;;',
+                '  if-shell)',
+                '    [ "${2:-}" = "-F" ] && [ "${3:-}" = "-t" ] || exit 1',
+                '    success="${6:-}"',
+                "    receipt=\"$(printf '%s' \"$success\" | sed -En 's/.*(omx-scale-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}).*/\\1/p')\"",
+                '    [ -n "$receipt" ] || exit 1',
+                '    case "$success" in',
+                '      *split-window*) printf "%s\\t%s\\n" "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1" "$receipt" ;;',
+                '      *set-option*) exit 1 ;;',
+                '      *kill-pane*) printf "%s\\n" "$receipt" ;;',
+                '      *) exit 1 ;;',
+                '    esac',
+                '    ;;',
                 '  split-window)',
-                '    echo "%31"',
+                '    echo "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1"',
                 '    ;;',
                 '  set-option)',
                 '    case "$*" in',
@@ -898,6 +940,7 @@ printf '%s\\n' "$@" > '${capturePath}'
                 '',
             ].join('\n'));
             await chmod(tmuxStubPath, 0o755);
+            execFileSync('sh', ['-n', tmuxStubPath], { stdio: 'pipe' });
             await writeFile(tmuxLogPath, '');
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             process.env.OMX_RUNTIME_BRIDGE = '0';
@@ -913,19 +956,11 @@ printf '%s\\n' "$@" > '${capturePath}'
             assert.equal(result.ok, false);
             if (result.ok)
                 return;
-            assert.match(result.error, /scale_up_rollback_cleanup_debt:pane_owner_unverified:%31/);
+            assert.equal(result.error, 'scale_up_split_target_authority_lost:%21');
             const config = await readTeamConfig('scale-up-owner-tag-rollback', cwd);
-            assert.deepEqual(config?.workers.map((worker) => worker.name), ['worker-1', 'worker-2']);
-            assert.equal(config?.workers[1]?.pane_id, '%31');
-            assert.equal(config?.next_worker_index, 3);
-            assert.equal((await readTask('scale-up-owner-tag-rollback', '1', cwd))?.owner, 'worker-2');
-            assert.equal(existsSync(join(cwd, '.omx', 'state', 'team', 'scale-up-owner-tag-rollback', 'workers', 'worker-2', 'identity.json')), false);
-            assert.equal(existsSync(join(cwd, '.omx', 'state', 'team', 'scale-up-owner-tag-rollback', 'workers', 'worker-2', 'inbox.md')), false);
-            const dispatch = JSON.parse(await readFile(join(cwd, '.omx', 'state', 'team', 'scale-up-owner-tag-rollback', 'dispatch', 'requests.json'), 'utf8'));
-            assert.equal(dispatch.some((request) => request.to_worker === 'worker-2'), false);
-            assert.equal((await listDispatchRequests('scale-up-owner-tag-rollback', cwd, { to_worker: 'worker-2' })).length, 0);
+            assert.deepEqual(config?.workers.map((worker) => worker.name), ['worker-1']);
+            assert.equal(await readTask('scale-up-owner-tag-rollback', '1', cwd), null);
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-            assert.ok(tmuxCommands.some((command) => (command === 'set-option -p -t %31 @omx_team_pane_owner_id team:scale-up-owner-tag-rollback')));
             assert.equal(tmuxCommands.some((command) => command === 'kill-pane -t %31'), false);
         }
         finally {
@@ -956,6 +991,7 @@ printf '%s\\n' "$@" > '${capturePath}'
                 'case "${1:-}" in',
                 '  -V) echo "tmux 3.2a" ;;',
                 '  show-option) echo "team:scale-up" ;;',
+                '  display-message) echo "%21\\t42421\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
                 '  split-window) : > "' + splitPath + '"; echo "%31" ;;',
                 '  list-panes)',
                 '    if [ -f "' + splitPath + '" ]; then printf "malformed pane snapshot\\n"; else',
@@ -979,10 +1015,9 @@ printf '%s\\n' "$@" > '${capturePath}'
             assert.equal(result.ok, false);
             if (result.ok)
                 return;
-            assert.match(result.error, /scale_up_rollback_cleanup_debt:pane_pid_unpinned:%31/);
+            assert.match(result.error, /scale_up_split_target_authority_lost:%21/);
             const config = await readTeamConfig(teamName, cwd);
-            assert.equal(config?.workers[1]?.pane_id, '%31');
-            assert.equal(config?.workers[1]?.pid, undefined);
+            assert.equal(config?.workers.length, 1);
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
             assert.equal(tmuxCommands.some((command) => command === 'kill-pane -t %31'), false);
         }
@@ -1008,8 +1043,27 @@ printf '%s\\n' "$@" > '${capturePath}'
                 `printf '%s\\n' "$*" >> "${tmuxLogPath}"`,
                 'case "${1:-}" in',
                 '  show-option) echo "team:scale-up" ;;',
+                '  display-message)',
+                '    case "$*" in',
+                '      *"-t %31 "*) echo "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
+                '      *"-t %21 "*) echo "%21\\t42421\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
+                '      *) exit 1 ;;',
+                '    esac',
+                '    ;;',
+                '  if-shell)',
+                '    [ "${2:-}" = "-F" ] && [ "${3:-}" = "-t" ] || exit 1',
+                '    success="${6:-}"',
+                "    receipt=\"$(printf '%s' \"$success\" | sed -En 's/.*(omx-scale-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}).*/\\1/p')\"",
+                '    [ -n "$receipt" ] || exit 1',
+                '    case "$success" in',
+                '      *set-option*) printf "recycled\\n" ;;',
+                '      *split-window*) printf "%s\\t%s\\n" "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1" "$receipt" ;;',
+                '      *kill-pane*) printf "%s\\n" "$receipt" ;;',
+                '      *) exit 1 ;;',
+                '    esac',
+                '    ;;',
                 '  -V) echo "tmux 3.2a" ;;',
-                '  split-window) echo "%31" ;;',
+                '  split-window) echo "%31\\t42424\\tomx-team-scale-up\\t\\$1\\t@1" ;;',
                 '  list-panes)',
                 `    count_file="${join(fakeBinDir, 'proof-count')}"`,
                 '    count=0; [ ! -f "$count_file" ] || count=$(cat "$count_file")',
@@ -1030,6 +1084,7 @@ printf '%s\\n' "$@" > '${capturePath}'
                 '',
             ].join('\n'));
             await chmod(tmuxStubPath, 0o755);
+            execFileSync('sh', ['-n', tmuxStubPath], { stdio: 'pipe' });
             await writeFile(tmuxLogPath, '');
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             const teamName = 'scale-up-owner-tag-reuse';
@@ -1041,13 +1096,10 @@ printf '%s\\n' "$@" > '${capturePath}'
             assert.equal(result.ok, false);
             if (result.ok)
                 return;
-            assert.match(result.error, /scale_up_rollback_cleanup_debt:pane_owner_unverified:%31/);
+            assert.equal(result.error, 'scale_up_split_target_authority_lost:%21');
             const config = await readTeamConfig(teamName, cwd);
-            assert.equal(config?.workers[1]?.pane_id, '%31');
-            assert.equal(config?.workers[1]?.pid, 42424);
+            assert.deepEqual(config?.workers.map((worker) => worker.name), ['worker-1']);
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-            assert.equal(tmuxCommands.some((command) => command.includes('set-option -p -t %31 @omx_team_pane_owner_id')), false);
-            assert.equal(tmuxCommands.some((command) => command.startsWith('split-window ')), true);
             assert.equal(tmuxCommands.some((command) => command === 'kill-pane -t %31'), false);
         }
         finally {
@@ -1093,7 +1145,7 @@ printf '%s\\n' "$@" > '${capturePath}'
             assert.match(inbox, /G001-team-runtime-bridge/);
             assert.match(inbox, /workers do not own Ultragoal goal state/i);
             assert.match(inbox, /omx ultragoal checkpoint --goal-id G001-team-runtime-bridge/);
-            assert.ok(tmuxCommands.some((command) => command.startsWith('split-window ')));
+            assert.equal(guardedScaleSplitCount(tmuxCommands), 1);
         }
         finally {
             if (typeof previousPath === 'string')
@@ -1124,7 +1176,7 @@ printf '%s\\n' "$@" > '${capturePath}'
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
             assert.match(inbox, /Implement generic follow-up/);
             assert.doesNotMatch(inbox, /## Approved Handoff Context/);
-            assert.ok(tmuxCommands.some((command) => command.startsWith('split-window ')));
+            assert.equal(guardedScaleSplitCount(tmuxCommands), 1);
         }
         finally {
             if (typeof previousPath === 'string')
@@ -1158,7 +1210,7 @@ printf '%s\\n' "$@" > '${capturePath}'
             assert.match(inbox, /## Approved Handoff Context/);
             assert.match(inbox, /Use the approved plan and matching test specs as the execution baseline/);
             assert.doesNotMatch(inbox, /Approved context pack|Context pack index/);
-            assert.ok(tmuxCommands.some((command) => command.startsWith('split-window ')));
+            assert.equal(guardedScaleSplitCount(tmuxCommands), 1);
         }
         finally {
             if (typeof previousPath === 'string')
@@ -1214,7 +1266,7 @@ printf '%s\\n' "$@" > '${capturePath}'
             assert.match(inbox, /Read the approved repository slice first\./);
             assert.match(inbox, /Use the approved plan and matching test specs as the execution baseline/);
             assert.doesNotMatch(inbox, /Approved context pack|Build refs|Verify refs|Scope refs|query the canonical pack|Context pack index/);
-            assert.ok(tmuxCommands.some((command) => command.startsWith('split-window ')));
+            assert.equal(guardedScaleSplitCount(tmuxCommands), 1);
         }
         finally {
             if (typeof previousPath === 'string')
@@ -1246,7 +1298,7 @@ printf '%s\\n' "$@" > '${capturePath}'
                     const tasks = buildScaleUpScenarioTasks(state, count);
                     const result = await scaleUp(teamName, count, 'executor', tasks, cwd, { OMX_TEAM_SCALING_ENABLED: '1', OMX_TEAM_SKIP_READY_WAIT: '1' });
                     const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-                    const splitWindowCommands = tmuxCommands.filter((command) => command.startsWith('split-window '));
+                    const splitWindowCommands = tmuxCommands.filter((command) => isGuardedScaleMutation(command, 'split-window'));
                     const inboxes = await Promise.all(tasks.map(async (task) => {
                         const inboxPath = join(cwd, '.omx', 'state', 'team', teamName, 'workers', task.owner, 'inbox.md');
                         return existsSync(inboxPath)
@@ -1402,6 +1454,7 @@ printf '%s\\n' "$@" > '${capturePath}'
                 '',
             ].join('\n'));
             await chmod(tmuxStubPath, 0o755);
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, tmuxLogPath);
             await writeFile(tmuxLogPath, '');
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             delete process.env.CODEX_HOME;
@@ -1433,7 +1486,7 @@ printf '%s\\n' "$@" > '${capturePath}'
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = 'omx-team-scale-up-project-reasoning';
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
@@ -1485,44 +1538,9 @@ printf '%s\\n' "$@" > '${capturePath}'
     it('removes generated worktree-root AGENTS when scale-up rolls back', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-scale-up-rollback-worktree-'));
         const fakeBinDir = await mkdtemp(join(tmpdir(), 'omx-scale-up-rollback-worktree-bin-'));
-        const tmuxStubPath = join(fakeBinDir, 'tmux');
         const previousPath = process.env.PATH;
         try {
-            await writeFile(tmuxStubPath, `#!/bin/sh
-set -eu
-	case "\${1:-}" in
-  show-option) echo 'team:scale-up' ;;
-  -V)
-    echo "tmux 3.2a"
-    ;;
-  split-window)
-    echo "%31"
-    ;;
-  list-panes)
-    case "$*" in
-      *"#{pane_id}\t#{pane_dead}\t#{pane_pid}"*)
-        printf '%s\t%s\t%s\n' '%11' '0' '42411'
-        printf '%s\t%s\t%s\n' '%21' '0' '42421'
-        if [ ! -f "${fakeBinDir}/killed-%31" ]; then printf '%s\t%s\t%s\n' '%31' '0' '42424'; fi
-        ;;
-      *)
-        echo "42424"
-        ;;
-    esac
-    ;;
-  send-keys)
-    exit 1
-    ;;
-  kill-pane)
-    : > "${fakeBinDir}/killed-$3"
-    ;;
-  capture-pane)
-    echo ""
-    ;;
-esac
-exit 0
-`);
-            await chmod(tmuxStubPath, 0o755);
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, join(fakeBinDir, 'tmux.log'), true);
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             await mkdir(join(cwd, '.codex', 'prompts'), { recursive: true });
             await writeFile(join(cwd, '.codex', 'prompts', 'writer.md'), '<identity>You are Writer.</identity>');
@@ -1537,7 +1555,7 @@ exit 0
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = 'omx-team-rollback-worktree';
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
@@ -1607,6 +1625,7 @@ esac
 exit 0
 `);
             await chmod(tmuxStubPath, 0o755);
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, join(fakeBinDir, 'tmux.log'));
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             await mkdir(join(cwd, '.codex', 'prompts'), { recursive: true });
             await writeFile(join(cwd, '.codex', 'prompts', 'writer.md'), '<identity>You are Writer.</identity>');
@@ -1621,7 +1640,7 @@ exit 0
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = 'omx-team-canonical-root';
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
@@ -1698,6 +1717,7 @@ esac
 exit 0
 `);
             await chmod(tmuxStubPath, 0o755);
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, join(fakeBinDir, 'tmux.log'));
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             await mkdir(join(cwd, '.codex', 'prompts'), { recursive: true });
             await writeFile(join(cwd, '.codex', 'prompts', 'test-engineer.md'), '<identity>Test Engineer</identity>');
@@ -1714,7 +1734,7 @@ exit 0
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = 'omx-team-frontier-role';
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
@@ -1783,6 +1803,7 @@ esac
 exit 0
 `);
             await chmod(tmuxStubPath, 0o755);
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, join(fakeBinDir, 'tmux.log'));
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             await mkdir(join(cwd, '.codex', 'prompts'), { recursive: true });
             await writeFile(join(cwd, '.codex', 'prompts', 'writer.md'), '<identity>You are Writer.</identity>');
@@ -1797,7 +1818,7 @@ exit 0
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = 'omx-team-mini-tuned-root';
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
@@ -1836,50 +1857,16 @@ exit 0
         const cwd = await mkdtemp(join(tmpdir(), 'omx-scale-up-layout-'));
         const fakeBinDir = await mkdtemp(join(tmpdir(), 'omx-scale-up-layout-bin-'));
         const tmuxLogPath = join(fakeBinDir, 'tmux.log');
-        const tmuxStubPath = join(fakeBinDir, 'tmux');
         const previousPath = process.env.PATH;
         try {
-            await writeFile(tmuxStubPath, `#!/bin/sh
-set -eu
-printf '%s\\n' "$*" >> "${tmuxLogPath}"
-case "\${1:-}" in
-  show-option) echo 'team:scale-up' ;;
-  -V)
-    echo "tmux 3.2a"
-    ;;
-  split-window)
-    echo "%31"
-    ;;
-  list-panes)
-    case "$*" in
-      *"#{pane_id}\t#{pane_dead}\t#{pane_pid}"*)
-        printf '%s\t%s\t%s\n' '%11' '0' '42411'
-        printf '%s\t%s\t%s\n' '%21' '0' '42421'
-        if [ ! -f "${fakeBinDir}/layout-killed-%31" ]; then printf '%s\t%s\t%s\n' '%31' '0' '42424'; fi
-        ;;
-      *)
-        echo "42424"
-        ;;
-    esac
-    ;;
-  capture-pane)
-    echo ""
-    ;;
-  kill-pane)
-    : > "${fakeBinDir}/layout-killed-$3"
-    ;;
-esac
-exit 0
-`);
-            await chmod(tmuxStubPath, 0o755);
-            await writeFile(tmuxLogPath, '');
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, tmuxLogPath);
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             await initTeamState('scale-up-layout', 'task', 'executor', 1, cwd);
             const config = await readTeamConfig('scale-up-layout', cwd);
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = 'omx-team-scale-up-layout';
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
@@ -1897,12 +1884,18 @@ exit 0
             if (!result.ok)
                 return;
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-            const splitWindowIndex = tmuxCommands.findIndex((command) => command.startsWith('split-window '));
-            assert.ok(splitWindowIndex > 2);
-            assert.match(tmuxCommands[splitWindowIndex - 3], /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/);
-            assert.equal(tmuxCommands[splitWindowIndex - 2], 'show-option -qv -p -t %21 @omx_team_pane_owner_id');
-            assert.match(tmuxCommands[splitWindowIndex - 1], /^list-panes -a -F #\{pane_id\}\t#\{pane_dead\}\t#\{pane_pid\}$/);
-            assert.match(tmuxCommands[splitWindowIndex], /split-window -v -t %21/);
+            const guardedSplit = tmuxCommands.find((command) => command.startsWith('if-shell -F -t %21 '));
+            assert.match(guardedSplit ?? '', /#\{==:#\{pane_id\},%21\}/);
+            assert.match(guardedSplit ?? '', /#\{==:#\{pane_pid\},42421\}/);
+            assert.match(guardedSplit ?? '', /#\{==:#\{session_name\},omx-team-scale-up\}/);
+            assert.match(guardedSplit ?? '', /#\{==:#\{session_id\},\$1\}/);
+            assert.match(guardedSplit ?? '', /#\{==:#\{window_id\},@1\}/);
+            assert.match(guardedSplit ?? '', /#\{==:#\{@omx_team_pane_owner_id\},team:scale-up\}/);
+            assert.match(guardedSplit ?? '', /split-window/);
+            const plainScaleMutations = tmuxCommands.filter((command) => /^(?:split-window|set-option|send-keys|kill-pane)\b/.test(command));
+            assert.deepEqual(plainScaleMutations, []);
+            assert.ok(tmuxCommands.some((command) => isGuardedScaleMutation(command, 'set-option', '%31')));
+            assert.ok(tmuxCommands.some((command) => isGuardedScaleMutation(command, 'send-keys', '%31')));
             assert.doesNotMatch(tmuxCommands.join('\n'), /select-layout .*tiled/);
         }
         finally {
@@ -2002,7 +1995,7 @@ exit 0
             assert.equal(result.ok, true);
             assert.equal((await readTeamConfig(teamName, cwd))?.workers[0]?.pid, 42421);
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-            assert.ok(tmuxCommands.some((command) => command.startsWith('split-window ')));
+            assert.equal(guardedScaleSplitCount(tmuxCommands), 1);
         }
         finally {
             if (typeof previousPath === 'string')
@@ -2112,6 +2105,7 @@ exit 0
                 '  -V)',
                 '    echo "tmux 3.2a"',
                 '    ;;',
+                '  display-message) echo "%21\\t42421\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
                 '  list-panes)',
                 `    count=0; [ ! -f "${proofCountPath}" ] || count=$(cat "${proofCountPath}")`,
                 '    count=$((count + 1))',
@@ -2122,8 +2116,14 @@ exit 0
                 '      exit 1',
                 '    fi',
                 '    ;;',
-                '  split-window)',
-                '    echo "%31"',
+                '  if-shell)',
+                '    [ "${2:-}" = "-F" ] && [ "${3:-}" = "-t" ] || exit 1',
+                '    success="${6:-}"',
+                "    receipt=\"$(printf '%s' \"$success\" | sed -En 's/.*(omx-scale-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}).*/\\1/p')\"",
+                '    case "$success" in',
+                '      *split-window*) printf "%s\\t%s\\n" "%31\\t42424\\tomx-team-scale-up\\t$1\\t@1" "$receipt" ;;',
+                '      *) printf "%s\\n" "$receipt" ;;',
+                '    esac',
                 '    ;;',
                 'esac',
                 'exit 0',
@@ -2147,14 +2147,14 @@ exit 0
             const result = await scaleUp(teamName, 1, 'executor', [{ subject: 'must not persist', description: 'proof loss rollback', owner: 'worker-2' }], cwd, { OMX_TEAM_SCALING_ENABLED: '1', OMX_TEAM_SKIP_READY_WAIT: '1' });
             assert.deepEqual(result, {
                 ok: false,
-                error: 'scale_up_split_target_proof_unavailable:%21:query_failed',
+                error: 'scale_up_split_target_proof_unavailable:%21',
             });
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
             assert.deepEqual(tmuxCommands.filter((command) => command.startsWith('list-panes ')), [
                 'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}',
                 'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}',
             ]);
-            assert.equal(tmuxCommands.some((command) => command.startsWith('split-window ')), false);
+            assert.equal(guardedScaleSplitCount(tmuxCommands), 0);
             assert.equal(tmuxCommands.some((command) => command.startsWith('send-keys ')), false);
             assert.deepEqual(withoutConfigGeneration(await readFile(configPath, 'utf-8')), withoutConfigGeneration(configBefore));
             assert.deepEqual((await readdir(tasksDir)).sort(), taskEntriesBefore);
@@ -2189,6 +2189,7 @@ exit 0
                 '  -V)',
                 '    echo "tmux 3.2a"',
                 '    ;;',
+                '  display-message) echo "%21\\t42421\\tomx-team-scale-up\\t\\$1\\t@1\\tteam:scale-up" ;;',
                 '  list-panes)',
                 `    count=0; [ ! -f "${proofCountPath}" ] || count=$(cat "${proofCountPath}")`,
                 '    count=$((count + 1))',
@@ -2230,12 +2231,11 @@ exit 0
             const result = await scaleUp(teamName, 1, 'executor', [{ subject: 'must not persist', description: 'PID reuse rollback', owner: 'worker-2' }], cwd, { OMX_TEAM_SCALING_ENABLED: '1', OMX_TEAM_SKIP_READY_WAIT: '1' });
             assert.deepEqual(result, {
                 ok: false,
-                error: 'scale_up_split_target_pid_changed:%21:42421:52421',
+                error: 'scale_up_split_target_authority_lost:%21',
             });
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
             assert.equal(tmuxCommands.filter((command) => command.startsWith('list-panes ')).length, 2);
-            assert.equal(tmuxCommands.some((command) => command.startsWith('split-window ')), false);
-            assert.equal(tmuxCommands.some((command) => command.startsWith('send-keys ')), false);
+            assert.equal(tmuxCommands.some((command) => isGuardedScaleMutation(command, 'send-keys')), false);
             assert.deepEqual(withoutConfigGeneration(await readFile(configPath, 'utf-8')), withoutConfigGeneration(configBefore));
             assert.deepEqual((await readdir(tasksDir)).sort(), taskEntriesBefore);
             assert.deepEqual((await readdir(workersDir)).sort(), workerEntriesBefore);
@@ -2290,6 +2290,7 @@ exit 0
                 '',
             ].join('\n'));
             await chmod(tmuxStubPath, 0o755);
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, tmuxLogPath);
             await writeFile(tmuxLogPath, '');
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             const teamName = 'scale-up-detached-worktree';
@@ -2305,11 +2306,11 @@ exit 0
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = `omx-team-${teamName}`;
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
-            config.workers[0].pid = 45452;
+            config.workers[0].pid = 42421;
             await saveTeamConfig(config, repo);
             const manifestPath = join(repo, '.omx', 'state', 'team', teamName, 'manifest.v2.json');
             const manifest = JSON.parse(await readFile(manifestPath, 'utf-8'));
@@ -2380,6 +2381,7 @@ exit 0
                 '',
             ].join('\n'));
             await chmod(tmuxStubPath, 0o755);
+            await writeSuccessfulScaleUpTmuxStub(fakeBinDir, tmuxLogPath);
             await writeFile(tmuxLogPath, '');
             process.env.PATH = `${fakeBinDir}:${previousPath ?? ''}`;
             const teamName = 'scale-up-named-worktree';
@@ -2396,11 +2398,11 @@ exit 0
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = `omx-team-${teamName}`;
+            config.tmux_session = 'omx-team-scale-up';
             config.leader_pane_id = '%11';
             config.tmux_pane_owner_id = 'team:scale-up';
             config.workers[0].pane_id = '%21';
-            config.workers[0].pid = 46462;
+            config.workers[0].pid = 42421;
             await saveTeamConfig(config, repo);
             const manifestPath = join(repo, '.omx', 'state', 'team', teamName, 'manifest.v2.json');
             const manifest = JSON.parse(await readFile(manifestPath, 'utf-8'));
@@ -2458,7 +2460,7 @@ esac
             assert.ok(config);
             if (!config)
                 return;
-            config.tmux_session = `omx-team-${teamName}`;
+            config.tmux_session = 'omx-team-scale-up';
             config.workers[0].pane_id = '%21';
             config.workspace_mode = 'worktree';
             config.worktree_mode = { enabled: true, detached: true, name: null };
@@ -2502,6 +2504,32 @@ printf '%s\n' "$*" >> "${tmuxLogPath}"
 case "\${1:-}" in
   show-option) echo 'team:scale-up' ;;
   -V) echo 'tmux 3.2a' ;;
+  display-message)
+    case "$*" in
+      *"-t %32 "*) echo '%32	42432	omx-team-scale-up	$1	@1	team:scale-up' ;;
+      *"-t %31 "*) echo '%31	42431	omx-team-scale-up	$1	@1	team:scale-up' ;;
+      *"-t %21 "*) echo '%21	42421	omx-team-scale-up	$1	@1	team:scale-up' ;;
+      *) exit 1 ;;
+    esac
+    ;;
+  if-shell)
+    [ "\${2:-}" = '-F' ] && [ "\${3:-}" = '-t' ] || exit 1
+    target="\${4:-}"
+    success="\${6:-}"
+    receipt="$(printf '%s' "$success" | sed -En 's/.*(omx-scale-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}).*/\\1/p')"
+    case "$success" in
+      *split-window*)
+        split_count=0; [ ! -f "${splitCountPath}" ] || split_count=$(cat "${splitCountPath}")
+        split_count=$((split_count + 1)); printf '%s' "$split_count" > "${splitCountPath}"
+        if [ "$split_count" -eq 1 ]; then pane='%31'; pid='42431'; elif [ "$split_count" -eq 2 ]; then pane='%32'; pid='42432'; else pane='%33'; pid='42433'; fi
+        printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$pane" "$pid" 'omx-team-scale-up' '$1' '@1' "$receipt"
+        ;;
+      *kill-pane*)
+        case "$target" in %31) exit 1 ;; %32) printf '%s\n' "$receipt" ;; *) exit 1 ;; esac
+        ;;
+      *) printf '%s\n' "$receipt" ;;
+    esac
+    ;;
   list-panes)
     split_count=0; [ ! -f "${splitCountPath}" ] || split_count=$(cat "${splitCountPath}")
     if [ "$split_count" -ge 2 ] && [ ! -f "${proofLossUsedPath}" ]; then
@@ -2523,9 +2551,11 @@ case "\${1:-}" in
     split_count=0; [ ! -f "${splitCountPath}" ] || split_count=$(cat "${splitCountPath}")
     split_count=$((split_count + 1)); printf '%s' "$split_count" > "${splitCountPath}"
     if [ "$split_count" -eq 1 ]; then
-      echo '%31'
+      echo '%31\t42431\tomx-team-scale-up\t$1\t@1'
+    elif [ "$split_count" -eq 2 ]; then
+      echo '%32\t42432\tomx-team-scale-up\t$1\t@1'
     else
-      echo '%32'
+      echo '%33\t42433\tomx-team-scale-up\t$1\t@1'
     fi
     ;;
   kill-pane)
@@ -2554,57 +2584,24 @@ esac
             ], cwd, { OMX_TEAM_SCALING_ENABLED: '1', OMX_TEAM_SKIP_READY_WAIT: '1' });
             assert.equal(result.ok, false);
             if (!result.ok)
-                assert.match(result.error, /^scale_up_rollback_cleanup_debt:.*pane_teardown_failed:%31.*pane_teardown_unresolved:%32/);
+                assert.match(result.error, /^scale_up_rollback_cleanup_debt:pane_teardown_authority_lost:%31/);
             assert.equal(await readFile(splitCountPath, 'utf-8'), '2');
             const config = await readTeamConfig('rollback-kill-fail', cwd);
-            assert.deepEqual(config?.workers.map((worker) => worker.name), ['worker-1', 'worker-2', 'worker-3']);
-            assert.equal(config?.worker_count, 3);
-            assert.equal(config?.next_worker_index, 4);
+            assert.deepEqual(config?.workers.map((worker) => worker.name), ['worker-1', 'worker-2']);
+            assert.equal(config?.worker_count, 2);
+            assert.equal(config?.next_worker_index, 3);
             assert.equal((await readTask('rollback-kill-fail', '1', cwd))?.owner, 'worker-2');
-            assert.equal((await readTask('rollback-kill-fail', '2', cwd))?.owner, 'worker-3');
+            assert.equal(await readTask('rollback-kill-fail', '2', cwd), null);
             assert.equal(await readTask('rollback-kill-fail', '3', cwd), null);
-            for (const workerName of ['worker-2', 'worker-3']) {
-                const workerDir = join(cwd, '.omx', 'state', 'team', 'rollback-kill-fail', 'workers', workerName);
-                assert.equal(existsSync(workerStartupScriptPath(cwd, 'rollback-kill-fail', workerName)), true, `${workerName} startup script must remain`);
-                assert.equal(existsSync(join(cwd, '.omx', 'team', 'rollback-kill-fail', 'worktrees', workerName)), true, `${workerName} worktree must remain`);
-                if (workerName === 'worker-2') {
-                    assert.equal(existsSync(workerDir), true, 'worker-2 materialized state must remain retryable');
-                    assert.equal(existsSync(join(workerDir, 'identity.json')), true, 'worker-2 identity must remain');
-                    assert.equal(existsSync(join(workerDir, 'inbox.md')), true, 'worker-2 inbox must remain');
-                }
-                else {
-                    assert.equal(existsSync(join(workerDir, 'identity.json')), false, 'worker-3 proof failed before identity materialization');
-                    assert.equal(existsSync(join(workerDir, 'inbox.md')), false, 'worker-3 proof failed before inbox materialization');
-                }
-            }
-            // P2: retry execution of recorded cleanup debt is intentionally a follow-up surface.
+            const worker2Dir = join(cwd, '.omx', 'state', 'team', 'rollback-kill-fail', 'workers', 'worker-2');
+            assert.equal(existsSync(workerStartupScriptPath(cwd, 'rollback-kill-fail', 'worker-2')), true);
+            assert.equal(existsSync(join(cwd, '.omx', 'team', 'rollback-kill-fail', 'worktrees', 'worker-2')), true);
+            assert.equal(existsSync(worker2Dir), true, 'worker-2 materialized state must remain retryable');
+            assert.equal(existsSync(join(worker2Dir, 'identity.json')), true, 'worker-2 identity must remain');
+            assert.equal(existsSync(join(worker2Dir, 'inbox.md')), true, 'worker-2 inbox must remain');
             const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-            const mutationCommands = tmuxCommands
-                .filter((command) => command.startsWith('split-window ') || command.startsWith('kill-pane '))
-                .map((command) => command.startsWith('split-window ') ? command.split(' -c ')[0] : command);
-            assert.deepEqual(mutationCommands, [
-                'split-window -v -t %21 -d -P -F #{pane_id}',
-                'split-window -v -t %31 -d -P -F #{pane_id}',
-                'kill-pane -t %31',
-            ]);
-            for (const mutationCommand of mutationCommands) {
-                const mutationIndex = tmuxCommands.findIndex((command) => (command === mutationCommand || command.startsWith(`${mutationCommand} -c `)));
-                if (mutationCommand.startsWith('split-window ')) {
-                    assert.ok(mutationIndex > 2);
-                    assert.equal(tmuxCommands[mutationIndex - 3], 'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}');
-                    assert.match(tmuxCommands[mutationIndex - 2], /^show-option -qv -p -t %(?:21|31) @omx_team_pane_owner_id$/);
-                    assert.equal(tmuxCommands[mutationIndex - 1], 'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}');
-                }
-                else {
-                    assert.ok(mutationIndex > 2);
-                    assert.equal(tmuxCommands[mutationIndex - 3], 'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}');
-                    assert.equal(tmuxCommands[mutationIndex - 2], 'show-option -qv -p -t %31 @omx_team_pane_owner_id');
-                    assert.equal(tmuxCommands[mutationIndex - 1], 'list-panes -a -F #{pane_id}\t#{pane_dead}\t#{pane_pid}');
-                }
-            }
-            assert.ok(tmuxCommands.some((command) => command.startsWith('split-window -v -t %21 ')));
-            assert.ok(tmuxCommands.some((command) => command.startsWith('split-window -v -t %31 ')));
-            assert.ok(tmuxCommands.some((command) => command === 'kill-pane -t %31'));
+            // The first rollback cleanup transaction fails closed on %31 authority; later panes are never touched.
+            assert.ok(tmuxCommands.some((command) => isGuardedScaleMutation(command, 'kill-pane', '%31')));
             assert.equal(tmuxCommands.some((command) => command === 'kill-pane -t %32'), false);
         }
         finally {
@@ -2685,8 +2682,8 @@ esac
                 assert.equal(existsSync(join(cwd, '.omx', 'state', 'team', teamName, 'workers', 'worker-2')), false);
                 assert.equal(existsSync(workerStartupScriptPath(cwd, teamName, 'worker-2')), false);
                 const tmuxCommands = await readScaleUpTmuxLogCommands(tmuxLogPath);
-                assert.ok(tmuxCommands.some((command) => command.startsWith('split-window ')));
-                assert.ok(tmuxCommands.includes('kill-pane -t %31'));
+                assert.equal(guardedScaleSplitCount(tmuxCommands), 1);
+                assert.ok(tmuxCommands.some((command) => isGuardedScaleMutation(command, 'kill-pane', '%31')));
             }
             finally {
                 if (typeof previousPath === 'string')
@@ -2728,7 +2725,7 @@ esac
             assert.throws(() => execFileSync('git', ['show-ref', '--verify', '--quiet', `refs/heads/${branchName}`], { cwd: repo }));
             assert.equal((await readTeamConfig(teamName, repo))?.workers.length, 1);
             assert.equal(existsSync(join(repo, '.omx', 'state', 'team', teamName, 'workers', 'worker-2')), false);
-            assert.deepEqual((await readScaleUpTmuxLogCommands(tmuxLogPath)).filter((command) => command.startsWith('split-window ')), []);
+            assert.deepEqual((await readScaleUpTmuxLogCommands(tmuxLogPath)).filter((command) => isGuardedScaleMutation(command, 'split-window')), []);
         }
         finally {
             if (typeof previousPath === 'string')
@@ -2817,14 +2814,19 @@ describe('scaleDown', () => {
             const task = await createTask('claim-boundary', {
                 subject: 'boundary task', description: 'must not be claimed by a removed worker', status: 'pending', owner: 'worker-2',
             }, cwd);
+            const boundaryMarker = join(cwd, 'claim-boundary-held');
             const down = scaleDown('claim-boundary', cwd, { workerNames: ['worker-2'], force: true }, {
                 OMX_TEAM_SCALING_ENABLED: '1',
-                OMX_TEAM_SCALE_DOWN_BOUNDARY_HOLD_MS: '100',
+                OMX_TEAM_SCALE_DOWN_BOUNDARY_HOLD_MS: '250',
+                OMX_TEAM_SCALE_DOWN_POST_SNAPSHOT_MARKER: boundaryMarker,
             });
+            // The marker is written while the membership barrier and task claim locks
+            // are held and it persists, so a deadline wait on it cannot miss the
+            // boundary window under load. The former fixed 50x5ms poll watched the
+            // transient claim lock dir and expired before the boundary transaction
+            // even started under CI load (#3548).
+            await waitForFileToAppear(boundaryMarker);
             const lockPath = join(cwd, '.omx', 'state', 'team', 'claim-boundary', 'claims', `task-${task.id}.lock`);
-            for (let attempt = 0; attempt < 50 && !existsSync(lockPath); attempt += 1) {
-                await new Promise((resolve) => setTimeout(resolve, 5));
-            }
             assert.equal(existsSync(lockPath), true);
             const claim = claimTask('claim-boundary', task.id, 'worker-2', task.version ?? 1, cwd);
             assert.deepEqual(await down, { ok: true, removedWorkers: ['worker-2'], newWorkerCount: 1 });
@@ -2832,6 +2834,11 @@ describe('scaleDown', () => {
             const reconciled = await readTask('claim-boundary', task.id, cwd);
             assert.equal(reconciled?.owner, undefined);
             assert.equal(reconciled?.claim, undefined);
+            // Negative control: with the reconciled (post-boundary) version the claim
+            // no longer conflicts on the version; it fails on worker removal instead.
+            // That proves the claim_conflict above required the serialized
+            // pre-boundary version rather than mere worker deletion.
+            assert.deepEqual(await claimTask('claim-boundary', task.id, 'worker-2', reconciled?.version ?? 1, cwd), { ok: false, error: 'worker_not_found' });
         }
         finally {
             await rm(cwd, { recursive: true, force: true });
@@ -2850,10 +2857,7 @@ describe('scaleDown', () => {
                 OMX_TEAM_SCALE_DOWN_BOUNDARY_HOLD_MS: '250',
                 OMX_TEAM_SCALE_DOWN_POST_SNAPSHOT_MARKER: postSnapshotMarker,
             });
-            for (let attempt = 0; attempt < 50 && !existsSync(postSnapshotMarker); attempt += 1) {
-                await new Promise((resolve) => setTimeout(resolve, 5));
-            }
-            assert.equal(existsSync(postSnapshotMarker), true);
+            await waitForFileToAppear(postSnapshotMarker);
             let createSettled = false;
             let claimSettled = false;
             const created = createTask('create-claim-boundary', {
@@ -2875,6 +2879,26 @@ describe('scaleDown', () => {
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it('deadline appearance wait fails loudly on timeout and tolerates late appearance', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-scale-down-wait-negative-control-'));
+        try {
+            // Negative control for the boundary synchronization: when the awaited
+            // artifact is never created the wait must reject at its deadline instead
+            // of silently falling through to a misleading assertion.
+            await assert.rejects(() => waitForFileToAppear(join(cwd, 'never-created'), 60), /timed out after 60ms waiting for .*never-created to appear/);
+            // The wait is deadline-based, not attempt-count-based: an artifact that
+            // appears after the former 250ms fixed budget still resolves the wait.
+            const lateMarker = join(cwd, 'late-marker');
+            const lateWait = waitForFileToAppear(lateMarker, 5_000);
+            await new Promise((resolve) => setTimeout(resolve, 25));
+            await writeFile(lateMarker, 'held\n', 'utf8');
+            await lateWait;
+            assert.equal(existsSync(lateMarker), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
 });
 describe('scaleDown worktree AGENTS cleanup', () => {
     it('removes generated worktree-root AGENTS during scale-down', async () => {