oh-my-copilot 5.5.0 → 5.6.2

package/docs/design/P2-RUN-LEDGER-AND-INTAKE-PLAN.md

@@ -0,0 +1,83 @@
+# P2: Run ledger and intake CLI — the runtime contract for closeout enforcement and scheduled intake
+
+**Status:** planning-only architecture contract; no runtime behavior changes in this PR
+**Origin:** the doctrine trial run and PR #4113/#4117 review cycle; the enforcement-layer design (E0–E3) with E0/E2 already shipped (#4117)
+**Owner:** Yeachan-Heo (final decisions marked **[OWNER]**)
+**Base:** `origin/dev` at the head of the #4113 review cycle
+
+## 1. Scope and non-goals
+
+This document is the planning contract for the P2 wave: the runtime pieces of the enforcement layer that cannot live at the hook layer. It defines (A) a durable **run ledger** that makes closeout enforcement possible at all, and (B) an **intake CLI** that gives the harbor headless sweep its missing power switch. It intentionally does **not** change what skills instruct, auto-merge anything, auto-resume any run, infer any approval, or introduce a daemon — every scheduled surface is host-native (cron / Task Scheduler / launchd), never an OMC process.
+
+Non-goals inherited from the #4113 review: nothing posts to a tracker or opens a PR without explicit authorization; the guardrail default remains whatever the owner decides on #4113 (this contract is agnostic to that flip).
+
+## 2. Why a contract is needed (the design correction this document records)
+
+The enforcement-layer design (E1) originally placed closeout enforcement in a Stop hook. Walking the real sequence invalidates that placement:
+
+1. ralph Step 10 writes the run closeout to the notepad;
+2. Step 8 runs `/oh-my-copilot:cancel`, which **deletes the mode state file**;
+3. the session stops; the Stop hook fires with **no state left to read**.
+
+A Stop-hook closeout check can therefore never observe a legitimately finished run — it would only ever fire on the mid-run stops that persistent-mode already blocks. The companion idea ("have the stale-run watchdog notice missing closeouts") is equally void: the watchdog only sees **crashed** runs (state still `active`), and a crashed run legitimately has no closeout. Hard closeout enforcement needs a durable trace that survives cancel. That trace is the run ledger.
+
+## 3. Part A — the run ledger
+
+### 3.1 Shape
+
+Append-only JSONL at `.omg/state/runs/ledger.jsonl` (respects `OMC_STATE_DIR` via the canonical state-root resolver). One line per lifecycle edge:
+
+```json
+{ "ts": "...", "run": "ralph", "sessionId": "...", "event": "start"|"end", "outcome": "running"|"completed"|"failed"|"cancelled", "closeoutWritten": true }
+```
+
+- **start** written when a mode state file transitions to `active: true` (single choke point: `state_write` in `src/lib/mode-state-io.ts` for the four watched modes).
+- **end** written by the cancel/session-end/state-clear path (`state_clear` and the cleanup branches) **before** the mode state file is removed, carrying the outcome and a `closeoutWritten` flag computed by checking the mode's notepad for a write after `startedAt` (mtime comparison — cheap, no content parsing).
+- The ledger is **not** wiped by cancel. It is the durable trace; mode state remains the ephemeral control plane. Rotation: lines beyond a bounded tail (e.g. 1,000) roll to `ledger.jsonl.1` — same pattern as other local logs.
+
+### 3.2 Consumers
+
+- **SessionStart reconciliation** (extends the stale-run reporter): for each `end` entry whose `closeoutWritten: false`, report one advisory line — "previous ralph run completed without a closeout; the run's friction was not captured." Advisory only; never mutates.
+- **Promotion evidence**: the enforcement shadow log (`.omg/state/enforcement/shadow.jsonl`, shipped in #4117) gains closeout-rule samples only once the ledger exists — the ledger is the prerequisite for any closeout enforcement, hard or advisory.
+
+### 3.3 Risks
+
+- **Concurrency**: two sessions writing the ledger — append-only single-line writes with the existing state-lock helper; worst case an interleaved line, which the JSONL readers already tolerate.
+- **Privacy**: the ledger carries only mode names, timestamps, and booleans — no prompts, no paths beyond the state root.
+- **Compatibility**: `state_clear` callers today expect nothing in return; the write is additive and failure-swallowed (evidence by contract, mirroring `enforcement-log.mjs`).
+
+## 4. Part B — the intake CLI
+
+### 4.1 Surface
+
+- `omg intake run --headless` — validates harbor preconditions (tracker reachable, the eight `harbor:*` labels, single-writer attestable), spawns one headless agent session running the harbor `sweep` argument with guardrails enabled, captures the docket link, posts it through `configure-notifications` when configured. Single process; exits when the sweep exits.
+- `omg intake schedule --cron "<expr>"` / `omg intake schedule --off` — registers/removes a **host-native** scheduled entry (cron on Linux/macOS, Task Scheduler on Windows) pointing at `omg intake run --headless`. The timer belongs to the OS; OMC still runs no daemon (harbor's own non-goal is preserved verbatim).
+
+### 4.2 Preconditions and refusals
+
+Schedule installation refuses (loudly, no silent install) when: the tracker is unreachable; labels are missing and cannot be created; single-writer cannot be attested; or no notification channel exists **and** the user has not confirmed the docket-only fallback. A headless sweep never widens communication scope and never creates standing rules — those wait for a signed session (harbor's own contract, unchanged).
+
+### 4.3 Risks
+
+- **Credentials**: headless gh needs a token; the CLI surfaces exactly which credential is missing rather than degrading to a half-run.
+- **Surface area**: this is the first `src/cli` change in the enforcement family — the bridge build chain must be exercised (`npm run build:cli`), and the CLI help snapshot tests updated.
+
+## 5. Sequencing
+
+1. **A** (run ledger) — one slice: ledger writes + SessionStart reconciliation + tests. No skill text changes.
+2. **B** (intake CLI) — one slice: CLI + schedule contract + tests. Depends on nothing from A.
+3. **E1 promotion** — after A ships and the reconciliation advisory accumulates samples, the closeout rule can move from advisory to enforced **[OWNER]**.
+
+## 6. Open questions for the owner
+
+1. **[OWNER]** Ledger location: `.omg/state/runs/ledger.jsonl` vs `.omg/logs/` — state (control-plane adjacent) or logs (audit-like)?
+2. **[OWNER]** Retention bound for the ledger tail (proposed 1,000 lines, rotate on overflow)?
+3. **[OWNER]** Should `omg intake schedule` be allowed to install without a notification channel (docket-only fallback), or is a channel mandatory?
+
+## 7. Verification checklist for changes in this contract
+
+1. Ledger write on activation, on cancel, on session-end crash path (simulate kill: no `end` entry — the gap is itself the signal the reconciliation reports).
+2. Reconciliation advisory appears for `closeoutWritten: false` and stays silent for true closeouts.
+3. Intake schedule install refusals covered (tracker down, labels missing, single-writer unattestable).
+4. Hook latency budgets unchanged (Stop hooks remain ≤ their declared timeouts; ledger writes are on the cancel path, not the Stop path).
+5. `dist/`/`bridge/` artifacts never committed; `npm run build`, `plugin:shipping:verify`, `prompt-ssot:check`, `lint` green.

package/docs/factory/t6-acceptance/acceptance-comment.md

@@ -0,0 +1,36 @@
+# T6 验收报告：软件工厂闭环正式实现（对正式实现重跑演练）
+
+- 日期：2026-09-28；演练场：`pangpang778/factory-demo` issue #1（退货退款用例）
+- 被验代码：分支 `factory-t6-acceptance`（spec #9 正式实现），编译产物 `dist/hooks/session-end/*`、`dist/factory/listener.js`
+- 方法：三项演练（金路径 / 失败注入 / 护栏触发），全程真实 HMAC 签名 webhook、真实标签、真实 gh 回写、真实 detached claude 会话
+- 证据包：分支 `factory-t6-acceptance` `docs/factory/t6-acceptance/evidence/`（审计 jsonl、decision ledger、handoff ×2、护栏 stop marker + usage、intent 草稿、金路径 timeline、演练驱动脚本）
+
+## 判据逐条结论
+
+**判据 1（intake 标签 → intake 会话自动起）：绿。** 签名 POST → 202 `spawned intent session (intent)`，审计记 `routed`（`evidence/factory-listener-audit.jsonl`），真实 claude 会话以 `/intent 处理 tracker 进货：…` 提示词自动启动、intent 技能装载（transcripts d6989e55 / ba18aaef / d314390f）。非绿段：首次尝试（listener 以 worktree 为 cwd 启动）spawn 的会话 f2f76121 首次 API 调用即死（模型 claude-sonnet-4-6 被代理拒）。根因：listener.ts:114 spawn 无 `cwd` 选项，子进程继承 listener 进程 cwd，`--cwd` 仅喂审计路径；以「从演练目录启动 listener」为文档化姿势重跑后稳定。归属 listener 跟进。
+
+**判据 2（草稿按契约回写）：绿。** 多轮追问（issue 评论）后自动回写 `docs/intents/return-refund-flow/intent.md`（五段 + 3 条非阻塞未决，`evidence/intent-draft-return-refund-flow.md`）、指针评论、标签 `intake → needs-review`（评论 5866170890 / 5866239914 / 5866302124）。诚实备注：轮间续接靠重新 POST webhook —— 正式实现应由 SessionEnd→链推进 enqueuer 完成，而 enqueuer 未实现（见红项 1）。
+
+**判据 3（人接受 → launch 会话自动起 + handoff 正确）：绿（含备注）。** 人闸记录评论 5866386028（signer: PangHong）、标签 `needs-review → accepted`；真实 `executeSpawnNext` + defaultSpawnFn：`acquireChainSlot('return-refund-flow')` allowed linkIndex=1，handoff `evidence/return-refund-flow-launch.json`（success:intent-accepted → launch，context 指向已接受 intent），tracker 评论「链已推进到 launch」，launch 会话 a2524410 于 08:34:38 自动起并定位到 handoff。备注：launch 技能 yard gate 需要目标仓 `scripts/shipyard-audit.mjs`，演练仓未铺设（T5 缺口），会话按技能定义 BLOCKED 收场；`launch` 标签未预置，detached shell 里 `gh --add-label` 静默失败，操作员补建补挂 —— tracker 命令失败可观测性是跟进项。
+
+**判据 4（机械对照自动过闸，signer = 判据事实）：绿。** `gradeGate('spec-approve', 全绿)` → auto-pass，signerFact「分级判据均未触发，机械验证项全部通过，自动过」（`evidence/t6-decision-ledger.json`）。
+
+**判据 5（先例性取舍升人闸，留痕）：绿。** 判据一/二/机械未过三类 facts 全部升 human 且留触发判据文案；intent-accept、review-approve 固定人闸（ledger 共 6 条：5 human + 1 auto）。
+
+**判据 6（失败注入 → failed + 告警 + 链停住）：绿（注入点诚实标注）。** 6a：生产路由表 + `failed:budget-exhausted` → plan null：0 spawn、链静默停住（`evidence/t6-exercise-evidence.json` 2A）。6b：spawnFn 注入抛错 → 真实告警评论「链已停住：… v1 无自动重试」+ 真实 failed 标签落 issue #1（`evidence/t6-exercise-2b.txt` + issue 评论/标签可查）。诚实边界：告警路径仅在 spawn 同步抛错时可达，defaultSpawnFn（shell:true）不同步抛 → 生产可达性≈0，子进程生死无观测（与判据 1 首败静默一致）。归属 listener/T2 跟进。
+
+**判据 7（每日 N=10 护栏）：绿。** 同 intent 当日 ×10 acquire 全过，第 11 次 `daily-cap` 拒绝、中文 detail、真实 stop marker `evidence/chain-t6-demo-refund.stopped.json` 落盘，`evidence/chain-usage.json` 计数 10。LOW 缺陷：guardrails.ts:131 拒绝 detail 引用 stopMarkerPath 漏传 stateRoot，提示路径与实际落盘根不一致（marker 本体正确）。
+
+**判据 8（全程可审计 / 黑灯度量）：绿。** 每环有记录：listener 审计 jsonl、handoff ×2、usage + stop marker、gate ledger ×6、issue 全程评论链。黑灯度量：gate 判定合计 7（ledger 6 + 实链 intent-accept 1），人签 6 → **6/7 ≈ 86%**；唯一非人签为 spec-approve 全绿 auto-pass，signer = 判据事实（设计如此）。
+
+## 红项归属（无未归属红项）
+1. **SessionEnd→链推进 enqueuer 未实现**：src 内无构造/入队 spawn-next action 的生产调用方（类型在 cleanup-manifest.ts:7、dispatch 在 worker.ts:47-53）。无闭环工票覆盖，建议开跟进票。
+2. **listener spawn 三缺口**：无 cwd 选项（子进程 cwd 继承 listener 进程）；子进程生死/退出无观测；tracker 命令 detached shell 失败静默。归属 listener（T2/T4 跟进）。
+3. **guardrails.ts:131 detail 路径 LOW**（见判据 7）。
+4. **T5 铺设缺口**：演练仓缺 shipyard 审计机械与 launch 标签预置。
+
+## 操作员侧修复披露（非实现改动）
+listener 以演练目录为 cwd 重启一次；演练目录 trust 与 allow-list 预置；轮间回答与人闸接受由操作员以 pangpang778 身份在 issue 留痕（人机协作「人」的一侧）。
+
+## 结论
+**8/8 判据全绿**（判据 3 含 T5 铺设备注、判据 6 注入点诚实标注）。红项均为实现跟进而非验收阻塞，按归属开跟进票即可。

package/hooks/hooks.json

@@ -36,6 +36,16 @@
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}\"/scripts/run.cjs \"${CLAUDE_PLUGIN_ROOT}\"/scripts/wiki-session-start.mjs",
             "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}\"/scripts/run.cjs \"${CLAUDE_PLUGIN_ROOT}\"/scripts/stale-run-reporter.mjs",
+            "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}\"/scripts/run.cjs \"${CLAUDE_PLUGIN_ROOT}\"/scripts/runs-reconciler.mjs",
+            "timeout": 5
           }
         ]
       },
@@ -70,6 +80,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}\"/scripts/run.cjs \"${CLAUDE_PLUGIN_ROOT}\"/scripts/git-guardrails.mjs",
+            "timeout": 5
+          }
+        ]
       }
     ],
     "PermissionRequest": [
@@ -96,7 +116,8 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}\"/scripts/run.cjs \"${CLAUDE_PLUGIN_ROOT}\"/scripts/project-memory-posttool.mjs",
-            "timeout": 3
+            "timeout": 3,
+            "async": true
           },
           {
             "type": "command",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-copilot",
-  "version": "5.5.0",
+  "version": "5.6.2",
   "description": "Multi-agent orchestration system for Copilot CLI - Inspired by oh-my-opencode",
   "type": "module",
   "main": "dist/index.js",
@@ -34,6 +34,9 @@
     "bridge/runtime-cli.cjs",
     "commands",
     "hooks",
+    "scripts/build-contained-fs.mjs",
+    "scripts/postinstall-contained-fs.mjs",
+    "scripts/verify-graph-contained-fs.mjs",
     "scripts",
     "skills",
     "templates",
@@ -92,6 +95,7 @@
     "generate:prompt-projections": "node scripts/generate-prompt-projections.mjs",
     "verify:prompt-projections": "node scripts/generate-prompt-projections.mjs --verify",
     "build:contained-fs": "node scripts/build-contained-fs.mjs",
+    "postinstall": "node scripts/postinstall-contained-fs.mjs",
     "build:copilot-hooks": "node scripts/copilot/build-hooks.mjs --write",
     "verify:copilot-hooks": "node scripts/copilot/build-hooks.mjs --verify",
     "build:copilot-agents": "node scripts/copilot/build-agents.mjs --write",
@@ -155,5 +159,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "f9bc06177e37904aa42cabce644b56340e8c44b0"
+  "gitHead": "dff284086ef69f7bd488ba13346e66a90180d671"
 }

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-copilot",
-  "version": "5.5.0",
+  "version": "5.6.2",
   "description": "Multi-agent orchestration system for GitHub Copilot CLI",
   "author": {
     "name": "oh-my-copilot contributors"

package/scripts/build-contained-fs.mjs

@@ -6,8 +6,24 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 // Build-time only. Runtime never invokes a compiler or downloads a binary.
-if (process.platform !== 'darwin' && !process.argv.includes('--force')) process.exit(0);
-if (!['darwin', 'linux'].includes(process.platform)) throw new Error('Unsupported native build platform');
+
+// Original behavior: darwin only, unless --optional or --force is passed
+const isOptional = process.argv.includes('--optional');
+const isForceBuild = process.argv.includes('--force');
+
+// Skip on non-darwin platforms unless explicitly forced or optional
+if (process.platform !== 'darwin' && !isForceBuild && !isOptional) {
+  process.exit(0);
+}
+
+// Fail loudly if platform is unsupported AND not optional
+if (!['darwin', 'linux'].includes(process.platform)) {
+  if (isOptional) {
+    process.exit(0);
+  }
+  throw new Error('Unsupported native build platform');
+}
+
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const explicit = process.argv.find(arg => arg.startsWith('--headers='))?.slice('--headers='.length);
 const version = process.versions.node;
@@ -20,10 +36,16 @@ const candidates = [
   '/usr/local/include/node',
   '/usr/include/node',
 ].filter(Boolean);
+
 const headers = candidates.find(path => existsSync(join(path, 'node_api.h')));
 if (!headers) {
+  if (isOptional) {
+    // Graceful skip for optional builds
+    process.exit(0);
+  }
   throw new Error('Node development headers are required. Supply --headers=/absolute/path/to/include/node (node_api.h), or populate the node-gyp cache before building. No headers are downloaded by this script.');
 }
+
 for (const arch of process.platform === 'darwin' ? ['arm64', 'x64'] : [process.arch]) {
   const output = join(root, 'native', `contained-fs-${process.platform}-${arch}.node`);
   mkdirSync(dirname(output), { recursive: true });

package/scripts/ci/check-multirepo-paths.mjs

@@ -36,6 +36,9 @@ const WHITELIST_FILES = new Set([
   'scripts/pre-tool-enforcer.mjs',
   'scripts/skill-injector.mjs',
   'scripts/session-start.mjs',
+  'scripts/code-simplifier.mjs',
+  // Hook templates (shipped in distribution, own resolver pre-dist)
+  'templates/hooks/code-simplifier.mjs',
   // Multi-repo test fixtures and audits (construct fake .omc trees)
   'scripts/smoke-multirepo.mjs',
   'scripts/audit-multirepo-e2e.mjs',

package/scripts/code-simplifier.mjs

@@ -6,7 +6,9 @@
  * Intercepts Stop events to automatically delegate recently modified source files
  * to the code-simplifier agent for cleanup and simplification.
  *
- * Opt-in via ~/.omg/config.json: { "codeSimplifier": { "enabled": true } }
+ * Opt-in via the global OMC config.json: { "codeSimplifier": { "enabled": true } }
+ * ($OMC_HOME/config.json, else ${XDG_CONFIG_HOME:-~/.config}/omc/config.json on
+ * Linux/Unix, with legacy ~/.omg/config.json as the fallback)
  * Default: disabled (must explicitly opt in)
  */
 
@@ -48,8 +50,28 @@ function readJsonFile(filePath) {
   }
 }
 
+// Mirrors src/utils/paths.ts:getGlobalOmcConfigCandidates('config.json'):
+// OMC_HOME alone when set; otherwise the XDG config root on Linux/Unix, then
+// the legacy ~/.omg fallback. The first file that exists wins.
+function getGlobalOmcConfigCandidates() {
+  const explicitRoot = process.env.OMC_HOME?.trim();
+  if (explicitRoot) return [join(explicitRoot, 'config.json')];
+
+  const home = process.platform === 'win32'
+    ? process.env.USERPROFILE || process.env.HOME || homedir()
+    : process.env.HOME || homedir();
+  const legacy = join(home, '.omg', 'config.json');
+  if (process.platform === 'win32' || process.platform === 'darwin') return [legacy];
+
+  const configHome = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+  return [...new Set([join(configHome, 'omc', 'config.json'), legacy])];
+}
+
 function readOmcConfig() {
-  return readJsonFile(join(homedir(), '.omg', 'config.json'));
+  for (const configPath of getGlobalOmcConfigCandidates()) {
+    if (existsSync(configPath)) return readJsonFile(configPath);
+  }
+  return null;
 }
 
 function isEnabled(config) {

package/scripts/dev/repro-state-lock.mjs

@@ -0,0 +1,67 @@
+// Repro for upstream issue #4146: mutual exclusion of the owner-file fallback in
+// scripts/lib/state-lock.mjs (owner releases/exits during a reclaimer's liveness
+// probe; the reclaimer must not quarantine a live replacement owner).
+//
+// Usage (from any cwd):  node scripts/dev/repro-state-lock.mjs [procs=8] [iterations=15]
+//
+// Spawns `procs` worker processes that each acquire/increment/release a shared
+// counter `iterations` times. Children run with NODE_ENV=test
+// OMC_TEST_FLOCK_AVAILABLE=0 to force the owner-file fallback (the same path
+// taken when better-sqlite3 cannot load). Prints acquisitions vs. counter,
+// overlaps, release/acquire failures, and a final RESULT line
+// (OK | MUTUAL EXCLUSION VIOLATED | LOCK STRANDED).
+//
+// Worker mode (used internally and by tests/integration/state-lock-owner-reclaim.test.ts):
+//   node scripts/dev/repro-state-lock.mjs worker <target> <iterations> <log>
+import { spawn } from 'node:child_process';
+import { appendFileSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const [, , role, ...args] = process.argv;
+
+if (role === 'worker') {
+  const lib = await import('../lib/state-lock.mjs');
+  const [target, iterations, log] = args;
+  const inside = `${target}.inside`; // created O_EXCL inside the critical section
+  const deadline = Date.now() + 60_000; // keep the run bounded if a lock gets stranded
+  for (let i = 0; i < Number(iterations) && Date.now() < deadline; i++) {
+    const lock = lib.acquireStateFileLockSync(target, 50);
+    if (!lock) {
+      const message = lib.getStateFileLockFailureMessage();
+      appendFileSync(log, `${process.pid} acquire-failed: ${/contention/.test(message) ? 'contention' : /could not be verified/.test(message) ? 'unverifiable' : message}\n`);
+      continue;
+    }
+    let marker = true;
+    try { closeSync(openSync(inside, 'wx')); } catch { marker = false; appendFileSync(log, `${process.pid} OVERLAP: another process is inside the critical section\n`); }
+    const n = Number(readFileSync(target, 'utf8'));
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5); // hold the lock ~5 ms
+    writeFileSync(target, String(n + 1));
+    if (marker) unlinkSync(inside);
+    appendFileSync(log, `${process.pid} acquired\n`);
+    if (!lib.releaseStateFileLockSync(lock)) appendFileSync(log, `${process.pid} release-failed: ${lib.getStateFileLockFailureMessage()}\n`);
+  }
+} else {
+  const procs = Number(role || 8), iterations = Number(args[0] || 15);
+  const dir = mkdtempSync(join(tmpdir(), 'omc-lock-repro-'));
+  mkdirSync(join(dir, 'state'));
+  const target = join(dir, 'state', 'counter.json');
+  const log = join(dir, 'log.txt');
+  writeFileSync(target, '0'); writeFileSync(log, '');
+  // Force the owner-file fallback (same path taken when better-sqlite3 cannot load).
+  const env = { ...process.env, NODE_ENV: 'test', OMC_TEST_FLOCK_AVAILABLE: '0' };
+  const t0 = Date.now();
+  await Promise.all(Array.from({ length: procs }, () => new Promise(resolve =>
+    spawn(process.execPath, [fileURLToPath(import.meta.url), 'worker', target, String(iterations), log], { env, stdio: 'inherit' }).on('exit', resolve))));
+  const lines = readFileSync(log, 'utf8').split('\n').filter(Boolean);
+  const count = re => lines.filter(l => re.test(l)).length;
+  const acquired = count(/ acquired$/), counter = Number(readFileSync(target, 'utf8'));
+  console.log(`platform=${process.platform} node=${process.version} procs=${procs} iterations=${iterations} elapsed=${Date.now() - t0}ms`);
+  console.log(`acquisitions=${acquired} counter=${counter} lostUpdates=${acquired - counter} overlaps=${count(/OVERLAP/)} releaseFailures=${count(/release-failed/)} acquireFailures=${count(/acquire-failed/)}`);
+  const stranded = existsSync(`${target}.mutation.lock`);
+  if (stranded) console.log(`lock file still present after all workers exited:${readFileSync(`${target}.mutation.lock`, 'utf8')}`);
+  for (const l of [...new Set(lines.filter(l => !/ acquired$/.test(l)).map(l => l.replace(/^\d+ /, '')))].slice(0, 6)) console.log(`  ${l}`);
+  const violated = acquired !== counter || count(/OVERLAP/) > 0;
+  console.log(`RESULT: ${violated ? 'MUTUAL EXCLUSION VIOLATED' : stranded ? 'LOCK STRANDED' : 'OK'}`);
+}