oh-my-opencode 5.0.0-beta.60 → 5.0.0-beta.63

package/packages/omo-codex/plugin/components/ulw-loop/src/status-next-actions.ts

@@ -1,36 +1,45 @@
 import { hasAllCriteriaPass, isFinalRunCompletionCandidate } from "./goal-status.js";
-import { ULW_LOOP_CREATE_GOALS_COMMAND } from "./plan-missing-recovery.js";
+import { createGoalsAction } from "./plan-missing-recovery.js";
+import type { UlwLoopToolkitSurface } from "./surface.js";
 import type { UlwLoopItem, UlwLoopPlan } from "./types.js";
 
 /**
- * `status --json` is the one call every agent already makes between steps, so it is
+ * Status is the one call every agent already makes between steps, so it is
  * also the cheapest place to answer "what now?" without a second round trip.
  */
-export function statusNextActions(plan: UlwLoopPlan): readonly string[] {
+export function statusNextActions(plan: UlwLoopPlan, surface: UlwLoopToolkitSurface = "lazycodex"): readonly string[] {
 	const actions: string[] = [];
 	const active = plan.goals.find((goal) => goal.id === plan.activeGoalId);
-	if (plan.goals.length === 0) actions.push(`No goals yet: bootstrap with \`${ULW_LOOP_CREATE_GOALS_COMMAND}\`.`);
-	else if (active !== undefined) actions.push(...activeGoalActions(plan, active));
+	if (plan.goals.length === 0) actions.push(`No goals yet: bootstrap with \`${createGoalsAction(surface)}\`.`);
+	else if (active !== undefined) actions.push(...activeGoalActions(plan, active, surface));
 	for (const goal of plan.goals.filter((candidate) => candidate.status === "review_blocked"))
 		actions.push(
-			`${goal.id} is review_blocked: capture the reviewer verdict with \`omo-agent-toolkit ulw-loop record-review-blockers --goal-id ${goal.id} --title "<title>" --objective "<objective>" --evidence "<verdict>" --codex-goal-json '<get_goal json>'\`.`,
+			surface === "omo-senpi"
+				? `${goal.id} is review_blocked: capture the reviewer verdict with \`agentToolkit.recordReviewBlockers({ goalId: "${goal.id}", title: "<title>", objective: "<objective>", evidence: "<verdict>" })\`.`
+				: `${goal.id} is review_blocked: capture the reviewer verdict with \`omo-agent-toolkit ulw-loop record-review-blockers --goal-id ${goal.id} --title "<title>" --objective "<objective>" --evidence "<verdict>" --codex-goal-json '<get_goal json>'\`.`,
 		);
 	if (plan.evidenceLayoutVersion !== 2 || active === undefined)
 		actions.push("plan is evidence-layout v1; artifacts go under .omo/evidence/");
 	return actions;
 }
 
-function activeGoalActions(plan: UlwLoopPlan, active: UlwLoopItem): readonly string[] {
+function activeGoalActions(plan: UlwLoopPlan, active: UlwLoopItem, surface: UlwLoopToolkitSurface): readonly string[] {
 	const unresolved = active.successCriteria.filter((criterion) => criterion.status !== "pass");
 	if (unresolved.length > 0)
 		return [
-			`${active.id} has ${unresolved.length} unresolved criterion(s) (${unresolved.map((criterion) => criterion.id).join(", ")}): record proof with \`omo-agent-toolkit ulw-loop record-evidence --goal-id ${active.id} --criterion-id <id> --status pass --evidence "<observable proof>"\`.`,
+			surface === "omo-senpi"
+				? `${active.id} has ${unresolved.length} unresolved criterion(s) (${unresolved.map((criterion) => criterion.id).join(", ")}): record proof with \`agentToolkit.recordEvidence({ goalId: "${active.id}", criterionId: "<id>", status: "pass", evidence: "<observable proof>" })\`.`
+				: `${active.id} has ${unresolved.length} unresolved criterion(s) (${unresolved.map((criterion) => criterion.id).join(", ")}): record proof with \`omo-agent-toolkit ulw-loop record-evidence --goal-id ${active.id} --criterion-id <id> --status pass --evidence "<observable proof>"\`.`,
 		];
 	if (hasAllCriteriaPass(active) && isFinalRunCompletionCandidate(plan, active))
 		return [
-			`${active.id} passes every criterion and is the final story: update_goal complete, then checkpoint --print-template to build the final quality gate. Use status --json's currentAttemptDir for all quality-gate artifacts.`,
+			surface === "omo-senpi"
+				? `${active.id} passes every criterion and is the final story: complete the driver goal, then call \`agentToolkit.checkpoint({ goalId: "${active.id}", printTemplate: true })\` to build the final quality gate. Use status().result.currentAttemptDir for all quality-gate artifacts.`
+				: `${active.id} passes every criterion and is the final story: update_goal complete, then checkpoint --print-template to build the final quality gate. Use status --json's currentAttemptDir for all quality-gate artifacts.`,
 		];
 	return [
-		`${active.id} passes every criterion: close it with \`omo-agent-toolkit ulw-loop checkpoint --goal-id ${active.id} --status complete --evidence "<proof>" --codex-goal-json '<get_goal json>'\`. Put quality-gate artifacts under the currentAttemptDir shown by status --json.`,
+		surface === "omo-senpi"
+			? `${active.id} passes every criterion: close it with \`agentToolkit.checkpoint({ goalId: "${active.id}", status: "complete", evidence: "<proof>" })\`. Put quality-gate artifacts under status().result.currentAttemptDir.`
+			: `${active.id} passes every criterion: close it with \`omo-agent-toolkit ulw-loop checkpoint --goal-id ${active.id} --status complete --evidence "<proof>" --codex-goal-json '<get_goal json>'\`. Put quality-gate artifacts under the currentAttemptDir shown by status --json.`,
 	];
 }

package/packages/omo-codex/plugin/components/ulw-loop/src/steering-batch.ts

@@ -1,6 +1,7 @@
 // biome-ignore-all format: compact batch steering module stays below the pure LOC budget.
 import type { UlwLoopScope } from "./paths.js";
-import { appendLedger, appendLedgerEntries, findAcceptedSteeringLedgerEntry, readUlwLoopPlan, withUlwLoopMutationLock, writePlan } from "./plan-io.js";
+import { commit } from "./plan-commit.js";
+import { findAcceptedSteeringLedgerEntry, readUlwLoopPlan, withUlwLoopMutationLock } from "./plan-io.js";
 import { applySteeringMutation, validateUlwLoopSteeringProposal } from "./steering.js";
 import { buildSteeringPlanSnapshot, changedGoalIdsBetween } from "./steering-snapshot.js";
 import type { UlwLoopLedgerEntry, UlwLoopPlan, UlwLoopSteeringAudit, UlwLoopSteeringProposal } from "./types.js";
@@ -43,17 +44,16 @@ export async function steerUlwLoopBatch(
 		const failed = prepared.results.find((item) => !item.accepted);
 		if (failed !== undefined) {
 			const entry = rejectedLedgerEntry(prepared.results);
-			await appendLedger(repoRoot, entry, scope);
+			await commit(repoRoot, scope, { plan, entries: [entry] });
 			return rejected(plan, prepared.results, failed.rejectedReasons);
 		}
 		let next = plan;
 		for (const item of prepared.items) if (item.kind === "fresh") next = item.prepared.next;
 		const fresh = prepared.items.filter((item): item is Extract<PreparedItem, { readonly kind: "fresh" }> => item.kind === "fresh");
 		if (fresh.length > 0) {
-			await writePlan(repoRoot, next, scope);
 			const entries = fresh.map((item) => ledgerEntry(item.prepared.proposal, item.prepared.audit, item.prepared.proposal.now?.toISOString() ?? iso()));
 			const batchEntry = batchUpdateLedgerEntry(plan, next, iso());
-			await appendLedgerEntries(repoRoot, batchEntry === null ? entries : [...entries, batchEntry], scope);
+			await commit(repoRoot, scope, { plan: next, entries: batchEntry === null ? entries : [...entries, batchEntry] });
 		}
 		return { plan: next, accepted: true, results: prepared.results, rejectedReasons: [] };
 	});

package/packages/omo-codex/plugin/components/ulw-loop/src/steering.ts

@@ -1,7 +1,8 @@
 // biome-ignore-all format: compact steering module must stay below the 240 pure-LOC budget
 import { isUlwLoopDone } from "./goal-status.js";
 import type { UlwLoopScope } from "./paths.js";
-import { appendLedger, findAcceptedSteeringLedgerEntry, readUlwLoopPlan, withUlwLoopMutationLock, writePlan } from "./plan-io.js";
+import { commit } from "./plan-commit.js";
+import { findAcceptedSteeringLedgerEntry, readUlwLoopPlan, withUlwLoopMutationLock } from "./plan-io.js";
 import { makeGoal, reviseCriterion, reviseWording, splitOrBlock } from "./steering-mutations.js";
 import { buildSteeringPlanSnapshot, changedGoalIdsBetween } from "./steering-snapshot.js";
 import type {
@@ -209,9 +210,9 @@ export async function steerUlwLoop(repoRoot: string, proposal: UlwLoopSteeringPr
 		}
 		const at = proposal.now?.toISOString() ?? iso();
 		const batchEntry = accepted ? batchUpdateLedgerEntry(plan, next, at) : null;
-		if (accepted) await writePlan(repoRoot, next, scope);
-		await appendLedger(repoRoot, ledgerEntry(proposal, finalAudit, at), scope);
-		if (batchEntry !== null) await appendLedger(repoRoot, batchEntry, scope);
+		const entries = [ledgerEntry(proposal, finalAudit, at)];
+		if (batchEntry !== null) entries.push(batchEntry);
+		await commit(repoRoot, scope, { plan: next, entries });
 		return { plan: next, accepted, audit: finalAudit, rejectedReasons: audit.invariant.rejectedReasons, deduped: false };
 	});
 }

package/packages/omo-codex/plugin/components/ulw-loop/src/stop-resume-hook.ts

@@ -1,7 +1,9 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, resolve, sep } from "node:path";
 
+import { readLedgerAt } from "./ledger.js";
 import { normalizeUlwLoopSessionId, ulwLoopDir, ulwLoopStateLockPath } from "./paths.js";
+import { readUlwLoopPlanSync } from "./plan-io.js";
 import { isStateLockTimeout, withStateLockSync } from "./state-lock.js";
 import type { UlwLoopItem, UlwLoopPlan } from "./types.js";
 
@@ -37,7 +39,7 @@ export function runStopResumeHook(input: unknown): string {
 	if (boulderContinuationWillFire(payload.cwd, payload.session_id)) return "";
 	const scope = { sessionId: payload.session_id } as const;
 	const stateDir = ulwLoopDir(payload.cwd, scope);
-	const plan = readPlan(join(stateDir, "goals.json"));
+	const plan = readPlan(payload.cwd, payload.session_id);
 	if (plan === null || plan.aggregateCompletion?.status === "complete") return "";
 	const goal = resumableGoal(plan);
 	if (goal === undefined) return "";
@@ -81,11 +83,10 @@ function consumeResumeBudgetLocked(lockPath: string, stateDir: string, goalId: s
 	}
 }
 
-// Two-strike cap keyed on ledger movement: an unchanged ledger.jsonl line
-// count across resumes means the loop is not progressing. The stuck marker is
-// a separate file — a ledger append would change the count and self-reset.
+// Hook budget counters are exempt from plan/audit commits. Count reconciled
+// entries, not cache lines: a writer dying after link still made progress.
 function consumeResumeBudget(stateDir: string, goalId: string): boolean {
-	const ledgerLineCount = countLedgerLines(join(stateDir, "ledger.jsonl"));
+	const ledgerLineCount = readLedgerAt(stateDir).length;
 	const counterPath = resolve(stateDir, `auto-resume-${goalId}.json`);
 	const stuckPath = resolve(stateDir, `auto-resume-${goalId}.stuck`);
 	// goals.json is untrusted input: a crafted goal id (e.g. `../../x`) must
@@ -119,24 +120,15 @@ function renderResumeDirective(plan: UlwLoopPlan, goal: UlwLoopItem, sessionId:
 	].join("\n");
 }
 
-function readPlan(goalsPath: string): UlwLoopPlan | null {
+function readPlan(repoRoot: string, sessionId: string): UlwLoopPlan | null {
 	try {
-		return JSON.parse(readFileSync(goalsPath, "utf8")) as UlwLoopPlan;
+		return readUlwLoopPlanSync(repoRoot, { sessionId });
 	} catch (error) {
 		if (error instanceof Error) return null;
 		throw error;
 	}
 }
 
-function countLedgerLines(ledgerPath: string): number {
-	try {
-		return readFileSync(ledgerPath, "utf8").split("\n").filter(Boolean).length;
-	} catch (error) {
-		if (error instanceof Error) return 0;
-		throw error;
-	}
-}
-
 function readCounter(counterPath: string): { count: number; ledgerLineCount: number } | null {
 	try {
 		if (!existsSync(counterPath)) return null;

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/barrier.ts

@@ -0,0 +1,13 @@
+export function barrier() {
+	let resolve: () => void = () => {
+		throw new Error("barrier not initialized");
+	};
+	const promise = new Promise<void>((done, reject) => {
+		const timeout = setTimeout(() => reject(new Error("barrier timed out")), 5_000);
+		resolve = () => {
+			clearTimeout(timeout);
+			done();
+		};
+	});
+	return { promise, resolve };
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-child.ts

@@ -0,0 +1,65 @@
+import { fork } from "node:child_process";
+import { join } from "node:path";
+
+const running = new Set<ReturnType<typeof childWriter>>();
+export async function cleanupWriters(): Promise<void> {
+	await Promise.all(
+		[...running].map(async (writer) => {
+			writer.child.kill("SIGKILL");
+			await writer.exited;
+		}),
+	);
+}
+export function childWriter(rootPath: string, mode: string, now = Date.now()) {
+	const child = fork(join(import.meta.dirname, "commit-writer.ts"), [rootPath, mode, String(now)], {
+		execPath: "bun",
+		execArgv: [],
+		stdio: ["ignore", "inherit", "inherit", "ipc"],
+	});
+	const pending = new Map<string, { resolve: () => void; reject: (error: Error) => void }>();
+	const seen = new Set<string>();
+	child.on("message", (message) => {
+		if (typeof message !== "string") return;
+		seen.add(message);
+		pending.get(message)?.resolve();
+	});
+	const exited = new Promise<number | null>((resolve, reject) => {
+		const timeout = setTimeout(() => {
+			child.kill("SIGKILL");
+			reject(new Error("child exit timed out"));
+		}, 15_000);
+		child.once("error", (error) => {
+			clearTimeout(timeout);
+			reject(error);
+		});
+		child.once("exit", (code) => {
+			clearTimeout(timeout);
+			running.delete(writer);
+			resolve(code);
+			for (const [name, waiter] of pending)
+				if (!seen.has(name)) waiter.reject(new Error(`child exited before ${name}: ${code}`));
+		});
+	});
+	const writer = {
+		child,
+		exited,
+		wait(name: string) {
+			if (seen.has(name)) return Promise.resolve();
+			return new Promise<void>((resolve, reject) => {
+				const timeout = setTimeout(() => reject(new Error(`IPC timeout: ${name}`)), 10_000);
+				pending.set(name, {
+					resolve: () => {
+						clearTimeout(timeout);
+						resolve();
+					},
+					reject: (error) => {
+						clearTimeout(timeout);
+						reject(error);
+					},
+				});
+			});
+		},
+	};
+	running.add(writer);
+	return writer;
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-cli-qa.mjs

@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import { fork, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { withCommitHooks } from "../../dist/plan-commit.js";
+import { commit } from "../../dist/plan-commit.js";
+import { readLedger, readUlwLoopPlan, withUlwLoopMutationLock } from "../../dist/plan-io.js";
+const cli = resolve("dist/cli.js");
+const root = mkdtempSync(join(tmpdir(), "ulw-cli-qa-"));
+const legacyRoot = mkdtempSync(join(tmpdir(), "ulw-legacy-qa-"));
+const scope = { sessionId: "commit-log" };
+const dir = join(root, ".omo", "ulw-loop", scope.sessionId);
+const json = (path) => JSON.parse(readFileSync(path, "utf8"));
+function run(cwd, ...args) {
+	const argv = [...args, "--session-id", scope.sessionId, "--json"];
+	const result = spawnSync(process.execPath, [cli, ...argv], { cwd, encoding: "utf8", timeout: 15_000, env: { ...process.env, PI_SESSION_ID: "", CODEX_SESSION_ID: "", CODEX_THREAD_ID: "", OMO_ULW_LOOP_SESSION_ID: "" } });
+	console.log(`command=${process.execPath} ${cli} ${argv.map((arg) => JSON.stringify(arg)).join(" ")} cwd=${cwd}\n${result.stdout}${result.stderr}\nexit=${result.status}`);
+	assert.equal(result.status, 0);
+	return JSON.parse(result.stdout);
+}
+try {
+	run(root, "create-goals", "--brief", "Build durable state");
+	const original = json(join(dir, "goals.json"));
+	assert.equal(run(root, "status").plan.revision, 1);
+	rmSync(join(dir, "goals.json"));
+	assert.equal(run(root, "status").plan.revision, 1);
+	assert.equal(existsSync(join(dir, "goals.json")), false);
+	const goal = original.goals[0];
+	run(root, "record-evidence", "--goal-id", goal.id, "--criterion-id", goal.successCriteria[0].id, "--status", "pass", "--evidence", "Observed real CLI publication");
+	assert.equal(json(join(dir, "revisions", "00000002.json")).ledger[0].kind, "evidence_captured");
+	assert.equal(json(join(dir, "goals.json")).revision, 2);
+	console.log("QA=PASS log-only status is read-only; CLI evidence repairs and commits plan plus audit");
+	const clock = { now: () => 0, schedule: () => { throw new Error("Unexpected scheduler use"); } };
+	await assert.rejects(withCommitHooks({ beforeCommit: async () => {
+		const child = fork(resolve("test/fixtures/commit-writer.ts"), [root, "write", "201"], { execPath: "bun", execArgv: [], stdio: ["ignore", "inherit", "inherit", "ipc"] });
+		const exit = await new Promise((done, reject) => {
+			const timeout = setTimeout(() => { child.kill("SIGKILL"); reject(new Error("writer B timed out")); }, 10_000);
+			child.once("error", (error) => { clearTimeout(timeout); reject(error); });
+			child.once("exit", (code) => { clearTimeout(timeout); done(code); });
+		});
+		assert.equal(exit, 0);
+	} }, () => withUlwLoopMutationLock(root, scope, async () => {
+		const plan = await readUlwLoopPlan(root, scope);
+		plan.brief = "zombie";
+		await commit(root, scope, { plan, entries: [{ at: "A", kind: "goal_added", message: "A" }] });
+	}, { clock, leaseMs: 200, heartbeatMs: 0 })), { code: "ULW_LOOP_LOCK_LOST" });
+	assert.equal(readLedger(root, scope).at(-1).message, "B");
+	assert.equal(readLedger(root, scope).some((entry) => entry.message === "A"), false);
+	assert.deepEqual(readdirSync(join(dir, "revisions")), ["00000001.json", "00000002.json", "00000003.json"]);
+	console.log(`QA=PASS real fork zombie fencing ULW_LOOP_LOCK_LOST record=${JSON.stringify(json(join(dir, "revisions", "00000003.json")))}`);
+	run(root, "create-goals", "--brief", "Replacement brief", "--force");
+	const recreated = json(join(dir, "goals.json"));
+	assert.equal(recreated.revision, 4);
+	assert.equal(recreated.ledgerResetRevision, 4);
+	assert.equal(readFileSync(join(dir, "brief.md"), "utf8"), recreated.brief);
+	assert.equal(readLedger(root, scope).length, 1);
+	console.log("QA=PASS force recreation retains revision history and resets the logical audit");
+	const legacyDir = join(legacyRoot, ".omo", "ulw-loop", scope.sessionId);
+	mkdirSync(legacyDir, { recursive: true });
+	delete original.revision; delete original.brief; delete original.ledgerResetRevision;
+	writeFileSync(join(legacyDir, "goals.json"), JSON.stringify(original));
+	writeFileSync(join(legacyDir, "brief.md"), "Legacy brief\n");
+	writeFileSync(join(legacyDir, "ledger.jsonl"), '{"at":"legacy","kind":"goal_started"}\n');
+	assert.equal(run(legacyRoot, "status").plan.revision ?? 0, 0);
+	assert.equal(existsSync(join(legacyDir, "revisions")), false);
+	run(legacyRoot, "add-goal", "--title", "Extra", "--objective", "Verify legacy hydration");
+	assert.equal(json(join(legacyDir, "revisions", "00000001.json")).plan.brief, "Legacy brief\n");
+	assert.equal(readLedger(legacyRoot, scope)[0].id, "legacy-1");
+	console.log("QA=PASS legacy CLI status and first commit preserve brief and legacy audit");
+} finally {
+	rmSync(root, { recursive: true, force: true });
+	rmSync(legacyRoot, { recursive: true, force: true });
+	assert.equal(existsSync(root) || existsSync(legacyRoot), false);
+	console.log(`cleanup=REMOVED ${root} ${legacyRoot}; real home directories not accessed by this driver`);
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-crash.ts

@@ -0,0 +1,23 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { type UlwLoopScope, ulwLoopDir } from "../../src/paths.js";
+import { createUlwLoopPlan } from "../../src/plan-crud.js";
+
+export async function seedCrash(root: string, scope: UlwLoopScope, first: boolean) {
+	const dir = ulwLoopDir(root, scope);
+	const plan = await createUlwLoopPlan(root, { brief: "original" }, scope);
+	const next = { ...plan, revision: (plan.revision ?? 0) + 1, brief: "committed\n", codexObjective: "committed" };
+	mkdirSync(join(dir, "revisions"), { recursive: true });
+	writeFileSync(
+		join(dir, "revisions", `${String(next.revision).padStart(8, "0")}.json`),
+		JSON.stringify({
+			version: 1,
+			revision: next.revision,
+			plan: next,
+			ledger: [{ at: "now", kind: "goal_added", revision: next.revision, id: `${next.revision}-0` }],
+		}),
+	);
+	if (first) await rm(join(dir, "goals.json"));
+	return next;
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-mutations.mjs

@@ -0,0 +1,58 @@
+// Run only in an isolated remote test checkout. Each mutant is restored before the next.
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+
+function replace(source, before, after) {
+	if (source.split(before).length !== 2) throw new Error(`Mutation anchor is not unique: ${before}`);
+	return source.replace(before, after);
+}
+const publication = '(hooks.getStore()?.link ?? linkSync)(temp, join(dir, "revisions", `${String(next).padStart(8, "0")}.json`));';
+const logTest = "test/plan-commit-log.test.ts";
+const recoveryTest = "test/plan-commit-recovery.test.ts";
+const mutations = [
+	{ name: "heartbeat-no-refresh", file: "src/state-lock.ts", test: "test/state-lock.test.ts", pattern: "\\(3\\)", change: (s) => replace(s, "holder.record.leaseUntil = clock.now()", "holder.record.leaseUntil ??= clock.now()") },
+	{ name: "heartbeat-by-path", file: "src/state-lock.ts", test: "test/state-lock.test.ts", pattern: "\\(2\\)", change: (s) => 'import { writeFileSync } from "node:fs";\n' + replace(s, "writeRecord(holder);\n\t\t\tschedule();", "writeFileSync(lockPath, JSON.stringify(holder.record));\n\t\t\tschedule();") },
+	{ name: "rename-over-goals", file: "src/plan-commit.ts", test: logTest, pattern: "B wins write", change: (s) => replace(s, publication, `if (next === 1) { ${publication} } else { writeFileSync(temp, JSON.stringify(record.plan)); renameSync(temp, join(dir, "goals.json")); }`) },
+	{ name: "delete-published-record", file: "src/plan-commit.ts", test: logTest, pattern: "B wins write", change: (s) => replace(s, "await materialize(dir);", 'await materialize(dir);\n if (next > 1) rmSync(join(dir, "revisions", `${String(next).padStart(8, "0")}.json`));') },
+	{ name: "next-from-directory", file: "src/plan-commit.ts", test: logTest, pattern: "\\(6\\)", change: (s) => replace(s, "const next = (plan.revision ?? 0) + 1;", "const next = Math.max(plan.revision ?? 0, ...readRecords(dir).map((record) => record.revision)) + 1;") },
+	{ name: "no-holder-retry", file: "src/plan-io.ts", test: logTest, pattern: "\\(6\\)", change: (s) => replace(s, "if (attempt !== 0) throw error;", "throw error;") },
+	{ name: "no-plan-reconciliation", file: "src/plan-log.ts", test: logTest, pattern: "\\(7a\\)", change: (s) => replace(s, "const latest = readNewestRecord(dir);", "const latest = cached === undefined ? readNewestRecord(dir) : undefined;") },
+	{ name: "no-ledger-reconciliation", file: "src/ledger.ts", test: logTest, pattern: "\\(7a\\)", change: (s) => replace(s, "for (const record of readRecords(dir))", "for (const record of [])") },
+	{ name: "cache-only-existence", file: "src/plan-log.ts", test: recoveryTest, pattern: "\\(7b\\)", change: (s) => replace(s, 'return existsSync(join(dir, "goals.json")) || logNames(dir).length > 0;', 'return existsSync(join(dir, "goals.json"));') },
+	{ name: "in-place-ledger-append",  file: "src/plan-commit.ts", test: logTest, pattern: "\\(7c\\)", change: (s) => {
+		const start = s.indexOf("export async function materialize(dir:");
+		if (start < 0) throw new Error("materializer not found");
+		const body = replace(s.slice(start), 'const temp = join(dir, "tmp", `${process.pid}-${randomUUID()}-${name}`);', 'const temp = name === "ledger.jsonl" && readRecords(dir).length > 1 ? join(dir, name) : join(dir, "tmp", `${process.pid}-${randomUUID()}-${name}`);');
+		return 'import { appendFile } from "node:fs/promises";\n' + s.slice(0, start) + replace(body, 'await writeViewFile(temp, content);', 'if (name === "ledger.jsonl" && readRecords(dir).length > 1) await (hooks.getStore()?.writeView ?? appendFile)(temp, content); else await writeViewFile(temp, content);');
+	} },
+	{ name: "brief-before-publication", file: "src/plan-crud.ts", test: recoveryTest, pattern: "\\(9\\)", change: (s) => replace(replace(s, 'import { beforePlanMutation, commit }', 'import { beforePlanMutation, commit, writeViewFile }'), "await beforePlanMutation();", 'await beforePlanMutation();\n await writeViewFile(`${repoRoot}/${plan.briefPath}`, plan.brief ?? "");') },
+	{ name: "steering-audit-outside-record", file: "src/steering.ts", test: logTest, pattern: "\\(11\\)", change: (s) => replace(s, "await commit(repoRoot, scope, { plan: next, entries });", 'await commit(repoRoot, scope, { plan: next, entries: [] });\n await (await import("node:fs/promises")).appendFile(`${repoRoot}/${next.ledgerPath}`, entries.map((entry) => JSON.stringify(entry)).join("\\n") + "\\n");') },
+	{ name: "copy-fallback", file: "src/plan-commit.ts", test: logTest, pattern: "\\(12\\)", change: (s) => 'import { copyFileSync } from "node:fs";\n' + replace(s, publication, `try { ${publication} } catch (error) { if (hasCode(error, "EPERM")) copyFileSync(temp, join(dir, "revisions", \`\${String(next).padStart(8, "0")}.json\`)); else throw error; }`) },
+];
+const digest = (content) => createHash("sha256").update(content).digest("hex");
+let failures = 0;
+for (const mutation of mutations) {
+	const original = readFileSync(mutation.file, "utf8");
+	console.log(`\n## MUTATION ${mutation.name}\nfile=${mutation.file}\nbefore_sha256=${digest(original)}`);
+	try {
+		writeFileSync(mutation.file, mutation.change(original));
+		const args = ["run", "test", "--", mutation.test, "-t", mutation.pattern];
+		console.log(`command=bun ${args.map((arg) => JSON.stringify(arg)).join(" ")}`);
+		const result = spawnSync("bun", args, { encoding: "utf8", timeout: 60_000 });
+		const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+		console.log(output);
+		console.log(`mutation_exit=${result.status}`);
+		if (result.status !== 1 || !/[1-9]\d* failed/.test(output.replace(/\x1b\[[0-9;]*m/g, "")) || !output.includes("AssertionError")) {
+			failures += 1;
+			console.log(`PROOF=FAILED ${mutation.name}`);
+		} else console.log(`PROOF=RED ${mutation.name}`);
+	} finally {
+		writeFileSync(mutation.file, original);
+		const restored = readFileSync(mutation.file, "utf8");
+		if (restored !== original) throw new Error(`Failed to restore ${mutation.file}`);
+		console.log(`restored_sha256=${digest(restored)} cleanup=RESTORED`);
+	}
+}
+console.log(`mutation_proofs=${mutations.length} failed_proofs=${failures}`);
+process.exitCode = failures === 0 ? 0 : 1;

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-writer.ts

@@ -0,0 +1,65 @@
+import { writeFile } from "node:fs/promises";
+import { commit, withCommitHooks } from "../../src/plan-commit.js";
+import { createUlwLoopPlan } from "../../src/plan-crud.js";
+import { readUlwLoopPlan, withMutationLockOptions, withUlwLoopMutationLock } from "../../src/plan-io.js";
+import { steerUlwLoop } from "../../src/steering.js";
+import { leaseClock } from "./lease-clock.js";
+
+const root = process.argv[2];
+const mode = process.argv[3];
+if (root === undefined) throw new Error("root required");
+const scope = { sessionId: "commit-log" };
+function barrier(name: string): Promise<void> {
+	return new Promise((resolve, reject) => {
+		const timeout = setTimeout(() => reject(new Error(`barrier timed out: ${name}`)), 10_000);
+		process.once("message", () => {
+			clearTimeout(timeout);
+			resolve();
+		});
+		process.send?.(name);
+	});
+}
+let calls = 0;
+await withMutationLockOptions({ clock: leaseClock(Number(process.argv[4])), heartbeatMs: 0, timeoutMs: 0 }, () =>
+	withCommitHooks(
+		{
+			beforeCommit: async () => {
+				calls += 1;
+				if (mode === "mirror" && calls === 1) await barrier("before");
+			},
+			afterCommit: async () => {
+				if (mode === "accepted" || mode === "rejected") await barrier("linked");
+			},
+			writeView: async (path, content) => {
+				if (mode === "partial" && path.endsWith("ledger.jsonl")) {
+					await writeFile(path, content.slice(0, Math.max(1, Math.floor(content.length / 2))));
+					await barrier("partial");
+				}
+				await writeFile(path, content);
+			},
+		},
+		async () => {
+			if (mode === "force") await createUlwLoopPlan(root, { brief: "B\n", force: true }, scope);
+			else if (mode === "accepted" || mode === "rejected")
+				await steerUlwLoop(
+					root,
+					{
+						kind: "annotate_ledger",
+						source: "cli",
+						evidence: mode === "rejected" ? "" : "observed",
+						rationale: "audit",
+						idempotencyKey: "crash-key",
+					},
+					scope,
+				);
+			else
+				await withUlwLoopMutationLock(root, scope, async () => {
+					const plan = await readUlwLoopPlan(root, scope);
+					plan.codexObjective = `${plan.codexObjective}|B`;
+					await commit(root, scope, { plan, entries: [{ at: "B", kind: "goal_added", message: "B" }] });
+				});
+		},
+	),
+);
+process.send?.("done");
+process.disconnect?.();

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/lease-clock.ts

@@ -0,0 +1,23 @@
+export function leaseClock(initial = 0) {
+	let now = initial;
+	const tasks = new Set<{ at: number; fn: () => void }>();
+	return {
+		now: () => now,
+		schedule(fn: () => void, ms: number) {
+			const task = { at: now + ms, fn };
+			tasks.add(task);
+			return { unref() {}, cancel: () => tasks.delete(task) };
+		},
+		advance(ms: number) {
+			const end = now + ms;
+			for (;;) {
+				const next = [...tasks].filter((task) => task.at <= end).sort((a, b) => a.at - b.at)[0];
+				if (next === undefined) break;
+				now = next.at;
+				tasks.delete(next);
+				next.fn();
+			}
+			now = end;
+		},
+	};
+}