oh-my-opencode 5.0.0-beta.62 → 5.0.0-beta.63

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/barrier.ts

@@ -0,0 +1,13 @@
+export function barrier() {
+	let resolve: () => void = () => {
+		throw new Error("barrier not initialized");
+	};
+	const promise = new Promise<void>((done, reject) => {
+		const timeout = setTimeout(() => reject(new Error("barrier timed out")), 5_000);
+		resolve = () => {
+			clearTimeout(timeout);
+			done();
+		};
+	});
+	return { promise, resolve };
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-child.ts

@@ -0,0 +1,65 @@
+import { fork } from "node:child_process";
+import { join } from "node:path";
+
+const running = new Set<ReturnType<typeof childWriter>>();
+export async function cleanupWriters(): Promise<void> {
+	await Promise.all(
+		[...running].map(async (writer) => {
+			writer.child.kill("SIGKILL");
+			await writer.exited;
+		}),
+	);
+}
+export function childWriter(rootPath: string, mode: string, now = Date.now()) {
+	const child = fork(join(import.meta.dirname, "commit-writer.ts"), [rootPath, mode, String(now)], {
+		execPath: "bun",
+		execArgv: [],
+		stdio: ["ignore", "inherit", "inherit", "ipc"],
+	});
+	const pending = new Map<string, { resolve: () => void; reject: (error: Error) => void }>();
+	const seen = new Set<string>();
+	child.on("message", (message) => {
+		if (typeof message !== "string") return;
+		seen.add(message);
+		pending.get(message)?.resolve();
+	});
+	const exited = new Promise<number | null>((resolve, reject) => {
+		const timeout = setTimeout(() => {
+			child.kill("SIGKILL");
+			reject(new Error("child exit timed out"));
+		}, 15_000);
+		child.once("error", (error) => {
+			clearTimeout(timeout);
+			reject(error);
+		});
+		child.once("exit", (code) => {
+			clearTimeout(timeout);
+			running.delete(writer);
+			resolve(code);
+			for (const [name, waiter] of pending)
+				if (!seen.has(name)) waiter.reject(new Error(`child exited before ${name}: ${code}`));
+		});
+	});
+	const writer = {
+		child,
+		exited,
+		wait(name: string) {
+			if (seen.has(name)) return Promise.resolve();
+			return new Promise<void>((resolve, reject) => {
+				const timeout = setTimeout(() => reject(new Error(`IPC timeout: ${name}`)), 10_000);
+				pending.set(name, {
+					resolve: () => {
+						clearTimeout(timeout);
+						resolve();
+					},
+					reject: (error) => {
+						clearTimeout(timeout);
+						reject(error);
+					},
+				});
+			});
+		},
+	};
+	running.add(writer);
+	return writer;
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-cli-qa.mjs

@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import { fork, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { withCommitHooks } from "../../dist/plan-commit.js";
+import { commit } from "../../dist/plan-commit.js";
+import { readLedger, readUlwLoopPlan, withUlwLoopMutationLock } from "../../dist/plan-io.js";
+const cli = resolve("dist/cli.js");
+const root = mkdtempSync(join(tmpdir(), "ulw-cli-qa-"));
+const legacyRoot = mkdtempSync(join(tmpdir(), "ulw-legacy-qa-"));
+const scope = { sessionId: "commit-log" };
+const dir = join(root, ".omo", "ulw-loop", scope.sessionId);
+const json = (path) => JSON.parse(readFileSync(path, "utf8"));
+function run(cwd, ...args) {
+	const argv = [...args, "--session-id", scope.sessionId, "--json"];
+	const result = spawnSync(process.execPath, [cli, ...argv], { cwd, encoding: "utf8", timeout: 15_000, env: { ...process.env, PI_SESSION_ID: "", CODEX_SESSION_ID: "", CODEX_THREAD_ID: "", OMO_ULW_LOOP_SESSION_ID: "" } });
+	console.log(`command=${process.execPath} ${cli} ${argv.map((arg) => JSON.stringify(arg)).join(" ")} cwd=${cwd}\n${result.stdout}${result.stderr}\nexit=${result.status}`);
+	assert.equal(result.status, 0);
+	return JSON.parse(result.stdout);
+}
+try {
+	run(root, "create-goals", "--brief", "Build durable state");
+	const original = json(join(dir, "goals.json"));
+	assert.equal(run(root, "status").plan.revision, 1);
+	rmSync(join(dir, "goals.json"));
+	assert.equal(run(root, "status").plan.revision, 1);
+	assert.equal(existsSync(join(dir, "goals.json")), false);
+	const goal = original.goals[0];
+	run(root, "record-evidence", "--goal-id", goal.id, "--criterion-id", goal.successCriteria[0].id, "--status", "pass", "--evidence", "Observed real CLI publication");
+	assert.equal(json(join(dir, "revisions", "00000002.json")).ledger[0].kind, "evidence_captured");
+	assert.equal(json(join(dir, "goals.json")).revision, 2);
+	console.log("QA=PASS log-only status is read-only; CLI evidence repairs and commits plan plus audit");
+	const clock = { now: () => 0, schedule: () => { throw new Error("Unexpected scheduler use"); } };
+	await assert.rejects(withCommitHooks({ beforeCommit: async () => {
+		const child = fork(resolve("test/fixtures/commit-writer.ts"), [root, "write", "201"], { execPath: "bun", execArgv: [], stdio: ["ignore", "inherit", "inherit", "ipc"] });
+		const exit = await new Promise((done, reject) => {
+			const timeout = setTimeout(() => { child.kill("SIGKILL"); reject(new Error("writer B timed out")); }, 10_000);
+			child.once("error", (error) => { clearTimeout(timeout); reject(error); });
+			child.once("exit", (code) => { clearTimeout(timeout); done(code); });
+		});
+		assert.equal(exit, 0);
+	} }, () => withUlwLoopMutationLock(root, scope, async () => {
+		const plan = await readUlwLoopPlan(root, scope);
+		plan.brief = "zombie";
+		await commit(root, scope, { plan, entries: [{ at: "A", kind: "goal_added", message: "A" }] });
+	}, { clock, leaseMs: 200, heartbeatMs: 0 })), { code: "ULW_LOOP_LOCK_LOST" });
+	assert.equal(readLedger(root, scope).at(-1).message, "B");
+	assert.equal(readLedger(root, scope).some((entry) => entry.message === "A"), false);
+	assert.deepEqual(readdirSync(join(dir, "revisions")), ["00000001.json", "00000002.json", "00000003.json"]);
+	console.log(`QA=PASS real fork zombie fencing ULW_LOOP_LOCK_LOST record=${JSON.stringify(json(join(dir, "revisions", "00000003.json")))}`);
+	run(root, "create-goals", "--brief", "Replacement brief", "--force");
+	const recreated = json(join(dir, "goals.json"));
+	assert.equal(recreated.revision, 4);
+	assert.equal(recreated.ledgerResetRevision, 4);
+	assert.equal(readFileSync(join(dir, "brief.md"), "utf8"), recreated.brief);
+	assert.equal(readLedger(root, scope).length, 1);
+	console.log("QA=PASS force recreation retains revision history and resets the logical audit");
+	const legacyDir = join(legacyRoot, ".omo", "ulw-loop", scope.sessionId);
+	mkdirSync(legacyDir, { recursive: true });
+	delete original.revision; delete original.brief; delete original.ledgerResetRevision;
+	writeFileSync(join(legacyDir, "goals.json"), JSON.stringify(original));
+	writeFileSync(join(legacyDir, "brief.md"), "Legacy brief\n");
+	writeFileSync(join(legacyDir, "ledger.jsonl"), '{"at":"legacy","kind":"goal_started"}\n');
+	assert.equal(run(legacyRoot, "status").plan.revision ?? 0, 0);
+	assert.equal(existsSync(join(legacyDir, "revisions")), false);
+	run(legacyRoot, "add-goal", "--title", "Extra", "--objective", "Verify legacy hydration");
+	assert.equal(json(join(legacyDir, "revisions", "00000001.json")).plan.brief, "Legacy brief\n");
+	assert.equal(readLedger(legacyRoot, scope)[0].id, "legacy-1");
+	console.log("QA=PASS legacy CLI status and first commit preserve brief and legacy audit");
+} finally {
+	rmSync(root, { recursive: true, force: true });
+	rmSync(legacyRoot, { recursive: true, force: true });
+	assert.equal(existsSync(root) || existsSync(legacyRoot), false);
+	console.log(`cleanup=REMOVED ${root} ${legacyRoot}; real home directories not accessed by this driver`);
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-crash.ts

@@ -0,0 +1,23 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { type UlwLoopScope, ulwLoopDir } from "../../src/paths.js";
+import { createUlwLoopPlan } from "../../src/plan-crud.js";
+
+export async function seedCrash(root: string, scope: UlwLoopScope, first: boolean) {
+	const dir = ulwLoopDir(root, scope);
+	const plan = await createUlwLoopPlan(root, { brief: "original" }, scope);
+	const next = { ...plan, revision: (plan.revision ?? 0) + 1, brief: "committed\n", codexObjective: "committed" };
+	mkdirSync(join(dir, "revisions"), { recursive: true });
+	writeFileSync(
+		join(dir, "revisions", `${String(next.revision).padStart(8, "0")}.json`),
+		JSON.stringify({
+			version: 1,
+			revision: next.revision,
+			plan: next,
+			ledger: [{ at: "now", kind: "goal_added", revision: next.revision, id: `${next.revision}-0` }],
+		}),
+	);
+	if (first) await rm(join(dir, "goals.json"));
+	return next;
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-mutations.mjs

@@ -0,0 +1,58 @@
+// Run only in an isolated remote test checkout. Each mutant is restored before the next.
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+
+function replace(source, before, after) {
+	if (source.split(before).length !== 2) throw new Error(`Mutation anchor is not unique: ${before}`);
+	return source.replace(before, after);
+}
+const publication = '(hooks.getStore()?.link ?? linkSync)(temp, join(dir, "revisions", `${String(next).padStart(8, "0")}.json`));';
+const logTest = "test/plan-commit-log.test.ts";
+const recoveryTest = "test/plan-commit-recovery.test.ts";
+const mutations = [
+	{ name: "heartbeat-no-refresh", file: "src/state-lock.ts", test: "test/state-lock.test.ts", pattern: "\\(3\\)", change: (s) => replace(s, "holder.record.leaseUntil = clock.now()", "holder.record.leaseUntil ??= clock.now()") },
+	{ name: "heartbeat-by-path", file: "src/state-lock.ts", test: "test/state-lock.test.ts", pattern: "\\(2\\)", change: (s) => 'import { writeFileSync } from "node:fs";\n' + replace(s, "writeRecord(holder);\n\t\t\tschedule();", "writeFileSync(lockPath, JSON.stringify(holder.record));\n\t\t\tschedule();") },
+	{ name: "rename-over-goals", file: "src/plan-commit.ts", test: logTest, pattern: "B wins write", change: (s) => replace(s, publication, `if (next === 1) { ${publication} } else { writeFileSync(temp, JSON.stringify(record.plan)); renameSync(temp, join(dir, "goals.json")); }`) },
+	{ name: "delete-published-record", file: "src/plan-commit.ts", test: logTest, pattern: "B wins write", change: (s) => replace(s, "await materialize(dir);", 'await materialize(dir);\n if (next > 1) rmSync(join(dir, "revisions", `${String(next).padStart(8, "0")}.json`));') },
+	{ name: "next-from-directory", file: "src/plan-commit.ts", test: logTest, pattern: "\\(6\\)", change: (s) => replace(s, "const next = (plan.revision ?? 0) + 1;", "const next = Math.max(plan.revision ?? 0, ...readRecords(dir).map((record) => record.revision)) + 1;") },
+	{ name: "no-holder-retry", file: "src/plan-io.ts", test: logTest, pattern: "\\(6\\)", change: (s) => replace(s, "if (attempt !== 0) throw error;", "throw error;") },
+	{ name: "no-plan-reconciliation", file: "src/plan-log.ts", test: logTest, pattern: "\\(7a\\)", change: (s) => replace(s, "const latest = readNewestRecord(dir);", "const latest = cached === undefined ? readNewestRecord(dir) : undefined;") },
+	{ name: "no-ledger-reconciliation", file: "src/ledger.ts", test: logTest, pattern: "\\(7a\\)", change: (s) => replace(s, "for (const record of readRecords(dir))", "for (const record of [])") },
+	{ name: "cache-only-existence", file: "src/plan-log.ts", test: recoveryTest, pattern: "\\(7b\\)", change: (s) => replace(s, 'return existsSync(join(dir, "goals.json")) || logNames(dir).length > 0;', 'return existsSync(join(dir, "goals.json"));') },
+	{ name: "in-place-ledger-append",  file: "src/plan-commit.ts", test: logTest, pattern: "\\(7c\\)", change: (s) => {
+		const start = s.indexOf("export async function materialize(dir:");
+		if (start < 0) throw new Error("materializer not found");
+		const body = replace(s.slice(start), 'const temp = join(dir, "tmp", `${process.pid}-${randomUUID()}-${name}`);', 'const temp = name === "ledger.jsonl" && readRecords(dir).length > 1 ? join(dir, name) : join(dir, "tmp", `${process.pid}-${randomUUID()}-${name}`);');
+		return 'import { appendFile } from "node:fs/promises";\n' + s.slice(0, start) + replace(body, 'await writeViewFile(temp, content);', 'if (name === "ledger.jsonl" && readRecords(dir).length > 1) await (hooks.getStore()?.writeView ?? appendFile)(temp, content); else await writeViewFile(temp, content);');
+	} },
+	{ name: "brief-before-publication", file: "src/plan-crud.ts", test: recoveryTest, pattern: "\\(9\\)", change: (s) => replace(replace(s, 'import { beforePlanMutation, commit }', 'import { beforePlanMutation, commit, writeViewFile }'), "await beforePlanMutation();", 'await beforePlanMutation();\n await writeViewFile(`${repoRoot}/${plan.briefPath}`, plan.brief ?? "");') },
+	{ name: "steering-audit-outside-record", file: "src/steering.ts", test: logTest, pattern: "\\(11\\)", change: (s) => replace(s, "await commit(repoRoot, scope, { plan: next, entries });", 'await commit(repoRoot, scope, { plan: next, entries: [] });\n await (await import("node:fs/promises")).appendFile(`${repoRoot}/${next.ledgerPath}`, entries.map((entry) => JSON.stringify(entry)).join("\\n") + "\\n");') },
+	{ name: "copy-fallback", file: "src/plan-commit.ts", test: logTest, pattern: "\\(12\\)", change: (s) => 'import { copyFileSync } from "node:fs";\n' + replace(s, publication, `try { ${publication} } catch (error) { if (hasCode(error, "EPERM")) copyFileSync(temp, join(dir, "revisions", \`\${String(next).padStart(8, "0")}.json\`)); else throw error; }`) },
+];
+const digest = (content) => createHash("sha256").update(content).digest("hex");
+let failures = 0;
+for (const mutation of mutations) {
+	const original = readFileSync(mutation.file, "utf8");
+	console.log(`\n## MUTATION ${mutation.name}\nfile=${mutation.file}\nbefore_sha256=${digest(original)}`);
+	try {
+		writeFileSync(mutation.file, mutation.change(original));
+		const args = ["run", "test", "--", mutation.test, "-t", mutation.pattern];
+		console.log(`command=bun ${args.map((arg) => JSON.stringify(arg)).join(" ")}`);
+		const result = spawnSync("bun", args, { encoding: "utf8", timeout: 60_000 });
+		const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+		console.log(output);
+		console.log(`mutation_exit=${result.status}`);
+		if (result.status !== 1 || !/[1-9]\d* failed/.test(output.replace(/\x1b\[[0-9;]*m/g, "")) || !output.includes("AssertionError")) {
+			failures += 1;
+			console.log(`PROOF=FAILED ${mutation.name}`);
+		} else console.log(`PROOF=RED ${mutation.name}`);
+	} finally {
+		writeFileSync(mutation.file, original);
+		const restored = readFileSync(mutation.file, "utf8");
+		if (restored !== original) throw new Error(`Failed to restore ${mutation.file}`);
+		console.log(`restored_sha256=${digest(restored)} cleanup=RESTORED`);
+	}
+}
+console.log(`mutation_proofs=${mutations.length} failed_proofs=${failures}`);
+process.exitCode = failures === 0 ? 0 : 1;

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-writer.ts

@@ -0,0 +1,65 @@
+import { writeFile } from "node:fs/promises";
+import { commit, withCommitHooks } from "../../src/plan-commit.js";
+import { createUlwLoopPlan } from "../../src/plan-crud.js";
+import { readUlwLoopPlan, withMutationLockOptions, withUlwLoopMutationLock } from "../../src/plan-io.js";
+import { steerUlwLoop } from "../../src/steering.js";
+import { leaseClock } from "./lease-clock.js";
+
+const root = process.argv[2];
+const mode = process.argv[3];
+if (root === undefined) throw new Error("root required");
+const scope = { sessionId: "commit-log" };
+function barrier(name: string): Promise<void> {
+	return new Promise((resolve, reject) => {
+		const timeout = setTimeout(() => reject(new Error(`barrier timed out: ${name}`)), 10_000);
+		process.once("message", () => {
+			clearTimeout(timeout);
+			resolve();
+		});
+		process.send?.(name);
+	});
+}
+let calls = 0;
+await withMutationLockOptions({ clock: leaseClock(Number(process.argv[4])), heartbeatMs: 0, timeoutMs: 0 }, () =>
+	withCommitHooks(
+		{
+			beforeCommit: async () => {
+				calls += 1;
+				if (mode === "mirror" && calls === 1) await barrier("before");
+			},
+			afterCommit: async () => {
+				if (mode === "accepted" || mode === "rejected") await barrier("linked");
+			},
+			writeView: async (path, content) => {
+				if (mode === "partial" && path.endsWith("ledger.jsonl")) {
+					await writeFile(path, content.slice(0, Math.max(1, Math.floor(content.length / 2))));
+					await barrier("partial");
+				}
+				await writeFile(path, content);
+			},
+		},
+		async () => {
+			if (mode === "force") await createUlwLoopPlan(root, { brief: "B\n", force: true }, scope);
+			else if (mode === "accepted" || mode === "rejected")
+				await steerUlwLoop(
+					root,
+					{
+						kind: "annotate_ledger",
+						source: "cli",
+						evidence: mode === "rejected" ? "" : "observed",
+						rationale: "audit",
+						idempotencyKey: "crash-key",
+					},
+					scope,
+				);
+			else
+				await withUlwLoopMutationLock(root, scope, async () => {
+					const plan = await readUlwLoopPlan(root, scope);
+					plan.codexObjective = `${plan.codexObjective}|B`;
+					await commit(root, scope, { plan, entries: [{ at: "B", kind: "goal_added", message: "B" }] });
+				});
+		},
+	),
+);
+process.send?.("done");
+process.disconnect?.();

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/lease-clock.ts

@@ -0,0 +1,23 @@
+export function leaseClock(initial = 0) {
+	let now = initial;
+	const tasks = new Set<{ at: number; fn: () => void }>();
+	return {
+		now: () => now,
+		schedule(fn: () => void, ms: number) {
+			const task = { at: now + ms, fn };
+			tasks.add(task);
+			return { unref() {}, cancel: () => tasks.delete(task) };
+		},
+		advance(ms: number) {
+			const end = now + ms;
+			for (;;) {
+				const next = [...tasks].filter((task) => task.at <= end).sort((a, b) => a.at - b.at)[0];
+				if (next === undefined) break;
+				now = next.at;
+				tasks.delete(next);
+				next.fn();
+			}
+			now = end;
+		},
+	};
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/plan-commit-log.test.ts

@@ -0,0 +1,252 @@
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { ulwLoopDir } from "../src/paths.js";
+import { createUlwLoopPlan } from "../src/plan-crud.js";
+import * as io from "../src/plan-io.js";
+import { childWriter, cleanupWriters } from "./fixtures/commit-child.js";
+import { seedCrash } from "./fixtures/commit-crash.js";
+import { leaseClock } from "./fixtures/lease-clock.js";
+
+let root: string;
+let dir: string;
+const scope = { sessionId: "commit-log" };
+beforeEach(async () => {
+	root = await mkdtemp(join(tmpdir(), "ulw-commit-"));
+	dir = ulwLoopDir(root, scope);
+});
+afterEach(async () => {
+	await cleanupWriters();
+	await rm(root, { recursive: true, force: true });
+});
+function snapshot() {
+	return Object.fromEntries(
+		["goals.json", "ledger.jsonl", "brief.md"].map((name) => [
+			name,
+			existsSync(join(dir, name)) ? readFileSync(join(dir, name), "utf8") : null,
+		]),
+	);
+}
+
+describe("#given an immutable plan and audit log", () => {
+	it("#when (7a) a writer dies after publishing #then reads reconcile without writes and locked reads repair views", async () => {
+		const next = await seedCrash(root, scope, false);
+		const before = snapshot();
+		expect(await io.readUlwLoopPlan(root, scope)).toEqual(next);
+		expect(io.readLedger(root, scope).at(-1)?.id).toBe(`${next.revision}-0`);
+		expect(snapshot()).toEqual(before);
+		await io.withUlwLoopMutationLock(root, scope, () => io.readUlwLoopPlan(root, scope));
+		expect(JSON.parse(readFileSync(join(dir, "goals.json"), "utf8"))).toEqual(next);
+		expect(readFileSync(join(dir, "brief.md"), "utf8")).toBe(next.brief);
+	});
+	it("#when (7b) first creation has no goals cache #then existence and reads use the log", async () => {
+		const next = await seedCrash(root, scope, true);
+		expect(io.planExists(root, scope)).toBe(true);
+		expect(await io.readUlwLoopPlan(root, scope)).toEqual(next);
+	});
+	it("#when (8) a legacy plan first commits #then revision zero and legacy ledger and brief survive", async () => {
+		const plan = await createUlwLoopPlan(root, { brief: "legacy" }, scope);
+		delete plan.revision;
+		delete plan.brief;
+		delete plan.ledgerResetRevision;
+		await rm(join(dir, "revisions"), { recursive: true, force: true });
+		writeFileSync(join(dir, "goals.json"), JSON.stringify(plan));
+		writeFileSync(join(dir, "ledger.jsonl"), '{"at":"legacy","kind":"goal_started"}\n{"torn":');
+		expect(io.readLedger(root, scope)[0]).toMatchObject({ revision: 0, id: "legacy-1" });
+		const { commit } = await import("../src/plan-commit.js");
+		await io.withUlwLoopMutationLock(root, scope, async () => {
+			const legacy = await io.readUlwLoopPlan(root, scope);
+			await commit(root, scope, { plan: legacy, entries: [] });
+		});
+		expect(readdirSync(join(dir, "revisions"))).toEqual(["00000001.json"]);
+		expect(io.readLedger(root, scope)[0]?.id).toBe("legacy-1");
+		expect(readFileSync(join(dir, "brief.md"), "utf8")).toBe("legacy\n");
+	});
+	it("#when (9) force recreation succeeds #then the reset is a new revision with filtered views", async () => {
+		const first = await createUlwLoopPlan(root, { brief: "old" }, scope);
+		const next = await createUlwLoopPlan(root, { brief: "new", force: true }, scope);
+		expect(next.revision).toBe((first.revision ?? 0) + 1);
+		expect(next.ledgerResetRevision).toBe(next.revision);
+		expect(io.readLedger(root, scope)).toHaveLength(1);
+		expect(readFileSync(join(dir, "brief.md"), "utf8")).toBe(next.brief);
+		expect(readdirSync(join(dir, "revisions"))).toHaveLength(2);
+	});
+	it("#when (12) hard links are unsupported #then publication fails closed without a record or view changes", async () => {
+		await createUlwLoopPlan(root, { brief: "old" }, scope);
+		const before = snapshot();
+		const { withCommitHooks, commit } = await import("../src/plan-commit.js");
+		await expect(
+			withCommitHooks(
+				{
+					link: () => {
+						throw Object.assign(new Error("unsupported"), { code: "EPERM" });
+					},
+				},
+				() =>
+					io.withUlwLoopMutationLock(root, scope, async () => {
+						const plan = await io.readUlwLoopPlan(root, scope);
+						plan.brief = "forbidden";
+						await commit(root, scope, { plan, entries: [] });
+					}),
+			),
+		).rejects.toMatchObject({ code: "ULW_LOOP_PUBLISH_UNSUPPORTED_FS" });
+		expect(snapshot()).toEqual(before);
+		expect(readdirSync(join(dir, "revisions"))).toHaveLength(1);
+	});
+});
+
+describe("#given paused writers in separate processes", () => {
+	it.each(["write", "force"])(
+		"#when (5)/(9) B wins %s after A's precheck #then A loses without publishing or changing views",
+		async (mode) => {
+			await createUlwLoopPlan(root, { brief: "initial" }, scope);
+			const { withCommitHooks, commit } = await import("../src/plan-commit.js");
+			let successor: ReturnType<typeof snapshot> | undefined;
+			let writes = 0;
+			const clock = leaseClock();
+			await expect(
+				withCommitHooks(
+					{
+						beforeCommit: async () => {
+							clock.advance(201);
+							const writer = childWriter(root, mode, clock.now());
+							expect(await writer.exited).toBe(0);
+							successor = snapshot();
+						},
+						writeView: async () => {
+							writes += 1;
+							throw new Error("loser wrote a view");
+						},
+					},
+					() =>
+						io.withUlwLoopMutationLock(
+							root,
+							scope,
+							async () => {
+								const plan = await io.readUlwLoopPlan(root, scope);
+								plan.brief = "A\n";
+								await commit(root, scope, { plan, entries: [{ at: "A", kind: "goal_added", message: "A" }] });
+							},
+							{ clock, leaseMs: 200, heartbeatMs: 0 },
+						),
+				),
+			).rejects.toMatchObject({ code: "ULW_LOOP_LOCK_LOST" });
+			expect(writes).toBe(0);
+			expect(snapshot()).toEqual(successor);
+			const published = JSON.parse(readFileSync(join(dir, "revisions", "00000002.json"), "utf8"));
+			expect(published.plan).toEqual(await io.readUlwLoopPlan(root, scope));
+			expect(published.ledger).toHaveLength(1);
+			expect(io.readLedger(root, scope).at(-1)).toEqual(published.ledger[0]);
+			expect(published.ledger[0].kind).toBe(mode === "force" ? "plan_created" : "goal_added");
+			expect(io.readLedger(root, scope).some((entry) => entry.message === "A")).toBe(false);
+			expect(readdirSync(join(dir, "revisions"))).toEqual(["00000001.json", "00000002.json"]);
+		},
+	);
+	it("#when (6) A wins before the valid holder B #then B retries once from A's revision", async () => {
+		await createUlwLoopPlan(root, { brief: "initial" }, scope);
+		const { withCommitHooks, commit } = await import("../src/plan-commit.js");
+		let writer: ReturnType<typeof childWriter> | undefined;
+		const clock = leaseClock();
+		await withCommitHooks(
+			{
+				beforeCommit: async () => {
+					clock.advance(201);
+					writer = childWriter(root, "mirror", clock.now());
+					await writer.wait("before");
+				},
+			},
+			() =>
+				io.withUlwLoopMutationLock(
+					root,
+					scope,
+					async () => {
+						const plan = await io.readUlwLoopPlan(root, scope);
+						plan.codexObjective = "A";
+						await commit(root, scope, { plan, entries: [{ at: "A", kind: "goal_added", message: "A" }] });
+					},
+					{ clock, leaseMs: 200, heartbeatMs: 0 },
+				),
+		);
+		if (writer === undefined) throw new Error("B not started");
+		writer.child.send("resume");
+		expect(await writer.exited).toBe(0);
+		expect((await io.readUlwLoopPlan(root, scope)).codexObjective).toBe("A|B");
+		expect(
+			io
+				.readLedger(root, scope)
+				.slice(-2)
+				.map((entry) => entry.message),
+		).toEqual(["A", "B"]);
+		expect(readdirSync(join(dir, "revisions"))).toHaveLength(3);
+	});
+	it("#when (7c) a child dies after an acknowledged partial temp write #then every public view remains complete", async () => {
+		await createUlwLoopPlan(root, { brief: "initial" }, scope);
+		const before = snapshot();
+		const writer = childWriter(root, "partial");
+		await writer.wait("partial");
+		writer.child.kill("SIGKILL");
+		await writer.exited;
+		const after = snapshot();
+		const published = JSON.parse(readFileSync(join(dir, "revisions", "00000002.json"), "utf8"));
+		expect([before["goals.json"], `${JSON.stringify(published.plan, null, 2)}\n`]).toContain(after["goals.json"]);
+		expect([before["brief.md"], published.plan.brief]).toContain(after["brief.md"]);
+		expect(after["ledger.jsonl"]).toBe(before["ledger.jsonl"]);
+		for (const line of readFileSync(join(dir, "ledger.jsonl"), "utf8").trim().split("\n"))
+			expect(() => JSON.parse(line)).not.toThrow();
+		expect(io.readLedger(root, scope).at(-1)?.message).toBe("B");
+	});
+	it.each(["accepted", "rejected"])(
+		"#when (11) %s steering dies after link #then its audit survives and accepted retries dedupe",
+		async (mode) => {
+			const original = await createUlwLoopPlan(root, { brief: "initial" }, scope);
+			const writer = childWriter(root, mode);
+			await writer.wait("linked");
+			writer.child.kill("SIGKILL");
+			await writer.exited;
+			expect(io.readLedger(root, scope).at(-1)?.kind).toBe(`steering_${mode}`);
+			const prior = await io.findAcceptedSteeringLedgerEntry(root, "crash-key", scope);
+			if (mode === "rejected") {
+				expect(prior).toBeUndefined();
+				expect(await io.readUlwLoopPlan(root, scope)).toEqual({ ...original, revision: 2 });
+			} else {
+				const { steerUlwLoop } = await import("../src/steering.js");
+				const result = await steerUlwLoop(
+					root,
+					{
+						kind: "annotate_ledger",
+						source: "cli",
+						evidence: "observed",
+						rationale: "audit",
+						idempotencyKey: "crash-key",
+					},
+					scope,
+				);
+				expect(result.deduped).toBe(true);
+				expect(io.readLedger(root, scope)).toHaveLength(2);
+				expect(readdirSync(join(dir, "revisions"))).toHaveLength(2);
+			}
+		},
+	);
+	it("#when (10) retry fails before commit #then no goal_retried audit escapes", async () => {
+		const { startNextUlwLoop } = await import("../src/plan-crud.js");
+		const plan = await createUlwLoopPlan(root, { brief: "initial" }, scope);
+		const { commit, withCommitHooks } = await import("../src/plan-commit.js");
+		for (const goal of plan.goals) goal.status = "failed";
+		await commit(root, scope, { plan, entries: [] });
+		const before = snapshot();
+		await expect(
+			withCommitHooks(
+				{
+					beforeCommit: () => {
+						throw new Error("stop before commit");
+					},
+				},
+				() => startNextUlwLoop(root, { retryFailed: true }, scope),
+			),
+		).rejects.toThrow("stop before commit");
+		expect(snapshot()).toEqual(before);
+		expect(io.readLedger(root, scope).some((entry) => entry.kind === "goal_retried")).toBe(false);
+	});
+});