oh-my-opencode 5.0.0-beta.62 → 5.0.0-beta.64

package/packages/omo-codex/plugin/components/ulw-loop/src/stop-resume-hook.ts

@@ -1,7 +1,9 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, resolve, sep } from "node:path";
 
+import { readLedgerAt } from "./ledger.js";
 import { normalizeUlwLoopSessionId, ulwLoopDir, ulwLoopStateLockPath } from "./paths.js";
+import { readUlwLoopPlanSync } from "./plan-io.js";
 import { isStateLockTimeout, withStateLockSync } from "./state-lock.js";
 import type { UlwLoopItem, UlwLoopPlan } from "./types.js";
 
@@ -37,7 +39,7 @@ export function runStopResumeHook(input: unknown): string {
 	if (boulderContinuationWillFire(payload.cwd, payload.session_id)) return "";
 	const scope = { sessionId: payload.session_id } as const;
 	const stateDir = ulwLoopDir(payload.cwd, scope);
-	const plan = readPlan(join(stateDir, "goals.json"));
+	const plan = readPlan(payload.cwd, payload.session_id);
 	if (plan === null || plan.aggregateCompletion?.status === "complete") return "";
 	const goal = resumableGoal(plan);
 	if (goal === undefined) return "";
@@ -81,11 +83,10 @@ function consumeResumeBudgetLocked(lockPath: string, stateDir: string, goalId: s
 	}
 }
 
-// Two-strike cap keyed on ledger movement: an unchanged ledger.jsonl line
-// count across resumes means the loop is not progressing. The stuck marker is
-// a separate file — a ledger append would change the count and self-reset.
+// Hook budget counters are exempt from plan/audit commits. Count reconciled
+// entries, not cache lines: a writer dying after link still made progress.
 function consumeResumeBudget(stateDir: string, goalId: string): boolean {
-	const ledgerLineCount = countLedgerLines(join(stateDir, "ledger.jsonl"));
+	const ledgerLineCount = readLedgerAt(stateDir).length;
 	const counterPath = resolve(stateDir, `auto-resume-${goalId}.json`);
 	const stuckPath = resolve(stateDir, `auto-resume-${goalId}.stuck`);
 	// goals.json is untrusted input: a crafted goal id (e.g. `../../x`) must
@@ -119,24 +120,15 @@ function renderResumeDirective(plan: UlwLoopPlan, goal: UlwLoopItem, sessionId:
 	].join("\n");
 }
 
-function readPlan(goalsPath: string): UlwLoopPlan | null {
+function readPlan(repoRoot: string, sessionId: string): UlwLoopPlan | null {
 	try {
-		return JSON.parse(readFileSync(goalsPath, "utf8")) as UlwLoopPlan;
+		return readUlwLoopPlanSync(repoRoot, { sessionId });
 	} catch (error) {
 		if (error instanceof Error) return null;
 		throw error;
 	}
 }
 
-function countLedgerLines(ledgerPath: string): number {
-	try {
-		return readFileSync(ledgerPath, "utf8").split("\n").filter(Boolean).length;
-	} catch (error) {
-		if (error instanceof Error) return 0;
-		throw error;
-	}
-}
-
 function readCounter(counterPath: string): { count: number; ledgerLineCount: number } | null {
 	try {
 		if (!existsSync(counterPath)) return null;

package/packages/omo-codex/plugin/components/ulw-loop/src/success-criteria-input.ts

@@ -0,0 +1,56 @@
+import type { UlwLoopSuccessCriterion, UlwLoopSuccessCriterionUserModel } from "./types.js";
+import { ULW_LOOP_SUCCESS_CRITERION_USER_MODELS, UlwLoopError } from "./types.js";
+
+export interface SuccessCriterionInput {
+	readonly scenario: string;
+	readonly expectedEvidence: string;
+	readonly userModel?: UlwLoopSuccessCriterionUserModel;
+	readonly essential?: boolean;
+}
+
+function invalid(message: string, details: Record<string, unknown>): never {
+	throw new UlwLoopError(`Invalid successCriteria: ${message}`, "ULW_LOOP_ARGUMENT_INVALID", { details });
+}
+
+function isUserModel(value: unknown): value is UlwLoopSuccessCriterionUserModel {
+	return typeof value === "string" && ULW_LOOP_SUCCESS_CRITERION_USER_MODELS.some((model) => model === value);
+}
+
+function requireText(value: unknown, field: string, index: number): string {
+	const trimmed = typeof value === "string" ? value.trim() : "";
+	return trimmed || invalid(`entry ${index + 1} needs a non-empty ${field}.`, { index, field });
+}
+
+export function criterionId(index: number): string {
+	return `C${String(index + 1).padStart(3, "0")}`;
+}
+
+export function criteriaFromInput(input: readonly unknown[]): UlwLoopSuccessCriterion[] {
+	if (input.length === 0) invalid("provide at least one criterion or omit the field for placeholders.", { count: 0 });
+	return input.map((entry, index) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+			return invalid(`entry ${index + 1} must be an object.`, { index });
+		const record: Record<string, unknown> = { ...entry };
+		const userModel = record["userModel"] ?? "happy";
+		if (!isUserModel(userModel))
+			return invalid(
+				`entry ${index + 1} userModel must be one of ${ULW_LOOP_SUCCESS_CRITERION_USER_MODELS.join(", ")}.`,
+				{
+					index,
+					userModel: String(userModel),
+				},
+			);
+		const essential = record["essential"];
+		if (essential !== undefined && typeof essential !== "boolean")
+			return invalid(`entry ${index + 1} essential must be a boolean.`, { index });
+		return {
+			id: criterionId(index),
+			scenario: requireText(record["scenario"], "scenario", index),
+			userModel,
+			expectedEvidence: requireText(record["expectedEvidence"], "expectedEvidence", index),
+			essential: essential ?? true,
+			capturedEvidence: null,
+			status: "pending",
+		};
+	});
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/codex-goal-snapshot.test.ts

@@ -152,6 +152,41 @@ describe("reconcileCodexGoalSnapshot", () => {
 		expect(reconciliation.ok).toBe(true);
 		expect(reconciliation.errors).toHaveLength(0);
 		expect(reconciliation.warnings.join(" ")).toContain("driver_objective_differs");
+		expect(reconciliation.nextActions).toEqual([]);
+		expect(reconciliation.unacknowledgedObjective).toBe("X");
+	});
+
+	it("#given the differing objective was acknowledged #when reconciled again #then it is silent", () => {
+		const reconciliation = reconcileCodexGoalSnapshot(
+			{ available: true, objective: " X  \n", status: "active", raw: null },
+			{ expectedObjective: "Y", acknowledgedObjectives: ["X"] },
+		);
+
+		expect(reconciliation.warnings).toEqual([]);
+		expect(reconciliation.nextActions).toEqual([]);
+		expect(reconciliation.unacknowledgedObjective).toBeUndefined();
+	});
+
+	it("#given no driver snapshot #when reconciled #then create_goal is a next action, not a warning", () => {
+		const reconciliation = reconcileCodexGoalSnapshot(null, { expectedObjective: "Y" });
+
+		expect(reconciliation.nextActions.join(" ")).toContain("create_goal");
+		expect(reconciliation.warnings).toEqual([]);
+	});
+
+	it("#given a completed or limited driver #when reconciled #then the advice is a next action", () => {
+		const completed = reconcileCodexGoalSnapshot(
+			{ available: true, objective: "Y", status: "complete", raw: null },
+			{ expectedObjective: "Y" },
+		);
+		const limited = reconcileCodexGoalSnapshot(
+			{ available: true, objective: "Y", status: "usage_limited", raw: null },
+			{ expectedObjective: "Y" },
+		);
+
+		expect(completed.nextActions.join(" ")).toContain("create_goal");
+		expect(limited.nextActions.join(" ")).toContain("/goal resume");
+		expect([...completed.warnings, ...limited.warnings]).toEqual([]);
 	});
 
 	it("accepts a parsable snapshot without objective as advisory", () => {
@@ -176,7 +211,8 @@ describe("reconcileCodexGoalSnapshot", () => {
 		// then
 		expect(reconciliation.ok).toBe(true);
 		expect(reconciliation.errors).toHaveLength(0);
-		expect(reconciliation.warnings.join(" ")).toContain("/goal resume");
+		expect(reconciliation.nextActions.join(" ")).toContain("/goal resume");
+		expect(reconciliation.warnings).toEqual([]);
 	});
 });
 

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/barrier.ts

@@ -0,0 +1,13 @@
+export function barrier() {
+	let resolve: () => void = () => {
+		throw new Error("barrier not initialized");
+	};
+	const promise = new Promise<void>((done, reject) => {
+		const timeout = setTimeout(() => reject(new Error("barrier timed out")), 5_000);
+		resolve = () => {
+			clearTimeout(timeout);
+			done();
+		};
+	});
+	return { promise, resolve };
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-child.ts

@@ -0,0 +1,65 @@
+import { fork } from "node:child_process";
+import { join } from "node:path";
+
+const running = new Set<ReturnType<typeof childWriter>>();
+export async function cleanupWriters(): Promise<void> {
+	await Promise.all(
+		[...running].map(async (writer) => {
+			writer.child.kill("SIGKILL");
+			await writer.exited;
+		}),
+	);
+}
+export function childWriter(rootPath: string, mode: string, now = Date.now()) {
+	const child = fork(join(import.meta.dirname, "commit-writer.ts"), [rootPath, mode, String(now)], {
+		execPath: "bun",
+		execArgv: [],
+		stdio: ["ignore", "inherit", "inherit", "ipc"],
+	});
+	const pending = new Map<string, { resolve: () => void; reject: (error: Error) => void }>();
+	const seen = new Set<string>();
+	child.on("message", (message) => {
+		if (typeof message !== "string") return;
+		seen.add(message);
+		pending.get(message)?.resolve();
+	});
+	const exited = new Promise<number | null>((resolve, reject) => {
+		const timeout = setTimeout(() => {
+			child.kill("SIGKILL");
+			reject(new Error("child exit timed out"));
+		}, 15_000);
+		child.once("error", (error) => {
+			clearTimeout(timeout);
+			reject(error);
+		});
+		child.once("exit", (code) => {
+			clearTimeout(timeout);
+			running.delete(writer);
+			resolve(code);
+			for (const [name, waiter] of pending)
+				if (!seen.has(name)) waiter.reject(new Error(`child exited before ${name}: ${code}`));
+		});
+	});
+	const writer = {
+		child,
+		exited,
+		wait(name: string) {
+			if (seen.has(name)) return Promise.resolve();
+			return new Promise<void>((resolve, reject) => {
+				const timeout = setTimeout(() => reject(new Error(`IPC timeout: ${name}`)), 10_000);
+				pending.set(name, {
+					resolve: () => {
+						clearTimeout(timeout);
+						resolve();
+					},
+					reject: (error) => {
+						clearTimeout(timeout);
+						reject(error);
+					},
+				});
+			});
+		},
+	};
+	running.add(writer);
+	return writer;
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-cli-qa.mjs

@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import { fork, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { withCommitHooks } from "../../dist/plan-commit.js";
+import { commit } from "../../dist/plan-commit.js";
+import { readLedger, readUlwLoopPlan, withUlwLoopMutationLock } from "../../dist/plan-io.js";
+const cli = resolve("dist/cli.js");
+const root = mkdtempSync(join(tmpdir(), "ulw-cli-qa-"));
+const legacyRoot = mkdtempSync(join(tmpdir(), "ulw-legacy-qa-"));
+const scope = { sessionId: "commit-log" };
+const dir = join(root, ".omo", "ulw-loop", scope.sessionId);
+const json = (path) => JSON.parse(readFileSync(path, "utf8"));
+function run(cwd, ...args) {
+	const argv = [...args, "--session-id", scope.sessionId, "--json"];
+	const result = spawnSync(process.execPath, [cli, ...argv], { cwd, encoding: "utf8", timeout: 15_000, env: { ...process.env, PI_SESSION_ID: "", CODEX_SESSION_ID: "", CODEX_THREAD_ID: "", OMO_ULW_LOOP_SESSION_ID: "" } });
+	console.log(`command=${process.execPath} ${cli} ${argv.map((arg) => JSON.stringify(arg)).join(" ")} cwd=${cwd}\n${result.stdout}${result.stderr}\nexit=${result.status}`);
+	assert.equal(result.status, 0);
+	return JSON.parse(result.stdout);
+}
+try {
+	run(root, "create-goals", "--brief", "Build durable state");
+	const original = json(join(dir, "goals.json"));
+	assert.equal(run(root, "status").plan.revision, 1);
+	rmSync(join(dir, "goals.json"));
+	assert.equal(run(root, "status").plan.revision, 1);
+	assert.equal(existsSync(join(dir, "goals.json")), false);
+	const goal = original.goals[0];
+	run(root, "record-evidence", "--goal-id", goal.id, "--criterion-id", goal.successCriteria[0].id, "--status", "pass", "--evidence", "Observed real CLI publication");
+	assert.equal(json(join(dir, "revisions", "00000002.json")).ledger[0].kind, "evidence_captured");
+	assert.equal(json(join(dir, "goals.json")).revision, 2);
+	console.log("QA=PASS log-only status is read-only; CLI evidence repairs and commits plan plus audit");
+	const clock = { now: () => 0, schedule: () => { throw new Error("Unexpected scheduler use"); } };
+	await assert.rejects(withCommitHooks({ beforeCommit: async () => {
+		const child = fork(resolve("test/fixtures/commit-writer.ts"), [root, "write", "201"], { execPath: "bun", execArgv: [], stdio: ["ignore", "inherit", "inherit", "ipc"] });
+		const exit = await new Promise((done, reject) => {
+			const timeout = setTimeout(() => { child.kill("SIGKILL"); reject(new Error("writer B timed out")); }, 10_000);
+			child.once("error", (error) => { clearTimeout(timeout); reject(error); });
+			child.once("exit", (code) => { clearTimeout(timeout); done(code); });
+		});
+		assert.equal(exit, 0);
+	} }, () => withUlwLoopMutationLock(root, scope, async () => {
+		const plan = await readUlwLoopPlan(root, scope);
+		plan.brief = "zombie";
+		await commit(root, scope, { plan, entries: [{ at: "A", kind: "goal_added", message: "A" }] });
+	}, { clock, leaseMs: 200, heartbeatMs: 0 })), { code: "ULW_LOOP_LOCK_LOST" });
+	assert.equal(readLedger(root, scope).at(-1).message, "B");
+	assert.equal(readLedger(root, scope).some((entry) => entry.message === "A"), false);
+	assert.deepEqual(readdirSync(join(dir, "revisions")), ["00000001.json", "00000002.json", "00000003.json"]);
+	console.log(`QA=PASS real fork zombie fencing ULW_LOOP_LOCK_LOST record=${JSON.stringify(json(join(dir, "revisions", "00000003.json")))}`);
+	run(root, "create-goals", "--brief", "Replacement brief", "--force");
+	const recreated = json(join(dir, "goals.json"));
+	assert.equal(recreated.revision, 4);
+	assert.equal(recreated.ledgerResetRevision, 4);
+	assert.equal(readFileSync(join(dir, "brief.md"), "utf8"), recreated.brief);
+	assert.equal(readLedger(root, scope).length, 1);
+	console.log("QA=PASS force recreation retains revision history and resets the logical audit");
+	const legacyDir = join(legacyRoot, ".omo", "ulw-loop", scope.sessionId);
+	mkdirSync(legacyDir, { recursive: true });
+	delete original.revision; delete original.brief; delete original.ledgerResetRevision;
+	writeFileSync(join(legacyDir, "goals.json"), JSON.stringify(original));
+	writeFileSync(join(legacyDir, "brief.md"), "Legacy brief\n");
+	writeFileSync(join(legacyDir, "ledger.jsonl"), '{"at":"legacy","kind":"goal_started"}\n');
+	assert.equal(run(legacyRoot, "status").plan.revision ?? 0, 0);
+	assert.equal(existsSync(join(legacyDir, "revisions")), false);
+	run(legacyRoot, "add-goal", "--title", "Extra", "--objective", "Verify legacy hydration");
+	assert.equal(json(join(legacyDir, "revisions", "00000001.json")).plan.brief, "Legacy brief\n");
+	assert.equal(readLedger(legacyRoot, scope)[0].id, "legacy-1");
+	console.log("QA=PASS legacy CLI status and first commit preserve brief and legacy audit");
+} finally {
+	rmSync(root, { recursive: true, force: true });
+	rmSync(legacyRoot, { recursive: true, force: true });
+	assert.equal(existsSync(root) || existsSync(legacyRoot), false);
+	console.log(`cleanup=REMOVED ${root} ${legacyRoot}; real home directories not accessed by this driver`);
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-crash.ts

@@ -0,0 +1,23 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { type UlwLoopScope, ulwLoopDir } from "../../src/paths.js";
+import { createUlwLoopPlan } from "../../src/plan-crud.js";
+
+export async function seedCrash(root: string, scope: UlwLoopScope, first: boolean) {
+	const dir = ulwLoopDir(root, scope);
+	const plan = await createUlwLoopPlan(root, { brief: "original" }, scope);
+	const next = { ...plan, revision: (plan.revision ?? 0) + 1, brief: "committed\n", codexObjective: "committed" };
+	mkdirSync(join(dir, "revisions"), { recursive: true });
+	writeFileSync(
+		join(dir, "revisions", `${String(next.revision).padStart(8, "0")}.json`),
+		JSON.stringify({
+			version: 1,
+			revision: next.revision,
+			plan: next,
+			ledger: [{ at: "now", kind: "goal_added", revision: next.revision, id: `${next.revision}-0` }],
+		}),
+	);
+	if (first) await rm(join(dir, "goals.json"));
+	return next;
+}

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-mutations.mjs

@@ -0,0 +1,58 @@
+// Run only in an isolated remote test checkout. Each mutant is restored before the next.
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+
+function replace(source, before, after) {
+	if (source.split(before).length !== 2) throw new Error(`Mutation anchor is not unique: ${before}`);
+	return source.replace(before, after);
+}
+const publication = '(hooks.getStore()?.link ?? linkSync)(temp, join(dir, "revisions", `${String(next).padStart(8, "0")}.json`));';
+const logTest = "test/plan-commit-log.test.ts";
+const recoveryTest = "test/plan-commit-recovery.test.ts";
+const mutations = [
+	{ name: "heartbeat-no-refresh", file: "src/state-lock.ts", test: "test/state-lock.test.ts", pattern: "\\(3\\)", change: (s) => replace(s, "holder.record.leaseUntil = clock.now()", "holder.record.leaseUntil ??= clock.now()") },
+	{ name: "heartbeat-by-path", file: "src/state-lock.ts", test: "test/state-lock.test.ts", pattern: "\\(2\\)", change: (s) => 'import { writeFileSync } from "node:fs";\n' + replace(s, "writeRecord(holder);\n\t\t\tschedule();", "writeFileSync(lockPath, JSON.stringify(holder.record));\n\t\t\tschedule();") },
+	{ name: "rename-over-goals", file: "src/plan-commit.ts", test: logTest, pattern: "B wins write", change: (s) => replace(s, publication, `if (next === 1) { ${publication} } else { writeFileSync(temp, JSON.stringify(record.plan)); renameSync(temp, join(dir, "goals.json")); }`) },
+	{ name: "delete-published-record", file: "src/plan-commit.ts", test: logTest, pattern: "B wins write", change: (s) => replace(s, "await materialize(dir);", 'await materialize(dir);\n if (next > 1) rmSync(join(dir, "revisions", `${String(next).padStart(8, "0")}.json`));') },
+	{ name: "next-from-directory", file: "src/plan-commit.ts", test: logTest, pattern: "\\(6\\)", change: (s) => replace(s, "const next = (plan.revision ?? 0) + 1;", "const next = Math.max(plan.revision ?? 0, ...readRecords(dir).map((record) => record.revision)) + 1;") },
+	{ name: "no-holder-retry", file: "src/plan-io.ts", test: logTest, pattern: "\\(6\\)", change: (s) => replace(s, "if (attempt !== 0) throw error;", "throw error;") },
+	{ name: "no-plan-reconciliation", file: "src/plan-log.ts", test: logTest, pattern: "\\(7a\\)", change: (s) => replace(s, "const latest = readNewestRecord(dir);", "const latest = cached === undefined ? readNewestRecord(dir) : undefined;") },
+	{ name: "no-ledger-reconciliation", file: "src/ledger.ts", test: logTest, pattern: "\\(7a\\)", change: (s) => replace(s, "for (const record of readRecords(dir))", "for (const record of [])") },
+	{ name: "cache-only-existence", file: "src/plan-log.ts", test: recoveryTest, pattern: "\\(7b\\)", change: (s) => replace(s, 'return existsSync(join(dir, "goals.json")) || logNames(dir).length > 0;', 'return existsSync(join(dir, "goals.json"));') },
+	{ name: "in-place-ledger-append",  file: "src/plan-commit.ts", test: logTest, pattern: "\\(7c\\)", change: (s) => {
+		const start = s.indexOf("export async function materialize(dir:");
+		if (start < 0) throw new Error("materializer not found");
+		const body = replace(s.slice(start), 'const temp = join(dir, "tmp", `${process.pid}-${randomUUID()}-${name}`);', 'const temp = name === "ledger.jsonl" && readRecords(dir).length > 1 ? join(dir, name) : join(dir, "tmp", `${process.pid}-${randomUUID()}-${name}`);');
+		return 'import { appendFile } from "node:fs/promises";\n' + s.slice(0, start) + replace(body, 'await writeViewFile(temp, content);', 'if (name === "ledger.jsonl" && readRecords(dir).length > 1) await (hooks.getStore()?.writeView ?? appendFile)(temp, content); else await writeViewFile(temp, content);');
+	} },
+	{ name: "brief-before-publication", file: "src/plan-crud.ts", test: recoveryTest, pattern: "\\(9\\)", change: (s) => replace(replace(s, 'import { beforePlanMutation, commit }', 'import { beforePlanMutation, commit, writeViewFile }'), "await beforePlanMutation();", 'await beforePlanMutation();\n await writeViewFile(`${repoRoot}/${plan.briefPath}`, plan.brief ?? "");') },
+	{ name: "steering-audit-outside-record", file: "src/steering.ts", test: logTest, pattern: "\\(11\\)", change: (s) => replace(s, "await commit(repoRoot, scope, { plan: next, entries });", 'await commit(repoRoot, scope, { plan: next, entries: [] });\n await (await import("node:fs/promises")).appendFile(`${repoRoot}/${next.ledgerPath}`, entries.map((entry) => JSON.stringify(entry)).join("\\n") + "\\n");') },
+	{ name: "copy-fallback", file: "src/plan-commit.ts", test: logTest, pattern: "\\(12\\)", change: (s) => 'import { copyFileSync } from "node:fs";\n' + replace(s, publication, `try { ${publication} } catch (error) { if (hasCode(error, "EPERM")) copyFileSync(temp, join(dir, "revisions", \`\${String(next).padStart(8, "0")}.json\`)); else throw error; }`) },
+];
+const digest = (content) => createHash("sha256").update(content).digest("hex");
+let failures = 0;
+for (const mutation of mutations) {
+	const original = readFileSync(mutation.file, "utf8");
+	console.log(`\n## MUTATION ${mutation.name}\nfile=${mutation.file}\nbefore_sha256=${digest(original)}`);
+	try {
+		writeFileSync(mutation.file, mutation.change(original));
+		const args = ["run", "test", "--", mutation.test, "-t", mutation.pattern];
+		console.log(`command=bun ${args.map((arg) => JSON.stringify(arg)).join(" ")}`);
+		const result = spawnSync("bun", args, { encoding: "utf8", timeout: 60_000 });
+		const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+		console.log(output);
+		console.log(`mutation_exit=${result.status}`);
+		if (result.status !== 1 || !/[1-9]\d* failed/.test(output.replace(/\x1b\[[0-9;]*m/g, "")) || !output.includes("AssertionError")) {
+			failures += 1;
+			console.log(`PROOF=FAILED ${mutation.name}`);
+		} else console.log(`PROOF=RED ${mutation.name}`);
+	} finally {
+		writeFileSync(mutation.file, original);
+		const restored = readFileSync(mutation.file, "utf8");
+		if (restored !== original) throw new Error(`Failed to restore ${mutation.file}`);
+		console.log(`restored_sha256=${digest(restored)} cleanup=RESTORED`);
+	}
+}
+console.log(`mutation_proofs=${mutations.length} failed_proofs=${failures}`);
+process.exitCode = failures === 0 ? 0 : 1;

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/commit-writer.ts

@@ -0,0 +1,65 @@
+import { writeFile } from "node:fs/promises";
+import { commit, withCommitHooks } from "../../src/plan-commit.js";
+import { createUlwLoopPlan } from "../../src/plan-crud.js";
+import { readUlwLoopPlan, withMutationLockOptions, withUlwLoopMutationLock } from "../../src/plan-io.js";
+import { steerUlwLoop } from "../../src/steering.js";
+import { leaseClock } from "./lease-clock.js";
+
+const root = process.argv[2];
+const mode = process.argv[3];
+if (root === undefined) throw new Error("root required");
+const scope = { sessionId: "commit-log" };
+function barrier(name: string): Promise<void> {
+	return new Promise((resolve, reject) => {
+		const timeout = setTimeout(() => reject(new Error(`barrier timed out: ${name}`)), 10_000);
+		process.once("message", () => {
+			clearTimeout(timeout);
+			resolve();
+		});
+		process.send?.(name);
+	});
+}
+let calls = 0;
+await withMutationLockOptions({ clock: leaseClock(Number(process.argv[4])), heartbeatMs: 0, timeoutMs: 0 }, () =>
+	withCommitHooks(
+		{
+			beforeCommit: async () => {
+				calls += 1;
+				if (mode === "mirror" && calls === 1) await barrier("before");
+			},
+			afterCommit: async () => {
+				if (mode === "accepted" || mode === "rejected") await barrier("linked");
+			},
+			writeView: async (path, content) => {
+				if (mode === "partial" && path.endsWith("ledger.jsonl")) {
+					await writeFile(path, content.slice(0, Math.max(1, Math.floor(content.length / 2))));
+					await barrier("partial");
+				}
+				await writeFile(path, content);
+			},
+		},
+		async () => {
+			if (mode === "force") await createUlwLoopPlan(root, { brief: "B\n", force: true }, scope);
+			else if (mode === "accepted" || mode === "rejected")
+				await steerUlwLoop(
+					root,
+					{
+						kind: "annotate_ledger",
+						source: "cli",
+						evidence: mode === "rejected" ? "" : "observed",
+						rationale: "audit",
+						idempotencyKey: "crash-key",
+					},
+					scope,
+				);
+			else
+				await withUlwLoopMutationLock(root, scope, async () => {
+					const plan = await readUlwLoopPlan(root, scope);
+					plan.codexObjective = `${plan.codexObjective}|B`;
+					await commit(root, scope, { plan, entries: [{ at: "B", kind: "goal_added", message: "B" }] });
+				});
+		},
+	),
+);
+process.send?.("done");
+process.disconnect?.();

package/packages/omo-codex/plugin/components/ulw-loop/test/fixtures/lease-clock.ts

@@ -0,0 +1,23 @@
+export function leaseClock(initial = 0) {
+	let now = initial;
+	const tasks = new Set<{ at: number; fn: () => void }>();
+	return {
+		now: () => now,
+		schedule(fn: () => void, ms: number) {
+			const task = { at: now + ms, fn };
+			tasks.add(task);
+			return { unref() {}, cancel: () => tasks.delete(task) };
+		},
+		advance(ms: number) {
+			const end = now + ms;
+			for (;;) {
+				const next = [...tasks].filter((task) => task.at <= end).sort((a, b) => a.at - b.at)[0];
+				if (next === undefined) break;
+				now = next.at;
+				tasks.delete(next);
+				next.fn();
+			}
+			now = end;
+		},
+	};
+}