opencode-longrun-harness 1.2.22

package/harness/test/v125-stability.test.mjs

@@ -0,0 +1,183 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import * as C from '../src/controller.js';
+import * as M from '../src/memory.mjs';
+import { F } from './helper.mjs';
+
+process.env.LONGRUN_CONTROLLER_FILE = path.resolve(import.meta.dirname, '../src/controller.js');
+const tmp = label => fs.mkdtempSync(path.join(os.tmpdir(), `lr125-${label}-`));
+const write = (p, s) => { fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, s); };
+async function setup(command = ['node', '-e', 'process.exit(1)'], timeoutMs = 2000) {
+  process.env.LONGRUN_STATE_DIR = tmp('state');
+  const dir = tmp('project'), fixture = tmp('fixture');
+  write(path.join(dir, 'value.txt'), 'protected');
+  write(path.join(fixture, 'value.txt'), 'broken');
+  const hooks = await F('../plugin/longrun.js', { client: null });
+  const ctx = { sessionID: 'first', directory: dir, worktree: dir };
+  const start = JSON.parse(await hooks.tool.longrun.execute({ action: 'start', request: 'Harness commissioning', criteria: [{ id: 'c', checks: ['gate'] }], checkCatalogue: { gate: { command, timeoutMs, kind: 'cmd', gate: true } } }, ctx));
+  assert.ok(start.runId);
+  const key = C.stateKey(C.projectIdentity(dir), start.runId), store = new C.Store(process.env.LONGRUN_STATE_DIR);
+  return { hooks, ctx, dir, fixture, store, key, runId: start.runId };
+}
+
+test('memory refresh is independent of directory enumeration and preserves unchanged bytes/mtime', t => {
+  const dir = tmp('memory');
+  write(path.join(dir, 'package.json'), '{"scripts":{"test":"node --test"}}');
+  for (const name of ['zeta', 'alpha']) {
+    write(path.join(dir, name, 'package.json'), '{}');
+    for (let n = 0; n < 12; n++) write(path.join(dir, name, `f${n}.ts`), `export const x${n} = ${n};\n`);
+    write(path.join(dir, name, 'index.ts'), 'export const entry = true;\n');
+  }
+  M.initDeep(dir, { harnessVersion: 'test' });
+  const paths = ['AGENTS.md', 'alpha/AGENTS.md', 'zeta/AGENTS.md', M.MEMORY_PATH];
+  const before = paths.map(p => ({ p, bytes: fs.readFileSync(path.join(dir, p)), mtime: fs.statSync(path.join(dir, p)).mtimeMs }));
+  const readdir = fs.readdirSync;
+  t.mock.method(fs, 'readdirSync', function (...args) { return readdir.apply(fs, args).reverse(); });
+  const refresh = M.initDeep(dir, { harnessVersion: 'test' });
+  for (const old of before) {
+    assert.deepEqual(fs.readFileSync(path.join(dir, old.p)), old.bytes, old.p);
+    assert.equal(fs.statSync(path.join(dir, old.p)).mtimeMs, old.mtime, old.p);
+  }
+  assert.deepEqual(refresh.updated, []);
+  assert.equal(M.assessStaleness(dir, M.readMemoryIndex(dir)).status, 'FRESH');
+});
+
+test('managed refresh preserves surrounding text exactly and retains source subject/location', () => {
+  const dir = tmp('prose');
+  write(path.join(dir, 'main.ts'), '// Presentation-only hash helper: NEVER use this function for combat rules.\nexport const hash = 1;\n');
+  const before = 'Curated preamble\n\n\nkeep exact spacing\n', after = '\n\n\nCurated ending\n';
+  write(path.join(dir, 'AGENTS.md'), before + M.wrapManaged('stale\n').trimEnd() + after);
+  M.initDeep(dir);
+  const content = fs.readFileSync(path.join(dir, 'AGENTS.md'), 'utf8');
+  assert.equal(content.slice(0, content.indexOf(M.MANAGED_BEGIN)), before);
+  assert.equal(content.slice(content.indexOf(M.MANAGED_END) + M.MANAGED_END.length), after);
+  assert.match(content, /main\.ts:1.*Presentation-only hash helper: NEVER/);
+});
+
+test('checkpoint persists advisory progress across session rebind/compaction without changing machine evidence', async t => {
+  const s = await setup(), before = s.store.readJSON(s.key, 'run.json');
+  const progress = { currentSlice: 'recover the fixture', nextAction: 'inspect the independent oracle failure', decisions: ['keep the original contract'], failedHypotheses: ['a timeout alone proves the verifier works'], memoryNodes: ['AGENTS.md'], artifacts: [path.join(s.fixture, 'evidence.log')] };
+  const result = JSON.parse(await s.hooks.tool.longrun.execute({ action: 'checkpoint', runId: s.runId, progress }, s.ctx));
+  assert.equal(result.checkpointed, true);
+  const saved = s.store.readJSON(s.key, 'run.json');
+  assert.deepEqual(saved.agentProgress.fields, progress);
+  for (const key of ['contract', 'contractHash', 'budget', 'receipts', 'state', 'status']) assert.deepEqual(saved[key], before[key], key);
+  await s.hooks.tool.longrun.execute({ action: 'pause', runId: s.runId }, s.ctx);
+  const ctx = { ...s.ctx, sessionID: 'fresh' };
+  await s.hooks.tool.longrun.execute({ action: 'resume', runId: s.runId }, ctx);
+  const observedAt = Date.now(); t.mock.method(Date, 'now', () => observedAt); // exact packet comparison at one instant
+  const packet = await s.hooks.tool.longrun.execute({ action: 'resume-context', runId: s.runId }, ctx);
+  assert.match(packet, /AGENT PROGRESS \(advisory; not verification evidence\)/);
+  assert.match(packet, /NEXT ACTION: inspect the independent oracle failure/);
+  const output = { context: [] }; await s.hooks['experimental.session.compacting']({ sessionID: 'fresh' }, output);
+  assert.equal(output.context.length, 1);
+  assert.match(output.context[0], /^## Long-run recovery\nPRE-COMPACTION SNAPSHOT:/);
+  assert.ok(output.context[0].endsWith(packet));
+  const invalid = JSON.parse(await s.hooks.tool.longrun.execute({ action: 'checkpoint', progress: { status: 'COMPLETE', loss: 0 } }, ctx));
+  assert.equal(invalid.error, 'INVALID_PROGRESS');
+  assert.equal(s.store.readJSON(s.key, 'run.json').status, 'IMPLEMENTING');
+});
+
+test('negative control refuses production, nested and symlink aliases before executing', async () => {
+  const s = await setup(['node', '-e', "require('node:fs').writeFileSync('should-not-run','bad');process.exit(1)"]);
+  const nested = path.join(s.dir, 'copy'); fs.mkdirSync(nested);
+  const alias = path.join(tmp('alias'), 'linked'); fs.symlinkSync(s.dir, alias);
+  const dependency = tmp('dependency'); fs.symlinkSync(s.dir, path.join(dependency, 'node_modules'));
+  for (const fixture of [s.dir, nested, alias, dependency]) {
+    const result = JSON.parse(await s.hooks.tool.longrun_verify.execute({ checkId: 'gate', mode: 'negative', fixture }, s.ctx));
+    assert.equal(result.error, 'FIXTURE_NOT_ISOLATED', fixture);
+    assert.equal(fs.existsSync(path.join(fixture, 'should-not-run')), false);
+  }
+  assert.equal((s.store.readJSON(s.key, 'run.json').evidence || []).length, 0);
+});
+
+test('negative control classifies launch failure and timeout as invalid execution, not expected FAIL', async () => {
+  for (const [command, timeout, observed] of [
+    [['/nonexistent/longrun-test-executable'], 1000, 'ERROR'],
+    [['node', '-e', 'setInterval(()=>{},1000)'], 40, 'TIMEOUT'],
+  ]) {
+    const s = await setup(command, timeout);
+    const result = JSON.parse(await s.hooks.tool.longrun_verify.execute({ checkId: 'gate', mode: 'negative', fixture: s.fixture }, s.ctx));
+    assert.equal(result.observed, observed);
+    assert.equal(result.ok, false);
+    const evidence = s.store.readJSON(s.key, 'run.json').evidence.at(-1);
+    assert.equal(evidence.valid, false);
+    assert.deepEqual(evidence.command, command);
+    assert.ok(evidence.finishedAt >= evidence.startedAt);
+    assert.equal(s.store.readJSON(s.key, 'run.json').receipts.length, 0);
+  }
+});
+
+test('long original requests cannot crowd the next action and machine status out of recovery', () => {
+  const run = C.startRun({ request: 'original request '.repeat(2000), contract: C.makeContract({ criteria: [{ id: 'c', checks: ['check'] }] }), checkCatalogue: { check: { command: ['node', '-e', 'process.exit(1)'] } } }).run;
+  const original = run.originalRequest;
+  assert.equal(C.saveAgentProgress(run, { currentSlice: 'API persistence', nextAction: 'verify reload preserves the saved record' }).ok, true);
+  const { packet, words, truncated } = C.buildRecoveryPacket(run);
+  assert.match(packet, /NEXT ACTION: verify reload preserves the saved record/);
+  assert.match(packet, /COMPLETION BLOCKED: true/);
+  assert.match(packet, /ORIGINAL GOAL EXCERPT/);
+  assert.equal(truncated, true);
+  assert.equal(words, packet.split(/\s+/).filter(Boolean).length);
+  assert.ok(words <= 1500);
+  assert.equal(run.originalRequest, original);
+});
+
+test('progress merges bounded revisions without allowing unknown fields or path traversal', () => {
+  const run = { state: {}, status: 'PAUSED', receipts: [], budget: { iterations: 40 } };
+  assert.equal(C.saveAgentProgress(run, { currentSlice: 'slice one', decisions: ['keep scope'] }).ok, true);
+  assert.equal(C.saveAgentProgress(run, { nextAction: 'review result' }).ok, true);
+  assert.equal(run.agentProgress.fields.currentSlice, 'slice one');
+  assert.equal(run.agentProgressHistory.length, 2);
+  assert.equal(run.agentProgressHistory[0].fields.nextAction, undefined);
+  for (const progress of [{ nextAction: 'x'.repeat(1001) }, { decisions: ['x'.repeat(501)] }, { memoryNodes: ['../AGENTS.md'] }, { receipts: [] }]) {
+    const before = JSON.stringify(run);
+    assert.equal(C.saveAgentProgress(run, progress).error, 'INVALID_PROGRESS');
+    assert.equal(JSON.stringify(run), before);
+  }
+});
+
+test('checkpoint accepts JSON-string objects emitted by the local adapter and validates their contents', async () => {
+  const s = await setup();
+  const fields = { currentSlice: 'adapter recovery', nextAction: 'inspect the declared result' };
+  const result = JSON.parse(await s.hooks.tool.longrun.execute({ action: 'checkpoint', progress: JSON.stringify(fields) }, s.ctx));
+  assert.equal(result.checkpointed, true);
+  assert.deepEqual(s.store.readJSON(s.key, 'run.json').agentProgress.fields, fields);
+  for (const progress of ['not JSON', '[]', '{"status":"COMPLETE"}', JSON.stringify({ currentSlice: 'x'.repeat(241) })]) {
+    const before = s.store.readJSON(s.key, 'run.json');
+    const result = JSON.parse(await s.hooks.tool.longrun.execute({ action: 'checkpoint', progress }, s.ctx));
+    assert.equal(result.error, 'INVALID_PROGRESS');
+    assert.deepEqual(s.store.readJSON(s.key, 'run.json'), before);
+  }
+});
+
+test('ambiguous managed markers preserve the file and are reported for review', () => {
+  const existing = 'Curated notes\n' + M.MANAGED_BEGIN + '\nIncomplete managed block\nStill curated';
+  const result = M.mergeManaged(existing, M.wrapManaged('new content\n'));
+  assert.equal(result.content, existing);
+  assert.equal(result.preserved, true);
+  assert.match(result.note, /ambiguous/);
+});
+
+test('isolation allows internal dependency links, rejects shared hardlinks and detects source mutation', async () => {
+  const s = await setup();
+  fs.symlinkSync('value.txt', path.join(s.fixture, 'internal'));
+  assert.equal(C.validateNegativeFixture(s.fixture, [s.dir]).ok, true);
+  fs.linkSync(path.join(s.dir, 'value.txt'), path.join(s.fixture, 'shared'));
+  assert.equal(C.validateNegativeFixture(s.fixture, [s.dir]).ok, false);
+  fs.unlinkSync(path.join(s.fixture, 'shared'));
+  const run = s.store.readJSON(s.key, 'run.json');
+  run.checkCatalogue.gate.command = ['node', '-e', `require('node:fs').writeFileSync(${JSON.stringify(path.join(s.dir, 'value.txt'))},'unexpected mutation');process.exit(1)`];
+  s.store.writeJSON(s.key, 'run.json', run);
+  // The persisted session catalogue is authoritative for this deliberately hostile runner too.
+  const indexPath = path.join(process.env.LONGRUN_STATE_DIR, 'runs.json');
+  const index = JSON.parse(fs.readFileSync(indexPath)); index.first.checkCatalogue = run.checkCatalogue;
+  fs.writeFileSync(indexPath, JSON.stringify(index));
+  const result = JSON.parse(await s.hooks.tool.longrun_verify.execute({ checkId: 'gate', mode: 'negative', fixture: s.fixture }, s.ctx));
+  assert.equal(result.mutatedProduction, true);
+  assert.equal(result.valid, false);
+  assert.equal(result.ok, false);
+  assert.equal(s.store.readJSON(s.key, 'run.json').receipts.length, 0);
+});

package/harness/test/v126-execution.test.mjs

@@ -0,0 +1,183 @@
+import { reviewProjectFixture } from "./helper.mjs";
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import * as C from '../src/controller.js';
+import { F } from './helper.mjs';
+process.env.LONGRUN_CONTROLLER_FILE = path.resolve(import.meta.dirname, '../src/controller.js');
+const tmp = name => fs.mkdtempSync(path.join(os.tmpdir(), `lr126-${name}-`));
+const command = ['node', '-e', "require('node:assert/strict').match(require('node:fs').readFileSync('value.txt','utf8'),/^good/)"];
+async function setup(options = {}, check = { command, kind: 'cmd' }) {
+  process.env.LONGRUN_STATE_DIR = tmp('state');
+  const dir = tmp('project'); fs.writeFileSync(path.join(dir, 'value.txt'), 'baseline');
+  const hooks = await F('../plugin/longrun.js', { client: null });
+  const ctx = { sessionID: 'first', directory: dir, worktree: dir };
+  const start = JSON.parse(await hooks.tool.longrun.execute({ action: 'start', request: 'Isolated execution regression', criteria: [{ id: 'c', checks: ['check'] }], checkCatalogue: { check }, ...options }, ctx));
+  const store = new C.Store(process.env.LONGRUN_STATE_DIR), key = start.runId && C.stateKey(C.projectIdentity(dir), start.runId);
+  const call = async (action, args = {}, context = ctx) => hooks.tool.longrun.execute({ action, runId: start.runId, ...args }, context);
+  const verify = async (args = {}, context = ctx) => JSON.parse(await hooks.tool.longrun_verify.execute({ checkId: 'check', runId: start.runId, ...args }, context));
+  return { dir, hooks, ctx, start, store, key, call, verify };
+}
+
+test('candidate cap blocks only a new source evaluation and survives a session rebind', async () => {
+  const s = await setup({ candidateBudget: 1 });
+  fs.writeFileSync(path.join(s.dir, 'value.txt'), 'good-one');
+  assert.equal((await s.verify()).status, 'PASS');
+  assert.equal((await s.verify()).candidateCounted, false);
+  await s.call('pause'); await s.call('resume', {}, { ...s.ctx, sessionID: 'fresh' });
+  fs.writeFileSync(path.join(s.dir, 'value.txt'), 'good-two');
+  const refused = await s.verify({}, { ...s.ctx, sessionID: 'fresh' });
+  assert.equal(refused.error, 'BUDGET_EXHAUSTED');
+  assert.ok(refused.spent.candidates);
+  const run = s.store.readJSON(s.key, 'run.json');
+  assert.equal(C.candidateCount(run), 1); assert.equal(run.receipts.length, 2);
+  assert.equal(run.budget.iterations, 1);
+});
+
+test('the real tool schema exposes finite budget and hard-gate inputs; invalid limits do not silently default', async () => {
+  const s = await setup();
+  for (const key of ['candidateBudget', 'timeBudgetHours', 'deadlineHours', 'toolActionCap', 'sameFailureThreshold', 'noProgressThreshold', 'hardGates', 'autoContinue']) assert.ok(s.hooks.tool.longrun.args[key], key);
+  for (const options of [{ candidateBudget: 0 }, { candidateBudget: 1.5 }, { timeBudgetHours: 'garbage' }, { toolActionCap: -1 }]) {
+    const bad = await setup(options); assert.equal(bad.start.error, 'INVALID_BUDGET');
+  }
+  const auto = await setup({ autoContinue: true }); assert.equal(auto.start.error, 'AUTO_CONTINUATION_UNAVAILABLE');
+});
+
+test('read-only receipt diagnostics expose exact command, exit and timestamps without making up absent legacy fields', async () => {
+  const s = await setup(); fs.writeFileSync(path.join(s.dir, 'value.txt'), 'good');
+  const result = await s.verify(); assert.equal(result.status, 'PASS');
+  const view = JSON.parse(await s.call('status'));
+  const receipt = JSON.parse(await s.call('receipts', { receiptId: view.checks[0].effectiveReceiptId })).receipt;
+  assert.deepEqual(receipt.argv, command); assert.equal(receipt.exitCode, 0);
+  assert.ok(receipt.finishedAt >= receipt.startedAt); assert.equal(receipt.outputTail, '');
+  const run = s.store.readJSON(s.key, 'run.json');
+  delete run.receipts[0].exitCode; delete run.receipts[0].command; delete run.receipts[0].argv;
+  s.store.writeJSON(s.key, 'run.json', run);
+  const legacyView = JSON.parse(await s.call('verify'));
+  const legacy = JSON.parse(await s.call('receipts', { receiptId: legacyView.checks[0].effectiveReceiptId })).receipt;
+  assert.equal(legacy.exitCode, null); assert.equal(legacy.command, null); assert.equal(legacy.argv, null);
+});
+
+test('deadline and command-attempt caps refuse execution, including a negative control', async () => {
+  const s = await setup({ toolActionCap: 1 }); fs.writeFileSync(path.join(s.dir, 'value.txt'), 'good');
+  assert.equal((await s.verify()).status, 'PASS');
+  assert.equal((await s.verify()).error, 'BUDGET_EXHAUSTED');
+  assert.equal(s.store.readJSON(s.key, 'run.json').receipts.length, 1);
+  const d = await setup({}, { command, gate: true });
+  const run = d.store.readJSON(d.key, 'run.json'); run.createdAt = Date.now() - run.budget.deadlineSeconds * 1000 - 1; d.store.writeJSON(d.key, 'run.json', run);
+  const fixture = tmp('negative'); fs.writeFileSync(path.join(fixture, 'value.txt'), 'broken');
+  const result = await d.verify({ mode: 'negative', fixture });
+  assert.equal(result.error, 'BUDGET_EXHAUSTED'); assert.ok(result.spent.deadline);
+  assert.equal((d.store.readJSON(d.key, 'run.json').evidence || []).length, 0);
+});
+
+test('active execution allowance caps a subprocess and records measured usage across reloads', async () => {
+  const s = await setup({ timeBudgetHours: 0.00008 }, { command: ['node', '-e', 'setInterval(()=>{},1000)'], timeoutMs: 5000, kind: 'cmd' });
+  const start = Date.now(), result = await s.verify();
+  assert.equal(result.status, 'TIMEOUT'); assert.ok(Date.now() - start < 2000);
+  const run = s.store.readJSON(s.key, 'run.json');
+  assert.ok(run.execution.verificationMs >= 200);
+  assert.equal(run.execution.commandAttempts, 1);
+  assert.equal((await s.verify()).error, 'BUDGET_EXHAUSTED');
+  assert.equal(run.receipts[0].terminationReason, 'active_time_budget');
+});
+
+test('pause is responsive during a check; abort cannot overwrite pause or a concurrent checkpoint', async () => {
+  const s = await setup({}, { command: ['node', '-e', 'setTimeout(()=>process.exit(0),1000)'], kind: 'cmd' });
+  const pending = s.verify();
+  await new Promise(resolve => setTimeout(resolve, 80));
+  await s.call('checkpoint', { progress: { nextAction: 'inspect interrupted check' } });
+  await s.call('pause');
+  const result = await pending;
+  assert.equal(result.status, 'ERROR');
+  const run = s.store.readJSON(s.key, 'run.json');
+  assert.equal(run.status, 'PAUSED'); assert.equal(run.agentProgress.fields.nextAction, 'inspect interrupted check');
+  assert.equal(run.receipts[0].terminationReason, 'run_paused');
+  assert.equal(run.receipts.length, 1);
+});
+
+test('concurrent verifier calls cannot both execute, and context cancellation terminates the owned child', async () => {
+  const s = await setup({}, { command: ['node', '-e', 'setTimeout(()=>process.exit(0),600)'], kind: 'cmd' });
+  const abort = new AbortController(); const pending = s.verify({}, { ...s.ctx, abort: abort.signal });
+  await new Promise(resolve => setTimeout(resolve, 50));
+  assert.equal((await s.verify()).error, 'VERIFY_IN_FLIGHT');
+  abort.abort(); const result = await pending; assert.equal(result.status, 'ERROR');
+  const run = s.store.readJSON(s.key, 'run.json'); assert.equal(run.receipts[0].terminationReason, 'aborted');
+  assert.equal(run.execution.inFlight, null);
+});
+
+test('unlaunched and pre-aborted checks retain errors without spending a source candidate', async () => {
+  for (const abortFirst of [false, true]) {
+    const s = await setup({}, { command: [path.join(tmp('missing'), 'absent')], kind: 'cmd' });
+    fs.writeFileSync(path.join(s.dir, 'value.txt'), 'new source');
+    const controller = new AbortController(); if (abortFirst) controller.abort();
+    const result = await s.verify({}, { ...s.ctx, abort: controller.signal });
+    assert.equal(result.status, 'ERROR'); assert.equal(result.candidateCounted, false);
+    const run = s.store.readJSON(s.key, 'run.json');
+    assert.equal(run.receipts.length, 1); assert.equal(run.execution.commandAttempts, 1);
+    assert.equal(C.candidateCount(run), 0); assert.equal(run.execution.inFlight, null);
+  }
+});
+
+test('root exit cleans up its stubborn descendant and preserves the actual root result', async () => {
+  const dir = tmp('child-cleanup'), pidFile = path.join(dir, 'child.pid');
+  const child = `require('node:fs').writeFileSync(${JSON.stringify(pidFile)},String(process.pid));process.on('SIGTERM',()=>{});setInterval(()=>{},1000)`;
+  const parent = `require('node:child_process').spawn(process.execPath,['-e',${JSON.stringify(child)}],{stdio:'inherit'});setTimeout(()=>process.exit(0),150)`;
+  const before = Date.now();
+  const result = await C.execution.runCommand([process.execPath, '-e', parent], { cwd: dir, timeoutMs: 3000 });
+  assert.equal(result.status, 0); assert.equal(result.terminationReason, null);
+  assert.ok(Date.now() - before < 2000);
+  const pid = Number(fs.readFileSync(pidFile, 'utf8'));
+  for (let i = 0; i < 40 && C.execution.alive(pid); i++) await new Promise(resolve => setTimeout(resolve, 25));
+  assert.equal(C.execution.alive(pid), false, 'owned descendant exited');
+});
+
+test('closed descendant stdio cannot return PASS before a late source mutation and group cleanup', async () => {
+  const pidFile = path.join(tmp('silent-child'), 'pid');
+  const child = `require('node:fs').writeFileSync(${JSON.stringify(pidFile)},String(process.pid));process.on('SIGTERM',()=>{});setTimeout(()=>require('node:fs').writeFileSync('value.txt','late mutation'),250);setInterval(()=>{},1000)`;
+  const parent = `require('node:child_process').spawn(process.execPath,['-e',${JSON.stringify(child)}],{stdio:'ignore'});setTimeout(()=>process.exit(0),100)`;
+  const s = await setup({}, { command: [process.execPath, '-e', parent], kind: 'cmd' });
+  const result = await s.verify();
+  assert.equal(result.status, 'STALE', 'fingerprint comparison happens after owned descendants exit');
+  assert.equal(C.execution.alive(Number(fs.readFileSync(pidFile, 'utf8'))), false);
+  assert.equal(s.store.readJSON(s.key, 'run.json').execution.inFlight, null);
+});
+
+test('terminal state committed by another writer cannot be overwritten by stale lifecycle actions', async () => {
+  for (const action of ['pause', 'resume', 'cancel', 'checkpoint', 'complete']) {
+    const s = await setup(); fs.writeFileSync(path.join(s.dir, 'value.txt'), 'good');
+    await s.verify();
+    if (action === "complete") reviewProjectFixture(s.dir, s.start.runId);
+    const mutate = C.Store.prototype.mutate; let intercepted = false;
+    C.Store.prototype.mutate = function(key, callback) {
+      if (!intercepted && key === s.key) {
+        intercepted = true;
+        mutate.call(this, key, run => { run.status = 'CANCELLED'; return { ok: true }; });
+      }
+      return mutate.call(this, key, callback);
+    };
+    try {
+      const result = JSON.parse(await s.call(action, { progress: { nextAction: 'must not persist' } }));
+      assert.equal(result.error, 'RUN_CANCELLED', action);
+      const run = s.store.readJSON(s.key, 'run.json');
+      assert.equal(run.status, 'CANCELLED'); assert.equal(run.agentProgress?.fields?.nextAction, undefined);
+    } finally { C.Store.prototype.mutate = mutate; }
+  }
+});
+
+test('legacy usage is a labelled lower bound and orphaned reservations fail closed without invented receipts', async () => {
+  const s = await setup(); const run = s.store.readJSON(s.key, 'run.json');
+  delete run.execution;
+  run.receipts = [{ startedAt: 100, finishedAt: 180 }, { startedAt: 150, finishedAt: 200 }, {}];
+  const usage = C.execution.usage(run);
+  assert.equal(usage.verificationMs, 100); assert.equal(usage.commandAttempts, 3);
+  assert.equal(usage.historicalUsageUnknown, true);
+  C.execution.initialize(run);
+  run.execution.inFlight = { token: 'interrupted-fixture', ownerPid: -1, childPid: null };
+  s.store.writeJSON(s.key, 'run.json', run);
+  const before = fs.readFileSync(s.store._file(s.key, 'run.json'));
+  assert.equal((await s.verify()).error, 'EXECUTION_RECOVERY_REQUIRED');
+  assert.deepEqual(fs.readFileSync(s.store._file(s.key, 'run.json')), before);
+});

package/harness/test/v127-reconciliation.test.mjs

@@ -0,0 +1,139 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import * as C from '../src/controller.js';
+import { F } from './helper.mjs';
+process.env.LONGRUN_CONTROLLER_FILE = path.resolve(import.meta.dirname, '../src/controller.js');
+async function setup({ delay = 0, negative = false, timeoutMs, executable = process.execPath } = {}) {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'lr127-'));
+  process.env.LONGRUN_STATE_DIR = path.join(base, 'state');
+  const dir = path.join(base, 'project'); fs.mkdirSync(dir); fs.writeFileSync(path.join(dir, 'value.txt'), 'before');
+  const counter = path.join(base, 'commands.txt');
+  const command = [executable, '-e', `require('node:fs').appendFileSync(${JSON.stringify(counter)},'1');setTimeout(()=>require('node:assert/strict').equal(require('node:fs').readFileSync('value.txt','utf8'),'after'),${delay})`];
+  const hooks = await F('../plugin/longrun.js', { client: null });
+  const context = { sessionID: 'initial', directory: dir, worktree: dir };
+  const start = JSON.parse(await hooks.tool.longrun.execute({ action: 'start', request: 'Real command reconciliation fixture', criteria: [{ id: 'c', checks: ['check'] }], checkCatalogue: { check: { command, kind: 'cmd', negativeControl: true, timeoutMs } } }, context));
+  const store = new C.Store(process.env.LONGRUN_STATE_DIR), key = C.stateKey(C.projectIdentity(dir), start.runId);
+  fs.writeFileSync(path.join(dir, 'value.txt'), 'after');
+  const call = async (action, args = {}, ctx = context) => hooks.tool.longrun.execute({ action, runId: start.runId, ...args }, ctx);
+  const verify = async () => {
+    const args = { checkId: 'check', runId: start.runId };
+    if (negative) { args.mode = 'negative'; args.fixture = path.join(base, 'fixture'); fs.mkdirSync(args.fixture); fs.writeFileSync(path.join(args.fixture, 'value.txt'), 'broken'); }
+    return JSON.parse(await hooks.tool.longrun_verify.execute(args, context));
+  };
+  const pending = async () => {
+    const mutate = C.Store.prototype.mutate;
+    C.Store.prototype.mutate = function(k, cb) {
+      if (k === key && fs.readdirSync(this.keyPath(k)).some(n => /^execution-.*\.json$/.test(n))) return { error: 'STATE_BUSY' };
+      return mutate.call(this, k, cb);
+    };
+    try { assert.equal((await verify()).error, 'RESULT_COMMIT_PENDING'); }
+    finally { C.Store.prototype.mutate = mutate; }
+    const token = store.readJSON(key, 'run.json').execution.inFlight.token;
+    return { token, name: `execution-${token}.json`, journal: store.readJSON(key, `execution-${token}.json`) };
+  };
+  return { base, dir, counter, hooks, context, runId: start.runId, store, key, call, verify, pending };
+}
+
+test('a fresh session reconciles a genuine saved result once without rerunning or unpausing', async () => {
+  const s = await setup(), { journal } = await s.pending();
+  await s.call('checkpoint', { progress: { nextAction: 'review recovered evidence' } });
+  await s.call('pause');
+  const before = s.store.readJSON(s.key, 'run.json');
+  const fresh = await F('../plugin/longrun.js', { client: null });
+  const reconcile = () => fresh.tool.longrun.execute({ action: 'reconcile', runId: s.runId }, { ...s.context, sessionID: 'fresh' });
+  const result = JSON.parse(await reconcile()); assert.equal(result.reconciled, true);
+  const run = s.store.readJSON(s.key, 'run.json');
+  assert.equal(run.status, 'PAUSED'); assert.equal(run.autoEnabled, false);
+  assert.equal(run.agentProgress.fields.nextAction, 'review recovered evidence');
+  assert.deepEqual(run.budget, before.budget); assert.equal(run.contractHash, before.contractHash);
+  assert.equal(run.receipts.length, 1); assert.equal(run.receipts[0].status, 'PASS');
+  assert.equal(C.candidateCount(run), 1); assert.equal(run.execution.commandAttempts, 1);
+  assert.equal(run.execution.verificationMs, journal.result.finishedAt - journal.result.startedAt);
+  assert.equal(run.execution.inFlight, null); assert.equal(fs.readFileSync(s.counter, 'utf8'), '1');
+  const second = JSON.parse(await reconcile()); assert.equal(second.nothingPending, true);
+  assert.equal(s.store.readJSON(s.key, 'run.json').receipts.length, 1);
+  assert.equal(fs.readFileSync(s.counter, 'utf8'), '1');
+});
+
+test('reconciliation retains old-source evidence as stale and preserves terminal cancellation', async () => {
+  const s = await setup(); await s.pending(); await s.call('cancel', { reason: 'fixture cancelled after command finished' });
+  fs.writeFileSync(path.join(s.dir, 'value.txt'), 'newer source');
+  assert.equal(JSON.parse(await s.call('reconcile')).reconciled, true);
+  const view = JSON.parse(await s.call('status'));
+  assert.equal(view.state, 'CANCELLED'); assert.equal(view.checks[0].effectiveStatus, 'STALE');
+  assert.equal(view.historicalReceiptCount, 1); assert.equal(view.completionBlocked, true);
+});
+
+test('a recovered negative control remains separate from product receipts and candidates', async () => {
+  const s = await setup({ negative: true }); await s.pending();
+  assert.equal(JSON.parse(await s.call('reconcile')).reconciled, true);
+  const run = s.store.readJSON(s.key, 'run.json');
+  assert.equal(run.receipts.length, 0); assert.equal(C.candidateCount(run), 0);
+  assert.equal(run.evidence.length, 1); assert.equal(run.evidence[0].observed, 'FAIL');
+  assert.equal(run.execution.commandAttempts, 1); assert.equal(run.execution.inFlight, null);
+  await s.call('reconcile'); assert.equal(s.store.readJSON(s.key, 'run.json').evidence.length, 1);
+});
+
+test('missing or inconsistent journals cannot release the reservation or manufacture a receipt', async () => {
+  for (const corruption of ['missing', 'fingerprint', 'command', 'cleanup', 'exit']) {
+    const s = await setup(), { name, journal } = await s.pending();
+    if (corruption === 'missing') fs.rmSync(s.store._file(s.key, name));
+    else {
+      if (corruption === 'fingerprint') delete journal.receipt.sourceFingerprint;
+      if (corruption === 'command') journal.receipt.argv = ['arbitrary'];
+      if (corruption === 'cleanup') journal.result.cleanupComplete = false;
+      if (corruption === 'exit') journal.result.status = 1;
+      s.store.writeJSON(s.key, name, journal);
+    }
+    const before = fs.readFileSync(s.store._file(s.key, 'run.json'));
+    const result = JSON.parse(await s.call('reconcile'));
+    assert.match(result.error, /EXECUTION_RECORD|EXECUTION_CLEANUP/);
+    assert.deepEqual(fs.readFileSync(s.store._file(s.key, 'run.json')), before);
+    assert.equal(fs.readFileSync(s.counter, 'utf8'), '1');
+  }
+});
+
+test('live checks and a busy writer cannot be bypassed by reconciliation', async () => {
+  const s = await setup({ delay: 600 }); const pending = s.verify();
+  await new Promise(resolve => setTimeout(resolve, 100));
+  assert.equal(JSON.parse(await s.call('reconcile')).error, 'VERIFY_IN_FLIGHT');
+  assert.equal((await pending).status, 'PASS');
+  const p = await setup(); await p.pending(); p.store.tryLock(p.key, 'fixture-owner');
+  try { assert.equal(JSON.parse(await p.call('reconcile')).error, 'STATE_BUSY'); }
+  finally { p.store.releaseLock(p.key); }
+  assert.equal(JSON.parse(await p.call('reconcile')).reconciled, true);
+  assert.equal(p.store.readJSON(p.key, 'run.json').receipts.length, 1);
+});
+
+test('real timeouts and launch failures retain their status without fabricating successful work', async () => {
+  for (const [options, expected] of [[{ delay: 5000, timeoutMs: 150 }, 'TIMEOUT'], [{ executable: '/longrun-no-such-executable' }, 'ERROR']]) {
+    const s = await setup(options); await s.pending();
+    const result = JSON.parse(await s.call('reconcile')); assert.equal(result.reconciled, true);
+    const run = s.store.readJSON(s.key, 'run.json');
+    assert.equal(run.receipts[0].status, expected); assert.equal(run.execution.commandAttempts, 1);
+    if (expected === 'ERROR') { assert.equal(C.candidateCount(run), 0); assert.equal(fs.existsSync(s.counter), false); }
+  }
+});
+
+test('legacy v1.2.6 result journals recover under an expired budget without restarting the run', async () => {
+  const s = await setup(), { name, journal } = await s.pending();
+  delete journal.runId; s.store.writeJSON(s.key, name, journal);
+  s.store.mutate(s.key, run => { run.createdAt -= 86400000; run.status = 'RECOVERY_REQUIRED'; return { ok: true }; });
+  const before = s.store.readJSON(s.key, 'run.json');
+  assert.equal(JSON.parse(await s.call('reconcile')).reconciled, true);
+  const run = s.store.readJSON(s.key, 'run.json');
+  assert.equal(run.createdAt, before.createdAt); assert.deepEqual(run.budget, before.budget);
+  assert.equal(run.status, 'RECOVERY_REQUIRED'); assert.equal(run.receipts.length, 1);
+  assert.equal(JSON.parse(await s.call('resume')).error, 'BUDGET_EXHAUSTED');
+});
+
+test('an executor retry after reconciliation cannot charge or append the same result again', async () => {
+  const s = await setup(), { journal } = await s.pending(); await s.call('reconcile');
+  const before = s.store.readJSON(s.key, 'run.json');
+  const retry = s.store.mutate(s.key, run => C.commitExecutionResult(run, journal));
+  assert.equal(retry.alreadyRecorded, true); assert.equal(retry.apply.candidate.counted, false);
+  assert.deepEqual(s.store.readJSON(s.key, 'run.json'), before);
+});