skalpel 4.0.43 → 4.0.44

package/metrics.mjs

@@ -3,20 +3,54 @@
 // the file (a live-mutated counter file WOULD lose increments under that race). record() never throws
 // and never blocks — telemetry must not be able to break a fail-open hook.
 //
+// BOUNDED: this file was previously append-only with no cap, so it grew without limit — one row every
+// turn, forever, for every user. record() now trims the file back to the last LOG_KEEP_LINES rows once
+// it crosses LOG_MAX_BYTES (same rotate-in-place discipline as verify-shadow.log's appendShadowLog),
+// so on-disk growth is bounded. stats.mjs folds whatever rows remain, so a trim only drops the oldest
+// telemetry — never breaks the reader.
+//
 // Read it back with:  node ~/.skalpel/hooks/stats.mjs
-import { appendFileSync, mkdirSync } from "node:fs";
+import {
+  appendFileSync,
+  mkdirSync,
+  statSync,
+  readFileSync,
+  writeFileSync,
+  renameSync,
+} from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
 const DIR = join(homedir(), ".skalpel");
 export const METRICS_PATH = join(DIR, "metrics.ndjson");
 
+// Cap the telemetry file: trim to the last LOG_KEEP_LINES rows once it exceeds LOG_MAX_BYTES.
+const LOG_MAX_BYTES = 1024 * 1024; // 1 MiB
+const LOG_KEEP_LINES = 5000;
+
 // outcome ∈ inject | silent | server_error | abort | fetch_error | skipped | budget_spent
 // `abort` == the fetch hit our deadline == a graph cold-start hit (the whole diagnosis).
 // ms == wall-clock of the network call (null for skipped / pre-network exits).
 export function record(event, outcome, ms) {
   try {
     mkdirSync(DIR, { recursive: true });
+    // Bound the file BEFORE appending: once it crosses the cap, keep only the newest rows. The trim is
+    // atomic (tmp + rename) and wrapped so a rotation failure still falls through to the append. A
+    // per-pid tmp keeps concurrent trims from colliding on one temp path.
+    try {
+      if (statSync(METRICS_PATH).size > LOG_MAX_BYTES) {
+        const kept = readFileSync(METRICS_PATH, "utf8")
+          .trim()
+          .split("\n")
+          .filter(Boolean)
+          .slice(-LOG_KEEP_LINES);
+        const tmp = `${METRICS_PATH}.${process.pid}.tmp`;
+        writeFileSync(tmp, kept.join("\n") + "\n");
+        renameSync(tmp, METRICS_PATH);
+      }
+    } catch {
+      /* no file yet, or a trim race — still append below */
+    }
     appendFileSync(
       METRICS_PATH,
       JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.43",
+  "version": "4.0.44",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-hook.mjs

@@ -8,9 +8,22 @@
 //   {"hooks":{"UserPromptSubmit":[{"type":"command","command":"node /path/to/skalpel-hook.mjs"}]}}
 // Config: SKALPEL_API (default https://graph.skalpel.ai). Identity comes from the Google sign-in
 // saved by `skalpel-prosumer login` (~/.skalpel/auth.json); SKALPEL_USER overrides for dev.
-import { readFileSync, writeFileSync, renameSync, appendFileSync, mkdirSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  appendFileSync,
+  mkdirSync,
+  openSync,
+  writeSync,
+  closeSync,
+  statSync,
+  rmSync,
+  realpathSync,
+} from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { identity } from "./auth.mjs";
 import { record } from "./metrics.mjs";
 import { recordInsight, cleanText, verifySpawnArmed } from "./insights.mjs";
@@ -230,8 +243,8 @@ function writeSteer(label, type, wt, id) {
 //   suppress[key] : true         — "fewer like this"    -> stop firing this steer type/trap for me
 //   verbose[key]  : true         — "tell me more…"      -> expand this trap's steer when it fires
 //   score[type]   : {up,down}    — implicit + explicit usefulness, for future gating
-const PREFS_PATH = join(homedir(), ".skalpel", "prefs.json");
-function readPrefs() {
+export const PREFS_PATH = join(homedir(), ".skalpel", "prefs.json");
+export function readPrefs() {
   const base = { muted_session: false, suppress: {}, verbose: {}, score: {}, stats: {} };
   try {
     return { ...base, ...JSON.parse(readFileSync(PREFS_PATH, "utf8")) };
@@ -264,10 +277,11 @@ function ignoredByAdherence(prefs, type) {
   const st = prefs.stats && prefs.stats[type];
   return !!(st && st.shown >= 6 && st.acted / st.shown < 0.2);
 }
-function writePrefs(p) {
+export function writePrefs(p) {
   try {
     mkdirSync(join(homedir(), ".skalpel"), { recursive: true });
-    const tmp = `${PREFS_PATH}.tmp`;
+    // Per-pid tmp so two concurrent writers can't tear each other's temp file before the rename commit.
+    const tmp = `${PREFS_PATH}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(p));
     renameSync(tmp, PREFS_PATH);
   } catch {
@@ -275,6 +289,89 @@ function writePrefs(p) {
   }
 }
 
+// ---- LOST-UPDATE FIX (prefs.json) --------------------------------------------------------------------
+// Every hook used to readPrefs() at the TOP of the turn, then await identity()+/retrieve (seconds), then
+// write that SAME in-memory object back at the end. During that long window a concurrent hook could mute
+// / suppress / record feedback — and this hook's end-of-turn write, carrying its stale snapshot, silently
+// CLOBBERED it (a user's "mute" or "fewer like this" just vanished). The fix is a race-safe read-modify-
+// write: serialize writers on a tiny cross-process lock, RE-READ prefs fresh immediately before writing,
+// apply only the intended field mutation to THAT fresh copy, then atomic-write. So a concurrent update
+// that landed during our await window is merged in, never overwritten. FAIL-OPEN throughout: prefs are a
+// bonus — a missed lock or a bad mutator degrades to a best-effort write and NEVER breaks the hook.
+const PREFS_LOCK_PATH = `${PREFS_PATH}.lock`;
+const PREFS_LOCK_STALE_MS = 10_000; // a hook that died holding the lock is reclaimed after this
+const PREFS_LOCK_SPIN_MS = 250; // bounded wait; real contention (a double-fire) clears in sub-ms
+
+// Synchronous sleep with no busy-spin (Atomics.wait on a throwaway buffer). Keeps the RMW critical
+// section short without pulling the hot path into async just for a lock.
+function sleepMs(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    /* SharedArrayBuffer unavailable — fall through; the spin just polls a touch faster */
+  }
+}
+
+// Acquire the prefs lock via an atomic exclusive create (O_EXCL "wx"): exactly one racer wins, the rest
+// back off and retry within a bounded budget; a stale lock (dead holder) is reclaimed by mtime. Returns
+// true if held (caller must releasePrefsLock), false if it gave up (caller still does a best-effort write).
+function acquirePrefsLock() {
+  const deadline = Date.now() + PREFS_LOCK_SPIN_MS;
+  for (;;) {
+    try {
+      const fd = openSync(PREFS_LOCK_PATH, "wx");
+      try {
+        writeSync(fd, String(process.pid));
+      } finally {
+        closeSync(fd);
+      }
+      return true;
+    } catch (e) {
+      if (e && e.code === "EEXIST") {
+        try {
+          const st = statSync(PREFS_LOCK_PATH);
+          if (Date.now() - st.mtimeMs >= PREFS_LOCK_STALE_MS) {
+            rmSync(PREFS_LOCK_PATH, { force: true }); // stale holder — reclaim, then retry the create
+            continue;
+          }
+        } catch {
+          continue; // lock vanished (just released) — retry immediately
+        }
+      } else {
+        return false; // unexpected error → don't spin; caller falls back to an unlocked write
+      }
+    }
+    if (Date.now() >= deadline) return false;
+    sleepMs(2);
+  }
+}
+function releasePrefsLock() {
+  try {
+    rmSync(PREFS_LOCK_PATH, { force: true });
+  } catch {
+    /* best-effort — a stale lock self-expires after PREFS_LOCK_STALE_MS */
+  }
+}
+
+// Race-safe prefs mutation. Under the lock: re-read fresh, apply `mutate(fresh)`, atomic-write. `mutate`
+// receives the on-disk state so its change is merged onto whatever concurrent hooks have persisted — the
+// caller must NOT rely on a snapshot read earlier in the turn. Returns the written object. Never throws.
+export function updatePrefs(mutate) {
+  const locked = acquirePrefsLock();
+  try {
+    const fresh = readPrefs();
+    try {
+      mutate(fresh);
+    } catch {
+      /* a mutator bug must never break the hook */
+    }
+    writePrefs(fresh);
+    return fresh;
+  } finally {
+    if (locked) releasePrefsLock();
+  }
+}
+
 // Parse a control PHRASE aimed at skalpel out of the user's prompt — the explicit feedback channel,
 // captured natively through the prompt (no button UI needed; this IS the harness wrapping). Returns
 // {action} or null. Deliberately narrow so normal prose never trips it: the word "skalpel", or a
@@ -353,51 +450,64 @@ function logSessionEvent(ev) {
 function applyControl(action, prefs) {
   const last = readSteer();
   const key = last.type ? (last.wt ? `${last.type}:${last.wt}` : last.type) : null;
-  const bump = (dir) => {
+  // A mutation is applied to a prefs object `P`; the score bump reads+writes P (not the outer snapshot).
+  const bump = (P, dir) => {
     if (!last.type) return;
-    const sc = prefs.score[last.type] || { up: 0, down: 0 };
+    const sc = P.score[last.type] || { up: 0, down: 0 };
     sc[dir] += 1;
-    prefs.score[last.type] = sc;
+    P.score[last.type] = sc;
+  };
+  // Apply the SAME field mutation to (a) the in-memory `prefs` so THIS turn's downstream gating sees it,
+  // and (b) the on-disk prefs via the race-safe read-modify-write so a concurrent hook's update isn't
+  // clobbered. The disk copy is re-read fresh inside updatePrefs, so each object is mutated once from its
+  // own base (set-once flags stay idempotent; a score bump lands exactly once on disk).
+  const persist = (m) => {
+    m(prefs);
+    updatePrefs(m);
   };
   if (action === "mute") {
-    prefs.muted_session = true;
-    writePrefs(prefs);
+    persist((P) => {
+      P.muted_session = true;
+    });
     return (
       "[skalpel — the user asked to MUTE skalpel for this session. Acknowledge in ONE short line " +
       "(“🔬 skalpel · muted for this session — I'll stay quiet”) and surface NO steers the rest of this session.]"
     );
   }
   if (action === "unmute") {
-    prefs.muted_session = false;
-    writePrefs(prefs);
+    persist((P) => {
+      P.muted_session = false;
+    });
     return "[skalpel — the user re-enabled skalpel. Acknowledge in one short line and continue.]";
   }
   if (action === "fewer") {
-    if (key) prefs.suppress[key] = true;
-    bump("down");
-    writePrefs(prefs);
+    persist((P) => {
+      if (key) P.suppress[key] = true;
+      bump(P, "down");
+    });
     return (
       `[skalpel — the user wants FEWER steers like the last one${last.wt ? ` (${last.wt})` : ""}. ` +
       "Acknowledge in one line (“🔬 skalpel · got it — easing off those”); skalpel will stop firing that trap for them.]"
     );
   }
   if (action === "more") {
-    if (key) prefs.verbose[key] = true;
-    writePrefs(prefs);
+    persist((P) => {
+      if (key) P.verbose[key] = true;
+    });
     return (
       `[skalpel — the user wants MORE detail whenever they hit this${last.wt ? ` ${last.wt}` : ""} trap. ` +
       "Acknowledge briefly, and from now on EXPAND that steer: name the shape, the count, and the way out.]"
     );
   }
   if (action === "up") {
-    bump("up");
-    writePrefs(prefs);
+    persist((P) => bump(P, "up"));
     return null; // positive signal — just record it; no need to make the model announce anything
   }
   if (action === "down") {
-    if (key) prefs.suppress[key] = true;
-    bump("down");
-    writePrefs(prefs);
+    persist((P) => {
+      if (key) P.suppress[key] = true;
+      bump(P, "down");
+    });
     return "[skalpel — the user found the last steer unhelpful. Acknowledge briefly; skalpel will ease off that one.]";
   }
   return null;
@@ -438,8 +548,13 @@ function pushTraj(cls) {
 }
 
 // local debug trail — proves the hook RAN (in any session), and what it decided. Fail-safe.
+// OPT-IN ONLY. The old guard (`=== "0"` → skip) meant the log was written on EVERY hook invocation for
+// EVERY user unless they explicitly set SKALPEL_DEBUG=0 — an unbounded ~/.skalpel/hook.log growing one
+// entry per turn, forever, that nobody asked for. dbg now writes ONLY when SKALPEL_DEBUG is explicitly
+// enabled (any value other than the off sentinels), so the default install produces no hook.log at all.
 function dbg(msg) {
-  if (process.env.SKALPEL_DEBUG === "0") return;
+  const flag = process.env.SKALPEL_DEBUG;
+  if (!flag || flag === "0" || flag === "false" || flag === "off") return; // default OFF — no log leak
   try {
     const p = join(homedir(), ".skalpel");
     mkdirSync(p, { recursive: true });
@@ -690,8 +805,14 @@ async function main() {
         // off (a break-out this turn). Accretes per steer-type; the gate above reads it next time. This is
         // categorical revealed-preference data, not a number shown to the user.
         const paid = brokeOut;
-        const adh = recordAdherence(prefs, prevSteer, steerWt, paid);
-        writePrefs(prefs);
+        // Race-safe write: this is the end-of-turn write that follows the long identity()+/retrieve await,
+        // so it must NOT persist the stale `prefs` snapshot read at the top of the turn (that clobbered a
+        // concurrent hook's mute/suppress). Re-read fresh inside updatePrefs and apply the adherence
+        // increment to THAT, merging in whatever landed during our await window.
+        let adh = null;
+        updatePrefs((fresh) => {
+          adh = recordAdherence(fresh, prevSteer, steerWt, paid);
+        });
         // ADHERENCE INSIGHT ROW (data, not display — no `display` field): the same judgment, exported
         // for the TUI's rail, joined to the prior steer by its minted id. followed = the n+1 credit
         // landed; ignored = you stayed on the very work-type the steer pushed you off AND no credit;
@@ -788,6 +909,22 @@ async function main() {
   }
 }
 
-main()
-  .then(() => process.exit(0))
-  .catch(() => process.exit(0));
+// Run main() only when invoked as the hook (node skalpel-hook.mjs), never on import. Importing the module
+// (the prefs concurrency test) must not read fd 0 or emit hook output. Robust main detection mirrors
+// verify-shadow.mjs / skalpel-setup.mjs: compare REAL paths, not a hand-built file:// URL (a home dir with
+// a space breaks `new URL("file://"+path)`). Any error → treat as not-main (safe: a test import stays inert).
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  main()
+    .then(() => process.exit(0))
+    .catch(() => process.exit(0));
+}

package/verify-races.test.mjs

@@ -0,0 +1,182 @@
+// verify-races.test.mjs — regression tests for the core-engine race/growth fixes (fix/core-engine-races):
+//   • classifyOutcome no longer misclassifies a GENUINE fail whose OWN output contains a harness phrase
+//   • acquireLock is single-flight under a CONCURRENT burst (O_EXCL, not statSync→writeFileSync TOCTOU)
+//   • updatePrefs is a race-safe read-modify-write (a concurrent mute/suppress is merged, never clobbered)
+//   • metrics.ndjson is bounded (rotate-in-place), not unbounded
+// HOME-isolated (import "./_test-home.mjs" FIRST) so nothing here reads/clobbers a real ~/.skalpel.
+import "./_test-home.mjs";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  utimesSync,
+} from "node:fs";
+import { tmpdir, homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { classifyOutcome, acquireLock } from "./verify-shadow.mjs";
+import { updatePrefs, readPrefs, writePrefs } from "./skalpel-hook.mjs";
+import { record, METRICS_PATH } from "./metrics.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+// ---- Bug 4: classifyOutcome — a genuine fail's OWN output containing a harness phrase is NOT quarantined
+test("classifyOutcome — a GENUINE fail that MENTIONS 'command not found' stays GENUINE_FAIL", () => {
+  const genuine =
+    `FAIL src/cli.test.js\n` +
+    `  ● prints a helpful error for an unknown subcommand\n` +
+    `    Expected substring: "command not found"\n` +
+    `    Received string:    "unknown option"\n` +
+    `  1 failed`;
+  assert.equal(classifyOutcome({ code: 1 }, genuine), "GENUINE_FAIL");
+  const genuine2 = `AssertionError: expected error to include "no such file or directory"\n  1 failing`;
+  assert.equal(classifyOutcome({ code: 1 }, genuine2), "GENUINE_FAIL");
+});
+
+test("classifyOutcome — a REAL harness break is STILL HARNESS_ERROR (true positives preserved)", () => {
+  assert.equal(classifyOutcome({ code: 1 }, "bash: pytest: command not found"), "HARNESS_ERROR");
+  assert.equal(classifyOutcome({ code: 1 }, "sh: 1: eslint: not found"), "HARNESS_ERROR");
+  assert.equal(classifyOutcome({ code: 1 }, 'npm error Missing script: "test"'), "HARNESS_ERROR");
+  assert.equal(
+    classifyOutcome({ code: 1 }, "Error: ENOENT: no such file or directory, open 'x'"),
+    "HARNESS_ERROR",
+  );
+  assert.equal(
+    classifyOutcome({ code: 1 }, "browserType.launch: Executable doesn't exist at /ms-playwright"),
+    "HARNESS_ERROR",
+  );
+});
+
+// ---- Bug 3: acquireLock — exactly ONE holder under a concurrent burst (the TOCTOU is closed) ----
+test("acquireLock — a concurrent burst yields EXACTLY ONE holder (no double-acquire)", () => {
+  const home = mkdtempSync(join(tmpdir(), "skalpel-lockrace-"));
+  mkdirSync(join(home, ".skalpel"), { recursive: true });
+  const worker = join(home, "w.mjs");
+  writeFileSync(
+    worker,
+    `import { acquireLock } from ${JSON.stringify(join(HERE, "verify-shadow.mjs"))};\n` +
+      `const START = Number(process.env.START_MS);\n` +
+      `while (Date.now() < START) {}\n` +
+      `process.stdout.write(acquireLock() ? "ACQUIRED" : "denied");\n`,
+  );
+  const N = 40;
+  const START_MS = Date.now() + 400;
+  const kids = [];
+  for (let i = 0; i < N; i++) {
+    kids.push(
+      spawn("node", [worker], {
+        env: { ...process.env, HOME: home, USERPROFILE: home, START_MS: String(START_MS) },
+        stdio: ["ignore", "pipe", "ignore"],
+      }),
+    );
+  }
+  const outs = kids.map(
+    (c) =>
+      new Promise((res) => {
+        let o = "";
+        c.stdout.on("data", (d) => (o += d));
+        c.on("exit", () => res(o));
+      }),
+  );
+  return Promise.all(outs).then((results) => {
+    const acquired = results.filter((r) => r.includes("ACQUIRED")).length;
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(acquired, 1, `expected exactly 1 holder, got ${acquired}`);
+  });
+});
+
+test("acquireLock — respects a fresh lock, reclaims a stale one", () => {
+  const dir = join(homedir(), ".skalpel");
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(dir, { recursive: true });
+  const LOCK = join(dir, "verify-shadow.lock");
+  assert.equal(acquireLock(), true, "first acquire creates the lock");
+  assert.equal(acquireLock(), false, "a fresh lock is respected (no re-acquire)");
+  // Backdate the lock past the 90s stale window → a reclaim is allowed.
+  const old = Date.now() / 1000 - 200;
+  utimesSync(LOCK, old, old);
+  assert.equal(acquireLock(), true, "a stale lock is reclaimed");
+  rmSync(dir, { recursive: true, force: true });
+});
+
+// ---- Bug 1: updatePrefs — re-read + merge, so a concurrent update is never clobbered ----
+test("updatePrefs — merges a concurrent mute instead of clobbering it with a stale snapshot", () => {
+  rmSync(join(homedir(), ".skalpel"), { recursive: true, force: true });
+  mkdirSync(join(homedir(), ".skalpel"), { recursive: true });
+  writePrefs({ muted_session: false, suppress: {}, verbose: {}, score: {}, stats: {} });
+  // The hook read a stale snapshot at the top of its turn:
+  const stale = readPrefs();
+  assert.equal(stale.muted_session, false);
+  // …then a CONCURRENT hook muted the session (persisted to disk) during the await window:
+  writePrefs({ ...stale, muted_session: true });
+  // …now the first hook's end-of-turn write goes through updatePrefs, which re-reads fresh + merges:
+  updatePrefs((f) => {
+    f.suppress["SINK:refine"] = true;
+  });
+  const after = readPrefs();
+  assert.equal(after.muted_session, true, "the concurrent mute survived (not clobbered)");
+  assert.equal(after.suppress["SINK:refine"], true, "our own suppress landed too");
+});
+
+test("updatePrefs — 50 concurrent distinct-key writers lose NONE", () => {
+  const home = mkdtempSync(join(tmpdir(), "skalpel-keys-"));
+  mkdirSync(join(home, ".skalpel"), { recursive: true });
+  writeFileSync(
+    join(home, ".skalpel", "prefs.json"),
+    JSON.stringify({ muted_session: false, suppress: {}, verbose: {}, score: {}, stats: {} }),
+  );
+  const worker = join(home, "kw.mjs");
+  writeFileSync(
+    worker,
+    `import { updatePrefs } from ${JSON.stringify(join(HERE, "skalpel-hook.mjs"))};\n` +
+      `const i = Number(process.env.KEY_I);\n` +
+      `const START = Number(process.env.START_MS);\n` +
+      `while (Date.now() < START) {}\n` +
+      `updatePrefs((P) => { P.suppress["k" + i] = true; });\n`,
+  );
+  const N = 50;
+  const START_MS = Date.now() + 500;
+  const kids = [];
+  for (let i = 0; i < N; i++) {
+    kids.push(
+      new Promise((res) => {
+        const c = spawn("node", [worker], {
+          env: {
+            ...process.env,
+            HOME: home,
+            USERPROFILE: home,
+            KEY_I: String(i),
+            START_MS: String(START_MS),
+          },
+          stdio: "ignore",
+        });
+        c.on("exit", res);
+      }),
+    );
+  }
+  return Promise.all(kids).then(() => {
+    const suppress =
+      JSON.parse(readFileSync(join(home, ".skalpel", "prefs.json"), "utf8")).suppress || {};
+    let survived = 0;
+    for (let i = 0; i < N; i++) if (suppress["k" + i] === true) survived++;
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(survived, N, `expected all ${N} keys, got ${survived}`);
+  });
+});
+
+// ---- Bug 5: metrics.ndjson is bounded (rotate-in-place), not unbounded ----
+test("record — metrics.ndjson stays bounded under a heavy write load", () => {
+  rmSync(METRICS_PATH, { force: true });
+  for (let i = 0; i < 30000; i++) record("prompt", i % 2 ? "inject" : "silent", 1800);
+  const size = statSync(METRICS_PATH).size;
+  assert.ok(size <= 1024 * 1024, `metrics.ndjson should be <= 1 MiB, was ${size} bytes`);
+  // …and it's still valid NDJSON the reader can fold (last line parses).
+  const lines = readFileSync(METRICS_PATH, "utf8").trim().split("\n").filter(Boolean);
+  assert.doesNotThrow(() => JSON.parse(lines[lines.length - 1]));
+});

package/verify-shadow.mjs

@@ -54,6 +54,9 @@ import {
   renameSync,
   statSync,
   rmSync,
+  openSync,
+  writeSync,
+  closeSync,
 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -575,10 +578,25 @@ export function classifyOutcome(err, evidence) {
   // tool binary/runtime that simply isn't installed (a Playwright browser not downloaded — "Executable
   // doesn't exist" / "download new browsers"). Surfacing any of these would cry wolf on setup state, so
   // they are HARNESS_ERROR, never counted as a lie.
+  //
+  // ANCHORED, not a bare substring scan. The old test was `/…command not found…/.test(evidence)` over the
+  // WHOLE tail, so a GENUINE test failure whose OWN output merely CONTAINS one of these phrases (a test
+  // asserting on a shell error message, e.g. Expected substring: "command not found") was misread as
+  // HARNESS_ERROR and its real catch silently DROPPED — the money case, and an easy way for an adversarial
+  // agent to dodge us by printing the phrase. Each signature now anchors to the LINE SHAPE a broken proof
+  // actually emits (a tool/errno prefix + line boundaries), so an embedded/quoted mention no longer trips.
+  const ev = String(evidence || "");
   if (
-    /\bno such file or directory\b|\bENOENT\b|\bcommand not found\b|missing script|no [a-z:-]{1,24} script|npm err!.*missing script|executable doesn'?t exist|download new browsers/i.test(
-      String(evidence || ""),
-    )
+    // shell "command not found" / "not found": the phrase ENDS a line whose leading `<cmd>: ` is the
+    // shell's own prefix — `bash: pytest: command not found`, `sh: 1: eslint: not found`.
+    /(^|\n)[^\n]*: (?:command not found|not found)[ \t]*(\n|$)/i.test(ev) ||
+    // errno string in its real `<path>: No such file or directory` shape, or Node's ENOENT code token.
+    /(^|\n)[^\n]*: no such file or directory[ \t]*(\n|$)/i.test(ev) ||
+    /\bENOENT\b/.test(ev) ||
+    // npm / pnpm / yarn missing-script — their exact `Missing script:` wording (with the colon).
+    /\bmissing script:/i.test(ev) ||
+    // Playwright browser binary not installed — a setup-state error, never the agent's code failing.
+    /executable doesn'?t exist|download new browsers/i.test(ev)
   )
     return "HARNESS_ERROR";
   return "GENUINE_FAIL"; // a real non-zero exit from the test/build/lint itself
@@ -739,19 +757,51 @@ function markVerified(sig, cursorPath = LAST_PATH) {
 }
 
 // Single-flight: only one shadow re-run at a time (a burst of prompts must not spawn parallel test runs).
-function acquireLock() {
+// The old body did `statSync(LOCK_PATH)` then an UNCONDITIONAL `writeFileSync` — a TOCTOU hole: when no
+// lock file existed (the common case), N concurrent shadows all saw "no lock" and all wrote it, so ALL
+// "acquired" and ran parallel test re-runs. The atomic primitive is an EXCLUSIVE create (O_EXCL via the
+// "wx" flag): exactly one racer's create can win; every other gets EEXIST and backs off. Stale-lock
+// takeover (a shadow that died holding it) is preserved, but done through the same exclusive create so
+// two reclaimers can't both win. FAIL-OPEN: any unexpected error resolves to "not acquired" (no re-run).
+// Exported for the concurrency test (proves exactly-one-holder under a burst). Never throws.
+export function acquireLock() {
   try {
     mkdirSync(DIR, { recursive: true });
+  } catch {
+    return false;
+  }
+  // Atomic exclusive create — the win/lose decision is the create itself, not a prior stat.
+  try {
+    const fd = openSync(LOCK_PATH, "wx");
     try {
-      const st = statSync(LOCK_PATH);
-      if (Date.now() - st.mtimeMs < LOCK_STALE_MS) return false; // fresh lock held
-    } catch {
-      /* no lock yet */
+      writeSync(fd, String(process.pid));
+    } finally {
+      closeSync(fd);
+    }
+    return true;
+  } catch (e) {
+    if (!e || e.code !== "EEXIST") return false; // not a contention error → fail-open, no lock
+  }
+  // A lock already exists. Take it over ONLY if it is STALE (holder died/hung > LOCK_STALE_MS ago); an
+  // actively-held fresh lock is respected (return false). Reclaim through the SAME exclusive create so
+  // only one reclaimer wins even if several fire at once.
+  try {
+    const st = statSync(LOCK_PATH);
+    if (Date.now() - st.mtimeMs < LOCK_STALE_MS) return false; // fresh — respect the active holder
+  } catch {
+    /* vanished between EEXIST and stat (just released) — fall through and try to claim it */
+  }
+  try {
+    rmSync(LOCK_PATH, { force: true });
+    const fd = openSync(LOCK_PATH, "wx");
+    try {
+      writeSync(fd, String(process.pid));
+    } finally {
+      closeSync(fd);
     }
-    writeFileSync(LOCK_PATH, String(process.pid));
     return true;
   } catch {
-    return false;
+    return false; // another reclaimer re-created it first — they hold it
   }
 }
 function releaseLock() {