fix(persistence): keep contended sessions usable

.github/workflows/ci.yml

@@ -89,7 +89,7 @@ jobs:
       - name: Install locked dependencies
         run: npm ci
       - name: Run portable lifecycle and filesystem tests
-        run: node --test test/host-lifecycle.test.js test/persistence-lease.test.js test/public-hook-cancellation.test.js
+        run: node --test test/host-lifecycle.test.js test/persistence-lease.test.js test/public-hook-cancellation.test.js test/session-concurrency.test.js
       - name: Compile installed-package type contracts on Windows
         if: runner.os == 'Windows'
         run: npm run type:check

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- Keep a second OpenCode process usable when it opens a session whose goal-state shard is already leased: ordinary chat and unrelated tools remain available, while goal commands and tools fail safely without reading, changing, or prompting from that session's goal state. After the owner exits, the next explicit goal command or tool retries ownership and reloads any active goal paused. Lease contention is now typed and owner metadata is sanitized; unrelated filesystem failures still fail closed.
+- Harden the single-writer lease with immutable per-owner claims so delayed publication, simultaneous stale reclaim, and concurrent release cannot remove a replacement owner's lease. A complete compatibility guard is published atomically with no replacement, preventing old/current startup races; legacy, incomplete, tampered, or unsupported lease layouts fail closed for explicit manual recovery. Owner reads remain bounded and symlink-safe, slow passive command guards keep blocking tools until an authenticated new boundary, delayed control errors cannot pause a newer goal run, takeover retains Plan/model execution context, and advisory host logging cannot stall loading or disposal.
+
 ## 0.6.7 — 2026-08-01
 
 - Fix `/goal` routing on OpenCode 1.17.15 and 1.18.10 by replacing the host-retained prompt parts in place, authenticating each resolved command turn (including host-expanded file attachments), framing control results with direct reporting instructions, blocking tools during those reporting turns, and excluding control responses from goal completion and progress analysis. Unreadable command attachments now become read-only error reports and pause safely without losing command provenance.

README.md

@@ -255,6 +255,10 @@ Alongside each session shard the plugin keeps an **append-only lifecycle ledger*
 
 Recovered active goals are loaded in a **paused** state with a recovery note, so unattended auto-continue does not resume blindly after a restart. Set `"persistState": false` to keep purely in-memory behavior (this also disables the ledger).
 
+Only one OpenCode process may own a given session shard at a time. If the same session is opened in a second process, that process enters **passive goal mode** instead of failing the whole session: ordinary chat and unrelated tools continue to work, but `/goal` commands and goal tools report that another process owns the workflow. Canonical goal tools return the stable envelope code `error: "session_owned_elsewhere"`. The passive process does not read, mutate, persist, or auto-continue that session's goal state. After the owner exits, retry an explicit goal command or goal tool; the process will acquire the shard and load any recovered active goal paused. To work concurrently without waiting, create a new session with `opencode --continue --fork` (or `opencode --session <id> --fork`).
+
+Lease ownership uses immutable per-process claim files so a delayed stale-lock cleanup or duplicate release cannot delete a newer owner's lease. The plugin publishes a complete regular-file compatibility guard atomically at `<shard>/state.json.lock`, then elects the current owner from claims in the sibling `<shard>/state.json.lock.claims-v2/` directory. That no-replace publication makes startup safe against older releases: either the older lock directory wins and the current plugin stays passive, or the guard file wins and the older release cannot reclaim it. Automatic ownership handoff requires the current release. Legacy, incomplete, tampered, or unsupported lease layouts fail closed instead of being rewritten online; filesystems must support regular-file hard links and preserve the guard's future timestamp. After confirming that every process using the session is closed and upgraded, either fork or remove only the affected shard's adjacent `.lock` file or legacy directory **and** `.lock.claims-v2` directory; keep its state and ledger.
+
 `/goal resume` continues the same objective with a fresh local budget window. This lets you continue after pause, blocker, no-progress pause, rate-limit failures, or a limit stop without retyping the objective.
 
 ### Per-goal flags
@@ -393,7 +397,7 @@ For `/goal status`, `/goal history`, `/goal list`, `/goal pause`, and `/goal cle
 
 The plugin still registers `experimental.chat.system.transform` as defense in depth for hosts that invoke it. Real OpenCode 1.17.15 and 1.18.10 do not call that hook, so the command-control protections above are deliberately self-contained. Other OpenCode plugin hooks may change between versions.
 
-Distinct OpenCode sessions may own shards under the same `stateFilePath` concurrently. A second process using the same session shard is still rejected with the owning PID/host instead of risking last-writer-wins state loss; use the original session or wait for its owner to dispose.
+Distinct OpenCode sessions may own shards under the same `stateFilePath` concurrently. A second process using the same session shard remains usable in passive goal mode, but goal commands and tools are denied until it can acquire that shard. The passive process never falls back to an unpersisted copy of the same goal workflow, which avoids divergent state and last-writer-wins data loss. Use the owner, wait and retry an explicit goal control after it exits, or fork to a new session. A no-replace compatibility guard prevents an older release and the current release from both acquiring during startup; current immutable claims protect takeover and release among upgraded processes. Older processes cannot take over a guarded shard, so all processes participating in automatic same-session handoff must run the current release.
 
 ## Diagnostics and recovery
 
@@ -403,9 +407,10 @@ If a goal does not continue:
 
 1. Check for a deliberate pause: user intervention, a hard limit, repeated tool-free/no-progress turns, prompt failures, or a rejected completion audit all stop unattended work by design.
 2. Run `/goal resume` only after resolving the reported reason. Resume creates a fresh local budget window; it does not erase the objective or history.
-3. Check OpenCode's structured logs for persistence, SDK-shape, prompt, or auditor errors.
-4. Confirm the configured project directory and state-path precedence described under [Safety limits](#safety-limits). A daemon started elsewhere can otherwise make a manually configured relative path surprising.
-5. Run `npm run verify`, `npm run smoke`, and `npm run smoke:packed-host` against the installed source when diagnosing registration or packaging problems. Maintainers can run `npm run release:check` for the complete artifact and quality gate. `npm run benchmark:behavior` exercises completion, false-completion, loop, interruption, compaction, and restart behavior without a provider call.
+3. If a goal control reports that another process owns the session, close that owner and retry the control, or fork to a new session. If it instead reports an older, incomplete, tampered, or unsupported lease, close every process that could own the session and upgrade them first; if the report persists, remove only the affected shard's adjacent `.lock` file or legacy directory and `.lock.claims-v2` directory, or fork. Keep the state and ledger. Do not point two copies of the same session at different state paths: that creates divergent goal histories.
+4. Check OpenCode's structured logs for persistence, SDK-shape, prompt, or auditor errors.
+5. Confirm the configured project directory and state-path precedence described under [Safety limits](#safety-limits). A daemon started elsewhere can otherwise make a manually configured relative path surprising.
+6. Run `npm run verify`, `npm run smoke`, and `npm run smoke:packed-host` against the installed source when diagnosing registration or packaging problems. Maintainers can run `npm run release:check` for the complete artifact and quality gate. `npm run benchmark:behavior` exercises completion, false-completion, loop, interruption, compaction, and restart behavior without a provider call.
 
 Do not paste `state.json`, its ledger, or verbose logs into a public issue without reviewing them first: they can contain goal text, assistant checkpoints, blockers, local paths, and command evidence. Prefer the bounded status/history output and redact project-specific content. There is intentionally no broad "dump diagnostics" tool: exposing process-wide session state or persistence paths to the model would add more privacy risk than troubleshooting value.
 

docs/compatibility.md

@@ -11,7 +11,8 @@ The latest published release is the supported line. Public compatibility covers:
 - the six canonical goal tools and five legacy tool aliases
 - persisted-state recovery from versions documented in the changelog
 - concurrent persistence for distinct OpenCode sessions in one project, with
-  single-writer protection retained per session
+  single-writer protection retained per session and passive goal behavior for
+  a same-session process that does not own the lease
 
 The package requires Node.js 18 or newer and OpenCode 1.17.15 through the latest
 compatible 1.x release. CI runs the complete unit suite on Node 18, 20, 22, and
@@ -25,6 +26,33 @@ them; the plugin does not claim that Windows provides equivalent POSIX semantics
 The Windows job also runs the installed-package type, host, and tool contracts
 so their portable npm launcher path is exercised in CI.
 
+When two processes open the same OpenCode session, only the lease owner may read
+or change that session's goal workflow. The contender keeps ordinary chat and
+unrelated tools available, but goal controls are denied and ambient hooks do not
+attempt a takeover. Canonical goal tools return the stable envelope code
+`session_owned_elsewhere`; a `/goal` slash command instead produces a
+human-readable denial through its normal model-rendered command turn. Once the
+owner exits, an explicit goal command or tool may acquire the shard; recovered
+active goals load paused and require an explicit resume. Forking creates a
+distinct session shard and remains the supported way to work concurrently from
+the same conversation.
+
+The immutable-claim lease protocol atomically hard-links a complete regular-file
+compatibility guard at `<shard>/state.json.lock`; active owners publish unique
+claims in the sibling `<shard>/state.json.lock.claims-v2/` directory. Publication
+is no-replace: an older lock directory and the current guard cannot both win the
+same startup race. Older releases treat the future-dated guard as non-reclaimable,
+while current releases determine ownership only from immutable claims. Automatic
+takeover requires all participating processes to run the current release.
+Legacy, incomplete, tampered, or unsupported lease layouts fail closed rather
+than being rewritten online. If that condition persists, first close every
+OpenCode process that could own the session and upgrade them; then either fork
+the session or manually remove only the affected shard's adjacent `.lock` file
+or legacy directory and `.lock.claims-v2` directory. Do not remove its state or
+lifecycle ledger. The local filesystem must support regular-file hard links
+and preserve the guard's future timestamp; the plugin does not fall back to a
+weaker publication protocol.
+
 ## OpenCode host compatibility
 
 OpenCode's experimental hooks and SDK request shapes may change within the 1.x