test: verify Telegram successor against current dev - #11

`sh` runs a TERM trap only after the current foreground command returns.
With the child looping on `sleep 1` and `gracefulMs: 500`, dispose could
escalate to SIGKILL before the handler wrote its `term` marker, so the
one-terminating-signal assertion saw an empty file (observed in CI run
30149261910, coding-agent shard 11).

Shorten the loop interval to 0.05s and use the module's own
`DEFAULT_GRACEFUL_MS` (2000ms) so the trap has a deterministic window.
Under 18-worker CPU contention the old shape wins the race 8/20; the new
shape wins 20/20. All assertions are unchanged.

Also record the missing `## [Unreleased]` changelog entries for Yeachan-Heo#3109,
Yeachan-Heo#3127, and Yeachan-Heo#3131, found while auditing release scope after v0.11.9.

…turns (Yeachan-Heo#3147)

Lifecycle `session_shutdown` started `controller.stopCurrentSession(ctx)`
but discarded the promise, awaiting only `stopSession(id)`. Once startup
has settled the host is broker-visible and can accept `session.close`
while the startup handler's post-start `reconcileCurrentSession` is still
running. That reconciliation can mint a replacement notification-root
token; `ensureTelegramDaemon` then unregisters it asynchronously. Shutdown
could therefore return — and disposal exit — before that unregister's file
lock and atomic registry write settled, leaving a stale `sessions[id]` row
that the retained older token is correctly fenced from removing
(`unregisterNotificationRoot` rejects token mismatches by design).

Now shutdown snapshots `sessionStartPromises.has(id)` first and awaits the
settled controller stop after `stopSession` whenever startup was NOT
pending, so completed-start reconciliation and its replacement-token
cleanup are joined. The intentional nonblocking path is preserved exactly
where it matters: a genuinely pending startup entry (the `/notify on`
case) still leaves the controller stop fire-and-forget.

Surfaced by the flaky-CI stabilization soak. The regression test
"Telegram root release failure is retained and retried through lifecycle
shutdown" failed deterministically on darwin-arm64 at dev head while
Linux CI stayed green (run 30147146988, 34/34 shards) — a completion-
ordering divergence, not a `/var` canonicalization or native-addon issue:
both registry and notification-root paths are lexical `path.join` with no
realpath or case folding.

Verified on darwin-arm64: the previously-failing test now passes 10/10,
the whole sdk-host-wiring file is 72/72 (first fully green run of this
file on Darwin), and telegram daemon + btw-e2e are 463/463. The assertion
was kept intact rather than replaced with polling, which would have hidden
the lifecycle-return bug.

Co-authored-by: Yeachan-Heo <yeachan-heo@gajae.dev>

…eachan-Heo#3149)

Caught by the stabilization soak: main-nontag rehearsal run 30151115867
failed on shard 8 with

  (fail) session_start swallows startup plus owner-release failure
         without surfacing an extension error
  expect(surfaced).toEqual([])   received 1 surfaced error

The test used `mockRejectedValueOnce` on the SHARED prototypes
`NotificationServer.prototype.start` and `SessionSdkHost.prototype.stop`.
That is a one-shot global: a peer test scheduled concurrently in the same
shard can consume the single rejection first. When that happens this
test's own `start()` resolves, so `startSession` never reaches the
`stopSession` catch that sets `suppressExtensionError`
(src/sdk/bus/index.ts:4407-4420), and the startup error surfaces through
`session_start` instead of being swallowed.

Three separate tests in this file arm one-shot rejections on the same two
prototypes, so the interference is cross-test within a shard rather than
a missing restore — every one of them restores correctly.

Replaces both one-shots with per-test guarded implementations that reject
only on this test's first call and then delegate to the real method,
preserving the existing assertions (including
`expect(hostStop).toHaveBeenCalledTimes(2)`, which is what makes the
"first call rejects" semantics load-bearing).

Verified on darwin-arm64: 10/10 targeted reruns, 6x concurrent whole-file
runs with zero failures, whole file 72/72, typecheck and biome clean.

Co-authored-by: Yeachan-Heo <yeachan-heo@gajae.dev>

…#3139) (Yeachan-Heo#3146)

The release CI default was narrowed to `contents: read` in Yeachan-Heo#3136 with
`publish` retaining the sole job-level `contents: write` override, but no
automated policy test protected that invariant. `dev-ci.yml` also had no
explicit permission block and inherited the repository default.

Add `scripts/check-workflow-permissions.ts`: a deterministic offline
default-deny evaluator plus CLI that parses committed workflow YAML and
requires every workflow to declare a least-privilege `permissions` block.
Write scopes are denied everywhere except one explicit allowlist triple
(ci.yml / publish / contents), and the three known workflows must declare
exactly `contents: read`. Violations name workflow, job, permission path,
actual, and expected.

Codify `contents: read` on `dev-ci.yml` after auditing its jobs: they only
check out, install, test, and exchange artifacts through the Actions
artifact API, with no `git push`, `gh` CLI, `secrets.*`, or release/PR
mutation, so no write-scoped token is required.

Back it with real-YAML mutation proofs that read committed workflows from
disk, mutate the parsed document, and re-evaluate -- covering workflow and
job `write`, `write-all`, extra scopes, deleted permission blocks, and
malformed job shapes. Route the regression through affected-path CI in both
the broad and targeted planners so workflow and CI-harness changes select it
alongside the existing release-policy suite, and pin the invariant in
`release-policy.test.ts` as well.

Refs Yeachan-Heo#3139

Co-authored-by: Yeachan-Heo <yeachan-heo@gajae.dev>

…3070)

Exact-head MERGE_READY at 332942d with green CI. Merged after post-merge Dev CI 30158899514 on e108816 terminalized success.

Owner-approved MERGE_READY at exact head 4caf43c with green CI (31 checks). Merged after post-Yeachan-Heo#3132 Dev CI 30159910672 on 77c9a60 terminalized success. Yeachan-Heo#3134 became dirty and was skipped under one-at-a-time sequencing.

…tones (rebase of Yeachan-Heo#3069) (Yeachan-Heo#3150)

* perf(coding-agent): skip lock acquisition for already-completed tombstones

Rebase of Yeachan-Heo#3069 (exact head 2b58273) onto
current dev.

`reconcileManagedTombstones` acquired a durable fsync-backed operation lock for
every tombstone in the scope, including tombstones whose targets had already
published a `cleanup_completed` receipt and therefore had nothing left to
reconcile. Scopes that accumulate many completed tombstones paid that cost on
every `gjc resume` and delete.

Skip the lock only when every target of the tombstone still satisfies the
identity-bound `cleanupCompleted` predicate, which verifies schema version,
state, scope digest, tombstone path, attempt, target path/sessionId/cwd, and the
full identity tuple (dev, ino, size, mtimeNs, sha256). Any target that fails the
predicate falls through to the existing locked reconciliation path unchanged, so
this is never a blanket skip.

Tests:
- untouched completed receipts -> zero lock acquisitions
- a completed receipt whose recorded target sha256 no longer matches -> lock is
  still acquired (negative control; fails if the skip is made unconditional)

* ci: re-trigger PR checks after GitHub Actions internal job failures

No product change. Previous Yeachan-Heo#3150 run failed with empty-step jobs annotated
as "GitHub Actions has encountered an internal error when running your job".

* ci: re-trigger PR checks after Actions recovery

No product change. Previous re-trigger landed in the GHA internal-error window
(empty-step jobs). Dev CI has since recovered on post-merge runs.

---------

Co-authored-by: Yeachan-Heo <yeachan-heo@gajae.dev>