main is red: binding-lifecycle security test still pins the pre-#1749 provider-excursion contract

[code-yeongyu]

Summary

main is red. packages/coding-agent/test/claude-sdk-oauth-binding-lifecycle-security.test.ts still pins the pre-#1749 contract for a provider excursion, so the merge of #1749 (fef17495627b4590fed028c7b7b1ab3a3064993a) left a failing test on main.

The failing case is forgets process binding and invalidates/deletes durable state when selecting a non-Claude provider (around :177-206): it asserts getBinding(sessionId) is undefined, that a { invalidated: true, reason: "model_selected" } ledger entry was appended, and that the sidecar file is gone. #1749 deliberately changed that contract — session-registry-wiring.ts now calls keepBindingThenClose for a provider excursion, so the binding is re-remembered, nothing is appended and no sidecar is deleted.

CI: Test (coding-agent 1/3) fails with AssertionError: expected { …(11) } to be undefined at test/claude-sdk-oauth-binding-lifecycle-security.test.ts:200.

Root cause of the miss

#1749 changed a contract that an existing test asserted, and that test was not in the regression survey: the PR checked claude-sdk-oauth-model-switch.test.ts and claude-sdk-oauth-session-registry-wiring.test.ts and concluded no existing test encoded the destructive behavior. This file does, and it was not part of the enumerated GREEN run either. The lesson is to enumerate tests by the CONTRACT being changed (grep the assertions for the behavior, here the sidecar deletion and the invalidation entry) rather than by the files that look topically related.

Expected

The provider-excursion case asserts the shipped contract: the binding and its sidecar survive, and no invalidation record is appended. The suite keeps proving the other half — durable state IS deleted for a genuine invalidation — through its assistant-rewritten and extensions-removed cases, which are unchanged.

Not a loosening: a binding kept across an excursion is still refused on the way back when identity drifted (identityDrift → model_changed) or when the SDK session id was never confirmed (withoutUnconfirmedResume). The deletion was never the mechanism protecting that.

Scope

In: the one test case and a comment recording why the contract changed.
Out: production behavior — #1749's contract stands.

[code-yeongyu]

Fixed by #1753, merged as the commit this issue auto-closed on.

claude-sdk-oauth-binding-lifecycle-security.test.ts now asserts the contract #1749 shipped: selecting a non-Claude provider keeps the binding (present, not forgotten) and its sidecar, and appends no invalidation record. The first attempt at the fix over-pinned the kept binding's sdkSessionId to the injected value; keepBindingThenClose re-remembers the binding from the live session entry, so it carries the entry's own id. The assertion was corrected to the security property this suite protects — durable state survives the excursion — with the reattach-at-the-recorded-prefix behavior left to the #1747 regression suite where it belongs.

The suite's other half stays pinned: durable state IS deleted for a genuine invalidation (the unchanged assistant-rewritten and extensions-removed cases), and a drifted identity is still refused on the way back by identityDrift / withoutUnconfirmedResume rather than by deleting the sidecar.

Also settled here: the interactive-mode-status "shimmering bullet" failure seen on the #1743/#1744/#1745/#1749 CI runs is pre-existing on main, not a regression from any of those merges. Proof: this PR changes only the one binding-lifecycle test file, and all three Test (coding-agent) shards pass on it against current main — the shimmering test included. Its last real edit was an unrelated commit, and none of the six senpi merges in this cluster touch that file or its SUT. It deserves its own fix on its own merits.

[code-yeongyu]

For the record, the merge commit that closed this is c68ec4d3c0a2dc5fd105da69b2ab4d4e898e7e4d (PR #1753).