1 files changed, 52 insertions, 0 deletions
diff --git a/scripts/tests/ai-wrap-teardown-hook.bats b/scripts/tests/ai-wrap-teardown-hook.bats
index 6e33cca..12ac941 100644
--- a/scripts/tests/ai-wrap-teardown-hook.bats
+++ b/scripts/tests/ai-wrap-teardown-hook.bats
@@ -7,6 +7,7 @@
 setup() {
     REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../.." && pwd)"
     SCRIPT="$REPO_ROOT/hooks/ai-wrap-teardown.sh"
+    DISARM="$REPO_ROOT/hooks/session-start-disarm.sh"
     GATE="$REPO_ROOT/claude-templates/bin/git-worktree-gate"
     TMPDIR_T="$(mktemp -d)"
     PROJ="proj-$$-$BATS_TEST_NUMBER"          # unique so /tmp sentinels don't collide
@@ -157,3 +158,54 @@ run_hook() {
     [ "$status" -eq 0 ]
     [ ! -f "$cert" ]
 }
+
+# --- Cross-session leakage (the 2026-07-27 work-session kill) ---------------
+#
+# A sentinel is deliberately preserved when certification fails, so a blocked
+# wrap can retry within the same session once the tree is clean. But nothing
+# bounded that to the session: the sentinel outlived it and detonated in
+# whatever session next happened to have a clean tree. work's 11:37 wrap left
+# one armed; the 13:20 session committed during startup, went clean, and was
+# torn down mid-work. archsetup's had been armed for two days on a live
+# terminal.
+#
+# A new session means the wrap that armed the sentinel is gone, so its pending
+# teardown is moot. session-start-disarm.sh clears it.
+
+@test "session-start disarm: removes a teardown sentinel left by a prior session" {
+    : > "$TEARDOWN_SENTINEL"
+    printf '{"cwd":"%s","hook_event_name":"SessionStart"}' "$CWD" \
+        | bash "$DISARM"
+    [ ! -f "$TEARDOWN_SENTINEL" ]
+}
+
+@test "session-start disarm: removes a shutdown sentinel too" {
+    : > "$SHUTDOWN_SENTINEL"
+    printf '{"cwd":"%s","hook_event_name":"SessionStart"}' "$CWD" \
+        | bash "$DISARM"
+    [ ! -f "$SHUTDOWN_SENTINEL" ]
+}
+
+@test "session-start disarm: silent and exit 0 when nothing is armed" {
+    run bash -c "printf '{\"cwd\":\"$CWD\",\"hook_event_name\":\"SessionStart\"}' | bash '$DISARM'"
+    [ "$status" -eq 0 ]
+    [ -z "$output" ]
+}
+
+@test "session-start disarm: only clears this project, not another's" {
+    other="/tmp/ai-wrap-teardown-someotherproj"
+    : > "$TEARDOWN_SENTINEL"
+    : > "$other"
+    printf '{"cwd":"%s","hook_event_name":"SessionStart"}' "$CWD" | bash "$DISARM"
+    [ ! -f "$TEARDOWN_SENTINEL" ]
+    [ -f "$other" ]
+    rm -f "$other"
+}
+
+@test "within-session retry still works: sentinel survives a blocked stop" {
+    : > "$TEARDOWN_SENTINEL"
+    echo dirt > "$CWD/untracked.txt"
+    run run_hook
+    [ -f "$TEARDOWN_SENTINEL" ]
+    rm -f "$CWD/untracked.txt"
+}