@bongos/core 1.19.267 → 1.19.269

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.267",
-  "core_contract": "1.19.267",
-  "source_commit": "438a7182b523f2e5d9bd4181397642f51b75c77d",
+  "core_version": "1.19.269",
+  "core_contract": "1.19.269",
+  "source_commit": "eb9189a55c35d65f7b127a4f825cf15111450f45",
   "source_ref": "HEAD",
-  "built_at": "2026-08-20T18:45:39.708Z",
+  "built_at": "2026-08-20T23:06:25.339Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 318,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1367,
+    "functional_verbatim": 1368,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1707,
-  "tree_sha256": "c333d9a98c37d10dd8a8e60d7c3f1a279fab0365ab4462a4a64517d5e681e77f",
+  "file_count": 1708,
+  "tree_sha256": "1bb1e8f0972473d957a4d18ab8cb07dc0e7320b9c00e1e504bbd939804fc8b3e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3912,7 +3912,7 @@
     {
       "path": "modules/memory/search-chunker.js",
       "mode": "0000644",
-      "sha256": "5eaebeb1d9a8c134a7e5f7ab532486dcf608181ee212ab46bb5f9bcee9951637"
+      "sha256": "b25ec0c42b9ea0ac856837e9a4282fd9ea4cb79a1c9258ee18bdf81e757c001e"
     },
     {
       "path": "modules/memory/search.js",
@@ -4472,12 +4472,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "593aec1826ec6611b0b879e4d71faeaac1fb32934aae45ac5abbf726f44c029e"
+      "sha256": "ddb6a432b5c2aab632e59179fa2429ac1055aa0eaac7ea30e94c7cba0e4cf8e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b1c9f3acb84a8ed67474e02d525666855953406b4393eb0b4fbbece6cd92b0e8"
+      "sha256": "00d26fc1394b365885ef97c011108dfbe1734aa49ed388a8c49a308480fe3b5a"
     },
     {
       "path": "public-docs/index.html",
@@ -5497,12 +5497,12 @@
     {
       "path": "scripts/gds/search-ingest-db.js",
       "mode": "0000644",
-      "sha256": "c410dfff1628a48ab68b687306335cf2fe73513c04888e73cbb80ba4beb3951b"
+      "sha256": "0723d48df92d78696b86adf0591584800f77da590afc80bcc5e3f99dcf614979"
     },
     {
       "path": "scripts/gds/search-ingest-md.js",
       "mode": "0000644",
-      "sha256": "19b4e880f0a44dcba9458d863ba10686fe67b90f3aed5b595f7b7db4e205e68a"
+      "sha256": "802d16a48f6a47bf41b1768fff3da0ae1b18a4d73147b3559a781f18ea47c75c"
     },
     {
       "path": "scripts/gds/security-baseline-check.sh",
@@ -6122,7 +6122,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c52908a516ff2f5cc2147e0a1d0a3c2564713b3dfeada50c5ba142b1e5b5bf32"
+      "sha256": "f87f3562ac47d91ae9031fbc80d64b2200e1a7ca2c5bfebab13d0bf0f2197b2a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8099,6 +8099,11 @@
       "mode": "0000644",
       "sha256": "c80af8bfbb83f0ebdc44c196b8d127caf228a5e102382f254f4e55e1c1d96eaf"
     },
+    {
+      "path": "tests/search_ingest_nul.mjs",
+      "mode": "0000644",
+      "sha256": "a8687493e50f83430b337df76c77e2ecb9924df5012180ba1c853141e0646f88"
+    },
     {
       "path": "tests/search_isolation.mjs",
       "mode": "0000644",

package/modules/memory/search-chunker.js

@@ -168,11 +168,37 @@ function splitLongBody(body, maxTokens) {
 // a typed ref like 'task:431' for DB prose); it's only used for the breadcrumb
 // root + returned for the caller's source_ref. Returns chunks in document order
 // with 0-based chunk_index.
+// task 1002859: strip characters Postgres rejects in a text column. U+0000 is the
+// one that matters: PG raises 'invalid byte sequence for encoding "UTF8": 0x00'
+// on it, and BOTH ingesters (search-ingest-md.js for the tree, search-ingest-db.js
+// for DB prose) hand chunk bodies straight to an INSERT. A NUL therefore aborted
+// the whole ingest and /recall silently stopped re-indexing (task 1003097).
+//
+// Sanitizing HERE rather than in either ingester is deliberate: this is the one
+// funnel both go through, so the guard cannot be added to one path and forgotten
+// on the other. That is exactly what happened the first time this bug class was
+// fixed — commit 75742cb (task 1002507) stripped NUL from ship.js snippetOf after
+// a UTF-16LE `wsl --list` read voided a session digest, and left every other path
+// carrying the same hazard.
+//
+// NUL is meaningless in prose, so dropping it loses nothing a reader wants. Lone
+// surrogates go too: they are unpaired UTF-16 halves that cannot be encoded as
+// valid UTF-8 — the same class of failure from the same class of cause (a file
+// read in the wrong encoding).
+const PG_INVALID_TEXT_RE = /\u0000|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+
+function sanitizeForText(text) {
+  return typeof text === 'string' ? text.replace(PG_INVALID_TEXT_RE, '') : text;
+}
+
 function chunkMarkdown({ path, content, maxTokens = DEFAULT_MAX_TOKENS, targetTokens = DEFAULT_TARGET_TOKENS } = {}) {
   // ADR 0095 C4: strip <private>-fenced content BEFORE chunking so it never
   // enters the recall index. Done first so front-matter parsing + heading
   // splitting see only the public text.
-  const { frontmatter, body } = parseFrontMatter(stripPrivate(content));
+  // Sanitize FIRST, before any parsing: a NUL inside a heading or a front-matter
+  // value would otherwise ride out on `title`/`heading_path`, which are also
+  // Postgres text columns.
+  const { frontmatter, body } = parseFrontMatter(stripPrivate(sanitizeForText(content)));
   const root = fileLabel(path);
 
   // Title: explicit front-matter title/name → first H1 → file label.
@@ -249,4 +275,4 @@ function chunkMarkdown({ path, content, maxTokens = DEFAULT_MAX_TOKENS, targetTo
   return { path: path || null, title, frontmatter: frontmatter || null, chunks };
 }
 
-module.exports = { chunkMarkdown, parseFrontMatter, estTokens, fileLabel, stripPrivate, DEFAULT_TARGET_TOKENS, DEFAULT_MAX_TOKENS };
+module.exports = { chunkMarkdown, parseFrontMatter, estTokens, fileLabel, stripPrivate, sanitizeForText, PG_INVALID_TEXT_RE, DEFAULT_TARGET_TOKENS, DEFAULT_MAX_TOKENS };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.267",
+  "version": "1.19.269",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.267",
+      "version": "1.19.269",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.267",
+  "version": "1.19.269",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/search-ingest-db.js

@@ -143,11 +143,26 @@ async function ingestRows(client, rows, sourceRef) {
   return stats;
 }
 
+// task 1002859 (panel finding): bound the driver's error text before it reaches a
+// log. A Postgres error message is unbounded upstream text and CAN embed row
+// content (a constraint violation quotes the offending key), and these logs are
+// deploy/cron sinks that get shipped around. One line, capped, is enough to
+// identify the fault; the source_ref beside it is what actually locates it. The
+// DB corpus makes this matter more than it looks — its prose is session-log and
+// memory-derived text the file elsewhere treats as scrub-sensitive.
+const ERR_LOG_MAX = 300;
+function errLine(e) {
+  const raw = e && e.message ? String(e.message) : String(e);
+  const flat = raw.replace(/\s+/g, ' ').trim();
+  return flat.length > ERR_LOG_MAX ? `${flat.slice(0, ERR_LOG_MAX)}… (truncated)` : flat;
+}
+
 async function main() {
   const dryRun = process.argv.includes('--dry-run');
   const pool = requirePool();
   const client = await pool.connect();
   const totals = { inserted: 0, updated: 0, unchanged: 0, pruned: 0, deleted: 0, sources: 0 };
+  const failures = []; // task 1002859 — per-source casualties, named at the end
   const presentRefs = [];
   try {
     // Gather every source's rows first (read-only), grouped by source_ref.
@@ -177,19 +192,39 @@ async function main() {
       return;
     }
 
-    await client.query('BEGIN');
+    // task 1002859: ONE TRANSACTION PER SOURCE, not one for the whole run — the
+    // same all-or-nothing shape that made a single bad byte a total recall
+    // outage on the markdown side. DB prose is the MORE exposed of the two: it
+    // carries session-log and transcript-derived text, which is exactly where a
+    // wrong-encoding read introduces a NUL in the first place.
     for (const [ref, rows] of byRef) {
-      const s = await ingestRows(client, rows, ref);
-      totals.inserted += s.inserted; totals.updated += s.updated;
-      totals.unchanged += s.unchanged; totals.pruned += s.pruned;
+      try {
+        await client.query('BEGIN');
+        const s = await ingestRows(client, rows, ref);
+        await client.query('COMMIT');
+        totals.inserted += s.inserted; totals.updated += s.updated;
+        totals.unchanged += s.unchanged; totals.pruned += s.pruned;
+      } catch (e) {
+        await client.query('ROLLBACK').catch(() => {});
+        failures.push({ sourceRef: ref, message: errLine(e) });
+        console.error(`search-ingest-db: SKIPPED ${ref} — ${errLine(e)}`);
+      }
     }
     // Delete db chunks whose source no longer exists (a deleted task/idea/etc.).
-    const del = await client.query(
-      `DELETE FROM search_chunks WHERE source_kind='db' AND NOT (source_ref = ANY($1::text[]))`,
-      [presentRefs]
-    );
-    totals.deleted = del.rowCount || 0;
-    await client.query('COMMIT');
+    // Own transaction, and SKIPPED after any failure: presentRefs is what we
+    // meant to write, so pruning against it on a partial run could delete a
+    // still-live source's chunks.
+    if (failures.length === 0) {
+      await client.query('BEGIN');
+      const del = await client.query(
+        `DELETE FROM search_chunks WHERE source_kind='db' AND NOT (source_ref = ANY($1::text[]))`,
+        [presentRefs]
+      );
+      totals.deleted = del.rowCount || 0;
+      await client.query('COMMIT');
+    } else {
+      console.error(`search-ingest-db: vanished-source prune SKIPPED — ${failures.length} source(s) failed, so presentRefs is incomplete`);
+    }
   } catch (e) {
     await client.query('ROLLBACK').catch(() => {});
     console.error('search-ingest-db: FAILED, rolled back:', e.message);
@@ -200,6 +235,13 @@ async function main() {
   client.release();
   await pool.end().catch(() => {});
   console.log(`search-ingest-db: inserted=${totals.inserted} updated=${totals.updated} unchanged=${totals.unchanged} pruned=${totals.pruned} deleted=${totals.deleted} across ${totals.sources} sources`);
+  if (failures.length > 0) {
+    // NON-SILENT: this runs best-effort from a scheduled job, so a non-zero exit
+    // is the only signal that reaches a log a human reads. Name every casualty.
+    console.error(`search-ingest-db: ${failures.length} source(s) FAILED and were skipped:`);
+    for (const f of failures) console.error(`  ${f.sourceRef}: ${f.message}`);
+    process.exitCode = 1;
+  }
 }
 
 if (require.main === module) {

package/scripts/gds/search-ingest-md.js

@@ -163,6 +163,20 @@ async function ingestFile(client, rows, sourceRef) {
   return stats;
 }
 
+// task 1002859 (panel finding): bound the driver's error text before it reaches a
+// log. A Postgres error message is unbounded upstream text and CAN embed row
+// content (a constraint violation quotes the offending key), and these logs are
+// deploy/cron sinks that get shipped around. One line, capped, is enough to
+// identify the fault; the source_ref beside it is what actually locates it. The
+// DB corpus makes this matter more than it looks — its prose is session-log and
+// memory-derived text the file elsewhere treats as scrub-sensitive.
+const ERR_LOG_MAX = 300;
+function errLine(e) {
+  const raw = e && e.message ? String(e.message) : String(e);
+  const flat = raw.replace(/\s+/g, ' ').trim();
+  return flat.length > ERR_LOG_MAX ? `${flat.slice(0, ERR_LOG_MAX)}… (truncated)` : flat;
+}
+
 async function main() {
   const args = process.argv.slice(2);
   const dryRun = args.includes('--dry-run');
@@ -191,32 +205,61 @@ async function main() {
   const pool = requirePool();
   const client = await pool.connect();
   const totals = { inserted: 0, updated: 0, unchanged: 0, pruned: 0, deleted: 0 };
-  try {
-    await client.query('BEGIN');
-    for (const f of allRows) {
+  // task 1002859: ONE TRANSACTION PER FILE, not one for the whole run. The old
+  // shape opened a single BEGIN before this loop, so ANY failure on ANY file
+  // rolled back the ENTIRE index update — that is the "rolls back the entire
+  // re-index" in this task's title, and it is what turned a one-character data
+  // problem into a total, permanent recall outage. Per-file scope makes the
+  // blast radius one file: the other ~900 still land, and the failure is
+  // reported by name instead of vanishing.
+  const failures = [];
+  for (const f of allRows) {
+    try {
+      await client.query('BEGIN');
       const s = await ingestFile(client, f.rows, f.sourceRef);
+      await client.query('COMMIT');
       totals.inserted += s.inserted; totals.updated += s.updated;
       totals.unchanged += s.unchanged; totals.pruned += s.pruned;
+    } catch (e) {
+      await client.query('ROLLBACK').catch(() => {});
+      failures.push({ sourceRef: f.sourceRef, message: errLine(e) });
+      console.error(`search-ingest-md: SKIPPED ${f.sourceRef} — ${errLine(e)}`);
+    }
+  }
+  // Delete chunks for doc sources that no longer exist in the tree. Its own
+  // transaction, and deliberately SKIPPED when any file failed: `present` is the
+  // list of sources we intended to write, so pruning against it after a partial
+  // run could delete chunks for a file that only failed transiently.
+  try {
+    if (failures.length === 0) {
+      await client.query('BEGIN');
+      const present = allRows.map((f) => f.sourceRef);
+      const del = await client.query(
+        `DELETE FROM search_chunks WHERE source_kind='doc' AND NOT (source_ref = ANY($1::text[]))`,
+        [present]
+      );
+      totals.deleted = del.rowCount || 0;
+      await client.query('COMMIT');
+    } else {
+      console.error(`search-ingest-md: vanished-source prune SKIPPED — ${failures.length} file(s) failed, so the present-sources list is incomplete`);
     }
-    // Delete chunks for doc sources that no longer exist in the tree.
-    const present = allRows.map((f) => f.sourceRef);
-    const del = await client.query(
-      `DELETE FROM search_chunks WHERE source_kind='doc' AND NOT (source_ref = ANY($1::text[]))`,
-      [present]
-    );
-    totals.deleted = del.rowCount || 0;
-    await client.query('COMMIT');
   } catch (e) {
     await client.query('ROLLBACK').catch(() => {});
-    console.error('search-ingest-md: FAILED, rolled back:', e.message);
-    process.exitCode = 1;
-    client.release();
-    await pool.end().catch(() => {});
-    return;
+    failures.push({ sourceRef: '(vanished-source prune)', message: errLine(e) });
+    console.error('search-ingest-md: vanished-source prune FAILED:', errLine(e));
   }
   client.release();
   await pool.end().catch(() => {});
   console.log(`search-ingest-md: inserted=${totals.inserted} updated=${totals.updated} unchanged=${totals.unchanged} pruned=${totals.pruned} deleted_sources_chunks=${totals.deleted}`);
+  if (failures.length > 0) {
+    // NON-SILENT (task 1003097's sibling half): the deploy step runs this
+    // best-effort, so a non-zero exit is the only signal that reaches a log a
+    // human reads. Name every casualty — "some files were skipped" is what let
+    // this hide.
+    console.error(`search-ingest-md: ${failures.length} file(s) FAILED and were skipped:`);
+    for (const f of failures) console.error(`  ${f.sourceRef}: ${f.message}`);
+    process.exitCode = 1;
+  }
 }
 
 if (require.main === module) {

package/src/module-api.js

@@ -961,8 +961,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.265 with no explicit bump. run 32400609982. (task 1002620)
 //   1.19.267 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.266 with no explicit bump. run 32404853216. (task 1002620)
+//   1.19.268 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.267 with no explicit bump. run 32407127474. (task 1002620)
+//   1.19.269 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.268 with no explicit bump. run 32427178123. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.267'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.269'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/search_ingest_nul.mjs

@@ -0,0 +1,193 @@
+// tests/search_ingest_nul.mjs — task 1002859.
+//
+// THE OUTAGE: /recall returned zero matches for EVERY query on live (task
+// 1003097), because the doc index was never written. Postgres rejects U+0000 in
+// a text column ('invalid byte sequence for encoding "UTF8": 0x00'), both
+// ingesters handed chunk bodies straight to an INSERT, and both wrapped the
+// WHOLE run in ONE transaction. So one NUL byte in one chunk of one file rolled
+// back the entire index update — and the deploy's search-index step logs
+// non-fatally, so nothing surfaced. A corpus that starts empty (a restore leaves
+// the table empty and expects the ingest to rebuild it) then stays empty
+// forever, and the route answers a legitimate-looking 200 with no results.
+//
+// Same bug class had already been fixed once on a different path: commit 75742cb
+// (task 1002507) stripped NUL from ship.js snippetOf after a UTF-16LE `wsl
+// --list` read voided a session digest — and left every other path exposed.
+//
+// What we prove here (pure — no DB):
+//   1. The sanitizer strips U+0000, and strips lone surrogates too (the same
+//      wrong-encoding cause, also unencodable as UTF-8).
+//   2. It runs at the SHARED funnel (search-chunker), so BOTH ingesters are
+//      covered and the guard cannot be added to one path and forgotten on the
+//      other — which is exactly how this survived the first fix.
+//   3. Nothing a reader wants is lost: sanitizing is a no-op on clean prose.
+//   4. A NUL in a HEADING or a front-matter title is stripped too — title and
+//      heading_path are Postgres text columns as well, so sanitizing only the
+//      body would have left two live vectors.
+//   5. Both ingesters now scope a transaction PER SOURCE, and report failures by
+//      name with a non-zero exit — the blast radius of a bad byte is one file,
+//      not the whole corpus, and it is no longer silent.
+//
+// Run:  node tests/search_ingest_nul.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const chunker = require('../modules/memory/search-chunker.js');
+const { chunkMarkdown, sanitizeForText } = chunker;
+
+// Never write a literal control character into a source file — build it.
+const NUL = String.fromCharCode(0);
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// ---- 1. the sanitizer ----
+
+test('sanitizeForText strips U+0000', () => {
+  assert.equal(sanitizeForText(`a${NUL}b`), 'ab');
+  assert.equal(sanitizeForText(`${NUL}${NUL}lead`), 'lead');
+  assert.equal(sanitizeForText(`trail${NUL}`), 'trail');
+});
+
+test('sanitizeForText strips LONE surrogates but keeps valid pairs', () => {
+  // Unpaired halves cannot be encoded as UTF-8 — same cause (a wrong-encoding
+  // read), same Postgres rejection.
+  assert.equal(sanitizeForText('a\uD800b'), 'ab', 'lone high surrogate');
+  assert.equal(sanitizeForText('a\uDC00b'), 'ab', 'lone low surrogate');
+  // A real astral character is a VALID pair and must survive untouched.
+  assert.equal(sanitizeForText('emoji \u{1F600} ok'), 'emoji \u{1F600} ok');
+});
+
+test('sanitizeForText is a no-op on clean prose and non-strings', () => {
+  const clean = '# Title\n\nSome prose with `code`, an emoji \u{1F680}, and accents: éàü.\n';
+  assert.equal(sanitizeForText(clean), clean);
+  assert.equal(sanitizeForText(null), null);
+  assert.equal(sanitizeForText(undefined), undefined);
+  assert.equal(sanitizeForText(42), 42);
+});
+
+// ---- 2/4. it runs at the shared funnel, and covers title + heading too ----
+
+test('chunkMarkdown strips NUL from body, title AND heading_path', () => {
+  const content = `# Ti${NUL}tle\n\n## Sec${NUL}tion\n\nbo${NUL}dy prose here, long enough to be a chunk.\n`;
+  const { title, chunks } = chunkMarkdown({ path: 'docs/x.md', content });
+  assert.ok(chunks.length > 0, 'produced at least one chunk');
+  assert.equal(title.includes(NUL), false, `title still carries NUL: ${JSON.stringify(title)}`);
+  for (const c of chunks) {
+    assert.equal(c.body.includes(NUL), false, 'body still carries NUL');
+    assert.equal(String(c.heading_path || '').includes(NUL), false, 'heading_path still carries NUL');
+  }
+});
+
+test('a front-matter title carrying NUL is sanitized', () => {
+  const content = `---\ntitle: Fr${NUL}ont\n---\n\nsome body prose here for a chunk.\n`;
+  const { title } = chunkMarkdown({ path: 'docs/y.md', content });
+  assert.equal(title.includes(NUL), false);
+  assert.equal(title, 'Front');
+});
+
+test('the guard lives at the SHARED funnel, so both ingesters inherit it', () => {
+  // The first fix of this bug class (task 1002507) was local to ship.js and left
+  // every other path exposed. Assert structurally that neither ingester relies
+  // on its own private guard: both must reach the sanitizer through chunkMarkdown.
+  for (const rel of ['scripts/gds/search-ingest-md.js', 'scripts/gds/search-ingest-db.js']) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    assert.match(src, /chunkMarkdown\(/, `${rel} must chunk through the shared funnel`);
+  }
+  const chunkerSrc = fs.readFileSync(path.join(ROOT, 'modules/memory/search-chunker.js'), 'utf8');
+  assert.match(chunkerSrc, /sanitizeForText\(content\)/, 'the funnel must sanitize its INPUT, before any parsing');
+});
+
+test('chunkFile (the md ingester\'s row builder) emits NUL-free rows', () => {
+  const ingest = require('../scripts/gds/search-ingest-md.js');
+  const tmp = fs.mkdtempSync(path.join(ROOT, '.tmp-nul-'));
+  try {
+    const f = path.join(tmp, 'poisoned.md');
+    fs.writeFileSync(f, `# He${NUL}ad\n\nbo${NUL}dy text long enough to survive chunking.\n`);
+    const rows = ingest.chunkFile(f);
+    assert.ok(rows.length > 0);
+    for (const r of rows) {
+      assert.equal(r.body.includes(NUL), false, 'row body must be clean before the INSERT');
+      assert.equal(String(r.title || '').includes(NUL), false);
+      assert.equal(String(r.heading_path || '').includes(NUL), false);
+      assert.match(r.content_hash, /^[0-9a-f]{64}$/, 'hash is of the SANITIZED body');
+    }
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// ---- 5. blast radius + non-silence ----
+
+test('both ingesters scope a transaction PER SOURCE, not one per run', () => {
+  // This is the "rolls back the entire re-index" half of the bug. A single BEGIN
+  // before the loop is what turned one bad byte into a total outage.
+  for (const rel of ['scripts/gds/search-ingest-md.js', 'scripts/gds/search-ingest-db.js']) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    // Anchor on the loop that actually WRITES (the one calling ingestFile /
+    // ingestRows), not the first `for (const f of ...)` in the file — the
+    // dry-run sample listing uses that shape too.
+    const writeIdx = src.search(/await ingest(File|Rows)\(client/); // the CALL, not the definition
+    assert.ok(writeIdx > 0, `${rel}: found the write call`);
+    const loopIdx = src.lastIndexOf('for (', writeIdx);
+    assert.ok(loopIdx > 0 && writeIdx - loopIdx < 400, `${rel}: the write is inside a loop`);
+    const loopBody = src.slice(loopIdx, writeIdx + 700);
+    assert.match(loopBody, /BEGIN/, `${rel}: BEGIN must be INSIDE the per-source loop`);
+    assert.match(loopBody, /COMMIT/, `${rel}: COMMIT must be inside the loop too`);
+    assert.match(loopBody, /ROLLBACK/, `${rel}: a failing source rolls back only itself`);
+  }
+});
+
+test('a skipped source is named and forces a non-zero exit', () => {
+  // The deploy/cron step runs these best-effort, so the exit code is the only
+  // signal that reaches a log a human reads. "Some files were skipped" is what
+  // let this hide for weeks — every casualty must be named.
+  for (const rel of ['scripts/gds/search-ingest-md.js', 'scripts/gds/search-ingest-db.js']) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    assert.match(src, /failures\.push\(/, `${rel}: collects casualties`);
+    assert.match(src, /FAILED and were skipped/, `${rel}: reports them as a group`);
+    assert.match(src, /for \(const f of failures\) console\.error/, `${rel}: names each one`);
+    assert.match(src, /process\.exitCode = 1/, `${rel}: exits non-zero so the deploy log shows it`);
+  }
+});
+
+test('the vanished-source prune is SKIPPED after any failure', () => {
+  // present/presentRefs is the list we MEANT to write. Pruning against it on a
+  // partial run would delete chunks for a source that only failed transiently —
+  // turning a recoverable skip into data loss.
+  for (const rel of ['scripts/gds/search-ingest-md.js', 'scripts/gds/search-ingest-db.js']) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    assert.match(src, /failures\.length === 0/, `${rel}: prune is gated on a clean run`);
+    assert.match(src, /prune SKIPPED/, `${rel}: and says so when it skips`);
+  }
+});
+
+test('the driver error text reaching a log is bounded and single-line', () => {
+  // Panel finding: a Postgres error message is unbounded upstream text and CAN
+  // embed row content (a constraint violation quotes the offending key), and
+  // these are deploy/cron log sinks. The DB corpus makes it matter more — its
+  // prose is session-log/memory-derived text the file treats as scrub-sensitive.
+  for (const rel of ['scripts/gds/search-ingest-md.js', 'scripts/gds/search-ingest-db.js']) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    assert.match(src, /const ERR_LOG_MAX = \d+;/, `${rel}: declares a cap`);
+    assert.match(src, /function errLine\(e\)/, `${rel}: has the single formatter`);
+    assert.match(src, /truncated/, `${rel}: says when it truncated`);
+    // And nothing may still interpolate the raw driver message directly.
+    assert.doesNotMatch(src, /e && e\.message \? e\.message : (e|String\(e\))/,
+      `${rel}: every error path must go through errLine`);
+  }
+});
+
+console.log('');
+console.log(`search_ingest_nul: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);