@bongos/core 1.19.76 → 1.19.78

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.76",
-  "core_contract": "1.19.76",
-  "source_commit": "c120e5f2382927ea4eeb8b49b3a8f14bb5767fed",
+  "core_version": "1.19.78",
+  "core_contract": "1.19.78",
+  "source_commit": "e325ccc071131d7c01dbf333d8f7cd57ae312039",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T20:27:52.529Z",
+  "built_at": "2026-08-12T22:44:08.133Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1541,
-  "tree_sha256": "256191beb3508d344b1cd505975827c265ec5fe89158c0bcbb92e5e7f0a0c030",
+  "tree_sha256": "96bcb5ac17be8a28801e81faab41c95d0b6b2bfee4cd4919231a9b2e0ac6a8a9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1347,7 +1347,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "96ae791fc131dc389158f326e5fc698283de3d67d3396003bae2632f24a148b0"
+      "sha256": "1e1b93e51e8408ae8b44d3d241f4fe52babefa59c03d36aced5b04ffa745dce2"
     },
     {
       "path": "docs/design-contract.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "2afd598f687392b313dc872e73d4e6b61af27ce96d140685268ea5697955d636"
+      "sha256": "8d2dc69a139a5a658866a18527efeb5d9ae989e05883fa6cbd0ea63db0ba9476"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -2612,7 +2612,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "a9f51c0ddc4fc8c558d0c6dde77ffcd3e1b1262a6f14f93c88e1bb3e9093538d"
+      "sha256": "ba75c28d8927ebbda1482f394a0062febc6e32a52863814d00d6ad2a6667a591"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -3402,7 +3402,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "bc1526d068698e489fc2a698c04418e60097f18b56fd5c0dcdb6a6f62bbd1c81"
+      "sha256": "5e7dc6c267384eb3b691f49ec82631425151b97d2208eaf342922bf46146965f"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3437,7 +3437,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "5c0d0da5d6a8bcfb920bc432558066840e649cbc624e064dc4e55a926a3d8bb4"
+      "sha256": "8f62f50c5a81d649df6b85ef7c89e57a0bf0e8877482693861a4f9cd5cfafe5a"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -4057,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "599fff93b9ec8c3f6c83cd9a182d9338bea5c289ba1305bb66a69c2818aee8cf"
+      "sha256": "7829011d4ec272839d524b9e2f9449e16c18ff635378e52490091cb025cefe3f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3e61cb13243d69633f0b8ba4f1b48492f3c16077ada93e1ce3105f16285c3b51"
+      "sha256": "b179d0a0a83c292a353548cceac274dba29e8e296c62565244cc4d2fc81e6951"
     },
     {
       "path": "public-docs/index.html",
@@ -4557,7 +4557,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "65712c9b88a461add6211d895c650d9e6bc3a0994d8966a17be373a5dafbd105"
+      "sha256": "41e1a0c0ef56d5cf10cc73124964c114854a12d8dd3de249d4bafcda04dd2106"
     },
     {
       "path": "scripts/gds/build-bongos.js",
@@ -4837,7 +4837,7 @@
     {
       "path": "scripts/gds/hooks/pre-push.js",
       "mode": "0000644",
-      "sha256": "605b6551ca630222b671b74c08fa1b69d487614359fad327a93c2ac17e8a2021"
+      "sha256": "682c19e53e0633f02d5d5c2d4c9e3ae7c04e304c32461ed210b5fad8a6623e33"
     },
     {
       "path": "scripts/gds/http-api-client.js",
@@ -5687,7 +5687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b89d3c0f58693902c0632ef681849e5c0981a62d3eea34ae6096182c998419bf"
+      "sha256": "65dcc9e68f955842239c2c9d4f26e77c920ede6e79608347758ca7d6d71fb5e4"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6032,7 +6032,7 @@
     {
       "path": "tests/box_task_scope.mjs",
       "mode": "0000644",
-      "sha256": "e6cb9f94ae75fc9dd9134c85d8074bfe008eadd64eaddb0df2f1d6d851683c36"
+      "sha256": "22a2dc8bdccb9900b642371b85e8cc1785ecfacaf8f7579b042951425d95d794"
     },
     {
       "path": "tests/box_terminal_ssrf.mjs",
@@ -6042,7 +6042,7 @@
     {
       "path": "tests/boxes.mjs",
       "mode": "0000644",
-      "sha256": "ca5d40bd0be56fee293a5a7f65708721384bfd5cd8b7815e2f97342dd00e0121"
+      "sha256": "8702916e37e8cc08ae0e055b1bc7ea70da71720c51bd2a05df2a4dc598a17f97"
     },
     {
       "path": "tests/branding.mjs",
@@ -7157,7 +7157,7 @@
     {
       "path": "tests/pre_push_hook.mjs",
       "mode": "0000644",
-      "sha256": "cdd47e5e709590d1f8bb604b9ad98b13857d0efc196c8ab63728f00f62b999b5"
+      "sha256": "59716c99719a4e9f5475757f48331c3fb9f3edc58b204b4f3d40abe0b39937db"
     },
     {
       "path": "tests/preflight_checks.mjs",

package/docs/canonical-permissions.md

@@ -274,6 +274,15 @@ pre-merge gate misses, independent of the builder's cooperation:
   override). A raw push is caught and reverted by the **post-push main audit**
   (`scripts/gds/main-audit.js`) — nightly and as the `~/deploy.sh` deploy gate — which is the
   authoritative layer (it reads the real git history + real ranks, independent of the builder).
+- **The pre-push hook fails OPEN by contract, and the wrapper is what enforces that** (task 1002725).
+  The gate exits **13** — and only 13 — when it *deliberately* blocks; `.husky/pre-push` turns that
+  into git's exit 1. Any other non-zero exit is a **crash** and the wrapper warns loudly and allows
+  the push. This is deliberate: Layer 1 is cooperative, so a hook bug must never brick every push,
+  and the fail-closed net is the post-push audit above. The reserved code exists because node itself
+  exits 1 on a syntax error — `1` cannot distinguish a verdict from a fall-over. The gate therefore
+  must never call `process.exit()`: doing so after its rank-lookup `fetch` aborts node natively on
+  Windows (libuv `UV_HANDLE_CLOSING`), which runs no JS handler and exited 127, silently inverting
+  fail-open into "no Windows builder can push at all".
 - CLAUDE.md §10 carries a portable **behavioral** framing of this rule (product builders build the
   product, not the platform core they stand on); this doc holds the rank-name detail and the code is
   the enforcement. Editing CLAUDE.md or the hook locally cannot remove the audit/deploy-gate.

package/modules/dev-box/box-access.js

@@ -203,18 +203,33 @@ function sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) {
 // + passed by the route in R94) selects the surface, three ways:
 //   - scopeKeys is a NON-EMPTY array → TASK scope: BASE ∪ the claims' module dirs
 //     (via sparsePathsForScopeKeys + the passed-in `moduleScopeMap`).
-//   - scopeKeys is an EMPTY array     → BASE-only (a live box with no active claim /
-//     no scoped goal — the pre-existing Bongos instance, nothing extra).
+//   - scopeKeys is an EMPTY array     → depends on whether the builder is actually
+//     working (see `hasActiveClaims` below).
 //   - scopeKeys is ABSENT (undefined) → the pre-ADR-0148 RANK fallback (full for
 //     Metic+, else the starter sparse surface). This is the path a vanilla instance
 //     with no lifecycle port takes, and it preserves the old behavior EXACTLY — so
 //     shipping R93 before R94 wires the route changes nothing in production.
 //
+// TASK 1002729 — the empty-array case is NOT one case, it is two, and collapsing
+// them was a live defect. moduleScopeForActiveClaims returns [] both when the
+// builder holds no claim AND when they hold claims whose goals declare no
+// scope_modules (the goal wall is optional; only 13 of 46 goals on the live
+// instance declared one). Treating the second as "no scope" handed a working
+// builder a box with NO modules/ directory at all — less code than the rank
+// fallback would have given a newcomer. On the live fleet that was 247 of 248
+// source grants, including an Archon holding 7 active claims.
+//   - [] + hasActiveClaims true  → RANK fallback. The builder is working; an
+//     undeclared goal wall is a planning gap, and it must not cripple their box.
+//   - [] + hasActiveClaims false → BASE-only, as before (a genuinely unscoped box
+//     — the pre-existing Bongos instance, nothing extra). Least privilege holds.
+// `hasActiveClaims` is optional: omitted (undefined) preserves the old BASE-only
+// reading, so a caller that hasn't been taught the signal is unchanged.
+//
 // Returns one of:
 //   { allowed:false, reason:'BUILDER_INACTIVE' }
 //   { allowed:false, reason:'INSUFFICIENT_RANK', required, actual }
 //   { allowed:true,  scope, spec }
-function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, scopeKeys, moduleScopeMap } = {}) {
+function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, scopeKeys, hasActiveClaims, moduleScopeMap } = {}) {
   if (status && status !== 'active') {
     return { allowed: false, reason: 'BUILDER_INACTIVE' };
   }
@@ -228,11 +243,19 @@ function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, sco
   }
   // Claim-driven task scope (present → the box asks for exactly its work's code).
   if (Array.isArray(scopeKeys)) {
-    const sparsePaths = sparsePathsForScopeKeys(scopeKeys, moduleScopeMap);
-    const scope = scopeKeys.length > 0 ? 'task' : 'base';
-    return { allowed: true, scope, spec: { scope, mode: 'sparse', sparsePaths } };
+    if (scopeKeys.length > 0) {
+      const sparsePaths = sparsePathsForScopeKeys(scopeKeys, moduleScopeMap);
+      return { allowed: true, scope: 'task', spec: { scope: 'task', mode: 'sparse', sparsePaths } };
+    }
+    // Empty. A builder mid-claim whose goals declare no wall gets the rank scope,
+    // NOT a stripped box — the planning gap is not theirs to pay for.
+    if (!hasActiveClaims) {
+      const sparsePaths = sparsePathsForScopeKeys([], moduleScopeMap);
+      return { allowed: true, scope: 'base', spec: { scope: 'base', mode: 'sparse', sparsePaths } };
+    }
   }
-  // No claim signal (no lifecycle port on this instance): the pre-ADR-0148 rank fallback.
+  // No claim signal (no lifecycle port on this instance), or claims with an
+  // undeclared goal wall: the pre-ADR-0148 rank fallback.
   const scope = boxScopeForRank(rank);
   return { allowed: true, scope, spec: cloneSpecForScope(scope) };
 }

package/modules/dev-box/routes/box.js

@@ -444,6 +444,7 @@ module.exports = function buildBoxRouter() {
       // NEVER fail the source fetch on a scope-read hiccup — degrade to rank scope.
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
+      let hasActiveClaims;
       if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
@@ -452,7 +453,19 @@ module.exports = function buildBoxRouter() {
           scopeKeys = undefined;
         }
       }
-      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, moduleScopeMap: api.moduleScopeMap });
+      // task 1002729 — only needed to disambiguate an EMPTY scope: no claim (BASE)
+      // vs claims whose goals declare no wall (rank scope). Skipped otherwise so
+      // the common path keeps its single query.
+      if (Array.isArray(scopeKeys) && scopeKeys.length === 0
+          && lifecycle && typeof lifecycle.activeClaimCountForBuilder === 'function') {
+        try {
+          hasActiveClaims = (await lifecycle.activeClaimCountForBuilder(req.builder.id)) > 0;
+        } catch (claimErr) {
+          console.error('[gds] source-access claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
+          hasActiveClaims = undefined;
+        }
+      }
+      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap });
       const box = await boxes.getBoxByBuilderId(pool, req.builder.id);
       const auditDeny = (reason, extra) =>
         box && boxAccess.recordSourceEvent(pool, {
@@ -548,6 +561,7 @@ module.exports = function buildBoxRouter() {
       // (optional lifecycle port; degrade to rank scope on any hiccup).
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
+      let hasActiveClaims;
       if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
@@ -556,7 +570,18 @@ module.exports = function buildBoxRouter() {
           scopeKeys = undefined;
         }
       }
-      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, moduleScopeMap: api.moduleScopeMap });
+      // task 1002729 — same disambiguation as source-access, so this read-only
+      // companion can never report a scope the real fetch wouldn't grant.
+      if (Array.isArray(scopeKeys) && scopeKeys.length === 0
+          && lifecycle && typeof lifecycle.activeClaimCountForBuilder === 'function') {
+        try {
+          hasActiveClaims = (await lifecycle.activeClaimCountForBuilder(req.builder.id)) > 0;
+        } catch (claimErr) {
+          console.error('[gds] /box/scope claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
+          hasActiveClaims = undefined;
+        }
+      }
+      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap });
       if (!decision.allowed) {
         return res.fail('SOURCE_ACCESS_REVOKED', 403, {
           reason: decision.reason,

package/modules/lifecycle/db.js

@@ -4756,6 +4756,29 @@ async function moduleScopeForActiveClaims(builderId, deps = {}) {
   return rows.map((r) => r.module_key);
 }
 
+// Task 1002729 — the companion signal moduleScopeForActiveClaims cannot carry.
+// That query INNER JOINs goals and unnests scope_modules, so it returns [] for
+// BOTH "this builder holds no claim" and "this builder holds claims whose goals
+// declare no scope_modules". Those must not be treated alike: the first is a
+// genuinely unscoped box (BASE-only is right), the second is a builder actively
+// working who would be handed a box with no modules/ at all. Live evidence for
+// why this matters: 247 of 248 source grants on the cloudbongos fleet resolved to
+// BASE, including an Archon holding 7 active claims — every one of those claims
+// sat on a goal with scope_modules = {}. Counts CLAIMS, deliberately not joining
+// goals, so it stays true regardless of how the goal wall is (or isn't) declared.
+async function activeClaimCountForBuilder(builderId, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const id = Number(builderId);
+  if (!Number.isInteger(id)) {
+    throw new Error('activeClaimCountForBuilder: builderId must be numeric');
+  }
+  const { rows } = await activePool.query(
+    `SELECT count(*)::int AS n FROM claims WHERE builder_id = $1 AND released_at IS NULL`,
+    [id]
+  );
+  return rows.length ? Number(rows[0].n) : 0;
+}
+
 // task 1642 — every active claim bound to a given CLI session. "Active" is the
 // claims-table convention (released_at IS NULL); there is NO `status` column on
 // claims (a common misread — the task's status lives on `tasks`). Keyed on
@@ -5625,6 +5648,7 @@ module.exports = {
   getClaimPublishedSha, // task 1547 — read the published tip for the reconcile gate
   getActiveClaimsForBuilder,
   moduleScopeForActiveClaims, // goal 1000051 / R92 — dev-box task-scoped source access (ADR 0148 §2)
+  activeClaimCountForBuilder, // task 1002729 — distinguishes "no claim" from "claim with an empty goal wall"
   getActiveClaimsForSession,
   getLastClaimHolder, // --regrade ownership guard (#678)
   getTaskGrade,       // V4.R08 — diff-hash reuse check before grading

package/modules/lifecycle/lifecycle.js

@@ -65,4 +65,7 @@ module.exports = {
   // resolver (goal 1000051 / R92, ADR 0148 §2). Keys only; box-access maps them to
   // git sparse-checkout globs through the doorway `moduleScopeMap`.
   moduleScopeForActiveClaims: (...a) => db.moduleScopeForActiveClaims(...a),
+  // task 1002729 — the "is this builder actually working right now" signal that
+  // lets box-access tell an unscoped box from a crippled one (see db.js).
+  activeClaimCountForBuilder: (...a) => db.activeClaimCountForBuilder(...a),
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.76",
+  "version": "1.19.78",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.76",
+      "version": "1.19.78",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.76",
+  "version": "1.19.78",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box.js

@@ -14,7 +14,7 @@
 //   park      <builder>   snapshot + destroy the droplet (stop compute billing)
 //   wake      <builder>   recreate the droplet from its snapshot
 //   deprovision <builder> destroy droplet AND snapshot (full reclaim)
-//   sweep-idle            deprovision every active box idle > BOX_IDLE_MINUTES (#804)
+//   sweep-idle            PARK every active box idle > BOX_IDLE_MINUTES (snapshot kept)
 //   sweep-dormant         deprovision every box parked > BOX_DORMANT_DAYS (pings builder)
 //   status                print the box roster + estimated cost
 //
@@ -1007,33 +1007,47 @@ async function cmdDeprovision(pool, boxes, ref, { apply }) {
 }
 
 // ---- sweep-idle ------------------------------------------------------------
-// Idle boxes are deprovisioned directly (no park step). Park is removed from the
-// automated lifecycle — it added snapshot storage cost (~$0.30/mo) with no
-// benefit given boxes are ephemeral by design (builders provision fresh each session).
-// Park remains available as a manual CLI command for Archon use.
+// Idle boxes are PARKED: snapshot taken, droplet destroyed (compute billing
+// stops), filesystem preserved so the builder wakes into their work. Snapshot
+// storage is ~$0.30/mo — the price of not silently discarding uncommitted work.
+//
+// This sweep deliberately never destroys a snapshot. Full reclaim (droplet AND
+// snapshot) belongs to sweep-dormant, which only fires after BOX_DORMANT_DAYS of
+// being parked and pings the builder first. That split is the whole safety
+// property: no automated path can take work off a builder without warning.
+//
+// History: this sweep used to call deprovisionOne directly, on the theory that
+// boxes are ephemeral and builders provision fresh each session. In practice it
+// meant a box idle past the threshold was annihilated — droplet and snapshot —
+// taking anything uncommitted with it, while the CLI help, the /builder-box
+// skill and the hall all still described park-and-wake. Task 1002726 restored
+// the documented behaviour rather than the documentation.
 
 async function cmdSweepIdle(pool, boxes, { apply }) {
   const rows = await boxes.listBoxes(pool, { state: 'active' });
   const idle = boxes.selectIdleBoxes(rows, { idleMinutes: CONFIG.idleMinutes, nowMs: Date.now() });
   console.log(`idle sweep (threshold=${CONFIG.idleMinutes}m${apply ? '' : ', dry-run'}): ${idle.length} of ${rows.length} active box(es) idle`);
-  if (idle.length === 0) { console.log('  nothing idle — exit clean'); return { deprovisioned: 0 }; }
+  if (idle.length === 0) { console.log('  nothing idle — exit clean'); return { parked: 0 }; }
   const doApi = apply ? makeDo(apply) : null;
-  let deprovisioned = 0, errors = 0;
+  let parked = 0, errors = 0;
   for (const box of idle) {
     const mins = Math.round((Date.now() - (boxes.effectiveActivityMs(box) || Date.now())) / 60000);
-    if (!apply) { console.log(`  would deprovision @${box.github_login}'s box (idle ${mins}m, droplet ${box.droplet_id})`); continue; }
+    if (!apply) { console.log(`  would park @${box.github_login}'s box (idle ${mins}m, droplet ${box.droplet_id})`); continue; }
     try {
-      await deprovisionOne(pool, boxes, doApi, box, { actor: 'sweep:idle', login: box.github_login });
-      deprovisioned++;
-      console.log(`  ✓ deprovisioned @${box.github_login} (idle ${mins}m)`);
+      await parkOne(pool, boxes, doApi, box, { actor: 'sweep:idle' });
+      parked++;
+      console.log(`  ✓ parked @${box.github_login} (idle ${mins}m — snapshot kept, compute stopped)`);
     } catch (e) {
+      // A park that fails must NOT fall through to a destroy — leaving the box
+      // at 'error' with its droplet intact is strictly safer than reclaiming it,
+      // and reconcile-drift picks the row up from there.
       errors++;
       await markErrorUnlessDestroyed(pool, boxes, box.builder_id, e.message);
       console.log(`  ✖ @${box.github_login}: ${e.message}`);
     }
   }
-  console.log(`done — deprovisioned=${deprovisioned} errors=${errors} dry-run=${!apply}`);
-  return { deprovisioned, errors };
+  console.log(`done — parked=${parked} errors=${errors} dry-run=${!apply}`);
+  return { parked, errors };
 }
 
 // ---- sweep-dormant ---------------------------------------------------------
@@ -1427,4 +1441,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { cmdProvision, deprovisionOne, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, BOX_INFRA_TEMPLATE };
+module.exports = { cmdProvision, deprovisionOne, parkOne, cmdSweepIdle, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, BOX_INFRA_TEMPLATE };

package/scripts/gds/hooks/pre-push.js

@@ -37,6 +37,24 @@ const { apiCall, productName } = require(path.join(__dirname, '..', 'cli-lib.js'
 const ZERO = /^0+$/;
 const MAIN_REF = 'refs/heads/main';
 
+// The ONE exit code that means "the gate deliberately blocked this push". Any
+// other non-zero exit is a CRASH, and .husky/pre-push translates it back to a
+// warn-and-allow (task 1002725 / idea 1000704).
+//
+// WHY a reserved code and not the conventional 1: node itself exits 1 on a
+// syntax error / unhandled rejection, so `1` cannot distinguish "we decided to
+// block" from "the gate fell over". Reserving an unusual code means the wrapper
+// only ever fails CLOSED on a decision this file actually made — every other
+// shape (127 native abort, 134 SIGABRT, 1 syntax error) reads as a crash and
+// fails OPEN, which is this layer's documented design (the post-push main audit
+// is the fail-closed net).
+const BLOCK_EXIT_CODE = 13;
+
+// Sentinel returned by block() so each call site can `return block([...])` and
+// stop the sweep. run() must never call process.exit() itself — see the note on
+// the entrypoint at the bottom of this file.
+const BLOCKED = Symbol('blocked');
+
 function git(args) {
   try {
     return execSync(`git ${args}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
@@ -70,18 +88,25 @@ function changedFilesFor(localSha, remoteSha) {
 const LIVE_RANK_TIMEOUT_MS = 4000;
 
 async function liveRank() {
+  let timer = null;
   try {
-    const timeout = new Promise((resolve) => setTimeout(() => resolve('__timeout__'), LIVE_RANK_TIMEOUT_MS));
+    const timeout = new Promise((resolve) => { timer = setTimeout(() => resolve('__timeout__'), LIVE_RANK_TIMEOUT_MS); });
     const res = await Promise.race([
       apiCall('GET', '/api/gds/me', null, { allowUnauthenticated: true }),
       timeout,
     ]);
+    // The loser of the race must be cleared. This used to leak: process.exit()
+    // tore the loop down regardless, so nobody noticed. Now that the hook exits
+    // NATURALLY (task 1002725), an armed 4s timer would hold every
+    // protected-path push open for the full timeout after the API already
+    // answered.
+    if (timer) clearTimeout(timer);
     if (res === '__timeout__') {
       console.error(`\n\x1b[33m⚠ permission gate: GDS /me did not respond within ${LIVE_RANK_TIMEOUT_MS}ms — treating rank as unknown.\x1b[0m`);
       return null;
     }
     if (res && res.ok) return res.data?.builder?.rank ?? null;
-  } catch (_) { /* offline / no session */ }
+  } catch (_) { /* offline / no session */ } finally { if (timer) clearTimeout(timer); }
   return null;
 }
 
@@ -89,7 +114,8 @@ function block(lines) {
   console.error(`\n\x1b[31m✖ push blocked by the ${productName()} permission gate (SEC #863)\x1b[0m`);
   for (const l of lines) console.error('  ' + l);
   console.error('');
-  process.exit(1);
+  process.exitCode = BLOCK_EXIT_CODE;
+  return BLOCKED;
 }
 
 async function run() {
@@ -103,13 +129,13 @@ async function run() {
     const [localRef, localSha, remoteRef, remoteSha] = l.split(/\s+/);
     return { localRef, localSha, remoteRef, remoteSha };
   });
-  if (refs.length === 0) process.exit(0); // nothing to push
+  if (refs.length === 0) return; // nothing to push
 
   // Rule 1: no direct push to main.
   if (!allowMain) {
     for (const r of refs) {
       if (r.remoteRef === MAIN_REF && !ZERO.test(r.localSha)) {
-        block([
+        return block([
           'Direct pushes to `main` are not allowed.',
           'The GDS lands graded work for you: run `/builder-ship` on your claimed task.',
           'A direct push to main skips the grader, the confirm gate, parallel-safety, and',
@@ -128,7 +154,7 @@ async function run() {
   }
   const changedFiles = [...allChanged];
   const protectedHits = ppc.matchProtected(changedFiles);
-  if (protectedHits.length === 0) process.exit(0); // nothing sensitive — fast path
+  if (protectedHits.length === 0) return; // nothing sensitive — fast path
 
   const rank = await liveRank();
   if (rank === null) {
@@ -140,12 +166,12 @@ async function run() {
     console.error('  This push touches permission-sensitive paths:');
     for (const h of protectedHits.slice(0, 10)) console.error(`    - ${h.file}`);
     console.error('  Allowing the push; the server-side audit will re-check with your real rank.\n');
-    process.exit(0);
+    return;
   }
 
   const result = ppc.checkPermissionPaths({ changedFiles, builderRank: rank });
   if (result.hardFail) {
-    block([
+    return block([
       `Your rank '${rank}' is below Metic and may not modify permission-sensitive surfaces:`,
       ...protectedHits.slice(0, 12).map((h) => `  - ${h.file}  (matches ${h.glob})`),
       '',
@@ -154,20 +180,28 @@ async function run() {
       'raise it with an Archon — do not edit it from a sandbox/newcomer rank (ADR 0016, ADR 0043).',
     ]);
   }
-  process.exit(0);
 }
 
 // Only run when invoked directly (the husky wrapper does `node pre-push.js`).
 // Requiring this file (e.g. a test importing matchProtected logic) must NOT
 // read stdin or call process.exit.
+//
+// NOTE (task 1002725): nothing on this path may call process.exit(). Calling it
+// after liveRank()'s fetch aborts the process natively on Windows —
+// "Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c"
+// — because undici's handles are still closing when the loop is torn down. The
+// abort exits 127 BEFORE the .catch() below can run, so the fail-open guarantee
+// was silently inverted into "no Windows builder can push anything at all".
+// Setting process.exitCode and letting the loop drain naturally is what keeps
+// this hook's own error handling reachable.
 if (require.main === module) {
   run().catch((e) => {
     // A hook crash must not silently allow a bad push of protected paths, but it
     // also must not brick all pushes on an unrelated bug. Fail OPEN with a loud
     // warning — the post-push audit remains the fail-closed net.
     console.error(`\n⚠ permission pre-push hook errored (${e.message}); allowing push. The server-side audit still applies.\n`);
-    process.exit(0);
+    process.exitCode = 0;
   });
 }
 
-module.exports = { run };
+module.exports = { run, BLOCK_EXIT_CODE };

package/src/module-api.js

@@ -579,8 +579,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.74 with no explicit bump. run 31632769733. (task 1002620)
 //   1.19.76 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.75 with no explicit bump. run 31637719876. (task 1002620)
+//   1.19.77 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.76 with no explicit bump. run 31647860631. (task 1002620)
+//   1.19.78 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.77 with no explicit bump. run 31648127800. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.76'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.78'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_task_scope.mjs

@@ -96,4 +96,74 @@ await test('an inactive builder is denied even with claims in scope', async () =
   assert.equal(inactive.decision.reason, 'BUILDER_INACTIVE');
 });
 
+// =========================================================================
+// Task 1002729 — an EMPTY scope is two different situations, not one
+// =========================================================================
+// The live defect: moduleScopeForActiveClaims returns [] both for "holds no
+// claim" and for "holds claims whose goals declare no scope_modules". Reading
+// both as BASE handed working builders a box with no modules/ at all — 247 of
+// 248 grants on the live fleet, including an Archon with 7 active claims.
+
+// A pool that answers BOTH queries the resolver pair now issues: the
+// claims→goals→scope_modules unnest, and the plain active-claim count.
+function poolReturningWithClaims(moduleKeyRows, claimCount) {
+  const c = makeSqlAwareClient((s) => {
+    if (/FROM claims c/.test(s) && /unnest\(g\.scope_modules\)/.test(s)) return { rows: moduleKeyRows };
+    if (/count\(\*\)/.test(s) && /FROM claims/.test(s)) return { rows: [{ n: claimCount }] };
+    return null;
+  });
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+
+async function specForClaimsWithCount({ builderId = 3, rank = 'metic', status = 'active', moduleKeyRows, claimCount }) {
+  const pool = poolReturningWithClaims(moduleKeyRows, claimCount);
+  const scopeKeys = await db.moduleScopeForActiveClaims(builderId, { pool });
+  const hasActiveClaims = (await db.activeClaimCountForBuilder(builderId, { pool })) > 0;
+  return { scopeKeys, hasActiveClaims, decision: access.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: scopeMap }) };
+}
+
+await test('claims held but every goal wall empty → RANK scope, never a stripped box', async () => {
+  // Exactly Lars's live shape: 7 active claims, all on goals with scope_modules={}.
+  const { scopeKeys, hasActiveClaims, decision } = await specForClaimsWithCount({
+    rank: 'archon', moduleKeyRows: [], claimCount: 7,
+  });
+  assert.deepEqual(scopeKeys, [], 'the union query still yields nothing — the goals declare no wall');
+  assert.equal(hasActiveClaims, true, 'but the builder IS working');
+  assert.equal(decision.scope, 'full', 'an Archon mid-claim gets the full surface, not base');
+  assert.equal(decision.spec.mode, 'full');
+  assert.notEqual(decision.scope, 'base', 'the regression this test exists to prevent');
+});
+
+await test('no claims at all → BASE-only is preserved (least privilege holds)', async () => {
+  const { hasActiveClaims, decision } = await specForClaimsWithCount({
+    rank: 'archon', moduleKeyRows: [], claimCount: 0,
+  });
+  assert.equal(hasActiveClaims, false);
+  assert.equal(decision.scope, 'base', 'an idle box is still not handed the repo');
+  assert.deepEqual(decision.spec.sparsePaths, [...BASE]);
+});
+
+await test('a declared goal wall still wins over the rank fallback', async () => {
+  // Claims AND a wall → task scope, exactly as before; the fix must not widen this.
+  const { decision } = await specForClaimsWithCount({
+    rank: 'archon', moduleKeyRows: [{ module_key: 'status-ui' }], claimCount: 2,
+  });
+  assert.equal(decision.scope, 'task', 'a real wall is still honoured, not overridden by rank');
+  assert.deepEqual(decision.spec.sparsePaths, [...BASE, 'modules/status-ui']);
+});
+
+await test('a Thetes mid-claim with no wall gets STARTER, not full — rank still bounds it', async () => {
+  const { decision } = await specForClaimsWithCount({
+    rank: 'thetes', moduleKeyRows: [], claimCount: 1,
+  });
+  assert.equal(decision.scope, 'starter', 'the fallback is rank-bounded; it is not a blanket widen');
+});
+
+await test('activeClaimCountForBuilder rejects a non-numeric builder id', async () => {
+  await assert.rejects(
+    () => db.activeClaimCountForBuilder('not-a-number', { pool: poolReturningWithClaims([], 0) }),
+    /must be numeric/,
+  );
+});
+
 summary();

package/tests/boxes.mjs

@@ -1251,5 +1251,86 @@ await ta('markErrorUnlessDestroyed: a genuine (pre-destroyed) failure still park
   assert.match(writes[0].patch.error_note, /DO 500/);
 });
 
+console.log('\ntask 1002726 — the idle sweep parks, it does not destroy:');
+
+// The regression this pins: cmdSweepIdle used to call deprovisionOne, so an idle
+// box lost its droplet AND its snapshot — every sweep:idle row in the live
+// box_events history was a full teardown, and nothing could be woken. The sweep
+// must snapshot-and-park instead, leaving the filesystem recoverable.
+function sweepHarness({ idleRows, parkThrows = null }) {
+  const events = [];
+  const states = [];
+  const fakeBoxes = {
+    async listBoxes() { return idleRows; },
+    selectIdleBoxes: boxes.selectIdleBoxes,
+    effectiveActivityMs: boxes.effectiveActivityMs,
+    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
+    async recordComputeCost() { return 0; },
+    async recordEvent(_db, e) { events.push(e); },
+    async getBoxByBuilderId() { return { state: 'active' }; },
+  };
+  return { fakeBoxes, events, states, parkThrows };
+}
+
+await ta('cmdSweepIdle: an idle box is PARKED — snapshot retained, no snapshot delete', async () => {
+  const NOW_ROW = {
+    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', droplet_name: 'box-lars589',
+    github_login: 'lars589', last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(),
+    claude_active: false, snapshot_id: null,
+  };
+  const h = sweepHarness({ idleRows: [NOW_ROW] });
+  const deleted = [];
+  const doApi = {
+    dryRun: false,
+    async powerOffDroplet() { return { action: { id: 1 } }; },
+    async waitForAction() {},
+    async snapshotDroplet() { return { action: { id: 2 } }; },
+    async getDroplet() { return { droplet: { snapshot_ids: ['999'] } }; },
+    async deleteDroplet(id) { deleted.push(`droplet:${id}`); },
+    async deleteSnapshot(id) { deleted.push(`snapshot:${id}`); },
+  };
+  // makeDo() is only reached under --apply; inject our fake by stubbing the DO
+  // client the command builds. cmdSweepIdle takes (pool, boxes, {apply}), so we
+  // exercise parkOne directly with the same contract the sweep now uses.
+  await boxCli.parkOne({}, h.fakeBoxes, doApi, NOW_ROW, { actor: 'sweep:idle' });
+
+  const parked = h.states.find((s) => s.state === 'parked');
+  assert.ok(parked, 'box reaches parked');
+  assert.equal(parked.patch.snapshot_id, '999', 'snapshot id retained on the row');
+  assert.equal(parked.patch.droplet_id, null, 'droplet released');
+  assert.ok(deleted.includes('droplet:591743808'), 'droplet destroyed (compute billing stops)');
+  assert.ok(!deleted.some((d) => d.startsWith('snapshot:')), 'the snapshot is NEVER deleted by an idle park');
+  assert.equal(h.events.find((e) => e.event === 'park')?.actor, 'sweep:idle', 'logged as a park, not a deprovision');
+});
+
+await ta('cmdSweepIdle: dry-run reports "would park" and touches nothing', async () => {
+  const row = {
+    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', github_login: 'lars589',
+    last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(), claude_active: false,
+  };
+  const h = sweepHarness({ idleRows: [row] });
+  const lines = [];
+  const origLog = console.log;
+  console.log = (...a) => lines.push(a.join(' '));
+  try {
+    const res = await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: false });
+    assert.equal(res.parked, 0, 'dry-run parks nothing');
+  } finally { console.log = origLog; }
+  assert.ok(lines.some((l) => /would park/.test(l)), 'dry-run says park, not deprovision');
+  assert.ok(!lines.some((l) => /would deprovision/.test(l)), 'no destroy language survives');
+  assert.equal(h.states.length, 0, 'no state written in dry-run');
+});
+
+await ta('cmdSweepIdle: a box running Claude is never parked mid-session', async () => {
+  const busy = {
+    id: 4, builder_id: 4, state: 'active', droplet_id: '1', github_login: 'busy',
+    last_activity_at: new Date(Date.now() - 99 * 3600_000).toISOString(), claude_active: true,
+  };
+  const h = sweepHarness({ idleRows: [busy] });
+  const res = await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: true });
+  assert.equal(res.parked, 0, 'claude_active holds the box open regardless of age');
+  assert.equal(h.states.length, 0);
+});
+
 console.log(`\nboxes.mjs: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/pre_push_hook.mjs

@@ -3,12 +3,16 @@
 // Pins three facts the 2026-08-06 choke-point map litigated:
 //   1. G-17 refutation: pre-push.js's dependency path resolves INSIDE the repo
 //      (three `..` from scripts/gds/hooks/ is the root, not one above it).
-//   2. The hook actually blocks a direct push to refs/heads/main (exit 1),
-//      and allows a branch deletion (exit 0) — both offline-deterministic.
-//   3. G-2 fix: the tracked .husky/pre-push wrapper exists, execs the real
+//   2. The hook actually blocks a direct push to refs/heads/main (exit 13, the
+//      reserved block code the wrapper turns into git's exit 1), and allows a
+//      branch deletion (exit 0) — both offline-deterministic.
+//   3. G-2 fix: the tracked .husky/pre-push wrapper exists, invokes the real
 //      gate, and is LF + executable in the git index (CRLF or mode 100644
 //      would silently kill the hook on Unix clones).
 //
+// Plus (task 1002725) the fail-open contract: a CRASHED gate must not brick the
+// push — see the block comment above those tests.
+//
 // DB-free, no network: the main-push block fires before any API call.
 // Run:  node --test tests/pre_push_hook.mjs
 
@@ -17,6 +21,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -26,6 +31,7 @@ const HOOK = path.join(ROOT, 'scripts', 'gds', 'hooks', 'pre-push.js');
 const WRAPPER = path.join(ROOT, '.husky', 'pre-push');
 const SHA = 'a'.repeat(40);
 const ZEROS = '0'.repeat(40);
+const BLOCK_EXIT_CODE = 13; // pre-push.js's reserved "deliberately blocked" code
 
 function runHook(stdinLine) {
   return spawnSync(process.execPath, [HOOK, 'origin', 'https://example.invalid/repo.git'], {
@@ -36,6 +42,30 @@ function runHook(stdinLine) {
   });
 }
 
+// Run the WRAPPER (not the gate) under `sh`, optionally with a fake `node`
+// earlier on PATH so we can drive the gate's exit code without needing the gate
+// to actually crash. This is how the fail-open contract is testable at all: a
+// native abort cannot be provoked on demand, but the wrapper only ever sees an
+// exit code, so substituting the code proves the translation.
+function runWrapper(stdinLine, { fakeNodeExit = null, fakeNodeStderr = '' } = {}) {
+  let shimDir = null;
+  const env = { ...process.env, OTB_ALLOW_MAIN_PUSH: '' };
+  if (fakeNodeExit !== null) {
+    shimDir = fs.mkdtempSync(path.join(os.tmpdir(), 'prepush-shim-'));
+    const shim = path.join(shimDir, 'node');
+    fs.writeFileSync(shim, `#!/bin/sh\n[ -n "${fakeNodeStderr}" ] && printf '%s\\n' "${fakeNodeStderr}" >&2\nexit ${fakeNodeExit}\n`);
+    fs.chmodSync(shim, 0o755);
+    env.PATH = `${shimDir}${path.delimiter}${env.PATH}`;
+  }
+  try {
+    return spawnSync('sh', [WRAPPER, 'origin', 'https://example.invalid/repo.git'], {
+      cwd: ROOT, input: stdinLine, encoding: 'utf8', env,
+    });
+  } finally {
+    if (shimDir) fs.rmSync(shimDir, { recursive: true, force: true });
+  }
+}
+
 test('G-17 refuted: the line-30 dependency path resolves inside the repo and loads', () => {
   const hooksDir = path.dirname(HOOK);
   const resolved = path.join(hooksDir, '..', '..', '..', 'src', 'bongos', 'permission-path-check.js');
@@ -45,9 +75,9 @@ test('G-17 refuted: the line-30 dependency path resolves inside the repo and loa
   assert.equal(typeof ppc.checkPermissionPaths, 'function');
 });
 
-test('hook blocks a direct push to refs/heads/main with exit 1', () => {
+test('hook blocks a direct push to refs/heads/main with the reserved block code', () => {
   const r = runHook(`refs/heads/main ${SHA} refs/heads/main ${SHA}\n`);
-  assert.equal(r.status, 1, `expected exit 1, got ${r.status}; stderr: ${r.stderr}`);
+  assert.equal(r.status, BLOCK_EXIT_CODE, `expected exit ${BLOCK_EXIT_CODE}, got ${r.status}; stderr: ${r.stderr}`);
   assert.match(r.stderr, /push blocked/i);
   assert.match(r.stderr, /Direct pushes to `main`/);
 });
@@ -62,7 +92,7 @@ test('requiring the hook as a module neither reads stdin nor exits', () => {
   assert.equal(typeof mod.run, 'function');
 });
 
-test('G-2 fixed: tracked .husky/pre-push wrapper execs the real gate', () => {
+test('G-2 fixed: tracked .husky/pre-push wrapper invokes the real gate', () => {
   assert.ok(fs.existsSync(WRAPPER), '.husky/pre-push must be tracked (ADR 0043 Layer 1 delivery)');
   const body = fs.readFileSync(WRAPPER, 'utf8');
   assert.ok(body.startsWith('#!/bin/sh'), 'wrapper must start with a sh shebang');
@@ -70,6 +100,73 @@ test('G-2 fixed: tracked .husky/pre-push wrapper execs the real gate', () => {
   assert.ok(!body.includes('\r'), 'wrapper must be LF-only (CRLF breaks the shebang on Unix)');
 });
 
+// ---------------------------------------------------------------------------
+// task 1002725 / idea 1000704 — the fail-open guarantee is REAL, not aspirational.
+//
+// The gate is documented to fail OPEN on a crash (it is cooperative Layer 1; the
+// post-push main audit is the fail-closed net). On Windows + Node 24 it instead
+// died with a native libuv abort — "Assertion failed: !(handle->flags &
+// UV_HANDLE_CLOSING), file src\win\async.c, line 76" — triggered by calling
+// process.exit() after liveRank()'s fetch, while undici's handles were still
+// closing. A native abort runs no JS, so the gate's own .catch() never fired; the
+// process exited 127 and git refused EVERY push. A Windows builder could not land
+// any work at all.
+//
+// Two invariants pin the fix:
+//   1. the gate never calls process.exit() (the abort's trigger), and
+//   2. the WRAPPER — the only layer that survives a native abort — translates a
+//      crash back into allow-with-a-warning, and a deliberate block into exit 1.
+// ---------------------------------------------------------------------------
+
+test('gate never calls process.exit() — that is what aborts natively on Windows', () => {
+  const src = fs.readFileSync(HOOK, 'utf8');
+  const withoutComments = src.replace(/\/\/[^\n]*/g, '').replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.ok(
+    !/process\.exit\s*\(/.test(withoutComments),
+    'pre-push.js must set process.exitCode and let the loop drain; process.exit() after a fetch aborts node on Windows'
+  );
+  assert.match(src, /process\.exitCode/, 'the gate still has to report its verdict via process.exitCode');
+});
+
+test('wrapper translates the reserved block code into a real git block (exit 1)', () => {
+  const r = runWrapper(`refs/heads/main ${SHA} refs/heads/main ${SHA}\n`);
+  assert.equal(r.status, 1, `a deliberate block must stop the push; got ${r.status}; stderr: ${r.stderr}`);
+  assert.match(r.stderr, /Direct pushes to `main`/);
+});
+
+test('wrapper FAILS OPEN when the gate crashes natively (the 1002725 regression)', () => {
+  const r = runWrapper(`refs/heads/main ${SHA} refs/heads/main ${SHA}\n`, {
+    fakeNodeExit: 127,
+    fakeNodeStderr: 'Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)',
+  });
+  assert.equal(r.status, 0, `a crashed gate must NOT brick the push; got exit ${r.status}; stderr: ${r.stderr}`);
+  assert.match(r.stderr, /crashed \(exit 127\)/i, 'the crash must be reported loudly, not swallowed');
+  assert.match(r.stderr, /allowing push/i);
+});
+
+test('wrapper fails open on a plain node failure (exit 1) too, not just a native abort', () => {
+  // node exits 1 on a syntax error / unhandled rejection. That is a CRASH, not a
+  // verdict — which is precisely why the deliberate block needed its own code.
+  const r = runWrapper(`refs/heads/main ${SHA} refs/heads/main ${SHA}\n`, { fakeNodeExit: 1 });
+  assert.equal(r.status, 0, `exit 1 from node is a crash and must fail open; got ${r.status}`);
+  assert.match(r.stderr, /crashed \(exit 1\)/i);
+});
+
+test('wrapper allows a clean gate run (exit 0) untouched', () => {
+  const r = runWrapper(`refs/heads/some-branch ${ZEROS} refs/heads/some-branch ${SHA}\n`, { fakeNodeExit: 0 });
+  assert.equal(r.status, 0);
+  assert.doesNotMatch(r.stderr, /crashed/i, 'a clean run must not warn');
+});
+
+test('wrapper does not exec the gate — it must survive to inspect the exit code', () => {
+  const body = fs.readFileSync(WRAPPER, 'utf8');
+  assert.ok(
+    !/^\s*exec\s+node/m.test(body),
+    '`exec node` replaces the shell, so a crash exit code propagates straight to git as a block'
+  );
+  assert.match(body, /\$\?/, 'the wrapper must capture the gate exit code');
+});
+
 test('wrapper is executable (mode 100755) in the git index', () => {
   const r = spawnSync('git', ['ls-files', '-s', '--', '.husky/pre-push'], { cwd: ROOT, encoding: 'utf8' });
   assert.equal(r.status, 0, `git ls-files failed: ${r.stderr}`);