@bongos/core 1.19.809 → 1.19.811

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.809",
-  "core_contract": "1.19.809",
-  "source_commit": "8a0d6205ab8651338ec9f196b0d2a76457ecd7de",
+  "core_version": "1.19.811",
+  "core_contract": "1.19.811",
+  "source_commit": "8dc3b188ab249c84103920e82ce8021dc55487ed",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T05:51:03.923Z",
+  "built_at": "2026-09-17T06:20:04.579Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 487,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2710,
-  "tree_sha256": "8ffacf4d6b6f9d1185a0367eef97d3f885c3219caa5f7b483c03e568f6e244cf",
+  "tree_sha256": "7f3e8838baaa79070aa7705d761e9613297767dc1391cbf4f2ba0492339cd9b1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2532,7 +2532,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0fc3cc0ea86f2325096412d389457b095d7e12b175415e0f9bc41d5cd40946a1"
+      "sha256": "bb4fbb214534d6224c13b6c6aa283ca18d762fc46482842169505bb7c58d6308"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7727,12 +7727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bce83e06aea9721525e159bbe1446154fcda006c89fdcde14fd6ab46f624366a"
+      "sha256": "d922e9276bdb8d89f5998de6f4b29dbc98d897e5a7acfc11d0ceeb2b11e89178"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "714b48f38c2da73d5a2353c66228b8f4aa8cd375f7c712a1421f59bb0cf22e09"
+      "sha256": "98f193e8dfee8bab41773622a373d2c19efafa8fb7bdeaf6e2c43f2032651d24"
     },
     {
       "path": "public-docs/index.html",
@@ -8977,7 +8977,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "de8f1f66bf964bfcb8e4fa570f1f873782dfee8d633ff6e599fb894096aecd14"
+      "sha256": "bb39ac6572410567ce0a2881f26b0512df817fd04cec9130792ca24c48e8d02a"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9432,7 +9432,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "f9d3e4e892d11bbe83b0f76c588fc4c76204f6a424257eb0249acf680f85967a"
+      "sha256": "8d7b749edca694b4c9d8a563a4334c7fe3fc7be64c520c3d14c3b63febff132a"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9622,7 +9622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "03b5ce71d6aeab750b5bd2dad14f89d459472a4b42a701b4923bb430cafa384e"
+      "sha256": "7cbce9c1f2bed1a8fe7a8cff1cfee09c702ee66fa719829ff347087bf86fb7bc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10327,7 +10327,7 @@
     {
       "path": "tests/cli_exit_no_abort.mjs",
       "mode": "0000644",
-      "sha256": "9772748fe60b831b26c41eab5b12e228d89fb7231065dfbdc527e47207104e36"
+      "sha256": "39b63a76b153426f486240e4c57d4fafb2b5b130fb9853c800d20d9f4e5acdde"
     },
     {
       "path": "tests/cli_lib_formatters.mjs",
@@ -11942,7 +11942,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "d985570340fb9706224c72ed27a2b9a9a84b985f56d2a45fcac564dc463175d4"
+      "sha256": "e277e0579dd6c8fea459cc5a3b4adf04dda12c95e69a415eeea5cfd2de52d760"
     },
     {
       "path": "tests/module_api.mjs",
@@ -12857,7 +12857,7 @@
     {
       "path": "tests/session_caps.mjs",
       "mode": "0000644",
-      "sha256": "72acabf6ffa1721f9b4ec7d2c8f7b1def31b7af4f7b40ac918045201a2b88b61"
+      "sha256": "b08260c077dca811eec663b0f32618ef1a5e28c78a427b907f0c451ee68fc196"
     },
     {
       "path": "tests/session_cost.mjs",

package/docs/module-api-changelog.md

@@ -2092,5 +2092,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.807 with no explicit bump. run 35185130913. (task 1002620)
   1.19.809 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.808 with no explicit bump. run 35187322516. (task 1002620)
+  1.19.810 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.809 with no explicit bump. run 35188253911. (task 1002620)
+  1.19.811 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.810 with no explicit bump. run 35189324772. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.809",
+  "version": "1.19.811",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.809",
+      "version": "1.19.811",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.809",
+  "version": "1.19.811",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-flow.js

@@ -11,8 +11,7 @@
 const { cliClient, requireSession, arg, detectWorktreeName, cardFlagsFromMe } = require('./cli-lib');
 const { resolveProse, markShipProgress, smokeGateMessages, proseFlagPresent, regradeNotesRefusal, staleSummaryNotice } = require('./ship-honesty.js');
 const { classifyEmptyShip } = require('../../modules/lifecycle/ship-preflight');
-const { scopeForModule, isModuleKey } = require('../../src/bongos/module-scope-map');
-const { matchOne } = require('../../src/bongos/path-match');
+const { isModuleKey, scopeForModule, moduleDriftFiles: computeModuleDrift } = require('../../src/bongos/module-scope-map');
 const { runShipGate } = require('./sandbox-stage');
 const { captureSurpriseLearning, promptSurprise } = require('./ship-surprise.js');
 // task 1003109: the optional `--visual` leg of a ship (goal 1000072).
@@ -270,9 +269,18 @@ async function shipMain() {
   // ---- Module drift check (BV1.R53, task 1422) ----
   // If the task carries a module_key, verify the committed diff doesn't stray
   // into a DIFFERENT module's territory. "You said game, you touched dev-box" is
-  // the semantic violation this catches. Files outside all module scopes (docs,
-  // session logs, general scripts) are allowed — they're cross-cutting. Only
-  // contact with a DIFFERENT module's glob set is refused.
+  // the semantic violation this catches. Files no module owns are allowed —
+  // they're cross-cutting — as is the territory of a CROSS-CUTTING module, which
+  // every craft legitimately writes into. Only contact with a different OWNING
+  // module's glob set is flagged.
+  //
+  // The rule itself lives in module-scope-map.js (moduleDriftFiles) next to the
+  // map it reads, so it can be tested without running a ship (task 1003770). It
+  // used to be inline here, and read "files outside all module scopes (docs,
+  // session logs, general scripts) are allowed" — a premise task 1002989 ended by
+  // giving `methodology` the whole docs/ subtree. Since every ship writes a
+  // session log, the advisory then fired for 25 of the 26 module keys on that log
+  // alone. See CROSS_CUTTING_KEYS for why the glob was not shrunk instead.
   //
   // The check is ADVISORY (warns but does not refuse) on the first cut because
   // the module_key column is new and existing tasks may carry a broader diff scope
@@ -280,24 +288,26 @@ async function shipMain() {
   // ac.module_key comes from getActiveClaimsForBuilder (t.module_key in the join).
   const enforceModule = args.includes('--enforce-module');
   if (ac.module_key && isModuleKey(ac.module_key) && committedFiles.length > 0) {
-    const declaredScope = scopeForModule(ac.module_key);
-    const { MODULE_SCOPE_MAP } = require('../../src/bongos/module-scope-map');
-    const moduleDriftFiles = committedFiles.filter((f) => {
-      if (declaredScope && matchOne(f, declaredScope.globs)) return false;
-      for (const [key, entry] of Object.entries(MODULE_SCOPE_MAP)) {
-        if (key === ac.module_key) continue;
-        if (matchOne(f, entry.globs)) return true;
-      }
-      return false;
-    });
+    const moduleDriftFiles = computeModuleDrift(ac.module_key, committedFiles);
     if (moduleDriftFiles.length > 0) {
+      // Name the module's REAL territory rather than guessing 'modules/<key>/'.
+      // That guess is wrong for every module whose code has not been carved out
+      // yet (ADR 0083) — kernel lives in src/bongos/, methodology in docs/ — so
+      // the advisory used to tell those builders to move their work somewhere
+      // their module does not own. scopeForModule is the roster's own answer.
+      const declared = scopeForModule(ac.module_key);
+      const territory = declared && declared.globs.length
+        ? declared.globs.slice(0, 4).join(', ') + (declared.globs.length > 4 ? `, +${declared.globs.length - 4} more` : '')
+        : `modules/${ac.module_key}/`;
       const msg = [
         `\n⚠ Module drift detected: task is scoped to '${ac.module_key}' but ${moduleDriftFiles.length} file(s) touch a different module:`,
         ...moduleDriftFiles.map((f) => `  - ${f}`),
         '',
+        `  '${ac.module_key}' owns: ${territory}`,
+        '',
         enforceModule
-          ? 'Refused (--enforce-module). Confine your changes to modules/' + ac.module_key + '/ or clear the module_key label.'
-          : 'Advisory — ship proceeds, but consider confining your changes to modules/' + ac.module_key + '/.',
+          ? `Refused (--enforce-module). Confine your changes to that territory, or clear the module_key label.`
+          : 'Advisory — ship proceeds, but consider confining your changes to that territory.',
       ].join('\n');
       console.log(msg);
       if (enforceModule) process.exit(1);

package/src/bongos/module-scope-map.js

@@ -37,7 +37,7 @@
 'use strict';
 
 const { PROTECTED_GLOBS } = require('./permission-path-check');
-const { touchesOverlap } = require('./path-match');
+const { touchesOverlap, matchOne } = require('./path-match');
 
 // key → the path globs that constitute the module's code (exact paths or
 // trailing-'/' subtree prefixes). See the header for the auto-tighten contract.
@@ -486,6 +486,62 @@ function scopeIncludesProtected(keys) {
   return (keys || []).some((k) => isProtectedModule(k) === true);
 }
 
+// ---- CROSS-CUTTING MODULES (task 1003770) ----
+//
+// A module whose territory EVERY craft legitimately writes into, whatever its own
+// task is scoped to. Distinct from SHARED_GLOBS above: a shared glob is owned by
+// nobody, while a cross-cutting module genuinely owns its paths — `methodology`
+// really is the owner of docs/ — it is just that owning them cannot mean other
+// modules are trespassing when they write there.
+//
+// WHAT THIS IS AND IS NOT FOR. This narrows ONE consumer: the ship-time module-
+// drift advisory (moduleDriftFiles below), whose question is "you said game, did
+// you touch dev-box?" — module-to-module confusion. It does NOT touch the goal
+// scope wall, claim collisions (touchesOverlap), or the protected-path wall.
+// Those keep counting methodology's territory as methodology's.
+//
+// WHY IT WAS NEEDED. Task 1002989 gave `methodology` the whole docs/ subtree.
+// Since every ship writes a session log under docs/session-logs/, that made the
+// advisory fire on 25 of the 26 module keys for the session log ALONE — it warned
+// on essentially every module-keyed ship, which is not a signal, it is weather.
+//
+// WHY NOT SHRINK THE GLOB INSTEAD. The glob format has no wildcards (see the
+// header), so "all of docs/ except session-logs" is inexpressible; enumerating
+// docs/ subtree-by-subtree would rot on the next doc.
+//
+// THE BAR, deliberately high — "every task legitimately writes here as a normal
+// part of shipping". `devsecops` is NOT on this list even though it owns
+// package.json: a task that edits .github/, .husky/ or fitness.js while scoped to
+// another module IS the confusion this advisory exists to surface, and lockfile
+// churn is occasional rather than universal.
+const CROSS_CUTTING_KEYS = Object.freeze(['methodology']);
+
+function isCrossCuttingModule(key) {
+  return CROSS_CUTTING_KEYS.includes(key);
+}
+
+// Pure: of `files`, the ones that stray into a DIFFERENT module's territory for a
+// task scoped to `moduleKey`. Extracted from scripts/gds/ship-flow.js (BV1.R53,
+// task 1422) so the rule is testable without running a ship.
+//
+// A file is drift only if it is (a) outside the declared module's own globs and
+// (b) inside some OTHER module's globs — a path no module owns is cross-cutting
+// and always fine. Cross-cutting modules are skipped in (b): their territory
+// never makes a file someone else's. An unknown moduleKey yields no drift, since
+// there is no declared scope to stray from.
+function moduleDriftFiles(moduleKey, files) {
+  const declaredScope = scopeForModule(moduleKey);
+  if (!declaredScope) return [];
+  return (files || []).filter((file) => {
+    if (matchOne(file, declaredScope.globs)) return false;
+    for (const [key, entry] of Object.entries(MODULE_SCOPE_MAP)) {
+      if (key === moduleKey || isCrossCuttingModule(key)) continue;
+      if (matchOne(file, entry.globs)) return true;
+    }
+    return false;
+  });
+}
+
 module.exports = {
   MODULE_GLOBS,
   MODULE_SCOPE_MAP,
@@ -498,5 +554,6 @@ module.exports = {
   isProtectedModule,
   protectedModules,
   globsForModules,
+  moduleDriftFiles,
   scopeIncludesProtected,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.809'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.811'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cli_exit_no_abort.mjs

@@ -493,3 +493,48 @@ test('main-audit.js exits 0 after a SUCCESSFUL roster request — the teardown t
     proc.kill();
   }
 });
+
+// ---- tests/session_caps.mjs (task 1003827) ----
+//
+// Not a CLI, but the same abort and the same cure. It printed "9 passed, 0
+// failed" and then died 127 in 4 of 6 runs on Windows + Node 24. run-unit-tests.js
+// reads the exit code, so a suite that fully passed was reported FAILED in most
+// local baselines — which is worse than a plain red, because it teaches builders
+// that a failing name is environmental noise.
+const SESSION_CAPS = path.join(ROOT, 'tests', 'session_caps.mjs');
+
+test('session_caps.mjs exits 0 after its server teardown, repeatedly (task 1003827)', () => {
+  // Three runs, because the abort was NONDETERMINISTIC — a single clean run
+  // proved nothing before the fix and would prove nothing after a regression.
+  for (let i = 0; i < 3; i++) {
+    const r = spawnSync(process.execPath, [SESSION_CAPS], { encoding: 'utf8', timeout: 60000 });
+    assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — a leaked handle, which is what removing the hard exit risks`);
+    assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively:\n${r.stderr}`);
+    assert.equal(r.status, 0, `run ${i + 1} exited ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+    assert.match(r.stdout || '', /0 failed/, `run ${i + 1} did not report a passing suite`);
+  }
+});
+
+test('session_caps.mjs sets exitCode rather than calling process.exit (task 1003827)', () => {
+  // The deterministic half: the behavioural test above can pass by luck on a
+  // platform where the race does not fire, so the shape is pinned directly.
+  const src = fs.readFileSync(SESSION_CAPS, 'utf8');
+  // Comments stripped first: the fix's own comment explains what it does NOT do
+  // and names the call, so a raw scan matches the prose and reds a correct file.
+  // (Caught by this test on its first run — the guard found its own false positive.)
+  const code = src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+  // Anti-vacuity: prove the pattern MATCHES something before trusting that it
+  // matches nothing here. A scanner that silently finds nothing looks identical
+  // to a scanner that works — and stripping comments is exactly the kind of step
+  // that can blank the haystack.
+  const HARD_EXIT = /process\.exit\s*\(/;
+  assert.match('process.exit(1)', HARD_EXIT, 'control: the pattern must detect a hard exit');
+  assert.ok(src.length > 1000, 'control: the suite was actually read');
+  assert.ok(code.length > src.length / 2, 'control: stripping comments did not blank the source');
+  assert.match(code, /server\.listen/, 'control: real code survived the strip');
+  assert.doesNotMatch(code, HARD_EXIT, 'session_caps.mjs must set process.exitCode and let the loop drain');
+  assert.match(code, /process\.exitCode\s*=/, 'and it must still report failure through the exit code');
+  // The other half of the cure: a hard exit MASKS leaked handles, so dropping it
+  // without releasing the keep-alive sockets trades the crash for a hang.
+  assert.match(code, /closeAllConnections/, 'sockets must be released before server.close()');
+});

package/tests/module-scope-map.mjs

@@ -291,3 +291,99 @@ test('the gap this closed: an honest task declaring its own test is now authoriz
   const r = gsc.check(['ideas'], ['modules/ideas/inbox.js', 'tests/idea_routing.mjs'], 'thetes');
   assert.equal(r.ok, true, r.reason);
 });
+
+
+// ---- module drift advisory: cross-cutting territory (task 1003770) ----
+
+const SESSION_LOG = 'docs/session-logs/2026-09-16-task-1003770-example.md';
+
+test('THE BUG: a module-scoped task writing a session log is not drift (task 1003770)', () => {
+  // The row's own acceptance criterion. Task 1002989 gave `methodology` the whole
+  // docs/ subtree, and every ship writes a session log under it — so the advisory
+  // started firing on almost every module-keyed ship.
+  for (const key of scope.moduleKeys()) {
+    assert.deepEqual(
+      scope.moduleDriftFiles(key, [SESSION_LOG]), [],
+      `a '${key}' task writing a session log must not read as drift`,
+    );
+  }
+});
+
+test('the regression this replaces: the OLD rule flagged 25 of 26 keys on that one file', () => {
+  // Reproduce the pre-fix predicate — identical except that it does not skip
+  // cross-cutting modules — and prove it fails where the new one passes. Without
+  // this, the test above could pass for the wrong reason (e.g. nobody owning
+  // docs/) and go quietly vacuous if the glob moved again.
+  const { matchOne } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
+  const oldRule = (moduleKey, files) => {
+    const declared = scope.scopeForModule(moduleKey);
+    return files.filter((file) => {
+      if (declared && matchOne(file, declared.globs)) return false;
+      return Object.entries(scope.MODULE_SCOPE_MAP)
+        .some(([k, e]) => k !== moduleKey && matchOne(file, e.globs));
+    });
+  };
+  const flaggedBefore = scope.moduleKeys().filter((k) => oldRule(k, [SESSION_LOG]).length);
+  assert.ok(
+    flaggedBefore.length >= 20,
+    `expected the old rule to flag most keys on a session log, it flagged ${flaggedBefore.length}`,
+  );
+  assert.ok(flaggedBefore.includes('lifecycle'), 'sanity: lifecycle was among them');
+});
+
+test('a cross-cutting module owns its paths everywhere EXCEPT the drift advisory', () => {
+  // The narrowness is the point: this must not become a hole in the scope wall.
+  // methodology still genuinely owns docs/ — only moduleDriftFiles looks away.
+  // Asserted through behaviour, not through the roster constant: the constant is
+  // internal (nothing outside the module reads it), and "docs/ stops counting as
+  // someone else's territory" is the property that actually matters.
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', ['docs/architecture.md']), []);
+  assert.ok(scope.scopeForModule('methodology').globs.includes('docs/'));
+  const owners = Object.entries(scope.MODULE_SCOPE_MAP)
+    .filter(([, e]) => e.globs.includes('docs/'))
+    .map(([k]) => k);
+  assert.deepEqual(owners, ['methodology'], 'docs/ is still owned, not orphaned');
+  // And the goal scope wall still places docs/ inside methodology, unchanged.
+  assert.equal(gsc.check(['methodology'], ['docs/architecture.md'], 'thetes').ok, true);
+});
+
+test('real cross-module contact is still flagged — the signal the advisory exists for', () => {
+  // "You said lifecycle, you touched dev-box."
+  assert.deepEqual(
+    scope.moduleDriftFiles('lifecycle', ['modules/dev-box/app/src/box-controller.js']),
+    ['modules/dev-box/app/src/box-controller.js'],
+  );
+  // Its own territory, and territory no module owns, both stay quiet.
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', ['modules/lifecycle/rot.js']), []);
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', ['some/unowned/path.txt']), []);
+  // A mixed diff reports only the straying file.
+  assert.deepEqual(
+    scope.moduleDriftFiles('lifecycle', ['modules/lifecycle/rot.js', SESSION_LOG, 'modules/discord/discord-bot.js']),
+    ['modules/discord/discord-bot.js'],
+  );
+});
+
+test('devsecops is deliberately NOT cross-cutting (task 1003770)', () => {
+  // The bar is "every task legitimately writes here as part of shipping". Editing
+  // .github/ or fitness.js while scoped elsewhere IS the confusion being surfaced,
+  // so this stays a signal. Widening the cross-cutting roster to devsecops would
+  // red these, which is the point: it should take a deliberate edit, not a shrug.
+  for (const f of ['.github/workflows/unit.yml', 'scripts/gds/fitness.js', 'package.json']) {
+    assert.deepEqual(scope.moduleDriftFiles('lifecycle', [f]), [f], `${f} must still read as drift`);
+  }
+  // And exactly one module is cross-cutting: every other key's territory still
+  // counts against a lifecycle-scoped task. Proven over the whole roster rather
+  // than by naming the constant, so adding a second cross-cutting module fails here.
+  const quiet = scope.moduleKeys().filter((k) => k !== 'lifecycle'
+    && scope.moduleDriftFiles('lifecycle', scope.scopeForModule(k).globs).length === 0);
+  assert.deepEqual(quiet, ['methodology']);
+});
+
+test('moduleDriftFiles degrades safely on junk input', () => {
+  // ship-flow calls this with whatever the claim carries; it must never throw.
+  assert.deepEqual(scope.moduleDriftFiles('not-a-module', ['modules/dev-box/app.js']), [],
+    'an unknown key has no declared scope to stray from');
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', []), []);
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', null), []);
+  assert.deepEqual(scope.moduleDriftFiles(null, ['modules/dev-box/app.js']), []);
+});

package/tests/session_caps.mjs

@@ -221,6 +221,10 @@ try {
     assert.equal(fixture.upserts.length, 0);
   });
 } finally {
+  // Drop keep-alive sockets BEFORE close(). fetch()'s global agent holds them
+  // open, and server.close() only stops new connections — it waits on the live
+  // ones, so without this the process would linger instead of exiting.
+  if (typeof server.closeAllConnections === 'function') server.closeAllConnections();
   await new Promise((resolve) => server.close(resolve));
   auth.requireBuilder = orig.requireBuilder;
   db.filterTaskIdsClaimedBy = orig.filterTaskIdsClaimedBy;
@@ -235,4 +239,15 @@ await t('the audit body cap constant is exported and sane', () => {
 });
 
 console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);
+// NOT process.exit(). On Windows this suite aborted in roughly two runs of three
+// — "Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c"
+// — exiting 127 AFTER printing "9 passed, 0 failed", because the hard exit tore
+// the loop down while fetch's handles were still closing. run-unit-tests.js reads
+// the exit code, so a fully-passing suite reported FAILED in every Windows
+// baseline, which trains builders to wave off real failures as environmental.
+// Setting the code and letting the loop drain is the same cure scripts/gds/
+// CLAUDE.md documents for the CLI scripts (cliExit) and tests/cli_exit_no_abort.mjs
+// guards for api.js. The closeAllConnections() above is the other half: a hard
+// exit MASKS a leaked handle, so removing it without releasing the sockets would
+// have traded a crash for a hang.
+process.exitCode = failed === 0 ? 0 : 1;