@bongos/core 1.19.831 → 1.19.833

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.831",
-  "core_contract": "1.19.831",
-  "source_commit": "30cc1cbe10b2f1a3d1cb907ee320d18c78e23eb0",
+  "core_version": "1.19.833",
+  "core_contract": "1.19.833",
+  "source_commit": "2b0af43d93e1f2c1cce0e30cf7b2f0893b5d7e51",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T15:15:18.923Z",
+  "built_at": "2026-09-17T15:53:43.843Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 491,
+    "docs_redacted": 492,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2244,
+    "functional_verbatim": 2245,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2761,
-  "tree_sha256": "484014065f907c382c6fdbaadc2ae5bc3ff3af2f1b79a02119f7acf9d3ccd2fc",
+  "file_count": 2763,
+  "tree_sha256": "c96978c58f5f47d2eb821f10b23aa5feafd029cd7a55fa921ab7f4db9f201c21",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1984,10 +1984,15 @@
       "mode": "0000644",
       "sha256": "f52bf2568d02d5cf8589dc394dc76cbf0ea3a7ba193275f300e320c2ab64a51c"
     },
+    {
+      "path": "docs/adr/0300-a-missing-protected-surface-registry-is-a-broken-install.md",
+      "mode": "0000644",
+      "sha256": "7c5d4c49dc98d37a8a41aa0cddd158c3a46a60cdb4e79b018d68c6b5222b7e79"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "0b4e0cd78a8bd6ae3d41c0d010634dfdc29ecd4dca1f8b49127791d1b4cd7450"
+      "sha256": "8af8b8c5ea9b368bb790280eadd167b99ed9f864350e101ba18a4b0ec8f5ed5e"
     },
     {
       "path": "docs/api-reference.md",
@@ -2552,7 +2557,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "eb4a8912413adbed5f2677ea334c86aeaac50dab4acc03e618dcff866286d505"
+      "sha256": "0e95a54bd91d5d34612789b30d12a1dc5a6dc679716438727170e65d14c009b4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7182,7 +7187,7 @@
     {
       "path": "modules/security/artifact-scan/quarantine.js",
       "mode": "0000644",
-      "sha256": "9ac4695e571efdda2b991ff42d4635c9b493383733819c8c97ca93f1066220a1"
+      "sha256": "af3f54455c88b9299a1eb4132709071cf7c92707ece4a947c9e18db86db8f7f1"
     },
     {
       "path": "modules/security/artifact-scan/rebuild-spec.js",
@@ -7197,7 +7202,7 @@
     {
       "path": "modules/security/artifact-scan/sanitize.js",
       "mode": "0000644",
-      "sha256": "861abc56de494363d4420d8e5826eeda01ba6ba79f113deceea094db4d9ab6a8"
+      "sha256": "e70485e457a496bc518fc8b26dfaa0ceca1768158cfb95407668c659a6f2b24b"
     },
     {
       "path": "modules/security/migrations/security_001_tool_scans.sql",
@@ -7252,7 +7257,7 @@
     {
       "path": "modules/security/tests/mirror.mjs",
       "mode": "0000644",
-      "sha256": "b1bceda3d21897133db69f22d02fc91ed9671c536432d32959409637bfaf3bdb"
+      "sha256": "fbded0d3f137a62c9f6255297b2aa5752e0dc2a6175ce0e344d461cf59bc53b1"
     },
     {
       "path": "modules/security/tests/sanitize_rebuild.mjs",
@@ -7837,12 +7842,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9ef226bf93c85c85d63babd32469fb3a3f4a69fdf2dc94f57d80c3b54b3e9c0d"
+      "sha256": "85dfac1e9f80f5a7b407616bacbad449156497c602357254482150f7f65e8725"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3a966e21858e712dbb9e8bedc875e4bc92095f1c4489b471221e51b42d701aed"
+      "sha256": "f55eb207a04e67907fb715c75ca37cdaf74f9463389c4e2c9c19b781666cf934"
     },
     {
       "path": "public-docs/index.html",
@@ -8382,7 +8387,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "aa1a26c0b2871cd6e49b619254ce2b11d477780da8f4b037c38cb16b0ccd68fc"
+      "sha256": "42c49bcab43be3367f05b99f4dfded590edf89ae10c1a3df2d9312b6e0d33fc9"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8622,7 +8627,7 @@
     {
       "path": "scripts/gds/migration-namespace.js",
       "mode": "0000644",
-      "sha256": "f90c5e21f17cb613d86de1bad8561783d6b823f54efe2fa8dc16e909f0dbc77c"
+      "sha256": "d5a4715d0e062a2fa9aabdfa19cf668521907df421f4a3532dbfe3d26c9cab11"
     },
     {
       "path": "scripts/gds/mirror-lineage-check.js",
@@ -9592,7 +9597,7 @@
     {
       "path": "src/bongos/permission-path-check.js",
       "mode": "0000644",
-      "sha256": "14ba2ffb603cbea7d8388c196b74f8e7db92b777fb0da7c69c7d3c7c9e27f386"
+      "sha256": "75264cfa68b2a8344c38565d96d16c28e101d286ad0b5794baa83ab774269d74"
     },
     {
       "path": "src/bongos/platform-visibility-gate.js",
@@ -9762,7 +9767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0e198cb1212d9a60178cb27ffed61166f60e097d3bed2afb564c9960b10c81e7"
+      "sha256": "f98bb83cf9fd6b0cc03f1e1d69b546a9fbf79e9e63c6e9121f4e225a898e7ea8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10022,7 +10027,7 @@
     {
       "path": "tests/artifact_staleness.mjs",
       "mode": "0000644",
-      "sha256": "8eaeb56d805615a65f30a62e32dd4d180f1b61d7ac084725bc9d9bde8a1d67d5"
+      "sha256": "95156a6c54388afca8894ca6eb16d2472ede78e2ae3cf34ff00942c4551548c3"
     },
     {
       "path": "tests/artist_gate.mjs",
@@ -11377,7 +11382,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "4478853e79266130c2ad3ab7a523f0f20fb98a97e88f1dd2476ef09db6b96dcc"
+      "sha256": "1d8502e8d25eedb54ed0fcbe3ce1a0fe87495d03bd8bda7322e55d6004669a63"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -12092,7 +12097,7 @@
     {
       "path": "tests/migration_namespace.mjs",
       "mode": "0000644",
-      "sha256": "511b7b0129abc708b1cf687f1813affff522cf42e8a70bcff8839f073f566059"
+      "sha256": "42266f01d6ce88fdcdfddf45c2a11bb4599a87ea05b603d41120674900a59c95"
     },
     {
       "path": "tests/migrations_forward_safe.mjs",
@@ -12754,6 +12759,11 @@
       "mode": "0000644",
       "sha256": "aea6f9ec053bd9477288025b58ed76c166c2d59a24d7ea3481edadba90113887"
     },
+    {
+      "path": "tests/quarantine_canonical.mjs",
+      "mode": "0000644",
+      "sha256": "d8a2376c5ff96d77378626c9b4d1c32660e8412afb2531cf93085564890ffdef"
+    },
     {
       "path": "tests/rank_floor_wiring.mjs",
       "mode": "0000644",
@@ -12977,7 +12987,7 @@
     {
       "path": "tests/search_index_poller.mjs",
       "mode": "0000644",
-      "sha256": "f665d4f0a9ccfb5b92564dfda39d13d6d8ed3146cde3fe2e05bb9f9aec029558"
+      "sha256": "5015bb705395336000e60ef957a48376ad7267bfeb74e3727213684dd30632e7"
     },
     {
       "path": "tests/search_ingest.mjs",
@@ -12997,7 +13007,7 @@
     {
       "path": "tests/search_isolation.mjs",
       "mode": "0000644",
-      "sha256": "869d47dc66f8e8a9913bbb875983796225209b3abc3c360c67eaa8e4a0fd8145"
+      "sha256": "225bebacb2660252bae17dd2274aac4ad1e322348480a781ee13f6b1060714b4"
     },
     {
       "path": "tests/search_route.mjs",

package/docs/adr/0300-a-missing-protected-surface-registry-is-a-broken-install.md

@@ -0,0 +1,109 @@
+# ADR 0300 — A missing protected-surface registry is a broken install, not a module opt-out
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1003662](https://cloudbongos.com/builders#/task/1003662) (goal 1000091 — BONGOS-V2)
+
+**Related:** [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (the protected-surface boundary this registry enforces) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (core never depends on a module's behavior) · [ADR 0108](0108-instance-composition-configurable-root.md) §1 (the core is consumed as a versioned npm package, and `modules/` ships inside it)
+
+## Context
+
+[task 1003662](https://cloudbongos.com/builders#/task/1003662) was filed as a bug with a
+concrete remedy attached:
+
+> `require('./module-scope-map')` throws on any checkout where
+> `modules/government/protected-surfaces.json` is absent … This breaks any checkout that has
+> disabled or not yet materialized the government module … Make `module-scope-map.js` degrade
+> gracefully (empty protected set + a loud warning) when the government module isn't present,
+> matching the `resolveOptional` pattern used elsewhere for optional module capabilities.
+
+The throw is real and reproduces exactly as described. Moving the registry aside and requiring
+the kernel file gives:
+
+```
+protected-surface registry unreadable at <root>/modules/government/protected-surfaces.json:
+ENOENT: no such file or directory. Refusing to run with an empty protected set (ADR 0043).
+```
+
+Everything after that first sentence is wrong, in four separate ways — and the remedy it
+proposes would disable the ADR 0043 boundary on exactly the installs least able to notice.
+
+**1. The throw is not in the file the task names.** `module-scope-map.js` contains no `throw`
+and no file read. It does `require('./permission-path-check')` at line 39, and
+`permission-path-check.js`'s `loadRegistry()` throws at module scope. Any "fix" applied to the
+file in the title would be applied to the wrong file; the behavior is owned by its sibling.
+
+**2. The throw is a written contract, not an oversight.** `permission-path-check.js` states it
+in its own header, in capitals, above the code:
+
+> FAIL-CLOSED: a missing/empty/malformed registry THROWS. It never degrades to "nothing is
+> protected" — an unreadable registry is a broken install, not an opted-out module.
+
+The remedy asks for the one behavior the header names and refuses. That header also pre-answers
+the architectural worry the title gestures at (a kernel file reaching into `modules/`): the read
+is `fs`, never `require`, because ADR 0083's one-way rule forbids core from requiring a module's
+*code* — and this is not code, it is a static declarative data file. The sibling trust primitive
+`route-rank-check.js` reads `modules/*/routes/*.js` off disk the same way. Code still flows one
+way; nothing in core requires the module.
+
+**3. Disabling the government module cannot produce the ENOENT.** Module enablement is a
+runtime flag, not a file deletion — disabling a module leaves its files on disk untouched. The
+registry read never consults enablement, deliberately: per the same header, a module's
+enable/disable state must never be something the kernel depends on. So the "disabled" half of
+the premise describes a state that cannot occur.
+
+**4. The "not yet materialized" half does not occur either, because the file ships with the
+core.** `package.json` declares no `files[]` allowlist, so the whole directory ships.
+`npm pack --dry-run` on this commit puts `modules/government/protected-surfaces.json` in the
+tarball at 13,274 bytes, one of 3,419 files. Per [ADR 0108](0108-instance-composition-configurable-root.md)
+§1 the core is consumed as a versioned npm dependency and `resolveCoreRoot()` resolves the core
+package's own `modules/` inside `node_modules`. You cannot have `@bongos/core` without this
+file. If it is absent, the install is damaged — a partial extract, a lossy copy, a `.gitignore`
+that ate a JSON file — and that is a fact worth surfacing loudly, not smoothing over.
+
+**The `resolveOptional` precedent does not transfer.** `resolveOptional` is real and used in
+roughly a dozen places, but it is the module **seam/port resolver**: `api.resolveOptional('grade')`
+lets one module degrade when another module's *runtime capability* is absent, which is exactly
+right for an optional capability. A protected-surface registry is not a capability being
+resolved at a seam. It is the static data the trust boundary is made of, read synchronously from
+disk by enforcers that run where there is no server and no database — a git hook on a laptop, a
+CI job. Borrowing the seam pattern here reads as consistency, but it silently converts "the
+boundary is unreadable" into "there is no boundary".
+
+## Decision
+
+**Fail-closed stays. The registry is not optional, and a missing registry is a broken install.**
+
+Concretely:
+
+1. **No behavior change to `permission-path-check.js` or `module-scope-map.js`.** The throw is
+   correct, its placement is correct, and the header already documents why.
+2. **The task's described remedy is rejected**, on the grounds above — chiefly that an empty
+   protected set is not a degraded mode of a trust boundary, it is the absence of one.
+3. **The error message gains a remediation line.** This is the one genuine defect the report
+   surfaced: the message states the refusal and cites ADR 0043, but never tells the reader what
+   to *do*, which is precisely how a reader concludes the module must be optional and files this
+   task. It now names the likely cause and the fix.
+
+The asymmetry is the whole point. A false "nothing is protected" is silent, permanent, and
+grants authority; a false "this install is broken" is loud, immediate, and grants nothing. Only
+one of those is safe to be wrong about.
+
+## Consequences
+
+**A damaged install fails loudly at require time, and now says what to do about it.** That was
+already true of the first half; the second half is new. The reader who hits this next gets
+pointed at reinstalling the core rather than at weakening the check.
+
+**The report will recur in some form, and that is acceptable.** Anyone meeting this ENOENT
+cold sees a kernel file reaching into `modules/` and reasonably suspects a layering bug. This
+ADR is the durable answer to that suspicion, which is why it exists rather than a won't-fix
+note: the next agent to wonder can be pointed at a number.
+
+**If a legitimate need for a core-only checkout without `modules/` ever appears, this decision
+is the thing to revisit** — and the revisit is "where should the registry live", not "should it
+be optional". Relocating the canonical data into `src/` and having the government module
+contribute to it would preserve fail-closed while removing the cross-directory read. Nothing
+today needs that, and doing it speculatively would move a trust primitive for no gain.
+
+**What this does not decide:** whether other `modules/` reads from core (`route-rank-check.js`
+reading `modules/*/routes/*.js`) should follow the same rule. They share the mechanism and the
+justification, but each is its own trust surface and none is currently in question.

package/docs/adr/README.md

@@ -391,3 +391,4 @@ This keeps the decision history honest and traceable.
 | 0297 | [**A task’s creator may retire it, and that is the ownership axis’s first route** ([task 1002443](https://cloudbongos.com/builders#/task/1002443), goal 1000095 — owner request 2026-07-25: *"the creator of that task should be able to abandon that task directly inside of the UI"*). Attribution itself shipped earlier and elsewhere (`core_227`, [task 1003278](https://cloudbongos.com/builders#/task/1003278)); what had not moved is that **retiring a task was a rank power and nothing else** — `task.abandon` floors at `metic` (ADR 0152), so a sub-Metic builder could file a task and then could not withdraw their own proposal. The model already had the vocabulary and had never used it: ADR 0151 §3 defines an **ownership axis** where a `scope:'own'` key authorizes nothing until a handler supplies the row's owner, R100 made `requirePermission` refuse such a key outright so `.own` can never degrade into `.any`, and it recorded that **zero call sites passed one**. This is that axis’s first real consumer. **Decision: two authorities, only one rank-shaped** — `task.abandon` (metic, any task) OR new `task.abandon.own` (xenos, a task you created, while it is still backlog/ready/blocked). Route becomes `requireBuilder` + an in-handler decision (the `POST /goals/:id/members` shape), pin `metic+archon`→`any-builder` so it now catches an accidental **tightening** as loudly as a gate removal. **The two facts resolve in two places on purpose:** the RANK fact is request-scoped and resolves before the transaction (uncached, ADR 0016); the OWNER fact is a column that can change under us, so `created_by` joins `abandonTask`’s existing `FOR UPDATE` SELECT and a new optional `authorize` callback decides under that lock. Reading `created_by` in the route would be a TOCTOU window; resolving permissions inside the transaction would hold a row lock across a second pool acquire. The decision is a PURE module (`abandon-authz.js`, the `goal-route-authz.js` precedent) so every branch is pinned DB-free and the hall hint and server verdict provably read one rule. **A creator’s window stops at the grader** — completed/confirmed stay cross-owner, because past the grader a retire is a ledger correction, not an author changing their mind; nothing is subtracted from `task.abandon`, pinned by a test. `counterpart: ['task.abandon']` is declared not derived, verb `act` not `manage` — `manage` would silently dominate every future narrower `task.*.own` key (the verb-blind escalation task 1003195 closed). **A null creator belongs to nobody and that is load-bearing:** ~1,357 pre-`core_227` tasks plus seed/restock/discord vectors are unattributed, so the owner comparison is the government resolver’s own — injected, never re-implemented, since a duplicated ownership comparison is how one quietly widens — and one slip would open every historical task to a xenos grant at once. Fail-closed throughout: a missing `government` port, a throwing resolver, and anything but an explicit `{ok:true}` all deny, and `authorize` runs BEFORE the idempotent already-abandoned return and the shipped/active-claim guards so an unauthorized caller cannot probe a row through a 200. No guard removed. Does NOT widen edit/promote/dependency (still Metic), does not touch `task.merge`, and does not backfill attribution — the control simply does not appear on tasks predating `core_227`.](0297-a-tasks-creator-may-retire-it.md) | authority / lifecycle / ownership |
 | 0298 | [**The grader gets a reader lens: advisory, scoped to copy-bearing diffs, and it waits on a written voice** ([task 1003937](https://cloudbongos.com/builders#/task/1003937), goal 1000095 — Working area 6; owner decision 2026-09-17). Every artist review the cascade files opened with *“REVIEW THE GRADER … coach it”*, and it could not be followed: the v4 panel runs narc, quality, hacker and efficiency — completion, code quality, security, runtime cost — and not one of them reads a sentence for whether it is true, clear, in the project’s voice or worth a person’s attention. Four consecutive reviews hit the same wall and all four graded ships deservedly PASSED on the axes that were measured; the gate is not lenient, it is not pointed at this. `grader-prompt.js` already injects the craft’s written responsibility, but only when `discipline === ‘artist’`, so the unjudged case is copy shipped by someone whose craft is not the copy. **Decision: a fifth ADVISORY `reader` worker, on three settled terms.** It runs only where `modules/lifecycle/cascade.js`’s existing `hasCopyOrVisualWork` says the ship is copy-bearing — the same predicate the after-the-fact review uses, so the two can never disagree about coverage, and every other ship costs exactly what it costs today. It records `issues[]` and a `copy_score` and can never verdict `fail` or drag the panel to `concerns`, because [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md) put the artist’s judgement on the DEPLOY and off the ship path; gating would need that ADR amended first. And it is NOT BUILT until the instance writes a voice guide — today the whole written standard is one dash rule in `DESIGN.md`, a tagline, a registry of which 1,860 strings exist, and one responsibility sentence, so a lens built now would record taste and call it a finding. Until the reader exists, STEP 1 asks the artist to WRITE DOWN what the grade could not see rather than to coach a lens that is not listening — followable today, and the corpus both the guide and the lens get written from. Nothing in the rubric, the active panel or any existing worker changes.](0298-the-reader-lens-is-advisory-and-waits-on-a-voice-guide.md) | grading / the artist’s loop / voice |
 | 0299 | [**The nod queue stays scoped to routed filings; the backlog walk is the widening** ([task 1003748](https://cloudbongos.com/builders#/task/1003748), goal 1000089). `listRoutedAwaitingNod` filters `origin='route'`, and on 2026-09-08 showed 11 of 232 backlog rows. Re-measured after `/backlog-review` (task 1003746) shipped: 115 backlog rows = 109 dep-gated + 2 spikes (not a person's decision) + 1 stranded + 3 awaiting a nod, all four walked by `/backlog-review`. **Decision: do not widen the card.** The omitted population already has a walkable review with the dependency predicate any widening needed; the copy says *reported* work, so the name is honest; a card slice would be a second copy of the walk's four-bucket partition. Revisit if the un-routed nod bucket outgrows a daily walk (then a count + link, derived from the same partition) or if the walk stops being run.](0299-the-nod-queue-stays-scoped-to-routed-filings.md) | ideas / backlog / attention |
+| 0300 | [**A missing protected-surface registry is a broken install, not a module opt-out** ([task 1003662](https://cloudbongos.com/builders#/task/1003662), goal 1000091). Filed as a bug with a remedy attached: `require('./module-scope-map')` throws when `modules/government/protected-surfaces.json` is absent, so make it degrade to an empty protected set + a warning, matching `resolveOptional`. The throw reproduces, and the rest is wrong four times over. **The throw is not in the named file** — `module-scope-map.js` has no throw and no file read; it requires `permission-path-check.js`, whose `loadRegistry()` throws at module scope. **It is a written contract, not an oversight** — that file's header says FAIL-CLOSED in capitals and already pre-answers the layering worry (the read is `fs`, never `require`, so ADR 0083's one-way rule holds; static data, not code; `route-rank-check.js` reads `modules/*/routes/*.js` the same way). **Disabling the module cannot cause it** — enablement is a runtime flag, never a file deletion, and the read never consults it. **"Not yet materialized" cannot either** — no `files[]` allowlist, so `npm pack --dry-run` puts the 13,274-byte registry in the tarball; per ADR 0108 §1 you cannot have `@bongos/core` without it. The `resolveOptional` precedent does not transfer: that is the module **seam/port** resolver for a missing runtime *capability*, whereas this is the static data the boundary is made of, read where there is no server and no DB (a git hook, a CI job) — borrowing it converts "the boundary is unreadable" into "there is no boundary". **Decision: fail-closed stays, no behavior change, the remedy is rejected — and the one genuine defect is fixed: the message now names the cause and the fix** (reinstall the core; do not empty the set), because stating a refusal without a remedy is exactly how a reader concludes the module is optional and files this task. The asymmetry is the point: a false "nothing is protected" is silent, permanent and grants authority; a false "this install is broken" is loud and grants nothing. Revisit only if a core-only checkout without `modules/` becomes legitimate — and then the question is *where the registry lives*, not whether it is optional.](0300-a-missing-protected-surface-registry-is-a-broken-install.md) | governance / permissions |

package/docs/module-api-changelog.md

@@ -2136,5 +2136,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.829 with no explicit bump. run 35235005422. (task 1002620)
   1.19.831 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.830 with no explicit bump. run 35238952391. (task 1002620)
+  1.19.832 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.831 with no explicit bump. run 35240512571. (task 1002620)
+  1.19.833 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.832 with no explicit bump. run 35243115057. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/security/artifact-scan/quarantine.js

@@ -58,11 +58,123 @@ function isSyncBacked(p) {
     .some((seg) => SYNC_SEGMENTS.includes(seg.toLowerCase()));
 }
 
-// Lexical containment: is `candidate` equal to, or under, `root`? Directional on
-// purpose — path.relative escaping upward ('..') or returning an absolute path
-// both mean "outside". Used to reject a quarantine site, and by callers to keep
-// derived paths inside the pen.
+// CANONICALISE BEFORE COMPARING (task 1003848). Windows hands out 8.3 short names:
+// os.tmpdir() here returns C:\Users\GMK1_P~1\AppData\Local\Temp while other sides
+// report C:\Users\GMK1_ppl51\..., and path.resolve does not reconcile the two — so
+// a purely lexical comparison called the same directory 'outside' itself.
+//
+// fs.realpathSync.native expands 8.3; plain fs.realpathSync does NOT. That single
+// fact is the whole fix, and it is worth stating because the plain form looks like
+// it should work.
+//
+// THIS IS NOT ONLY A TEST BUG. siteRefusal below asks isInside(REPO_ROOT, site) to
+// refuse a quarantine site inside the repository. Lexically, a site spelled with a
+// short name would not match the long-form REPO_ROOT — so the refusal could be
+// evaded by spelling, on the one platform that hands out both spellings. Comparing
+// canonical paths closes that as well as the false negative in the pen check.
+//
+// Falls back to the lexical answer when a path does not exist yet, which is the
+// ordinary case for a derived path being validated BEFORE it is written: realpath
+// throws on a missing leaf, so the nearest existing ancestor is canonicalised and
+// the remainder appended.
+// MEMOISED, and that is not an optimisation detail — isInside() is called twice per
+// entry inside mirror.js's per-file loop (capped at 5,000 files), so an unmemoised
+// realpath here would put 20,000 sync syscalls on a path whose own header is explicit
+// about staying cheap. A directory cannot move under a running scan, so the answer is
+// stable for the life of the process.
+//
+// Keyed on the RESOLVED input, so the two spellings of one path — which is the entire
+// problem being solved — share an entry only after they canonicalise to the same value,
+// never before.
+const canonicalCache = new Map();
+
+function canonicalUncached(p) {
+  let abs = path.resolve(p);
+  const tail = [];
+  for (;;) {
+    try {
+      const real = fs.realpathSync.native(abs);
+      // `exact` is true only when the FULL path resolved — nothing was walked off.
+      // That is the whole cacheability test; see canonical() below.
+      return { value: path.join(real, ...tail.reverse()), exact: tail.length === 0 };
+    } catch (e) {
+      // ENOENT is the ordinary case: a derived path being validated BEFORE it is
+      // written. Walk up to the nearest ancestor that exists and re-attach the tail.
+      //
+      // ANY OTHER ERROR (EACCES, EPERM, ELOOP) used to return the raw lexical path,
+      // which silently re-opened the 8.3 gap this function exists to close — an
+      // unreadable leaf would have made a short-name spelling pass containment again.
+      // Walking up instead keeps as much canonical prefix as we can actually read, so
+      // the comparison degrades gradually rather than reverting.
+      const parent = path.dirname(abs);
+      // hit the root and found nothing real — a lexical answer, never cacheable
+      if (parent === abs) return { value: path.resolve(p), exact: false };
+      tail.push(path.basename(abs));
+      abs = parent;
+    }
+  }
+}
+
+// ONLY AN EXACT ANSWER IS CACHEABLE (task 1003848, second pass).
+//
+// The first pass cached every answer, including the provisional one computed by
+// walking up to the nearest EXISTING ancestor. That is the answer for a path being
+// validated BEFORE it is written — and it is only true until the path is written.
+// Create it as a symlink (or, on Windows, a junction) pointing out of the pen and the
+// cache keeps serving the pre-creation answer, so isInside() still calls it INSIDE and
+// the path_escape refusal is lost. That is the containment evasion this function
+// exists to close, re-opened one layer down by its own memoisation.
+//
+// Proven by control: with a warm cache isInside(pen, probed) answered true; after
+// clearCanonicalCache() the same call answered false, with nothing else changed.
+//
+// So a walked-up answer is returned and NOT stored. This keeps every bit of the
+// memoisation that mattered — mirror.js's hot loop canonicalises EXISTING directories
+// over and over, and those still resolve exactly and still cache on first touch — while
+// a path that does not exist yet is re-read each time, which is precisely when the
+// filesystem is allowed to disagree with the last answer.
+function canonical(p) {
+  const key = path.resolve(p);
+  const hit = canonicalCache.get(key);
+  if (hit !== undefined) return hit;
+  const { value, exact } = canonicalUncached(key);
+  if (exact) canonicalCache.set(key, value);
+  return value;
+}
+
+// For tests, and for a caller that genuinely needs to re-read the filesystem.
+function clearCanonicalCache() { canonicalCache.clear(); }
+
+// Containment: is `candidate` equal to, or under, `root`? Directional on purpose —
+// path.relative escaping upward ('..') or returning an absolute path both mean
+// "outside". Used to reject a quarantine site, and by callers to keep derived paths
+// inside the pen.
 function isInside(root, candidate) {
+  const rel = path.relative(canonical(root), canonical(candidate));
+  if (rel === '') return true;
+  return !rel.startsWith('..') && !path.isAbsolute(rel);
+}
+
+// LEXICAL containment — path arithmetic only, never the filesystem (task 1003848,
+// grade round 2).
+//
+// isInside() above canonicalises, which RESOLVES SYMLINKS. That is right for a
+// physical check ("where does this actually point?") and wrong for a lexical one
+// ("does this manifest path try to climb out?"). sanitize.js runs both, in that
+// order, on purpose: lexical first to reject a traversing manifest path, then
+// physical to reject a link whose target escapes, then lstat to reject a link the
+// manifest called a file — each with its own refusal message.
+//
+// Canonicalising the lexical arm collapsed those three into one: a symlink inside
+// pristine/ resolved to its target outside, so the LEXICAL arm threw "escapes the
+// pristine tree" and pre-empted the two later refusals. The artifact was still
+// refused — containment never weakened — but the diagnosis became wrong, and the
+// two tests pinning those messages failed. Those tests only run where symlinks can
+// be created, so Windows skips them and the regression is invisible off-CI.
+//
+// There is deliberately no canonical() call here: this answer must not depend on
+// what the leaf currently points at.
+function isInsideLexical(root, candidate) {
   const rel = path.relative(path.resolve(root), path.resolve(candidate));
   if (rel === '') return true;
   return !rel.startsWith('..') && !path.isAbsolute(rel);
@@ -140,6 +252,10 @@ function createQuarantine({ tmpRoot = os.tmpdir(), forbiddenRoots } = {}) {
 }
 
 module.exports = {
+  canonical,
+  isInsideLexical,
+  canonicalUncached,
+  clearCanonicalCache,
   CAPS,
   REPO_ROOT,
   createQuarantine,

package/modules/security/artifact-scan/sanitize.js

@@ -38,7 +38,7 @@ const crypto = require('node:crypto');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
 
-const { isInside } = require('./quarantine');
+const { isInside, isInsideLexical } = require('./quarantine');
 const { excerpt } = require('./detectors/shared');
 
 const SANITIZED_DIRNAME = 'sanitized';
@@ -240,8 +240,12 @@ async function buildSanitizedCopy({ pristineDir, quarantineRoot, entries, remova
       }
 
       // Confinement, same discipline as mirror.js: lexical first, then physical.
+      // isInsideLexical, NOT isInside: this arm asks whether the MANIFEST PATH climbs
+      // out, which is pure path arithmetic. isInside canonicalises and so follows a
+      // symlink to its target, which would make this arm fire for a link that escapes
+      // and pre-empt the two specific refusals below (task 1003848).
       if (typeof rel !== 'string' || rel.length === 0 || path.isAbsolute(rel)
-        || !isInside(pristineDir, path.resolve(pristineDir, ...rel.split('/')))) {
+        || !isInsideLexical(pristineDir, path.resolve(pristineDir, ...rel.split('/')))) {
         throw new Error(`Manifest path "${excerpt(String(rel), 300)}" escapes the pristine tree — refusing to build a sanitized copy over it.`);
       }
       const abs = path.resolve(pristineDir, ...rel.split('/'));

package/modules/security/tests/mirror.mjs

@@ -24,6 +24,12 @@ import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const { buildMirror, MIRROR_CAPS } = require('../artifact-scan/mirror.js');
+// Containment is asked of the module's own predicate, not of String.startsWith
+// (task 1003848). A prefix match is both too weak - '/pen-evil' starts with '/pen' -
+// and, on Windows, wrong: os.tmpdir() hands back an 8.3 short name while the built
+// path carries the long form, so the two spellings of ONE directory did not share a
+// prefix and the pen looked like it was outside itself.
+const { isInside } = require('../artifact-scan/quarantine.js');
 const fenceLocal = require('../artifact-scan/fence-local.js');
 const { scrubUntrusted, newFenceDelim, FENCE_MARKER, DANGEROUS_CHARS } = fenceLocal;
 
@@ -322,7 +328,7 @@ async function run() {
         pristineDir: pen.pristineDir, mirrorDir: pen.mirrorDir, quarantineRoot: pen.root,
         entries: [fileEntry('ok.txt', 4), fileEntry('bad.bin', 3)],
       });
-      assert.ok(res.indexPath.startsWith(pen.root), 'index lives inside the pen');
+      assert.ok(isInside(pen.root, res.indexPath), 'index lives inside the pen');
       const idx = JSON.parse(fs.readFileSync(res.indexPath, 'utf8'));
       assert.equal(idx.mirrored.length, 1);
       assert.equal(idx.stubs.length, 1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.831",
+  "version": "1.19.833",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.831",
+      "version": "1.19.833",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.831",
+  "version": "1.19.833",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -26,7 +26,7 @@ const { execFileSync } = require('node:child_process');
 const { checkRankGuards, checkModulePinKeysResolve } = require('./fitness-checks-route-pins.js'); // Checks 4 + 4b — carved out by task 1003192 (the 1,500-line ratchet)
 const genApiDocs = require('./gen-api-docs'); // R12 (#1999): reuse the route model (readsBody/validated) that drives the OpenAPI spec
 const { parseRoutineFrontmatter } = require('./run-routine'); // System 4 (ADR 0078): deterministic-routine boundary
-const { filenameViolation, stemCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
+const { filenameViolation, stemCollisions, numberCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
 const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
 
 // task 1003206 (goal 1000079): fitness.js was 2,004 lines. Four cohesive pieces now
@@ -965,13 +965,23 @@ function checkMigrationNamespacing() {
     violations.push(`migration stem "${c.stem}" is produced by more than one source (${c.files.join(', ')}) — schema_migrations is stem-keyed, so one applies and the rest are SILENTLY SKIPPED; namespace them (ADR 0108 §5).`);
   }
 
+  // Two DIFFERENT stems at one number inside ONE series (task 1003646). Not the
+  // silent-skip above — all of them apply — but migrate.sh orders by basename, so
+  // their relative order is the alphabetical accident of the slug, and a from-scratch
+  // replay can order them differently from the merge order prod applied. Renumbering an
+  // APPLIED migration re-runs it, so the fix for a new one is to renumber BEFORE it
+  // lands; the single pre-existing case is grandfathered in migration-namespace.js.
+  for (const c of numberCollisions(files)) {
+    violations.push(`migration number ${String(c.number).padStart(3, '0')} is used by ${c.files.length} different migrations in one series (${c.series}): ${c.files.join(', ')} — each was allocated max+1 from its own branch point. migrate.sh applies in BASENAME order, so their order is decided by the slug alphabetically and a fresh replay can differ from the order prod applied. Renumber the one that has NOT landed yet (renaming an applied migration re-runs it) (task 1003646).`);
+  }
+
   return {
-    name: 'migration filenames namespaced + no stem collision (ADR 0108 §5)',
+    name: 'migration filenames namespaced + no stem/number collision (ADR 0108 §5)',
     ok: violations.length === 0,
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${coreFiles.length} core + ${instFiles.length} instance + ${moduleCount} module migration file(s): new core→core_, new module→<key>_, instance bare; no cross-root stem collision.`,
+    note: `${coreFiles.length} core + ${instFiles.length} instance + ${moduleCount} module migration file(s): new core→core_, new module→<key>_, instance bare; no cross-root stem collision, and no two migrations share a number within one series.`,
   };
 }
 

package/scripts/gds/migration-namespace.js

@@ -154,6 +154,106 @@ function stemCollisions(files) {
   return out.sort((a, b) => a.stem.localeCompare(b.stem));
 }
 
+// ---- same-series number-collision detector ---------------------------------
+
+// The stem detector above catches the CROSS-source hazard (one stem, two sources →
+// migrate.sh applies one and silently skips the rest). It deliberately does not care
+// that `core_012_x` and `platform_identity_012_y` share a number: they are separate
+// allocators with separate namespaces, and the comment on lineageReport says so.
+//
+// THE GAP (task 1003646). Two DIFFERENT stems sharing a number inside ONE series is a
+// different bug, and nothing watched it. next-number.js allocates max+1 by scanning the
+// series as it stands at the caller's BRANCH POINT, so two claim sessions that branch
+// before either lands both compute the same "next". On 2026-08-28 that put three files
+// at platform_identity_012 on main. stemCollisions() returns [] for them — the stems
+// differ — so CI was green.
+//
+// WHY IT MATTERS, given nothing is skipped. migrate.sh applies in BASENAME order
+// (scripts/migrate.sh: core+instance merge-sorted by basename; modules by shell glob),
+// so a colliding pair's relative order is decided by the alphabetical accident of its
+// SLUG. On prod they applied in the order the branches merged. On a from-scratch replay
+// — a restore, a fresh instance, the CI replay guard — they apply alphabetically. When
+// those two orders differ, a rebuilt database is not the database that was built, which
+// is the exact hazard migrations/README.md names as "the one rule that has actually
+// bitten us". Nothing detects the divergence, because both databases report every
+// migration applied.
+//
+// The fix is a guard, not a renumber: renaming an applied migration changes its stem,
+// which is the schema_migrations key, so migrate.sh would see it as unapplied and RE-RUN
+// it — the same reason LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES exist above.
+// The one pre-existing collision is therefore grandfathered by name, and the guard binds
+// on everything new.
+// Keyed series/number → the exact STEMS that are exempt. Deliberately not a bare
+// series/number exemption: that would also wave through a FOURTH file landing at 012,
+// which is the very bug this detects. Only the already-applied files are forgiven, so
+// the number stays closed to anything new.
+// Seven races that already landed. Every one of these files is applied on prod, and
+// renaming an applied migration changes its schema_migrations stem, so migrate.sh would
+// see it as unapplied and RE-RUN it — the same constraint that produced
+// LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES above. They are recorded rather than
+// fixed, and the guard binds on everything new.
+//
+// These are history, not a pattern to copy: the number is the SECOND-oldest of these
+// (067) through to 2026-08-28 (platform_identity 012), i.e. the race has been happening
+// for as long as parallel claims have, which is why a keyword-free structural check is
+// worth having at all.
+const GRANDFATHERED_NUMBER_COLLISIONS = new Map([
+  ['core/(bare)/067', new Set(['067_builder_boxes', '067_discord_bot_foundation'])],
+  ['core/(bare)/176', new Set(['176_promotion_respects_open_blockers', '176_ui_discipline'])],
+  ['core/(bare)/187', new Set(['187_goal_sort_order', '187_tasks_kind_check_add_verify'])],
+  ['core/core/189', new Set(['core_189_core_upgrades_ledger', 'core_189_credit_log_task_id_index'])],
+  ['core/core/223', new Set(['core_223_blocker_resolve_respects_other_open_blockers', 'core_223_task_visual'])],
+  ['core/core/240', new Set(['core_240_artist_gate_indexes', 'core_240_goal_members_drop_legacy_role'])],
+  ['module:platform-identity/platform_identity/012', new Set([
+    // 2026-08-28, the collision task 1003646 was filed for: three parallel sessions each
+    // allocated 012 from its own branch point. Order between them does not matter — they
+    // alter three different tables (platform_identity_accounts, _projects,
+    // _builder_project_activity), so the basename-order vs merge-order divergence has
+    // nothing to bite on here.
+    'platform_identity_012_account_privacy',
+    'platform_identity_012_project_template',
+    'platform_identity_012_recent_ships',
+  ])],
+]);
+
+// Given the same flat { source, moduleKey?, basename } list stemCollisions() takes,
+// return [{ series, number, files:[…] }] for every number carrying >1 distinct stem
+// within ONE series. Grandfathered entries are omitted.
+function numberCollisions(files) {
+  const bySeriesNumber = new Map();
+  for (const f of files || []) {
+    const p = parseMigrationName(f.basename);
+    if (!p.ok) continue;
+    // A SERIES is one allocator's number space, and that is identified by the filename
+    // PREFIX, not by the directory. A renamed module keeps its historical prefix for
+    // already-applied files (RENAMED_MODULE_PREFIXES) and restarts the new prefix at 001,
+    // so modules/government/ holds governance_001…007 beside government_001…007. Those are
+    // two namespaces sharing a directory, not a race: the prefixes sort into separate
+    // contiguous blocks, so their order is fixed and identical on prod and on replay.
+    // Keying by directory would report all seven as collisions and the check would be
+    // wrong seven times before it was right once. moduleKey still participates so that two
+    // LEGACY BARE modules (game, demo) each numbering from 001 do not collide with each other.
+    const owner = f.source === 'module' ? `module:${f.moduleKey}` : f.source;
+    const series = `${owner}/${p.bare ? '(bare)' : p.prefix}`;
+    const key = `${series}/${pad3(p.number)}`;
+    if (!bySeriesNumber.has(key)) bySeriesNumber.set(key, { series, number: p.number, stems: new Map() });
+    // Keyed by STEM, so the same file counted twice is not a collision — only two
+    // genuinely different migrations at one number are.
+    bySeriesNumber.get(key).stems.set(f.basename.replace(/\.sql$/, ''), f.basename);
+  }
+  const out = [];
+  for (const [key, v] of bySeriesNumber) {
+    if (v.stems.size < 2) continue;
+    // Exempt only when EVERY stem at this number is one of the already-applied files.
+    // One unrecognised stem re-opens the whole group, because that new file is exactly
+    // what must not be allowed to sit on a taken number.
+    const allowed = GRANDFATHERED_NUMBER_COLLISIONS.get(key);
+    if (allowed && [...v.stems.keys()].every((stem) => allowed.has(stem))) continue;
+    out.push({ series: v.series, number: v.number, files: [...v.stems.values()].sort() });
+  }
+  return out.sort((a, b) => (a.series === b.series ? a.number - b.number : a.series.localeCompare(b.series)));
+}
+
 // ---- numbering / lineage (mirrors the public-mirror pattern) ---------------
 
 // next free = max + 1; empty starts at `start` (same shape as next-number.js nextFree,
@@ -207,6 +307,7 @@ module.exports = {
   migrationNumberOf,
   filenameViolation,
   stemCollisions,
+  numberCollisions,
   nextInNamespace,
   lineageReport,
 };

package/src/bongos/permission-path-check.js

@@ -73,16 +73,31 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // hook.
 const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'protected-surfaces.json');
 
+// WHY THE REFUSAL NAMES A FIX: the FAIL-CLOSED note above tells the reader what
+// this throw refuses to do, but nothing told them what to DO — and a reader who
+// meets this cold sees a core file reaching into modules/ and concludes the
+// module must be optional. That is not hypothetical: task 1003662 was filed
+// asking for exactly the degrade-to-empty-set this refuses, on that reading. The
+// registry SHIPS INSIDE @bongos/core (modules/ is in the published tarball, ADR
+// 0108 §1), so it cannot be absent on an intact install and disabling the
+// government module cannot remove it — a module's enable/disable state is a
+// runtime flag, never a file deletion. Absent therefore means the install is
+// damaged, and reinstalling is the fix. Full reasoning: ADR 0300.
+const REMEDIATION =
+  'modules/government/protected-surfaces.json ships inside @bongos/core, so an intact install always has it '
+  + '— this is a damaged install (partial extract or lossy copy), not a disabled module. Reinstall/repair the '
+  + 'core package; do NOT degrade to an empty protected set (ADR 0043, ADR 0300).';
+
 function loadRegistry(file) {
   let raw;
   try {
     raw = JSON.parse(fs.readFileSync(file, 'utf8'));
   } catch (e) {
-    throw new Error(`protected-surface registry unreadable at ${file}: ${e.message}. Refusing to run with an empty protected set (ADR 0043).`);
+    throw new Error(`protected-surface registry unreadable at ${file}: ${e.message}. Refusing to run with an empty protected set (ADR 0043). ${REMEDIATION}`);
   }
   const surfaces = Array.isArray(raw && raw.surfaces) ? raw.surfaces : null;
   if (!surfaces || surfaces.length === 0) {
-    throw new Error(`protected-surface registry ${file} declares no surfaces. Refusing to run with an empty protected set (ADR 0043).`);
+    throw new Error(`protected-surface registry ${file} declares no surfaces. Refusing to run with an empty protected set (ADR 0043). ${REMEDIATION}`);
   }
   const defaultFloor = raw.floor;
   const defaultPermission = raw.permission;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.831'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.833'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/artifact_staleness.mjs

@@ -21,6 +21,7 @@
 // Run:  node --test tests/artifact_staleness.mjs
 
 import { test } from 'node:test';
+import path from 'node:path';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 import { readFileSync, readdirSync } from 'node:fs';
@@ -123,7 +124,11 @@ test('a generator that cannot answer is UNKNOWN, never stale — it is not a fin
 
 const runFor = (byGenerator) => (cmd, args) => {
   if (cmd === 'git') return fakeGit()(cmd, args);
-  const which = String(args[0] || '').split('/').pop();
+  // path.basename, not split('/') — the checker passes an ABSOLUTE generator path,
+  // which is backslash-separated on Windows, so this returned the whole path, matched
+  // no key in byGenerator, and every generator reported `status: undefined` -> "exit
+  // undefined". Three suites carried this same idiom (task 1003848).
+  const which = path.basename(String(args[0] || ''));
   return { status: byGenerator[which], stdout: '', stderr: '' };
 };
 

package/tests/government_protected_surfaces.mjs

@@ -742,6 +742,55 @@ test('a missing registry fails CLOSED — it never degrades to "nothing is prote
   }, /unreadable|Refusing/i);
 });
 
+// The refusal text, not just the refusal. Run the kernel load in a cold subprocess
+// with a patched read and hand back stderr, so a message assertion sees what an
+// operator would actually read.
+function refusalStderr(patch) {
+  try {
+    execFileSync(process.execPath, ['-e',
+      "const fs=require('node:fs');const real=fs.readFileSync;" + patch
+      + "require('./src/bongos/permission-path-check');",
+    ], { cwd: ROOT, stdio: 'pipe' });
+  } catch (e) {
+    return String(e.stderr || '');
+  }
+  return '';
+}
+
+// WHY ASSERT ON THE WORDS (task 1003662, ADR 0300). The sibling probe above proves
+// the load REFUSES; it cannot tell whether the refusal is actionable. It was not:
+// the message stated the refusal and cited ADR 0043 but never named a fix, and a
+// reader who meets it cold sees a core file reaching into modules/ and concludes
+// the module must be optional. Task 1003662 was filed on exactly that reading,
+// asking for the degrade-to-empty-set this refuses. The remediation line is the
+// fix for that, so it is part of the contract and not decoration.
+//
+// The EMPTY-surfaces branch is covered here for the first time. Until now only the
+// unreadable branch had a probe, so `surfaces: []` — the shape an out-of-band
+// registry write most plausibly produces — could have degraded silently.
+test('both refusal branches name the fix, not just the refusal (ADR 0300)', () => {
+  const gone = refusalStderr(
+    "fs.readFileSync=(p,...r)=>{ if(String(p).includes('protected-surfaces.json')) throw new Error('gone'); return real(p,...r); };",
+  );
+  const empty = refusalStderr(
+    "fs.readFileSync=(p,...r)=>(String(p).includes('protected-surfaces.json') ? '{\"surfaces\":[]}' : real(p,...r));",
+  );
+
+  assert.match(empty, /declares no surfaces/,
+    'an empty surfaces[] must refuse too — not only an unreadable file');
+
+  for (const [name, text] of [['unreadable', gone], ['empty', empty]]) {
+    assert.match(text, /Refusing to run with an empty protected set/,
+      `the ${name} branch must still state the refusal`);
+    assert.match(text, /ships inside @bongos\/core/,
+      `the ${name} branch must say the registry ships with the core (so absent means damaged, not disabled)`);
+    assert.match(text, /[Rr]einstall/,
+      `the ${name} branch must name the action that fixes it`);
+    assert.match(text, /ADR 0300/,
+      `the ${name} branch must cite the ADR that rejected degrading to an empty set`);
+  }
+});
+
 // ---------- the matcher, driven by registry data ----------
 
 test('a known path is protected at the right floor; an unknown path is not', () => {

package/tests/migration_namespace.mjs

@@ -8,6 +8,8 @@
 //      while grandfathering the existing bare files (core ≤ 187; game/demo modules).
 //   3. stemCollisions catches the real bug: two sources sharing a schema_migrations stem.
 //   4. nextInNamespace / lineageReport count both forms so an allocator can't reuse a number.
+//   5. numberCollisions catches the SAME-SERIES race stemCollisions is blind to: two
+//      different stems on one number, which parallel claims produce (task 1003646).
 //
 // No fs/git — the helpers are pure. Run:  node tests/migration_namespace.mjs
 
@@ -150,6 +152,142 @@ t('stemCollisions: namespacing REMOVES the collision', () => {
   assert.deepEqual(ns.stemCollisions(files), []);
 });
 
+// ---- numberCollisions (task 1003646) ---------------------------------------
+// The SAME-SERIES hazard, which stemCollisions is blind to by design: two different
+// stems at one number inside one series. Nothing is skipped — but migrate.sh applies in
+// BASENAME order, so the pair's order is the alphabetical accident of its slug, and a
+// from-scratch replay can order them differently from the merge order prod applied.
+t('numberCollisions: none when each number is used once in its series', () => {
+  const files = [
+    { source: 'core', basename: 'core_188_a.sql' },
+    { source: 'core', basename: 'core_189_b.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_001_x.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the SAME number in DIFFERENT series is not a collision', () => {
+  // The deliberate tolerance lineageReport documents: separate allocators, separate
+  // namespaces, distinct stems. core_012 and economy_012 are unrelated.
+  const files = [
+    { source: 'core', basename: 'core_012_a.sql' },
+    { source: 'instance', basename: '012_b.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_c.sql' },
+    { source: 'module', moduleKey: 'ideas', basename: 'ideas_012_d.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: catches two stems at one number in ONE series (the 1003646 bug)', () => {
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_beta.sql' },
+  ];
+  const c = ns.numberCollisions(files);
+  assert.equal(c.length, 1);
+  assert.equal(c[0].series, 'module:economy/economy');
+  assert.equal(c[0].number, 12);
+  assert.deepEqual(c[0].files, ['economy_012_alpha.sql', 'economy_012_beta.sql']);
+});
+
+t('numberCollisions: stemCollisions is blind to it — the two detectors are not redundant', () => {
+  // If this ever starts failing because stemCollisions caught it, one of the two is
+  // doing the other's job and the pair should be revisited.
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_beta.sql' },
+  ];
+  assert.deepEqual(ns.stemCollisions(files), [], 'different stems — not a stem collision');
+  assert.equal(ns.numberCollisions(files).length, 1, 'but it IS a number collision');
+});
+
+t('numberCollisions: core and instance series are checked too, not just modules', () => {
+  const files = [
+    { source: 'core', basename: 'core_190_a.sql' },
+    { source: 'core', basename: 'core_190_b.sql' },
+    { source: 'instance', basename: '042_x.sql' },
+    { source: 'instance', basename: '042_y.sql' },
+  ];
+  const c = ns.numberCollisions(files);
+  assert.equal(c.length, 2);
+  assert.deepEqual(c.map((x) => x.series), ['core/core', 'instance/(bare)']);
+});
+
+t('numberCollisions: a RENAMED module\'s two prefixes are two series, not a collision', () => {
+  // modules/government/ really holds governance_001…007 beside government_001…007: the
+  // key was renamed (RENAMED_MODULE_PREFIXES, ADR 0174) and the new prefix restarted at
+  // 001, while the applied files keep the old one because the stem is the
+  // schema_migrations key. Keying a series by DIRECTORY reported all seven as collisions
+  // — the check would have been wrong seven times and right once. It is keyed by PREFIX
+  // for exactly this reason, and the prefixes sort into separate contiguous blocks
+  // (governance_ < government_), so their order is fixed on prod and on replay alike.
+  const files = [
+    { source: 'module', moduleKey: 'government', basename: 'governance_001_tables.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'government_001_rename_from_governance.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'governance_007_delegate_archon_ops_to_metic.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'government_007_amendments.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: two LEGACY BARE modules numbering from 001 do not collide', () => {
+  // game and demo both predate the <key>_ convention, so both hold a bare 001_. They are
+  // different directories and different allocators — moduleKey keeps them apart.
+  const files = [
+    { source: 'module', moduleKey: 'game', basename: '001_initial.sql' },
+    { source: 'module', moduleKey: 'demo', basename: '001_demo_pings.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the SAME file listed twice is not a collision', () => {
+  // Keyed by stem, so a double-scan of one directory cannot manufacture a violation.
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the one pre-existing collision is grandfathered', () => {
+  // platform_identity_012 x3 is applied on prod. Renaming an applied migration changes
+  // its schema_migrations stem, so migrate.sh would RE-RUN it — the same reason
+  // LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES exist. It is exempt BY NAME, so a
+  // fourth file at that number still fails.
+  const three = ['account_privacy', 'project_template', 'recent_ships'].map((s) => ({
+    source: 'module', moduleKey: 'platform-identity', basename: `platform_identity_012_${s}.sql`,
+  }));
+  assert.deepEqual(ns.numberCollisions(three), [], 'the known trio is exempt');
+
+  // The exemption names STEMS, not the number, so 012 stays CLOSED. A fourth file
+  // landing there is the bug this check exists for and must still fail — a bare
+  // series/number exemption would have waved it through.
+  const four = [...three, {
+    source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_012_new.sql',
+  }];
+  const c4 = ns.numberCollisions(four);
+  assert.equal(c4.length, 1, 'a NEW fourth file at the grandfathered number still fails');
+  assert.ok(c4[0].files.includes('platform_identity_012_new.sql'),
+    'and the new file is named in the violation');
+
+  // …but a DIFFERENT number in the same module is not exempt — the grandfather is not
+  // a blanket pass for platform-identity.
+  const other = [
+    { source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_013_a.sql' },
+    { source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_013_b.sql' },
+  ];
+  assert.equal(ns.numberCollisions(other).length, 1, '013 in the same module still fails');
+});
+
+t('numberCollisions: non-migration filenames are ignored', () => {
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'README.md' },
+    { source: 'module', moduleKey: 'economy', basename: '.keep' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
 // ---- nextInNamespace / lineageReport ---------------------------------------
 t('nextInNamespace: counts bare AND prefixed forms (no number reuse)', () => {
   assert.equal(ns.nextInNamespace(['003_a.sql', 'core_188_b.sql', 'core_190_c.sql']), 191,

package/tests/quarantine_canonical.mjs

@@ -0,0 +1,245 @@
+// tests/quarantine_canonical.mjs — containment compares WHERE a path points, not how it
+// is spelled (task 1003848).
+//
+// Windows hands out 8.3 short names: os.tmpdir() here is C:\Users\GMK1_P~1\AppData\Local\Temp
+// while the same directory reports as C:\Users\GMK1_ppl51\... elsewhere, and path.resolve
+// does not reconcile them. fs.realpathSync.native expands 8.3; plain fs.realpathSync does NOT.
+//
+// This is not only a test bug. siteRefusal() asks isInside(REPO_ROOT, site) to refuse a
+// quarantine site inside the repository — so on the one platform that hands out two
+// spellings, that refusal was evadable by spelling.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const q = require('../modules/security/artifact-scan/quarantine.js');
+
+const SHORT = os.tmpdir();
+const LONG = fs.realpathSync.native(SHORT);
+
+test('canonical expands an 8.3 short name — plain realpathSync does not', () => {
+  assert.equal(q.canonical(SHORT), LONG);
+  // The premise, stated so this test explains itself on a machine where it does not apply:
+  // if the two spellings are identical here, the rest is trivially true rather than wrong.
+  if (SHORT === LONG) return;
+  assert.notEqual(fs.realpathSync(SHORT), LONG, 'this is the fact the obvious fix gets wrong');
+});
+
+test('the two spellings of ONE directory contain each other', () => {
+  assert.equal(q.isInside(SHORT, path.join(LONG, 'x')), true);
+  assert.equal(q.isInside(LONG, path.join(SHORT, 'x')), true);
+});
+
+test('a genuinely outside path is still outside — the fix narrows nothing', () => {
+  assert.equal(q.isInside(LONG, path.resolve('/definitely/elsewhere')), false);
+  // and a sibling whose name merely starts with the root is not inside it: this is what
+  // a String.startsWith containment check gets wrong, which is how security/mirror failed.
+  assert.equal(q.isInside(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+});
+
+test('a path that does not exist yet still canonicalises via its nearest real ancestor', () => {
+  // The ordinary case: a derived destination is validated BEFORE it is written.
+  const notYet = path.join(SHORT, 'no-such-dir-1003848', 'deep', 'leaf.txt');
+  assert.equal(q.canonical(notYet), path.join(LONG, 'no-such-dir-1003848', 'deep', 'leaf.txt'));
+  assert.equal(q.isInside(SHORT, notYet), true);
+});
+
+test('a fully nonexistent absolute path degrades to the lexical answer rather than throwing', () => {
+  const nowhere = path.resolve('/no-such-root-1003848/a/b');
+  assert.equal(typeof q.canonical(nowhere), 'string');
+  assert.equal(q.isInside(path.resolve('/no-such-root-1003848'), nowhere), true);
+});
+
+test('canonical is MEMOISED for paths that EXIST — the hot-loop case', () => {
+  // mirror.js's header is explicit about staying cheap; an unmemoised realpath here would
+  // put ~20,000 sync syscalls on its 5,000-file loop.
+  //
+  // BOTH OPERANDS MUST EXIST. Only an EXACT resolution is cacheable (see canonical()):
+  // an answer reached by walking up to the nearest existing ancestor is deliberately
+  // NOT stored, because the leaf can still be created as a link that escapes. So a
+  // not-yet-existing path re-reads every call BY DESIGN, and asserting memoisation
+  // against one asserts the opposite of the rule.
+  //
+  // The first version of this test used <tmpdir>/x and passed only because a stray
+  // file of that name happened to exist on the author's box; on CI it did not, the
+  // walk-up path was taken, and 50 iterations cost ~100 syscalls instead of 2.
+  const dir = fs.mkdtempSync(path.join(LONG, 'memo-'));
+  try {
+    q.clearCanonicalCache();
+    const orig = fs.realpathSync.native;
+    let calls = 0;
+    fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+    try {
+      for (let i = 0; i < 50; i += 1) q.isInside(SHORT, dir);
+    } finally {
+      fs.realpathSync.native = orig;
+    }
+    assert.ok(calls <= 4, `50 containment checks over existing paths should not cost ${calls} realpath syscalls`);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('a path that does NOT exist is re-read every time — the cache must not answer for it', () => {
+  // The companion rule, and a security property rather than a performance one: a
+  // walked-up answer is provisional. Cache it and creating the leaf as an escaping
+  // link would keep serving "inside" forever. Pinning it here stops a future
+  // optimisation from caching provisional answers to make the test above cheaper.
+  const notYet = path.join(LONG, 'no-such-memo-1003848', 'leaf');
+  q.clearCanonicalCache();
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try {
+    q.canonical(notYet);
+    q.canonical(notYet);
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.ok(calls >= 4, `two lookups of a non-existent path must both hit the filesystem, saw ${calls}`);
+});
+
+test('a path that does NOT exist yet is never cached — the escape must stay visible', () => {
+  // THE SECURITY PROPERTY, and the one the first pass of this fix got wrong.
+  //
+  // A derived destination is canonicalised BEFORE it is written, so its answer comes from
+  // walking up to the nearest existing ancestor. That answer is true only until the path
+  // is written. Cache it and the window never closes: create the path as a symlink (a
+  // junction on Windows) pointing out of the pen and isInside() keeps returning the
+  // pre-creation verdict — INSIDE — so mirror.js's path_escape refusal is silently lost.
+  // The containment check this file exists to harden is then evadable one layer down, by
+  // its own memoisation.
+  //
+  // Asserted as the MECHANISM rather than by building a symlink, deliberately: creating
+  // one needs privileges this suite does not have on Windows, so a symlink-shaped test
+  // would skip on the very platform whose 8.3 spellings motivated the whole change. The
+  // mechanism is platform-free — a missing path must cost a fresh filesystem read every
+  // time — and modules/security/tests/mirror.mjs covers the real symlink end-to-end
+  // wherever symlinks can be made.
+  q.clearCanonicalCache();
+  const missing = path.join(SHORT, 'not-written-yet-1003848', 'leaf.txt');
+
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p2) => { calls += 1; return orig(p2); };
+  try {
+    q.canonical(missing);
+    const afterFirst = calls;
+    q.canonical(missing);
+    assert.ok(calls > afterFirst,
+      'a non-existent path must be re-read, not served from cache — otherwise a symlink '
+      + 'created there afterwards keeps the stale INSIDE verdict');
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+});
+
+test('an EXISTING directory is still cached — the fix keeps the memoisation that mattered', () => {
+  // The counterweight to the test above: mirror.js's hot loop canonicalises real
+  // directories over and over, and those answers are stable (a directory cannot move
+  // under a running scan). Only the provisional ones are re-read.
+  q.clearCanonicalCache();
+  q.canonical(SHORT);
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p2) => { calls += 1; return orig(p2); };
+  try {
+    for (let i = 0; i < 20; i += 1) q.canonical(SHORT);
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.equal(calls, 0, 'an existing directory resolved once must not be resolved again');
+});
+
+test('clearing the cache makes it read the filesystem again', () => {
+  q.clearCanonicalCache();
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try { q.canonical(SHORT); } finally { fs.realpathSync.native = orig; }
+  assert.ok(calls >= 1, 'a cleared cache must not keep answering from memory');
+});
+
+// ---------------------------------------------------------------------------
+// LEXICAL vs PHYSICAL containment (task 1003848, grade round 2).
+//
+// sanitize.js runs three confinement arms in order, each with its own refusal:
+// lexical (does the manifest path climb out?), then physical (does it RESOLVE
+// out?), then lstat (is it a link the manifest called a file?). Canonicalising
+// the lexical arm made it follow the link and fire first, pre-empting the other
+// two — the artifact was still refused, but with the wrong diagnosis, and the two
+// tests pinning those messages went red.
+//
+// The existing cases live in modules/security/tests/sanitize_rebuild.mjs and are
+// SKIPPED wherever symlinks cannot be created — which is this platform, so that
+// regression was invisible locally and only CI saw it. This case therefore falls
+// back to a DIRECTORY JUNCTION, which Windows allows without elevation, so the
+// divergence is pinned on both platforms.
+// ---------------------------------------------------------------------------
+
+const linkKind = (() => {
+  const probe = fs.mkdtempSync(path.join(os.tmpdir(), 'linkprobe-'));
+  const target = fs.mkdtempSync(path.join(os.tmpdir(), 'linktarget-'));
+  try {
+    for (const kind of ['dir', 'junction']) {
+      try { fs.symlinkSync(target, path.join(probe, `l-${kind}`), kind); return kind; }
+      catch { /* try the next form */ }
+    }
+    return null;
+  } finally {
+    fs.rmSync(probe, { recursive: true, force: true });
+    fs.rmSync(target, { recursive: true, force: true });
+  }
+})();
+
+test('a link that escapes is LEXICALLY inside but PHYSICALLY outside', { skip: linkKind ? false : 'this platform cannot create links' }, () => {
+  const pen = fs.mkdtempSync(path.join(os.tmpdir(), 'pen-'));
+  const pristine = path.join(pen, 'pristine');
+  fs.mkdirSync(pristine);
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'outside-'));
+  try {
+    const link = path.join(pristine, 'escape');
+    fs.symlinkSync(outside, link, linkKind);
+    q.clearCanonicalCache();
+
+    // The lexical arm must NOT fire: nothing in the SPELLING of this path climbs
+    // out. If it fired, sanitize.js would report "escapes the pristine tree" and
+    // never reach the two refusals that describe what is actually wrong.
+    assert.equal(q.isInsideLexical(pristine, link), true);
+
+    // The physical arm is what catches it — this is the containment that matters.
+    assert.equal(q.isInside(pristine, link), false);
+  } finally {
+    fs.rmSync(pen, { recursive: true, force: true });
+    fs.rmSync(outside, { recursive: true, force: true });
+  }
+});
+
+test('on ordinary paths the two predicates agree — the split narrows nothing', () => {
+  const inside = path.join(LONG, 'a', 'b');
+  assert.equal(q.isInsideLexical(LONG, inside), q.isInside(LONG, inside));
+  assert.equal(q.isInsideLexical(LONG, inside), true);
+  const climbs = path.join(LONG, '..', 'elsewhere');
+  assert.equal(q.isInsideLexical(LONG, climbs), false);
+  assert.equal(q.isInside(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+  assert.equal(q.isInsideLexical(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+});
+
+test('the lexical predicate never touches the filesystem', () => {
+  // The whole point: its answer must not depend on what the leaf points at right
+  // now. A realpath call here would reintroduce exactly the coupling being removed.
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try {
+    q.isInsideLexical(LONG, path.join(LONG, 'whatever', 'deep.txt'));
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.equal(calls, 0, 'isInsideLexical must be pure path arithmetic');
+});

package/tests/search_index_poller.mjs

@@ -13,6 +13,7 @@
 // Run:  node tests/search_index_poller.mjs
 
 import { strict as assert } from 'node:assert';
+import path from 'node:path';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
@@ -104,7 +105,11 @@ function fakePool(seq) {
 await test('the sweep runs BOTH ingesters — one failing must not skip the other', async () => {
   const called = [];
   const exec = (_p, args, _o, cb) => {
-    called.push(args[0].split('/').pop());
+    // path.basename, not split('/') — the sweep passes an ABSOLUTE path, and on
+    // Windows that is backslash-separated, so splitting on a forward slash returned
+    // the whole path and this assertion compared a path against a basename (task
+    // 1003848). The production code was never wrong; the test helper was.
+    called.push(path.basename(args[0]));
     cb(args[0].includes('md') ? Object.assign(new Error('x'), { code: 1 }) : null, '', 'boom');
   };
   const r = await sweep({ pool: fakePool([{ chunks: 0, last: null }]), log: quietLog, execFileImpl: exec, now: NOW });

package/tests/search_isolation.mjs

@@ -161,6 +161,14 @@ const client = await dbReachable();
 if (!client) {
   console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / on a dev box.');
   console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
+  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
+  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
+  // still closing from its failed connect — and the process.exit() at the bottom of
+  // this file then tore down the loop underneath them. On Windows that surfaces as
+  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
+  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
+  // a failing suite in the unit gate while every assertion actually passed.
+  if (pool) await pool.end().catch(() => {});
 } else {
   try {
     await client.query('BEGIN');
@@ -204,4 +212,11 @@ if (!client) {
 }
 
 console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);
+// EXIT CODE, NOT process.exit() (task 1003848). A hard exit tears the event loop down
+// underneath any handle that is still closing — and pg leaves one behind after a
+// FAILED connect, which is exactly the skip path. On Windows that surfaced as
+// `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`
+// and exit 0xC0000409 AFTER "5 passed, 0 failed" — a process-teardown crash that the
+// unit gate can only read as a failing suite. Setting exitCode lets node drain the
+// handles and then exit with the same status.
+process.exitCode = failed === 0 ? 0 : 1;