@bongos/core 1.19.832 → 1.19.833

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.832",
-  "core_contract": "1.19.832",
-  "source_commit": "c8e1d760c29ed41a5d66af6b1c4f9936a7fd0f32",
+  "core_version": "1.19.833",
+  "core_contract": "1.19.833",
+  "source_commit": "2b0af43d93e1f2c1cce0e30cf7b2f0893b5d7e51",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T15:29:22.894Z",
+  "built_at": "2026-09-17T15:53:43.843Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 492,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2244,
+    "functional_verbatim": 2245,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2762,
-  "tree_sha256": "0795b0e4670053ed5c638dac4719252988b0dbfd0d863dafef3df5b466a11f45",
+  "file_count": 2763,
+  "tree_sha256": "c96978c58f5f47d2eb821f10b23aa5feafd029cd7a55fa921ab7f4db9f201c21",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2557,7 +2557,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "02d7156a9ee2a022e71835b03c120059c44b36cf9358085bf2c2d1fb91a72bd4"
+      "sha256": "0e95a54bd91d5d34612789b30d12a1dc5a6dc679716438727170e65d14c009b4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7187,7 +7187,7 @@
     {
       "path": "modules/security/artifact-scan/quarantine.js",
       "mode": "0000644",
-      "sha256": "9ac4695e571efdda2b991ff42d4635c9b493383733819c8c97ca93f1066220a1"
+      "sha256": "af3f54455c88b9299a1eb4132709071cf7c92707ece4a947c9e18db86db8f7f1"
     },
     {
       "path": "modules/security/artifact-scan/rebuild-spec.js",
@@ -7202,7 +7202,7 @@
     {
       "path": "modules/security/artifact-scan/sanitize.js",
       "mode": "0000644",
-      "sha256": "861abc56de494363d4420d8e5826eeda01ba6ba79f113deceea094db4d9ab6a8"
+      "sha256": "e70485e457a496bc518fc8b26dfaa0ceca1768158cfb95407668c659a6f2b24b"
     },
     {
       "path": "modules/security/migrations/security_001_tool_scans.sql",
@@ -7257,7 +7257,7 @@
     {
       "path": "modules/security/tests/mirror.mjs",
       "mode": "0000644",
-      "sha256": "b1bceda3d21897133db69f22d02fc91ed9671c536432d32959409637bfaf3bdb"
+      "sha256": "fbded0d3f137a62c9f6255297b2aa5752e0dc2a6175ce0e344d461cf59bc53b1"
     },
     {
       "path": "modules/security/tests/sanitize_rebuild.mjs",
@@ -7842,12 +7842,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f833d910fdbed07c2c2a6a1597d5d6315780e4633c6015bde77629b7682f8c8d"
+      "sha256": "85dfac1e9f80f5a7b407616bacbad449156497c602357254482150f7f65e8725"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6fd9cd7067b463895344e6de0710ce6eda471f96d659161c56f9ce3cc9c0edb1"
+      "sha256": "f55eb207a04e67907fb715c75ca37cdaf74f9463389c4e2c9c19b781666cf934"
     },
     {
       "path": "public-docs/index.html",
@@ -8387,7 +8387,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "aa1a26c0b2871cd6e49b619254ce2b11d477780da8f4b037c38cb16b0ccd68fc"
+      "sha256": "42c49bcab43be3367f05b99f4dfded590edf89ae10c1a3df2d9312b6e0d33fc9"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8627,7 +8627,7 @@
     {
       "path": "scripts/gds/migration-namespace.js",
       "mode": "0000644",
-      "sha256": "f90c5e21f17cb613d86de1bad8561783d6b823f54efe2fa8dc16e909f0dbc77c"
+      "sha256": "d5a4715d0e062a2fa9aabdfa19cf668521907df421f4a3532dbfe3d26c9cab11"
     },
     {
       "path": "scripts/gds/mirror-lineage-check.js",
@@ -9767,7 +9767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8e0d57c0e24d78b95565b3c81fdae6ca50647ad6f84ea337eed213109594056e"
+      "sha256": "f98bb83cf9fd6b0cc03f1e1d69b546a9fbf79e9e63c6e9121f4e225a898e7ea8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10027,7 +10027,7 @@
     {
       "path": "tests/artifact_staleness.mjs",
       "mode": "0000644",
-      "sha256": "8eaeb56d805615a65f30a62e32dd4d180f1b61d7ac084725bc9d9bde8a1d67d5"
+      "sha256": "95156a6c54388afca8894ca6eb16d2472ede78e2ae3cf34ff00942c4551548c3"
     },
     {
       "path": "tests/artist_gate.mjs",
@@ -12097,7 +12097,7 @@
     {
       "path": "tests/migration_namespace.mjs",
       "mode": "0000644",
-      "sha256": "511b7b0129abc708b1cf687f1813affff522cf42e8a70bcff8839f073f566059"
+      "sha256": "42266f01d6ce88fdcdfddf45c2a11bb4599a87ea05b603d41120674900a59c95"
     },
     {
       "path": "tests/migrations_forward_safe.mjs",
@@ -12759,6 +12759,11 @@
       "mode": "0000644",
       "sha256": "aea6f9ec053bd9477288025b58ed76c166c2d59a24d7ea3481edadba90113887"
     },
+    {
+      "path": "tests/quarantine_canonical.mjs",
+      "mode": "0000644",
+      "sha256": "d8a2376c5ff96d77378626c9b4d1c32660e8412afb2531cf93085564890ffdef"
+    },
     {
       "path": "tests/rank_floor_wiring.mjs",
       "mode": "0000644",
@@ -12982,7 +12987,7 @@
     {
       "path": "tests/search_index_poller.mjs",
       "mode": "0000644",
-      "sha256": "f665d4f0a9ccfb5b92564dfda39d13d6d8ed3146cde3fe2e05bb9f9aec029558"
+      "sha256": "5015bb705395336000e60ef957a48376ad7267bfeb74e3727213684dd30632e7"
     },
     {
       "path": "tests/search_ingest.mjs",
@@ -13002,7 +13007,7 @@
     {
       "path": "tests/search_isolation.mjs",
       "mode": "0000644",
-      "sha256": "869d47dc66f8e8a9913bbb875983796225209b3abc3c360c67eaa8e4a0fd8145"
+      "sha256": "225bebacb2660252bae17dd2274aac4ad1e322348480a781ee13f6b1060714b4"
     },
     {
       "path": "tests/search_route.mjs",

package/docs/module-api-changelog.md

@@ -2138,5 +2138,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.830 with no explicit bump. run 35238952391. (task 1002620)
   1.19.832 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.831 with no explicit bump. run 35240512571. (task 1002620)
+  1.19.833 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.832 with no explicit bump. run 35243115057. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/security/artifact-scan/quarantine.js

@@ -58,11 +58,123 @@ function isSyncBacked(p) {
     .some((seg) => SYNC_SEGMENTS.includes(seg.toLowerCase()));
 }
 
-// Lexical containment: is `candidate` equal to, or under, `root`? Directional on
-// purpose — path.relative escaping upward ('..') or returning an absolute path
-// both mean "outside". Used to reject a quarantine site, and by callers to keep
-// derived paths inside the pen.
+// CANONICALISE BEFORE COMPARING (task 1003848). Windows hands out 8.3 short names:
+// os.tmpdir() here returns C:\Users\GMK1_P~1\AppData\Local\Temp while other sides
+// report C:\Users\GMK1_ppl51\..., and path.resolve does not reconcile the two — so
+// a purely lexical comparison called the same directory 'outside' itself.
+//
+// fs.realpathSync.native expands 8.3; plain fs.realpathSync does NOT. That single
+// fact is the whole fix, and it is worth stating because the plain form looks like
+// it should work.
+//
+// THIS IS NOT ONLY A TEST BUG. siteRefusal below asks isInside(REPO_ROOT, site) to
+// refuse a quarantine site inside the repository. Lexically, a site spelled with a
+// short name would not match the long-form REPO_ROOT — so the refusal could be
+// evaded by spelling, on the one platform that hands out both spellings. Comparing
+// canonical paths closes that as well as the false negative in the pen check.
+//
+// Falls back to the lexical answer when a path does not exist yet, which is the
+// ordinary case for a derived path being validated BEFORE it is written: realpath
+// throws on a missing leaf, so the nearest existing ancestor is canonicalised and
+// the remainder appended.
+// MEMOISED, and that is not an optimisation detail — isInside() is called twice per
+// entry inside mirror.js's per-file loop (capped at 5,000 files), so an unmemoised
+// realpath here would put 20,000 sync syscalls on a path whose own header is explicit
+// about staying cheap. A directory cannot move under a running scan, so the answer is
+// stable for the life of the process.
+//
+// Keyed on the RESOLVED input, so the two spellings of one path — which is the entire
+// problem being solved — share an entry only after they canonicalise to the same value,
+// never before.
+const canonicalCache = new Map();
+
+function canonicalUncached(p) {
+  let abs = path.resolve(p);
+  const tail = [];
+  for (;;) {
+    try {
+      const real = fs.realpathSync.native(abs);
+      // `exact` is true only when the FULL path resolved — nothing was walked off.
+      // That is the whole cacheability test; see canonical() below.
+      return { value: path.join(real, ...tail.reverse()), exact: tail.length === 0 };
+    } catch (e) {
+      // ENOENT is the ordinary case: a derived path being validated BEFORE it is
+      // written. Walk up to the nearest ancestor that exists and re-attach the tail.
+      //
+      // ANY OTHER ERROR (EACCES, EPERM, ELOOP) used to return the raw lexical path,
+      // which silently re-opened the 8.3 gap this function exists to close — an
+      // unreadable leaf would have made a short-name spelling pass containment again.
+      // Walking up instead keeps as much canonical prefix as we can actually read, so
+      // the comparison degrades gradually rather than reverting.
+      const parent = path.dirname(abs);
+      // hit the root and found nothing real — a lexical answer, never cacheable
+      if (parent === abs) return { value: path.resolve(p), exact: false };
+      tail.push(path.basename(abs));
+      abs = parent;
+    }
+  }
+}
+
+// ONLY AN EXACT ANSWER IS CACHEABLE (task 1003848, second pass).
+//
+// The first pass cached every answer, including the provisional one computed by
+// walking up to the nearest EXISTING ancestor. That is the answer for a path being
+// validated BEFORE it is written — and it is only true until the path is written.
+// Create it as a symlink (or, on Windows, a junction) pointing out of the pen and the
+// cache keeps serving the pre-creation answer, so isInside() still calls it INSIDE and
+// the path_escape refusal is lost. That is the containment evasion this function
+// exists to close, re-opened one layer down by its own memoisation.
+//
+// Proven by control: with a warm cache isInside(pen, probed) answered true; after
+// clearCanonicalCache() the same call answered false, with nothing else changed.
+//
+// So a walked-up answer is returned and NOT stored. This keeps every bit of the
+// memoisation that mattered — mirror.js's hot loop canonicalises EXISTING directories
+// over and over, and those still resolve exactly and still cache on first touch — while
+// a path that does not exist yet is re-read each time, which is precisely when the
+// filesystem is allowed to disagree with the last answer.
+function canonical(p) {
+  const key = path.resolve(p);
+  const hit = canonicalCache.get(key);
+  if (hit !== undefined) return hit;
+  const { value, exact } = canonicalUncached(key);
+  if (exact) canonicalCache.set(key, value);
+  return value;
+}
+
+// For tests, and for a caller that genuinely needs to re-read the filesystem.
+function clearCanonicalCache() { canonicalCache.clear(); }
+
+// Containment: is `candidate` equal to, or under, `root`? Directional on purpose —
+// path.relative escaping upward ('..') or returning an absolute path both mean
+// "outside". Used to reject a quarantine site, and by callers to keep derived paths
+// inside the pen.
 function isInside(root, candidate) {
+  const rel = path.relative(canonical(root), canonical(candidate));
+  if (rel === '') return true;
+  return !rel.startsWith('..') && !path.isAbsolute(rel);
+}
+
+// LEXICAL containment — path arithmetic only, never the filesystem (task 1003848,
+// grade round 2).
+//
+// isInside() above canonicalises, which RESOLVES SYMLINKS. That is right for a
+// physical check ("where does this actually point?") and wrong for a lexical one
+// ("does this manifest path try to climb out?"). sanitize.js runs both, in that
+// order, on purpose: lexical first to reject a traversing manifest path, then
+// physical to reject a link whose target escapes, then lstat to reject a link the
+// manifest called a file — each with its own refusal message.
+//
+// Canonicalising the lexical arm collapsed those three into one: a symlink inside
+// pristine/ resolved to its target outside, so the LEXICAL arm threw "escapes the
+// pristine tree" and pre-empted the two later refusals. The artifact was still
+// refused — containment never weakened — but the diagnosis became wrong, and the
+// two tests pinning those messages failed. Those tests only run where symlinks can
+// be created, so Windows skips them and the regression is invisible off-CI.
+//
+// There is deliberately no canonical() call here: this answer must not depend on
+// what the leaf currently points at.
+function isInsideLexical(root, candidate) {
   const rel = path.relative(path.resolve(root), path.resolve(candidate));
   if (rel === '') return true;
   return !rel.startsWith('..') && !path.isAbsolute(rel);
@@ -140,6 +252,10 @@ function createQuarantine({ tmpRoot = os.tmpdir(), forbiddenRoots } = {}) {
 }
 
 module.exports = {
+  canonical,
+  isInsideLexical,
+  canonicalUncached,
+  clearCanonicalCache,
   CAPS,
   REPO_ROOT,
   createQuarantine,

package/modules/security/artifact-scan/sanitize.js

@@ -38,7 +38,7 @@ const crypto = require('node:crypto');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
 
-const { isInside } = require('./quarantine');
+const { isInside, isInsideLexical } = require('./quarantine');
 const { excerpt } = require('./detectors/shared');
 
 const SANITIZED_DIRNAME = 'sanitized';
@@ -240,8 +240,12 @@ async function buildSanitizedCopy({ pristineDir, quarantineRoot, entries, remova
       }
 
       // Confinement, same discipline as mirror.js: lexical first, then physical.
+      // isInsideLexical, NOT isInside: this arm asks whether the MANIFEST PATH climbs
+      // out, which is pure path arithmetic. isInside canonicalises and so follows a
+      // symlink to its target, which would make this arm fire for a link that escapes
+      // and pre-empt the two specific refusals below (task 1003848).
       if (typeof rel !== 'string' || rel.length === 0 || path.isAbsolute(rel)
-        || !isInside(pristineDir, path.resolve(pristineDir, ...rel.split('/')))) {
+        || !isInsideLexical(pristineDir, path.resolve(pristineDir, ...rel.split('/')))) {
         throw new Error(`Manifest path "${excerpt(String(rel), 300)}" escapes the pristine tree — refusing to build a sanitized copy over it.`);
       }
       const abs = path.resolve(pristineDir, ...rel.split('/'));

package/modules/security/tests/mirror.mjs

@@ -24,6 +24,12 @@ import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const { buildMirror, MIRROR_CAPS } = require('../artifact-scan/mirror.js');
+// Containment is asked of the module's own predicate, not of String.startsWith
+// (task 1003848). A prefix match is both too weak - '/pen-evil' starts with '/pen' -
+// and, on Windows, wrong: os.tmpdir() hands back an 8.3 short name while the built
+// path carries the long form, so the two spellings of ONE directory did not share a
+// prefix and the pen looked like it was outside itself.
+const { isInside } = require('../artifact-scan/quarantine.js');
 const fenceLocal = require('../artifact-scan/fence-local.js');
 const { scrubUntrusted, newFenceDelim, FENCE_MARKER, DANGEROUS_CHARS } = fenceLocal;
 
@@ -322,7 +328,7 @@ async function run() {
         pristineDir: pen.pristineDir, mirrorDir: pen.mirrorDir, quarantineRoot: pen.root,
         entries: [fileEntry('ok.txt', 4), fileEntry('bad.bin', 3)],
       });
-      assert.ok(res.indexPath.startsWith(pen.root), 'index lives inside the pen');
+      assert.ok(isInside(pen.root, res.indexPath), 'index lives inside the pen');
       const idx = JSON.parse(fs.readFileSync(res.indexPath, 'utf8'));
       assert.equal(idx.mirrored.length, 1);
       assert.equal(idx.stubs.length, 1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.832",
+  "version": "1.19.833",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.832",
+      "version": "1.19.833",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.832",
+  "version": "1.19.833",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -26,7 +26,7 @@ const { execFileSync } = require('node:child_process');
 const { checkRankGuards, checkModulePinKeysResolve } = require('./fitness-checks-route-pins.js'); // Checks 4 + 4b — carved out by task 1003192 (the 1,500-line ratchet)
 const genApiDocs = require('./gen-api-docs'); // R12 (#1999): reuse the route model (readsBody/validated) that drives the OpenAPI spec
 const { parseRoutineFrontmatter } = require('./run-routine'); // System 4 (ADR 0078): deterministic-routine boundary
-const { filenameViolation, stemCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
+const { filenameViolation, stemCollisions, numberCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
 const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
 
 // task 1003206 (goal 1000079): fitness.js was 2,004 lines. Four cohesive pieces now
@@ -965,13 +965,23 @@ function checkMigrationNamespacing() {
     violations.push(`migration stem "${c.stem}" is produced by more than one source (${c.files.join(', ')}) — schema_migrations is stem-keyed, so one applies and the rest are SILENTLY SKIPPED; namespace them (ADR 0108 §5).`);
   }
 
+  // Two DIFFERENT stems at one number inside ONE series (task 1003646). Not the
+  // silent-skip above — all of them apply — but migrate.sh orders by basename, so
+  // their relative order is the alphabetical accident of the slug, and a from-scratch
+  // replay can order them differently from the merge order prod applied. Renumbering an
+  // APPLIED migration re-runs it, so the fix for a new one is to renumber BEFORE it
+  // lands; the single pre-existing case is grandfathered in migration-namespace.js.
+  for (const c of numberCollisions(files)) {
+    violations.push(`migration number ${String(c.number).padStart(3, '0')} is used by ${c.files.length} different migrations in one series (${c.series}): ${c.files.join(', ')} — each was allocated max+1 from its own branch point. migrate.sh applies in BASENAME order, so their order is decided by the slug alphabetically and a fresh replay can differ from the order prod applied. Renumber the one that has NOT landed yet (renaming an applied migration re-runs it) (task 1003646).`);
+  }
+
   return {
-    name: 'migration filenames namespaced + no stem collision (ADR 0108 §5)',
+    name: 'migration filenames namespaced + no stem/number collision (ADR 0108 §5)',
     ok: violations.length === 0,
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${coreFiles.length} core + ${instFiles.length} instance + ${moduleCount} module migration file(s): new core→core_, new module→<key>_, instance bare; no cross-root stem collision.`,
+    note: `${coreFiles.length} core + ${instFiles.length} instance + ${moduleCount} module migration file(s): new core→core_, new module→<key>_, instance bare; no cross-root stem collision, and no two migrations share a number within one series.`,
   };
 }
 

package/scripts/gds/migration-namespace.js

@@ -154,6 +154,106 @@ function stemCollisions(files) {
   return out.sort((a, b) => a.stem.localeCompare(b.stem));
 }
 
+// ---- same-series number-collision detector ---------------------------------
+
+// The stem detector above catches the CROSS-source hazard (one stem, two sources →
+// migrate.sh applies one and silently skips the rest). It deliberately does not care
+// that `core_012_x` and `platform_identity_012_y` share a number: they are separate
+// allocators with separate namespaces, and the comment on lineageReport says so.
+//
+// THE GAP (task 1003646). Two DIFFERENT stems sharing a number inside ONE series is a
+// different bug, and nothing watched it. next-number.js allocates max+1 by scanning the
+// series as it stands at the caller's BRANCH POINT, so two claim sessions that branch
+// before either lands both compute the same "next". On 2026-08-28 that put three files
+// at platform_identity_012 on main. stemCollisions() returns [] for them — the stems
+// differ — so CI was green.
+//
+// WHY IT MATTERS, given nothing is skipped. migrate.sh applies in BASENAME order
+// (scripts/migrate.sh: core+instance merge-sorted by basename; modules by shell glob),
+// so a colliding pair's relative order is decided by the alphabetical accident of its
+// SLUG. On prod they applied in the order the branches merged. On a from-scratch replay
+// — a restore, a fresh instance, the CI replay guard — they apply alphabetically. When
+// those two orders differ, a rebuilt database is not the database that was built, which
+// is the exact hazard migrations/README.md names as "the one rule that has actually
+// bitten us". Nothing detects the divergence, because both databases report every
+// migration applied.
+//
+// The fix is a guard, not a renumber: renaming an applied migration changes its stem,
+// which is the schema_migrations key, so migrate.sh would see it as unapplied and RE-RUN
+// it — the same reason LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES exist above.
+// The one pre-existing collision is therefore grandfathered by name, and the guard binds
+// on everything new.
+// Keyed series/number → the exact STEMS that are exempt. Deliberately not a bare
+// series/number exemption: that would also wave through a FOURTH file landing at 012,
+// which is the very bug this detects. Only the already-applied files are forgiven, so
+// the number stays closed to anything new.
+// Seven races that already landed. Every one of these files is applied on prod, and
+// renaming an applied migration changes its schema_migrations stem, so migrate.sh would
+// see it as unapplied and RE-RUN it — the same constraint that produced
+// LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES above. They are recorded rather than
+// fixed, and the guard binds on everything new.
+//
+// These are history, not a pattern to copy: the number is the SECOND-oldest of these
+// (067) through to 2026-08-28 (platform_identity 012), i.e. the race has been happening
+// for as long as parallel claims have, which is why a keyword-free structural check is
+// worth having at all.
+const GRANDFATHERED_NUMBER_COLLISIONS = new Map([
+  ['core/(bare)/067', new Set(['067_builder_boxes', '067_discord_bot_foundation'])],
+  ['core/(bare)/176', new Set(['176_promotion_respects_open_blockers', '176_ui_discipline'])],
+  ['core/(bare)/187', new Set(['187_goal_sort_order', '187_tasks_kind_check_add_verify'])],
+  ['core/core/189', new Set(['core_189_core_upgrades_ledger', 'core_189_credit_log_task_id_index'])],
+  ['core/core/223', new Set(['core_223_blocker_resolve_respects_other_open_blockers', 'core_223_task_visual'])],
+  ['core/core/240', new Set(['core_240_artist_gate_indexes', 'core_240_goal_members_drop_legacy_role'])],
+  ['module:platform-identity/platform_identity/012', new Set([
+    // 2026-08-28, the collision task 1003646 was filed for: three parallel sessions each
+    // allocated 012 from its own branch point. Order between them does not matter — they
+    // alter three different tables (platform_identity_accounts, _projects,
+    // _builder_project_activity), so the basename-order vs merge-order divergence has
+    // nothing to bite on here.
+    'platform_identity_012_account_privacy',
+    'platform_identity_012_project_template',
+    'platform_identity_012_recent_ships',
+  ])],
+]);
+
+// Given the same flat { source, moduleKey?, basename } list stemCollisions() takes,
+// return [{ series, number, files:[…] }] for every number carrying >1 distinct stem
+// within ONE series. Grandfathered entries are omitted.
+function numberCollisions(files) {
+  const bySeriesNumber = new Map();
+  for (const f of files || []) {
+    const p = parseMigrationName(f.basename);
+    if (!p.ok) continue;
+    // A SERIES is one allocator's number space, and that is identified by the filename
+    // PREFIX, not by the directory. A renamed module keeps its historical prefix for
+    // already-applied files (RENAMED_MODULE_PREFIXES) and restarts the new prefix at 001,
+    // so modules/government/ holds governance_001…007 beside government_001…007. Those are
+    // two namespaces sharing a directory, not a race: the prefixes sort into separate
+    // contiguous blocks, so their order is fixed and identical on prod and on replay.
+    // Keying by directory would report all seven as collisions and the check would be
+    // wrong seven times before it was right once. moduleKey still participates so that two
+    // LEGACY BARE modules (game, demo) each numbering from 001 do not collide with each other.
+    const owner = f.source === 'module' ? `module:${f.moduleKey}` : f.source;
+    const series = `${owner}/${p.bare ? '(bare)' : p.prefix}`;
+    const key = `${series}/${pad3(p.number)}`;
+    if (!bySeriesNumber.has(key)) bySeriesNumber.set(key, { series, number: p.number, stems: new Map() });
+    // Keyed by STEM, so the same file counted twice is not a collision — only two
+    // genuinely different migrations at one number are.
+    bySeriesNumber.get(key).stems.set(f.basename.replace(/\.sql$/, ''), f.basename);
+  }
+  const out = [];
+  for (const [key, v] of bySeriesNumber) {
+    if (v.stems.size < 2) continue;
+    // Exempt only when EVERY stem at this number is one of the already-applied files.
+    // One unrecognised stem re-opens the whole group, because that new file is exactly
+    // what must not be allowed to sit on a taken number.
+    const allowed = GRANDFATHERED_NUMBER_COLLISIONS.get(key);
+    if (allowed && [...v.stems.keys()].every((stem) => allowed.has(stem))) continue;
+    out.push({ series: v.series, number: v.number, files: [...v.stems.values()].sort() });
+  }
+  return out.sort((a, b) => (a.series === b.series ? a.number - b.number : a.series.localeCompare(b.series)));
+}
+
 // ---- numbering / lineage (mirrors the public-mirror pattern) ---------------
 
 // next free = max + 1; empty starts at `start` (same shape as next-number.js nextFree,
@@ -207,6 +307,7 @@ module.exports = {
   migrationNumberOf,
   filenameViolation,
   stemCollisions,
+  numberCollisions,
   nextInNamespace,
   lineageReport,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.832'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.833'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/artifact_staleness.mjs

@@ -21,6 +21,7 @@
 // Run:  node --test tests/artifact_staleness.mjs
 
 import { test } from 'node:test';
+import path from 'node:path';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 import { readFileSync, readdirSync } from 'node:fs';
@@ -123,7 +124,11 @@ test('a generator that cannot answer is UNKNOWN, never stale — it is not a fin
 
 const runFor = (byGenerator) => (cmd, args) => {
   if (cmd === 'git') return fakeGit()(cmd, args);
-  const which = String(args[0] || '').split('/').pop();
+  // path.basename, not split('/') — the checker passes an ABSOLUTE generator path,
+  // which is backslash-separated on Windows, so this returned the whole path, matched
+  // no key in byGenerator, and every generator reported `status: undefined` -> "exit
+  // undefined". Three suites carried this same idiom (task 1003848).
+  const which = path.basename(String(args[0] || ''));
   return { status: byGenerator[which], stdout: '', stderr: '' };
 };
 

package/tests/migration_namespace.mjs

@@ -8,6 +8,8 @@
 //      while grandfathering the existing bare files (core ≤ 187; game/demo modules).
 //   3. stemCollisions catches the real bug: two sources sharing a schema_migrations stem.
 //   4. nextInNamespace / lineageReport count both forms so an allocator can't reuse a number.
+//   5. numberCollisions catches the SAME-SERIES race stemCollisions is blind to: two
+//      different stems on one number, which parallel claims produce (task 1003646).
 //
 // No fs/git — the helpers are pure. Run:  node tests/migration_namespace.mjs
 
@@ -150,6 +152,142 @@ t('stemCollisions: namespacing REMOVES the collision', () => {
   assert.deepEqual(ns.stemCollisions(files), []);
 });
 
+// ---- numberCollisions (task 1003646) ---------------------------------------
+// The SAME-SERIES hazard, which stemCollisions is blind to by design: two different
+// stems at one number inside one series. Nothing is skipped — but migrate.sh applies in
+// BASENAME order, so the pair's order is the alphabetical accident of its slug, and a
+// from-scratch replay can order them differently from the merge order prod applied.
+t('numberCollisions: none when each number is used once in its series', () => {
+  const files = [
+    { source: 'core', basename: 'core_188_a.sql' },
+    { source: 'core', basename: 'core_189_b.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_001_x.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the SAME number in DIFFERENT series is not a collision', () => {
+  // The deliberate tolerance lineageReport documents: separate allocators, separate
+  // namespaces, distinct stems. core_012 and economy_012 are unrelated.
+  const files = [
+    { source: 'core', basename: 'core_012_a.sql' },
+    { source: 'instance', basename: '012_b.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_c.sql' },
+    { source: 'module', moduleKey: 'ideas', basename: 'ideas_012_d.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: catches two stems at one number in ONE series (the 1003646 bug)', () => {
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_beta.sql' },
+  ];
+  const c = ns.numberCollisions(files);
+  assert.equal(c.length, 1);
+  assert.equal(c[0].series, 'module:economy/economy');
+  assert.equal(c[0].number, 12);
+  assert.deepEqual(c[0].files, ['economy_012_alpha.sql', 'economy_012_beta.sql']);
+});
+
+t('numberCollisions: stemCollisions is blind to it — the two detectors are not redundant', () => {
+  // If this ever starts failing because stemCollisions caught it, one of the two is
+  // doing the other's job and the pair should be revisited.
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_beta.sql' },
+  ];
+  assert.deepEqual(ns.stemCollisions(files), [], 'different stems — not a stem collision');
+  assert.equal(ns.numberCollisions(files).length, 1, 'but it IS a number collision');
+});
+
+t('numberCollisions: core and instance series are checked too, not just modules', () => {
+  const files = [
+    { source: 'core', basename: 'core_190_a.sql' },
+    { source: 'core', basename: 'core_190_b.sql' },
+    { source: 'instance', basename: '042_x.sql' },
+    { source: 'instance', basename: '042_y.sql' },
+  ];
+  const c = ns.numberCollisions(files);
+  assert.equal(c.length, 2);
+  assert.deepEqual(c.map((x) => x.series), ['core/core', 'instance/(bare)']);
+});
+
+t('numberCollisions: a RENAMED module\'s two prefixes are two series, not a collision', () => {
+  // modules/government/ really holds governance_001…007 beside government_001…007: the
+  // key was renamed (RENAMED_MODULE_PREFIXES, ADR 0174) and the new prefix restarted at
+  // 001, while the applied files keep the old one because the stem is the
+  // schema_migrations key. Keying a series by DIRECTORY reported all seven as collisions
+  // — the check would have been wrong seven times and right once. It is keyed by PREFIX
+  // for exactly this reason, and the prefixes sort into separate contiguous blocks
+  // (governance_ < government_), so their order is fixed on prod and on replay alike.
+  const files = [
+    { source: 'module', moduleKey: 'government', basename: 'governance_001_tables.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'government_001_rename_from_governance.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'governance_007_delegate_archon_ops_to_metic.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'government_007_amendments.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: two LEGACY BARE modules numbering from 001 do not collide', () => {
+  // game and demo both predate the <key>_ convention, so both hold a bare 001_. They are
+  // different directories and different allocators — moduleKey keeps them apart.
+  const files = [
+    { source: 'module', moduleKey: 'game', basename: '001_initial.sql' },
+    { source: 'module', moduleKey: 'demo', basename: '001_demo_pings.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the SAME file listed twice is not a collision', () => {
+  // Keyed by stem, so a double-scan of one directory cannot manufacture a violation.
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the one pre-existing collision is grandfathered', () => {
+  // platform_identity_012 x3 is applied on prod. Renaming an applied migration changes
+  // its schema_migrations stem, so migrate.sh would RE-RUN it — the same reason
+  // LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES exist. It is exempt BY NAME, so a
+  // fourth file at that number still fails.
+  const three = ['account_privacy', 'project_template', 'recent_ships'].map((s) => ({
+    source: 'module', moduleKey: 'platform-identity', basename: `platform_identity_012_${s}.sql`,
+  }));
+  assert.deepEqual(ns.numberCollisions(three), [], 'the known trio is exempt');
+
+  // The exemption names STEMS, not the number, so 012 stays CLOSED. A fourth file
+  // landing there is the bug this check exists for and must still fail — a bare
+  // series/number exemption would have waved it through.
+  const four = [...three, {
+    source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_012_new.sql',
+  }];
+  const c4 = ns.numberCollisions(four);
+  assert.equal(c4.length, 1, 'a NEW fourth file at the grandfathered number still fails');
+  assert.ok(c4[0].files.includes('platform_identity_012_new.sql'),
+    'and the new file is named in the violation');
+
+  // …but a DIFFERENT number in the same module is not exempt — the grandfather is not
+  // a blanket pass for platform-identity.
+  const other = [
+    { source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_013_a.sql' },
+    { source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_013_b.sql' },
+  ];
+  assert.equal(ns.numberCollisions(other).length, 1, '013 in the same module still fails');
+});
+
+t('numberCollisions: non-migration filenames are ignored', () => {
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'README.md' },
+    { source: 'module', moduleKey: 'economy', basename: '.keep' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
 // ---- nextInNamespace / lineageReport ---------------------------------------
 t('nextInNamespace: counts bare AND prefixed forms (no number reuse)', () => {
   assert.equal(ns.nextInNamespace(['003_a.sql', 'core_188_b.sql', 'core_190_c.sql']), 191,

package/tests/quarantine_canonical.mjs

@@ -0,0 +1,245 @@
+// tests/quarantine_canonical.mjs — containment compares WHERE a path points, not how it
+// is spelled (task 1003848).
+//
+// Windows hands out 8.3 short names: os.tmpdir() here is C:\Users\GMK1_P~1\AppData\Local\Temp
+// while the same directory reports as C:\Users\GMK1_ppl51\... elsewhere, and path.resolve
+// does not reconcile them. fs.realpathSync.native expands 8.3; plain fs.realpathSync does NOT.
+//
+// This is not only a test bug. siteRefusal() asks isInside(REPO_ROOT, site) to refuse a
+// quarantine site inside the repository — so on the one platform that hands out two
+// spellings, that refusal was evadable by spelling.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const q = require('../modules/security/artifact-scan/quarantine.js');
+
+const SHORT = os.tmpdir();
+const LONG = fs.realpathSync.native(SHORT);
+
+test('canonical expands an 8.3 short name — plain realpathSync does not', () => {
+  assert.equal(q.canonical(SHORT), LONG);
+  // The premise, stated so this test explains itself on a machine where it does not apply:
+  // if the two spellings are identical here, the rest is trivially true rather than wrong.
+  if (SHORT === LONG) return;
+  assert.notEqual(fs.realpathSync(SHORT), LONG, 'this is the fact the obvious fix gets wrong');
+});
+
+test('the two spellings of ONE directory contain each other', () => {
+  assert.equal(q.isInside(SHORT, path.join(LONG, 'x')), true);
+  assert.equal(q.isInside(LONG, path.join(SHORT, 'x')), true);
+});
+
+test('a genuinely outside path is still outside — the fix narrows nothing', () => {
+  assert.equal(q.isInside(LONG, path.resolve('/definitely/elsewhere')), false);
+  // and a sibling whose name merely starts with the root is not inside it: this is what
+  // a String.startsWith containment check gets wrong, which is how security/mirror failed.
+  assert.equal(q.isInside(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+});
+
+test('a path that does not exist yet still canonicalises via its nearest real ancestor', () => {
+  // The ordinary case: a derived destination is validated BEFORE it is written.
+  const notYet = path.join(SHORT, 'no-such-dir-1003848', 'deep', 'leaf.txt');
+  assert.equal(q.canonical(notYet), path.join(LONG, 'no-such-dir-1003848', 'deep', 'leaf.txt'));
+  assert.equal(q.isInside(SHORT, notYet), true);
+});
+
+test('a fully nonexistent absolute path degrades to the lexical answer rather than throwing', () => {
+  const nowhere = path.resolve('/no-such-root-1003848/a/b');
+  assert.equal(typeof q.canonical(nowhere), 'string');
+  assert.equal(q.isInside(path.resolve('/no-such-root-1003848'), nowhere), true);
+});
+
+test('canonical is MEMOISED for paths that EXIST — the hot-loop case', () => {
+  // mirror.js's header is explicit about staying cheap; an unmemoised realpath here would
+  // put ~20,000 sync syscalls on its 5,000-file loop.
+  //
+  // BOTH OPERANDS MUST EXIST. Only an EXACT resolution is cacheable (see canonical()):
+  // an answer reached by walking up to the nearest existing ancestor is deliberately
+  // NOT stored, because the leaf can still be created as a link that escapes. So a
+  // not-yet-existing path re-reads every call BY DESIGN, and asserting memoisation
+  // against one asserts the opposite of the rule.
+  //
+  // The first version of this test used <tmpdir>/x and passed only because a stray
+  // file of that name happened to exist on the author's box; on CI it did not, the
+  // walk-up path was taken, and 50 iterations cost ~100 syscalls instead of 2.
+  const dir = fs.mkdtempSync(path.join(LONG, 'memo-'));
+  try {
+    q.clearCanonicalCache();
+    const orig = fs.realpathSync.native;
+    let calls = 0;
+    fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+    try {
+      for (let i = 0; i < 50; i += 1) q.isInside(SHORT, dir);
+    } finally {
+      fs.realpathSync.native = orig;
+    }
+    assert.ok(calls <= 4, `50 containment checks over existing paths should not cost ${calls} realpath syscalls`);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('a path that does NOT exist is re-read every time — the cache must not answer for it', () => {
+  // The companion rule, and a security property rather than a performance one: a
+  // walked-up answer is provisional. Cache it and creating the leaf as an escaping
+  // link would keep serving "inside" forever. Pinning it here stops a future
+  // optimisation from caching provisional answers to make the test above cheaper.
+  const notYet = path.join(LONG, 'no-such-memo-1003848', 'leaf');
+  q.clearCanonicalCache();
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try {
+    q.canonical(notYet);
+    q.canonical(notYet);
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.ok(calls >= 4, `two lookups of a non-existent path must both hit the filesystem, saw ${calls}`);
+});
+
+test('a path that does NOT exist yet is never cached — the escape must stay visible', () => {
+  // THE SECURITY PROPERTY, and the one the first pass of this fix got wrong.
+  //
+  // A derived destination is canonicalised BEFORE it is written, so its answer comes from
+  // walking up to the nearest existing ancestor. That answer is true only until the path
+  // is written. Cache it and the window never closes: create the path as a symlink (a
+  // junction on Windows) pointing out of the pen and isInside() keeps returning the
+  // pre-creation verdict — INSIDE — so mirror.js's path_escape refusal is silently lost.
+  // The containment check this file exists to harden is then evadable one layer down, by
+  // its own memoisation.
+  //
+  // Asserted as the MECHANISM rather than by building a symlink, deliberately: creating
+  // one needs privileges this suite does not have on Windows, so a symlink-shaped test
+  // would skip on the very platform whose 8.3 spellings motivated the whole change. The
+  // mechanism is platform-free — a missing path must cost a fresh filesystem read every
+  // time — and modules/security/tests/mirror.mjs covers the real symlink end-to-end
+  // wherever symlinks can be made.
+  q.clearCanonicalCache();
+  const missing = path.join(SHORT, 'not-written-yet-1003848', 'leaf.txt');
+
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p2) => { calls += 1; return orig(p2); };
+  try {
+    q.canonical(missing);
+    const afterFirst = calls;
+    q.canonical(missing);
+    assert.ok(calls > afterFirst,
+      'a non-existent path must be re-read, not served from cache — otherwise a symlink '
+      + 'created there afterwards keeps the stale INSIDE verdict');
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+});
+
+test('an EXISTING directory is still cached — the fix keeps the memoisation that mattered', () => {
+  // The counterweight to the test above: mirror.js's hot loop canonicalises real
+  // directories over and over, and those answers are stable (a directory cannot move
+  // under a running scan). Only the provisional ones are re-read.
+  q.clearCanonicalCache();
+  q.canonical(SHORT);
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p2) => { calls += 1; return orig(p2); };
+  try {
+    for (let i = 0; i < 20; i += 1) q.canonical(SHORT);
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.equal(calls, 0, 'an existing directory resolved once must not be resolved again');
+});
+
+test('clearing the cache makes it read the filesystem again', () => {
+  q.clearCanonicalCache();
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try { q.canonical(SHORT); } finally { fs.realpathSync.native = orig; }
+  assert.ok(calls >= 1, 'a cleared cache must not keep answering from memory');
+});
+
+// ---------------------------------------------------------------------------
+// LEXICAL vs PHYSICAL containment (task 1003848, grade round 2).
+//
+// sanitize.js runs three confinement arms in order, each with its own refusal:
+// lexical (does the manifest path climb out?), then physical (does it RESOLVE
+// out?), then lstat (is it a link the manifest called a file?). Canonicalising
+// the lexical arm made it follow the link and fire first, pre-empting the other
+// two — the artifact was still refused, but with the wrong diagnosis, and the two
+// tests pinning those messages went red.
+//
+// The existing cases live in modules/security/tests/sanitize_rebuild.mjs and are
+// SKIPPED wherever symlinks cannot be created — which is this platform, so that
+// regression was invisible locally and only CI saw it. This case therefore falls
+// back to a DIRECTORY JUNCTION, which Windows allows without elevation, so the
+// divergence is pinned on both platforms.
+// ---------------------------------------------------------------------------
+
+const linkKind = (() => {
+  const probe = fs.mkdtempSync(path.join(os.tmpdir(), 'linkprobe-'));
+  const target = fs.mkdtempSync(path.join(os.tmpdir(), 'linktarget-'));
+  try {
+    for (const kind of ['dir', 'junction']) {
+      try { fs.symlinkSync(target, path.join(probe, `l-${kind}`), kind); return kind; }
+      catch { /* try the next form */ }
+    }
+    return null;
+  } finally {
+    fs.rmSync(probe, { recursive: true, force: true });
+    fs.rmSync(target, { recursive: true, force: true });
+  }
+})();
+
+test('a link that escapes is LEXICALLY inside but PHYSICALLY outside', { skip: linkKind ? false : 'this platform cannot create links' }, () => {
+  const pen = fs.mkdtempSync(path.join(os.tmpdir(), 'pen-'));
+  const pristine = path.join(pen, 'pristine');
+  fs.mkdirSync(pristine);
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'outside-'));
+  try {
+    const link = path.join(pristine, 'escape');
+    fs.symlinkSync(outside, link, linkKind);
+    q.clearCanonicalCache();
+
+    // The lexical arm must NOT fire: nothing in the SPELLING of this path climbs
+    // out. If it fired, sanitize.js would report "escapes the pristine tree" and
+    // never reach the two refusals that describe what is actually wrong.
+    assert.equal(q.isInsideLexical(pristine, link), true);
+
+    // The physical arm is what catches it — this is the containment that matters.
+    assert.equal(q.isInside(pristine, link), false);
+  } finally {
+    fs.rmSync(pen, { recursive: true, force: true });
+    fs.rmSync(outside, { recursive: true, force: true });
+  }
+});
+
+test('on ordinary paths the two predicates agree — the split narrows nothing', () => {
+  const inside = path.join(LONG, 'a', 'b');
+  assert.equal(q.isInsideLexical(LONG, inside), q.isInside(LONG, inside));
+  assert.equal(q.isInsideLexical(LONG, inside), true);
+  const climbs = path.join(LONG, '..', 'elsewhere');
+  assert.equal(q.isInsideLexical(LONG, climbs), false);
+  assert.equal(q.isInside(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+  assert.equal(q.isInsideLexical(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+});
+
+test('the lexical predicate never touches the filesystem', () => {
+  // The whole point: its answer must not depend on what the leaf points at right
+  // now. A realpath call here would reintroduce exactly the coupling being removed.
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try {
+    q.isInsideLexical(LONG, path.join(LONG, 'whatever', 'deep.txt'));
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.equal(calls, 0, 'isInsideLexical must be pure path arithmetic');
+});

package/tests/search_index_poller.mjs

@@ -13,6 +13,7 @@
 // Run:  node tests/search_index_poller.mjs
 
 import { strict as assert } from 'node:assert';
+import path from 'node:path';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
@@ -104,7 +105,11 @@ function fakePool(seq) {
 await test('the sweep runs BOTH ingesters — one failing must not skip the other', async () => {
   const called = [];
   const exec = (_p, args, _o, cb) => {
-    called.push(args[0].split('/').pop());
+    // path.basename, not split('/') — the sweep passes an ABSOLUTE path, and on
+    // Windows that is backslash-separated, so splitting on a forward slash returned
+    // the whole path and this assertion compared a path against a basename (task
+    // 1003848). The production code was never wrong; the test helper was.
+    called.push(path.basename(args[0]));
     cb(args[0].includes('md') ? Object.assign(new Error('x'), { code: 1 }) : null, '', 'boom');
   };
   const r = await sweep({ pool: fakePool([{ chunks: 0, last: null }]), log: quietLog, execFileImpl: exec, now: NOW });

package/tests/search_isolation.mjs

@@ -161,6 +161,14 @@ const client = await dbReachable();
 if (!client) {
   console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / on a dev box.');
   console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
+  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
+  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
+  // still closing from its failed connect — and the process.exit() at the bottom of
+  // this file then tore down the loop underneath them. On Windows that surfaces as
+  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
+  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
+  // a failing suite in the unit gate while every assertion actually passed.
+  if (pool) await pool.end().catch(() => {});
 } else {
   try {
     await client.query('BEGIN');
@@ -204,4 +212,11 @@ if (!client) {
 }
 
 console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);
+// EXIT CODE, NOT process.exit() (task 1003848). A hard exit tears the event loop down
+// underneath any handle that is still closing — and pg leaves one behind after a
+// FAILED connect, which is exactly the skip path. On Windows that surfaced as
+// `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`
+// and exit 0xC0000409 AFTER "5 passed, 0 failed" — a process-teardown crash that the
+// unit gate can only read as a failing suite. Setting exitCode lets node drain the
+// handles and then exit with the same status.
+process.exitCode = failed === 0 ? 0 : 1;