@bongos/core 1.19.832 → 1.19.834

package/tests/migration_namespace.mjs

@@ -8,6 +8,8 @@
 //      while grandfathering the existing bare files (core ≤ 187; game/demo modules).
 //   3. stemCollisions catches the real bug: two sources sharing a schema_migrations stem.
 //   4. nextInNamespace / lineageReport count both forms so an allocator can't reuse a number.
+//   5. numberCollisions catches the SAME-SERIES race stemCollisions is blind to: two
+//      different stems on one number, which parallel claims produce (task 1003646).
 //
 // No fs/git — the helpers are pure. Run:  node tests/migration_namespace.mjs
 
@@ -150,6 +152,142 @@ t('stemCollisions: namespacing REMOVES the collision', () => {
   assert.deepEqual(ns.stemCollisions(files), []);
 });
 
+// ---- numberCollisions (task 1003646) ---------------------------------------
+// The SAME-SERIES hazard, which stemCollisions is blind to by design: two different
+// stems at one number inside one series. Nothing is skipped — but migrate.sh applies in
+// BASENAME order, so the pair's order is the alphabetical accident of its slug, and a
+// from-scratch replay can order them differently from the merge order prod applied.
+t('numberCollisions: none when each number is used once in its series', () => {
+  const files = [
+    { source: 'core', basename: 'core_188_a.sql' },
+    { source: 'core', basename: 'core_189_b.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_001_x.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the SAME number in DIFFERENT series is not a collision', () => {
+  // The deliberate tolerance lineageReport documents: separate allocators, separate
+  // namespaces, distinct stems. core_012 and economy_012 are unrelated.
+  const files = [
+    { source: 'core', basename: 'core_012_a.sql' },
+    { source: 'instance', basename: '012_b.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_c.sql' },
+    { source: 'module', moduleKey: 'ideas', basename: 'ideas_012_d.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: catches two stems at one number in ONE series (the 1003646 bug)', () => {
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_beta.sql' },
+  ];
+  const c = ns.numberCollisions(files);
+  assert.equal(c.length, 1);
+  assert.equal(c[0].series, 'module:economy/economy');
+  assert.equal(c[0].number, 12);
+  assert.deepEqual(c[0].files, ['economy_012_alpha.sql', 'economy_012_beta.sql']);
+});
+
+t('numberCollisions: stemCollisions is blind to it — the two detectors are not redundant', () => {
+  // If this ever starts failing because stemCollisions caught it, one of the two is
+  // doing the other's job and the pair should be revisited.
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_beta.sql' },
+  ];
+  assert.deepEqual(ns.stemCollisions(files), [], 'different stems — not a stem collision');
+  assert.equal(ns.numberCollisions(files).length, 1, 'but it IS a number collision');
+});
+
+t('numberCollisions: core and instance series are checked too, not just modules', () => {
+  const files = [
+    { source: 'core', basename: 'core_190_a.sql' },
+    { source: 'core', basename: 'core_190_b.sql' },
+    { source: 'instance', basename: '042_x.sql' },
+    { source: 'instance', basename: '042_y.sql' },
+  ];
+  const c = ns.numberCollisions(files);
+  assert.equal(c.length, 2);
+  assert.deepEqual(c.map((x) => x.series), ['core/core', 'instance/(bare)']);
+});
+
+t('numberCollisions: a RENAMED module\'s two prefixes are two series, not a collision', () => {
+  // modules/government/ really holds governance_001…007 beside government_001…007: the
+  // key was renamed (RENAMED_MODULE_PREFIXES, ADR 0174) and the new prefix restarted at
+  // 001, while the applied files keep the old one because the stem is the
+  // schema_migrations key. Keying a series by DIRECTORY reported all seven as collisions
+  // — the check would have been wrong seven times and right once. It is keyed by PREFIX
+  // for exactly this reason, and the prefixes sort into separate contiguous blocks
+  // (governance_ < government_), so their order is fixed on prod and on replay alike.
+  const files = [
+    { source: 'module', moduleKey: 'government', basename: 'governance_001_tables.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'government_001_rename_from_governance.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'governance_007_delegate_archon_ops_to_metic.sql' },
+    { source: 'module', moduleKey: 'government', basename: 'government_007_amendments.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: two LEGACY BARE modules numbering from 001 do not collide', () => {
+  // game and demo both predate the <key>_ convention, so both hold a bare 001_. They are
+  // different directories and different allocators — moduleKey keeps them apart.
+  const files = [
+    { source: 'module', moduleKey: 'game', basename: '001_initial.sql' },
+    { source: 'module', moduleKey: 'demo', basename: '001_demo_pings.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the SAME file listed twice is not a collision', () => {
+  // Keyed by stem, so a double-scan of one directory cannot manufacture a violation.
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
+t('numberCollisions: the one pre-existing collision is grandfathered', () => {
+  // platform_identity_012 x3 is applied on prod. Renaming an applied migration changes
+  // its schema_migrations stem, so migrate.sh would RE-RUN it — the same reason
+  // LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES exist. It is exempt BY NAME, so a
+  // fourth file at that number still fails.
+  const three = ['account_privacy', 'project_template', 'recent_ships'].map((s) => ({
+    source: 'module', moduleKey: 'platform-identity', basename: `platform_identity_012_${s}.sql`,
+  }));
+  assert.deepEqual(ns.numberCollisions(three), [], 'the known trio is exempt');
+
+  // The exemption names STEMS, not the number, so 012 stays CLOSED. A fourth file
+  // landing there is the bug this check exists for and must still fail — a bare
+  // series/number exemption would have waved it through.
+  const four = [...three, {
+    source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_012_new.sql',
+  }];
+  const c4 = ns.numberCollisions(four);
+  assert.equal(c4.length, 1, 'a NEW fourth file at the grandfathered number still fails');
+  assert.ok(c4[0].files.includes('platform_identity_012_new.sql'),
+    'and the new file is named in the violation');
+
+  // …but a DIFFERENT number in the same module is not exempt — the grandfather is not
+  // a blanket pass for platform-identity.
+  const other = [
+    { source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_013_a.sql' },
+    { source: 'module', moduleKey: 'platform-identity', basename: 'platform_identity_013_b.sql' },
+  ];
+  assert.equal(ns.numberCollisions(other).length, 1, '013 in the same module still fails');
+});
+
+t('numberCollisions: non-migration filenames are ignored', () => {
+  const files = [
+    { source: 'module', moduleKey: 'economy', basename: 'README.md' },
+    { source: 'module', moduleKey: 'economy', basename: '.keep' },
+    { source: 'module', moduleKey: 'economy', basename: 'economy_012_alpha.sql' },
+  ];
+  assert.deepEqual(ns.numberCollisions(files), []);
+});
+
 // ---- nextInNamespace / lineageReport ---------------------------------------
 t('nextInNamespace: counts bare AND prefixed forms (no number reuse)', () => {
   assert.equal(ns.nextInNamespace(['003_a.sql', 'core_188_b.sql', 'core_190_c.sql']), 191,

package/tests/promote_deps_gate.mjs

@@ -0,0 +1,93 @@
+// tests/promote_deps_gate.mjs — promote must not advertise dependency-blocked work
+// (task 1003553).
+//
+// POST /tasks/:id/promote flipped backlog -> ready with a bare updateTaskStatus and NO
+// dependency check. Only the CLAIM refused, with DEPS_NOT_SHIPPED — so a manual promote
+// put blocked work into the claimable feed and a builder discovered it by trying to take
+// it. The feed lied.
+//
+// claimTask's own comment already named this as the reason it re-checks: "the
+// auto-promotion triggers keep backlog tasks gated, but a manually-promoted task could
+// end up 'ready' with pending deps — this is the second line of defence." The first line
+// is what was missing.
+//
+// These are WIRING assertions on the source. `db` is module-scoped in routes/tasks.js, so
+// a behavioural test needs a real Postgres and belongs in the integration lane; what can
+// go wrong here without one is the ORDER and the SURVIVAL of the claim-time check, and
+// both are checked below rather than assumed.
+//
+// Run:  node tests/promote_deps_gate.mjs
+//
+// NOTE: makeRunner's test() returns a PROMISE, so every call must be awaited. Without
+// the await, summary() runs before any of them and the file reports '0 passed, 0 failed'
+// and EXITS 0 - a suite that looks green while asserting nothing.
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const { test, summary } = makeRunner();
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => readFileSync(path.join(REPO_ROOT, rel), 'utf8');
+
+const ROUTES = read('modules/lifecycle/routes/tasks.js');
+// The promote handler only — so a dependency check somewhere else in this 1,400-line
+// file cannot make these pass.
+const PROMOTE = (() => {
+  const start = ROUTES.indexOf("router.post('/tasks/:id/promote'");
+  assert.ok(start > 0, 'the promote route must still exist');
+  const end = ROUTES.indexOf("router.post('/tasks/:id/demote'", start);
+  assert.ok(end > start, 'expected /demote to follow /promote — the slice bound moved');
+  return ROUTES.slice(start, end);
+})();
+
+await test('promote asks whether the dependencies are done', () => {
+  assert.match(PROMOTE, /db\.unsatisfiedDeps\(/,
+    'promote must consult the dependency gate before making a task claimable');
+});
+
+await test('it refuses with the SAME shape the claim path uses', () => {
+  assert.match(PROMOTE, /deps_not_shipped/);
+  assert.match(PROMOTE, /depRefusalRow/,
+    'the refusal rows come from dead-deps.js, so promote and claim describe a blocked task identically');
+  assert.match(PROMOTE, /409/, 'a blocked promote is a conflict, not a 400');
+});
+
+await test('the check runs BEFORE the status flip — the whole point', () => {
+  const gate = PROMOTE.indexOf('db.unsatisfiedDeps(');
+  const flip = PROMOTE.indexOf("updateTaskStatus(id, 'ready')");
+  assert.ok(gate > 0 && flip > 0, 'both the gate and the flip must be present');
+  assert.ok(gate < flip,
+    'checking dependencies after flipping to ready would advertise the task first and refuse second');
+});
+
+await test('the abandoned -> backlog restore is NOT gated', () => {
+  // A restore lands in backlog, which is pre-workable: nothing can claim it there, so a
+  // dependency gate would refuse an undo for no benefit. The restore branch returns
+  // before the gate.
+  const restore = PROMOTE.indexOf('restoreTask(');
+  const gate = PROMOTE.indexOf('db.unsatisfiedDeps(');
+  assert.ok(restore > 0 && gate > restore,
+    'the restore branch must return before the dependency gate is reached');
+});
+
+await test('the CLAIM-time check still exists — this adds a line of defence, it does not move one', () => {
+  // Deleting the claim check "because promote now gates" would be the tempting
+  // simplification and a real regression: a task can acquire a dependency after it is
+  // promoted, and ADR 0015 puts the gate on the claim.
+  const claims = read('modules/lifecycle/db-claims.js');
+  assert.match(claims, /unsatisfiedDeps\(/, 'the claim path keeps its own gate');
+  assert.match(claims, /DEPS_NOT_SHIPPED/);
+});
+
+await test('promote and claim resolve deps through ONE function, not two notions of blocked', () => {
+  // If these ever diverge, a task can be promotable and unclaimable at the same time —
+  // which is the bug this task fixed, inverted.
+  const deps = read('modules/lifecycle/db-deps-criteria.js');
+  assert.match(deps, /async function unsatisfiedDeps\(/,
+    'the shared resolver must still live in one place');
+});
+
+summary();

package/tests/push_path_brief.mjs

@@ -38,6 +38,9 @@ t('server path gets the brief, with every load-bearing phrase', () => {
     '/builder-ship',
     'NEVER ask the owner for a PAT',
     'publish-status',
+    // task 1003988: a box that cannot see which test failed re-pushes blind.
+    'merge_driver.failing_tests',
+    'checks_unreadable',
   ]) {
     assert.ok(l.includes(must), `line must state: ${must}`);
   }

package/tests/quarantine_canonical.mjs

@@ -0,0 +1,245 @@
+// tests/quarantine_canonical.mjs — containment compares WHERE a path points, not how it
+// is spelled (task 1003848).
+//
+// Windows hands out 8.3 short names: os.tmpdir() here is C:\Users\GMK1_P~1\AppData\Local\Temp
+// while the same directory reports as C:\Users\GMK1_ppl51\... elsewhere, and path.resolve
+// does not reconcile them. fs.realpathSync.native expands 8.3; plain fs.realpathSync does NOT.
+//
+// This is not only a test bug. siteRefusal() asks isInside(REPO_ROOT, site) to refuse a
+// quarantine site inside the repository — so on the one platform that hands out two
+// spellings, that refusal was evadable by spelling.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const q = require('../modules/security/artifact-scan/quarantine.js');
+
+const SHORT = os.tmpdir();
+const LONG = fs.realpathSync.native(SHORT);
+
+test('canonical expands an 8.3 short name — plain realpathSync does not', () => {
+  assert.equal(q.canonical(SHORT), LONG);
+  // The premise, stated so this test explains itself on a machine where it does not apply:
+  // if the two spellings are identical here, the rest is trivially true rather than wrong.
+  if (SHORT === LONG) return;
+  assert.notEqual(fs.realpathSync(SHORT), LONG, 'this is the fact the obvious fix gets wrong');
+});
+
+test('the two spellings of ONE directory contain each other', () => {
+  assert.equal(q.isInside(SHORT, path.join(LONG, 'x')), true);
+  assert.equal(q.isInside(LONG, path.join(SHORT, 'x')), true);
+});
+
+test('a genuinely outside path is still outside — the fix narrows nothing', () => {
+  assert.equal(q.isInside(LONG, path.resolve('/definitely/elsewhere')), false);
+  // and a sibling whose name merely starts with the root is not inside it: this is what
+  // a String.startsWith containment check gets wrong, which is how security/mirror failed.
+  assert.equal(q.isInside(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+});
+
+test('a path that does not exist yet still canonicalises via its nearest real ancestor', () => {
+  // The ordinary case: a derived destination is validated BEFORE it is written.
+  const notYet = path.join(SHORT, 'no-such-dir-1003848', 'deep', 'leaf.txt');
+  assert.equal(q.canonical(notYet), path.join(LONG, 'no-such-dir-1003848', 'deep', 'leaf.txt'));
+  assert.equal(q.isInside(SHORT, notYet), true);
+});
+
+test('a fully nonexistent absolute path degrades to the lexical answer rather than throwing', () => {
+  const nowhere = path.resolve('/no-such-root-1003848/a/b');
+  assert.equal(typeof q.canonical(nowhere), 'string');
+  assert.equal(q.isInside(path.resolve('/no-such-root-1003848'), nowhere), true);
+});
+
+test('canonical is MEMOISED for paths that EXIST — the hot-loop case', () => {
+  // mirror.js's header is explicit about staying cheap; an unmemoised realpath here would
+  // put ~20,000 sync syscalls on its 5,000-file loop.
+  //
+  // BOTH OPERANDS MUST EXIST. Only an EXACT resolution is cacheable (see canonical()):
+  // an answer reached by walking up to the nearest existing ancestor is deliberately
+  // NOT stored, because the leaf can still be created as a link that escapes. So a
+  // not-yet-existing path re-reads every call BY DESIGN, and asserting memoisation
+  // against one asserts the opposite of the rule.
+  //
+  // The first version of this test used <tmpdir>/x and passed only because a stray
+  // file of that name happened to exist on the author's box; on CI it did not, the
+  // walk-up path was taken, and 50 iterations cost ~100 syscalls instead of 2.
+  const dir = fs.mkdtempSync(path.join(LONG, 'memo-'));
+  try {
+    q.clearCanonicalCache();
+    const orig = fs.realpathSync.native;
+    let calls = 0;
+    fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+    try {
+      for (let i = 0; i < 50; i += 1) q.isInside(SHORT, dir);
+    } finally {
+      fs.realpathSync.native = orig;
+    }
+    assert.ok(calls <= 4, `50 containment checks over existing paths should not cost ${calls} realpath syscalls`);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('a path that does NOT exist is re-read every time — the cache must not answer for it', () => {
+  // The companion rule, and a security property rather than a performance one: a
+  // walked-up answer is provisional. Cache it and creating the leaf as an escaping
+  // link would keep serving "inside" forever. Pinning it here stops a future
+  // optimisation from caching provisional answers to make the test above cheaper.
+  const notYet = path.join(LONG, 'no-such-memo-1003848', 'leaf');
+  q.clearCanonicalCache();
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try {
+    q.canonical(notYet);
+    q.canonical(notYet);
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.ok(calls >= 4, `two lookups of a non-existent path must both hit the filesystem, saw ${calls}`);
+});
+
+test('a path that does NOT exist yet is never cached — the escape must stay visible', () => {
+  // THE SECURITY PROPERTY, and the one the first pass of this fix got wrong.
+  //
+  // A derived destination is canonicalised BEFORE it is written, so its answer comes from
+  // walking up to the nearest existing ancestor. That answer is true only until the path
+  // is written. Cache it and the window never closes: create the path as a symlink (a
+  // junction on Windows) pointing out of the pen and isInside() keeps returning the
+  // pre-creation verdict — INSIDE — so mirror.js's path_escape refusal is silently lost.
+  // The containment check this file exists to harden is then evadable one layer down, by
+  // its own memoisation.
+  //
+  // Asserted as the MECHANISM rather than by building a symlink, deliberately: creating
+  // one needs privileges this suite does not have on Windows, so a symlink-shaped test
+  // would skip on the very platform whose 8.3 spellings motivated the whole change. The
+  // mechanism is platform-free — a missing path must cost a fresh filesystem read every
+  // time — and modules/security/tests/mirror.mjs covers the real symlink end-to-end
+  // wherever symlinks can be made.
+  q.clearCanonicalCache();
+  const missing = path.join(SHORT, 'not-written-yet-1003848', 'leaf.txt');
+
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p2) => { calls += 1; return orig(p2); };
+  try {
+    q.canonical(missing);
+    const afterFirst = calls;
+    q.canonical(missing);
+    assert.ok(calls > afterFirst,
+      'a non-existent path must be re-read, not served from cache — otherwise a symlink '
+      + 'created there afterwards keeps the stale INSIDE verdict');
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+});
+
+test('an EXISTING directory is still cached — the fix keeps the memoisation that mattered', () => {
+  // The counterweight to the test above: mirror.js's hot loop canonicalises real
+  // directories over and over, and those answers are stable (a directory cannot move
+  // under a running scan). Only the provisional ones are re-read.
+  q.clearCanonicalCache();
+  q.canonical(SHORT);
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p2) => { calls += 1; return orig(p2); };
+  try {
+    for (let i = 0; i < 20; i += 1) q.canonical(SHORT);
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.equal(calls, 0, 'an existing directory resolved once must not be resolved again');
+});
+
+test('clearing the cache makes it read the filesystem again', () => {
+  q.clearCanonicalCache();
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try { q.canonical(SHORT); } finally { fs.realpathSync.native = orig; }
+  assert.ok(calls >= 1, 'a cleared cache must not keep answering from memory');
+});
+
+// ---------------------------------------------------------------------------
+// LEXICAL vs PHYSICAL containment (task 1003848, grade round 2).
+//
+// sanitize.js runs three confinement arms in order, each with its own refusal:
+// lexical (does the manifest path climb out?), then physical (does it RESOLVE
+// out?), then lstat (is it a link the manifest called a file?). Canonicalising
+// the lexical arm made it follow the link and fire first, pre-empting the other
+// two — the artifact was still refused, but with the wrong diagnosis, and the two
+// tests pinning those messages went red.
+//
+// The existing cases live in modules/security/tests/sanitize_rebuild.mjs and are
+// SKIPPED wherever symlinks cannot be created — which is this platform, so that
+// regression was invisible locally and only CI saw it. This case therefore falls
+// back to a DIRECTORY JUNCTION, which Windows allows without elevation, so the
+// divergence is pinned on both platforms.
+// ---------------------------------------------------------------------------
+
+const linkKind = (() => {
+  const probe = fs.mkdtempSync(path.join(os.tmpdir(), 'linkprobe-'));
+  const target = fs.mkdtempSync(path.join(os.tmpdir(), 'linktarget-'));
+  try {
+    for (const kind of ['dir', 'junction']) {
+      try { fs.symlinkSync(target, path.join(probe, `l-${kind}`), kind); return kind; }
+      catch { /* try the next form */ }
+    }
+    return null;
+  } finally {
+    fs.rmSync(probe, { recursive: true, force: true });
+    fs.rmSync(target, { recursive: true, force: true });
+  }
+})();
+
+test('a link that escapes is LEXICALLY inside but PHYSICALLY outside', { skip: linkKind ? false : 'this platform cannot create links' }, () => {
+  const pen = fs.mkdtempSync(path.join(os.tmpdir(), 'pen-'));
+  const pristine = path.join(pen, 'pristine');
+  fs.mkdirSync(pristine);
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'outside-'));
+  try {
+    const link = path.join(pristine, 'escape');
+    fs.symlinkSync(outside, link, linkKind);
+    q.clearCanonicalCache();
+
+    // The lexical arm must NOT fire: nothing in the SPELLING of this path climbs
+    // out. If it fired, sanitize.js would report "escapes the pristine tree" and
+    // never reach the two refusals that describe what is actually wrong.
+    assert.equal(q.isInsideLexical(pristine, link), true);
+
+    // The physical arm is what catches it — this is the containment that matters.
+    assert.equal(q.isInside(pristine, link), false);
+  } finally {
+    fs.rmSync(pen, { recursive: true, force: true });
+    fs.rmSync(outside, { recursive: true, force: true });
+  }
+});
+
+test('on ordinary paths the two predicates agree — the split narrows nothing', () => {
+  const inside = path.join(LONG, 'a', 'b');
+  assert.equal(q.isInsideLexical(LONG, inside), q.isInside(LONG, inside));
+  assert.equal(q.isInsideLexical(LONG, inside), true);
+  const climbs = path.join(LONG, '..', 'elsewhere');
+  assert.equal(q.isInsideLexical(LONG, climbs), false);
+  assert.equal(q.isInside(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+  assert.equal(q.isInsideLexical(path.join(LONG, 'pen'), path.join(LONG, 'pen-evil', 'f')), false);
+});
+
+test('the lexical predicate never touches the filesystem', () => {
+  // The whole point: its answer must not depend on what the leaf points at right
+  // now. A realpath call here would reintroduce exactly the coupling being removed.
+  const orig = fs.realpathSync.native;
+  let calls = 0;
+  fs.realpathSync.native = (p) => { calls += 1; return orig(p); };
+  try {
+    q.isInsideLexical(LONG, path.join(LONG, 'whatever', 'deep.txt'));
+  } finally {
+    fs.realpathSync.native = orig;
+  }
+  assert.equal(calls, 0, 'isInsideLexical must be pure path arithmetic');
+});

package/tests/search_index_poller.mjs

@@ -13,6 +13,7 @@
 // Run:  node tests/search_index_poller.mjs
 
 import { strict as assert } from 'node:assert';
+import path from 'node:path';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
@@ -104,7 +105,11 @@ function fakePool(seq) {
 await test('the sweep runs BOTH ingesters — one failing must not skip the other', async () => {
   const called = [];
   const exec = (_p, args, _o, cb) => {
-    called.push(args[0].split('/').pop());
+    // path.basename, not split('/') — the sweep passes an ABSOLUTE path, and on
+    // Windows that is backslash-separated, so splitting on a forward slash returned
+    // the whole path and this assertion compared a path against a basename (task
+    // 1003848). The production code was never wrong; the test helper was.
+    called.push(path.basename(args[0]));
     cb(args[0].includes('md') ? Object.assign(new Error('x'), { code: 1 }) : null, '', 'boom');
   };
   const r = await sweep({ pool: fakePool([{ chunks: 0, last: null }]), log: quietLog, execFileImpl: exec, now: NOW });

package/tests/search_isolation.mjs

@@ -161,6 +161,14 @@ const client = await dbReachable();
 if (!client) {
   console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / on a dev box.');
   console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
+  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
+  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
+  // still closing from its failed connect — and the process.exit() at the bottom of
+  // this file then tore down the loop underneath them. On Windows that surfaces as
+  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
+  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
+  // a failing suite in the unit gate while every assertion actually passed.
+  if (pool) await pool.end().catch(() => {});
 } else {
   try {
     await client.query('BEGIN');
@@ -204,4 +212,11 @@ if (!client) {
 }
 
 console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);
+// EXIT CODE, NOT process.exit() (task 1003848). A hard exit tears the event loop down
+// underneath any handle that is still closing — and pg leaves one behind after a
+// FAILED connect, which is exactly the skip path. On Windows that surfaced as
+// `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`
+// and exit 0xC0000409 AFTER "5 passed, 0 failed" — a process-teardown crash that the
+// unit gate can only read as a failing suite. Setting exitCode lets node drain the
+// handles and then exit with the same status.
+process.exitCode = failed === 0 ? 0 : 1;

package/tests/unit_report_status.mjs

@@ -0,0 +1,101 @@
+// tests/unit_report_status.mjs — the `unit-report` commit status (task 1003988).
+//
+// WHY. The Cloud Bongos App cannot read check runs without Checks:read, so a
+// builder box saw a red PR and never WHICH test failed. A commit status IS
+// readable, so the unit workflow reports the failing tests as one. Two halves
+// have to agree for that to work — what the runner writes and what the workflow
+// posts — and the context name is shared with the server that reads it back.
+//
+// Run:  node tests/unit_report_status.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import { describeFailures, STATUS_DESCRIPTION_MAX } from '../scripts/gds/run-unit-tests.js';
+import { redPrLine } from '../scripts/gds/ship-land.js';
+
+const require = createRequire(import.meta.url);
+const gh = require('../modules/lifecycle/github-push.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const workflow = fs
+  .readFileSync(new URL('../.github/workflows/unit.yml', import.meta.url), 'utf8')
+  .replace(/\r\n/g, '\n');
+const reportJob = workflow.slice(workflow.indexOf('\n  report:'));
+
+test('describeFailures is empty when nothing failed', () => {
+  assert.equal(describeFailures([]), '');
+});
+
+test('describeFailures counts and names the failing tests', () => {
+  assert.equal(describeFailures(['security']), '1 failed: security');
+  assert.equal(describeFailures(['quarantine_canonical', 'security']), '2 failed: quarantine_canonical, security');
+});
+
+test('describeFailures fits the GitHub status limit and keeps the true count', () => {
+  const many = Array.from({ length: 40 }, (_, i) => `some_long_test_name_${i}`);
+  const d = describeFailures(many);
+  assert.ok(d.length <= STATUS_DESCRIPTION_MAX, `${d.length} chars`);
+  assert.ok(d.startsWith('40 failed: some_long_test_name_0'), d);
+  assert.ok(d.endsWith('…'), 'a cut list says it was cut');
+});
+
+test('describeFailures is one line — a test name cannot forge a second output key', () => {
+  assert.ok(!/[\r\n]/.test(describeFailures(['evil\nfailures=spoofed'])));
+});
+
+test('the unit job itself stays read-only; only the report job may write statuses', () => {
+  const unitJob = workflow.slice(0, workflow.indexOf('\n  report:'));
+  assert.ok(workflow.includes('\n  report:'), 'report job exists');
+  assert.ok(!/statuses:\s*write/.test(unitJob), 'PR-controlled test code never runs beside a status-writing token');
+  assert.match(reportJob, /permissions:\n\s+statuses: write/);
+  assert.ok(!/uses:\s*actions\/checkout/.test(reportJob), 'the report job checks out no PR code');
+});
+
+test('the report job posts the context the server reads back', () => {
+  assert.ok(reportJob.includes(`context=${gh.UNIT_REPORT_CONTEXT}`), gh.UNIT_REPORT_CONTEXT);
+  assert.notEqual(gh.UNIT_REPORT_CONTEXT, 'unit', 'must never shadow the required `unit` check');
+});
+
+test('the status lands on the PR head sha, not the throwaway merge commit', () => {
+  assert.ok(reportJob.includes('github.event.pull_request.head.sha || github.sha'));
+});
+
+test('builder-controlled text reaches the script through env, never inline interpolation', () => {
+  const run = reportJob.slice(reportJob.indexOf('run: |'));
+  assert.ok(!run.includes('${{'), 'no ${{ }} inside the run script');
+});
+
+test('a cancelled run reports nothing, and a failed post never reds the job', () => {
+  assert.match(reportJob, /if: \$\{\{ !cancelled\(\) \}\}/);
+  assert.match(reportJob, /\|\| echo "::warning::/);
+});
+
+test('redPrLine names the failing tests when the server could read them', () => {
+  const l = redPrLine({ reason: 'failing_check:unit-report', failing_tests: '1 failed: security' });
+  assert.ok(l.includes('1 failed: security'), l);
+  assert.ok(l.includes('node tests/'), 'says how to reproduce it');
+});
+
+test('redPrLine says the list is blind, and that a retry cannot help', () => {
+  const l = redPrLine({ reason: 'failing_check_unreadable', checks_unreadable: true, failing_tests: null });
+  assert.match(l, /cannot see which check failed/);
+  assert.match(l, /Checks: read/);
+  assert.match(l, /npm test/);
+});
+
+test('redPrLine falls back to the check name, and is silent when nothing is red', () => {
+  assert.ok(redPrLine({ reason: 'failing_check:unit' }).includes('`unit`'));
+  for (const quiet of [null, {}, { reason: 'review_required' }, { reason: 'blocked_required_review_or_pending_check' }]) {
+    assert.equal(redPrLine(quiet), null);
+  }
+});
+
+console.log(`\nunit-report status (task 1003988) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;