@mindrian_os/install 1.13.0-beta.16 → 1.13.0-beta.19

package/lib/core/room-discard-cascade.cjs

@@ -0,0 +1,225 @@
+'use strict';
+/*
+ * Phase 119-01 -- Transactionally-safe placeholder room discard cascade.
+ *
+ * Per CONTEXT.md D-06 + Architectural Decision item 4: when the user picks
+ * [discard room] in the F.1 selector, the entire placeholder is removed:
+ * room.db rows + STATE.md + MINTO.md + section folders + ROOM.md identity
+ * files + registry entry. Wrapped in a SQLite transaction + ordered fs ops
+ * so a partial failure is recoverable.
+ *
+ * Cascade ORDER (matters; the reverse-order rollback is unwinding):
+ *   1. Open room.db handle (room-db.cjs::openRoomDb -- the canonical opener
+ *      that applies the Phase 109 nodes-provenance + session_focus migrations
+ *      the memory_event log depends on).
+ *   2. BEGIN sqlite transaction.
+ *   3. emit room_discarded memory_event INSIDE the transaction (via navigation.cjs).
+ *   4. COMMIT transaction.
+ *   5. Close room.db handle (handle MUST close before file removal).
+ *   6. execFileSync bash scripts/room-registry archive <slug> + direct
+ *      registry-key removal (the archive subcommand soft-deletes; we want hard
+ *      removal because the user picked [discard room]).
+ *   7. fs.rmSync($roomsHome/$slug, {recursive: true, force: true}) (LAST -- the
+ *      fs removal is final; the registry archive is rollback-able by a
+ *      recovery script; the memory_event is durable in the rooms-meta.db
+ *      fallback).
+ *
+ * Partial-failure recovery: if step 7 fails, emit a room_discard_partial_failure
+ * memory_event to a SEPARATE .rooms/rooms-meta.db at the rooms-home level (the
+ * room.db is either gone or in an inconsistent state). The rooms-meta.db is a
+ * Phase 119-01 introduced artifact for the discard recovery signal ONLY; future
+ * phases may consolidate this into the central registry-host db.
+ *
+ * Guard: only PLACEHOLDER slugs (matching PLACEHOLDER_SLUG_RE from Plan 119-00)
+ * are discardable via this cascade. Non-placeholder rooms MUST go through
+ * /mos:rooms archive.
+ *
+ * Canon Part 8: pure-local; no Brain MCP coupling.
+ * Canon Part 9: ALL memory_event writes route through navigation.cjs::logMemoryEvent.
+ * Canon Part 10 sub-claim 3: discard is a typed graph event (the placeholder
+ *   becomes graph data even on departure).
+ * Em-dash discipline: uses `--` never the U+2014 character per HARD RULE.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const child_process = require('node:child_process');
+
+// Cross-import the Plan 119-00 placeholder pattern (the cascade refuses any
+// slug that does not match this regex).
+const { PLACEHOLDER_SLUG_RE } = require('./room-auto-create.cjs');
+
+/**
+ * discardPlaceholderRoom(roomsHome, slug, opts) -> {ok, slug, rolled_back_*, ...}
+ *
+ * @param {string} roomsHome
+ * @param {string} slug           must match PLACEHOLDER_SLUG_RE
+ * @param {object} opts
+ * @param {string} [opts.decided_by]   collaborator identity for the memory_event payload
+ * @returns {{ok, slug, rolled_back_db, rolled_back_fs, rolled_back_registry, partial_failure_event_id?, reason?}}
+ */
+function discardPlaceholderRoom(roomsHome, slug, opts) {
+  const options = opts || {};
+  const result = {
+    ok: false,
+    slug: slug,
+    rolled_back_db: false,
+    rolled_back_fs: false,
+    rolled_back_registry: false,
+  };
+
+  // Guard 1: placeholder slug invariant.
+  if (typeof slug !== 'string' || !PLACEHOLDER_SLUG_RE.test(slug)) {
+    result.reason = 'not_a_placeholder_slug';
+    return result;
+  }
+
+  const roomDir = path.join(roomsHome, slug);
+  const dbPath = path.join(roomDir, '.mindrian', 'room.db');
+
+  // Guard 2: roomDir must exist.
+  if (!fs.existsSync(roomDir)) {
+    result.reason = 'room_dir_not_found';
+    return result;
+  }
+
+  // Steps 1-5: room_discarded memory_event INSIDE a sqlite transaction.
+  let dbHandle = null;
+  try {
+    if (fs.existsSync(dbPath)) {
+      // Use room-db.cjs::openRoomDb (canonical opener; applies Phase 109
+      // migrations) per the Plan 119-00 Rule 3 deviation. The plan invoked
+      // lazygraph-ops.openRoomDb which does not exist; this is the canonical
+      // surface.
+      const { openRoomDb, closeRoomDb } = require('./room-db.cjs');
+      dbHandle = openRoomDb(roomDir);
+      if (dbHandle) {
+        const nav = require('./navigation.cjs');
+        try {
+          dbHandle.exec('BEGIN');
+          const eventResult = nav.logMemoryEvent(dbHandle, 'room_discarded', {
+            previous_slug: slug,
+            decided_by: options.decided_by || 'anonymous',
+            source_path: 'system:room-discard-cascade',
+            created_by: 'system',
+          });
+          if (eventResult && eventResult.ok) {
+            dbHandle.exec('COMMIT');
+            result.rolled_back_db = true;
+          } else {
+            try { dbHandle.exec('ROLLBACK'); } catch (_e2) { /* swallow */ }
+          }
+        } catch (_e) {
+          try { dbHandle.exec('ROLLBACK'); } catch (_e2) { /* swallow */ }
+        } finally {
+          try { closeRoomDb(dbHandle); } catch (_e2) { /* swallow */ }
+          dbHandle = null;
+        }
+      }
+    }
+  } catch (_e) {
+    // room-db unavailable -- skip the db step; the registry purge + fs.rmSync
+    // still proceed because the durable graph signal is best-effort.
+    if (dbHandle) {
+      try { dbHandle.close(); } catch (_e2) { /* swallow */ }
+      dbHandle = null;
+    }
+  }
+
+  // Step 6: registry archive + direct key removal.
+  try {
+    const registryScript = path.join(__dirname, '..', '..', 'scripts', 'room-registry');
+    if (fs.existsSync(registryScript)) {
+      try {
+        child_process.execFileSync('bash', [registryScript, 'archive', slug], {
+          cwd: process.cwd(),
+          env: Object.assign({}, process.env, { MINDRIAN_ROOMS_HOME: roomsHome }),
+          stdio: 'pipe',
+          timeout: 5000,
+        });
+      } catch (_archiveErr) {
+        // archive may fail if entry doesn't exist; continue to direct mutation.
+      }
+    }
+    // Direct registry mutation: remove the key entirely (the archive subcommand
+    // sets status=archived; the discard cascade goes further by deleting the key).
+    const registryPath = path.join(roomsHome, '.rooms', 'registry.json');
+    if (fs.existsSync(registryPath)) {
+      const raw = fs.readFileSync(registryPath, 'utf8');
+      const reg = JSON.parse(raw);
+      if (reg && typeof reg.rooms === 'object' && reg.rooms[slug]) {
+        delete reg.rooms[slug];
+        if (reg.active === slug) reg.active = '';
+        const tmpPath = registryPath + '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2, 8);
+        fs.writeFileSync(tmpPath, JSON.stringify(reg, null, 2), 'utf8');
+        fs.renameSync(tmpPath, registryPath);
+        result.rolled_back_registry = true;
+      } else if (reg && typeof reg.rooms === 'object') {
+        // Entry already absent (idempotent path); mark as registry purged.
+        result.rolled_back_registry = true;
+      }
+    } else {
+      // No registry to purge; treat as nothing-to-do success for this step.
+      result.rolled_back_registry = true;
+    }
+  } catch (registryErr) {
+    // Registry update failed -- record partial failure and bail out before fs.rmSync.
+    _emitPartialFailure(roomsHome, slug, result, registryErr);
+    return result;
+  }
+
+  // Step 7: filesystem rmSync (LAST -- final, irreversible). On failure, emit the
+  // partial-failure memory_event to a fallback rooms-meta.db so /mos:doctor can
+  // find the orphaned directory + the archived-but-still-present registry footprint.
+  try {
+    fs.rmSync(roomDir, { recursive: true, force: true });
+    if (!fs.existsSync(roomDir)) {
+      result.rolled_back_fs = true;
+    }
+  } catch (fsErr) {
+    _emitPartialFailure(roomsHome, slug, result, fsErr);
+    return result;
+  }
+
+  result.ok = result.rolled_back_fs && result.rolled_back_registry;
+  return result;
+}
+
+/**
+ * Internal: emit the room_discard_partial_failure memory_event to a fallback
+ * .rooms-meta.db at the rooms-home level. This is the recovery hook /mos:doctor
+ * --orphaned-room-cleanup uses to find orphaned placeholder rooms (the v1.13.0
+ * housekeeping pass; THIS plan only ships the recovery signal).
+ */
+function _emitPartialFailure(roomsHome, slug, result, err) {
+  const error_short = String(err && err.message || err).slice(0, 60);
+  result.reason = error_short;
+  try {
+    const metaRoomDir = path.join(roomsHome, '.rooms', '_meta');
+    // _meta is a synthetic "room dir" containing a real room.db; we use the
+    // canonical openRoomDb opener with the standard .mindrian/room.db nesting.
+    fs.mkdirSync(path.join(metaRoomDir, '.mindrian'), { recursive: true, mode: 0o755 });
+    const { openRoomDb, closeRoomDb } = require('./room-db.cjs');
+    const handle = openRoomDb(metaRoomDir);
+    if (handle) {
+      const nav = require('./navigation.cjs');
+      const eventResult = nav.logMemoryEvent(handle, 'room_discard_partial_failure', {
+        previous_slug: slug,
+        partial_state: {
+          fs_removed: result.rolled_back_fs,
+          registry_purged: result.rolled_back_registry,
+          db_dropped: result.rolled_back_db,
+        },
+        error_short: error_short,
+        source_path: 'system:room-discard-cascade',
+        created_by: 'system',
+      });
+      if (eventResult && eventResult.ok) {
+        result.partial_failure_event_id = eventResult.eventId;
+      }
+      try { closeRoomDb(handle); } catch (_e2) { /* swallow */ }
+    }
+  } catch (_e) { /* if even the partial-failure emission fails, swallow */ }
+}
+
+module.exports = { discardPlaceholderRoom: discardPlaceholderRoom };

package/lib/core/room-discard-cascade.test.cjs

@@ -0,0 +1,135 @@
+'use strict';
+// Phase 119-01 Task 2 tests for lib/core/room-discard-cascade.cjs.
+// Validates the happy-path cascade, the guard for non-placeholder slugs,
+// the partial-failure recovery via rooms-meta.db, and the Canon Part 8/9
+// invariants (no Brain coupling; writes through navigation.cjs chokepoint).
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+const { discardPlaceholderRoom } = require('./room-discard-cascade.cjs');
+const { openRoomDb, closeRoomDb } = require('./room-db.cjs');
+
+function _mkPlaceholderRoom(slug) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'discard-cascade-test-'));
+  fs.mkdirSync(path.join(tmp, '.rooms'), { recursive: true });
+  const roomDir = path.join(tmp, slug);
+  fs.mkdirSync(roomDir, { recursive: true });
+  fs.writeFileSync(path.join(roomDir, '.room-root'), '');
+  // Bootstrap a real room.db (the canonical opener auto-creates the file).
+  const db = openRoomDb(roomDir);
+  closeRoomDb(db);
+  // Seed registry.
+  const reg = {
+    version: 1,
+    active: slug,
+    rooms: {
+      [slug]: {
+        path: roomDir,
+        venture_name: 'untitled',
+        venture_stage: 'Pre-Opportunity',
+        status: 'active',
+        last_opened: Date.now(),
+      },
+    },
+  };
+  fs.writeFileSync(path.join(tmp, '.rooms', 'registry.json'), JSON.stringify(reg, null, 2), 'utf8');
+  return { roomsHome: tmp, roomDir, slug };
+}
+
+function _cleanup(roomsHome) {
+  try { fs.rmSync(roomsHome, { recursive: true, force: true }); } catch (_e) {}
+}
+
+test('Test 10: discardPlaceholderRoom happy path -- transactional rollback flags all true', function () {
+  const { roomsHome, roomDir, slug } = _mkPlaceholderRoom('untitled-2026-05-16-1845');
+  try {
+    const r = discardPlaceholderRoom(roomsHome, slug, { decided_by: 'jsagi' });
+    assert.strictEqual(r.ok, true, 'cascade must succeed; got ' + JSON.stringify(r));
+    assert.strictEqual(r.slug, slug);
+    assert.strictEqual(r.rolled_back_fs, true);
+    assert.strictEqual(r.rolled_back_registry, true);
+    assert.strictEqual(r.rolled_back_db, true, 'memory_event must land inside transaction');
+    // Filesystem assertion: directory no longer exists.
+    assert.ok(!fs.existsSync(roomDir), 'roomDir must be removed');
+    // Registry assertion: slug removed from rooms map.
+    const reg = JSON.parse(fs.readFileSync(path.join(roomsHome, '.rooms', 'registry.json'), 'utf8'));
+    assert.ok(!reg.rooms[slug], 'registry entry must be purged');
+    assert.strictEqual(reg.active, '', 'active must be cleared when active room is discarded');
+  } finally { _cleanup(roomsHome); }
+});
+
+test('Test 11: discardPlaceholderRoom on fs.rmSync failure -> partial-failure recovery via rooms-meta.db', function () {
+  const { roomsHome, roomDir, slug } = _mkPlaceholderRoom('untitled-2026-05-16-1900');
+  try {
+    // Monkey-patch fs.rmSync to throw EACCES the FIRST time it's called on
+    // roomDir (the discard cascade calls it on the target room). Other paths
+    // (tmp files etc.) must still work.
+    const origRmSync = fs.rmSync;
+    let tripped = false;
+    fs.rmSync = function (target, opts) {
+      if (!tripped && typeof target === 'string' && target === roomDir) {
+        tripped = true;
+        const err = new Error('EACCES: permission denied');
+        err.code = 'EACCES';
+        throw err;
+      }
+      return origRmSync.call(fs, target, opts);
+    };
+    try {
+      const r = discardPlaceholderRoom(roomsHome, slug, { decided_by: 'jsagi' });
+      assert.strictEqual(r.ok, false, 'cascade must fail when fs.rmSync throws');
+      assert.strictEqual(r.rolled_back_fs, false, 'fs MUST remain not-removed on EACCES');
+      // Directory must still exist (the cascade bounded the failure).
+      assert.ok(fs.existsSync(roomDir), 'roomDir must still exist after partial failure');
+      // partial_failure_event_id should be populated.
+      assert.ok(typeof r.partial_failure_event_id === 'string' && r.partial_failure_event_id.length > 0,
+        'partial_failure_event_id must be set; got ' + JSON.stringify(r));
+      // rooms-meta.db file must exist on disk.
+      const metaDbPath = path.join(roomsHome, '.rooms', '_meta', '.mindrian', 'room.db');
+      assert.ok(fs.existsSync(metaDbPath), 'rooms-meta.db must materialize for recovery');
+    } finally {
+      fs.rmSync = origRmSync;
+    }
+  } finally { _cleanup(roomsHome); }
+});
+
+test('Test 12: guard -- non-placeholder slug is refused (must go through /mos:rooms archive)', function () {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'discard-guard-test-'));
+  try {
+    const r = discardPlaceholderRoom(tmp, 'acme-robotics', {});
+    assert.strictEqual(r.ok, false);
+    assert.strictEqual(r.reason, 'not_a_placeholder_slug');
+    assert.strictEqual(r.rolled_back_db, false);
+    assert.strictEqual(r.rolled_back_fs, false);
+    assert.strictEqual(r.rolled_back_registry, false);
+  } finally { try { fs.rmSync(tmp, { recursive: true, force: true }); } catch (_e) {} }
+});
+
+test('Test 13: Canon Part 9 chokepoint -- writes route through navigation.cjs::logMemoryEvent', function () {
+  const src = fs.readFileSync(require.resolve('./room-discard-cascade.cjs'), 'utf8');
+  // No direct SQL INSERT into nodes (the chokepoint owns INSERTs).
+  assert.ok(!/db\.prepare\(\s*['\"]INSERT/.test(src),
+    'direct SQL INSERT detected -- writes MUST go through navigation.cjs::logMemoryEvent');
+  // Must call logMemoryEvent at least twice (room_discarded + room_discard_partial_failure).
+  const matches = src.match(/logMemoryEvent\(/g) || [];
+  assert.ok(matches.length >= 2, 'expected >= 2 logMemoryEvent calls; got ' + matches.length);
+});
+
+test('Test 14: Canon Part 8 -- no Brain coupling', function () {
+  const src = fs.readFileSync(require.resolve('./room-discard-cascade.cjs'), 'utf8');
+  assert.ok(src.indexOf('brain.mindrian') === -1, 'brain.mindrian substring present (Canon Part 8 breach)');
+  assert.ok(!/require\([^)]*brain-client[^)]*\)/.test(src), 'brain-client require (Canon Part 8 breach)');
+  assert.ok(!/fetch\([^)]*['\"][^'\"]*brain[^'\"]*['\"]/.test(src), 'fetch to brain.* host (Canon Part 8 breach)');
+});
+
+test('Test 15: em-dash invariant', function () {
+  const EMDASH = String.fromCharCode(0x2014);
+  const srcCascade = fs.readFileSync(require.resolve('./room-discard-cascade.cjs'), 'utf8');
+  const srcValidator = fs.readFileSync(require.resolve('./room-name-validator.cjs'), 'utf8');
+  assert.ok(srcCascade.indexOf(EMDASH) === -1, 'em-dash present in room-discard-cascade.cjs (HARD RULE)');
+  assert.ok(srcValidator.indexOf(EMDASH) === -1, 'em-dash present in room-name-validator.cjs (HARD RULE)');
+});

package/lib/core/room-name-validator.cjs

@@ -0,0 +1,132 @@
+'use strict';
+/*
+ * Phase 119-01 -- Room name validator (four rejection classes).
+ *
+ * Per CONTEXT.md Architectural Decision item 5: when the user picks
+ * [type your own name] in the F.1 selector, this validator runs.
+ * Four rejection classes: collision, fs-unsafe chars, reserved untitled-
+ * prefix, empty / whitespace. On any failure, the F.1 selector re-prompts
+ * inline with the rejection reason; it MUST NOT fall back to a different
+ * F.1 option silently.
+ *
+ * Defense-in-depth: a fifth class (Windows-reserved device names) is also
+ * surfaced because rooms may sync across CLI / Desktop / Cowork surfaces per
+ * CLAUDE.md tri-polar HARD RULE; a Linux/macOS-named room that collides with
+ * a Windows reserved device name (CON, PRN, LPT1...) breaks the user's room
+ * the moment it syncs to a Windows machine.
+ *
+ * Canon Part 8 invariant: pure-local; no Brain MCP, no fetch, no telemetry.
+ * Em-dash discipline: uses `--` never the U+2014 character per HARD RULE.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// Canonical slug pattern: lowercase letters, digits, hyphens.
+// Minimum 3 chars to avoid single-letter directory names that clash with
+// common filesystem temp patterns. Maximum 64 chars per /mos:rooms list
+// rendering budget (the registry render uses fixed-column alignment).
+const FS_SAFE_SLUG_RE = Object.freeze(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/);
+
+// Reserved-prefix namespaces that the user MUST NOT manually claim.
+// 'untitled-' is reserved by the Phase 119-00 placeholder pattern.
+const RESERVED_PREFIXES = Object.freeze(['untitled-']);
+
+// Windows reserved device names (the validator surfaces these even on Linux/
+// macOS because rooms may sync across surfaces per CLAUDE.md tri-polar rule).
+const WINDOWS_RESERVED = Object.freeze(new Set([
+  'con', 'prn', 'aux', 'nul',
+  'com1', 'com2', 'com3', 'com4', 'com5', 'com6', 'com7', 'com8', 'com9',
+  'lpt1', 'lpt2', 'lpt3', 'lpt4', 'lpt5', 'lpt6', 'lpt7', 'lpt8', 'lpt9',
+]));
+
+/**
+ * validateRoomName(candidate, opts) -> {ok, normalized_slug, reasons}
+ *
+ * @param {string} candidate    user input (free-text, untrusted)
+ * @param {object} opts
+ * @param {string} [opts.roomsHome]  absolute path to $ROOMS_HOME for collision check
+ * @returns {{ok: boolean, normalized_slug: string, reasons: string[]}}
+ */
+function validateRoomName(candidate, opts) {
+  const options = opts || {};
+  const reasons = [];
+
+  // Rejection class 4: empty / whitespace.
+  if (typeof candidate !== 'string') {
+    return { ok: false, normalized_slug: '', reasons: ['empty'] };
+  }
+  const trimmed = candidate.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, normalized_slug: '', reasons: ['empty'] };
+  }
+
+  // Normalize: lowercase + trim. We do NOT silently substitute unsafe chars;
+  // unsafe input surfaces the fs_unsafe_chars rejection so the user can fix it.
+  const normalized = trimmed.toLowerCase();
+
+  // Rejection class 3: reserved prefix. Match the canonical hyphenated form
+  // (RESERVED_PREFIXES e.g. 'untitled-') AND the broader 'untitled' family
+  // head (bare 'untitled' OR 'untitled' followed by any non-alphanumeric
+  // separator). This closes the "untitled/with-slash" / "untitled.foo"
+  // namespace-escape vectors while still allowing names like 'untitledly'
+  // to pass the reserved-prefix gate (they will still hit fs_unsafe_chars
+  // if non-canonical).
+  for (const prefix of RESERVED_PREFIXES) {
+    if (normalized.indexOf(prefix) === 0) {
+      reasons.push('reserved_prefix:' + prefix);
+      break;
+    }
+  }
+  // Bare 'untitled' OR 'untitled' followed by a non-alphanumeric separator
+  // (slash, dot, space, etc.) is also reserved.
+  if (reasons.indexOf('reserved_prefix:untitled-') === -1) {
+    if (normalized === 'untitled' || /^untitled[^a-z0-9]/.test(normalized)) {
+      reasons.push('reserved_prefix:untitled-');
+    }
+  }
+
+  // Rejection class 2: fs-unsafe characters / shape.
+  if (!FS_SAFE_SLUG_RE.test(normalized)) {
+    reasons.push('fs_unsafe_chars');
+  }
+  // Defense-in-depth: Windows reserved device names (regardless of platform).
+  if (WINDOWS_RESERVED.has(normalized)) {
+    reasons.push('windows_reserved');
+  }
+
+  // Rejection class 1: collision check (registry + on-disk).
+  if (options.roomsHome && typeof options.roomsHome === 'string') {
+    const registryPath = path.join(options.roomsHome, '.rooms', 'registry.json');
+    try {
+      if (fs.existsSync(registryPath)) {
+        const raw = fs.readFileSync(registryPath, 'utf8');
+        const reg = JSON.parse(raw);
+        const rooms = (reg && typeof reg.rooms === 'object') ? reg.rooms : {};
+        if (Object.prototype.hasOwnProperty.call(rooms, normalized)) {
+          reasons.push('collision');
+        }
+        // Defense-in-depth: registry may be out of sync with disk.
+        const candidateDir = path.join(options.roomsHome, normalized);
+        if (fs.existsSync(candidateDir) && reasons.indexOf('collision') === -1) {
+          reasons.push('collision');
+        }
+      }
+    } catch (_e) {
+      // Registry unreadable -- skip collision check; degrade open.
+    }
+  }
+
+  return {
+    ok: reasons.length === 0,
+    normalized_slug: normalized,
+    reasons: reasons,
+  };
+}
+
+module.exports = {
+  validateRoomName: validateRoomName,
+  FS_SAFE_SLUG_RE: FS_SAFE_SLUG_RE,
+  RESERVED_PREFIXES: RESERVED_PREFIXES,
+  WINDOWS_RESERVED: WINDOWS_RESERVED,
+};

package/lib/core/room-name-validator.test.cjs

@@ -0,0 +1,156 @@
+'use strict';
+// Phase 119-01 Task 2 tests for lib/core/room-name-validator.cjs.
+// Validates FS_SAFE_SLUG_RE shape + 4 rejection classes + Windows-reserved
+// defense-in-depth + normalization + multi-rejection compounding.
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+const { validateRoomName, FS_SAFE_SLUG_RE, RESERVED_PREFIXES, WINDOWS_RESERVED } = require('./room-name-validator.cjs');
+
+function _mkTmpRoomsHome() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'room-validator-test-'));
+  fs.mkdirSync(path.join(tmp, '.rooms'), { recursive: true });
+  return tmp;
+}
+
+function _seedRegistry(roomsHome, rooms) {
+  const reg = { version: 1, active: '', rooms: rooms || {} };
+  fs.writeFileSync(path.join(roomsHome, '.rooms', 'registry.json'), JSON.stringify(reg, null, 2), 'utf8');
+}
+
+test('Test 1: FS_SAFE_SLUG_RE accepts canonical slugs', function () {
+  assert.ok(FS_SAFE_SLUG_RE.test('acme-robotics'));
+  assert.ok(FS_SAFE_SLUG_RE.test('biotech-imaging-v2'));
+  assert.ok(FS_SAFE_SLUG_RE.test('a-b'));
+  assert.ok(FS_SAFE_SLUG_RE.test('abc'));
+});
+
+test('Test 2: FS_SAFE_SLUG_RE rejects unsafe chars', function () {
+  assert.ok(!FS_SAFE_SLUG_RE.test('acme/robotics'));
+  assert.ok(!FS_SAFE_SLUG_RE.test('acme robotics'));
+  assert.ok(!FS_SAFE_SLUG_RE.test('acme.robotics'));
+  assert.ok(!FS_SAFE_SLUG_RE.test('../etc'));
+  assert.ok(!FS_SAFE_SLUG_RE.test('.hidden'));
+  // Single char and leading-hyphen
+  assert.ok(!FS_SAFE_SLUG_RE.test('a'));
+  assert.ok(!FS_SAFE_SLUG_RE.test('-ab'));
+  assert.ok(!FS_SAFE_SLUG_RE.test('ab-'));
+});
+
+test('Test 3: collision rejection -- registry has an entry with the same slug', function () {
+  const roomsHome = _mkTmpRoomsHome();
+  try {
+    _seedRegistry(roomsHome, { 'acme-robotics': { path: '/tmp/acme', venture_name: 'acme', status: 'active' } });
+    const r = validateRoomName('acme-robotics', { roomsHome });
+    assert.strictEqual(r.ok, false);
+    assert.strictEqual(r.normalized_slug, 'acme-robotics');
+    assert.ok(r.reasons.indexOf('collision') !== -1, 'expected collision reason; got ' + JSON.stringify(r.reasons));
+  } finally {
+    try { fs.rmSync(roomsHome, { recursive: true, force: true }); } catch (_e) {}
+  }
+});
+
+test('Test 4: fs-unsafe rejection', function () {
+  const roomsHome = _mkTmpRoomsHome();
+  try {
+    _seedRegistry(roomsHome, {});
+    const r = validateRoomName('acme/robotics', { roomsHome });
+    assert.strictEqual(r.ok, false);
+    assert.ok(r.reasons.indexOf('fs_unsafe_chars') !== -1, 'expected fs_unsafe_chars; got ' + JSON.stringify(r.reasons));
+  } finally {
+    try { fs.rmSync(roomsHome, { recursive: true, force: true }); } catch (_e) {}
+  }
+});
+
+test('Test 5: reserved-prefix rejection (untitled-* AND bare untitled)', function () {
+  const roomsHome = _mkTmpRoomsHome();
+  try {
+    _seedRegistry(roomsHome, {});
+    const r1 = validateRoomName('untitled-mything', { roomsHome });
+    assert.strictEqual(r1.ok, false);
+    assert.ok(r1.reasons.indexOf('reserved_prefix:untitled-') !== -1, 'expected reserved_prefix; got ' + JSON.stringify(r1.reasons));
+
+    const r2 = validateRoomName('untitled', { roomsHome });
+    assert.strictEqual(r2.ok, false);
+    assert.ok(r2.reasons.indexOf('reserved_prefix:untitled-') !== -1, 'expected reserved_prefix on bare untitled; got ' + JSON.stringify(r2.reasons));
+  } finally {
+    try { fs.rmSync(roomsHome, { recursive: true, force: true }); } catch (_e) {}
+  }
+});
+
+test('Test 6: empty / whitespace-only rejection', function () {
+  const r1 = validateRoomName('', {});
+  assert.strictEqual(r1.ok, false);
+  assert.deepStrictEqual(r1.reasons, ['empty']);
+
+  const r2 = validateRoomName('   ', {});
+  assert.strictEqual(r2.ok, false);
+  assert.deepStrictEqual(r2.reasons, ['empty']);
+
+  const r3 = validateRoomName('\t\n', {});
+  assert.strictEqual(r3.ok, false);
+  assert.deepStrictEqual(r3.reasons, ['empty']);
+
+  const r4 = validateRoomName(null, {});
+  assert.strictEqual(r4.ok, false);
+  assert.deepStrictEqual(r4.reasons, ['empty']);
+});
+
+test('Test 7: multi-rejection compounding (fs_unsafe + reserved_prefix)', function () {
+  const roomsHome = _mkTmpRoomsHome();
+  try {
+    _seedRegistry(roomsHome, {});
+    const r = validateRoomName('untitled/with-slash', { roomsHome });
+    assert.strictEqual(r.ok, false);
+    assert.ok(r.reasons.indexOf('fs_unsafe_chars') !== -1, 'expected fs_unsafe_chars in reasons');
+    assert.ok(r.reasons.indexOf('reserved_prefix:untitled-') !== -1, 'expected reserved_prefix in reasons');
+  } finally {
+    try { fs.rmSync(roomsHome, { recursive: true, force: true }); } catch (_e) {}
+  }
+});
+
+test('Test 8: happy path -- valid slug + empty registry', function () {
+  const roomsHome = _mkTmpRoomsHome();
+  try {
+    _seedRegistry(roomsHome, {});
+    const r = validateRoomName('acme-robotics', { roomsHome });
+    assert.strictEqual(r.ok, true);
+    assert.strictEqual(r.normalized_slug, 'acme-robotics');
+    assert.deepStrictEqual(r.reasons, []);
+  } finally {
+    try { fs.rmSync(roomsHome, { recursive: true, force: true }); } catch (_e) {}
+  }
+});
+
+test('Test 9: normalization -- trim + lowercase', function () {
+  const roomsHome = _mkTmpRoomsHome();
+  try {
+    _seedRegistry(roomsHome, {});
+    const r = validateRoomName('  Acme-Robotics  ', { roomsHome });
+    assert.strictEqual(r.ok, true);
+    assert.strictEqual(r.normalized_slug, 'acme-robotics');
+    assert.deepStrictEqual(r.reasons, []);
+  } finally {
+    try { fs.rmSync(roomsHome, { recursive: true, force: true }); } catch (_e) {}
+  }
+});
+
+test('Test 10: Windows-reserved defense-in-depth (CON / PRN / LPT1)', function () {
+  for (const name of ['con', 'CON', 'prn', 'lpt1', 'aux']) {
+    const r = validateRoomName(name, {});
+    assert.strictEqual(r.ok, false, 'expected ok=false for ' + name);
+    assert.ok(r.reasons.indexOf('windows_reserved') !== -1, 'expected windows_reserved for ' + name + '; got ' + JSON.stringify(r.reasons));
+  }
+});
+
+test('Test 11: source-grep -- no Brain coupling + no em-dash', function () {
+  const src = fs.readFileSync(require.resolve('./room-name-validator.cjs'), 'utf8');
+  assert.ok(src.indexOf('brain.mindrian') === -1, 'brain.mindrian substring present (Canon Part 8 breach)');
+  assert.ok(!/require\([^)]*brain-client[^)]*\)/.test(src), 'brain-client require (Canon Part 8 breach)');
+  const EMDASH = String.fromCharCode(0x2014);
+  assert.ok(src.indexOf(EMDASH) === -1, 'em-dash present (HARD RULE)');
+});