@vibe-agent-toolkit/utils 0.2.0-rc.3 → 0.2.0-rc.5

package/dist/testing.d.ts

@@ -1,8 +1,78 @@
 /**
- * @vibe-agent-toolkit/utils/testing
+ * Fixture primitives shared by suites in more than one package.
  *
- * Isolated temp-directory helpers for test suites. Node-only. Intended for
- * a consumer's test code — not for their shipped runtime.
+ * Deliberately framework-free: nothing here imports `vitest`, so this module
+ * stays a plain function library rather than something that registers hooks as a
+ * side effect of being imported. Each suite owns its own `beforeEach`/
+ * `afterEach` and calls these from inside them — two lines, which is below
+ * anything worth sharing, while the part that is genuinely identical (mkdtemp,
+ * write the literal, remove the tree) lives here once.
+ *
+ * It earned a home in `utils` the ordinary way: two packages needed it, not one
+ * package speculating that a second might.
+ *
+ * ⛔ **Do not import `vitest` here to share the hook wrapper itself.**
+ * `subpath-purity.test.ts` pins this entry at an EMPTY third-party set, and that
+ * pin is load-bearing: `./testing` is a published subpath, so a test framework
+ * reached from it becomes a runtime requirement for every adopter who imports
+ * it. {@link replantableCorpus} exists precisely so the per-test wrapper each
+ * suite still writes is three lines rather than twelve.
  */
 export * from './test-helpers.js';
+/** A planted fixture tree and the means to remove it. */
+export interface TempCorpus {
+    /** Absolute path to the tree's root. */
+    root: string;
+    /** Remove the tree. Safe to call when it is already gone. */
+    cleanup: () => void;
+}
+/**
+ * Write a literal corpus into a fresh temp directory.
+ *
+ * 🪤 Fixture files must NOT be byte-identical to each other when the suite is
+ * about content-addressed behaviour: VAT's blobs are keyed on their bytes plus
+ * the parser kind, so two files with the same content collapse into ONE blob and
+ * assertions then describe whichever path sorted first. Give each fixture a
+ * distinguishing marker line.
+ *
+ * ⚠️ The root is minted per call, so a suite that plants per test must call this
+ * per test — a root captured once and reused across tests survives its own
+ * `cleanup`.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content; written verbatim as UTF-8.
+ *   Names may include forward-slash subpaths only if their parents already exist
+ * @returns The tree's root and its teardown
+ */
+export declare function createTempCorpus(prefix: string, corpus: Readonly<Record<string, string>>): TempCorpus;
+/** A corpus that can be planted and cleared repeatedly — one tree per test. */
+export interface ReplantableCorpus {
+    /** Plant a fresh tree. Drive from the suite's `beforeEach`. */
+    plant: () => void;
+    /** Remove the current tree, if any. Drive from the suite's `afterEach`. */
+    clear: () => void;
+    /** The root minted by the most recent {@link plant}. */
+    root: () => string;
+}
+/**
+ * Hold a per-test corpus root, so a suite's hook wrapper is three lines.
+ *
+ * ⚠️ **The root comes back through a GETTER, never as a value.** A per-test
+ * fixture is reminted for every test, so a root captured at registration time is
+ * `undefined` in the first test and stale in every one after it. That mistake is
+ * the reason this holder exists rather than each suite keeping its own `let`.
+ *
+ * ⭐ Framework-free on purpose: it takes no hooks and registers none, so the
+ * suite still owns its own `beforeEach`/`afterEach` and this module keeps the
+ * empty third-party set its purity pin asserts. See the module docstring.
+ *
+ * 🪤 `root()` before the first `plant()` THROWS by name. The shape it replaced
+ * read an uninitialised `let` and raised `Cannot read properties of undefined`
+ * from inside the fixture, which names neither the suite nor the missing hook.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content, as {@link createTempCorpus} takes it
+ * @returns Plant/clear/root, to be driven from the caller's own hooks
+ */
+export declare function replantableCorpus(prefix: string, corpus: Readonly<Record<string, string>>): ReplantableCorpus;
 //# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAUH,cAAc,mBAAmB,CAAC;AAElC,yDAAyD;AACzD,MAAM,WAAW,UAAU;IACzB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACvC,UAAU,CAOZ;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,wDAAwD;IACxD,IAAI,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACvC,iBAAiB,CAyBnB"}

package/dist/testing.js

@@ -1,8 +1,98 @@
 /**
- * @vibe-agent-toolkit/utils/testing
+ * Fixture primitives shared by suites in more than one package.
  *
- * Isolated temp-directory helpers for test suites. Node-only. Intended for
- * a consumer's test code — not for their shipped runtime.
+ * Deliberately framework-free: nothing here imports `vitest`, so this module
+ * stays a plain function library rather than something that registers hooks as a
+ * side effect of being imported. Each suite owns its own `beforeEach`/
+ * `afterEach` and calls these from inside them — two lines, which is below
+ * anything worth sharing, while the part that is genuinely identical (mkdtemp,
+ * write the literal, remove the tree) lives here once.
+ *
+ * It earned a home in `utils` the ordinary way: two packages needed it, not one
+ * package speculating that a second might.
+ *
+ * ⛔ **Do not import `vitest` here to share the hook wrapper itself.**
+ * `subpath-purity.test.ts` pins this entry at an EMPTY third-party set, and that
+ * pin is load-bearing: `./testing` is a published subpath, so a test framework
+ * reached from it becomes a runtime requirement for every adopter who imports
+ * it. {@link replantableCorpus} exists precisely so the per-test wrapper each
+ * suite still writes is three lines rather than twelve.
  */
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { normalizedTmpdir, safePath } from './path-utils.js';
+// The rest of the testing surface. ⚠️ This re-export is the ENTIRETY of what
+// `./testing` used to be, and dropping it silently removed `detachGitEnv`,
+// `setupSyncTempDirSuite` and every sibling from a published subpath. A module
+// that is both a definition site and a barrel loses the barrel first.
 export * from './test-helpers.js';
+/**
+ * Write a literal corpus into a fresh temp directory.
+ *
+ * 🪤 Fixture files must NOT be byte-identical to each other when the suite is
+ * about content-addressed behaviour: VAT's blobs are keyed on their bytes plus
+ * the parser kind, so two files with the same content collapse into ONE blob and
+ * assertions then describe whichever path sorted first. Give each fixture a
+ * distinguishing marker line.
+ *
+ * ⚠️ The root is minted per call, so a suite that plants per test must call this
+ * per test — a root captured once and reused across tests survives its own
+ * `cleanup`.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content; written verbatim as UTF-8.
+ *   Names may include forward-slash subpaths only if their parents already exist
+ * @returns The tree's root and its teardown
+ */
+export function createTempCorpus(prefix, corpus) {
+    const root = mkdtempSync(safePath.join(normalizedTmpdir(), prefix));
+    for (const [name, content] of Object.entries(corpus)) {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- a fixture name from the caller's own literal corpus, under this call's fresh mkdtemp root
+        writeFileSync(safePath.join(root, name), content, 'utf8');
+    }
+    return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+/**
+ * Hold a per-test corpus root, so a suite's hook wrapper is three lines.
+ *
+ * ⚠️ **The root comes back through a GETTER, never as a value.** A per-test
+ * fixture is reminted for every test, so a root captured at registration time is
+ * `undefined` in the first test and stale in every one after it. That mistake is
+ * the reason this holder exists rather than each suite keeping its own `let`.
+ *
+ * ⭐ Framework-free on purpose: it takes no hooks and registers none, so the
+ * suite still owns its own `beforeEach`/`afterEach` and this module keeps the
+ * empty third-party set its purity pin asserts. See the module docstring.
+ *
+ * 🪤 `root()` before the first `plant()` THROWS by name. The shape it replaced
+ * read an uninitialised `let` and raised `Cannot read properties of undefined`
+ * from inside the fixture, which names neither the suite nor the missing hook.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content, as {@link createTempCorpus} takes it
+ * @returns Plant/clear/root, to be driven from the caller's own hooks
+ */
+export function replantableCorpus(prefix, corpus) {
+    let planted;
+    return {
+        plant: () => {
+            // 🪤 Removes any tree still standing FIRST. Nested `describe` blocks each
+            // get their own `beforeEach` and vitest runs outer-then-inner before a
+            // single `afterEach`, so a double plant is ordinary rather than exotic.
+            // Overwriting the handle without this would leak the first tree for the
+            // process's lifetime, silently and only on the suites that nest.
+            planted?.cleanup();
+            planted = createTempCorpus(prefix, corpus);
+        },
+        clear: () => {
+            planted?.cleanup();
+            planted = undefined;
+        },
+        root: () => {
+            if (planted === undefined) {
+                throw new Error(`replantableCorpus('${prefix}'): root() before plant() — the suite is missing its beforeEach`);
+            }
+            return planted.root;
+        },
+    };
+}
 //# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,sEAAsE;AACtE,cAAc,mBAAmB,CAAC;AAUlC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,MAAwC;IAExC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,gKAAgK;QAChK,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAAwC;IAExC,IAAI,OAA+B,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,EAAE,OAAO,EAAE,CAAC;YACnB,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,OAAO,EAAE,OAAO,EAAE,CAAC;YACnB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,iEAAiE,CAC9F,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/timing-dump.d.ts

@@ -18,9 +18,14 @@
  * 2. A dump failure is written to **stderr and never thrown**. These run from
  *    an `exit` listener, where a throw changes the process's exit behaviour, and
  *    they must never touch stdout, which carries vat's report.
- * 3. A pid can file more than one dump. `vat validate` spawns the vat binary
- *    once per phase and pids are reused, so `<stem>-<pid>.json` genuinely
- *    collides; the name gains a counter rather than overwriting.
+ * 3. A pid can file more than one dump, and the name is CLAIMED rather than
+ *    checked. `vat validate` spawns the vat binary once per phase and pids are
+ *    reused, so `<stem>-<pid>.json` genuinely collides; worse, worker threads
+ *    SHARE their parent's pid, so a thread pool's whole cohort competes for one
+ *    `<stem>-<pid>` sequence at the same instant. The name gains a counter
+ *    rather than overwriting, and the counter is settled by
+ *    {@link EXCLUSIVE_CREATE} so the OS — not a check-then-write gap — decides
+ *    who won it.
  * 4. The process's own wall and CPU time is read ONCE, at dump time. It is a
  *    lifetime figure for the process and never a duration of the measured work;
  *    its value is the RATIO, which tells a reader whether the wall-timed
@@ -59,6 +64,16 @@ export interface TimingProcess {
     /** System CPU consumed by the process, across all its threads. */
     cpuSystemMs: number;
 }
+/**
+ * Ceiling on the pid-collision search. A directory holding this many dumps for
+ * one pid is a runaway, not a collision, and giving up on a reported line is a
+ * better outcome than spinning.
+ *
+ * Exhausting it does NOT fall back to overwriting the last slot. That was the
+ * old behaviour, and it destroyed a dump for the same reason the check-then-
+ * write gap did — silently, and precisely when the directory was busiest.
+ */
+export declare const MAX_DUMP_COLLISIONS = 1000;
 /**
  * Reduce a raw env value to a directory or `null`.
  *
@@ -107,13 +122,15 @@ export declare function readTimingProcess(): TimingProcess;
  * Write one seam's dump, if the seam is on.
  *
  * The body is built lazily, inside this call, so a disabled seam never pays to
- * snapshot accumulators nobody will read.
+ * snapshot accumulators nobody will read — and a `build` that throws is reported
+ * like any other failure, because this runs from an `exit` listener where a
+ * throw would change the process's exit behaviour.
  *
  * @param noun - What the seam is called, for any failure line
  * @param directory - Where to write, or `null` when the seam is off
  * @param basename - Basename stem for the file
  * @param build - Produces the dump body
- * @returns The path written, or `null` when the seam is off or the write failed
+ * @returns The path written, or `null` when the seam is off or nothing was written
  */
 export declare function writeTimingDump(noun: string, directory: string | null, basename: string, build: () => unknown): string | null;
 //# sourceMappingURL=timing-dump.d.ts.map

package/dist/timing-dump.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timing-dump.d.ts","sourceRoot":"","sources":["../src/timing-dump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAOH;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB;AAeD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,CAOjD;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,OAAO,GACnB,MAAM,GAAG,IAAI,CAYf"}
+{"version":3,"file":"timing-dump.d.ts","sourceRoot":"","sources":["../src/timing-dump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAOH;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AA6BxC;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,CAOjD;AA0DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,OAAO,GACnB,MAAM,GAAG,IAAI,CAoBf"}

package/dist/timing-dump.js

@@ -18,9 +18,14 @@
  * 2. A dump failure is written to **stderr and never thrown**. These run from
  *    an `exit` listener, where a throw changes the process's exit behaviour, and
  *    they must never touch stdout, which carries vat's report.
- * 3. A pid can file more than one dump. `vat validate` spawns the vat binary
- *    once per phase and pids are reused, so `<stem>-<pid>.json` genuinely
- *    collides; the name gains a counter rather than overwriting.
+ * 3. A pid can file more than one dump, and the name is CLAIMED rather than
+ *    checked. `vat validate` spawns the vat binary once per phase and pids are
+ *    reused, so `<stem>-<pid>.json` genuinely collides; worse, worker threads
+ *    SHARE their parent's pid, so a thread pool's whole cohort competes for one
+ *    `<stem>-<pid>` sequence at the same instant. The name gains a counter
+ *    rather than overwriting, and the counter is settled by
+ *    {@link EXCLUSIVE_CREATE} so the OS — not a check-then-write gap — decides
+ *    who won it.
  * 4. The process's own wall and CPU time is read ONCE, at dump time. It is a
  *    lifetime figure for the process and never a duration of the measured work;
  *    its value is the RATIO, which tells a reader whether the wall-timed
@@ -42,7 +47,7 @@
  * thing a reader has to be able to trust identically. What each seam keeps for
  * itself is its accumulator shape, its dump body and the noun it is called by.
  */
-import { existsSync, writeFileSync } from 'node:fs';
+import { writeFileSync } from 'node:fs';
 import { safePath } from './path-core.js';
 import { mkdirSyncReal } from './path-utils.js';
 /** `process.cpuUsage()` reports microseconds; a dump reports milliseconds. */
@@ -51,10 +56,27 @@ const MICROSECONDS_PER_MS = 1000;
 const MS_PER_SECOND = 1000;
 /**
  * Ceiling on the pid-collision search. A directory holding this many dumps for
- * one pid is a runaway, not a collision; overwriting the last slot is a better
- * outcome than spinning.
+ * one pid is a runaway, not a collision, and giving up on a reported line is a
+ * better outcome than spinning.
+ *
+ * Exhausting it does NOT fall back to overwriting the last slot. That was the
+ * old behaviour, and it destroyed a dump for the same reason the check-then-
+ * write gap did — silently, and precisely when the directory was busiest.
  */
-const MAX_DUMP_COLLISIONS = 1000;
+export const MAX_DUMP_COLLISIONS = 1000;
+/**
+ * The `writeFileSync` flag that makes claiming a name atomic.
+ *
+ * `wx` is create-exclusive: the OS fails the call with `EEXIST` when the path
+ * already exists, so exactly one caller wins each name no matter how many are
+ * racing for it. Asking `existsSync` first and writing second is two operations
+ * with a gap in between, and threads sharing a pid land in that gap routinely —
+ * a measured 8-worker parse pool lost 6 of 9 dumps to it, reporting 44 of 172
+ * documents as if that were the whole run.
+ */
+const EXCLUSIVE_CREATE = 'wx';
+/** How the failure line names the ceiling case, so it reads unlike an OS error. */
+const CEILING_DETAIL = `every name up to the ${String(MAX_DUMP_COLLISIONS)}-collision ceiling was already claimed`;
 /**
  * Reduce a raw env value to a directory or `null`.
  *
@@ -119,46 +141,90 @@ export function readTimingProcess() {
     };
 }
 /**
- * Pick a dump path that does not already exist.
+ * The nth candidate name in one pid's dump sequence.
+ *
+ * @param directory - Directory dumps are written to
+ * @param stem - Basename and pid, already joined
+ * @param collision - 0 for the unsuffixed name, then the collision counter
+ * @returns The candidate path
+ */
+function timingDumpCandidate(directory, stem, collision) {
+    const suffix = collision === 0 ? '' : `-${String(collision)}`;
+    return safePath.join(directory, `${stem}${suffix}.json`);
+}
+/**
+ * Whether a caught write failure means somebody else already holds the name.
+ *
+ * @param error - Whatever `writeFileSync` threw
+ * @returns `true` only for `EEXIST`, which is a lost race and not a fault
+ */
+function isNameAlreadyTaken(error) {
+    return error instanceof Error && 'code' in error && error.code === 'EEXIST';
+}
+/**
+ * Claim a name by creating it, and fill it in the same operation.
+ *
+ * Choosing the name and writing it CANNOT be two steps: whatever separates them
+ * is a window in which another writer takes the name that was just declared
+ * free, and the loser's dump disappears with no error raised anywhere. So each
+ * candidate is written create-exclusively ({@link EXCLUSIVE_CREATE}) and an
+ * `EEXIST` — the OS saying somebody else got there — advances to the next
+ * counter rather than overwriting.
  *
  * @param directory - Directory dumps are written to
  * @param basename - Basename stem; the pid and any collision counter follow
- * @returns An unused path, or the last candidate tried
+ * @param contents - The already-serialized dump body
+ * @returns Which name was claimed, or why none could be
  */
-function nextTimingDumpPath(directory, basename) {
+function claimTimingDump(directory, basename, contents) {
     const stem = `${basename}-${String(process.pid)}`;
-    let candidate = safePath.join(directory, `${stem}.json`);
-    for (let collision = 1; 
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- operator-supplied diagnostic directory from a VAT_*_TIMING variable
-    collision <= MAX_DUMP_COLLISIONS && existsSync(candidate); collision += 1) {
-        candidate = safePath.join(directory, `${stem}-${String(collision)}.json`);
+    for (let collision = 0; collision <= MAX_DUMP_COLLISIONS; collision += 1) {
+        const candidate = timingDumpCandidate(directory, stem, collision);
+        try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename -- operator-supplied diagnostic directory from a VAT_*_TIMING variable
+            writeFileSync(candidate, contents, { encoding: 'utf-8', flag: EXCLUSIVE_CREATE });
+            return { outcome: 'written', path: candidate };
+        }
+        catch (error) {
+            if (!isNameAlreadyTaken(error))
+                return { outcome: 'failed', path: candidate, error };
+        }
     }
-    return candidate;
+    return {
+        outcome: 'exhausted',
+        path: timingDumpCandidate(directory, stem, MAX_DUMP_COLLISIONS),
+    };
 }
 /**
  * Write one seam's dump, if the seam is on.
  *
  * The body is built lazily, inside this call, so a disabled seam never pays to
- * snapshot accumulators nobody will read.
+ * snapshot accumulators nobody will read — and a `build` that throws is reported
+ * like any other failure, because this runs from an `exit` listener where a
+ * throw would change the process's exit behaviour.
  *
  * @param noun - What the seam is called, for any failure line
  * @param directory - Where to write, or `null` when the seam is off
  * @param basename - Basename stem for the file
  * @param build - Produces the dump body
- * @returns The path written, or `null` when the seam is off or the write failed
+ * @returns The path written, or `null` when the seam is off or nothing was written
  */
 export function writeTimingDump(noun, directory, basename, build) {
     if (directory === null)
         return null;
-    const target = nextTimingDumpPath(directory, basename);
+    let claim;
     try {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- operator-supplied diagnostic directory from a VAT_*_TIMING variable
-        writeFileSync(target, `${JSON.stringify(build(), null, 2)}\n`, 'utf-8');
+        claim = claimTimingDump(directory, basename, `${JSON.stringify(build(), null, 2)}\n`);
     }
     catch (error) {
-        reportTimingDumpFailure(noun, target, error);
+        // Only `build()` and its serialization can reach here; every filesystem
+        // failure is already an outcome rather than a throw.
+        reportTimingDumpFailure(noun, directory, error);
         return null;
     }
-    return target;
+    if (claim.outcome === 'written')
+        return claim.path;
+    reportTimingDumpFailure(noun, claim.path, claim.outcome === 'exhausted' ? CEILING_DETAIL : claim.error);
+    return null;
 }
 //# sourceMappingURL=timing-dump.js.map

package/dist/timing-dump.js.map

@@ -1 +1 @@
-{"version":3,"file":"timing-dump.js","sourceRoot":"","sources":["../src/timing-dump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAoBhD,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,uEAAuE;AACvE,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC9D,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,MAAc,EAAE,KAAc;IAClF,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,oBAAoB,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IACnE,IAAI,CAAC;QACH,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,aAAa;QACxC,SAAS,EAAE,GAAG,CAAC,IAAI,GAAG,mBAAmB;QACzC,WAAW,EAAE,GAAG,CAAC,MAAM,GAAG,mBAAmB;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,SAAiB,EAAE,QAAgB;IAC7D,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAClD,IAAI,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IACzD,KACE,IAAI,SAAS,GAAG,CAAC;IACjB,0IAA0I;IAC1I,SAAS,IAAI,mBAAmB,IAAI,UAAU,CAAC,SAAS,CAAC,EACzD,SAAS,IAAI,CAAC,EACd,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,SAAwB,EACxB,QAAgB,EAChB,KAAoB;IAEpB,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,0IAA0I;QAC1I,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"timing-dump.js","sourceRoot":"","sources":["../src/timing-dump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAoBhD,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,uEAAuE;AACvE,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,mFAAmF;AACnF,MAAM,cAAc,GAAG,wBAAwB,MAAM,CAAC,mBAAmB,CAAC,wCAAwC,CAAC;AAcnH;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC9D,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,MAAc,EAAE,KAAc;IAClF,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,oBAAoB,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IACnE,IAAI,CAAC;QACH,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,aAAa;QACxC,SAAS,EAAE,GAAG,CAAC,IAAI,GAAG,mBAAmB;QACzC,WAAW,EAAE,GAAG,CAAC,MAAM,GAAG,mBAAmB;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,IAAY,EAAE,SAAiB;IAC7E,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,eAAe,CAAC,SAAiB,EAAE,QAAgB,EAAE,QAAgB;IAC5E,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAClD,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,IAAI,mBAAmB,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,0IAA0I;YAC1I,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,mBAAmB,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,SAAwB,EACxB,QAAgB,EAChB,KAAoB;IAEpB,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,KAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,qDAAqD;QACrD,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IACnD,uBAAuB,CACrB,IAAI,EACJ,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAC7D,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/eslint/index.cjs

@@ -54,6 +54,7 @@ const rules = {
   'no-self-package-import': require('./rules/no-self-package-import.cjs'),
   'require-justified-skip': require('./rules/require-justified-skip.cjs'),
   'no-bare-symlink-in-tests': require('./rules/no-bare-symlink-in-tests.cjs'),
+  'no-process-exit-in-phase': require('./rules/no-process-exit-in-phase.cjs'),
 };
 
 /**
@@ -136,6 +137,14 @@ const RECOMMENDED_EXCLUDE = new Set([
   // ride in `recommended`; that is a public-API change and has not been made.
   // VAT enables the whole rule explicitly, scoped to its own conventions.
   'no-bare-symlink-in-tests',
+  // Excluded because it keys on a NAMING CONVENTION that is VAT's, not a
+  // portable fact — the same reason `no-unsafe-root-join` is excluded above. The
+  // hazard it guards is real and general (an in-process orchestrator whose step
+  // calls `process.exit()` silently skips every later step), but the marker is
+  // the `…Phase` suffix, and an adopter with an unrelated `computeRenderPhase()`
+  // that legitimately exits would get a finding they cannot act on. It ships in
+  // `rules` and VAT enables it explicitly, scoped to its own orchestrators.
+  'no-process-exit-in-phase',
 ]);
 
 /**

package/eslint/index.d.cts

@@ -47,13 +47,20 @@ declare namespace plugin {
     rules: Record<string, RuleModule>;
     configs: {
       /**
-       * The cross-platform safety core: 18 of the 22 rules, 15 `error` / 3 `warn`.
-       * Four are excluded, for three reasons: `no-test-scoped-functions` and
-       * `require-justified-skip` are positions on test style rather than
-       * portability facts; `no-unsafe-root-join` keys on naming rather than taint;
-       * and `no-raw-text-decode` names a decoding seam that only exists in the
-       * consuming repo. All four still ship in `rules` and are enabled by naming
-       * them.
+       * The cross-platform safety core: 18 of the 25 rules, 15 `error` / 3 `warn`.
+       *
+       * Seven are excluded, for four reasons. `no-test-scoped-functions`,
+       * `require-justified-skip` and `no-bare-symlink-in-tests` are positions on
+       * TEST STYLE rather than portability facts. `no-unsafe-root-join` and
+       * `no-process-exit-in-phase` key on NAMING rather than on the property they
+       * care about (taint, and an orchestrated call site). `no-raw-text-decode`
+       * names a decoding SEAM that only exists in the consuming repo. And
+       * `no-self-package-import` REQUIRES an option this config cannot supply.
+       *
+       * All seven still ship in `rules` and are enabled by naming them — which is
+       * what this repo's own `eslint.config.js` does. The count above is asserted
+       * by `packages/utils/test/eslint/rules.test.ts`, so it cannot drift
+       * unnoticed the way it did when this comment said "four".
        */
       recommended: FlatConfig;
     };

package/eslint/rules/no-process-exit-in-phase.cjs

@@ -0,0 +1,117 @@
+/**
+ * ESLint Rule: no-process-exit-in-phase
+ *
+ * Forbid `process.exit()` inside a phase entry point — a function whose name
+ * ends in `Phase`.
+ *
+ * ## Why this rule exists
+ *
+ * `vat validate`, `vat verify` and `vat build` used to run each phase as a
+ * SEPARATE CHILD PROCESS. A `process.exit()` inside a phase was then perfectly
+ * safe: it ended that child, the parent read the exit code, and the run carried
+ * on to the next phase. Nothing about the code said so — the safety came
+ * entirely from the process boundary.
+ *
+ * That boundary is gone. Phases now run in the orchestrator's own process, so a
+ * surviving `process.exit()` ends THE WHOLE RUN: every later phase is silently
+ * skipped, the parent's aggregation never happens, and the process exits 0-or-1
+ * having done half the work with nothing in the document to say so. It is the
+ * worst shape of failure this codebase has — a confident, well-formed, wrong
+ * answer — and it cannot be caught by a type, because `process.exit()`
+ * typechecks anywhere.
+ *
+ * A phase must RETURN `{ document, exitCode }` and let its caller decide whether
+ * to print and exit (a command-line run) or to fold the result into the run (an
+ * orchestrated one).
+ *
+ * ## Why the name is the marker
+ *
+ * The `…Phase` suffix is the convention every phase entry point already follows
+ * (`runResourcesValidatePhase`, `runSkillsBuildPhase`, …). Keying the rule to it
+ * means a new phase is protected the moment it is named like one, with no list
+ * to keep in sync — a list is the thing that goes stale silently, which is the
+ * defect class this rule exists to prevent in the first place.
+ *
+ * The thin Commander wrappers that CALL these functions keep their
+ * `process.exit()`: deciding how the process ends is exactly their job, and they
+ * are not named `…Phase`.
+ */
+
+/** Does this call expression read as `process.exit(...)`? */
+function isProcessExitCall(node) {
+  const { callee } = node;
+  return (
+    callee.type === 'MemberExpression' &&
+    !callee.computed &&
+    callee.object.type === 'Identifier' &&
+    callee.object.name === 'process' &&
+    callee.property.type === 'Identifier' &&
+    callee.property.name === 'exit'
+  );
+}
+
+/**
+ * The declared name of a function-ish node, however it was declared.
+ *
+ * Covers the three spellings a phase entry point can legitimately take: a
+ * function declaration, a `const x = function () {}`, and a `const x = () => {}`.
+ * A rule that only understood declarations would be silently inert against an
+ * arrow const — the same blind spot `no-test-scoped-functions` documents.
+ */
+function functionName(node) {
+  if (node.id && node.id.type === 'Identifier') return node.id.name;
+
+  const { parent } = node;
+  if (parent && parent.type === 'VariableDeclarator' && parent.id.type === 'Identifier') {
+    return parent.id.name;
+  }
+  if (parent && parent.type === 'Property' && parent.key.type === 'Identifier') {
+    return parent.key.name;
+  }
+  return undefined;
+}
+
+const FUNCTION_TYPES = new Set([
+  'FunctionDeclaration',
+  'FunctionExpression',
+  'ArrowFunctionExpression',
+]);
+
+/** The nearest enclosing function named like a phase entry point, if any. */
+function enclosingPhaseName(node) {
+  for (let current = node.parent; current; current = current.parent) {
+    if (!FUNCTION_TYPES.has(current.type)) continue;
+    const name = functionName(current);
+    if (name !== undefined && name.endsWith('Phase')) return name;
+  }
+  return undefined;
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Forbid process.exit() inside a phase entry point, where it would end the whole orchestrated run',
+      category: 'Agentic Code Safety',
+      recommended: true,
+    },
+    fixable: null,
+    schema: [],
+    messages: {
+      exitInPhase:
+        "'{{name}}' is a phase entry point, so process.exit() here ends the ENTIRE run — every later phase is skipped and the orchestrator never aggregates. Return { document, exitCode } instead and let the caller decide how the process ends.",
+    },
+  },
+
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (!isProcessExitCall(node)) return;
+        const name = enclosingPhaseName(node);
+        if (name === undefined) return;
+        context.report({ node, messageId: 'exitInPhase', data: { name } });
+      },
+    };
+  },
+};