cabloy 5.1.219 → 5.1.221

package/.cabloy-version

@@ -1 +1 @@
-5.1.219
+5.1.221

package/.github/workflows/agent-governance.yml

@@ -17,9 +17,9 @@ jobs:
       PNPM_CONFIG_MINIMUM_RELEASE_AGE: 0
     steps:
       - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - uses: actions/setup-node@v6
         with:
           node-version: 24

package/.github/workflows/create-cabloy.yml

@@ -35,9 +35,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash
@@ -97,7 +97,7 @@ jobs:
           if (Test-Path $log) { Get-Content $log }
           throw 'Redis did not become ready'
       - name: create project
-        run: npm create cabloy cabloy-app
+        run: npm create cabloy@latest cabloy-app
       - name: verify project initialization
         working-directory: cabloy-app
         run: >-

package/.github/workflows/docs-pages.yml

@@ -29,9 +29,9 @@ jobs:
       PNPM_CONFIG_MINIMUM_RELEASE_AGE: 0
     steps:
       - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - uses: actions/setup-node@v6
         with:
           node-version: 24

package/.github/workflows/playwright-e2e.yml

@@ -28,9 +28,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash
@@ -136,9 +136,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash

package/.github/workflows/vona-cov-pg.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: cov

package/.github/workflows/vona-test-crud.yml

@@ -22,9 +22,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - run: npm run vona :create:module demo-student2 -- --suite --ci

package/.github/workflows/vona-test-mysql.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: run Commerce lifecycle gate

package/.github/workflows/vona-test-pg.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: run A-Pay focused gate

package/.github/workflows/vona-test-sqlite3.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash

package/.github/workflows/vona-tsc.yml

@@ -17,9 +17,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: tsc

package/.github/workflows/zova-ui.yml

@@ -17,9 +17,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: suite

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 5.1.221
+
+### Features
+
+- Incorporate updates from MCP.
+- Incorporate updates from the specification.
+
+### Improvements
+
+- Update pnpm.
+
+## 5.1.220
+
+### Features
+
+- Add request boundary lifecycle support and diagnostic suppression.
+
+### Improvements
+
+- Speed up REST declaration builds with oxc.
+- Enhance the REST build process.
+- Update setup documentation to use `npm create cabloy@latest`.
+
 ## 5.1.219
 
 ### Improvements

package/README.md

@@ -27,7 +27,7 @@ Learn more about [Vona + Zova Integration](https://cabloy.com/fullstack/vona-zov
 Create a new Cabloy Basic project:
 
 ```bash
-npm create cabloy
+npm create cabloy@latest
 ```
 
 For Cabloy Start, clone the [Cabloy Start repository](https://github.com/cabloy/cabloy-start) and run `npm run init` from its root. See the [Fullstack Quickstart](https://cabloy.com/fullstack/quickstart) for prerequisites and development commands.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.219",
+  "version": "5.1.221",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [
@@ -106,7 +106,8 @@
     "typescript": "^5.9.3"
   },
   "engines": {
-    "node": ">=24.4.0"
+    "node": ">=24.4.0",
+    "pnpm": ">=11.5.2"
   },
-  "packageManager": "pnpm@11.5.2"
+  "packageManager": "pnpm@12.14.0"
 }

package/repo-docs/frontend/openapi-sdk-guide.md

@@ -73,6 +73,8 @@ npm run contract:generate:isolated -- training-student
 
 The isolated command uses the same generator and preserves module ownership validation, but manages a disposable service, claim, and test resources without starting Playwright. Generated files under `zova/src/**` are shared workspace output, not run-owned temporary files; serialize concurrent SDK generation and do not expect automatic rollback.
 
+For an explicitly authorized run that must skip historical-claim reaping, use the standalone `--skip-expired-claim-reaping` flag. In this strict lane, generated environment source contains selected keys rather than resolved values, configuration reaches the bootstrap child in memory, service/generator stdout and stderr are discarded, and framework file logging is prevented before transport construction. Failures remain failures with categorical diagnostics and retained current-run claims/resources; there is no automatic retry or fallback to development Swagger. This is not a network or arbitrary-filesystem sandbox, and it does not authorize Provider operations or prove custom seed/logging behavior. See [Strict isolated generation](/reference/repo-scripts#test-isolation-and-development-data) for resource and diagnostic boundaries.
+
 The project-level source resolver accepts `OPENAPI_SOURCE_URL` as a complete OpenAPI document URL. It takes precedence over `API_BASE_URL` for generation only and does not change runtime `OPENAPI_BASE_URL_*` request targets:
 
 ```bash

package/repo-docs/fullstack/quickstart.md

@@ -21,7 +21,7 @@ Before creating a new Cabloy project, make sure your environment has:
 ## 2. Create a new project
 
 ```bash
-npm create cabloy
+npm create cabloy@latest
 ```
 
 The generated project includes `repo-agent-governance/` plus committed adapters for Claude Code, Codex, and Cursor. This path creates a Cabloy Basic project baseline. Open it in a supported coding agent and start with the project-specific guidance; regenerate adapters from the canonical governance source rather than editing generated files directly.
@@ -52,13 +52,13 @@ npm create cabloy
 #### Windows Command Prompt
 
 ```cmd
-set pnpm_config_minimum_release_age=0 && npm create cabloy
+set pnpm_config_minimum_release_age=0 && npm create cabloy@latest
 ```
 
 #### macOS / Linux
 
 ```bash
-pnpm_config_minimum_release_age=0 npm create cabloy
+pnpm_config_minimum_release_age=0 npm create cabloy@latest
 ```
 
 ## 3. Start Vona integrated SSR

package/repo-docs/reference/repo-scripts.md

@@ -82,6 +82,22 @@ A process-list match or a free port alone is not proof of either a conflict or s
 
 `npm run contract:generate:isolated -- <module-name>` starts a fresh test-mode Vona service on a run-owned loopback port, verifies its signed readiness response, fetches the Swagger document, and invokes the existing Zova OpenAPI generator without Playwright. The run owns its disposable test resources and claim-backed local roots; successful runs clean them after the service drains, while failures retain the claim and evidence for inspection. The generated SDK files under `zova/src/**` remain shared checkout output, so serialize concurrent generation for the same workspace/module and do not treat this command as an automatic rollback boundary.
 
+For an explicitly authorized contract-generation run that must not reap historical claims, Cabloy Basic and Cabloy Start support this opt-in form:
+
+```bash
+npm run contract:generate:isolated -- <module-name> --skip-expired-claim-reaping
+```
+
+The wrapper consumes this standalone flag rather than forwarding it to Zova; `--skip-expired-claim-reaping=...` is rejected. Without the flag, contract generation retains normal historical-claim reaping. Unit, coverage and E2E defaults are unchanged; the runner rejects their use of this opt-out.
+
+The opt-in lane requires strict freshness after application configuration and before module loading: run-owned public/runtime/SQLite directories must be absent or empty, shared and static-isolate database namespaces must be absent, and persistent Redis namespaces must be empty. Read-only discovery failures or preexisting resources fail closed rather than authorizing deletion. Startup requires per-application freshness proof to bypass normal test clearing; database preparation rechecks the namespace, never drops existing databases in this lane, and reuses only a database creation recorded by that application.
+
+In the strict opt-in lane, generated `env.ts` contains a selected-key projection of the bootstrap process environment, not serialized configuration values. The CLI passes its resolved configuration to the bootstrap child in memory, preserving resolved-value precedence without exposing every inherited environment key through `app.meta.env`. Strict generation requires test mode and matching run-owned directories before configuration loading or generated-file writes. Ordinary dev/build/test and default contract generation keep their existing environment generation behavior.
+
+Strict service and generator stdout/stderr are discarded, not captured for later redaction. Framework logger access bypasses client configuration and transport construction; direct file-transport construction fails before filesystem or rotation access. Parent failures report categorical stages instead of raw child errors, causes or response bodies. Windows output still drains through the native bridges into discard streams; this implementation policy and synthetic coverage are not native Windows runtime verification. Custom filesystem writers, external logging sinks and seed behavior remain outside this framework diagnostic boundary: it is not a universal secret sandbox or secret scanner.
+
+This still loads environment configuration, initializes newly allocated test databases and Redis/runtime resources, and runs normal module seeds. Successful runs clean only their inventoried current-run resources after verified shutdown; failed runs retain their claim/resources, without automatic generation retry or fallback. Discarded diagnostics are not recoverable from a retained claim. Generated consumers remain shared checkout writes. Freshness is a snapshot, **not an exclusive lease**, zero-mutation mode, network sandbox, blanket log-redaction guarantee, or authorization to contact a Provider. Independently configured external resources and Provider operations retain their separate ownership and approval requirements. This shared flag does not extend Basic's separately scoped Windows verification to Start.
+
 For Vona integrated SSR, the allocated E2E origin is supplied to Zova at runtime as server `SSR_API_BASE_URL` and browser `API_BASE_URL`. Do not edit Zova `.env` files or rebuild solely to match the test port. The current root `npm run test:e2e` consumes prebuilt frontend artifacts; refresh affected SSR/REST output and synchronize dependencies when their inputs change. See [Runtime API origins in Vona integrated SSR](/fullstack/ssr-entry-modes#runtime-api-origins-in-vona-integrated-ssr) for configuration overrides and scope.
 
 For deliberate **dev-mode** database preparation, `npm run db:reset` is a separate, destructive command: in a single process, it clears validated application-owned Redis keys, drops and recreates managed disposable development databases, reruns migrations and instance initialization, then runs module `seed()` hooks. It requires `database.testDatabase: true` in the dev configuration and a connection outside the disposable database. Ordinary `npm run dev` and `npm run dev:one` only reuse existing managed databases; if any required target is missing, startup fails promptly with an instruction to run `npm run db:reset`. They do not create databases, perform creation-time Redis cleanup, or seed. Never run `db:reset` against development data you need to retain. Upgrades do not reset existing development data or repeat its seeds. See [Development database preparation](#development-database-preparation) and [Migration and Changes](/backend/migration-and-changes#local-development-workflow).

package/scripts/generateOpenapiIsolated.test.ts

@@ -9,10 +9,35 @@ import type { GuardianResult, OwnedProcess } from './runIsolatedTest.ts';
 import {
   getOpenapiGeneratorCommand,
   getOpenapiSource,
+  parseIsolatedOpenapiArgs,
   validateOpenapiSource,
 } from './generateOpenapiIsolated.ts';
 import { getIsolatedVonaCommand, ROOT_DIR, withIsolatedVona } from './runIsolatedTest.ts';
 
+test('contract reaping opt-out is explicit and removed from generator arguments', () => {
+  const original = ['training-student', '--skip-expired-claim-reaping', '--nometadata'];
+  const parsed = parseIsolatedOpenapiArgs(original);
+  assert.deepEqual(parsed, {
+    generatorArgs: ['training-student', '--nometadata'],
+    skipExpiredClaimReaping: true,
+  });
+  assert.deepEqual(original, ['training-student', '--skip-expired-claim-reaping', '--nometadata']);
+  assert.equal(
+    getOpenapiGeneratorCommand(parsed.generatorArgs).args.includes('--skip-expired-claim-reaping'),
+    false,
+  );
+  assert.deepEqual(parseIsolatedOpenapiArgs(['training-student']), {
+    generatorArgs: ['training-student'],
+    skipExpiredClaimReaping: false,
+  });
+  for (const value of ['true', 'false', '']) {
+    assert.throws(
+      () => parseIsolatedOpenapiArgs([`--skip-expired-claim-reaping=${value}`]),
+      /standalone flag/,
+    );
+  }
+});
+
 test('builds the isolated Swagger source from the allocated port', () => {
   assert.equal(getOpenapiSource(7123), 'http://127.0.0.1:7123/swagger/json?version=V31');
 });

package/scripts/generateOpenapiIsolated.ts

@@ -7,6 +7,7 @@ import {
   withIsolatedVona,
   withIsolatedRun,
 } from './runIsolatedTest.ts';
+import { strictGenerationFailure } from './strictGenerationDiagnostics.ts';
 
 const OPENAPI_VERSION = 'V31';
 const SOURCE_TIMEOUT_MS = 30_000;
@@ -15,6 +16,17 @@ export function getOpenapiSource(port: number) {
   return `http://127.0.0.1:${port}/swagger/json?version=${OPENAPI_VERSION}`;
 }
 
+export function parseIsolatedOpenapiArgs(args: string[]) {
+  const flag = '--skip-expired-claim-reaping';
+  if (args.some(arg => arg.startsWith(`${flag}=`))) {
+    throw new Error(`${flag} is a standalone flag`);
+  }
+  return {
+    generatorArgs: args.filter(arg => arg !== flag),
+    skipExpiredClaimReaping: args.includes(flag),
+  };
+}
+
 export function getOpenapiGeneratorCommand(args: string[]) {
   if (args.some(arg => /^--projectPath(?:=|$)/.test(arg))) {
     throw new Error(
@@ -67,25 +79,47 @@ export async function validateOpenapiSource(source: string) {
 }
 
 export async function generateOpenapiIsolated(args: string[]) {
-  const command = getOpenapiGeneratorCommand(args);
+  const strict = args.some(arg => /^--skip-expired-claim-reaping(?:=|$)/.test(arg));
+  try {
+    return await generateOpenapiIsolatedInternal(args);
+  } catch (error) {
+    throw strict ? strictGenerationFailure('run', error) : error;
+  }
+}
+
+async function generateOpenapiIsolatedInternal(args: string[]) {
+  const { generatorArgs, skipExpiredClaimReaping } = parseIsolatedOpenapiArgs(args);
+  const command = getOpenapiGeneratorCommand(generatorArgs);
   if (process.env.E2E_BASE_URL !== undefined) {
     throw new Error(
       'E2E_BASE_URL is unsupported; isolated OpenAPI generation manages a local test-mode target.',
     );
   }
-  return await withIsolatedRun('contract', async ({ env, port }) => {
-    const source = getOpenapiSource(port);
-    await withIsolatedVona(port, env, async () => {
-      await validateOpenapiSource(source);
-      await runIsolatedProcess(command.command, command.args, command.cwd, {
-        ...env,
-        OPENAPI_SOURCE_URL: source,
-        VONA_TEST_READY_KEY: undefined,
+  return await withIsolatedRun(
+    'contract',
+    async ({ env, port }) => {
+      const source = getOpenapiSource(port);
+      await withIsolatedVona(port, env, async () => {
+        await validateOpenapiSource(source);
+        await runIsolatedProcess(command.command, command.args, command.cwd, {
+          ...env,
+          OPENAPI_SOURCE_URL: source,
+          VONA_TEST_READY_KEY: undefined,
+        });
       });
-    });
-  });
+    },
+    ROOT_DIR,
+    { skipExpiredClaimReaping },
+  );
 }
 
 if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
-  await generateOpenapiIsolated(process.argv.slice(2));
+  const args = process.argv.slice(2);
+  try {
+    await generateOpenapiIsolated(args);
+  } catch (error) {
+    if (!args.some(arg => /^--skip-expired-claim-reaping(?:=|$)/.test(arg))) throw error;
+    console.error(strictGenerationFailure('run', error).message);
+    process.exitCode = 1;
+  }
 }

package/scripts/runIsolatedTest.test.ts

@@ -33,6 +33,7 @@ import {
   createTestRunId,
   getUnitTestCommands,
   reserveTestRun,
+  reapBeforeIsolatedRun,
   resolveNpmCli,
   resolveCabloyEdition,
   ROOT_DIR,
@@ -45,12 +46,104 @@ import {
   waitForReady,
   withIsolatedRun,
 } from './runIsolatedTest.ts';
+import { StrictGenerationError } from './strictGenerationDiagnostics.ts';
 
 const isolationSource = resolve(
   ROOT_DIR,
   'vona/packages-vona/vona-core/src/lib/core/testIsolation.ts',
 );
 
+test('claim reaping defaults remain enabled and contract opt-out never calls the reaper', async () => {
+  const calls: string[] = [];
+  const reap = async (projectPath: string) => {
+    calls.push(projectPath);
+    return [];
+  };
+  for (const kind of ['unit', 'cov', 'e2e', 'contract'] as const) {
+    await reapBeforeIsolatedRun(kind, '/synthetic/vona', {}, reap);
+  }
+  assert.deepEqual(calls, [
+    '/synthetic/vona',
+    '/synthetic/vona',
+    '/synthetic/vona',
+    '/synthetic/vona',
+  ]);
+  await reapBeforeIsolatedRun(
+    'contract',
+    '/synthetic/vona',
+    { skipExpiredClaimReaping: true },
+    async () => {
+      throw new Error('historical reaper must not run');
+    },
+  );
+  for (const kind of ['unit', 'cov', 'e2e'] as const) {
+    await assert.rejects(
+      reapBeforeIsolatedRun(kind, '/synthetic/vona', { skipExpiredClaimReaping: true }, reap),
+      /supported only for contract generation/,
+    );
+  }
+  assert.equal(calls.length, 4);
+});
+
+test('public test entrypoints reject contract-only flags before claim reaping', () => {
+  const runnerUrl = new URL('./runIsolatedTest.ts', import.meta.url).href;
+  const source = `
+    import assert from 'node:assert/strict';
+    import { registerHooks } from 'node:module';
+    globalThis.cleanupCalls = [];
+    registerHooks({ resolve(specifier, context, nextResolve) {
+      if (context.parentURL === ${JSON.stringify(runnerUrl)} && specifier === './testClaimCleanup.ts') {
+        const source = \`
+          export function parseTestClaimTtlSeconds() { return 1; }
+          export async function reapExpiredTestClaims() {
+            globalThis.cleanupCalls.push('reap');
+            throw new Error('unexpected claim reaping');
+          }
+          export async function cleanTestClaim() {
+            globalThis.cleanupCalls.push('clean');
+            throw new Error('unexpected claim cleanup');
+          }
+        \`;
+        return { url: 'data:text/javascript,' + encodeURIComponent(source), shortCircuit: true };
+      }
+      return nextResolve(specifier, context);
+    } });
+    const { runIsolatedTest } = await import(${JSON.stringify(runnerUrl)});
+    for (const [kind, args] of [['unit', []], ['unit', ['--coverage']], ['e2e', []]]) {
+      for (const suffix of ['', '=true', '=false', '=']) {
+        await assert.rejects(
+          runIsolatedTest(kind, [...args, '--skip-expired-claim-reaping' + suffix]),
+          /--skip-expired-claim-reaping is supported only for contract generation/,
+        );
+        assert.deepEqual(globalThis.cleanupCalls, []);
+      }
+    }
+    await assert.rejects(runIsolatedTest('unit', []), /unexpected claim reaping/);
+    assert.deepEqual(globalThis.cleanupCalls, ['reap']);
+  `;
+  const result = spawnSync(process.execPath, ['--input-type=module', '-e', source], {
+    cwd: ROOT_DIR,
+    env: { ...process.env, E2E_BASE_URL: undefined },
+    encoding: 'utf8',
+    timeout: 10_000,
+  });
+  assert.equal(result.error, undefined);
+  assert.equal(result.status, 0, result.stderr);
+});
+
+test('claim reaping errors propagate without retries', async () => {
+  const error = new Error('synthetic reaper failure');
+  let calls = 0;
+  await assert.rejects(
+    reapBeforeIsolatedRun('contract', '/synthetic/vona', {}, async () => {
+      calls++;
+      throw error;
+    }),
+    value => value === error,
+  );
+  assert.equal(calls, 1);
+});
+
 test('public test scripts delegate to the isolated runner without recursion', () => {
   const root = JSON.parse(readFileSync(resolve(ROOT_DIR, 'package.json'), 'utf8'));
   const original = JSON.parse(
@@ -223,51 +316,78 @@ test('creates exclusive manifest claims and refuses stale or symlinked roots', a
   }
 });
 
-test('contract runs clean owned roots on success and retain failed-run evidence', async () => {
-  const root = mkdtempSync(join(realpathSync(tmpdir()), 'cabloy-contract-run-'));
-  mkdirSync(join(root, 'vona'));
-  writeFileSync(join(root, '__CABLOY_BASIC__'), '');
-  let claimPath = '';
-  let dataRoot = '';
-  let generatedRoot = '';
-  try {
-    assert.equal(
-      await withIsolatedRun(
-        'contract',
-        async context => {
-          ({ claimPath, dataRoot, generatedRoot } = context);
-          assert.equal((await loadTestClaim(claimPath)).kind, 'contract');
-          assert.equal(context.env.META_MODE, 'test');
-          assert.equal(context.env.VONA_DB_RESET, undefined);
-          assert.equal(context.env.VONA_TEST_READY_KEY, undefined);
-          assert.ok(existsSync(join(dataRoot, '.vona-test-owner')));
-          return 'generated';
-        },
-        root,
-      ),
-      'generated',
-    );
-    assert.equal(existsSync(claimPath), false);
-    assert.equal(existsSync(dataRoot), false);
-    assert.equal(existsSync(generatedRoot), false);
-    await assert.rejects(
-      withIsolatedRun(
-        'contract',
-        async context => {
-          ({ claimPath, dataRoot, generatedRoot } = context);
-          throw new Error('generator failed');
-        },
-        root,
-      ),
-      /generator failed/,
-    );
-    assert.equal((await loadTestClaim(claimPath)).status, 'failed');
-    assert.equal(existsSync(dataRoot), true);
-    assert.equal(existsSync(generatedRoot), true);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
+for (const marker of ['__CABLOY_BASIC__', '__CABLOY_START__']) {
+  test(
+    `contract runs clean owned roots on success and retain failed-run evidence for ${marker}`,
+    { concurrency: false },
+    async () => {
+      const root = mkdtempSync(join(realpathSync(tmpdir()), 'cabloy-contract-run-'));
+      mkdirSync(join(root, 'vona'));
+      writeFileSync(join(root, marker), '');
+      let claimPath = '';
+      let dataRoot = '';
+      let generatedRoot = '';
+      const previous = process.env.VONA_TEST_REQUIRE_FRESH_RESOURCES;
+      try {
+        process.env.VONA_TEST_REQUIRE_FRESH_RESOURCES = 'true';
+        await withIsolatedRun(
+          'contract',
+          async context => {
+            assert.equal(context.env.VONA_TEST_REQUIRE_FRESH_RESOURCES, undefined);
+          },
+          root,
+        );
+        assert.equal(
+          await withIsolatedRun(
+            'contract',
+            async context => {
+              ({ claimPath, dataRoot, generatedRoot } = context);
+              assert.equal((await loadTestClaim(claimPath)).kind, 'contract');
+              assert.equal(context.env.META_MODE, 'test');
+              assert.equal(context.env.VONA_DB_RESET, undefined);
+              assert.equal(context.env.VONA_TEST_READY_KEY, undefined);
+              assert.equal(context.env.VONA_TEST_REQUIRE_FRESH_RESOURCES, 'true');
+              assert.ok(existsSync(join(dataRoot, '.vona-test-owner')));
+              return 'generated';
+            },
+            root,
+            { skipExpiredClaimReaping: true },
+          ),
+          'generated',
+        );
+        assert.equal(existsSync(claimPath), false);
+        assert.equal(existsSync(dataRoot), false);
+        assert.equal(existsSync(generatedRoot), false);
+        await assert.rejects(
+          withIsolatedRun(
+            'contract',
+            async context => {
+              ({ claimPath, dataRoot, generatedRoot } = context);
+              throw new Error('generator failed');
+            },
+            root,
+            { skipExpiredClaimReaping: true },
+          ),
+          error => {
+            assert.ok(error instanceof StrictGenerationError);
+            assert.equal(error.stage, 'run');
+            assert.equal(error.message, 'Strict contract generation failed: run');
+            assert.doesNotMatch(error.stack ?? '', /generator failed/);
+            assert.equal(error.cause, undefined);
+            return true;
+          },
+        );
+        assert.equal((await loadTestClaim(claimPath)).status, 'failed');
+        assert.equal(existsSync(dataRoot), true);
+        assert.equal(existsSync(generatedRoot), true);
+      } finally {
+        if (previous === undefined) delete process.env.VONA_TEST_REQUIRE_FRESH_RESOURCES;
+        else process.env.VONA_TEST_REQUIRE_FRESH_RESOURCES = previous;
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+  );
+}
 
 test('readiness retries signed not-ready responses and rejects server exit or timeout', async () => {
   const key = 'a'.repeat(64);