leerness 1.36.185 → 1.36.187

package/scripts/encoding-selftest-probe.js

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+'use strict';
+
+// T-0181: test the confirmed UR-0113 diagnostic/exit-code defect separately
+// from the unconfirmed Windows CI failure. The default violates the platform's
+// BOM contract: Windows misses its required replacement, whereas POSIX receives
+// a forbidden BOM in the disposable fixture. Both must retain failure details
+// and restore the caller's exit code. --real-controls uses the actual writer.
+const assert = require('assert');
+const cp = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const PREFIX = 'ENCODING_SELFTEST_RESULT:';
+const MISSING = 'ENCODING_DIAGNOSTICS_MISSING';
+const MAX_DIAGNOSTIC = 4096;
+const FIXTURE_PREFIX = 'leerness-encoding-selftest-';
+
+function samePath(left, right) {
+  const normalize = value => process.platform === 'win32'
+    ? path.resolve(value).toLowerCase() : path.resolve(value);
+  return normalize(left) === normalize(right);
+}
+
+function child(kind, arena, priorExit) {
+  assert(['fault', 'canonical', 'junction'].includes(kind), 'unknown child scenario');
+  assert(path.basename(arena).startsWith(FIXTURE_PREFIX), 'unexpected fixture name');
+  assert(samePath(fs.realpathSync.native(arena), arena), 'fixture must be canonical');
+  const canonical = path.join(arena, 'canonical-temp');
+  const selected = kind === 'junction' ? path.join(arena, 'junction-temp') : canonical;
+  assert(samePath(fs.realpathSync.native(selected), canonical), 'unexpected TEMP target');
+  assert(fs.statSync(path.join(arena, '.leerness')).isDirectory(), 'missing recovery boundary');
+  const previousTmpdir = os.tmpdir;
+  os.tmpdir = () => selected;
+  let injectedCalls = 0;
+  let injectedByteChanges = 0;
+  let unexpectedReplacementPlans = 0;
+  try {
+    const encoding = require('../lib/shell-encoding');
+    if (kind === 'fault') {
+      // Install before bin imports the export by value. Other fixture files
+      // retain the real planner's no-op action, without calling a writer.
+      encoding.applyShellScriptUtf8Bom = (file, displayFile = file) => {
+        if (path.basename(file) === 's.ps1') {
+          injectedCalls++;
+          if (process.platform !== 'win32') {
+            // A pre-replacement timeout alone leaves valid POSIX bytes and
+            // therefore does not violate UR-0113's no-change contract. Model
+            // an erroneous POSIX repair instead, confined to this fixture.
+            const original = fs.readFileSync(file);
+            const bom = Buffer.from([0xEF, 0xBB, 0xBF]);
+            assert(!original.subarray(0, bom.length).equals(bom), 'fault fixture already has a BOM');
+            fs.writeFileSync(file, Buffer.concat([bom, original]));
+            injectedByteChanges++;
+          }
+          const error = new Error('controlled encoding probe timeout: ' + 'x'.repeat(8192));
+          error.code = 'ETIMEDOUT';
+          throw error;
+        }
+        const plan = encoding.planShellScriptUtf8Bom(file, fs.readFileSync(file));
+        if (plan.bytes) unexpectedReplacementPlans++;
+        return { file: displayFile, action: plan.action };
+      };
+    }
+    const cases = require('../bin/leerness')._selfTestCases()
+      .filter(test => test.name.includes('UR-0113'));
+    assert.strictEqual(cases.length, 1, 'expected exactly one UR-0113 case');
+    process.exitCode = priorExit === 'unset' ? undefined : Number(priorExit);
+    const beforeExit = process.exitCode;
+    let returned = null;
+    let thrown = null;
+    try {
+      const result = cases[0].run();
+      returned = typeof result === 'boolean' ? result : null;
+    } catch (error) {
+      const message = String(error && error.message || error);
+      thrown = {
+        message: message.slice(0, MAX_DIAGNOSTIC + 1),
+        length: message.length,
+        hasTimeoutCode: message.includes('ETIMEDOUT'),
+        hasFileName: message.includes('s.ps1'),
+        platformContractFailed: message.includes('"platformOk":false'),
+      };
+    }
+    const afterExit = process.exitCode;
+    // Child status is transport status; report the case's actual exit state.
+    process.exitCode = 0;
+    process.stdout.write(PREFIX + JSON.stringify({
+      kind, node: process.version, platform: process.platform,
+      beforeExit: beforeExit === undefined ? null : beforeExit,
+      afterExit: afterExit === undefined ? null : afterExit,
+      returned, thrown, injectedCalls, injectedByteChanges, unexpectedReplacementPlans,
+    }) + '\n');
+  } finally {
+    os.tmpdir = previousTmpdir;
+  }
+}
+
+function childEnvironment(arena) {
+  const env = { ...process.env };
+  // The probe must not inherit ambient runtime descriptors, provider choices,
+  // or Node preload hooks. TEMP is overridden inside the isolated child.
+  for (const name of Object.keys(env)) {
+    if (/^LEERNESS_/i.test(name) || /^NODE_OPTIONS$/i.test(name)) delete env[name];
+  }
+  return { ...env, LEERNESS_OFFLINE: '1', LEERNESS_NO_AUTOCHCP: '1',
+    GIT_CEILING_DIRECTORIES: arena };
+}
+
+function runChild(kind, arena, priorExit = 'unset') {
+  const result = cp.spawnSync(process.execPath, [__filename, '--child', kind, arena, priorExit], {
+    cwd: arena, env: childEnvironment(arena), encoding: 'utf8',
+    shell: false, windowsHide: true,
+    timeout: kind === 'fault' ? 15000 : 45000, maxBuffer: 64 * 1024,
+  });
+  assert(!result.error, `child failed: ${result.error && result.error.code}`);
+  assert.strictEqual(result.status, 0,
+    `child exit ${result.status}: ${String(result.stderr || '').slice(0, 1000)}`);
+  const reports = String(result.stdout || '').split(/\r?\n/)
+    .filter(line => line.startsWith(PREFIX));
+  assert.strictEqual(reports.length, 1, 'child must emit exactly one observation');
+  return JSON.parse(reports[0].slice(PREFIX.length));
+}
+
+function summary(result) {
+  return JSON.stringify({
+    kind: result.kind, platform: result.platform, beforeExit: result.beforeExit, afterExit: result.afterExit,
+    returned: result.returned, injectedCalls: result.injectedCalls, injectedByteChanges: result.injectedByteChanges,
+    thrown: result.thrown && {
+      length: result.thrown.length,
+      hasTimeoutCode: result.thrown.hasTimeoutCode,
+      hasFileName: result.thrown.hasFileName,
+      platformContractFailed: result.thrown.platformContractFailed,
+    },
+  });
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  if (args[0] === '--child') return child(args[1], args[2], args[3]);
+  if (args.length > 1 || (args.length && !['--expect-legacy', '--repro', '--real-controls', '--help'].includes(args[0]))) {
+    throw new Error('usage: node scripts/encoding-selftest-probe.js [--expect-legacy|--repro|--real-controls]');
+  }
+  if (args[0] === '--help') {
+    process.stdout.write('Default / --repro: violate the platform BOM contract; require bounded ETIMEDOUT diagnostics and restored exit code.\n'
+      + '--expect-legacy: succeed only when silent failure and exit-code leakage are reproduced.\n'
+      + '--real-controls: run the real canonical/junction TEMP happy cases separately.\n');
+    return;
+  }
+  const mode = args[0] || '--repro';
+  const tempParent = fs.realpathSync.native(os.tmpdir());
+  const arena = fs.realpathSync.native(fs.mkdtempSync(path.join(tempParent, FIXTURE_PREFIX)));
+  const canonical = path.join(arena, 'canonical-temp');
+  const junction = path.join(arena, 'junction-temp');
+  const failures = [];
+  let total = 0;
+  try {
+    // Confine the preservation helper's ancestor search and recovery artifacts
+    // to this exclusive fixture, even if the user's TEMP has another harness.
+    fs.mkdirSync(path.join(arena, '.leerness'));
+    fs.mkdirSync(canonical);
+    const scenarios = mode === '--real-controls'
+      ? [['canonical', 'unset'], ['junction', 'unset']]
+      : [['fault', 'unset'], ['fault', '23']];
+    if (mode === '--real-controls') {
+      fs.symlinkSync(canonical, junction, process.platform === 'win32' ? 'junction' : 'dir');
+    }
+    for (const [kind, priorExit] of scenarios) {
+      total++;
+      const label = `${kind}, prior exit ${priorExit}`;
+      try {
+        const result = runChild(kind, arena, priorExit);
+        if (mode === '--real-controls') {
+          assert.strictEqual(result.returned, true, summary(result));
+          assert.strictEqual(result.thrown, null, summary(result));
+          assert.strictEqual(result.afterExit, result.beforeExit, summary(result));
+        } else {
+          assert.strictEqual(result.injectedCalls, 1, 'fault must reach s.ps1 exactly once');
+          assert.strictEqual(result.injectedByteChanges, result.platform === 'win32' ? 0 : 1,
+            'fault must violate the platform BOM contract');
+          assert.strictEqual(result.unexpectedReplacementPlans, 0, 'fault probe must not need another replacement');
+          const legacy = result.returned === false && !result.thrown
+            && result.afterExit === 1 && result.afterExit !== result.beforeExit;
+          if (mode === '--expect-legacy') {
+            assert(legacy, `legacy defect was not reproduced: ${summary(result)}`);
+            process.stdout.write(`${MISSING}: reproduced ${label}\n`);
+          } else {
+            assert(result.thrown && result.thrown.hasTimeoutCode && result.thrown.hasFileName
+              && result.thrown.platformContractFailed
+              && result.thrown.length <= MAX_DIAGNOSTIC,
+            `${MISSING}: ${summary(result)}`);
+            assert.strictEqual(result.afterExit, result.beforeExit,
+              `ENCODING_EXIT_CODE_NOT_RESTORED: ${summary(result)}`);
+          }
+        }
+        process.stdout.write(`ok - ${label}\n`);
+      } catch (error) {
+        failures.push(label);
+        process.stderr.write(`not ok - ${label}: ${String(error.message).slice(0, MAX_DIAGNOSTIC)}\n`);
+      }
+    }
+  } finally {
+    if (fs.existsSync(junction)) {
+      assert(fs.lstatSync(junction).isSymbolicLink(), 'refusing unexpected cleanup target');
+      assert(samePath(fs.realpathSync.native(junction), canonical), 'refusing changed junction target');
+      fs.unlinkSync(junction);
+    }
+    assert(path.basename(arena).startsWith(FIXTURE_PREFIX), 'refusing unexpected fixture cleanup');
+    assert(samePath(path.dirname(arena), tempParent), 'fixture cleanup escaped TEMP');
+    assert(samePath(fs.realpathSync.native(arena), arena), 'fixture cleanup target changed');
+    fs.rmSync(arena, { recursive: true, force: true, maxRetries: 5, retryDelay: 40 });
+  }
+  process.stdout.write(`encoding selftest probe: ${total - failures.length}/${total} PASS (${mode})\n`);
+  if (failures.length) process.exitCode = 1;
+}
+
+try { main(); }
+catch (error) {
+  process.stderr.write(`encoding selftest probe error: ${String(error.message).slice(0, MAX_DIAGNOSTIC)}\n`);
+  process.exitCode = 1;
+}

package/scripts/false-claim-probe.js

@@ -296,10 +296,16 @@ try {
       { label: 'handoff', args: ['handoff', '--json', '--no-record', '--no-drift-check', '--no-headline'], timeout: 180000 },
       { label: 'session close', args: ['session', 'close', '--json'], timeout: 300000 },
     ]) {
+      const before = treeDigest(root);
       result = run(root, aggregate.args, aggregate.timeout, true, { PATH: noGitPath });
       parsed = json(result);
-      check(`${aggregate.label} preserves null/error provenance when Git is unavailable`,
-        result.status === 0 && aggregateHistoryUnavailable(parsed), result);
+      // These aggregate commands have bookkeeping/writers. Without Git in a
+      // repository they cannot establish layout authority, unlike the pure
+      // history readers above. History-only faults below still exercise all
+      // original null/error aggregation assertions with working topology.
+      check(`${aggregate.label} rejects unresolvable repository authority before writing`,
+        result.status === 1 && parsed?.code === 'runtime_layout_incompatible'
+          && parsed.error.includes('(git_missing)') && treeDigest(root) === before, result);
     }
   } finally {
     fs.rmSync(noGitPath, { recursive: true, force: true });
@@ -403,6 +409,7 @@ try {
     ['preview', ['preview']],
     ['preview', ['preview', 'list']],
     ['preview', ['preview', 'show', 'P-0001']],
+    ['state', ['state', 'inspect']],
   ].every(([cmd, argv]) => _cliMutationClass(argv, cmd) === 'observation-only'));
   let readOnlyStatusesOk = true;
   for (const args of [
@@ -421,6 +428,7 @@ try {
     ['security-surface', '--json'],
     ['preview', '--json'],
     ['preview', 'list', '--json'],
+    ['state', 'inspect', '--json'],
   ]) {
     const readOnlyResult = run(root, args);
     if (readOnlyResult.status !== 0) readOnlyStatusesOk = false;
@@ -441,6 +449,7 @@ try {
       { args: ['identity', '--json'], status: 0 },
       { args: ['status', '--json'], status: 0 },
       { args: ['auto-update', 'status', '--json'], status: 0 },
+      { args: ['state', 'inspect', '--json'], status: 0 },
       // These surfaces currently require the canonical workspace to render;
       // on legacy input they may fail read-only, but must never migrate it.
       { args: ['dashboard', '--json'], status: 1 },
@@ -1433,6 +1442,29 @@ try {
     fs.writeFileSync(linkedStore, JSON.stringify([{ id: 'P-0001', title: 'linked output', status: 'proposed', features: [], history: [] }]), 'utf8');
     const linkedStoreBefore = digest(linkedStore);
 
+    // A partial standalone store is rejected at admission. An initialized
+    // workspace must still reach the original domain-specific link guards.
+    result = run(linkedOutputRoot, ['preview', 'mockup', 'P-0001', '--json']);
+    parsed = json(result);
+    check('standalone linked preview output is rejected before CLI bookkeeping',
+      result.status === 1 && parsed?.code === 'runtime_layout_incompatible'
+        && parsed.error.includes('(workspace_ambiguous)')
+        && digest(linkedStore) === linkedStoreBefore
+        && !fs.existsSync(path.join(linkedOutputRoot, '.leerness/cache'))
+        && fs.readdirSync(linkedOutputTarget).length === 0, result);
+    const previewServe = require('../lib/preview-serve');
+    for (const operation of [
+      () => previewServe.buildServeWorkspace(linkedOutputRoot, { id: 'P-0001', mockupPath: 'mock.html' }),
+      () => previewServe.cleanupServeDir(linkedOutputRoot, 'P-0001'),
+    ]) {
+      let caught;
+      try { operation(); } catch (error) { caught = error; }
+      check('standalone direct preview writer rejects linked output without writes',
+        caught?.code === 'E_RUNTIME_LAYOUT_INCOMPATIBLE' && caught.reasonCode === 'workspace_ambiguous'
+          && digest(linkedStore) === linkedStoreBefore && fs.readdirSync(linkedOutputTarget).length === 0);
+    }
+    fs.writeFileSync(path.join(linkedOutputRoot, '.leerness/HARNESS_VERSION'), require('../package.json').version);
+
     result = run(linkedOutputRoot, ['preview', 'mockup', 'P-0001', '--json']);
     parsed = json(result);
     check('preview mockup rejects an outward linked output directory before writing outside the project',
@@ -1442,7 +1474,6 @@ try {
         && !fs.existsSync(path.join(linkedOutputTarget, 'P-0001-mockup.html')),
       result);
 
-    const previewServe = require('../lib/preview-serve');
     const linkedBuild = previewServe.buildServeWorkspace(linkedOutputRoot, { id: 'P-0001', mockupPath: 'mock.html' });
     check('buildServeWorkspace rejects an outward linked output directory before writing its temporary HTML',
       linkedBuild.ok === false

package/scripts/file-lease-probe.js

@@ -901,7 +901,10 @@ async function main() {
   makeDirLink(cacheTarget, cacheLink);
   const cacheLinkAcquire = runLease(cacheLinkRoot, ['acquire', 'x.js', '--session', alpha, '--ttl', '300']);
   check('lease cache symlinks or junctions are rejected before writing tracked project paths',
-    cacheLinkAcquire.status === 1 && parseJson(cacheLinkAcquire)?.code === 'cache_symlink'
+    // Runtime admission now rejects the unsafe fixed descriptor parent before
+    // CLI bookkeeping or the lease-specific validator can run.
+    cacheLinkAcquire.status === 1 && parseJson(cacheLinkAcquire)?.code === 'runtime_layout_incompatible'
+      && parseJson(cacheLinkAcquire)?.error.includes('(layout_linked)')
       && !fs.existsSync(path.join(cacheTarget, 'file-leases.json')),
     cacheLinkAcquire.stdout || cacheLinkAcquire.stderr);
 
@@ -1054,7 +1057,7 @@ async function main() {
       && PU._requiredTier('npx --yes leerness lease acquire reports/release publish/status.js') === 'safe-write');
 
   check('command catalog and both help locales advertise exact-file lease',
-    catalog.status === 0 && catalogJson?.totalCommands === 100
+    catalog.status === 0 && catalogJson?.totalCommands === rows.length
       && rows.some(row => /^lease acquire\|release\|list\|check\b/.test(row.cmd))
       && /lease acquire\|release\|list\|check/.test(helpEn.stdout)
       && /leerness lease acquire\|release\|list\|check/.test(helpKo.stdout),

package/scripts/legacy-runtime-negative-probe.js

@@ -0,0 +1,72 @@
+'use strict';
+
+// Release-only negative controls. Supply an existing installed v1.36.186 package;
+// this probe never downloads a client or changes that installation.
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const cp = require('child_process');
+const crypto = require('crypto');
+const legacy = fs.realpathSync(process.argv[2] || assert.fail('Supply installed leerness@1.36.186 package directory'));
+assert.strictEqual(JSON.parse(fs.readFileSync(path.join(legacy, 'package.json'))).version, '1.36.186');
+const parent = fs.realpathSync(os.tmpdir());
+const arena = fs.mkdtempSync(path.join(parent, 'leerness-legacy-runtime-negative-'));
+const sourceFiles = ['package.json', 'bin/leerness.js', 'lib/io.js'].map(name => path.join(legacy, name));
+function identity(file) {
+  return [String(fs.statSync(file, { bigint: true }).mtimeNs),
+    crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')];
+}
+const beforeSources = sourceFiles.map(identity);
+const env = { ...process.env, LEERNESS_OFFLINE: '1', LEERNESS_INTERNAL: '1',
+  LEERNESS_NO_STALE_CHECK: '1', LEERNESS_NO_AUTOCHCP: '1', LEERNESS_NO_PROMPT: '1' };
+for (const key of Object.keys(env)) if (/^GIT_|^LEERNESS_(SESSION_ID|WORKSPACE_DIR|MCP_)/i.test(key)) delete env[key];
+const future = JSON.stringify({ schema: 'leerness.runtime-layout/v1', schemaVersion: 1,
+  scope: 'project-local', generation: 1, layout: 'legacy', requiredWriterProtocol: 2 });
+function fixture(name) {
+  const root = path.join(arena, name);
+  fs.mkdirSync(path.join(root, '.leerness/cache'), { recursive: true });
+  fs.writeFileSync(path.join(root, '.leerness/HARNESS_VERSION'), '1.36.186\n');
+  return root;
+}
+function layout(root) {
+  const file = path.join(root, '.leerness/cache/state-layout.json');
+  fs.writeFileSync(file, future); return file;
+}
+try {
+  const root = fixture('old-cli'), descriptor = layout(root);
+  const stamp = identity(descriptor);
+  const old = cp.spawnSync(process.execPath, [path.join(legacy, 'bin/leerness.js'),
+    'state', 'start', '--path', root, '--goal', 'isolated negative control', '--json'],
+  { cwd: root, env, encoding: 'utf8', timeout: 120000 });
+  assert.strictEqual(old.status, 0, old.stderr + old.stdout);
+  assert(fs.existsSync(path.join(root, '.leerness/state.json')), 'old CLI must demonstrate the known missing guard');
+  assert.deepStrictEqual(identity(descriptor), stamp);
+  console.log('PASS negative control: v1.36.186 CLI does not honor the new descriptor');
+
+  const retained = require(path.join(legacy, 'lib/io.js')).writeUtf8;
+  const longLived = fixture('already-loaded-writer');
+  layout(longLived);
+  const output = path.join(longLived, '.leerness/cache/retained.txt');
+  retained(output, 'old writer remains unguarded');
+  assert.strictEqual(fs.readFileSync(output, 'utf8'), 'old writer remains unguarded');
+  console.log('PASS negative control: already-loaded legacy writer remains unguarded');
+
+  const currentRoot = fixture('current-cli'), currentDescriptor = layout(currentRoot);
+  const currentStamp = identity(currentDescriptor);
+  const current = cp.spawnSync(process.execPath, [path.resolve(__dirname, '../bin/leerness.js'),
+    'state', 'start', '--path', currentRoot, '--goal', 'new writer control', '--json'],
+  { cwd: currentRoot, env, encoding: 'utf8', timeout: 120000 });
+  assert.strictEqual(current.status, 1, current.stderr + current.stdout);
+  assert.strictEqual(JSON.parse(current.stdout).code, 'runtime_layout_incompatible');
+  assert(!fs.existsSync(path.join(currentRoot, '.leerness/state.json')));
+  assert.deepStrictEqual(identity(currentDescriptor), currentStamp);
+  console.log('PASS current writer refuses the same incompatible layout');
+  assert.deepStrictEqual(sourceFiles.map(identity), beforeSources);
+  console.log('legacy runtime negative controls: 3/3 PASS; installed source unchanged');
+} finally {
+  assert.strictEqual(fs.realpathSync(arena), arena);
+  assert.strictEqual(path.dirname(arena), parent);
+  assert(path.basename(arena).startsWith('leerness-legacy-runtime-negative-'));
+  fs.rmSync(arena, { recursive: true, force: true });
+}

package/scripts/mutation-integrity-probe.js

@@ -489,6 +489,9 @@ try {
   // Security + critical drift must still run session recovery in the same pass.
   const combinedDir = path.join(tempRoot, 'drift-security-critical');
   fs.mkdirSync(path.join(combinedDir, '.leerness'), { recursive: true });
+  // The DI fixture writes a synthetic usage.json, unlike the real cache path.
+  // Establish workspace ownership before exercising its recovery sequence.
+  fs.writeFileSync(path.join(combinedDir, '.leerness', 'HARNESS_VERSION'), 'fixture\n');
   fs.writeFileSync(path.join(combinedDir, '.env'), 'TOKEN=value\n');
   fs.writeFileSync(path.join(combinedDir, '.gitignore'), 'node_modules/\n');
   fs.writeFileSync(path.join(combinedDir, '.leerness', 'session-handoff.md'), 'Last generated: 2020-01-01T00:00:00.000Z\n');

package/scripts/role-fallback-probe.js

@@ -686,7 +686,10 @@ test('linked execution-ledger parents are rejected before any external target is
     assert.strictEqual(history.code, 'ledger_parent_linked');
     assert.throws(
       () => appendExecutionEvent(dir, { event: 'execution.started', taskId: 'T-LINK' }),
-      error => error && error.code === 'ledger_parent_linked',
+      // Direct reads retain their ledger diagnostic; writer admission rejects
+      // the linked workspace before entering the append implementation.
+      error => error && error.code === 'E_RUNTIME_LAYOUT_INCOMPATIBLE'
+        && error.reasonCode === 'workspace_dir_symlink',
     );
     assert.strictEqual(fs.existsSync(path.join(outside, 'execution-ledger.jsonl')), false);
     assert.deepStrictEqual(fs.readFileSync(path.join(outside, 'sentinel.txt')), before);
@@ -750,14 +753,59 @@ test('execution-ledger reads and appends bind validation to the opened inode', (
 });
 
 test('dangling execution-ledger symlinks are rejected without creating their target', () => {
-  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-ledger-dangling-'));
+  const temp = fs.realpathSync.native(os.tmpdir());
+  const base = fs.mkdtempSync(path.join(temp, 'leerness-ledger-dangling-'));
   const dir = path.join(base, 'project');
   const ledger = path.join(dir, '.leerness', 'execution-ledger.jsonl');
   const missingTarget = path.join(base, 'outside-missing.jsonl');
+  let linkType = 'file';
+  const snapshot = () => {
+    const rows = [];
+    const visit = (file, relative) => {
+      const stat = fs.lstatSync(file, { bigint: true });
+      const row = [relative, String(stat.mode), String(stat.size), String(stat.mtimeNs)];
+      if (stat.isSymbolicLink()) rows.push([...row, 'link', fs.readlinkSync(file)]);
+      else if (stat.isDirectory()) {
+        rows.push([...row, 'directory']);
+        for (const name of fs.readdirSync(file).sort()) visit(path.join(file, name), `${relative}/${name}`);
+      } else {
+        assert.ok(stat.isFile(), `unexpected fixture file kind: ${relative}`);
+        rows.push([...row, 'file', fs.readFileSync(file).toString('base64')]);
+      }
+    };
+    visit(base, '.');
+    return rows;
+  };
   try {
     fs.mkdirSync(path.dirname(ledger), { recursive: true });
-    try { fs.symlinkSync(missingTarget, ledger, 'file'); }
-    catch { return; }
+    fs.writeFileSync(path.join(base, 'outside-sentinel.txt'), 'unchanged\n', 'utf8');
+    assert.strictEqual(fs.existsSync(missingTarget), false);
+    // Keep native file-symlink coverage wherever available, including Windows CI.
+    // Only Windows permission failures fall back to the same lstat guard via a junction.
+    try { fs.symlinkSync(missingTarget, ledger, linkType); }
+    catch (error) {
+      if (process.platform !== 'win32' || !['EPERM', 'EACCES'].includes(error.code)) throw error;
+      linkType = 'junction';
+      fs.symlinkSync(missingTarget, ledger, linkType);
+    }
+    assert.ok(fs.lstatSync(ledger).isSymbolicLink());
+    assert.strictEqual(fs.existsSync(missingTarget), false);
+
+    // A standalone store containing a link is not an accepted workspace. The first
+    // writer refuses admission before the ledger domain can inspect or create its target.
+    const standaloneBefore = snapshot();
+    assert.throws(
+      () => appendExecutionEvent(dir, { event: 'execution.started', taskId: 'T-DANGLING' }),
+      error => error && error.code === 'E_RUNTIME_LAYOUT_INCOMPATIBLE'
+        && error.reasonCode === 'workspace_ambiguous',
+    );
+    assert.strictEqual(fs.existsSync(missingTarget), false);
+    assert.deepStrictEqual(snapshot(), standaloneBefore);
+
+    // A normal initialized marker admits the workspace, preserving the original
+    // read/append domain-link checks instead of replacing them with the admission error.
+    fs.writeFileSync(path.join(dir, '.leerness', 'HARNESS_VERSION'), require('../package.json').version + '\n', 'utf8');
+    const initializedBefore = snapshot();
     const history = readExecutionEvents(dir, 20);
     assert.strictEqual(history.ok, false);
     assert.strictEqual(history.code, 'ledger_not_regular_file');
@@ -766,9 +814,18 @@ test('dangling execution-ledger symlinks are rejected without creating their tar
       error => error && error.code === 'ledger_not_regular_file',
     );
     assert.strictEqual(fs.existsSync(missingTarget), false);
+    assert.deepStrictEqual(snapshot(), initializedBefore);
+    console.log('  DANGLING_LEDGER_BOUNDARIES ' + JSON.stringify({
+      platform: process.platform, linkType, casesRun: 2, skipped: 0,
+      standalone: 'workspace_ambiguous', initialized: 'ledger_not_regular_file', unchanged: true,
+    }));
   } finally {
     try { fs.rmSync(ledger, { force: true }); } catch {}
-    fs.rmSync(base, { recursive: true, force: true });
+    const actual = fs.realpathSync.native(base);
+    assert.strictEqual(actual, base);
+    assert.strictEqual(path.dirname(actual), temp);
+    assert.match(path.basename(actual), /^leerness-ledger-dangling-[A-Za-z0-9]{6}$/);
+    fs.rmSync(actual, { recursive: true, force: true });
   }
 });
 
@@ -1999,7 +2056,11 @@ try {
     fs.mkdirSync(ledger);
     const result = run(['agents', 'history', '--path', fixture, '--json'], { env });
     assert.strictEqual(result.status, 1, result.stderr || result.stdout);
-    assert.strictEqual(json(result).code, 'ledger_not_regular_file');
+    // The CLI has startup bookkeeping, so ambiguous standalone ownership is
+    // refused first. The read-only store API still reports its exact reason.
+    assert.strictEqual(json(result).code, 'runtime_layout_incompatible');
+    assert.ok(json(result).error.includes('(workspace_ambiguous)'));
+    assert.strictEqual(readExecutionEvents(fixture, 20).code, 'ledger_not_regular_file');
     assert.ok(fs.statSync(ledger).isDirectory());
   });
 } finally {