leerness 1.36.297 → 1.36.299

package/scripts/memory-arena-cleanup-probe.js

@@ -0,0 +1,106 @@
+'use strict';
+// T-0354: scripts/memory-migration-test-support.js removes its arena at finish() when every test passed, and keeps
+// it when one failed. A link inside the arena that points outside it is removed as a link: its target and the files
+// in it must survive. An arena, or a folder in it, that was replaced with a link is not walked, whether that happened
+// before finish() or while it ran. Each case runs the support in a child process, the way the memory probes use it.
+const assert = require('assert');
+const cp = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const support = path.join(__dirname, 'memory-migration-test-support.js');
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log('PASS ' + name); }
+  catch (error) { failed++; console.error('FAIL ' + name + ': ' + (error && error.stack || error)); }
+}
+const linkType = process.platform === 'win32' ? 'junction' : 'dir';
+const unlinkLink = link => { try { fs.unlinkSync(link); } catch { fs.rmdirSync(link); } };
+const outside = fs.mkdtempSync(path.join(fs.realpathSync.native(os.tmpdir()), 'leerness-arena-cleanup-outside-'));
+const sentinel = path.join(outside, 'sentinel.txt');
+fs.writeFileSync(sentinel, 'kept');
+// A second outside folder with a link of its own, for the replacement cases.
+const elsewhere = fs.mkdtempSync(path.join(fs.realpathSync.native(os.tmpdir()), 'leerness-arena-cleanup-elsewhere-'));
+fs.writeFileSync(path.join(elsewhere, 'keep.txt'), 'kept');
+fs.symlinkSync(outside, path.join(elsewhere, 'keep-link'), linkType);
+// The child links to `outside` from inside its arena, runs one test that passes or fails, calls finish(), and prints
+// its arena path. `replace` renames a folder aside and puts a link to `elsewhere` in its place:
+//   'arena-before'      the arena, before finish();
+//   'arena-after-check' the arena, right after finish() checked its identity;
+//   'nested-during'     the arena's `nested` folder, right after finish() saw it as a folder.
+const child = (shouldFail, replace = '') => cp.spawnSync(process.execPath, ['-e', `
+  const S = require(${JSON.stringify(support)});
+  const fs = require('fs'), path = require('path');
+  const type = ${JSON.stringify(linkType)}, elsewhere = ${JSON.stringify(elsewhere)}, replace = ${JSON.stringify(replace)};
+  const swap = dir => { fs.renameSync(dir, dir + '-aside'); fs.symlinkSync(elsewhere, dir, type); };
+  fs.mkdirSync(path.join(S.arena, 'nested'));
+  fs.symlinkSync(${JSON.stringify(outside)}, path.join(S.arena, 'nested', 'link-out'), type);
+  if (replace === 'arena-before') swap(S.arena);
+  S.test('child test', () => { if (${shouldFail}) throw new Error('planned failure'); });
+  const lstat = fs.lstatSync;
+  let armed = replace === 'arena-after-check' || replace === 'nested-during';
+  fs.lstatSync = function (file, ...rest) {
+    const st = lstat.call(this, file, ...rest);
+    if (armed && replace === 'arena-after-check' && file === S.arena && rest[0] && rest[0].bigint) { armed = false; swap(file); }
+    if (armed && replace === 'nested-during' && file === path.join(S.arena, 'nested')) { armed = false; swap(file); }
+    return st;
+  };
+  S.finish('arena cleanup child');
+  fs.lstatSync = lstat;
+  console.log('ARENA ' + S.arena + (armed ? ' (the replacement never happened)' : ''));
+`], { encoding: 'utf8', windowsHide: true, timeout: 60000 });
+const arenaOf = r => {
+  const line = r.stdout.split(/\r?\n/).find(l => l.startsWith('ARENA '));
+  assert(line && !line.includes('never happened'), r.stdout + r.stderr);
+  return line.slice(6);
+};
+const outsideIntact = () => {
+  assert.strictEqual(fs.lstatSync(path.join(elsewhere, 'keep-link')).isSymbolicLink(), true, 'the link behind the replacement must be kept');
+  assert.strictEqual(fs.readFileSync(path.join(elsewhere, 'keep.txt'), 'utf8'), 'kept');
+  assert.strictEqual(fs.readFileSync(sentinel, 'utf8'), 'kept');
+};
+try {
+  test('a passing run removes its arena, and a link to a folder outside it leaves that folder alone', () => {
+    const r = child(false);
+    assert.strictEqual(r.status, 0, r.stdout + r.stderr);
+    assert.strictEqual(fs.existsSync(arenaOf(r)), false, 'the arena must be gone');
+    assert.strictEqual(fs.readFileSync(sentinel, 'utf8'), 'kept', 'the link target must be untouched');
+    assert.match(r.stdout, /arena cleanup child: 1\/1 passed; fixtures: .*\(removed\)/);
+  });
+  test('a failing run keeps its arena for inspection', () => {
+    const r = child(true);
+    assert.strictEqual(r.status, 1, r.stdout + r.stderr);
+    const arena = arenaOf(r), link = path.join(arena, 'nested', 'link-out');
+    assert.strictEqual(fs.existsSync(arena), true, 'the arena must be kept');
+    assert.strictEqual(fs.lstatSync(link).isSymbolicLink(), true, 'its contents must be kept');
+    assert.match(r.stdout, /arena cleanup child: 0\/1 passed; fixtures: .*\(kept\)/);
+    unlinkLink(link);
+    fs.rmSync(arena, { recursive: true, force: true });
+    assert.strictEqual(fs.readFileSync(sentinel, 'utf8'), 'kept');
+  });
+  for (const [replace, what] of [['arena-before', 'an arena replaced by a link before finish()'],
+    ['arena-after-check', 'an arena replaced by a link right after its identity check'],
+    ['nested-during', 'a folder in the arena replaced by a link while finish() walks the arena']]) {
+    test(`${what} is not walked, and nothing behind the link is removed`, () => {
+      // Each case starts with `elsewhere` whole, so one failure does not decide the next case.
+      try { fs.lstatSync(path.join(elsewhere, 'keep-link')); } catch { fs.symlinkSync(outside, path.join(elsewhere, 'keep-link'), linkType); }
+      fs.writeFileSync(path.join(elsewhere, 'keep.txt'), 'kept');
+      const r = child(false, replace);
+      assert.strictEqual(r.status, 0, r.stdout + r.stderr);
+      const arena = arenaOf(r);
+      outsideIntact();
+      assert.match(r.stdout, /arena cleanup child: 1\/1 passed; fixtures: .*\(not removed: E_ARENA_REPLACED\)/);
+      const swapped = replace === 'nested-during' ? path.join(arena, 'nested') : arena;
+      unlinkLink(swapped);
+      unlinkLink(path.join(replace === 'nested-during' ? path.join(arena, 'nested-aside') : path.join(arena + '-aside', 'nested'), 'link-out'));
+      fs.rmSync(replace === 'nested-during' ? arena : arena + '-aside', { recursive: true, force: true });
+    });
+  }
+} finally {
+  try { unlinkLink(path.join(elsewhere, 'keep-link')); } catch {}
+  fs.rmSync(elsewhere, { recursive: true, force: true });
+  fs.rmSync(outside, { recursive: true, force: true });
+}
+console.log(`memory arena cleanup probe: ${passed}/${passed + failed} passed (${process.platform})`);
+process.exitCode = failed ? 1 : 0;

package/scripts/memory-checked-input-probe.js

@@ -63,7 +63,7 @@ function run(project,args,config) {
 }
 let serial=0;
 function fixture(surface,legacy=false) {
-  const project=path.join(temp,'case-'+(++serial)); fs.cpSync(seed,project,{recursive:true});
+  const project=path.join(temp,'case-'+(++serial)); require('../lib/copy-tree').copyTreeSync(seed,project);
   const p=ext=>path.join(project,'.leerness',surface+'.'+ext);
   const item=value=>surface==='decisions'?{date:'2026-01-01',title:value,decision:value,reason:null,alternatives:null,impact:null,extension:{keep:'line1\nline2'}}:{date:'2026-01-01',text:value,tag:null,extension:{keep:'line1\nline2'}};
   const body=value=>surface==='decisions'?`### 2026-01-01 — ${value}\n- Decision: ${value}\n`:`### 2026-01-01\n- Lesson: ${value}\n`;

package/scripts/memory-guard-order-probe.js

@@ -36,7 +36,7 @@ const snapshot = root => Object.fromEntries([
 let sequence = 0;
 const fixture = () => {
   const root = path.join(temp, `case-${++sequence}`);
-  fs.cpSync(seed, root, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, root);
   return root;
 };
 const check = (name, fn) => {

package/scripts/memory-input-preflight-probe.js

@@ -52,7 +52,7 @@ const syncProjection = (root, surface, entries) => fs.writeFileSync(projection(r
 let sequence = 0;
 function fixture() {
   const root = path.join(temp, `case-${String(++sequence).padStart(3, '0')}`);
-  fs.cpSync(seed, root, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, root);
   return root;
 }
 function run(root, args) {

package/scripts/memory-legacy-retention-probe.js

@@ -44,7 +44,7 @@ function fileState(file) {
 }
 function fixture(surface) {
   const project = path.join(temp, `case-${++sequence}`);
-  fs.cpSync(seed, project, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, project);
   const p = ext => path.join(project, '.leerness', `${surface}.${ext}`);
   const entry = value => surface === 'decisions'
     ? { date: '2026-09-12', title: value, decision: value, reason: 'reason', alternatives: null, impact: null }
@@ -131,7 +131,7 @@ try {
     });
     check(`${surface} fresh init remains usable and retains its template`, () => {
       const project = path.join(temp, `case-${++sequence}`);
-      fs.cpSync(seed, project, { recursive: true });
+      require('../lib/copy-tree').copyTreeSync(seed, project);
       const md = path.join(project, '.leerness', `${surface}.md`);
       const original = fs.existsSync(md) ? fs.readFileSync(md, 'utf8') : '';
       success(run(project, commands(surface).add));

package/scripts/memory-migration-test-support.js

@@ -54,8 +54,46 @@ function privateMetadata(result) {
 const legacy = surface => surface === 'decisions'
   ? `# Personal notes\n### 2026-09-12 — Example\n- Decision: ${PRIVATE}\n- Reason: test\n`
   : `# Personal notes\n### 2026-09-12\n- Lesson: ${PRIVATE}\n- Tag: fixture\n`;
+// T-0354: a run with no failures removes its arena; nothing did before, and every run of a memory probe left one in
+// the temp directory (1,206 were found). A failed run keeps it for inspection. Links inside the arena are removed
+// first, as links, so the removal never walks into a link's target, wherever that points. The arena itself must
+// still be the folder made above (same file identity, not a link): a test that renamed it away and put a link in its
+// place would otherwise have the walk run inside the link's target (review round 1).
+const arenaIdentity = fs.lstatSync(arena, { bigint: true });
+function sameArena() {
+  const st = fs.lstatSync(arena, { bigint: true });
+  return !st.isSymbolicLink() && st.isDirectory() && st.dev === arenaIdentity.dev && st.ino === arenaIdentity.ino;
+}
+// Review round 2: a folder can also be replaced by a link after its lstat, and the arena right after sameArena().
+// So each folder must still resolve inside the arena just before it is listed and before a link in it is removed.
+// finish() runs after the tests, so nothing else changes the arena then; a process that kept swapping folders
+// during finish() could still race these checks.
+const arenaReal = fs.realpathSync.native(arena);
+const replaced = () => Object.assign(new Error('the arena was replaced'), { code: 'E_ARENA_REPLACED' });
+function resolvesInArena(dir) {
+  const relative = path.relative(arenaReal, fs.realpathSync.native(dir));
+  return !(relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative));
+}
+function removeLinks(dir) {
+  if (!resolvesInArena(dir)) throw replaced();
+  for (const name of fs.readdirSync(dir)) {
+    const file = path.join(dir, name), st = fs.lstatSync(file);
+    if (st.isSymbolicLink()) {
+      if (!resolvesInArena(dir)) throw replaced();
+      try { fs.unlinkSync(file); } catch { fs.rmdirSync(file); }
+    } else if (st.isDirectory()) removeLinks(file);
+  }
+}
 function finish(label) {
-  console.log(`${label}: ${count - failed}/${count} passed; fixtures: ${arena}`);
-  if (failed) process.exitCode = 1;
+  let kept = '';
+  if (failed) { process.exitCode = 1; kept = ' (kept)'; }
+  else {
+    try {
+      if (!sameArena()) throw replaced();
+      removeLinks(arena); require('./temp-cleanup').removeTree(arena, { recursive: true, force: true }); kept = ' (removed)';
+    }
+    catch (error) { kept = ` (not removed: ${error.code || error.message})`; }
+  }
+  console.log(`${label}: ${count - failed}/${count} passed; fixtures: ${arena}${kept}`);
 }
 module.exports = { assert, fs, path, cp, arena, entry, PRIVATE, test, project, snapshot, command, privateMetadata, legacy, finish };

package/scripts/memory-output-publication-probe.js

@@ -107,7 +107,7 @@ function entry(surface, value) {
 function render(surface, entries) { return surface === 'decisions' ? _renderDecisionsMd(entries) : _renderLessonsMd(entries); }
 function fixture(surface, options = {}) {
   const project = path.join(temp, `case-${++sequence}`);
-  fs.cpSync(seed, project, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, project);
   const hd = path.join(project, '.leerness');
   const json = path.join(hd, `${surface}.json`);
   const md = path.join(hd, `${surface}.md`);

package/scripts/memory-policy-root-spelling-probe.js

@@ -0,0 +1,110 @@
+'use strict';
+// T-0350: a decisions or lessons restore with an explicit write policy must work when the project root is spelled
+// differently from its real path. Until 1.36.297 the footprint capture named its snapshots under the realpath.native
+// workspace while admission and preparation named the same files under the caller's spelling, so
+// assertCheckedFileCurrent refused every such restore with "snapshot does not belong to this file".
+// Spellings: as created, and on Windows a lowercase drive letter, a junction and the 8.3 short name (reported as
+// skipped when the volume has no short names); elsewhere a symlink. Each restore must leave the same files as the
+// restore through the real path. One MCP restore per surface uses a non-canonical spelling too.
+const S = require('./memory-write-budget-support');
+const { assert, fs, path, cp, arena, entry, test, finish, fixture, row, options } = S;
+const { renderLosslessArchiveEntries } = require('../lib/memory-archive');
+const policy = JSON.stringify({ limits: options(), mode: 'within-target',
+  targets: { items: 100, canonicalBytes: 65536, projectionBytes: 65536, archiveBytes: 65536, totalPathBytes: 200000 } });
+const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => /^(PATH|PATHEXT|SystemRoot|WINDIR|COMSPEC)$/i.test(k)));
+for (const key of ['TEMP','TMP','USERPROFILE','APPDATA','LOCALAPPDATA']) { env[key] = path.join(arena,'env-'+key.toLowerCase()); fs.mkdirSync(env[key]); }
+Object.assign(env,{ LEERNESS_INTERNAL: '1', LEERNESS_OFFLINE: '1', LEERNESS_NO_BANNER: '1', LEERNESS_NO_PROMPT: '1', LEERNESS_NO_AUTOCHCP: '1' });
+const win = process.platform === 'win32';
+
+const make = s => fixture(s,[row(s,'base')],'\nPRIVATE suffix\n',
+  { [s+'.archive.md']: '# Archive\n\n## 제거 2026-09-01 (target: "recover")\n'+renderLosslessArchiveEntries(s,[row(s,'revive')])+'\n' });
+// What a restore leaves, read through the real path.
+const state = (p, s) => ({ rows: JSON.parse(fs.readFileSync(path.join(p,'.leerness',s+'.json'),'utf8')),
+  projection: fs.readFileSync(path.join(p,'.leerness',s+'.md'),'utf8'), archive: fs.readFileSync(path.join(p,'.leerness',s+'.archive.md'),'utf8') });
+// The 8.3 name of an existing folder, or null when the volume gives none.
+function shortName(p) {
+  const r = cp.spawnSync(process.env.ComSpec || 'cmd.exe', ['/d','/s','/c',`"for %I in ("${p}") do @echo %~sI"`],
+    { encoding: 'utf8', windowsHide: true, windowsVerbatimArguments: true });
+  const out = String(r.stdout || '').trim();
+  return r.status === 0 && out && !out.includes('"') && out.toLowerCase() !== p.toLowerCase() ? out : null;
+}
+const spellings = [
+  ['as created', p => p],
+  ...(win ? [
+    ['a lowercase drive letter', p => /^[A-Z]:/.test(p) ? p[0].toLowerCase() + p.slice(1) : null],
+    ['a junction', p => { const link = p + '-junction'; fs.symlinkSync(p, link, 'junction'); return link; }],
+    ['the 8.3 short name', shortName],
+  ] : [
+    ['a symlink', p => { const link = p + '-symlink'; fs.symlinkSync(p, link, 'dir'); return link; }],
+  ]),
+];
+function restoreCli(spelled, s) {
+  const r = cp.spawnSync(process.execPath,[entry,'memory','restore',s,'recover','--path',spelled,'--write-policy-json',policy,'--json'],
+    { cwd: spelled, env, encoding: 'utf8', timeout: 60000, maxBuffer: 1048576, windowsHide: true });
+  assert(!r.error && !r.signal, r.error && r.error.message);
+  return r;
+}
+function restoreMcp(spelled, s) {
+  const request = { jsonrpc: '2.0', id: 1, method: 'tools/call',
+    params: { name: 'leerness_memory_restore', arguments: { surface: s, target: 'recover', path: spelled, writePolicyJson: policy } } };
+  const r = cp.spawnSync(process.execPath,[entry,'mcp','serve','--profile','full'],
+    { cwd: spelled, env, input: JSON.stringify(request)+'\n', encoding: 'utf8', timeout: 60000, maxBuffer: 1048576, windowsHide: true });
+  assert(!r.error && !r.signal, r.error && r.error.message); assert.equal(r.status,0,r.stderr);
+  return JSON.parse(r.stdout.trim().split(/\r?\n/)[0]);
+}
+// T-0355: a spelling this machine cannot give counts as absent: a test arena on a UNC path has no drive letter, and
+// a link may be refused there. The MCP and resolve-check tests take the first non-canonical spelling that exists.
+const trySpell = (spell, p) => { try { return spell(p); } catch { return null; } };
+function alternate(p) {
+  for (const [name, spell] of spellings.slice(1)) { const spelled = trySpell(spell, p); if (spelled && spelled !== p) return [name, spelled]; }
+  return null;
+}
+
+for (const s of ['decisions','lessons']) {
+  let expected = null;
+  for (const [name, spell] of spellings) {
+    const p = make(s), spelled = trySpell(spell, p);
+    if (spelled === null) { console.log(`SKIP ${s}: policy restore through ${name} (this volume or path gives no such spelling)`); continue; }
+    test(`${s}: policy restore through ${name} matches the restore through the real path`, () => {
+      if (name !== 'as created') assert.notStrictEqual(spelled, p, 'the spelling must differ from the real path');
+      const r = restoreCli(spelled, s);
+      assert.equal(r.status, 0, r.stdout + r.stderr);
+      const after = state(p, s);
+      assert.deepEqual(after.rows.map(entry => entry.title || entry.text), ['base','revive']);
+      assert(!after.archive.includes('target: "recover"'), 'the restored block must leave the archive');
+      if (expected === null) expected = after; else assert.deepEqual(after, expected);
+    });
+  }
+  const pm = make(s), alt = alternate(pm);
+  if (!alt) { console.log(`SKIP ${s}: MCP policy restore (this volume or path gives no non-canonical spelling)`); continue; }
+  const [mcpName, spelled] = alt; // a lowercase drive letter on Windows when there is one, a symlink elsewhere
+  test(`${s}: MCP policy restore through ${mcpName}`, () => {
+    const p = pm;
+    const reply = restoreMcp(spelled, s);
+    assert(reply.result, JSON.stringify(reply)); assert.equal(reply.result.isError, false, JSON.stringify(reply));
+    assert.deepEqual(state(p, s).rows.map(entry => entry.title || entry.text), ['base','revive']);
+  });
+}
+// The capture names files under the given spelling only after that spelling's workspace resolves to the resolved
+// one. Make it resolve elsewhere (as a swapped link would between the two resolutions) and the capture must refuse
+// before reading a file; without the check the files of the other folder would be measured as this project's.
+const resolveCheckProject = make('decisions'), resolveCheckAlternate = alternate(resolveCheckProject);
+if (!resolveCheckAlternate) console.log('SKIP a spelled workspace that resolves to another folder (no non-canonical spelling here)');
+else test('a spelled workspace that resolves to another folder is refused before any file is read', () => {
+  const { inspectMemoryFootprint } = require('../lib/memory-footprint');
+  const p = resolveCheckProject, other = make('decisions'), spelled = resolveCheckAlternate[1];
+  const limits = JSON.stringify(options().observation);
+  assert.equal(inspectMemoryFootprint(spelled,'decisions',limits).ok, true, 'control: the spelling itself is accepted');
+  const workspace = path.join(spelled,'.leerness'), same = (a, b) => win ? a.toLowerCase() === b.toLowerCase() : a === b;
+  const real = fs.realpathSync.native, opened = [], open = fs.openSync;
+  fs.realpathSync.native = function (file, ...rest) {
+    return real.call(fs, same(path.resolve(String(file)), path.resolve(workspace)) ? path.join(other,'.leerness') : file, ...rest);
+  };
+  fs.openSync = function (file, ...rest) { opened.push(String(file)); return open.call(fs, file, ...rest); };
+  try {
+    const result = inspectMemoryFootprint(spelled,'decisions',limits);
+    assert.equal(result.ok, false); assert.equal(result.error.code, 'workspace_unavailable');
+    assert.deepEqual(opened.filter(file => /\.leerness[\\/]decisions\./.test(file)), [], 'no store file may be opened');
+  } finally { fs.realpathSync.native = real; fs.openSync = open; }
+});
+finish('memory policy root spelling');

package/scripts/memory-projection-retention-probe.js

@@ -39,7 +39,7 @@ function run(project, args) {
 function success(r) { assert.strictEqual(r.status, 0, String(r.stdout || r.stderr).slice(-1000)); }
 function fixture(surface) {
   const project = path.join(temp, `case-${++sequence}`);
-  fs.cpSync(seed, project, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, project);
   const hd = path.join(project, '.leerness');
   const p = ext => path.join(hd, `${surface}.${ext}`);
   const entry = surface === 'decisions'

package/scripts/memory-recovery-external-probe.js

@@ -5,7 +5,9 @@ const os=require('os'),runtime=require('../lib/runtime-writes'),{attachMemoryRec
 // Node 18 writeFileSync dispatches through the later intercepted writeSync.
 // Capture primitive fixture writers before installing interception, so descriptor
 // changes represent an external writer rather than the guarded operation itself.
-const rawOpen=fs.openSync.bind(fs),rawWriteSync=fs.writeSync.bind(fs),rawClose=fs.closeSync.bind(fs);
+const rawOpen=fs.openSync.bind(fs),rawWriteSync=fs.writeSync.bind(fs),rawClose=fs.closeSync.bind(fs),rawRename=fs.renameSync.bind(fs);
+const rawSymlink=fs.symlinkSync.bind(fs),rawUnlink=fs.unlinkSync.bind(fs),rawRmdir=fs.rmdirSync.bind(fs);
+const rawUnlinkLink=link=>{try{rawUnlink(link);}catch{rawRmdir(link);}};
 function rawWrite(file,text){const fd=rawOpen(file,'w');try{rawWriteSync(fd,Buffer.from(text));}finally{rawClose(fd);}}
 const descriptor={schema:'leerness.runtime-layout/v1',schemaVersion:1,scope:'project-local',generation:1,layout:'legacy',requiredWriterProtocol:1};
 // Begin in the supported implicit legacy layout. Creating an incompatible
@@ -36,6 +38,71 @@ test('a temp directory inside the project is rejected before producer work',()=>
     os.tmpdir=()=>p;try{assert.throws(()=>runtime.writeExternalRecoveryStream(p,()=>{called=true;},8),e=>e.code==='E_RECOVERY_TEMP_UNSAFE');}finally{os.tmpdir=original;}
   });assert.equal(called,false);
 });
+// T-0349: the same folder spelled so that its text is outside the project: through a link placed outside it, and
+// on Windows by its 8.3 short name. The guard compared spellings only and let both through.
+function shortName(p){const r=cp.spawnSync(process.env.ComSpec||'cmd.exe',['/d','/s','/c',`"for %I in ("${p}") do @echo %~sI"`],{encoding:'utf8',windowsHide:true,windowsVerbatimArguments:true});const out=String(r.stdout||'').trim();return r.status===0&&out&&!out.includes('"')&&out.toLowerCase()!==p.toLowerCase()?out:null;}
+const insideSpellings=[['a link outside the project',(p,inside)=>{const link=p+'-temp-link';fs.symlinkSync(inside,link,process.platform==='win32'?'junction':'dir');return link;}],
+  ...(process.platform==='win32'?[['its 8.3 short name',(p,inside)=>shortName(inside)]]:[])];
+for(const [name,spell] of insideSpellings){
+  const p=project(),inside=path.join(p,'temp-folder-with-a-long-name');fs.mkdirSync(inside);const spelled=spell(p,inside);
+  if(!spelled){console.log('SKIP a temp folder inside the project named by '+name+' (no such spelling here)');continue;}
+  test('a temp folder inside the project named by '+name+' is rejected before producer work',()=>{
+    assert(path.relative(p,spelled).startsWith('..'),'the spelling must look outside the project: '+spelled);
+    const original=os.tmpdir;let called=false;latch(p,()=>{
+      os.tmpdir=()=>spelled;try{assert.throws(()=>runtime.writeExternalRecoveryStream(p,()=>{called=true;},8),e=>e.code==='E_RECOVERY_TEMP_UNSAFE');}finally{os.tmpdir=original;}
+    });assert.equal(called,false);assert.deepEqual(fs.readdirSync(inside),[]);
+  });
+}
+// T-0349 review: a project folder renamed away while the operation runs has no real path. Its recovery must still be
+// written outside it, as before; only a temp folder that does not resolve is refused.
+test('a project renamed away during the operation still gets its recovery outside it',()=>{
+  const p=project(),moved=p+'-moved';let dir;latch(p,()=>{
+    rawRename(p,moved);try{dir=runtime.writeExternalRecoveryStream(p,sink=>sink.write('before.bin',put=>put(Buffer.from('before'))),8);}finally{rawRename(moved,p);}
+  });
+  external.push(dir);assert(path.relative(p,dir).startsWith('..'));assert.equal(fs.readFileSync(path.join(dir,'before.bin'),'utf8'),'before');
+});
+// Review round 1: a child folder whose name starts with two dots is inside the project, named directly and through a
+// link outside the project (only the real paths then show it).
+for(const [name,spell] of [['directly',(p,inside)=>inside],['through a link outside the project',(p,inside)=>{const link=p+'-dots-link';fs.symlinkSync(inside,link,process.platform==='win32'?'junction':'dir');return link;}]]){
+  test('a temp folder inside the project whose name starts with two dots, named '+name+', is rejected before producer work',()=>{
+    const p=project(),inside=path.join(p,'..temp');fs.mkdirSync(inside);const spelled=spell(p,inside),original=os.tmpdir;let called=false;latch(p,()=>{
+      os.tmpdir=()=>spelled;try{assert.throws(()=>runtime.writeExternalRecoveryStream(p,()=>{called=true;},8),e=>e.code==='E_RECOVERY_TEMP_UNSAFE');}finally{os.tmpdir=original;}
+    });assert.equal(called,false);assert.deepEqual(fs.readdirSync(inside),[]);
+  });
+}
+test('a project path that fails to resolve for a reason other than absence is refused',()=>{
+  const p=project(),original=fs.realpathSync.native;let called=false;latch(p,()=>{
+    fs.realpathSync.native=function(q,...rest){if(path.resolve(String(q))===path.resolve(p))throw Object.assign(new Error('EIO: simulated'),{code:'EIO'});return original.call(this,q,...rest);};
+    try{assert.throws(()=>runtime.writeExternalRecoveryStream(p,()=>{called=true;},8),e=>e.code==='E_RECOVERY_TEMP_UNSAFE');}finally{fs.realpathSync.native=original;}
+  });assert.equal(called,false);
+});
+// Review round 2: the temp link is retargeted into the project after it was checked (here, while the guard resolves
+// the project path). The bundle must still go below the folder that was checked.
+test('a temp link retargeted into the project after the check still gets the recovery outside the project',()=>{
+  const p=project(),inside=path.join(p,'temp-after-retarget');fs.mkdirSync(inside);
+  const safe=fs.mkdtempSync(path.join(path.dirname(p),'safe-temp-')),link=p+'-temp-retarget-link',type=process.platform==='win32'?'junction':'dir';
+  rawSymlink(safe,link,type);
+  const originalTmp=os.tmpdir,originalReal=fs.realpathSync.native;let dir,retargeted=false;
+  latch(p,()=>{
+    os.tmpdir=()=>link;
+    fs.realpathSync.native=function(q,...rest){if(!retargeted&&path.resolve(String(q))===path.resolve(p)){retargeted=true;rawUnlinkLink(link);rawSymlink(inside,link,type);}return originalReal.call(this,q,...rest);};
+    try{dir=runtime.writeExternalRecoveryStream(p,sink=>sink.write('before.bin',put=>put(Buffer.from('before'))),8);}finally{os.tmpdir=originalTmp;fs.realpathSync.native=originalReal;}
+  });
+  external.push(dir);assert(retargeted,'the link must have been retargeted during the check');
+  assert.deepEqual(fs.readdirSync(inside),[]);assert.equal(fs.readFileSync(path.join(dir,'before.bin'),'utf8'),'before');
+  assert(path.relative(fs.realpathSync.native(p),fs.realpathSync.native(dir)).split(path.sep)[0]==='..','the recovery must be outside the project: '+dir);
+});
+test('a missing temp folder is refused when the project path is gone too',()=>{
+  const p=project(),moved=p+'-moved-too',original=os.tmpdir;let called=false;latch(p,()=>{
+    rawRename(p,moved);os.tmpdir=()=>path.join(path.dirname(p),'missing-temp-folder');
+    try{assert.throws(()=>runtime.writeExternalRecoveryStream(p,()=>{called=true;},8),e=>e.code==='E_RECOVERY_TEMP_UNSAFE');}finally{os.tmpdir=original;rawRename(moved,p);}
+  });assert.equal(called,false);
+});
+test('a temp folder that does not resolve is refused before producer work',()=>{
+  const p=project(),original=os.tmpdir;let called=false;latch(p,()=>{
+    os.tmpdir=()=>path.join(path.dirname(p),'missing-temp-folder');try{assert.throws(()=>runtime.writeExternalRecoveryStream(p,()=>{called=true;},8),e=>e.code==='E_RECOVERY_TEMP_UNSAFE');}finally{os.tmpdir=original;}
+  });assert.equal(called,false);
+});
 test('invalid chunk admission occurs before creating an external namespace',()=>{
   const p=project();latch(p,()=>{for(const value of [0,-1,65537,1.5,'8'])assert.throws(()=>runtime.writeExternalRecoveryStream(p,()=>{},value),e=>e.code==='E_RECOVERY_BUNDLE_INVALID');});
 });

package/scripts/memory-recovery-receipt-probe.js

@@ -97,7 +97,7 @@ function entry(surface, value) {
 function render(surface, entries) { return surface === 'decisions' ? _renderDecisionsMd(entries) : _renderLessonsMd(entries); }
 function fixture(surface) {
   const project = path.join(temp, `case-${++sequence}`);
-  fs.cpSync(seed, project, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, project);
   const hd = path.join(project, '.leerness');
   const json = path.join(hd, `${surface}.json`);
   const md = path.join(hd, `${surface}.md`);

package/scripts/memory-restore-canonical-probe.js

@@ -54,7 +54,7 @@ function check(name, fn) {
 }
 function fixture(surface) {
   const project = path.join(temp, `case-${++sequence}`);
-  fs.cpSync(seed, project, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, project);
   const file = ext => path.join(project, '.leerness', `${surface}.${ext}`);
   const identity = surface === 'decisions' ? 'title' : 'text';
   const item = (value, extra = {}) => surface === 'decisions'

package/scripts/memory-utf8-admission-probe.js

@@ -54,7 +54,7 @@ function success(result) {
 }
 function fixture(surface, payload, bom = false) {
   const project = path.join(temp, `case-${++sequence}`);
-  fs.cpSync(seed, project, { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(seed, project);
   const dir = path.join(project, '.leerness');
   const file = ext => path.join(dir, `${surface}.${ext}`);
   const item = identity => surface === 'decisions'