leerness 1.36.298 → 1.36.300

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## 1.36.300 - 2026-10-13
+
+- Fixed: `leerness lazy detect --auto-track` registered TODOs that a task already covered (T-0345).
+  - When a batch of new TODOs mixed files that no tracker row references with a file a task already referenced, every new TODO got a task, including those in the referenced file.
+  - Now only the TODOs whose file no row references are registered, decided under the tracker lock as before, and `known-todos.json` gains exactly those. A TODO in a referenced file is left as it is, as without `--auto-track`.
+- Tests (T-0345, T-0346):
+  - `scripts/lazy-auto-track-probe.js` (`npm run test:lazy-auto-track`, in `test:commands`) checks a mixed batch, a rerun, and two controls: nothing referenced, and everything referenced. On the old code the two mixed-batch cases fail: the referenced file's two TODOs got tasks too.
+  - The 30 races of `scripts/e2e-concurrency.js` now check that the two commands overlapped. Before, the first command's publication stalled for a fixed 1.2 s, and a second command that started later than that passed without racing.
+    - The second command now runs with `scripts/lock-probe.js` too. After each operation on the stalled file it reports: a finished read, open, stat or existence check, and the result of its first attempt at that file's lock or at a lock the first command held when it stalled (refused because held, or taken). It reads those held locks once, when it starts; if they cannot be read, the race does not count. It marks its report complete when it exits. A report that cannot be written sets its exit code to 97 at once, and an incomplete report does not count.
+    - The first command stays stalled until a report exists (at most 15 s), then 1.2 s more. `scripts/race-overlap.js` judges the reports. A race counts when such a lock attempt was refused because the first command held the lock. For a command that tried none of those locks, it counts when its read finished before the first command resumed. A first attempt that took such a lock means the first command had already released it, and the race does not count.
+    - `scripts/race-overlap-probe.js` (`npm run test:race-overlap`, in `test`, `test:core` and `test:fast`) runs the handshake with two small processes on ten fixed schedules. They include a second process that is slow to reach its lock attempt, one that reads during the stall but takes a lock after the release, held locks that cannot be read, and a report that can no longer be rewritten, also after the report was completed. Write failures are injected (`LOCKPROBE_REPORT_FAIL_AFTER`), so the test does not depend on file permissions. Ablations:
+      - every lock attempt reported as refused, whatever its result: 8 of 10;
+      - a first process that does not wait for the report: 6 of 10;
+      - the held locks read at the first lock attempt, and a failed read kept as "none": 8 of 10;
+      - a report judged without the completion mark: 9 of 10;
+      - a failed write that sets the exit code only in the closing exit listener: 9 of 10.
+    - Measured from the stall to the first report: 468-1,704 ms on this Windows PC and 123-217 ms on Linux (Docker node:20). In `creds-refresh` the second command reached the stalled file 1,704 ms after the stall began, 504 ms after the old fixed stall would have ended, so with the old harness that race would have passed without overlapping.
+    - On the current code all 30 races overlapped and passed, on Windows and on Linux. On Linux the second command's lock attempt was refused by the first command's lock in all 30; on Windows in 29, and `bugfix-start-vs-task-add` counted by its read. On Linux with the 1.36.296 code (before T-0343) all 30 overlapped too, and 20 failed: the 19 races T-0343 added and `plan-init-vs-remove`, whose `plan init` T-0343 also fixed. The other 10 pass there, as before.
+
+## 1.36.299 - 2026-10-12
+
+- Fixed: on Windows, `leerness skill publish` made a `.zip` instead of the `.tgz` when Git for Windows' GNU tar came first on PATH, as it does in Git Bash and in agent shells built on it (T-0352).
+  - Cause: the archive step gave `tar -czf` the absolute output path, and GNU tar reads the drive letter `C:` as a remote host ("Cannot connect to C:"). The step failed, and the Compress-Archive fallback made a `.zip`.
+  - The archive is now named relative to the `.leerness` folder, with forward slashes (`skills-publish-tarball/leerness-skills-<version>.tgz`). Windows' own tar (bsdtar) accepts that form too.
+- Fixed: on Windows, `leerness path-setup --apply` could take a different folder for the npm bin folder and not add it (T-0353).
+  - Cause: it compared Path entries with PowerShell's `-contains`. That comparison uses the culture and ignores characters such as a soft hyphen (U+00AD), so an entry that differed from the bin folder only by such a character counted as present. Measured in Windows PowerShell 5.1 and PowerShell 7.
+  - Entries are now compared by ordinal value, letter case aside.
+- Fixed: the recovery bundle that a memory write saves to the temp folder after a runtime-layout failure could be written inside the project (T-0349). The check that keeps it out compared the project and the temp folder as spelled.
+  - When the temp folder was named by an 8.3 short name (GitHub's Windows runners use `C:\Users\RUNNER~1\...`) or reached through a link, it could lie inside the project while its spelling did not.
+  - The check also took a folder inside the project whose name starts with two dots, such as `..temp`, for a folder outside it.
+  - The check now also compares their real paths, and only a first path part of exactly `..` counts as outside. A temp folder that does not resolve is refused, and so is a project path that fails to resolve for any reason other than being gone. A project path that no longer exists, because the project was renamed or removed during the operation, is compared as spelled only, as before, so its recovery is still saved.
+  - The bundle is now written below the temp folder's real path, the one that was checked, and the recovery folder it reports is named by that path. A temp link retargeted into the project after the check can no longer carry the bundle there.
+- Tests (T-0347, T-0349, T-0352, T-0353, T-0354, T-0355):
+  - `scripts/skill-archive-probe.js` (`npm run test:skill-archive`, in `test`, `test:core` and `test:fast`) asks the archive step for the `.tgz` with each tar the machine has first on PATH, and checks that tar made it, with the expected entries. Here that is Windows' bsdtar and Git for Windows' GNU tar. With the old absolute path it passes 2 of 6.
+  - `scripts/memory-recovery-external-probe.js` (21 tests) adds nine. The old check fails eight of them:
+    - A temp folder inside the project, named through a link outside the project or by its 8.3 short name, must be refused before any recovery work. So must a folder inside the project whose name starts with two dots, named directly or through a link.
+    - A temp folder that does not resolve must be refused, also when the project path is gone. So must a project path that fails to resolve with an error other than "not found" (simulated). With the old check, an unresolvable temp folder failed the recovery later, with ENOENT.
+    - A temp link retargeted into the project while the check runs (simulated) must not carry the bundle into the project.
+    - A project renamed away during the operation must still get its recovery outside it. The old check passes this one.
+  - `scripts/path-setup-powershell-probe.js` (19 checks):
+    - An entry that differs from the bin folder by a soft hyphen must not count as present. The old script fails it.
+    - Every registry run now requires the parser check first. With a command injected into the script, no registry run happened. With that requirement removed, the injected command ran.
+  - `scripts/memory-policy-root-spelling-probe.js`: the MCP checks and the resolve check use the first non-canonical spelling the machine has. Before, they always used the lowercase drive letter, which a UNC path does not have. They print SKIP when there is none.
+  - The shared support of the memory probes (`scripts/memory-migration-test-support.js`) now removes its temp arena when every test passed, and keeps it when one failed. Links inside the arena are removed as links first, so their targets are left alone. An arena, or a folder in it, that was replaced with a link is neither walked nor removed. This holds also when the replacement happens while `finish()` runs: each folder must still resolve inside the arena just before it is listed and before a link in it is removed. A process that kept replacing folders during `finish()` could still race those checks; `finish()` runs after the tests.
+    - Before, every run left one arena (1,206 were in this machine's temp folder on 2026-10-11).
+    - `scripts/memory-arena-cleanup-probe.js` (`npm run test:memory-arena-cleanup`, in `test`, `test:core` and `test:fast`) checks five cases with links to folders outside the arena, three of them with a replacement before or during `finish()`. On the old support all five fail: the removal case because nothing is removed, the failing-run and replace-before cases only on the note that `finish()` now prints, and the two replacement-during cases because the old `finish()` never looks at the arena, so the replacement never happens.
+  - The 24 `fs.cpSync` copies in 21 test files now use `lib/copy-tree.js` (T-0347). On Windows with Node 22.23.3, `fs.cpSync` ends the process with an access violation when a path has non-ASCII letters, as the temp folder does for a Windows user name in Korean.
+    - Measured with the temp folder set to `...\AppData\Local\Temp\임시한글` on Node 22.23.3: on the old code all 21 files crashed (Segmentation fault, exit 139 in Git Bash). With the change, 20 passed.
+    - The 21st, `scripts/store-values-probe.js`, failed one language check, which read the Hangul in the temp path as Korean text. Its language checks now mask the test folder's path first, and it passes.
+  - On Windows, `lib/copy-tree.js` now resolves a relative directory link against the copy's own folder, so the copied link names its sibling in the copy. Before, Node resolved the junction target against the process's working folder. On POSIX the relative link is copied as written and names the same sibling. `fs.cpSync` instead points such a link back into the source tree.
+    - `scripts/copy-tree-probe.js` checks this where links can be made. A Windows machine without the symlink privilege skips it.
+
 ## 1.36.298 - 2026-10-11
 
 - Fixed: on Windows, `leerness path-setup --apply` never registered the npm bin folder in the user PATH (T-0351). This was so from 1.9.254.

package/README.md

@@ -195,7 +195,7 @@ MIT
 <!-- leerness:project-readme:start -->
 ## Leerness Project Harness
 
-이 프로젝트는 Leerness v1.36.298 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
+이 프로젝트는 Leerness v1.36.300 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
 
 ### 정체성 — AI 에이전트 운영 레이어 (UR-0030)
 
@@ -249,7 +249,7 @@ leerness memory restore decision <date|title>
 
 ### MCP server (외부 AI 통합)
 
-Leerness v1.36.298는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **102개 도구**를 노출:
+Leerness v1.36.300는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **102개 도구**를 노출:
 
 ```jsonc
 // 카테고리별
@@ -270,7 +270,7 @@ Leerness v1.36.298는 stdio JSON-RPC MCP server를 내장합니다 — Claude Co
 `<<autonomous-loop-dynamic>>` 신호만 보내면 AI가:
 1) 다음 라운드 후보 선정 → 2) 코드 변경 → 3) 회귀 테스트 갱신 → 4) 전체 e2e 스위트 통과 → 5) npm publish + git tag → 6) main push → 7) session close → 8) 다음 라운드 예약.
 
-현재 사용 중인 하네스 버전: **1.36.298**. 공개 릴리스 여부는 공개 저장소의 태그와 배포 기록에서 별도로 확인합니다.
+현재 사용 중인 하네스 버전: **1.36.300**. 공개 릴리스 여부는 공개 저장소의 태그와 배포 기록에서 별도로 확인합니다.
 
 ### 성능 가이드
 
@@ -308,7 +308,7 @@ leerness release pack --close --auto-main-push
 - `.leerness/session-handoff.md`: 다음 세션 인수인계 (자동 작성)
 - `.leerness/lessons.md` / `decisions.md` / `rules.md`: 영구 메모리 (5 surface)
 
-Last synced by Leerness v1.36.298: 2026-09-30
+Last synced by Leerness v1.36.300: 2026-09-30
 <!-- leerness:project-readme:end -->
 GitHub 로그인 계정 확인용 서버 어댑터: [설정·연결·승인과의 구분](docs/github-login.md). 실제 앱 등록/브라우저 세션 연결과 대상별 승인은 후속입니다.
 

package/bin/leerness.js

@@ -115,7 +115,7 @@ const {
   migrateLegacyWorkspace,
 } = require('../lib/workspace-dir');
 
-const VERSION = '1.36.298';
+const VERSION = '1.36.300';
 
 // MCP lifecycle 주소 표식은 현재 CLI 호출 한 번에만 유효하다. CLI bootstrap에서 즉시 env에서
 // 떼어 두어 `--no-record`/hook처럼 presence 기록 함수에 도달하지 않는 경로도 후속 child에 유출하지 않는다.
@@ -3998,7 +3998,7 @@ function _pathDiagnose() {
 //   do to the user Path (review round 1): the read expands %VAR% entries with this process's values, and the write
 //   stores REG_SZ, so a REG_EXPAND_SZ Path (the Windows default, e.g. %USERPROFILE%\...\WindowsApps) would lose its
 //   references. The script reads the raw value and its registry type and writes both back. An entry counts as present
-//   only as written (letter case aside): expanding %VAR% here would use this shell's variables, which new terminals may
+//   only as written (ordinal, letter case aside): expanding %VAR% here would use this shell's variables, which new terminals may
 //   not have, and could report EXISTS for a directory they cannot reach (review round 3; the owner chose this). The
 //   cost is a harmless second entry when the Path already names the directory through a variable. Deleting a variable
 //   that does not exist through SetEnvironmentVariable(..., 'User') writes nothing but sends the WM_SETTINGCHANGE that
@@ -4020,7 +4020,10 @@ function _winPathPsScript() {
       + "$kind = [Microsoft.Win32.RegistryValueKind]::ExpandString; "
       + "if ($names -contains 'Path') { $kind = $k.GetValueKind('Path') }; "
       + "if ($kind -ne [Microsoft.Win32.RegistryValueKind]::String -and $kind -ne [Microsoft.Win32.RegistryValueKind]::ExpandString) { throw ('the user Path has registry type ' + $kind) }; "
-      + "if ($raw.Split(';') -contains $b) { [Console]::Out.WriteLine('EXISTS') } "
+      // T-0353: ordinal, case-insensitive. -contains compares with the culture, which ignores characters such as a
+      //   soft hyphen (U+00AD), so 'C:\np<U+00AD>m' counted as 'C:\npm' (measured in Windows PowerShell 5.1 and 7).
+      + "$found = $false; foreach ($p in $raw.Split(';')) { if ([string]::Equals($p, $b, [StringComparison]::OrdinalIgnoreCase)) { $found = $true } }; "
+      + "if ($found) { [Console]::Out.WriteLine('EXISTS') } "
       + "else { $nu = if ($raw -eq '') { $b } else { $raw.TrimEnd(';') + ';' + $b }; "
       + "$k.SetValue('Path', $nu, $kind); "
       + "[Environment]::SetEnvironmentVariable('LEERNESS_PATH_SETUP_NOTIFY', $null, 'User'); "
@@ -17525,23 +17528,27 @@ function lazyDetect(root, opts = {}) {
           const header = progressHeader(root, input.text);
           const rows2 = readProgressRows(root, input.text);
           const lockedText = rows2.map(r => `${r.request || ''} ${r.evidence || ''}`).join('\n');
-          if (!newTodos.some(t => !lockedText.includes(t.file))) return false;
+          // T-0345: only the TODOs whose file no row references. A batch with one untracked file registered every
+          //   new TODO, so TODOs in files a task already covered were registered again.
+          const toRegister = newTodos.filter(t => !lockedText.includes(t.file));
+          if (!toRegister.length) return [];
           let maxT = _historyRetention.reservedTaskMax(root); const idRe = /\bT-(\d{4,})\b/g;
           const scanSrc = (exists(planPath(root)) ? read(planPath(root)) : '') + '\n' + rows2.map(r => r.id).join('\n');
           let mm; while ((mm = idRe.exec(scanSrc))) maxT = Math.max(maxT, Number(mm[1]));
-          _historyRetention.assertTaskIdCapacity(maxT, newTodos.length);
-          for (const t of newTodos) {
+          _historyRetention.assertTaskIdCapacity(maxT, toRegister.length);
+          for (const t of toRegister) {
             maxT++;
             rows2.push({ id: `T-${String(maxT).padStart(4, '0')}`, status: 'requested', request: `TODO ${t.file}:${t.line}`, evidence: 'auto-tracked', nextAction: t.text.slice(0, 80), updated: today() });
           }
           writeProgressRows(root, header, rows2, { input });
-          return true;
+          return toRegister;
         });
-        if (registered) {
-          // known-todos에 추가 — 다음 detect에서 재카운트 안 하도록
-          const merged = [...knownList, ...newTodos.map(t => ({ ...t, ackAt: now() }))];
+        if (registered.length) {
+          // known-todos에 추가 — 다음 detect에서 재카운트 안 하도록. T-0345: only what was registered; a TODO in a
+          //   file a task already references stays as it is, as without --auto-track.
+          const merged = [...knownList, ...registered.map(t => ({ ...t, ackAt: now() }))];
           writeUtf8(knownPath, JSON.stringify(merged, null, 2) + '\n');
-          if (!jsonMode) ok(`${newTodos.length}개 TODO를 progress-tracker에 자동 등록 + known-todos.json 갱신`);
+          if (!jsonMode) ok(`${registered.length}개 TODO를 progress-tracker에 자동 등록 + known-todos.json 갱신`);
         }
       } else if (newTodos.length && !jsonMode) {
         log(`    💡 자동 등록: leerness lazy detect --auto-track`);
@@ -26493,7 +26500,12 @@ function _createArchive(cwd, sourceDir, outPath) {
   // 1) tar.gz (POSIX 환경에서 가장 안정)
   if (/\.(tgz|tar\.gz)$/i.test(outPath)) {
     tried.push('tar');
-    const r = _spawnPortableArgvSync('tar', ['-czf', outPath, sourceDir], {
+    // T-0352: the archive is named relative to cwd, with forward slashes. Git for Windows' GNU tar, first on PATH in
+    //   Git Bash, reads the drive letter of an absolute Windows path as a remote host ("Cannot connect to C:") and
+    //   failed, so the .zip fallback ran instead. bsdtar accepts either form. A path on another drive stays absolute.
+    const relativeOut = path.relative(cwd, outPath);
+    const tarOut = relativeOut && !path.isAbsolute(relativeOut) ? relativeOut.split(path.sep).join('/') : outPath;
+    const r = _spawnPortableArgvSync('tar', ['-czf', tarOut, sourceDir], {
       encoding: 'utf8', timeout: 30000, shell: false, cwd
     });
     if (r.status === 0 && exists(outPath)) return { ok: true, path: outPath, method: 'tar', tried };
@@ -34146,6 +34158,8 @@ module.exports = {
   _cliMutationClass, _mustRemainReadOnly, _runtimeProjectRoot,
   _npmGlobalBin, _dirInPath, _leernessResolvable, _pathDiagnose, _registerPath,
   _winPathPsScript, _unixPathBlock, pathSetupCmd,
+  // T-0352: the skill publish archive chain (tar, then the zip fallbacks), for scripts/skill-archive-probe.js.
+  _createArchive,
   _isSecretKey, compareVer, parseHarnessVersion,
   // 1.9.257: CJK 인코딩 분류 (UR-0014 계열) 순수 함수 — 단위 테스트
   _classifyCJK, _riskLabel,

package/lib/copy-tree.js

@@ -12,10 +12,14 @@ const path = require('path');
 function copyTreeSync(src, dst) {
   const stat = fs.lstatSync(src);
   if (stat.isSymbolicLink()) {
-    const target = fs.readlinkSync(src);
+    let target = fs.readlinkSync(src);
     let type;
     if (process.platform === 'win32') {
       try { type = fs.statSync(src).isDirectory() ? 'junction' : 'file'; } catch { type = 'file'; }
+      // T-0347: a junction's target must be absolute, and Node resolves a relative one against the process cwd.
+      //   A relative directory link is resolved against the copy's own folder, so it still names the place it named
+      //   relative to where it now is (fs.cpSync instead points it back into the source tree).
+      if (type === 'junction' && !path.isAbsolute(target)) target = path.resolve(path.dirname(dst), target);
     }
     fs.symlinkSync(target, dst, type);
     return;

package/lib/runtime-writes.js

@@ -159,13 +159,33 @@ function assertExternalRecoveryAllowed(root) {
   }
   const project = path.resolve(root);
   const base = path.resolve(os.tmpdir());
-  const relative = path.relative(project, base);
-  if (relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))) {
+  // T-0349: compared as spelled and as real paths. A temp folder reached through a link, or named by an 8.3 short
+  //   name (GitHub's Windows runners give C:\Users\RUNNER~1\...), can lie inside the project while its spelling does
+  //   not, and the recovery bundle was then written into the project it must stay out of. A temp folder that cannot
+  //   be resolved counts as unsafe. A project path that no longer exists (ENOENT or ENOTDIR: renamed or removed during
+  //   the operation, one way this latch is reached) has nothing at it to lie inside, so only its spelling is compared;
+  //   any other failure to resolve it counts as unsafe.
+  const unsafe = () => {
     const error = new Error(`External recovery temp must stay outside project root: ${base}`);
     error.code = 'E_RECOVERY_TEMP_UNSAFE';
     throw error;
-  }
-  return base;
+  };
+  // Outside means a first component of exactly '..' (a child folder may be named '..temp', review round 1).
+  const inside = (from, to) => {
+    const relative = path.relative(from, to);
+    return !(relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative));
+  };
+  const real = p => { try { return { path: fs.realpathSync.native(p) }; } catch (error) { return { error }; } };
+  const realBase = real(base), realProject = real(project);
+  if (!realBase.path) unsafe();
+  const missing = !realProject.path && ['ENOENT', 'ENOTDIR'].includes(realProject.error && realProject.error.code);
+  if (!realProject.path && !missing) unsafe();
+  if (inside(project, base)) unsafe();
+  if (realProject.path && inside(realProject.path, realBase.path)) unsafe();
+  // The bundle goes below the real path that was checked, not below the alias: a temp link retargeted into the project
+  // after this check would otherwise carry the bundle there (review round 2). A real folder replaced while the
+  // recovery runs is not covered, as for every path-based write here.
+  return realBase.path;
 }
 
 // Streaming recovery uses the same latch and external-only destination. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.298",
+  "version": "1.36.300",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",
@@ -48,15 +48,15 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && npm run test:state-scopes && npm run test:runtime-compatibility && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/e2e-repo-guard.js && node ./scripts/e2e-lived-in-harness.js && npm run test:lock-heartbeat && npm run test:temp-cleanup && npm run test:path-setup && node ./scripts/platform-smoke.js && node ./scripts/parent-detect-selftest-probe.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/i18n-priority-surface-probe.js && npm run test:harness-text && npm run test:test-plan && node ./scripts/i18n-next-cluster-probe.js && node ./scripts/handoff-i18n-probe.js && node ./scripts/provider-capacity-probe.js && npm run test:provider-response && npm run test:github-login && npm run test:provider-dispatch && npm run test:provider-receipt && npm run test:provider-observation && npm run test:ui-review-publication && npm run test:ui-review-target && npm run test:ui-review-authorization && npm run test:ui-review-authority-host && npm run test:ui-review-authority-floor && npm run test:ui-review-proof-use && npm run test:ui-review-recovery && node ./scripts/file-lease-probe.js && node ./scripts/role-agent-schema-probe.js && node ./scripts/role-store-loader-probe.js && node ./scripts/role-fallback-probe.js && npm run test:agent-bench-output && npm run test:agent-chat-stream && npm run test:encoding-diagnostics && npm run test:managed-text && npm run test:plan-text && npm run test:session-close-text && npm run test:brief-text && npm run test:generation-text && npm run test:install-text && npm run test:authoring-language && npm run test:context-reading && npm run test:rule-text && npm run test:mode-text && npm run test:handoff-text && npm run test:audit-text && npm run test:audit-readme-text && npm run test:audit-env-text && npm run test:feature-graph-text && npm run test:env-sync-text && npm run test:teams-text && npm run test:reminder-text && npm run test:handoff-history-text && npm run test:env-snapshot-text && npm run test:context-current && npm run test:review-feedback && npm run test:ledger-sync && npm run test:state-lock && npm run test:history-retention && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/mutation-integrity-probe.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js && node ./scripts/review-checkpoint-probe.js && node ./scripts/review-checkpoint-transport-probe.js && node ./scripts/review-snapshot-probe.js && npm run test:memory-migration && npm run test:memory-items && npm run test:memory-budget && npm run test:memory-footprint && npm run test:memory-write-budget && npm run test:memory-write-preparation && npm run test:memory-write-admission && npm run test:memory-command-policy && npm run test:memory-publication-policy && npm run test:memory-recovery-transfer && npm run test:ui-boundary && node ./scripts/review-control-probe.js && npm run test:ui-review-run && npm run test:rule-verification",
-    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && npm run test:state-scopes && npm run test:runtime-compatibility && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/e2e-repo-guard.js && node ./scripts/e2e-lived-in-harness.js && npm run test:lock-heartbeat && npm run test:temp-cleanup && npm run test:path-setup && node ./scripts/platform-smoke.js && node ./scripts/parent-detect-selftest-probe.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/i18n-priority-surface-probe.js && npm run test:harness-text && npm run test:test-plan && node ./scripts/i18n-next-cluster-probe.js && node ./scripts/handoff-i18n-probe.js && node ./scripts/provider-capacity-probe.js && npm run test:provider-response && npm run test:github-login && npm run test:provider-dispatch && npm run test:provider-receipt && npm run test:provider-observation && npm run test:ui-review-publication-smoke && npm run test:ui-review-target-smoke && npm run test:ui-review-authorization-smoke && npm run test:ui-review-authority-host-smoke && npm run test:ui-review-authority-floor-smoke && npm run test:ui-review-proof-use-smoke && npm run test:ui-review-recovery && node ./scripts/file-lease-probe.js && node ./scripts/role-agent-schema-probe.js && node ./scripts/role-store-loader-probe.js && node ./scripts/role-fallback-probe.js && npm run test:agent-bench-output && npm run test:review-feedback && npm run test:ledger-sync && npm run test:state-lock && npm run test:history-retention && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/mutation-integrity-probe.js && node ./scripts/memory-guard-order-probe.js && node ./scripts/memory-input-preflight-probe.js && node ./scripts/memory-utf8-admission-probe.js && node ./scripts/memory-checked-input-probe.js && node ./scripts/memory-input-unit-probe.js && node ./scripts/memory-restore-canonical-probe.js && node ./scripts/memory-archive-retention-probe.js && node ./scripts/memory-archive-check-probe.js && node ./scripts/memory-projection-retention-probe.js && node ./scripts/memory-language-probe.js && node ./scripts/memory-legacy-retention-probe.js && node ./scripts/memory-recovery-receipt-probe.js && node ./scripts/memory-output-unit-probe.js && node ./scripts/memory-output-posix-probe.js && node ./scripts/memory-output-publication-probe.js && node ./scripts/memory-output-parent-race-probe.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js && node ./scripts/rule-applicability-probe.js && node ./scripts/review-checkpoint-probe.js && node ./scripts/review-checkpoint-transport-probe.js && node ./scripts/review-snapshot-probe.js && node ./scripts/review-snapshot-transport-probe.js && npm run test:memory-migration && npm run test:memory-items && npm run test:memory-budget && npm run test:memory-footprint && npm run test:memory-write-budget && npm run test:memory-write-preparation && npm run test:memory-write-admission && npm run test:memory-command-policy && npm run test:memory-publication-policy && npm run test:memory-recovery-transfer && npm run test:ui-boundary && npm run test:ui-review-run && npm run test:rule-verification",
-    "test:commands": "npm run test:hooks && npm run test:e2e-observation && node ./scripts/memory-guard-order-probe.js && node ./scripts/memory-input-preflight-probe.js && node ./scripts/memory-utf8-admission-probe.js && node ./scripts/memory-checked-input-probe.js && node ./scripts/memory-input-unit-probe.js && node ./scripts/memory-restore-canonical-probe.js && node ./scripts/memory-archive-retention-probe.js && node ./scripts/memory-archive-check-probe.js && node ./scripts/memory-projection-retention-probe.js && node ./scripts/memory-language-probe.js && node ./scripts/memory-legacy-retention-probe.js && node ./scripts/memory-recovery-receipt-probe.js && node ./scripts/memory-output-unit-probe.js && node ./scripts/memory-output-posix-probe.js && node ./scripts/memory-output-publication-probe.js && node ./scripts/memory-output-parent-race-probe.js && node ./scripts/command-flags-probe.js && node ./scripts/dead-flags-probe.js && node ./scripts/free-text-args-probe.js && node ./scripts/title-args-probe.js && node ./scripts/false-claim-probe.js && node ./scripts/claim-sweep-git-probe.js && node ./scripts/claim-runtime-cache-probe.js && node ./scripts/runtime-cost-probe.js && node ./scripts/secret-scan-scope-probe.js && node ./scripts/handoff-preservation-probe.js && node ./scripts/next-action-suggestion-probe.js && node ./scripts/api-skill-match-probe.js && node ./scripts/crud-check-probe.js && node ./scripts/claims-baseline-probe.js && node ./scripts/claims-baseline-concurrency-probe.js && node ./scripts/e2e-command-surface.js && node ./scripts/rule-applicability-probe.js && node ./scripts/review-request-labels-probe.js && node ./scripts/review-request-signals-probe.js && node ./scripts/store-values-probe.js && node ./scripts/review-snapshot-transport-probe.js && node ./scripts/bugfix-areas-probe.js && node ./scripts/done-status-probe.js && node ./scripts/fix-evidence-language-probe.js && node ./scripts/decision-fence-offset-probe.js && node ./scripts/task-sync-roundtrip-probe.js && node ./scripts/tracker-write-language-probe.js && node ./scripts/write-path-language-probe.js && node ./scripts/write-primitive-language-probe.js && node ./scripts/dry-run-refusal-probe.js",
+    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && npm run test:state-scopes && npm run test:runtime-compatibility && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/race-overlap-probe.js && node ./scripts/e2e-repo-guard.js && node ./scripts/e2e-lived-in-harness.js && npm run test:lock-heartbeat && npm run test:temp-cleanup && npm run test:path-setup && npm run test:skill-archive && npm run test:memory-arena-cleanup && node ./scripts/platform-smoke.js && node ./scripts/parent-detect-selftest-probe.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/i18n-priority-surface-probe.js && npm run test:harness-text && npm run test:test-plan && node ./scripts/i18n-next-cluster-probe.js && node ./scripts/handoff-i18n-probe.js && node ./scripts/provider-capacity-probe.js && npm run test:provider-response && npm run test:github-login && npm run test:provider-dispatch && npm run test:provider-receipt && npm run test:provider-observation && npm run test:ui-review-publication && npm run test:ui-review-target && npm run test:ui-review-authorization && npm run test:ui-review-authority-host && npm run test:ui-review-authority-floor && npm run test:ui-review-proof-use && npm run test:ui-review-recovery && node ./scripts/file-lease-probe.js && node ./scripts/role-agent-schema-probe.js && node ./scripts/role-store-loader-probe.js && node ./scripts/role-fallback-probe.js && npm run test:agent-bench-output && npm run test:agent-chat-stream && npm run test:encoding-diagnostics && npm run test:managed-text && npm run test:plan-text && npm run test:session-close-text && npm run test:brief-text && npm run test:generation-text && npm run test:install-text && npm run test:authoring-language && npm run test:context-reading && npm run test:rule-text && npm run test:mode-text && npm run test:handoff-text && npm run test:audit-text && npm run test:audit-readme-text && npm run test:audit-env-text && npm run test:feature-graph-text && npm run test:env-sync-text && npm run test:teams-text && npm run test:reminder-text && npm run test:handoff-history-text && npm run test:env-snapshot-text && npm run test:context-current && npm run test:review-feedback && npm run test:ledger-sync && npm run test:state-lock && npm run test:history-retention && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/mutation-integrity-probe.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js && node ./scripts/review-checkpoint-probe.js && node ./scripts/review-checkpoint-transport-probe.js && node ./scripts/review-snapshot-probe.js && npm run test:memory-migration && npm run test:memory-items && npm run test:memory-budget && npm run test:memory-footprint && npm run test:memory-write-budget && npm run test:memory-write-preparation && npm run test:memory-write-admission && npm run test:memory-command-policy && npm run test:memory-publication-policy && npm run test:memory-recovery-transfer && npm run test:ui-boundary && node ./scripts/review-control-probe.js && npm run test:ui-review-run && npm run test:rule-verification",
+    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && npm run test:state-scopes && npm run test:runtime-compatibility && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/race-overlap-probe.js && node ./scripts/e2e-repo-guard.js && node ./scripts/e2e-lived-in-harness.js && npm run test:lock-heartbeat && npm run test:temp-cleanup && npm run test:path-setup && npm run test:skill-archive && npm run test:memory-arena-cleanup && node ./scripts/platform-smoke.js && node ./scripts/parent-detect-selftest-probe.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/i18n-priority-surface-probe.js && npm run test:harness-text && npm run test:test-plan && node ./scripts/i18n-next-cluster-probe.js && node ./scripts/handoff-i18n-probe.js && node ./scripts/provider-capacity-probe.js && npm run test:provider-response && npm run test:github-login && npm run test:provider-dispatch && npm run test:provider-receipt && npm run test:provider-observation && npm run test:ui-review-publication-smoke && npm run test:ui-review-target-smoke && npm run test:ui-review-authorization-smoke && npm run test:ui-review-authority-host-smoke && npm run test:ui-review-authority-floor-smoke && npm run test:ui-review-proof-use-smoke && npm run test:ui-review-recovery && node ./scripts/file-lease-probe.js && node ./scripts/role-agent-schema-probe.js && node ./scripts/role-store-loader-probe.js && node ./scripts/role-fallback-probe.js && npm run test:agent-bench-output && npm run test:review-feedback && npm run test:ledger-sync && npm run test:state-lock && npm run test:history-retention && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/mutation-integrity-probe.js && node ./scripts/memory-guard-order-probe.js && node ./scripts/memory-input-preflight-probe.js && node ./scripts/memory-utf8-admission-probe.js && node ./scripts/memory-checked-input-probe.js && node ./scripts/memory-input-unit-probe.js && node ./scripts/memory-restore-canonical-probe.js && node ./scripts/memory-archive-retention-probe.js && node ./scripts/memory-archive-check-probe.js && node ./scripts/memory-projection-retention-probe.js && node ./scripts/memory-language-probe.js && node ./scripts/memory-legacy-retention-probe.js && node ./scripts/memory-recovery-receipt-probe.js && node ./scripts/memory-output-unit-probe.js && node ./scripts/memory-output-posix-probe.js && node ./scripts/memory-output-publication-probe.js && node ./scripts/memory-output-parent-race-probe.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js && node ./scripts/rule-applicability-probe.js && node ./scripts/review-checkpoint-probe.js && node ./scripts/review-checkpoint-transport-probe.js && node ./scripts/review-snapshot-probe.js && node ./scripts/review-snapshot-transport-probe.js && npm run test:memory-migration && npm run test:memory-items && npm run test:memory-budget && npm run test:memory-footprint && npm run test:memory-write-budget && npm run test:memory-write-preparation && npm run test:memory-write-admission && npm run test:memory-command-policy && npm run test:memory-publication-policy && npm run test:memory-recovery-transfer && npm run test:ui-boundary && npm run test:ui-review-run && npm run test:rule-verification",
+    "test:commands": "npm run test:hooks && npm run test:e2e-observation && node ./scripts/memory-guard-order-probe.js && node ./scripts/memory-input-preflight-probe.js && node ./scripts/memory-utf8-admission-probe.js && node ./scripts/memory-checked-input-probe.js && node ./scripts/memory-input-unit-probe.js && node ./scripts/memory-restore-canonical-probe.js && node ./scripts/memory-archive-retention-probe.js && node ./scripts/memory-archive-check-probe.js && node ./scripts/memory-projection-retention-probe.js && node ./scripts/memory-language-probe.js && node ./scripts/memory-legacy-retention-probe.js && node ./scripts/memory-recovery-receipt-probe.js && node ./scripts/memory-output-unit-probe.js && node ./scripts/memory-output-posix-probe.js && node ./scripts/memory-output-publication-probe.js && node ./scripts/memory-output-parent-race-probe.js && node ./scripts/command-flags-probe.js && node ./scripts/dead-flags-probe.js && node ./scripts/free-text-args-probe.js && node ./scripts/title-args-probe.js && node ./scripts/false-claim-probe.js && node ./scripts/claim-sweep-git-probe.js && node ./scripts/claim-runtime-cache-probe.js && node ./scripts/runtime-cost-probe.js && node ./scripts/secret-scan-scope-probe.js && node ./scripts/handoff-preservation-probe.js && node ./scripts/next-action-suggestion-probe.js && node ./scripts/api-skill-match-probe.js && node ./scripts/crud-check-probe.js && node ./scripts/claims-baseline-probe.js && node ./scripts/claims-baseline-concurrency-probe.js && node ./scripts/e2e-command-surface.js && node ./scripts/rule-applicability-probe.js && node ./scripts/review-request-labels-probe.js && node ./scripts/review-request-signals-probe.js && node ./scripts/store-values-probe.js && node ./scripts/review-snapshot-transport-probe.js && node ./scripts/bugfix-areas-probe.js && node ./scripts/done-status-probe.js && node ./scripts/fix-evidence-language-probe.js && node ./scripts/decision-fence-offset-probe.js && node ./scripts/task-sync-roundtrip-probe.js && node ./scripts/tracker-write-language-probe.js && node ./scripts/write-path-language-probe.js && node ./scripts/write-primitive-language-probe.js && node ./scripts/dry-run-refusal-probe.js && node ./scripts/lazy-auto-track-probe.js",
     "test:e2e-observation": "node ./scripts/e2e-temp-scope-probe.js && node ./scripts/e2e-child-diagnostics-probe.js",
     "test:next-actions": "node ./scripts/next-action-suggestion-probe.js && node ./scripts/api-skill-match-probe.js",
     "test:installed": "npm run test:installed-lifecycle && node ./scripts/installed-cleanroom-probe.js",
     "test:installed-lifecycle": "node ./scripts/installed-handoff-lifecycle-probe.js",
     "test:handoff": "node ./scripts/handoff-readonly-probe.js",
-    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && npm run test:state-scopes && npm run test:runtime-compatibility && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/e2e-repo-guard.js && npm run test:lock-heartbeat && npm run test:temp-cleanup && npm run test:path-setup && node ./scripts/platform-smoke.js && node ./scripts/parent-detect-selftest-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/i18n-priority-surface-probe.js && npm run test:harness-text && npm run test:test-plan && node ./scripts/i18n-next-cluster-probe.js && node ./scripts/handoff-i18n-probe.js && node ./scripts/mutation-integrity-probe.js && node ./scripts/memory-guard-order-probe.js && node ./scripts/memory-input-preflight-probe.js && node ./scripts/memory-utf8-admission-probe.js && node ./scripts/memory-checked-input-probe.js && node ./scripts/memory-input-unit-probe.js && node ./scripts/memory-restore-canonical-probe.js && node ./scripts/memory-archive-retention-probe.js && node ./scripts/memory-archive-check-probe.js && node ./scripts/memory-projection-retention-probe.js && node ./scripts/memory-language-probe.js && node ./scripts/memory-legacy-retention-probe.js && node ./scripts/memory-recovery-receipt-probe.js && node ./scripts/memory-output-unit-probe.js && node ./scripts/memory-output-posix-probe.js && node ./scripts/memory-output-publication-probe.js && node ./scripts/memory-output-parent-race-probe.js && node ./scripts/mcp-presence-probe.js && node ./scripts/provider-capacity-probe.js && npm run test:provider-response && npm run test:provider-dispatch && npm run test:provider-receipt && npm run test:provider-observation && npm run test:ui-review-recovery && node ./scripts/file-lease-probe.js && node ./scripts/role-agent-schema-probe.js && node ./scripts/role-store-loader-probe.js && node ./scripts/role-fallback-probe.js && npm run test:agent-bench-output && npm run test:ledger-sync && npm run test:state-lock && npm run test:history-retention && node ./scripts/false-claim-probe.js && node ./scripts/smoke.js && node ./scripts/rule-applicability-probe.js && node ./scripts/review-checkpoint-probe.js && node ./scripts/review-checkpoint-transport-probe.js && node ./scripts/review-snapshot-probe.js && node ./scripts/review-snapshot-transport-probe.js && npm run test:memory-migration && npm run test:memory-items && npm run test:memory-budget && npm run test:memory-footprint && npm run test:memory-write-budget && npm run test:memory-write-preparation && npm run test:memory-write-admission && npm run test:memory-command-policy && npm run test:memory-publication-policy && npm run test:memory-recovery-transfer && npm run test:ui-boundary && npm run test:rule-verification",
+    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && npm run test:state-scopes && npm run test:runtime-compatibility && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/race-overlap-probe.js && node ./scripts/e2e-repo-guard.js && npm run test:lock-heartbeat && npm run test:temp-cleanup && npm run test:path-setup && npm run test:skill-archive && npm run test:memory-arena-cleanup && node ./scripts/platform-smoke.js && node ./scripts/parent-detect-selftest-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/i18n-priority-surface-probe.js && npm run test:harness-text && npm run test:test-plan && node ./scripts/i18n-next-cluster-probe.js && node ./scripts/handoff-i18n-probe.js && node ./scripts/mutation-integrity-probe.js && node ./scripts/memory-guard-order-probe.js && node ./scripts/memory-input-preflight-probe.js && node ./scripts/memory-utf8-admission-probe.js && node ./scripts/memory-checked-input-probe.js && node ./scripts/memory-input-unit-probe.js && node ./scripts/memory-restore-canonical-probe.js && node ./scripts/memory-archive-retention-probe.js && node ./scripts/memory-archive-check-probe.js && node ./scripts/memory-projection-retention-probe.js && node ./scripts/memory-language-probe.js && node ./scripts/memory-legacy-retention-probe.js && node ./scripts/memory-recovery-receipt-probe.js && node ./scripts/memory-output-unit-probe.js && node ./scripts/memory-output-posix-probe.js && node ./scripts/memory-output-publication-probe.js && node ./scripts/memory-output-parent-race-probe.js && node ./scripts/mcp-presence-probe.js && node ./scripts/provider-capacity-probe.js && npm run test:provider-response && npm run test:provider-dispatch && npm run test:provider-receipt && npm run test:provider-observation && npm run test:ui-review-recovery && node ./scripts/file-lease-probe.js && node ./scripts/role-agent-schema-probe.js && node ./scripts/role-store-loader-probe.js && node ./scripts/role-fallback-probe.js && npm run test:agent-bench-output && npm run test:ledger-sync && npm run test:state-lock && npm run test:history-retention && node ./scripts/false-claim-probe.js && node ./scripts/smoke.js && node ./scripts/rule-applicability-probe.js && node ./scripts/review-checkpoint-probe.js && node ./scripts/review-checkpoint-transport-probe.js && node ./scripts/review-snapshot-probe.js && node ./scripts/review-snapshot-transport-probe.js && npm run test:memory-migration && npm run test:memory-items && npm run test:memory-budget && npm run test:memory-footprint && npm run test:memory-write-budget && npm run test:memory-write-preparation && npm run test:memory-write-admission && npm run test:memory-command-policy && npm run test:memory-publication-policy && npm run test:memory-recovery-transfer && npm run test:ui-boundary && npm run test:rule-verification",
     "test:false-claims": "node ./scripts/false-claim-probe.js",
     "test:claim-sweep": "node ./scripts/claim-sweep-git-probe.js",
     "test:claim-runtime": "node ./scripts/claim-runtime-cache-probe.js",
@@ -74,6 +74,8 @@
     "test:tracker-write-language": "node ./scripts/tracker-write-language-probe.js",
     "test:write-path-language": "node ./scripts/write-path-language-probe.js",
     "test:write-primitive-language": "node ./scripts/write-primitive-language-probe.js",
+    "test:race-overlap": "node ./scripts/race-overlap-probe.js",
+    "test:lazy-auto-track": "node ./scripts/lazy-auto-track-probe.js",
     "test:dry-run-refusal": "node ./scripts/dry-run-refusal-probe.js",
     "test:api-skill-match": "node ./scripts/api-skill-match-probe.js",
     "test:crud-check": "node ./scripts/crud-check-probe.js",
@@ -141,6 +143,8 @@
     "test:lock-heartbeat": "node ./scripts/lock-heartbeat-probe.js",
     "test:temp-cleanup": "node ./scripts/temp-cleanup-probe.js && node ./scripts/copy-tree-probe.js",
     "test:path-setup": "node ./scripts/path-setup-powershell-probe.js",
+    "test:skill-archive": "node ./scripts/skill-archive-probe.js",
+    "test:memory-arena-cleanup": "node ./scripts/memory-arena-cleanup-probe.js",
     "test:ui-review-publication": "node ./scripts/ui-review-publication-probe.js",
     "test:ui-review-publication-smoke": "node ./scripts/ui-review-publication-probe.js --smoke",
     "test:ui-review-target": "node ./scripts/ui-review-target-probe.js",

package/scripts/bugfix-areas-probe.js

@@ -41,7 +41,7 @@ const seed = lang => {
   return (seeds[lang] = dir);
 };
 let copies = 0;
-const fresh = (lang = 'ko') => { const dir = path.join(arena, 'p' + (++copies)); fs.cpSync(seed(lang), dir, { recursive: true }); return dir; };
+const fresh = (lang = 'ko') => { const dir = path.join(arena, 'p' + (++copies)); require('../lib/copy-tree').copyTreeSync(seed(lang), dir); return dir; };
 const runIn = (cwd, args, runEnv = env) => cp.spawnSync(process.execPath, [CLI, ...args], { cwd, encoding: 'utf8', timeout: 300000, windowsHide: true, env: runEnv });
 const show = r => `exit ${r.status}\n${String(r.stdout || '').slice(0, 1200)}${String(r.stderr || '').slice(0, 600)}`;
 const json = (r, label) => { const out = String(r.stdout || ''); try { return JSON.parse(out.slice(out.indexOf('{'))); } catch { throw new Error(label + ': not JSON — ' + show(r)); } };

package/scripts/copy-tree-probe.js

@@ -50,6 +50,23 @@ try {
     assert.throws(() => copyTreeSync(from, to), error => error.code === 'EEXIST');
     assert.strictEqual(fs.readFileSync(path.join(to, 'bytes.bin'), 'utf8'), 'kept');
   });
+  // T-0347: a relative directory link must still name its sibling inside the copy. On Windows the copy is a junction,
+  // whose target must be absolute; Node resolved the relative one against the process cwd.
+  {
+    const from = path.join(arena, 'src-relative-link'), to = path.join(arena, 'dst-relative-link');
+    fs.mkdirSync(path.join(from, 'sibling'), { recursive: true });
+    fs.writeFileSync(path.join(from, 'sibling', 'mark.txt'), 'source');
+    let made = true;
+    try { fs.symlinkSync('sibling', path.join(from, 'link'), 'dir'); }
+    catch (error) { if (error.code !== 'EPERM') throw error; made = false; }
+    if (!made) console.log('SKIP a relative directory link (creating one needs the symlink privilege here)');
+    else test('a relative directory link names its sibling inside the copy', () => {
+      copyTreeSync(from, to);
+      fs.writeFileSync(path.join(to, 'sibling', 'mark.txt'), 'copy');
+      assert.strictEqual(fs.readFileSync(path.join(to, 'link', 'mark.txt'), 'utf8'), 'copy');
+      assert.strictEqual(fs.realpathSync.native(path.join(to, 'link')), fs.realpathSync.native(path.join(to, 'sibling')));
+    });
+  }
   test('a missing source is an error, not an empty copy', () => {
     assert.throws(() => copyTreeSync(path.join(arena, 'missing'), path.join(arena, 'dst-missing')), error => error.code === 'ENOENT');
     assert.ok(!fs.existsSync(path.join(arena, 'dst-missing')));

package/scripts/done-status-probe.js

@@ -34,7 +34,7 @@ const seed = () => {
   return (seedDir = dir);
 };
 let copies = 0;
-const fresh = () => { const dir = path.join(arena, 'p' + (++copies)); fs.cpSync(seed(), dir, { recursive: true }); return dir; };
+const fresh = () => { const dir = path.join(arena, 'p' + (++copies)); require('../lib/copy-tree').copyTreeSync(seed(), dir); return dir; };
 const runIn = (cwd, args) => cp.spawnSync(process.execPath, [CLI, ...args], { cwd, encoding: 'utf8', timeout: 300000, windowsHide: true, env });
 const show = r => `exit ${r.status}\n${String(r.stdout || '').slice(0, 1200)}${String(r.stderr || '').slice(0, 600)}`;
 const json = (r, label) => { const out = String(r.stdout || ''); try { return JSON.parse(out.slice(out.indexOf('{'))); } catch { throw new Error(label + ': not JSON — ' + show(r)); } };

package/scripts/e2e-concurrency.js

@@ -9,6 +9,7 @@ const cp = require('child_process');
 
 const CLI = path.resolve(process.argv[2] || path.join(__dirname, '..', 'bin', 'leerness.js'));
 const PRELOAD = path.join(__dirname, 'lock-probe.js');
+const { overlapOf } = require('./race-overlap');
 const ENV = {
   ...process.env,
   LEERNESS_OFFLINE: '1',
@@ -37,16 +38,22 @@ function init(d) {
 // is observed rather than inferred. T-0314: inferring it from `<target>.tmp-*` names stopped working when
 // 1.36.190 published memory outputs through `.<target>.publish-*` + link; 8 of 11 races then never raced.
 const readyFileOf = d => path.join(d, '.stall-ready.json');
+// T-0346: the second command writes this file after it read the target, or tried its lock or a lock the first
+// command held when it stalled; the first command's stall ends only after it exists (see scripts/lock-probe.js).
+// A fixed 1.2 s stall could end before the second command had started (a Node start alone can take that long on
+// Windows), and the race then passed without overlapping the publication.
+const reachFileOf = d => path.join(d, '.stall-reached.json');
 
-function spawn(d, args, stallTarget) {
-  const nodeArgs = stallTarget
-    ? ['--require', PRELOAD, CLI, ...args, '--path', d]
-    : [CLI, ...args, '--path', d];
-  const env = stallTarget
-    ? { ...ENV, LOCKPROBE_STALL_TARGET: stallTarget, LOCKPROBE_STALL_MS: String(STALL_MS), LOCKPROBE_READY_FILE: readyFileOf(d) }
-    : ENV;
+// role 'first' stalls the publication of `target` until the second command reaches it; role 'second' reports
+// reaching it. Both run with the lock-probe preload.
+function spawn(d, args, role, target) {
+  const nodeArgs = ['--require', PRELOAD, CLI, ...args, '--path', d];
+  const env = role === 'first'
+    ? { ...ENV, LOCKPROBE_STALL_TARGET: target, LOCKPROBE_STALL_MS: String(STALL_MS), LOCKPROBE_READY_FILE: readyFileOf(d), LOCKPROBE_WAIT_FILE: reachFileOf(d) }
+    : { ...ENV, LOCKPROBE_REACH_TARGET: target, LOCKPROBE_REACH_FILE: reachFileOf(d), LOCKPROBE_REACH_LOCKS_FILE: readyFileOf(d) };
   return cp.spawn(process.execPath, nodeArgs, { cwd: d, env, stdio: 'ignore' });
 }
+const readJson = file => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
 
 function waitForStall(d, target) {
   // T-0343: an absolute target (a file outside .leerness) is acknowledged by its full path, a relative one by its
@@ -66,15 +73,22 @@ async function race(name, config) {
     if (config.seed) config.seed(d);
     // T-0343: a target outside .leerness is given as a function of the project directory (its absolute path).
     const stallTarget = typeof config.stallTarget === 'function' ? config.stallTarget(d) : config.stallTarget;
-    const first = spawn(d, config.first, stallTarget);
+    const first = spawn(d, config.first, 'first', stallTarget);
     const stalled = waitForStall(d, stallTarget);
     if (config.beforeSecond) config.beforeSecond(d);
-    const second = spawn(d, typeof config.second === 'function' ? config.second(d) : config.second);
+    const second = spawn(d, typeof config.second === 'function' ? config.second(d) : config.second, 'second', stallTarget);
     const exits = await Promise.all([wait(first), wait(second)]);
+    // T-0346: the race counts only when the second command overlapped the first one's stalled section (see
+    // scripts/race-overlap.js): a contended lock attempt, or, for a command that tried none of those locks, a read
+    // of the stalled file that finished before the first command resumed.
+    const ready = readJson(readyFileOf(d)) || {}, reach = readJson(reachFileOf(d));
+    const { overlapped, why } = overlapOf({ stalled, ready, reach });
     const inspected = config.inspect(d);
     // T-0343: `secondExit` names the second command's expected exit when it is not 0 (lazy detect reports issues with 1).
     const secondExit = config.secondExit === undefined ? 0 : config.secondExit;
-    return { name, stalled, exits, ...inspected, ok: stalled && exits[0] === 0 && exits[1] === secondExit && inspected.preserved === true };
+    return { name, stalled, overlapped, why, read: reach && reach.read && reach.read.how, lock: reach && reach.lock && reach.lock.result,
+      waitedMs: ready.waitedMs, exits, ...inspected,
+      ok: overlapped && exits[0] === 0 && exits[1] === secondExit && inspected.preserved === true };
   } catch (e) {
     return { name, error: String(e && e.message || e), ok: false };
   } finally {

package/scripts/e2e-lived-in-harness.js

@@ -225,7 +225,7 @@ if (require.main === module) {
     ]) {
       const copy = path.join(root, 'copy-' + (++n));
       covered.push(what);
-      fs.cpSync(dir, copy, { recursive: true });
+      require('../lib/copy-tree').copyTreeSync(dir, copy);
       t(`fixture: ${what} changed alone is the one reported missing (#${n})`, () => {
         change(copy);
         assert.deepStrictEqual(livedInMissing(copy).map(m => m.split(' (')[0]), [what]);
@@ -235,7 +235,7 @@ if (require.main === module) {
     // Control for the whole-id match: the id in Markdown emphasis still names the task.
     t('fixture: a handoff naming the task as __id__ still counts', () => {
       const copy = path.join(root, 'copy-emphasis');
-      fs.cpSync(dir, copy, { recursive: true });
+      require('../lib/copy-tree').copyTreeSync(dir, copy);
       edit(copy, 'session-handoff.md', built.ids.task1, '__' + built.ids.task1 + '__');
       assert.deepStrictEqual(livedInMissing(copy), []);
     });

package/scripts/fix-evidence-language-probe.js

@@ -31,7 +31,7 @@ const seed = lang => {
   return (seeds[lang] = dir);
 };
 let copies = 0;
-const fresh = lang => { const dir = path.join(arena, 'p' + (++copies)); fs.cpSync(seed(lang), dir, { recursive: true }); return dir; };
+const fresh = lang => { const dir = path.join(arena, 'p' + (++copies)); require('../lib/copy-tree').copyTreeSync(seed(lang), dir); return dir; };
 const runIn = (cwd, args, extraEnv = {}) => cp.spawnSync(process.execPath, [CLI, ...args], { cwd, encoding: 'utf8', timeout: 300000, windowsHide: true, env: { ...env, ...extraEnv } });
 const show = r => `exit ${r.status}\n${String(r.stdout || '').slice(0, 1500)}${String(r.stderr || '').slice(0, 600)}`;
 const addDone = (dir, title, evidence) => {

package/scripts/i18n-next-cluster-probe.js

@@ -140,7 +140,7 @@ function normalizedJson(label, result) {
 function cloneProjectState(target) {
   fs.mkdirSync(target, { recursive: true });
   fs.copyFileSync(path.join(project, 'package.json'), path.join(target, 'package.json'));
-  fs.cpSync(path.join(project, '.leerness'), path.join(target, '.leerness'), { recursive: true });
+  require('../lib/copy-tree').copyTreeSync(path.join(project, '.leerness'), path.join(target, '.leerness'));
 }
 
 const surfaces = [

package/scripts/lazy-auto-track-probe.js

@@ -0,0 +1,87 @@
+'use strict';
+// T-0345: `lazy detect --auto-track` registers a task for each new TODO whose file no tracker row references, and
+// only those. A batch that mixed such files with a file a task already referenced registered every new TODO, so the
+// TODOs in the referenced file got tasks of their own as well. known-todos.json gains exactly the registered TODOs.
+const assert = require('assert');
+const cp = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const CLI = path.resolve(__dirname, '..', 'bin', 'leerness.js');
+const ENV = { ...process.env, LEERNESS_OFFLINE: '1', LEERNESS_NO_PROMPT: '1', LEERNESS_NO_LOCK_WARN: '1', LEERNESS_NO_AUTOCHCP: '1' };
+const arena = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-lazy-auto-track-'));
+let passed = 0, failed = 0, seq = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log('PASS ' + name); }
+  catch (error) { failed++; console.error('FAIL ' + name + ': ' + (error && error.stack || error)); }
+}
+const run = (d, args) => {
+  const r = cp.spawnSync(process.execPath, [CLI, ...args], { cwd: d, env: ENV, encoding: 'utf8', timeout: 120000, windowsHide: true });
+  assert.strictEqual(r.error, undefined, r.error && r.error.message);
+  return r;
+};
+// A project with the given source files and, for each entry of `referenced`, a task whose text names that file.
+function project(files, referenced = []) {
+  const d = path.join(arena, 'p' + (++seq));
+  fs.mkdirSync(d);
+  assert.strictEqual(run(d, ['init', d, '--yes', '--minimal']).status, 0, 'init');
+  for (const [name, text] of Object.entries(files)) {
+    fs.mkdirSync(path.dirname(path.join(d, name)), { recursive: true });
+    fs.writeFileSync(path.join(d, name), text);
+  }
+  for (const name of referenced) assert.strictEqual(run(d, ['task', 'add', `Clean up ${name}`, '--path', d]).status, 0, 'task add');
+  return d;
+}
+const tasks = d => {
+  const r = run(d, ['task', 'list', '--path', d, '--json']);
+  assert.strictEqual(r.status, 0, r.stdout + r.stderr);
+  const parsed = JSON.parse(r.stdout);
+  return (parsed.tasks || parsed).map(t => t.request);
+};
+const autoTracked = d => tasks(d).filter(request => /^TODO /.test(request)).sort();
+const known = d => {
+  const file = path.join(d, '.leerness', 'known-todos.json');
+  return fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')).map(t => `${t.file}:${t.line}`).sort() : null;
+};
+const autoTrack = d => {
+  const r = run(d, ['lazy', 'detect', d, '--auto-track']);
+  assert.ok(r.status === 0 || r.status === 1, 'lazy detect exit ' + r.status + '\n' + r.stdout + r.stderr);
+  return r;
+};
+const SOURCES = {
+  'src/covered.js': '// TODO: first covered note\nfunction a() {}\n// FIXME: second covered note\n',
+  'src/fresh.js': 'function b() {}\n// TODO: fresh note\n',
+};
+try {
+  test('a mixed batch registers only the TODO in the file no task references', () => {
+    const d = project(SOURCES, ['src/covered.js']);
+    autoTrack(d);
+    assert.deepStrictEqual(autoTracked(d), ['TODO src/fresh.js:2']);
+    assert.deepStrictEqual(known(d), ['src/fresh.js:2']);
+    assert.strictEqual(tasks(d).filter(request => request === 'Clean up src/covered.js').length, 1, 'the referencing task is kept as it was');
+  });
+  test('running it again registers nothing more', () => {
+    const d = project(SOURCES, ['src/covered.js']);
+    autoTrack(d);
+    autoTrack(d);
+    assert.deepStrictEqual(autoTracked(d), ['TODO src/fresh.js:2']);
+    assert.deepStrictEqual(known(d), ['src/fresh.js:2']);
+  });
+  test('control: with no file referenced, every new TODO is registered', () => {
+    const d = project(SOURCES);
+    autoTrack(d);
+    assert.deepStrictEqual(autoTracked(d), ['TODO src/covered.js:1', 'TODO src/covered.js:3', 'TODO src/fresh.js:2']);
+    assert.deepStrictEqual(known(d), ['src/covered.js:1', 'src/covered.js:3', 'src/fresh.js:2']);
+  });
+  test('control: with every file referenced, nothing is registered and known-todos.json is not written', () => {
+    const d = project(SOURCES, ['src/covered.js', 'src/fresh.js']);
+    autoTrack(d);
+    assert.deepStrictEqual(autoTracked(d), []);
+    assert.strictEqual(known(d), null);
+  });
+} finally {
+  fs.rmSync(arena, { recursive: true, force: true });
+}
+console.log(`lazy auto-track probe: ${passed}/${passed + failed} passed (${process.platform})`);
+process.exitCode = failed ? 1 : 0;