leerness 1.36.303 → 1.36.305

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.36.305 - 2026-10-16
+
+- Fixed: on Windows with Node 23.x, 24.0.0-24.21.x, 25.x or 26.0.0-26.8.x, a removal that failed (a file or folder another process holds: an editor, antivirus, a shell's working directory) could end leerness without any error when the path had a character outside the system code page, and on other non-ASCII paths the error named a garbled path (T-0365). This is a Node bug: when fs.rmSync fails, Node builds the error from the absolute path given, converted with the ANSI code page, which ends the process for a character the code page cannot hold (exit code 0xC0000409; no try/catch sees it). Node fixed it in 24.22.0 and 26.9.0; 22.x and older are not affected. Measured on this PC (Node 26.3.0, code page 949): the process ended for e-acute, u-umlaut, n-tilde, Thai, Arabic, an emoji and a CJK Extension B character, and not for ASCII, Hangul, hanja, kana, Cyrillic, Greek, the euro sign or the other characters code page 949 holds; also for a single held file; read-only files are removed normally.
+  - `lib/safe-remove.js` `removeSync` is fs.rmSync with the same arguments, except on those Windows Node versions for a path with a character above U+007F (Node converts only the path given, and every code page holds ASCII). There it checks the options with fs.rmSync itself first (on a path that does not exist) and reads them as Node does (one copy of their own enumerable properties, so a getter runs once; only recursive, force, maxRetries and retryDelay are used), then the target as given, as Node does (an empty path is ENOENT; a string, a Buffer or a URL goes to the file calls unchanged); unlinks a file or a link (a symbolic link or a junction) as given, which reports its error with the path and never ends the process; and for a folder makes its first change on the folder as given (an empty one is removed there), so a write guard (`--dry-run`, the runtime write boundary) decides on the same path as for fs.rmSync's one call. A full folder is removed by fs.rmSync itself in a child process, with the absolute path this process resolved (a copied environment loses Windows' per-drive current directories), the same options and working directory; if that process ends, as fs.rmSync makes it on this bug, the caller gets an EPERM error that names the folder. A folder without recursive is ERR_FS_EISDIR, as in fs.rmSync.
+  - It is used where leerness removes user data or its own files: `skill remove`, archive pruning, the npm publish temp folder (its credential file is emptied first, as before), the atomic write's hard-link rollback and detach (`lib/io.js`), the `.harness` to `.leerness` migration rollback, preview cleanup, memory output and recovery bundle cleanup (with the file functions captured before the write guard, as before), the claims baseline and machine cache temp files, and the test runner's fixture; also `scripts/temp-cleanup.js` `removeTree`, which the tests use. selftest's own fixtures keep fs.rmSync.
+  - On an affected Node and a non-ASCII path, a file is removed with unlink, not fs.rmSync: the atomic write's fallback after a failed unlink (fs.rmSync of the same file) is that unlink again there.
+  - `leerness env summary` (and `env summary --json`, as `node.rmSyncPathBug`) and `leerness selftest` say when this Node has the bug and to update it to 24.22.0 or later, or 26.9.0 or later, in the language the user chose. selftest now prints its heading, the note on the settings it ignores while it runs, and this advisory before the cases run, in the same order as before.
+  - The full test run on this code (`ci-shard.js npm test i/3`, three shards in parallel, each with its own new temp directory; Windows, Node v26.3.0): 69/69 leaves in each shard (207, one more than 1.36.304 for the new probe), e2e 469/469 with 432 folders recorded; the runner removed 38, 217 and 47 temp folders. Three `leerness-*` folders were left, the same kinds as in 1.36.304: one that an e2e case replaces after it was recorded (`orph116`) and two memory recovery bundles from processes that do not record.
+- Tests: `scripts/safe-remove-probe.js` (new, in `npm run test:temp-cleanup`), twenty-nine cases: the version bounds on Windows, Linux and macOS; which paths are isolated (ASCII paths are not; relative, Buffer and Hangul paths); without the isolate option an ASCII path is exactly one fs.rmSync call and a non-ASCII one is isolated only with the bug; where it is off, removeSync is exactly one fs.rmSync call with the same arguments; a full folder goes to the child as the absolute path this process resolved, also for a drive-relative `D:rel`, with the four option values it uses; bad options are rejected before anything is removed, with fs.rmSync's error; options are read as Node reads them (an inherited or non-enumerable `recursive` does not count; a BigInt extra, a cycle or a `toJSON` changes nothing; each option is read once, as by fs.rmSync, getters included); the child removes a relative path from this working directory and runs without NODE_OPTIONS; an empty path removes nothing, as fs.rmSync; under `--dry-run` the removal is refused at the folder, also when it is spelled with a trailing separator or given as a URL with a search part, and nothing inside goes, and where the guard allows the folder (a `*.lock` folder) all of it goes, as with fs.rmSync (where fs.rmSync is native and asks the guard once; on Node 22 and older it asks for each entry, and the case says so and is skipped); a nested tree with a read-only file and non-ASCII names is removed; links are removed as links and their targets kept; the same results as fs.rmSync for a missing path (with and without force), a folder without recursive, a file, an empty folder and a full folder; this process never calls fs.rmSync on the target of an isolated removal; a failure names the target with its code, and a child ended by the bug is an EPERM error; a held file is waited out with maxRetries; the removal sites use removeSync; on Windows, `leerness skill remove` with a held folder under a path with an emoji ends with an error, the npm temp cleanup reports the folder as not cleaned, and `removeTree` fails with the code and waits out a short hold, instead of the process ending; the env flag and the advisory in English and Korean; selftest prints the advisory in the language chosen with LEERNESS_LANG; the selftest case. On this PC the probe's first version passed 0 of 15 cases on the 1.36.304 code, and with lib/ switched but bin/ and scripts/ not, the three Windows cases ended the process (0xC0000409). selftest has one more case. `scripts/test-node-runner-probe.js` injects its fixture hold into rmdirSync as well; `scripts/temp-cleanup-probe.js` skips its direct fs.rmSync report on an affected Node with a non-ASCII temp path.
+  - 41 deliberate breaks of `lib/safe-remove.js` (each check, and the child's path, options, working directory, environment and answer), the switched call sites, the advisory and the selftest change were run against this probe, with the unchanged copy as the control (28/28): 40 made a case fail on Windows, each through a failed check (the probe ran to its end every time); the one that passes moves the child's working directory, which no longer matters since the child gets an absolute path. After the last change (each option read once) its four options mutants, one new, and the control (29/29) were run again on the final code: all four fail a case.
+  - Review: cross-model review (codex gpt-6.1-sol), four rounds. The first version removed a folder by walking it in JavaScript; round 1 found that a drive-relative `C:` removed names at the drive root (P1), that selftest chose the advisory's language after dropping LEERNESS_LANG (P2), and that a test forced the mode it should check (P2); round 2 that an empty path removed the working directory's contents (P1) and that a write guard checked every entry, so under `--dry-run` an exempt `*.lock` entry went before the next was refused (P1); round 3 that the guard saw the resolved spelling, so a trailing separator made a folder exempt (P1), and that entries vanishing during the walk and retries without a rescan differed from fs.rmSync (P2). After round 3 the owner chose to have fs.rmSync itself remove a full folder, in a child process. Round 4's first run was stopped by the review service before a report; its notes named three cases, which were fixed (a URL target's search part changed what the guard saw; options fs.rmSync rejects were not checked first; the child lost the per-drive current directory), and round 4 ran again; it found that the options were read with inherited and non-enumerable properties and sent to the child as a whole (P2, P2), which were fixed; the owner chose a short confirmation of that fix, which found that a getter ran twice (once in the options check, once in the copy; P2); by the owner's decision that was fixed, with a test that fails on the reviewed code, and shipped without another round.
+
+## 1.36.304 - 2026-10-16
+
+- Fixed (tests): probes and e2e cases left their temp folders behind (T-0357). On 2026-10-14 this PC's temp directory held 8,434 `leerness-*` folders under 332 name prefixes; 5,142 of them came from e2e.js case sandboxes and 1,243 from the memory probes' arena (T-0354 fixed that one). The test runner now removes them: the test process records the folders it makes, and `scripts/ci-shard.js` removes them after the test ended with exit status 0.
+  - `scripts/temp-cleanup.js` `trackTemp(module)` records only when the environment carries `LEERNESS_TEMP_RECORD`, a directory the runner makes for each leaf; without it nothing is wrapped and the script behaves as before. It wraps `fs.mkdtempSync` and appends one line per folder to its own file in that directory in the same synchronous step that made the folder. The callback and promise forms are not wrapped: they complete later, when another folder may have been put in place (review round 1); their folders are left, and no script in `scripts/` uses them. It removes nothing and installs no exit, emit or exception hook. Child processes that inherit the variable record into the same directory.
+  - What is recorded: only a call whose prefix is an absolute path without `.` or `..` segments; a `Buffer` prefix or result only if it is UTF-8 that decodes and encodes back to the same bytes; a result only if it is the prefix followed by the six characters mkdtemp adds; a folder only if it is strictly below the temp directory of the moment of the call and empty when the call returns (a wrapper installed before the tracker could otherwise put an existing folder in its place; review round 2). Others are left, as before.
+  - `runNpm` gives each leaf its own record directory and, after the leaf ended with status 0, no signal and no spawn error (the verdict it uses for pass/fail), removes the recorded folders newest first with `removeRecorded`: each must still be the folder recorded (same file identity and real path, not a link) and strictly below both the temp directory recorded with it and the runner's own; links inside are removed as links and never followed, and each folder must still resolve inside the tree before it is listed and before a link in it is removed (the checks T-0354 wrote for the memory arena, shared as `ownTree` and `removeOwnedTree`). A failed leaf keeps its folders. The runner checks its record root and each leaf's directory right after making them (an empty directory, not a link; a wrapper of `fs.mkdtempSync` or `fs.mkdirSync` installed before the runner could put an existing folder there, review round 3); a leaf whose directory fails gets no variable and records nothing. It removes only the leaf directories it checked, the root only when it is empty, and prints one line with the counts.
+  - Each of the 171 scripts in `scripts/` that name `mkdtemp` has the tracker as its first statement, before it loads anything from `lib/` or `bin/`; the tracker records only when given a module whose chain reaches the main module, in the main thread (a script loaded with `--require` into another process, anything it loads, and a call without a module record nothing).
+  - Runs that do not go through the runner (`node scripts/x.js`, a plain `npm test`, and CI's e2e and core jobs, which run on throw-away machines) record nothing and leave their folders as before; CONTRIBUTING.md names `node ./scripts/ci-shard.js npm test 1/1` for a local run that cleans up.
+  - Not covered: folders made by processes that do not inherit the variable or do not run the tracker (such as the CLI a probe starts); a test that writes into the record directory, replaces the mkdtemp functions again, or patches the module loader; a folder a process renames or replaces after recording it (left).
+  - Measured with each tree's own runner (the 30 probes of the 2026-10-14 prefix map, one leaf each, a dedicated temp directory per tree, side by side): 29 `leerness-*` folders left with 1.36.303 and 1 now (a memory recovery bundle that `memory-recovery-external-probe.js` makes while it points the temp directory elsewhere); every leaf passed. The full test run (`ci-shard.js npm test i/3`, three shards in parallel, each with its own new temp directory; Windows, Node v26.3.0; on the round-4 code, before the later changes, which touch only `temp-cleanup-probe.js` and `ci-shard-probe.js`): 68/68, 69/69 and 69/69 leaves passed, e2e 469/469 with 432 folders recorded; the runner removed 37, 116 and 150 folders. Five `leerness-*` folders were left: one that an e2e case replaces after it was recorded (`orph116`); two memory recovery bundles from processes that do not record (the one above, and one made by the CLI that `memory-migration-boundary-probe.js` starts); and two that the record-root test of `ci-shard-probe.js` left, the folder it swaps in and the root it moves aside (that test now removes them; run alone and as a leaf it leaves nothing). The first full run of this version left 10 memory recovery bundles: `lib/runtime-writes.js` intercepts fs writes, and the record went through `fs.appendFileSync`, which calls the intercepted `fs.openSync`. Records are now written, and folders read, with the fs functions of the moment the tracker starts.
+  - Why the runner: 1.36.302 and 1.36.303 decided inside the test process at exit. In eight review rounds a later piece of JavaScript (another exit listener, a microtask, an exception handler, an interrupted `process.exit()`) kept changing the verdict after the decision; the owner moved the change out of both releases. The exit status the runner reads cannot change afterwards. The first review round of this version found two problems (an asynchronous mkdtemp whose folder was swapped before its completion was recorded; a call without a module skipped the check against preloads) and the second one more (a wrapper preloaded before the tracker swapped an existing folder in); the third found that the runner's own record root was removed without that check, and that the lossy-`Buffer` test did not distinguish on POSIX; the owner chose one more round, and the fourth found that the encoded-result test did not distinguish its check (a test was added, which fails on that mutant; the owner chose a short confirmation of it, which found that the new test failed when the temp path holds a non-ASCII letter: it is skipped there; a second confirmation found that the skip also gives up a setup where a link of the mangled name leads back into the temp path, and the owner chose to document that and ship). Each code fix has a test that fails on the reviewed code.
+- Tests: `scripts/temp-cleanup-probe.js` has twenty-seven cases (four before) and `scripts/ci-shard-probe.js` three more (seventeen):
+  - without `LEERNESS_TEMP_RECORD` the tracker changes nothing (the mkdtemp functions stay the same objects, nothing is recorded or removed); with it, `fs.mkdtempSync` records its folder with path, identity, real path and temp directory in the process's own file, and the process removes nothing; `fs.mkdtemp`, `fs.promises.mkdtemp`, `require('fs/promises').mkdtemp` and `util.promisify(fs.mkdtemp)` stay unwrapped and record nothing, also when the folder is swapped for another before the completion (review round 1); a record is written when the call returns, so a run that then fails, throws or calls `process.exit(3)` keeps it; a record is written and the folder read with the fs functions of the start, also after the test replaced `fs.openSync`, `fs.writeSync`, `fs.appendFileSync`, `fs.lstatSync` and `fs.realpathSync.native`;
+  - a folder that is not empty when `fs.mkdtempSync` returns is not recorded: a wrapper preloaded before the tracker that swaps in a folder holding a file gets nothing recorded, and that folder survives the runner's removal (an empty folder swapped in is recorded, as named in the stop rule);
+  - not recorded: a `Buffer` prefix that is not UTF-8, also when a wrapper preloaded before the tracker planted the sibling its lossy decoding names (POSIX; Windows refuses such a prefix, so there it is a control); a result in another encoding that is not the prefix plus six characters (`hex`, and `latin1` with a non-ASCII letter, also when a wrapper preloaded before the tracker made the folder the mangled result names; review round 4; skipped when the temp path itself holds a non-ASCII letter, which `latin1` mangles too, also where a link of the mangled name would lead back into it); a relative prefix, a dotted prefix, and a folder outside the temp directory; recorded: a `Buffer` result that is UTF-8 and a `file:` URL prefix; each case has a control that must be recorded in the same process;
+  - with recording on, `process.reallyExit`, `process.exit`, `process.emit` and the `exit`, `beforeExit`, `uncaughtExceptionMonitor` and `newListener` listener counts are unchanged;
+  - nothing is recorded by `trackTemp()` without a module (in a main script, a `--require` preload, or `node -e`; review round 1), by a script loaded with `--require` (directly, through `NODE_OPTIONS`, a module such a script loads, 60 requires deep, or through `createRequire()`), or in a worker thread started from a script file; the same script, and the same 60-deep chain, run as the main script record, and so does a main script after `temp-cleanup.js` itself was preloaded; one tracker per process;
+  - `removeRecorded` removes the recorded folders newest first, nested ones too, and leaves a link's target alone; it leaves a folder replaced by a link (and the link) or by another folder, skips one already gone, leaves a folder outside the runner's temp directory or outside the temp directory of its own record, skips lines it cannot use, and removes nothing for an empty or missing directory;
+  - `scripts/ci-shard-probe.js`: `runNpm` removes the folders a passing leaf and its tracked child recorded and keeps those of a failing leaf and of a killed one; each leaf gets its own record directory, the runner leaves no record directory behind, prints the count line, and does not change the caller's environment; a wrapper that swaps an existing folder in for the record root or a leaf's record directory gets nothing removed and the leaf no variable (the test then removes those folders itself; the full run found them left); a folder a leaf moves into the record root is left with the root;
+  - every script in `scripts/` that names `mkdtemp` in any form has the tracker as its first statement; the check refuses a tracker in a block comment, a line comment (ended by any JavaScript line terminator: CR, LF, U+2028, U+2029), a string, or after other code.
+  - 35 deliberate breaks of `temp-cleanup.js` and `ci-shard.js` (each check removed or weakened in turn, including reverting each review fix) were run against this probe, `ci-shard-probe.js` and `memory-arena-cleanup-probe.js`, with the unchanged files as the control (27/27, 17/17 and 5/5): 27 made a case fail on Windows (one of them, the encoded-result check, only through the round-4 test). Of the eight that pass on Windows, two concern POSIX only (a lossily decoded `Buffer` prefix, which Windows refuses; a leaf ended by a signal, which on Windows ends with exit code 1; CI's Linux jobs run the same tests); one is the identity check when the runner removes a leaf's record directory, which matters only if the leaf replaces that directory (a test writing into the record directory, named in the stop rule); the other five do not change what is removed, because another check stops the same case (a link in place of a folder has another identity; a real path that moved fails the inside check of `removeOwnedTree`; the identity check repeated inside `removeOwnedTree` and the inside check before listing guard only against changes during the removal; an inherited variable of the same name is replaced for the leaf).
+
 ## 1.36.303 - 2026-10-15
 
 - Fixed (tests): `scripts/ci-shard.js` passed its own `LEERNESS_CI_SHARD_TIMES` to the leaves it runs, so `scripts/ci-shard-probe.js`, which runs the runner itself, overwrote the outer run's times file in the middle of a local full run (found in a full run for this release; the outer runner rewrote the file at its end, so the stored times were right). Leaves no longer see the variable, the way `e2eShard` already hides its own. CI does not set it. A new probe case fails on the 1.36.302 runner (13/14) and passes now (14/14) (T-0364).

package/CONTRIBUTING.md

@@ -37,6 +37,8 @@ When you add a guard, construct the **discriminating case**: an input where the
 
 Each top-level case in `scripts/e2e.js` starts with `if (e2eShard.take('<unique key>')) {` and counts itself with `total++;` inside the block. CI runs that file, `test:commands` and `test:fast` in parallel shards (`scripts/ci-shard.js`): every shard computes the same split from `scripts/ci-shard-weights.json`, so the shards of one job run each case and leaf exactly once. A top-level block without the guard, a repeated key, or a guard that is not reached exactly once fails the e2e run. `node ./scripts/ci-shard.js plan e2e 4` shows the split; a run with `LEERNESS_E2E_TIMES=<file>` (e2e) or `LEERNESS_CI_SHARD_TIMES=<file>` (npm leaves) writes measured seconds, and `node ./scripts/ci-shard.js weights e2e <file>` stores them.
 
+A script in `scripts/` that makes temp folders with `fs.mkdtempSync`, `fs.mkdtemp` or `fs.promises.mkdtemp` starts with `require('./temp-cleanup').trackTemp(module);` as its first statement, before it loads anything from `lib/` or `bin/`. Under the test runner (`node ./scripts/ci-shard.js npm <script> <i>/<k>`, as CI runs `test:commands` and `test:fast`, or `node ./scripts/ci-shard.js npm test 1/1` locally), the script records the folders it makes below the temp directory, and the runner removes them after the script ended with exit status 0 and keeps them after a failure; links inside are removed as links, never followed. Child processes that inherit the runner's variable record too. Run directly (`node scripts/x.js`, a plain `npm test`), nothing is recorded or removed. Only code that the main script loaded records; a script loaded with `--require` into another process does not. `scripts/temp-cleanup-probe.js` fails when a script that names `mkdtemp` lacks the line.
+
 ## Release
 
 `npm test` (gate) → bump `VERSION` in `bin/leerness.js` **and** `version` in `package.json` (selftest asserts they match) → CHANGELOG entry → commit → publish → push.

package/README.md

@@ -195,7 +195,7 @@ MIT
 <!-- leerness:project-readme:start -->
 ## Leerness Project Harness
 
-이 프로젝트는 Leerness v1.36.303 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
+이 프로젝트는 Leerness v1.36.305 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
 
 ### 정체성 — AI 에이전트 운영 레이어 (UR-0030)
 
@@ -249,7 +249,7 @@ leerness memory restore decision <date|title>
 
 ### MCP server (외부 AI 통합)
 
-Leerness v1.36.303는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **102개 도구**를 노출:
+Leerness v1.36.305는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **102개 도구**를 노출:
 
 ```jsonc
 // 카테고리별
@@ -270,7 +270,7 @@ Leerness v1.36.303는 stdio JSON-RPC MCP server를 내장합니다 — Claude Co
 `<<autonomous-loop-dynamic>>` 신호만 보내면 AI가:
 1) 다음 라운드 후보 선정 → 2) 코드 변경 → 3) 회귀 테스트 갱신 → 4) 전체 e2e 스위트 통과 → 5) npm publish + git tag → 6) main push → 7) session close → 8) 다음 라운드 예약.
 
-현재 사용 중인 하네스 버전: **1.36.303**. 공개 릴리스 여부는 공개 저장소의 태그와 배포 기록에서 별도로 확인합니다.
+현재 사용 중인 하네스 버전: **1.36.305**. 공개 릴리스 여부는 공개 저장소의 태그와 배포 기록에서 별도로 확인합니다.
 
 ### 성능 가이드
 
@@ -308,7 +308,7 @@ leerness release pack --close --auto-main-push
 - `.leerness/session-handoff.md`: 다음 세션 인수인계 (자동 작성)
 - `.leerness/lessons.md` / `decisions.md` / `rules.md`: 영구 메모리 (5 surface)
 
-Last synced by Leerness v1.36.303: 2026-09-30
+Last synced by Leerness v1.36.305: 2026-09-30
 <!-- leerness:project-readme:end -->
 GitHub 로그인 계정 확인용 서버 어댑터: [설정·연결·승인과의 구분](docs/github-login.md). 실제 앱 등록/브라우저 세션 연결과 대상별 승인은 후속입니다.
 

package/bin/leerness.js

@@ -62,6 +62,7 @@ const path = require('path');
 const cp = require('child_process');
 const { log, ok, warn, fail, failJson, setQuiet, today, now, absRoot, exists, read, readBuf, mkdirp, writeUtf8, append, rel, setDryRunGuard, mkdirpRaw } = require('../lib/io');  // 1.9.382/383 (UR-0025): 출력/시간/파일 프리미티브 공유 모듈 · 1.10.2 (UR-0146): setQuiet
 const { resolveNpmCliPath, spawnNpmSync } = require('../lib/npm-process');
+const { removeSync: _removeSync, rmSyncPathBug: _rmSyncPathBug } = require('../lib/safe-remove');  // T-0365
 const { resolvePortableLaunch, spawnPortable, spawnPortableSync } = require('../lib/portable-process');
 const { scanShellScriptsEncoding, applyShellScriptUtf8Bom } = require('../lib/shell-encoding');
 const { captureMemoryInput, assertMemoryInputCurrent, captureCheckedFileInput, assertCheckedFileCurrent } = require('../lib/memory-input');
@@ -115,7 +116,7 @@ const {
   migrateLegacyWorkspace,
 } = require('../lib/workspace-dir');
 
-const VERSION = '1.36.303';
+const VERSION = '1.36.305';
 
 // MCP lifecycle 주소 표식은 현재 CLI 호출 한 번에만 유효하다. CLI bootstrap에서 즉시 env에서
 // 떼어 두어 `--no-record`/hook처럼 presence 기록 함수에 도달하지 않는 경로도 후속 child에 유출하지 않는다.
@@ -1375,7 +1376,7 @@ function _pruneArchives(root, keep = 10) {
   const withTime = names.map(name => { let t = 0; try { t = fs.statSync(path.join(adir, name)).mtimeMs; } catch {} return { name, t }; });
   withTime.sort((a, b) => b.t - a.t);  // 최신 우선 (이름의 버전 문자열은 zero-pad 안 돼 사전순 부정확 → mtime 사용)
   let pruned = 0;
-  for (const e of withTime.slice(keep)) { try { fs.rmSync(path.join(adir, e.name), { recursive: true, force: true }); pruned++; } catch {} }
+  for (const e of withTime.slice(keep)) { try { _removeSync(path.join(adir, e.name), { recursive: true, force: true }); pruned++; } catch {} }
   return pruned;
 }
 function createBackup(root, reason, files, dry = false) {
@@ -2494,10 +2495,10 @@ function skillRemove(root, id) {
   try { _SKILLS_LIST_CACHE.delete(absRoot(root)); } catch {}
   if (_skillCatalog()[id]) {
     // catalog 스킬은 로컬 메타만 제거 (카탈로그는 패키지 내장이라 영구 제거 불가)
-    fs.rmSync(dir, { recursive: true, force: true });
+    _removeSync(dir, { recursive: true, force: true });
     ok(`local meta removed for catalog skill: ${id} (catalog 자체는 패키지에 내장)`);
   } else {
-    fs.rmSync(dir, { recursive: true, force: true });
+    _removeSync(dir, { recursive: true, force: true });
     ok(`user skill removed: ${id}`);
   }
 }
@@ -3712,7 +3713,7 @@ function _collectRuntimeEnv(opts = {}) {
 function _collectRuntimeEnvBase() {
   const env = {
     os: { platform: os.platform(), release: os.release(), arch: os.arch() },
-    node: { version: process.version, exe: process.execPath },
+    node: { version: process.version, exe: process.execPath, rmSyncPathBug: _rmSyncPathBug() },
     locale: {
       LANG: process.env.LANG || null,
       LC_ALL: process.env.LC_ALL || null,
@@ -3853,6 +3854,14 @@ function _scanShellScriptsEncoding(root) {
   return scanShellScriptsEncoding(root, { classifyCJK: _classifyCJK, riskLabel: _riskLabel });
 }
 
+// T-0365: Windows Node versions whose failed fs.rmSync ends the process (lib/safe-remove.js). leerness removes its own
+//   files around it; the advisory is for the user, since other programs on the same Node are not.
+function _rmSyncAdvisory(lang, version = process.versions.node, platform = process.platform) {
+  if (!_rmSyncPathBug(version, platform)) return null;
+  return lang === 'en'
+    ? `Node ${version} on Windows: when fs.rmSync fails on a path with a character outside the system code page, the process ends without an error (fixed in Node 24.22.0 and 26.9.0). leerness removes files without it on this version. Update Node to 24.22.0 or later, or 26.9.0 or later.`
+    : `Windows 의 Node ${version}: 시스템 코드 페이지에 없는 문자가 든 경로에서 fs.rmSync 가 실패하면 프로세스가 오류 없이 종료됩니다(Node 24.22.0·26.9.0 에서 수정). 이 버전에서 leerness 는 fs.rmSync 를 쓰지 않고 삭제합니다. Node 를 24.22.0 이상 또는 26.9.0 이상으로 올리세요.`;
+}
 function envCmd(root, sub) {
   root = absRoot(root);
   const isTty = process.stdout && process.stdout.isTTY;
@@ -3914,6 +3923,7 @@ function envCmd(root, sub) {
   log('');
   log(`  💻 OS: ${gr(env.os.platform)} ${env.os.release} (${env.os.arch})`);
   log(`  📦 Node: ${gr(env.node.version)}`);
+  { const advisory = _rmSyncAdvisory(_uiLang(root)); if (advisory) log(yl(`  ⚠ ${advisory}`)); }
   log(`  🌐 Locale: LANG=${env.locale.LANG || 'unset'} · CP=${env.locale.codepage || 'unknown'}${env.locale.isKoreanWindows ? yl(' (한국어 Windows)') : ''}`);
   // 1.9.252 (UR-0018 마무리): 인라인 Windows/POSIX 인코딩 분기를 _terminalEncodingNotice() 헬퍼로 통합 (DRY).
   //   이전 (1.9.249/250) 에는 env summary / handoff / install 에 거의 동일한 분기가 중복 → 단일 소스로 일원화.
@@ -4216,6 +4226,11 @@ function _selfTestCases() {
     { name: '_isSecretKey: NPM_TOKEN 차단', run: () => _isSecretKey('NPM_TOKEN') === true },
     { name: '_isSecretKey: API_KEY/SECRET/PASSWORD 차단', run: () => _isSecretKey('OPENAI_API_KEY') && _isSecretKey('MY_SECRET') && _isSecretKey('db_PASSWORD') },
     { name: '_isSecretKey: 비시크릿 LEERNESS_* 통과', run: () => _isSecretKey('LEERNESS_ENABLE_AGY') === false && _isSecretKey('LANG') === false },
+    { name: 'T-0365: Windows fs.rmSync 경로 변환 버그 판정 (24.22.0·26.9.0 에서 수정) + 안내 문구', run: () => {
+      const bug = [['22.23.3', false], ['23.0.0', true], ['24.21.0', true], ['24.22.0', false], ['25.9.0', true], ['26.8.2', true], ['26.9.0', false], ['27.0.0', false]];
+      return bug.every(([v, want]) => _rmSyncPathBug(v, 'win32') === want && _rmSyncPathBug(v, 'linux') === false)
+        && _rmSyncAdvisory('en', '26.3.0', 'win32') !== null && _rmSyncAdvisory('en', '26.9.0', 'win32') === null && _rmSyncAdvisory('ko', '24.0.0', 'linux') === null;
+    } },
     { name: 'compareVer: 대소 비교', run: () => compareVer('1.9.258', '1.9.257') === 1 && compareVer('1.9.0', '1.10.0') === -1 && compareVer('2.0.0', '2.0.0') === 0 },
     { name: 'compareVer: 누락 파트/null 안전', run: () => compareVer('1.9', '1.9.0') === 0 && compareVer(null, '0.0.0') === 0 },
     { name: 'parseHarnessVersion: exact canonical/legacy formats only', run: () => parseHarnessVersion('1.9.0').base === '1.9.0' && parseHarnessVersion('leerness@1.8.0+plus@1.0.1').plus === '1.0.1' && parseHarnessVersion('leerness@1.8.0').base === '1.8.0' && parseHarnessVersion('garbage leerness@1.8.0 trailing').base === null && parseHarnessVersion('leerness@1.8.0.1').base === null && parseHarnessVersion('plus@1.0.1 junk').plus === null },
@@ -8086,15 +8101,35 @@ function _controlSelftestEnv() {
   return Object.assign(dropped, { restore });
 }
 function selfTestCmd(opts = {}) {
+  // T-0365: the advisory's language is read before LEERNESS_LANG and the other controlled variables are dropped
+  //   (1.36.305 review round 1: read after, English mode printed it in Korean).
+  const lang = _uiLang(process.cwd());
   const droppedEnv = _controlSelftestEnv();
-  try { return _selfTestCmdInner(opts, droppedEnv); } finally { droppedEnv.restore(); }
+  try { return _selfTestCmdInner(opts, droppedEnv, lang); } finally { droppedEnv.restore(); }
 }
-function _selfTestCmdInner(opts, droppedEnv) {
+function _selfTestCmdInner(opts, droppedEnv, lang) {
   const isTty = process.stdout && process.stdout.isTTY;
   const gr = s => isTty ? `\x1b[32m${s}\x1b[0m` : s;
   const rd = s => isTty ? `\x1b[31m${s}\x1b[0m` : s;
   const cy = s => isTty ? `\x1b[36m${s}\x1b[0m` : s;
   const dm = s => isTty ? `\x1b[2m${s}\x1b[0m` : s;
+  // The heading, the controlled-environment note and the advisory come before the cases run (several minutes on
+  //   Windows), in the same order as before.
+  if (!opts.json) {
+    log(cy(`# leerness selftest (1.9.258) — 코어 함수 무결성 검증 (v${VERSION})`));
+    log('');
+    // 무시한 설정은 반드시 보인다 — 사용자가 켜 둔 것이 안 먹었다는 사실을 숨기면 그 자체가 거짓 보고다(1.36.125).
+    if (droppedEnv.length) {
+      log(dm(`  ⓘ 측정 통제: 검증 중에만 ${droppedEnv.length}개 환경설정을 무시합니다 — ${droppedEnv.join(', ')}`));
+      //   ⚠ 1.36.129: 여기에 다른 가드의 **실패 표지 문자열**을 그대로 적어 두었더니, 그 가드가 이 안내를
+      //     실패로 읽었다(안내 문구가 곧 표면이다 — 같은 클래스를 이 저장소에서 세 번째로 만났다).
+      //     뜻은 유지하고 표지 문자열만 피한다.
+      log(dm(`     (이 설정들이 켜져 있으면 selftest 가 정상 설치를 실패로 거짓 보고했습니다 — 실제 제품 동작은 그대로입니다)`));
+      log('');
+    }
+    const advisory = _rmSyncAdvisory(lang);
+    if (advisory) { log(`  ⚠ ${advisory}`); log(''); }
+  }
   const cases = _selfTestCases();
   const results = cases.map(c => {
     let ok = false, err = null;
@@ -8108,17 +8143,6 @@ function _selfTestCmdInner(opts, droppedEnv) {
     if (fail > 0) process.exitCode = 1;
     return;
   }
-  log(cy(`# leerness selftest (1.9.258) — 코어 함수 무결성 검증 (v${VERSION})`));
-  log('');
-  // 무시한 설정은 반드시 보인다 — 사용자가 켜 둔 것이 안 먹었다는 사실을 숨기면 그 자체가 거짓 보고다(1.36.125).
-  if (droppedEnv.length) {
-    log(dm(`  ⓘ 측정 통제: 검증 중에만 ${droppedEnv.length}개 환경설정을 무시합니다 — ${droppedEnv.join(', ')}`));
-    //   ⚠ 1.36.129: 여기에 다른 가드의 **실패 표지 문자열**을 그대로 적어 두었더니, 그 가드가 이 안내를
-    //     실패로 읽었다(안내 문구가 곧 표면이다 — 같은 클래스를 이 저장소에서 세 번째로 만났다).
-    //     뜻은 유지하고 표지 문자열만 피한다.
-    log(dm(`     (이 설정들이 켜져 있으면 selftest 가 정상 설치를 실패로 거짓 보고했습니다 — 실제 제품 동작은 그대로입니다)`));
-    log('');
-  }
   results.forEach(r => {
     if (r.ok) log(`  ${gr('✓')} ${r.name}`);
     else log(`  ${rd('✗')} ${r.name}${r.err ? dm(' — ' + r.err) : ''}`);
@@ -25081,7 +25105,7 @@ function _cleanupNpmTempDir(tmpDir, sensitiveFile = null) {
         try { fs.chmodSync(sensitiveFile, 0o600); } catch {}
         fs.writeFileSync(sensitiveFile, '', { mode: 0o600 });
       }
-      fs.rmSync(tmpDir, { recursive: true, force: true });
+      _removeSync(tmpDir, { recursive: true, force: true });
       cleaned = !exists(tmpDir);
     } catch {}
   }
@@ -34174,6 +34198,8 @@ module.exports = {
   _shellFailuresPath, _loadShellFailures, _recordShellFailure: projectWriter(_recordShellFailure), _shellEnvDrift,
   // 1.36.287 (T-0304): 환경 수집의 프로세스당 1회·도구 조회 분리 — 자식 프로세스 수로 검증
   _collectRuntimeEnv,
+  // T-0365: the rmSync advisory and the npm temp cleanup, for scripts/safe-remove-probe.js
+  _rmSyncAdvisory, _cleanupNpmTempDir,
   // 1.9.265: CLI 에이전트 슬래시 명령어 레지스트리 (UR-0021 1단계) — 단위 테스트
   AGENT_SLASH_COMMANDS, _agentSlashFile, _loadAgentSlashCommands, _recordAgentSlashCommands, _agentSlashHint, slashCommandsCmd,
   _parseSlashFromHelp, _probeAgentSlash, _refreshAgentSlashCommands,

package/lib/claims-baseline.js

@@ -8,6 +8,7 @@
 
 const crypto = require('crypto');
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const path = require('path');
 const { absRoot, exists, read, mkdirp, writeUtf8 } = require('./io');
 const { _isDoneStatus } = require('./pure-utils');
@@ -163,7 +164,7 @@ function saveBaseline(root, doc, withLock) {
     writeUtf8(temp, JSON.stringify(doc, null, 2) + '\n');
     try { fs.renameSync(temp, file); }
     catch (error) {
-      try { fs.rmSync(temp, { force: true }); } catch {}
+      try { removeSync(temp, { force: true }); } catch {}
       throw error;
     }
   };

package/lib/io.js

@@ -11,6 +11,7 @@ const { errorLanguage } = require('./error-language');
 const _english = () => errorLanguage() === 'en';
 const _korean = () => errorLanguage() === 'ko';
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const path = require('path');
 const os = require('os');
 const cp = require('child_process');
@@ -597,7 +598,7 @@ function _rollbackCommittedHardLink(alias, live, expected, maxReadBytes) {
   try { fs.unlinkSync(live); }
   catch (error) { removalError = error; }
   if (_lstatState(live).exists === true) {
-    try { fs.rmSync(live, { force: true }); }
+    try { removeSync(live, { force: true }); }
     catch (error) { removalError = removalError || error; }
   }
   if (_lstatState(live).exists === true) {
@@ -606,7 +607,7 @@ function _rollbackCommittedHardLink(alias, live, expected, maxReadBytes) {
       fs.renameSync(live, quarantine);
       try { fs.unlinkSync(quarantine); }
       catch {
-        try { fs.rmSync(quarantine, { force: true }); } catch {}
+        try { removeSync(quarantine, { force: true }); } catch {}
       }
       const postRename = _lstatState(live);
       return postRename.exists === false
@@ -643,7 +644,7 @@ function detachCommittedHardLink(aliasPath, livePath, expectedBytes, opts = {})
     firstCleanupError = error;
     // Some transient/platform wrappers fail unlink but permit the equivalent
     // exact-path removal. This is only the random prepared alias, never user data.
-    try { fs.rmSync(alias, { force: true }); } catch {}
+    try { removeSync(alias, { force: true }); } catch {}
     if (fs.existsSync(alias)) {
       const detacher = `${alias}.detach-${process.pid}-${crypto.randomBytes(8).toString('hex')}`;
       let detacherExists = false;
@@ -655,7 +656,7 @@ function detachCommittedHardLink(aliasPath, livePath, expectedBytes, opts = {})
         fs.renameSync(detacher, alias);
         detacherExists = false;
       } catch (detachError) {
-        try { if (detacherExists) fs.rmSync(detacher, { force: true }); } catch {}
+        try { if (detacherExists) removeSync(detacher, { force: true }); } catch {}
         const expected = Buffer.isBuffer(expectedBytes) ? expectedBytes : null;
         const rollback = _rollbackCommittedHardLink(alias, live, expected, maxReadBytes);
         // Another actor may have detached the alias between our failed rename
@@ -677,7 +678,7 @@ function detachCommittedHardLink(aliasPath, livePath, expectedBytes, opts = {})
       }
       // The path now names an unrelated empty inode. Failure to remove this
       // cleanup artifact is non-fatal and cannot poison the committed file.
-      try { fs.rmSync(alias, { force: true }); } catch {}
+      try { removeSync(alias, { force: true }); } catch {}
     }
   }
   let stat;

package/lib/machine-cache.js

@@ -6,6 +6,7 @@
 // read or parse error as a miss. Writes are best-effort and must never fail the calling command.
 // It never lives inside a project, so project read-only contracts are unaffected.
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
@@ -70,7 +71,7 @@ function writeCache(name, key, value) {
     fs.renameSync(temp, file);
     return true;
   } catch {
-    try { fs.rmSync(temp, { force: true }); } catch {}
+    try { removeSync(temp, { force: true }); } catch {}
     return false;
   }
 }

package/lib/memory-output.js

@@ -9,6 +9,7 @@
 // cleanup also cannot retain writes that arrive later through an already-open
 // descriptor to the displaced inode; this boundary protects pathname races.
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const { readPublicationBytes } = require('./memory-publication-read');
 const path = require('path');
 const crypto = require('crypto');
@@ -210,7 +211,7 @@ function cleanupFile(file) {
 }
 function cleanupDir(dir) {
   if (!dir) return null;
-  try { if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true }); return null; }
+  try { if (fs.existsSync(dir)) removeSync(dir, { recursive: true }); return null; }
   catch (error) { return error; }
 }
 function markOutputError(error, details = {}) {

package/lib/migrate.js

@@ -6,6 +6,7 @@
 'use strict';
 const path = require('path');
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const os = require('os');
 const cp = require('child_process');
 const { absRoot, exists, read, log, ok, warn } = require('./io');
@@ -121,7 +122,7 @@ function migratePlanCmd(root, opts = {}, deps = {}) {
       for (const f of tmpFiles) if (!exists(path.join(root, f))) plan.missingFiles.push(f);
     }
   } catch {}
-  finally { if (tmp) { try { fs.rmSync(tmp, { recursive: true, force: true }); } catch {} } }
+  finally { if (tmp) { try { removeSync(tmp, { recursive: true, force: true }); } catch {} } }
   plan.willChange = plan.missingFiles.length + plan.canonicalPending.length + (plan.versionDrift ? 1 : 0);
   if (opts.json) { log(JSON.stringify(plan, null, 2)); return; }
   log(`# leerness migrate plan (1.9.358, UR-0075 Phase D) — 임시폴더 설치 후 비교 · 읽기 전용(프로젝트 미변경)`);

package/lib/preview-serve.js

@@ -7,6 +7,7 @@
 //   leerness 는 사용자의 dev 서버를 임의로 실행하지 않는다(사용자 코드 실행은 명시 옵트인 영역).
 'use strict';
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const http = require('http');
 const path = require('path');
 const { absRoot, exists, read, writeUtf8, mkdirp, log, ok, warn, failJson, now } = require('./io');
@@ -54,7 +55,7 @@ function cleanupServeDir(root, id) {
     const checked = _previewOutputPathCheck(root, dRel, { requireDirectory: exists(d) });
     // Never follow a swapped `.leerness/previews` or `.serve-*` link during
     // recursive cleanup. An unsafe path is left untouched for manual recovery.
-    if (checked.ok && exists(d)) { fs.rmSync(d, { recursive: true, force: true }); cleaned = true; }
+    if (checked.ok && exists(d)) { removeSync(d, { recursive: true, force: true }); cleaned = true; }
   } catch {}
   // (검수 #8) project 모드로 프로젝트 정적 디렉토리에 배치한 사본도 함께 정리 — "확인 끝나면 정리한다"는 안내와 실제를 일치시킨다.
   try {
@@ -66,7 +67,7 @@ function cleanupServeDir(root, id) {
         const abs = path.resolve(absRoot(root), placed);
         const rel = path.relative(absRoot(root), abs).replace(/\\/g, '/');
         const checked = _previewOutputPathCheck(root, rel, { requireFile: exists(abs) });
-        if (checked.ok && exists(abs)) { fs.rmSync(abs, { force: true }); cleaned = true; }
+        if (checked.ok && exists(abs)) { removeSync(abs, { force: true }); cleaned = true; }
         delete j.placed[id];
         writeUtf8(cfgF, JSON.stringify(j, null, 2) + '\n');
       }

package/lib/runtime-writes.js

@@ -3,6 +3,7 @@
 // 호환 릴리스의 관측 기반 쓰기 경계. 원자 fencing/activation 프로토콜이 아니다.
 // topology만 한 작업 동안 재사용하고 descriptor/indicator는 매 쓰기마다 다시 읽는다.
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const path = require('path');
 const os = require('os');
 const { fileURLToPath } = require('url');
@@ -20,6 +21,11 @@ const recoveryFs = {
   closeSync: fs.closeSync.bind(fs),
   chmodSync: typeof fs.chmodSync === 'function' ? fs.chmodSync.bind(fs) : null,
   rmSync: typeof fs.rmSync === 'function' ? fs.rmSync.bind(fs) : null,
+  // T-0365: what lib/safe-remove.js removeSync checks and removes a target with on a Windows Node whose fs.rmSync can end
+  //   the process (a full folder then goes to fs.rmSync in a child process).
+  lstatSync: fs.lstatSync.bind(fs),
+  unlinkSync: fs.unlinkSync.bind(fs),
+  rmdirSync: fs.rmdirSync.bind(fs),
 };
 let installed = false;
 
@@ -260,7 +266,7 @@ function writeExternalRecoveryBundle(root, files) {
     }
     return dir;
   } catch (error) {
-    try { if (recoveryFs.rmSync) recoveryFs.rmSync(dir, { recursive: true, force: true }); } catch {}
+    try { if (recoveryFs.rmSync) removeSync(dir, { recursive: true, force: true }, { fsImpl: recoveryFs }); } catch {}
     throw error;
   }
 }

package/lib/safe-remove.js

@@ -0,0 +1,132 @@
+'use strict';
+
+// T-0365: on Windows, Node 23.x, 24.0.0-24.21.x, 25.x and 26.0.0-26.8.x build the error of a fs.rmSync that fails (a
+//   file or folder another process holds) from std::filesystem::path::string() of the absolute path given, which
+//   converts with the ANSI code page. A character the code page has no mapping for ends the process (0xC0000409; no
+//   try/catch sees it), and any other non-ASCII path comes back garbled in error.path and error.message. Node fixed it
+//   in 24.22.0 and 26.9.0 (nodejs/node 37aeecc7b6, "fs: fix rmSync error messages for non-ASCII paths"); 22.x and older
+//   remove in JavaScript. Only that one path is converted, so an ASCII path is safe on every version.
+// removeSync is fs.rmSync with the same arguments except for a non-ASCII path on those versions. There a file or a link
+//   is unlinked (libuv reports its errors with the path as given), and a folder is removed by fs.rmSync itself in a
+//   child process, so a failure ends only the child. 1.36.305 review rounds 1-3 found, each time, another place where a
+//   removal walked in JavaScript differed from fs.rmSync (a drive-relative path, an empty path, a write guard seeing
+//   every entry, a trailing separator, entries that vanish, retries that do not rescan); the owner chose to have
+//   fs.rmSync itself do the removal.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+const crypto = require('crypto');
+const { fileURLToPath } = require('url');
+// fs.rmSync as it was when this module loaded (lib/io.js loads it before any write guard wraps fs), used only to have
+//   Node check a removal's options on a path that does not exist.
+const RM_UNGUARDED = fs.rmSync.bind(fs);
+
+function rmSyncPathBug(version = process.versions.node, platform = process.platform) {
+  if (platform !== 'win32') return false;
+  const [major, minor] = String(version).replace(/^v/, '').split('.').map(Number);
+  if (major === 23 || major === 25) return true;
+  if (major === 24) return minor < 22;
+  if (major === 26) return minor < 9;
+  return false;
+}
+
+const asPath = target => target instanceof URL ? fileURLToPath(target) : Buffer.isBuffer(target) ? target.toString() : target;
+// Whether fs.rmSync could end the process or garble its error for this target: the bug, and a character above U+007F
+//   in the absolute path Node converts (any ANSI code page holds ASCII).
+function needsIsolation(target, version, platform) {
+  if (!rmSyncPathBug(version, platform)) return false;
+  const p = asPath(target);
+  return typeof p === 'string' && /[^\x00-\x7f]/.test(path.resolve(p));
+}
+
+// The codes fs.rmSync retries when maxRetries is given.
+const RETRY_CODES = new Set(['EBUSY', 'EMFILE', 'ENFILE', 'ENOTEMPTY', 'EPERM']);
+const sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+function eisdir(target) {
+  return Object.assign(new Error(`Path is a directory: rm returned EISDIR (is a directory) ${target}`),
+    { name: 'SystemError', code: 'ERR_FS_EISDIR', errno: 21, syscall: 'rm', path: target });
+}
+
+// Node checks fs.rmSync's options before it touches the path (1.36.305 review round 4: the isolated removal unlinked a
+//   file or removed an empty folder with options fs.rmSync rejects). The same options on a path that does not exist:
+//   Node returns for a missing path before the error that ends the process, so this removes nothing and cannot crash.
+function checkOptions(options) {
+  const missing = path.join(os.tmpdir(), `leerness-rm-options-${process.pid}-${crypto.randomBytes(8).toString('hex')}`);
+  try { RM_UNGUARDED(missing, options); }
+  catch (error) { if (!(error && error.code === 'ENOENT')) throw error; }
+}
+
+// fs.rmSync(target, options) in a new Node process, from this working directory, without NODE_OPTIONS (a preload must
+//   not run there). It answers with one JSON line; a process that ended without one ended in fs.rmSync.
+const CHILD = "const fs=require('fs');let r;try{const j=JSON.parse(fs.readFileSync(0,'utf8'));fs.rmSync(j.target,j.options);r={ok:true};}"
+  + "catch(e){r={ok:false,code:e&&e.code,errno:e&&e.errno};}process.stdout.write(JSON.stringify(r));";
+function rmSyncInChild(target, options) {
+  const env = { ...process.env };
+  for (const k of Object.keys(env)) if (k.toUpperCase() === 'NODE_OPTIONS') delete env[k];
+  const r = cp.spawnSync(process.execPath, ['-e', CHILD], { input: JSON.stringify({ target, options: options || {} }), cwd: process.cwd(),
+    env, encoding: 'utf8', windowsHide: true, maxBuffer: 1 << 20 });
+  if (r.error) throw r.error;
+  let answer = null;
+  try { answer = JSON.parse(r.stdout); } catch {}
+  return { status: r.status, signal: r.signal, answer };
+}
+
+// fs.rmSync(target, options). fsImpl: the fs functions to use (lib/runtime-writes.js passes the ones it captured before
+//   installing its write guard); isolate: whether to isolate (the default: needsIsolation for this process); runChild:
+//   what removes a folder (tests pass their own).
+function removeSync(target, options, { fsImpl = fs, isolate = needsIsolation(target), runChild = rmSyncInChild } = {}) {
+  if (!isolate) return fsImpl.rmSync(target, options);
+  // Node reads the options once, as a copy of their own enumerable properties; so does this, and only the four values
+  //   it uses go anywhere, the child included (1.36.305 review round 4, second run: inherited or non-enumerable
+  //   properties were read, and the whole object went to the child as JSON, where a BigInt or a cycle threw and a
+  //   toJSON could change it). An object (not null, not an array) is copied once and the copy is checked and used, so
+  //   a getter runs once (confirmation round: checking the object as given and then copying it ran getters twice);
+  //   anything else is checked as given, which Node rejects before it reads a property.
+  const read = options !== null && typeof options === 'object' && !Array.isArray(options) ? { ...options } : options;
+  checkOptions(read);
+  const { recursive = false, force = false, maxRetries = 0, retryDelay = 100 } = { ...read };
+  const used = { recursive, force, maxRetries, retryDelay };
+  const step = (fn, settle = () => false) => {
+    for (let attempt = 0; ; attempt++) {
+      try { return fn(); }
+      catch (error) {
+        if (settle(error) || attempt >= maxRetries || !RETRY_CODES.has(error && error.code)) throw error;
+        sleep(retryDelay * (attempt + 1));
+      }
+    }
+  };
+  // As Node: the target as given is checked first (an empty path is ENOENT, not the working directory). The parent's
+  //   fs calls get the target exactly as given (a string, a Buffer or a URL), as fs.rmSync's one call does, so a write
+  //   guard (--dry-run, the runtime write boundary) sees the same value (1.36.305 review round 4: a URL's search part).
+  const given = asPath(target);
+  let st;
+  try { st = fsImpl.lstatSync(target); }
+  catch (error) { if (force && error && error.code === 'ENOENT') return; throw error; }
+  const gone = error => !!error && error.code === 'ENOENT';
+  // A file or a link (a symbolic link or, on Windows, a junction): one unlink.
+  if (!st.isDirectory()) {
+    try { return step(() => fsImpl.unlinkSync(target)); }
+    catch (error) { if (gone(error)) return; throw error; }
+  }
+  if (!recursive) throw eisdir(given);
+  // A folder: rmdir first, through fsImpl, so a guard decides before anything inside goes; an empty folder is removed
+  //   there. A full one (ENOTEMPTY or EEXIST) is removed by fs.rmSync in a child process, given the absolute path this
+  //   process resolved: Windows keeps each drive's current directory in environment entries ('=D:') that a copied
+  //   environment loses, so a drive-relative 'D:x' could name another folder in the child (review round 4).
+  const full = error => !!error && (error.code === 'ENOTEMPTY' || error.code === 'EEXIST');
+  try { return step(() => fsImpl.rmdirSync(target), full); }
+  catch (error) { if (gone(error)) return; if (!full(error)) throw error; }
+  const { status, signal, answer } = runChild(path.resolve(given), used);
+  if (answer && answer.ok) return;
+  if (answer) {
+    throw Object.assign(new Error(`${answer.code || 'EPERM'}: could not remove ${given}`),
+      { code: answer.code || 'EPERM', errno: answer.errno, syscall: 'rm', path: given });
+  }
+  throw Object.assign(new Error(`EPERM: could not remove ${given}: the process removing it ended (status ${status}${signal ? `, ${signal}` : ''}); `
+    + 'on this Node, fs.rmSync ends the process when a removal fails on a path with a character outside the system code page'),
+  { code: 'EPERM', syscall: 'rm', path: given, removalProcessEnded: true });
+}
+
+module.exports = { rmSyncPathBug, needsIsolation, removeSync, RETRY_CODES };

package/lib/test-node-runner.js

@@ -2,6 +2,7 @@
 
 const cp = require('node:child_process');
 const fs = require('node:fs');
+const { removeSync } = require('./safe-remove');
 const os = require('node:os');
 const path = require('node:path');
 const { pathToFileURL } = require('node:url');
@@ -199,7 +200,7 @@ async function verifyFixture() {
     // The last child test process can still be exiting. Windows then refuses the delete, and Node 26
     // rmSync does not retry EPERM even with maxRetries, so wait here, bounded.
     for (const deadline = Date.now() + 5000; ;) {
-      try { fs.rmSync(actual, { recursive: true, force: true }); break; }
+      try { removeSync(actual, { recursive: true, force: true }); break; }
       catch (error) {
         if (!['EBUSY', 'EMFILE', 'ENFILE', 'ENOTEMPTY', 'EPERM'].includes(error && error.code) || Date.now() >= deadline) throw error;
         await new Promise(resolve => setTimeout(resolve, 100));