leerness 1.36.304 → 1.36.305

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.36.305 - 2026-10-16
+
+- Fixed: on Windows with Node 23.x, 24.0.0-24.21.x, 25.x or 26.0.0-26.8.x, a removal that failed (a file or folder another process holds: an editor, antivirus, a shell's working directory) could end leerness without any error when the path had a character outside the system code page, and on other non-ASCII paths the error named a garbled path (T-0365). This is a Node bug: when fs.rmSync fails, Node builds the error from the absolute path given, converted with the ANSI code page, which ends the process for a character the code page cannot hold (exit code 0xC0000409; no try/catch sees it). Node fixed it in 24.22.0 and 26.9.0; 22.x and older are not affected. Measured on this PC (Node 26.3.0, code page 949): the process ended for e-acute, u-umlaut, n-tilde, Thai, Arabic, an emoji and a CJK Extension B character, and not for ASCII, Hangul, hanja, kana, Cyrillic, Greek, the euro sign or the other characters code page 949 holds; also for a single held file; read-only files are removed normally.
+  - `lib/safe-remove.js` `removeSync` is fs.rmSync with the same arguments, except on those Windows Node versions for a path with a character above U+007F (Node converts only the path given, and every code page holds ASCII). There it checks the options with fs.rmSync itself first (on a path that does not exist) and reads them as Node does (one copy of their own enumerable properties, so a getter runs once; only recursive, force, maxRetries and retryDelay are used), then the target as given, as Node does (an empty path is ENOENT; a string, a Buffer or a URL goes to the file calls unchanged); unlinks a file or a link (a symbolic link or a junction) as given, which reports its error with the path and never ends the process; and for a folder makes its first change on the folder as given (an empty one is removed there), so a write guard (`--dry-run`, the runtime write boundary) decides on the same path as for fs.rmSync's one call. A full folder is removed by fs.rmSync itself in a child process, with the absolute path this process resolved (a copied environment loses Windows' per-drive current directories), the same options and working directory; if that process ends, as fs.rmSync makes it on this bug, the caller gets an EPERM error that names the folder. A folder without recursive is ERR_FS_EISDIR, as in fs.rmSync.
+  - It is used where leerness removes user data or its own files: `skill remove`, archive pruning, the npm publish temp folder (its credential file is emptied first, as before), the atomic write's hard-link rollback and detach (`lib/io.js`), the `.harness` to `.leerness` migration rollback, preview cleanup, memory output and recovery bundle cleanup (with the file functions captured before the write guard, as before), the claims baseline and machine cache temp files, and the test runner's fixture; also `scripts/temp-cleanup.js` `removeTree`, which the tests use. selftest's own fixtures keep fs.rmSync.
+  - On an affected Node and a non-ASCII path, a file is removed with unlink, not fs.rmSync: the atomic write's fallback after a failed unlink (fs.rmSync of the same file) is that unlink again there.
+  - `leerness env summary` (and `env summary --json`, as `node.rmSyncPathBug`) and `leerness selftest` say when this Node has the bug and to update it to 24.22.0 or later, or 26.9.0 or later, in the language the user chose. selftest now prints its heading, the note on the settings it ignores while it runs, and this advisory before the cases run, in the same order as before.
+  - The full test run on this code (`ci-shard.js npm test i/3`, three shards in parallel, each with its own new temp directory; Windows, Node v26.3.0): 69/69 leaves in each shard (207, one more than 1.36.304 for the new probe), e2e 469/469 with 432 folders recorded; the runner removed 38, 217 and 47 temp folders. Three `leerness-*` folders were left, the same kinds as in 1.36.304: one that an e2e case replaces after it was recorded (`orph116`) and two memory recovery bundles from processes that do not record.
+- Tests: `scripts/safe-remove-probe.js` (new, in `npm run test:temp-cleanup`), twenty-nine cases: the version bounds on Windows, Linux and macOS; which paths are isolated (ASCII paths are not; relative, Buffer and Hangul paths); without the isolate option an ASCII path is exactly one fs.rmSync call and a non-ASCII one is isolated only with the bug; where it is off, removeSync is exactly one fs.rmSync call with the same arguments; a full folder goes to the child as the absolute path this process resolved, also for a drive-relative `D:rel`, with the four option values it uses; bad options are rejected before anything is removed, with fs.rmSync's error; options are read as Node reads them (an inherited or non-enumerable `recursive` does not count; a BigInt extra, a cycle or a `toJSON` changes nothing; each option is read once, as by fs.rmSync, getters included); the child removes a relative path from this working directory and runs without NODE_OPTIONS; an empty path removes nothing, as fs.rmSync; under `--dry-run` the removal is refused at the folder, also when it is spelled with a trailing separator or given as a URL with a search part, and nothing inside goes, and where the guard allows the folder (a `*.lock` folder) all of it goes, as with fs.rmSync (where fs.rmSync is native and asks the guard once; on Node 22 and older it asks for each entry, and the case says so and is skipped); a nested tree with a read-only file and non-ASCII names is removed; links are removed as links and their targets kept; the same results as fs.rmSync for a missing path (with and without force), a folder without recursive, a file, an empty folder and a full folder; this process never calls fs.rmSync on the target of an isolated removal; a failure names the target with its code, and a child ended by the bug is an EPERM error; a held file is waited out with maxRetries; the removal sites use removeSync; on Windows, `leerness skill remove` with a held folder under a path with an emoji ends with an error, the npm temp cleanup reports the folder as not cleaned, and `removeTree` fails with the code and waits out a short hold, instead of the process ending; the env flag and the advisory in English and Korean; selftest prints the advisory in the language chosen with LEERNESS_LANG; the selftest case. On this PC the probe's first version passed 0 of 15 cases on the 1.36.304 code, and with lib/ switched but bin/ and scripts/ not, the three Windows cases ended the process (0xC0000409). selftest has one more case. `scripts/test-node-runner-probe.js` injects its fixture hold into rmdirSync as well; `scripts/temp-cleanup-probe.js` skips its direct fs.rmSync report on an affected Node with a non-ASCII temp path.
+  - 41 deliberate breaks of `lib/safe-remove.js` (each check, and the child's path, options, working directory, environment and answer), the switched call sites, the advisory and the selftest change were run against this probe, with the unchanged copy as the control (28/28): 40 made a case fail on Windows, each through a failed check (the probe ran to its end every time); the one that passes moves the child's working directory, which no longer matters since the child gets an absolute path. After the last change (each option read once) its four options mutants, one new, and the control (29/29) were run again on the final code: all four fail a case.
+  - Review: cross-model review (codex gpt-6.1-sol), four rounds. The first version removed a folder by walking it in JavaScript; round 1 found that a drive-relative `C:` removed names at the drive root (P1), that selftest chose the advisory's language after dropping LEERNESS_LANG (P2), and that a test forced the mode it should check (P2); round 2 that an empty path removed the working directory's contents (P1) and that a write guard checked every entry, so under `--dry-run` an exempt `*.lock` entry went before the next was refused (P1); round 3 that the guard saw the resolved spelling, so a trailing separator made a folder exempt (P1), and that entries vanishing during the walk and retries without a rescan differed from fs.rmSync (P2). After round 3 the owner chose to have fs.rmSync itself remove a full folder, in a child process. Round 4's first run was stopped by the review service before a report; its notes named three cases, which were fixed (a URL target's search part changed what the guard saw; options fs.rmSync rejects were not checked first; the child lost the per-drive current directory), and round 4 ran again; it found that the options were read with inherited and non-enumerable properties and sent to the child as a whole (P2, P2), which were fixed; the owner chose a short confirmation of that fix, which found that a getter ran twice (once in the options check, once in the copy; P2); by the owner's decision that was fixed, with a test that fails on the reviewed code, and shipped without another round.
+
 ## 1.36.304 - 2026-10-16
 
 - Fixed (tests): probes and e2e cases left their temp folders behind (T-0357). On 2026-10-14 this PC's temp directory held 8,434 `leerness-*` folders under 332 name prefixes; 5,142 of them came from e2e.js case sandboxes and 1,243 from the memory probes' arena (T-0354 fixed that one). The test runner now removes them: the test process records the folders it makes, and `scripts/ci-shard.js` removes them after the test ended with exit status 0.

package/README.md

@@ -195,7 +195,7 @@ MIT
 <!-- leerness:project-readme:start -->
 ## Leerness Project Harness
 
-이 프로젝트는 Leerness v1.36.304 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
+이 프로젝트는 Leerness v1.36.305 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
 
 ### 정체성 — AI 에이전트 운영 레이어 (UR-0030)
 
@@ -249,7 +249,7 @@ leerness memory restore decision <date|title>
 
 ### MCP server (외부 AI 통합)
 
-Leerness v1.36.304는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **102개 도구**를 노출:
+Leerness v1.36.305는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **102개 도구**를 노출:
 
 ```jsonc
 // 카테고리별
@@ -270,7 +270,7 @@ Leerness v1.36.304는 stdio JSON-RPC MCP server를 내장합니다 — Claude Co
 `<<autonomous-loop-dynamic>>` 신호만 보내면 AI가:
 1) 다음 라운드 후보 선정 → 2) 코드 변경 → 3) 회귀 테스트 갱신 → 4) 전체 e2e 스위트 통과 → 5) npm publish + git tag → 6) main push → 7) session close → 8) 다음 라운드 예약.
 
-현재 사용 중인 하네스 버전: **1.36.304**. 공개 릴리스 여부는 공개 저장소의 태그와 배포 기록에서 별도로 확인합니다.
+현재 사용 중인 하네스 버전: **1.36.305**. 공개 릴리스 여부는 공개 저장소의 태그와 배포 기록에서 별도로 확인합니다.
 
 ### 성능 가이드
 
@@ -308,7 +308,7 @@ leerness release pack --close --auto-main-push
 - `.leerness/session-handoff.md`: 다음 세션 인수인계 (자동 작성)
 - `.leerness/lessons.md` / `decisions.md` / `rules.md`: 영구 메모리 (5 surface)
 
-Last synced by Leerness v1.36.304: 2026-09-30
+Last synced by Leerness v1.36.305: 2026-09-30
 <!-- leerness:project-readme:end -->
 GitHub 로그인 계정 확인용 서버 어댑터: [설정·연결·승인과의 구분](docs/github-login.md). 실제 앱 등록/브라우저 세션 연결과 대상별 승인은 후속입니다.
 

package/bin/leerness.js

@@ -62,6 +62,7 @@ const path = require('path');
 const cp = require('child_process');
 const { log, ok, warn, fail, failJson, setQuiet, today, now, absRoot, exists, read, readBuf, mkdirp, writeUtf8, append, rel, setDryRunGuard, mkdirpRaw } = require('../lib/io');  // 1.9.382/383 (UR-0025): 출력/시간/파일 프리미티브 공유 모듈 · 1.10.2 (UR-0146): setQuiet
 const { resolveNpmCliPath, spawnNpmSync } = require('../lib/npm-process');
+const { removeSync: _removeSync, rmSyncPathBug: _rmSyncPathBug } = require('../lib/safe-remove');  // T-0365
 const { resolvePortableLaunch, spawnPortable, spawnPortableSync } = require('../lib/portable-process');
 const { scanShellScriptsEncoding, applyShellScriptUtf8Bom } = require('../lib/shell-encoding');
 const { captureMemoryInput, assertMemoryInputCurrent, captureCheckedFileInput, assertCheckedFileCurrent } = require('../lib/memory-input');
@@ -115,7 +116,7 @@ const {
   migrateLegacyWorkspace,
 } = require('../lib/workspace-dir');
 
-const VERSION = '1.36.304';
+const VERSION = '1.36.305';
 
 // MCP lifecycle 주소 표식은 현재 CLI 호출 한 번에만 유효하다. CLI bootstrap에서 즉시 env에서
 // 떼어 두어 `--no-record`/hook처럼 presence 기록 함수에 도달하지 않는 경로도 후속 child에 유출하지 않는다.
@@ -1375,7 +1376,7 @@ function _pruneArchives(root, keep = 10) {
   const withTime = names.map(name => { let t = 0; try { t = fs.statSync(path.join(adir, name)).mtimeMs; } catch {} return { name, t }; });
   withTime.sort((a, b) => b.t - a.t);  // 최신 우선 (이름의 버전 문자열은 zero-pad 안 돼 사전순 부정확 → mtime 사용)
   let pruned = 0;
-  for (const e of withTime.slice(keep)) { try { fs.rmSync(path.join(adir, e.name), { recursive: true, force: true }); pruned++; } catch {} }
+  for (const e of withTime.slice(keep)) { try { _removeSync(path.join(adir, e.name), { recursive: true, force: true }); pruned++; } catch {} }
   return pruned;
 }
 function createBackup(root, reason, files, dry = false) {
@@ -2494,10 +2495,10 @@ function skillRemove(root, id) {
   try { _SKILLS_LIST_CACHE.delete(absRoot(root)); } catch {}
   if (_skillCatalog()[id]) {
     // catalog 스킬은 로컬 메타만 제거 (카탈로그는 패키지 내장이라 영구 제거 불가)
-    fs.rmSync(dir, { recursive: true, force: true });
+    _removeSync(dir, { recursive: true, force: true });
     ok(`local meta removed for catalog skill: ${id} (catalog 자체는 패키지에 내장)`);
   } else {
-    fs.rmSync(dir, { recursive: true, force: true });
+    _removeSync(dir, { recursive: true, force: true });
     ok(`user skill removed: ${id}`);
   }
 }
@@ -3712,7 +3713,7 @@ function _collectRuntimeEnv(opts = {}) {
 function _collectRuntimeEnvBase() {
   const env = {
     os: { platform: os.platform(), release: os.release(), arch: os.arch() },
-    node: { version: process.version, exe: process.execPath },
+    node: { version: process.version, exe: process.execPath, rmSyncPathBug: _rmSyncPathBug() },
     locale: {
       LANG: process.env.LANG || null,
       LC_ALL: process.env.LC_ALL || null,
@@ -3853,6 +3854,14 @@ function _scanShellScriptsEncoding(root) {
   return scanShellScriptsEncoding(root, { classifyCJK: _classifyCJK, riskLabel: _riskLabel });
 }
 
+// T-0365: Windows Node versions whose failed fs.rmSync ends the process (lib/safe-remove.js). leerness removes its own
+//   files around it; the advisory is for the user, since other programs on the same Node are not.
+function _rmSyncAdvisory(lang, version = process.versions.node, platform = process.platform) {
+  if (!_rmSyncPathBug(version, platform)) return null;
+  return lang === 'en'
+    ? `Node ${version} on Windows: when fs.rmSync fails on a path with a character outside the system code page, the process ends without an error (fixed in Node 24.22.0 and 26.9.0). leerness removes files without it on this version. Update Node to 24.22.0 or later, or 26.9.0 or later.`
+    : `Windows 의 Node ${version}: 시스템 코드 페이지에 없는 문자가 든 경로에서 fs.rmSync 가 실패하면 프로세스가 오류 없이 종료됩니다(Node 24.22.0·26.9.0 에서 수정). 이 버전에서 leerness 는 fs.rmSync 를 쓰지 않고 삭제합니다. Node 를 24.22.0 이상 또는 26.9.0 이상으로 올리세요.`;
+}
 function envCmd(root, sub) {
   root = absRoot(root);
   const isTty = process.stdout && process.stdout.isTTY;
@@ -3914,6 +3923,7 @@ function envCmd(root, sub) {
   log('');
   log(`  💻 OS: ${gr(env.os.platform)} ${env.os.release} (${env.os.arch})`);
   log(`  📦 Node: ${gr(env.node.version)}`);
+  { const advisory = _rmSyncAdvisory(_uiLang(root)); if (advisory) log(yl(`  ⚠ ${advisory}`)); }
   log(`  🌐 Locale: LANG=${env.locale.LANG || 'unset'} · CP=${env.locale.codepage || 'unknown'}${env.locale.isKoreanWindows ? yl(' (한국어 Windows)') : ''}`);
   // 1.9.252 (UR-0018 마무리): 인라인 Windows/POSIX 인코딩 분기를 _terminalEncodingNotice() 헬퍼로 통합 (DRY).
   //   이전 (1.9.249/250) 에는 env summary / handoff / install 에 거의 동일한 분기가 중복 → 단일 소스로 일원화.
@@ -4216,6 +4226,11 @@ function _selfTestCases() {
     { name: '_isSecretKey: NPM_TOKEN 차단', run: () => _isSecretKey('NPM_TOKEN') === true },
     { name: '_isSecretKey: API_KEY/SECRET/PASSWORD 차단', run: () => _isSecretKey('OPENAI_API_KEY') && _isSecretKey('MY_SECRET') && _isSecretKey('db_PASSWORD') },
     { name: '_isSecretKey: 비시크릿 LEERNESS_* 통과', run: () => _isSecretKey('LEERNESS_ENABLE_AGY') === false && _isSecretKey('LANG') === false },
+    { name: 'T-0365: Windows fs.rmSync 경로 변환 버그 판정 (24.22.0·26.9.0 에서 수정) + 안내 문구', run: () => {
+      const bug = [['22.23.3', false], ['23.0.0', true], ['24.21.0', true], ['24.22.0', false], ['25.9.0', true], ['26.8.2', true], ['26.9.0', false], ['27.0.0', false]];
+      return bug.every(([v, want]) => _rmSyncPathBug(v, 'win32') === want && _rmSyncPathBug(v, 'linux') === false)
+        && _rmSyncAdvisory('en', '26.3.0', 'win32') !== null && _rmSyncAdvisory('en', '26.9.0', 'win32') === null && _rmSyncAdvisory('ko', '24.0.0', 'linux') === null;
+    } },
     { name: 'compareVer: 대소 비교', run: () => compareVer('1.9.258', '1.9.257') === 1 && compareVer('1.9.0', '1.10.0') === -1 && compareVer('2.0.0', '2.0.0') === 0 },
     { name: 'compareVer: 누락 파트/null 안전', run: () => compareVer('1.9', '1.9.0') === 0 && compareVer(null, '0.0.0') === 0 },
     { name: 'parseHarnessVersion: exact canonical/legacy formats only', run: () => parseHarnessVersion('1.9.0').base === '1.9.0' && parseHarnessVersion('leerness@1.8.0+plus@1.0.1').plus === '1.0.1' && parseHarnessVersion('leerness@1.8.0').base === '1.8.0' && parseHarnessVersion('garbage leerness@1.8.0 trailing').base === null && parseHarnessVersion('leerness@1.8.0.1').base === null && parseHarnessVersion('plus@1.0.1 junk').plus === null },
@@ -8086,15 +8101,35 @@ function _controlSelftestEnv() {
   return Object.assign(dropped, { restore });
 }
 function selfTestCmd(opts = {}) {
+  // T-0365: the advisory's language is read before LEERNESS_LANG and the other controlled variables are dropped
+  //   (1.36.305 review round 1: read after, English mode printed it in Korean).
+  const lang = _uiLang(process.cwd());
   const droppedEnv = _controlSelftestEnv();
-  try { return _selfTestCmdInner(opts, droppedEnv); } finally { droppedEnv.restore(); }
+  try { return _selfTestCmdInner(opts, droppedEnv, lang); } finally { droppedEnv.restore(); }
 }
-function _selfTestCmdInner(opts, droppedEnv) {
+function _selfTestCmdInner(opts, droppedEnv, lang) {
   const isTty = process.stdout && process.stdout.isTTY;
   const gr = s => isTty ? `\x1b[32m${s}\x1b[0m` : s;
   const rd = s => isTty ? `\x1b[31m${s}\x1b[0m` : s;
   const cy = s => isTty ? `\x1b[36m${s}\x1b[0m` : s;
   const dm = s => isTty ? `\x1b[2m${s}\x1b[0m` : s;
+  // The heading, the controlled-environment note and the advisory come before the cases run (several minutes on
+  //   Windows), in the same order as before.
+  if (!opts.json) {
+    log(cy(`# leerness selftest (1.9.258) — 코어 함수 무결성 검증 (v${VERSION})`));
+    log('');
+    // 무시한 설정은 반드시 보인다 — 사용자가 켜 둔 것이 안 먹었다는 사실을 숨기면 그 자체가 거짓 보고다(1.36.125).
+    if (droppedEnv.length) {
+      log(dm(`  ⓘ 측정 통제: 검증 중에만 ${droppedEnv.length}개 환경설정을 무시합니다 — ${droppedEnv.join(', ')}`));
+      //   ⚠ 1.36.129: 여기에 다른 가드의 **실패 표지 문자열**을 그대로 적어 두었더니, 그 가드가 이 안내를
+      //     실패로 읽었다(안내 문구가 곧 표면이다 — 같은 클래스를 이 저장소에서 세 번째로 만났다).
+      //     뜻은 유지하고 표지 문자열만 피한다.
+      log(dm(`     (이 설정들이 켜져 있으면 selftest 가 정상 설치를 실패로 거짓 보고했습니다 — 실제 제품 동작은 그대로입니다)`));
+      log('');
+    }
+    const advisory = _rmSyncAdvisory(lang);
+    if (advisory) { log(`  ⚠ ${advisory}`); log(''); }
+  }
   const cases = _selfTestCases();
   const results = cases.map(c => {
     let ok = false, err = null;
@@ -8108,17 +8143,6 @@ function _selfTestCmdInner(opts, droppedEnv) {
     if (fail > 0) process.exitCode = 1;
     return;
   }
-  log(cy(`# leerness selftest (1.9.258) — 코어 함수 무결성 검증 (v${VERSION})`));
-  log('');
-  // 무시한 설정은 반드시 보인다 — 사용자가 켜 둔 것이 안 먹었다는 사실을 숨기면 그 자체가 거짓 보고다(1.36.125).
-  if (droppedEnv.length) {
-    log(dm(`  ⓘ 측정 통제: 검증 중에만 ${droppedEnv.length}개 환경설정을 무시합니다 — ${droppedEnv.join(', ')}`));
-    //   ⚠ 1.36.129: 여기에 다른 가드의 **실패 표지 문자열**을 그대로 적어 두었더니, 그 가드가 이 안내를
-    //     실패로 읽었다(안내 문구가 곧 표면이다 — 같은 클래스를 이 저장소에서 세 번째로 만났다).
-    //     뜻은 유지하고 표지 문자열만 피한다.
-    log(dm(`     (이 설정들이 켜져 있으면 selftest 가 정상 설치를 실패로 거짓 보고했습니다 — 실제 제품 동작은 그대로입니다)`));
-    log('');
-  }
   results.forEach(r => {
     if (r.ok) log(`  ${gr('✓')} ${r.name}`);
     else log(`  ${rd('✗')} ${r.name}${r.err ? dm(' — ' + r.err) : ''}`);
@@ -25081,7 +25105,7 @@ function _cleanupNpmTempDir(tmpDir, sensitiveFile = null) {
         try { fs.chmodSync(sensitiveFile, 0o600); } catch {}
         fs.writeFileSync(sensitiveFile, '', { mode: 0o600 });
       }
-      fs.rmSync(tmpDir, { recursive: true, force: true });
+      _removeSync(tmpDir, { recursive: true, force: true });
       cleaned = !exists(tmpDir);
     } catch {}
   }
@@ -34174,6 +34198,8 @@ module.exports = {
   _shellFailuresPath, _loadShellFailures, _recordShellFailure: projectWriter(_recordShellFailure), _shellEnvDrift,
   // 1.36.287 (T-0304): 환경 수집의 프로세스당 1회·도구 조회 분리 — 자식 프로세스 수로 검증
   _collectRuntimeEnv,
+  // T-0365: the rmSync advisory and the npm temp cleanup, for scripts/safe-remove-probe.js
+  _rmSyncAdvisory, _cleanupNpmTempDir,
   // 1.9.265: CLI 에이전트 슬래시 명령어 레지스트리 (UR-0021 1단계) — 단위 테스트
   AGENT_SLASH_COMMANDS, _agentSlashFile, _loadAgentSlashCommands, _recordAgentSlashCommands, _agentSlashHint, slashCommandsCmd,
   _parseSlashFromHelp, _probeAgentSlash, _refreshAgentSlashCommands,

package/lib/claims-baseline.js

@@ -8,6 +8,7 @@
 
 const crypto = require('crypto');
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const path = require('path');
 const { absRoot, exists, read, mkdirp, writeUtf8 } = require('./io');
 const { _isDoneStatus } = require('./pure-utils');
@@ -163,7 +164,7 @@ function saveBaseline(root, doc, withLock) {
     writeUtf8(temp, JSON.stringify(doc, null, 2) + '\n');
     try { fs.renameSync(temp, file); }
     catch (error) {
-      try { fs.rmSync(temp, { force: true }); } catch {}
+      try { removeSync(temp, { force: true }); } catch {}
       throw error;
     }
   };

package/lib/io.js

@@ -11,6 +11,7 @@ const { errorLanguage } = require('./error-language');
 const _english = () => errorLanguage() === 'en';
 const _korean = () => errorLanguage() === 'ko';
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const path = require('path');
 const os = require('os');
 const cp = require('child_process');
@@ -597,7 +598,7 @@ function _rollbackCommittedHardLink(alias, live, expected, maxReadBytes) {
   try { fs.unlinkSync(live); }
   catch (error) { removalError = error; }
   if (_lstatState(live).exists === true) {
-    try { fs.rmSync(live, { force: true }); }
+    try { removeSync(live, { force: true }); }
     catch (error) { removalError = removalError || error; }
   }
   if (_lstatState(live).exists === true) {
@@ -606,7 +607,7 @@ function _rollbackCommittedHardLink(alias, live, expected, maxReadBytes) {
       fs.renameSync(live, quarantine);
       try { fs.unlinkSync(quarantine); }
       catch {
-        try { fs.rmSync(quarantine, { force: true }); } catch {}
+        try { removeSync(quarantine, { force: true }); } catch {}
       }
       const postRename = _lstatState(live);
       return postRename.exists === false
@@ -643,7 +644,7 @@ function detachCommittedHardLink(aliasPath, livePath, expectedBytes, opts = {})
     firstCleanupError = error;
     // Some transient/platform wrappers fail unlink but permit the equivalent
     // exact-path removal. This is only the random prepared alias, never user data.
-    try { fs.rmSync(alias, { force: true }); } catch {}
+    try { removeSync(alias, { force: true }); } catch {}
     if (fs.existsSync(alias)) {
       const detacher = `${alias}.detach-${process.pid}-${crypto.randomBytes(8).toString('hex')}`;
       let detacherExists = false;
@@ -655,7 +656,7 @@ function detachCommittedHardLink(aliasPath, livePath, expectedBytes, opts = {})
         fs.renameSync(detacher, alias);
         detacherExists = false;
       } catch (detachError) {
-        try { if (detacherExists) fs.rmSync(detacher, { force: true }); } catch {}
+        try { if (detacherExists) removeSync(detacher, { force: true }); } catch {}
         const expected = Buffer.isBuffer(expectedBytes) ? expectedBytes : null;
         const rollback = _rollbackCommittedHardLink(alias, live, expected, maxReadBytes);
         // Another actor may have detached the alias between our failed rename
@@ -677,7 +678,7 @@ function detachCommittedHardLink(aliasPath, livePath, expectedBytes, opts = {})
       }
       // The path now names an unrelated empty inode. Failure to remove this
       // cleanup artifact is non-fatal and cannot poison the committed file.
-      try { fs.rmSync(alias, { force: true }); } catch {}
+      try { removeSync(alias, { force: true }); } catch {}
     }
   }
   let stat;

package/lib/machine-cache.js

@@ -6,6 +6,7 @@
 // read or parse error as a miss. Writes are best-effort and must never fail the calling command.
 // It never lives inside a project, so project read-only contracts are unaffected.
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
@@ -70,7 +71,7 @@ function writeCache(name, key, value) {
     fs.renameSync(temp, file);
     return true;
   } catch {
-    try { fs.rmSync(temp, { force: true }); } catch {}
+    try { removeSync(temp, { force: true }); } catch {}
     return false;
   }
 }

package/lib/memory-output.js

@@ -9,6 +9,7 @@
 // cleanup also cannot retain writes that arrive later through an already-open
 // descriptor to the displaced inode; this boundary protects pathname races.
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const { readPublicationBytes } = require('./memory-publication-read');
 const path = require('path');
 const crypto = require('crypto');
@@ -210,7 +211,7 @@ function cleanupFile(file) {
 }
 function cleanupDir(dir) {
   if (!dir) return null;
-  try { if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true }); return null; }
+  try { if (fs.existsSync(dir)) removeSync(dir, { recursive: true }); return null; }
   catch (error) { return error; }
 }
 function markOutputError(error, details = {}) {

package/lib/migrate.js

@@ -6,6 +6,7 @@
 'use strict';
 const path = require('path');
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const os = require('os');
 const cp = require('child_process');
 const { absRoot, exists, read, log, ok, warn } = require('./io');
@@ -121,7 +122,7 @@ function migratePlanCmd(root, opts = {}, deps = {}) {
       for (const f of tmpFiles) if (!exists(path.join(root, f))) plan.missingFiles.push(f);
     }
   } catch {}
-  finally { if (tmp) { try { fs.rmSync(tmp, { recursive: true, force: true }); } catch {} } }
+  finally { if (tmp) { try { removeSync(tmp, { recursive: true, force: true }); } catch {} } }
   plan.willChange = plan.missingFiles.length + plan.canonicalPending.length + (plan.versionDrift ? 1 : 0);
   if (opts.json) { log(JSON.stringify(plan, null, 2)); return; }
   log(`# leerness migrate plan (1.9.358, UR-0075 Phase D) — 임시폴더 설치 후 비교 · 읽기 전용(프로젝트 미변경)`);

package/lib/preview-serve.js

@@ -7,6 +7,7 @@
 //   leerness 는 사용자의 dev 서버를 임의로 실행하지 않는다(사용자 코드 실행은 명시 옵트인 영역).
 'use strict';
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const http = require('http');
 const path = require('path');
 const { absRoot, exists, read, writeUtf8, mkdirp, log, ok, warn, failJson, now } = require('./io');
@@ -54,7 +55,7 @@ function cleanupServeDir(root, id) {
     const checked = _previewOutputPathCheck(root, dRel, { requireDirectory: exists(d) });
     // Never follow a swapped `.leerness/previews` or `.serve-*` link during
     // recursive cleanup. An unsafe path is left untouched for manual recovery.
-    if (checked.ok && exists(d)) { fs.rmSync(d, { recursive: true, force: true }); cleaned = true; }
+    if (checked.ok && exists(d)) { removeSync(d, { recursive: true, force: true }); cleaned = true; }
   } catch {}
   // (검수 #8) project 모드로 프로젝트 정적 디렉토리에 배치한 사본도 함께 정리 — "확인 끝나면 정리한다"는 안내와 실제를 일치시킨다.
   try {
@@ -66,7 +67,7 @@ function cleanupServeDir(root, id) {
         const abs = path.resolve(absRoot(root), placed);
         const rel = path.relative(absRoot(root), abs).replace(/\\/g, '/');
         const checked = _previewOutputPathCheck(root, rel, { requireFile: exists(abs) });
-        if (checked.ok && exists(abs)) { fs.rmSync(abs, { force: true }); cleaned = true; }
+        if (checked.ok && exists(abs)) { removeSync(abs, { force: true }); cleaned = true; }
         delete j.placed[id];
         writeUtf8(cfgF, JSON.stringify(j, null, 2) + '\n');
       }

package/lib/runtime-writes.js

@@ -3,6 +3,7 @@
 // 호환 릴리스의 관측 기반 쓰기 경계. 원자 fencing/activation 프로토콜이 아니다.
 // topology만 한 작업 동안 재사용하고 descriptor/indicator는 매 쓰기마다 다시 읽는다.
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const path = require('path');
 const os = require('os');
 const { fileURLToPath } = require('url');
@@ -20,6 +21,11 @@ const recoveryFs = {
   closeSync: fs.closeSync.bind(fs),
   chmodSync: typeof fs.chmodSync === 'function' ? fs.chmodSync.bind(fs) : null,
   rmSync: typeof fs.rmSync === 'function' ? fs.rmSync.bind(fs) : null,
+  // T-0365: what lib/safe-remove.js removeSync checks and removes a target with on a Windows Node whose fs.rmSync can end
+  //   the process (a full folder then goes to fs.rmSync in a child process).
+  lstatSync: fs.lstatSync.bind(fs),
+  unlinkSync: fs.unlinkSync.bind(fs),
+  rmdirSync: fs.rmdirSync.bind(fs),
 };
 let installed = false;
 
@@ -260,7 +266,7 @@ function writeExternalRecoveryBundle(root, files) {
     }
     return dir;
   } catch (error) {
-    try { if (recoveryFs.rmSync) recoveryFs.rmSync(dir, { recursive: true, force: true }); } catch {}
+    try { if (recoveryFs.rmSync) removeSync(dir, { recursive: true, force: true }, { fsImpl: recoveryFs }); } catch {}
     throw error;
   }
 }

package/lib/safe-remove.js

@@ -0,0 +1,132 @@
+'use strict';
+
+// T-0365: on Windows, Node 23.x, 24.0.0-24.21.x, 25.x and 26.0.0-26.8.x build the error of a fs.rmSync that fails (a
+//   file or folder another process holds) from std::filesystem::path::string() of the absolute path given, which
+//   converts with the ANSI code page. A character the code page has no mapping for ends the process (0xC0000409; no
+//   try/catch sees it), and any other non-ASCII path comes back garbled in error.path and error.message. Node fixed it
+//   in 24.22.0 and 26.9.0 (nodejs/node 37aeecc7b6, "fs: fix rmSync error messages for non-ASCII paths"); 22.x and older
+//   remove in JavaScript. Only that one path is converted, so an ASCII path is safe on every version.
+// removeSync is fs.rmSync with the same arguments except for a non-ASCII path on those versions. There a file or a link
+//   is unlinked (libuv reports its errors with the path as given), and a folder is removed by fs.rmSync itself in a
+//   child process, so a failure ends only the child. 1.36.305 review rounds 1-3 found, each time, another place where a
+//   removal walked in JavaScript differed from fs.rmSync (a drive-relative path, an empty path, a write guard seeing
+//   every entry, a trailing separator, entries that vanish, retries that do not rescan); the owner chose to have
+//   fs.rmSync itself do the removal.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+const crypto = require('crypto');
+const { fileURLToPath } = require('url');
+// fs.rmSync as it was when this module loaded (lib/io.js loads it before any write guard wraps fs), used only to have
+//   Node check a removal's options on a path that does not exist.
+const RM_UNGUARDED = fs.rmSync.bind(fs);
+
+function rmSyncPathBug(version = process.versions.node, platform = process.platform) {
+  if (platform !== 'win32') return false;
+  const [major, minor] = String(version).replace(/^v/, '').split('.').map(Number);
+  if (major === 23 || major === 25) return true;
+  if (major === 24) return minor < 22;
+  if (major === 26) return minor < 9;
+  return false;
+}
+
+const asPath = target => target instanceof URL ? fileURLToPath(target) : Buffer.isBuffer(target) ? target.toString() : target;
+// Whether fs.rmSync could end the process or garble its error for this target: the bug, and a character above U+007F
+//   in the absolute path Node converts (any ANSI code page holds ASCII).
+function needsIsolation(target, version, platform) {
+  if (!rmSyncPathBug(version, platform)) return false;
+  const p = asPath(target);
+  return typeof p === 'string' && /[^\x00-\x7f]/.test(path.resolve(p));
+}
+
+// The codes fs.rmSync retries when maxRetries is given.
+const RETRY_CODES = new Set(['EBUSY', 'EMFILE', 'ENFILE', 'ENOTEMPTY', 'EPERM']);
+const sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+function eisdir(target) {
+  return Object.assign(new Error(`Path is a directory: rm returned EISDIR (is a directory) ${target}`),
+    { name: 'SystemError', code: 'ERR_FS_EISDIR', errno: 21, syscall: 'rm', path: target });
+}
+
+// Node checks fs.rmSync's options before it touches the path (1.36.305 review round 4: the isolated removal unlinked a
+//   file or removed an empty folder with options fs.rmSync rejects). The same options on a path that does not exist:
+//   Node returns for a missing path before the error that ends the process, so this removes nothing and cannot crash.
+function checkOptions(options) {
+  const missing = path.join(os.tmpdir(), `leerness-rm-options-${process.pid}-${crypto.randomBytes(8).toString('hex')}`);
+  try { RM_UNGUARDED(missing, options); }
+  catch (error) { if (!(error && error.code === 'ENOENT')) throw error; }
+}
+
+// fs.rmSync(target, options) in a new Node process, from this working directory, without NODE_OPTIONS (a preload must
+//   not run there). It answers with one JSON line; a process that ended without one ended in fs.rmSync.
+const CHILD = "const fs=require('fs');let r;try{const j=JSON.parse(fs.readFileSync(0,'utf8'));fs.rmSync(j.target,j.options);r={ok:true};}"
+  + "catch(e){r={ok:false,code:e&&e.code,errno:e&&e.errno};}process.stdout.write(JSON.stringify(r));";
+function rmSyncInChild(target, options) {
+  const env = { ...process.env };
+  for (const k of Object.keys(env)) if (k.toUpperCase() === 'NODE_OPTIONS') delete env[k];
+  const r = cp.spawnSync(process.execPath, ['-e', CHILD], { input: JSON.stringify({ target, options: options || {} }), cwd: process.cwd(),
+    env, encoding: 'utf8', windowsHide: true, maxBuffer: 1 << 20 });
+  if (r.error) throw r.error;
+  let answer = null;
+  try { answer = JSON.parse(r.stdout); } catch {}
+  return { status: r.status, signal: r.signal, answer };
+}
+
+// fs.rmSync(target, options). fsImpl: the fs functions to use (lib/runtime-writes.js passes the ones it captured before
+//   installing its write guard); isolate: whether to isolate (the default: needsIsolation for this process); runChild:
+//   what removes a folder (tests pass their own).
+function removeSync(target, options, { fsImpl = fs, isolate = needsIsolation(target), runChild = rmSyncInChild } = {}) {
+  if (!isolate) return fsImpl.rmSync(target, options);
+  // Node reads the options once, as a copy of their own enumerable properties; so does this, and only the four values
+  //   it uses go anywhere, the child included (1.36.305 review round 4, second run: inherited or non-enumerable
+  //   properties were read, and the whole object went to the child as JSON, where a BigInt or a cycle threw and a
+  //   toJSON could change it). An object (not null, not an array) is copied once and the copy is checked and used, so
+  //   a getter runs once (confirmation round: checking the object as given and then copying it ran getters twice);
+  //   anything else is checked as given, which Node rejects before it reads a property.
+  const read = options !== null && typeof options === 'object' && !Array.isArray(options) ? { ...options } : options;
+  checkOptions(read);
+  const { recursive = false, force = false, maxRetries = 0, retryDelay = 100 } = { ...read };
+  const used = { recursive, force, maxRetries, retryDelay };
+  const step = (fn, settle = () => false) => {
+    for (let attempt = 0; ; attempt++) {
+      try { return fn(); }
+      catch (error) {
+        if (settle(error) || attempt >= maxRetries || !RETRY_CODES.has(error && error.code)) throw error;
+        sleep(retryDelay * (attempt + 1));
+      }
+    }
+  };
+  // As Node: the target as given is checked first (an empty path is ENOENT, not the working directory). The parent's
+  //   fs calls get the target exactly as given (a string, a Buffer or a URL), as fs.rmSync's one call does, so a write
+  //   guard (--dry-run, the runtime write boundary) sees the same value (1.36.305 review round 4: a URL's search part).
+  const given = asPath(target);
+  let st;
+  try { st = fsImpl.lstatSync(target); }
+  catch (error) { if (force && error && error.code === 'ENOENT') return; throw error; }
+  const gone = error => !!error && error.code === 'ENOENT';
+  // A file or a link (a symbolic link or, on Windows, a junction): one unlink.
+  if (!st.isDirectory()) {
+    try { return step(() => fsImpl.unlinkSync(target)); }
+    catch (error) { if (gone(error)) return; throw error; }
+  }
+  if (!recursive) throw eisdir(given);
+  // A folder: rmdir first, through fsImpl, so a guard decides before anything inside goes; an empty folder is removed
+  //   there. A full one (ENOTEMPTY or EEXIST) is removed by fs.rmSync in a child process, given the absolute path this
+  //   process resolved: Windows keeps each drive's current directory in environment entries ('=D:') that a copied
+  //   environment loses, so a drive-relative 'D:x' could name another folder in the child (review round 4).
+  const full = error => !!error && (error.code === 'ENOTEMPTY' || error.code === 'EEXIST');
+  try { return step(() => fsImpl.rmdirSync(target), full); }
+  catch (error) { if (gone(error)) return; if (!full(error)) throw error; }
+  const { status, signal, answer } = runChild(path.resolve(given), used);
+  if (answer && answer.ok) return;
+  if (answer) {
+    throw Object.assign(new Error(`${answer.code || 'EPERM'}: could not remove ${given}`),
+      { code: answer.code || 'EPERM', errno: answer.errno, syscall: 'rm', path: given });
+  }
+  throw Object.assign(new Error(`EPERM: could not remove ${given}: the process removing it ended (status ${status}${signal ? `, ${signal}` : ''}); `
+    + 'on this Node, fs.rmSync ends the process when a removal fails on a path with a character outside the system code page'),
+  { code: 'EPERM', syscall: 'rm', path: given, removalProcessEnded: true });
+}
+
+module.exports = { rmSyncPathBug, needsIsolation, removeSync, RETRY_CODES };

package/lib/test-node-runner.js

@@ -2,6 +2,7 @@
 
 const cp = require('node:child_process');
 const fs = require('node:fs');
+const { removeSync } = require('./safe-remove');
 const os = require('node:os');
 const path = require('node:path');
 const { pathToFileURL } = require('node:url');
@@ -199,7 +200,7 @@ async function verifyFixture() {
     // The last child test process can still be exiting. Windows then refuses the delete, and Node 26
     // rmSync does not retry EPERM even with maxRetries, so wait here, bounded.
     for (const deadline = Date.now() + 5000; ;) {
-      try { fs.rmSync(actual, { recursive: true, force: true }); break; }
+      try { removeSync(actual, { recursive: true, force: true }); break; }
       catch (error) {
         if (!['EBUSY', 'EMFILE', 'ENFILE', 'ENOTEMPTY', 'EPERM'].includes(error && error.code) || Date.now() >= deadline) throw error;
         await new Promise(resolve => setTimeout(resolve, 100));

package/lib/workspace-dir.js

@@ -4,6 +4,7 @@
 // migrated.  Keeping the policy in this domain module prevents another
 // read-one-directory/write-another split brain.
 const fs = require('fs');
+const { removeSync } = require('./safe-remove');
 const path = require('path');
 const crypto = require('crypto');
 
@@ -290,7 +291,7 @@ function _safeRemoveCanonicalDir(root, target) {
   if (resolvedTarget !== allowed || path.dirname(resolvedTarget) !== resolvedRoot || resolvedRoot === path.parse(resolvedRoot).root) {
     throw new WorkspaceDirectoryError('E_WORKSPACE_DIR_UNSAFE_REMOVE', `unsafe canonical rollback target: ${resolvedTarget}`);
   }
-  fs.rmSync(resolvedTarget, { recursive: true, force: true });
+  removeSync(resolvedTarget, { recursive: true, force: true });
 }
 
 function _rewriteLegacyReference(file) {
@@ -915,7 +916,7 @@ function _migrateLegacyWorkspace(root, opts = {}) {
         legacyRenamed = false;
       }
       for (const item of overwritten.reverse()) { _beat(); _copyFile(item.backup, item.dst); }
-      for (const file of created.reverse()) { _beat(); if (fs.existsSync(file)) fs.rmSync(file, { force: true }); }
+      for (const file of created.reverse()) { _beat(); if (fs.existsSync(file)) removeSync(file, { force: true }); }
       _beat();
       if (!canonicalExisted && fs.existsSync(state.canonical.abs)) _safeRemoveCanonicalDir(state.root, state.canonical.abs);
     } catch (rollbackError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.304",
+  "version": "1.36.305",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",
@@ -143,7 +143,7 @@
     "test:ledger-sync": "node ./scripts/execution-ledger-sync-probe.js",
     "test:state-lock": "node ./scripts/shared-state-lock-probe.js",
     "test:lock-heartbeat": "node ./scripts/lock-heartbeat-probe.js",
-    "test:temp-cleanup": "node ./scripts/temp-cleanup-probe.js && node ./scripts/copy-tree-probe.js",
+    "test:temp-cleanup": "node ./scripts/temp-cleanup-probe.js && node ./scripts/copy-tree-probe.js && node ./scripts/safe-remove-probe.js",
     "test:path-setup": "node ./scripts/path-setup-powershell-probe.js",
     "test:skill-archive": "node ./scripts/skill-archive-probe.js",
     "test:memory-arena-cleanup": "node ./scripts/memory-arena-cleanup-probe.js",

package/scripts/safe-remove-probe.js

@@ -0,0 +1,573 @@
+'use strict';
+require('./temp-cleanup').trackTemp(module); // T-0357: records this run's temp folders; the runner that started it removes them after a clean exit
+
+// T-0365: on Windows, Node 23.x, 24.0.0-24.21.x, 25.x and 26.0.0-26.8.x end the process (0xC0000409) when a fs.rmSync
+//   that fails (a file or folder another process holds) has a path with a character outside the ANSI code page, and
+//   garble error.path otherwise. lib/safe-remove.js removeSync isolates such a removal there (a file or link is
+//   unlinked; a full folder is removed by fs.rmSync in a child process) and is fs.rmSync everywhere else. The cases that
+//   end a process run in a child; on a Windows Node without the bug they still run but cannot tell the fix apart, and
+//   say so.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+const assert = require('assert');
+
+const PKG = path.resolve(__dirname, '..');
+const CLI = path.join(PKG, 'bin', 'leerness.js');
+const SAFE = path.join(PKG, 'lib', 'safe-remove.js');
+const isWin = process.platform === 'win32';
+// The probe's own copy of the bounds (rmcrash/bounds-out.txt), so it does not trust the module it tests.
+const [major, minor] = process.versions.node.split('.').map(Number);
+const bugHere = isWin && (major === 23 || major === 25 || (major === 24 && minor < 22) || (major === 26 && minor < 9));
+const CRASH = 3221226505; // 0xC0000409
+const EMOJI = String.fromCodePoint(0x1f600); // in no ANSI code page
+const HAN = String.fromCharCode(0xd55c, 0xae00); // in code page 949: no crash, a garbled error
+const arena = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'leerness-safe-remove-'));
+const sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const children = [];
+let passed = 0, failed = 0, seq = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`PASS ${name}`); }
+  catch (error) { failed++; console.error(`FAIL ${name}: ${error.stack}`); }
+}
+const safe = () => require(SAFE);
+const fresh = name => { const d = path.join(arena, `${++seq}-${name}`); fs.mkdirSync(d, { recursive: true }); return d; };
+// A child whose working directory is the folder holds it on Windows until it exits.
+function hold(dir, ms) {
+  const child = cp.spawn(process.execPath, ['-e', `setTimeout(() => {}, ${ms})`], { cwd: dir, stdio: 'ignore', windowsHide: true });
+  children.push(child);
+  sleep(300);
+  return child;
+}
+// A file another process opened without delete sharing cannot be unlinked on Windows until that process closes it.
+//   Returns once the lock is in place (opening the file fails), not after a guessed delay.
+function lockFile(file, ms) {
+  const exe = cp.spawnSync('pwsh', ['-NoProfile', '-Command', 'exit 0'], { stdio: 'ignore', windowsHide: true }).error ? 'powershell' : 'pwsh';
+  const ps = `$f=[System.IO.File]::Open('${file.replace(/'/g, "''")}','Open','Read','None'); Start-Sleep -Milliseconds ${ms}; $f.Close()`;
+  const child = cp.spawn(exe, ['-NoProfile', '-NonInteractive', '-Command', ps], { stdio: 'ignore', windowsHide: true });
+  children.push(child);
+  for (const deadline = Date.now() + 15000; Date.now() < deadline; sleep(100)) {
+    try { fs.closeSync(fs.openSync(file, 'r')); } catch (e) { if (e.code === 'EBUSY' || e.code === 'EPERM') return child; throw e; }
+  }
+  throw new Error('the file was not locked in time');
+}
+const runNode = (args, opts = {}) => cp.spawnSync(process.execPath, args, { encoding: 'utf8', timeout: 120000, ...opts });
+const note = () => { if (!bugHere) console.log(`  (Node ${process.version} on ${process.platform} has no rmSync bug: this case runs but cannot tell the fix apart)`); };
+const outcome = fn => { try { fn(); return 'ok'; } catch (e) { return e.code; } };
+
+try {
+  test('rmSyncPathBug: the versions with the bug, Windows only', () => {
+    const { rmSyncPathBug } = safe();
+    const table = [['22.23.3', false], ['23.0.0', true], ['23.11.1', true], ['24.0.0', true], ['24.21.0', true], ['24.21.9', true],
+      ['24.22.0', false], ['24.30.1', false], ['25.0.0', true], ['25.9.0', true], ['26.0.0', true], ['26.3.0', true], ['26.8.2', true],
+      ['26.9.0', false], ['26.12.0', false], ['27.0.0', false], ['20.20.0', false], ['18.20.4', false]];
+    for (const [v, want] of table) {
+      assert.strictEqual(rmSyncPathBug(v, 'win32'), want, `win32 ${v}`);
+      assert.strictEqual(rmSyncPathBug(v, 'linux'), false, `linux ${v}`);
+      assert.strictEqual(rmSyncPathBug(v, 'darwin'), false, `darwin ${v}`);
+    }
+    assert.strictEqual(rmSyncPathBug(), bugHere, 'the defaults read this process');
+  });
+
+  test('needsIsolation: only a non-ASCII absolute path on a Node with the bug (Node converts only that path)', () => {
+    const { needsIsolation } = safe();
+    const e = String.fromCharCode(0xe9);
+    assert.strictEqual(needsIsolation('C:\\Users\\ascii\\x', '26.3.0', 'win32'), false, 'an ASCII path is isolated');
+    assert.strictEqual(needsIsolation('C:\\Users\\Jos' + e + '\\x', '26.3.0', 'win32'), true);
+    const back = process.cwd();
+    process.chdir(fresh('cwd-' + e));
+    try { assert.strictEqual(needsIsolation('rel', '26.3.0', 'win32'), true, 'a relative path below a non-ASCII working directory'); }
+    finally { process.chdir(back); }
+    assert.strictEqual(needsIsolation('C:\\Users\\' + String.fromCharCode(0xd55c) + '\\x', '24.21.0', 'win32'), true, 'Hangul (its errors come back garbled)');
+    assert.strictEqual(needsIsolation('C:\\Users\\Jos' + e + '\\x', '26.9.0', 'win32'), false, 'a fixed Node is isolated');
+    assert.strictEqual(needsIsolation('/home/jos' + e + '/x', '26.3.0', 'linux'), false, 'Linux is isolated');
+    assert.strictEqual(needsIsolation('rel', '26.3.0', 'win32'), /[^\x00-\x7f]/.test(process.cwd()), 'a relative path is judged with the working directory');
+    assert.strictEqual(needsIsolation(Buffer.from('C:\\Jos' + e), '26.3.0', 'win32'), true, 'a Buffer path');
+  });
+
+  // 1.36.305 review round 1: the pass-through case forced the mode, so a wrong default passed.
+  test('without the isolate option the choice is needsIsolation: an ASCII path is one fs.rmSync call; a non-ASCII one is isolated only with the bug', () => {
+    const calls = [];
+    const spy = { rmSync: () => calls.push('rmSync'), lstatSync: () => { calls.push('lstatSync'); return { isDirectory: () => false }; }, unlinkSync: () => calls.push('unlinkSync') };
+    const base = isWin ? 'C:\\leerness-sr\\' : '/tmp/leerness-sr/';
+    safe().removeSync(base + 'ascii.txt', { force: true }, { fsImpl: spy });
+    assert.deepStrictEqual(calls, ['rmSync'], 'an ASCII path');
+    calls.length = 0;
+    safe().removeSync(base + 'Jos' + String.fromCharCode(0xe9) + '.txt', { force: true }, { fsImpl: spy });
+    assert.deepStrictEqual(calls, bugHere ? ['lstatSync', 'unlinkSync'] : ['rmSync'], 'a non-ASCII path');
+  });
+
+  test('removeSync where the bug is absent is fs.rmSync with the same arguments and nothing else', () => {
+    const calls = [];
+    const spy = new Proxy({}, { get: (_, name) => (...args) => { calls.push([name, ...args]); return name === 'rmSync' ? 'result' : undefined; } });
+    const opts = { recursive: true, force: true, maxRetries: 3 };
+    assert.strictEqual(safe().removeSync('x', opts, { fsImpl: spy, isolate: false }), 'result');
+    assert.deepStrictEqual(calls.map(c => c[0]), ['rmSync']);
+    assert.strictEqual(calls[0][1], 'x'); assert.strictEqual(calls[0][2], opts, 'the options object was not passed as it is');
+    calls.length = 0;
+    safe().removeSync('y', undefined, { fsImpl: spy, isolate: false });
+    assert.deepStrictEqual(calls, [['rmSync', 'y', undefined]]);
+  });
+
+  // 1.36.305 review rounds 1 and 3: a JavaScript walk of the folder differed from fs.rmSync (a drive-relative path,
+  //   entries that vanish, retries that do not rescan). A full folder now goes to fs.rmSync itself. Round 4: the child
+  //   gets the absolute path the parent resolved, since Windows keeps each drive's current directory in environment
+  //   entries ('=D:') that a copied environment loses, so 'D:rel' could name another folder there.
+  test('a full folder goes to the child as the absolute path this process resolved, with the four option values it uses', () => {
+    const got = [];
+    const fsImpl = { lstatSync: () => ({ isDirectory: () => true }), rmdirSync: () => { throw Object.assign(new Error('not empty'), { code: 'ENOTEMPTY' }); } };
+    const opts = { recursive: true, force: true, maxRetries: 4, retryDelay: 50 };
+    for (const target of [isWin ? process.cwd().slice(0, 2) : '.', isWin ? 'D:rel' : 'rel/x', 'rel' + path.sep + 'x', 'tail.lock' + path.sep]) {
+      got.length = 0;
+      safe().removeSync(target, opts, { fsImpl, isolate: true, runChild: (t, o) => { got.push([t, o]); return { status: 0, answer: { ok: true } }; } });
+      assert.strictEqual(got.length, 1, target);
+      assert.strictEqual(got[0][0], path.resolve(target), `the child did not get the absolute path for ${target}`);
+      assert.ok(path.isAbsolute(got[0][0]), got[0][0]);
+      assert.deepStrictEqual(got[0][1], { recursive: true, force: true, maxRetries: 4, retryDelay: 50 }, 'the options the child got');
+    }
+  });
+
+  // 1.36.305 review round 4: fs.rmSync rejects bad options before it removes anything; the isolated removal unlinked a
+  //   file or removed an empty folder first.
+  test('bad options are rejected before anything is removed, with the error fs.rmSync gives', () => {
+    const { removeSync } = safe();
+    for (const [name, opts] of [['recursive not a boolean', { recursive: 'yes' }], ['maxRetries out of range', { recursive: true, maxRetries: -1 }], ['retryDelay not a number', { force: true, retryDelay: 'x' }]]) {
+      const d = fresh('bad-options');
+      const file = path.join(d, 'f.txt'), empty = path.join(d, 'empty');
+      fs.writeFileSync(file, 'f'); fs.mkdirSync(empty);
+      for (const target of [file, empty]) {
+        const want = outcome(() => fs.rmSync(target, opts));
+        assert.ok(want !== 'ok', `control: fs.rmSync accepted ${name}`);
+        const got = outcome(() => removeSync(target, opts, { isolate: true }));
+        assert.strictEqual(got, want, `${name}: ${target}`);
+        assert.strictEqual(fs.existsSync(target), true, `${name}: removed ${target}`);
+      }
+    }
+  });
+
+  // 1.36.305 review round 4, second run: Node reads fs.rmSync's options as a copy of their own enumerable properties;
+  //   the isolated removal read inherited and non-enumerable ones too, and sent the object to the child as JSON (a BigInt
+  //   or a cycle threw, toJSON could change it). It now reads them as Node does and sends only the four it uses.
+  test('options are read as Node reads them: own enumerable properties only, and only those it uses go to the child', () => {
+    const { removeSync } = safe();
+    const inherited = Object.create({ recursive: true });
+    const hidden = Object.defineProperty({}, 'recursive', { value: true, enumerable: false });
+    for (const [name, opts] of [['inherited recursive', inherited], ['non-enumerable recursive', hidden]]) {
+      const d = fresh('options-read');
+      const a = path.join(d, 'a'), b = path.join(d, 'b');
+      fs.mkdirSync(a); fs.mkdirSync(b);
+      const want = outcome(() => fs.rmSync(a, opts));
+      assert.strictEqual(want, 'ERR_FS_EISDIR', `control: fs.rmSync with ${name}`);
+      assert.strictEqual(outcome(() => removeSync(b, opts, { isolate: true })), want, name);
+      assert.strictEqual(fs.existsSync(b), true, `${name}: removed`);
+    }
+    const cycle = { recursive: true, force: true }; cycle.self = cycle;
+    for (const [name, opts] of [['a BigInt extra', { recursive: true, force: true, extra: 1n }], ['a cycle', cycle],
+      ['toJSON', { recursive: true, force: true, toJSON: () => ({ recursive: false }) }]]) {
+      const d = fresh('options-child-' + HAN);
+      const make = n => { const t = path.join(d, n); fs.mkdirSync(path.join(t, 's'), { recursive: true }); fs.writeFileSync(path.join(t, 's', 'f'), 'f'); return t; };
+      const a = make('a'), b = make('b');
+      assert.strictEqual(outcome(() => fs.rmSync(a, opts)), 'ok', `control: fs.rmSync with ${name}`);
+      assert.strictEqual(outcome(() => removeSync(b, opts, { isolate: true })), 'ok', name);
+      assert.strictEqual(fs.existsSync(b), false, `${name}: not removed`);
+    }
+    assert.strictEqual(outcome(() => fs.rmSync(path.join(arena, 'nope'), null)), outcome(() => removeSync(path.join(arena, 'nope'), null, { isolate: true })), 'null options');
+  });
+
+  // 1.36.305 confirmation round: Node reads each option once (its copy); checking the options as given and then copying
+  //   them read a getter twice, so a getter that changes between reads got another outcome than fs.rmSync's.
+  test('each option is read once, as by fs.rmSync (getters included)', () => {
+    const { removeSync } = safe();
+    for (const [name, make, build] of [
+      ['a getter that fails on its second read', reads => ({ recursive: true, get extra() { if (++reads.n === 2) throw new Error('read twice'); return 1; } }), d => { const t = path.join(d, 'empty'); fs.mkdirSync(t); return t; }],
+      ['a recursive getter true only on its first read', reads => ({ get recursive() { return ++reads.n === 1; } }), d => { const t = path.join(d, 'full'); fs.mkdirSync(path.join(t, 's'), { recursive: true }); fs.writeFileSync(path.join(t, 's', 'f'), 'f'); return t; }],
+    ]) {
+      const d = fresh('getters-' + HAN);
+      const a = build(fs.mkdtempSync(path.join(d, 'a-'))), b = build(fs.mkdtempSync(path.join(d, 'b-')));
+      const ra = { n: 0 }, rb = { n: 0 };
+      const want = outcome(() => fs.rmSync(a, make(ra)));
+      const got = outcome(() => removeSync(b, make(rb), { isolate: true }));
+      assert.strictEqual(got, want, name);
+      assert.strictEqual(fs.existsSync(b), fs.existsSync(a), `${name}: what is left differs`);
+      assert.strictEqual(rb.n, ra.n, `${name}: read ${rb.n} times, fs.rmSync ${ra.n}`);
+    }
+    const arr = Object.assign([], { recursive: true });
+    assert.strictEqual(outcome(() => removeSync(path.join(arena, 'nope'), arr, { isolate: true })), outcome(() => fs.rmSync(path.join(arena, 'nope'), arr)), 'an array as options');
+  });
+
+  // 1.36.305 review round 4: the guard saw the path string where fs.rmSync's guard sees the URL it was given; a search
+  //   part ('?x') makes String(url) end in something other than '.lock', so --dry-run refuses fs.rmSync(url), while the
+  //   path the URL names ends in '.lock' and was exempt.
+  test('a write guard sees a URL target as it sees it for fs.rmSync', () => {
+    const io = require(path.join(PKG, 'lib', 'io.js'));
+    const { pathToFileURL } = require('url');
+    const d = fresh('dry-run-url');
+    const make = name => { const t = path.join(d, name); fs.mkdirSync(t); fs.writeFileSync(path.join(t, 'SKILL.md'), 's'); const u = pathToFileURL(t); u.search = '?x'; return [t, u]; };
+    const [isolatedPath, isolated] = make('isolated.lock'), [, control] = make('control.lock');
+    io.setDryRunGuard(true);
+    try {
+      assert.throws(() => fs.rmSync(control, { recursive: true, force: true }), e => e.code === 'E_DRY_RUN_WRITE', 'control: fs.rmSync is refused');
+      assert.throws(() => safe().removeSync(isolated, { recursive: true, force: true }, { isolate: true }), e => e.code === 'E_DRY_RUN_WRITE');
+    } finally { io.setDryRunGuard(false); }
+    assert.strictEqual(fs.existsSync(path.join(isolatedPath, 'SKILL.md')), true, 'removed under --dry-run');
+  });
+
+  test('the child runs without NODE_OPTIONS (a preload of this process does not run there)', () => {
+    const d = fresh('node-options');
+    const marker = path.join(d, 'preload-ran.txt'), preload = path.join(d, 'preload.js');
+    fs.writeFileSync(preload, `require('fs').writeFileSync(${JSON.stringify(marker)}, 'ran');\n`);
+    const t = path.join(d, 'full'); fs.mkdirSync(path.join(t, 's'), { recursive: true }); fs.writeFileSync(path.join(t, 's', 'f'), 'f');
+    const saved = process.env.NODE_OPTIONS;
+    process.env.NODE_OPTIONS = `--require ${JSON.stringify(preload)}`;
+    try { safe().removeSync(t, { recursive: true }, { isolate: true }); }
+    finally { if (saved === undefined) delete process.env.NODE_OPTIONS; else process.env.NODE_OPTIONS = saved; }
+    assert.strictEqual(fs.existsSync(t), false);
+    assert.strictEqual(fs.existsSync(marker), false, 'the preload ran in the child');
+  });
+
+  test('the child removes a relative path from this working directory', () => {
+    const back = process.cwd();
+    const sandbox = fresh('relative-' + HAN);
+    fs.mkdirSync(path.join(sandbox, 'sub', 'deeper'), { recursive: true });
+    fs.writeFileSync(path.join(sandbox, 'sub', 'deeper', 'x.txt'), 'x');
+    fs.writeFileSync(path.join(sandbox, 'sentinel.txt'), 's');
+    process.chdir(sandbox);
+    try { safe().removeSync('sub', { recursive: true }, { isolate: true }); }
+    finally { process.chdir(back); }
+    assert.strictEqual(fs.existsSync(path.join(sandbox, 'sub')), false);
+    assert.strictEqual(fs.readFileSync(path.join(sandbox, 'sentinel.txt'), 'utf8'), 's');
+  });
+
+  // 1.36.305 review round 2: an empty path resolved to the working directory, whose contents were removed; Node checks
+  //   the path as given (lstat ''), so fs.rmSync('') is ENOENT and removes nothing.
+  test('an empty path removes nothing, as fs.rmSync (not the working directory)', () => {
+    const { removeSync } = safe();
+    const back = process.cwd();
+    const sandbox = fresh('empty-path');
+    fs.writeFileSync(path.join(sandbox, 'sentinel.txt'), 's');
+    process.chdir(sandbox);
+    try {
+      for (const [target, opts] of [['', { recursive: true }], ['', { recursive: true, force: true }], [Buffer.alloc(0), { recursive: true, force: true }]]) {
+        const want = outcome(() => fs.rmSync(target, opts));
+        const got = outcome(() => removeSync(target, opts, { isolate: true }));
+        assert.strictEqual(got, want, `${JSON.stringify(String(target))} ${JSON.stringify(opts)}`);
+        assert.strictEqual(fs.readFileSync(path.join(sandbox, 'sentinel.txt'), 'utf8'), 's', 'the working directory lost a file');
+      }
+    } finally { process.chdir(back); }
+  });
+
+  // 1.36.305 review rounds 2 and 3: a write guard (--dry-run, the runtime write boundary) checks the path each fs call
+  //   is given. fs.rmSync is one call on the target as given; the isolated removal's first change is on the target as
+  //   given, through the guarded fs, and the rest happens where no guard runs (fs.rmSync in the child), as inside
+  //   fs.rmSync.
+  test('a write guard sees an isolated removal as it sees fs.rmSync: refused at the target, nothing inside removed', () => {
+    const io = require(path.join(PKG, 'lib', 'io.js'));
+    const t = path.join(fresh('dry-run'), 'skill');
+    fs.mkdirSync(t);
+    fs.writeFileSync(path.join(t, 'Pipfile.lock'), 'l');
+    fs.writeFileSync(path.join(t, 'SKILL.md'), 's');
+    const before = fs.readdirSync(t).sort();
+    io.setDryRunGuard(true);
+    try {
+      assert.throws(() => safe().removeSync(t, { recursive: true, force: true }, { isolate: true }), e => e.code === 'E_DRY_RUN_WRITE');
+      assert.throws(() => fs.rmSync(t, { recursive: true, force: true }), e => e.code === 'E_DRY_RUN_WRITE', 'control: fs.rmSync is refused too');
+    } finally { io.setDryRunGuard(false); }
+    assert.deepStrictEqual(fs.readdirSync(t).sort(), before, 'an entry was removed under --dry-run');
+  });
+
+  test('a write guard that allows the target lets an isolated removal remove what is inside, as fs.rmSync', () => {
+    const io = require(path.join(PKG, 'lib', 'io.js'));
+    const d = fresh('dry-run-lock');
+    const make = name => { const t = path.join(d, name); fs.mkdirSync(path.join(t, 'sub'), { recursive: true }); fs.writeFileSync(path.join(t, 'owner.json'), '{}'); fs.writeFileSync(path.join(t, 'sub', 'x.txt'), 'x'); return t; };
+    const isolated = make('isolated.lock'), control = make('control.lock');
+    io.setDryRunGuard(true);
+    let controlCode = null;
+    try {
+      // Where fs.rmSync is written in JavaScript (Node 22 and older, as on CI's Node 20 jobs) it removes the entries
+      //   through fs's own functions, which the guard wraps, so there it refuses inside. The removal is isolated only on
+      //   Node versions whose fs.rmSync is native and asks the guard once; the comparison applies where the control
+      //   shows that (1.36.305 CI: this case failed on Node 20 when it assumed it).
+      try { fs.rmSync(control, { recursive: true, force: true }); } catch (e) { controlCode = e.code; }
+      if (controlCode === null) safe().removeSync(isolated, { recursive: true, force: true }, { isolate: true });
+    } finally { io.setDryRunGuard(false); }
+    if (controlCode !== null) {
+      assert.strictEqual(controlCode, 'E_DRY_RUN_WRITE', 'control: fs.rmSync failed for another reason');
+      console.log(`  skipped: fs.rmSync on Node ${process.version} asks the guard for each entry (the removal is not isolated on such a Node)`);
+      return;
+    }
+    assert.strictEqual(fs.existsSync(control), false, 'control: fs.rmSync removed the exempt folder');
+    assert.strictEqual(fs.existsSync(isolated), false, 'the isolated removal did not remove what fs.rmSync removes');
+  });
+
+  // 1.36.305 review round 3: the guard saw the resolved path; for 'x.lock\' that is 'x.lock', which --dry-run exempts,
+  //   where fs.rmSync('x.lock\') is refused (the spelling given does not end in '.lock').
+  test('a write guard sees the target spelled as given (a trailing separator)', () => {
+    const io = require(path.join(PKG, 'lib', 'io.js'));
+    const d = fresh('dry-run-tail');
+    const make = name => { const t = path.join(d, name); fs.mkdirSync(t); fs.writeFileSync(path.join(t, 'SKILL.md'), 's'); return t + path.sep; };
+    const isolated = make('isolated.lock'), control = make('control.lock');
+    io.setDryRunGuard(true);
+    try {
+      assert.throws(() => fs.rmSync(control, { recursive: true, force: true }), e => e.code === 'E_DRY_RUN_WRITE', 'control: fs.rmSync is refused');
+      assert.throws(() => safe().removeSync(isolated, { recursive: true, force: true }, { isolate: true }), e => e.code === 'E_DRY_RUN_WRITE');
+    } finally { io.setDryRunGuard(false); }
+    assert.strictEqual(fs.existsSync(path.join(isolated, 'SKILL.md')), true, 'removed under --dry-run');
+  });
+
+  test('isolated removal: a nested tree with a read-only file and non-ASCII names is removed', () => {
+    const root = fresh('tree');
+    const t = path.join(root, 'tree-' + HAN + EMOJI);
+    fs.mkdirSync(path.join(t, 'a', 'b', 'c'), { recursive: true });
+    fs.writeFileSync(path.join(t, 'a', 'one.txt'), '1');
+    fs.writeFileSync(path.join(t, 'a', 'b', 'c', 'two.txt'), '2');
+    fs.writeFileSync(path.join(t, 'ro.txt'), 'r'); fs.chmodSync(path.join(t, 'ro.txt'), 0o444);
+    safe().removeSync(t, { recursive: true, force: true }, { isolate: true });
+    assert.strictEqual(fs.existsSync(t), false);
+    assert.deepStrictEqual(fs.readdirSync(root), []);
+  });
+
+  test('isolated removal: a link inside is removed as a link, and its target keeps its contents', () => {
+    const root = fresh('links');
+    const target = path.join(root, 'target'); fs.mkdirSync(target); fs.writeFileSync(path.join(target, 'sentinel.txt'), 's');
+    const tfile = path.join(root, 'tfile.txt'); fs.writeFileSync(tfile, 't');
+    const t = path.join(root, 'tree'); fs.mkdirSync(t);
+    const made = [];
+    try { fs.symlinkSync(target, path.join(t, 'junction'), 'junction'); made.push('junction'); } catch (e) { if (isWin) throw e; }
+    try { fs.symlinkSync(target, path.join(t, 'dirlink'), 'dir'); made.push('dir symlink'); } catch (e) { if (!isWin) throw e; }
+    try { fs.symlinkSync(tfile, path.join(t, 'filelink'), 'file'); made.push('file symlink'); } catch (e) { if (!isWin) throw e; }
+    assert.ok(made.length > 0, 'no link could be made');
+    console.log(`  links made here: ${made.join(', ')}`);
+    safe().removeSync(t, { recursive: true, force: true }, { isolate: true });
+    assert.strictEqual(fs.existsSync(t), false);
+    assert.strictEqual(fs.readFileSync(path.join(target, 'sentinel.txt'), 'utf8'), 's', 'the removal went into a link');
+    assert.strictEqual(fs.readFileSync(tfile, 'utf8'), 't', 'a file link target was removed');
+  });
+
+  test('isolated removal: a target that is itself a link is removed as a link', () => {
+    const root = fresh('link-target');
+    const target = path.join(root, 'target'); fs.mkdirSync(target); fs.writeFileSync(path.join(target, 'sentinel.txt'), 's');
+    const link = path.join(root, 'link');
+    fs.symlinkSync(target, link, isWin ? 'junction' : 'dir');
+    safe().removeSync(link, { recursive: true, force: true }, { isolate: true });
+    assert.throws(() => fs.lstatSync(link), e => e.code === 'ENOENT');
+    assert.strictEqual(fs.readFileSync(path.join(target, 'sentinel.txt'), 'utf8'), 's');
+  });
+
+  test('isolated removal: force and recursive work as in fs.rmSync (same codes on the same inputs)', () => {
+    const { removeSync } = safe();
+    const full = fn => { try { fn(); return 'ok'; } catch (e) { return `${e.code}|${e.syscall}|${e.errno}|${e.path}`; } };
+    for (const [name, setup, opts] of [
+      ['missing, force', d => path.join(d, 'nope'), { force: true }],
+      ['missing, no force', d => path.join(d, 'nope'), {}],
+      ['missing, recursive', d => path.join(d, 'nope'), { recursive: true }],
+      ['directory, no recursive', d => { const x = path.join(d, 'dir'); fs.mkdirSync(x); fs.writeFileSync(path.join(x, 'f'), 'f'); return x; }, { force: true }],
+      ['file, recursive', d => { const x = path.join(d, 'file'); fs.writeFileSync(x, 'f'); return x; }, { recursive: true }],
+      ['file, no options', d => { const x = path.join(d, 'file'); fs.writeFileSync(x, 'f'); return x; }, undefined],
+      ['empty directory, recursive', d => { const x = path.join(d, 'empty'); fs.mkdirSync(x); return x; }, { recursive: true }],
+      ['full directory, recursive', d => { const x = path.join(d, 'full'); fs.mkdirSync(path.join(x, 's'), { recursive: true }); fs.writeFileSync(path.join(x, 's', 'f'), 'f'); return x; }, { recursive: true }],
+    ]) {
+      const a = fresh('parity-a'), b = fresh('parity-b');
+      const pa = setup(a), pb = setup(b);
+      const want = full(() => fs.rmSync(pa, opts)).split(a).join('<d>');
+      const got = full(() => removeSync(pb, opts, { isolate: true })).split(b).join('<d>');
+      assert.strictEqual(got, want, name);
+      assert.strictEqual(fs.existsSync(pb), fs.existsSync(pa), `${name}: what is left differs`);
+    }
+    const d = fresh('eisdir'); const x = path.join(d, 'dir'); fs.mkdirSync(x);
+    assert.throws(() => removeSync(x, {}, { isolate: true }), e => e.code === 'ERR_FS_EISDIR' && e.path === x && /is a directory/.test(e.message));
+  });
+
+  // (The options check calls fs.rmSync on a path that does not exist, through the copy captured at load, not fsImpl.)
+  test('in this process, an isolated removal never calls fs.rmSync on the target', () => {
+    const d = fresh('no-rmsync'); fs.mkdirSync(path.join(d, 't', 'sub'), { recursive: true }); fs.writeFileSync(path.join(d, 't', 'sub', 'f'), 'f');
+    fs.writeFileSync(path.join(d, 'file.txt'), 'f');
+    const fsImpl = new Proxy(fs, { get: (target, name) => name === 'rmSync' ? () => { throw new Error('rmSync was called'); } : target[name] });
+    safe().removeSync(path.join(d, 't'), { recursive: true, force: true }, { fsImpl, isolate: true });
+    safe().removeSync(path.join(d, 'file.txt'), { force: true }, { fsImpl, isolate: true });
+    assert.deepStrictEqual(fs.readdirSync(d), []);
+  });
+
+  test('isolated removal: a failure reports its code and the target as given; a removal process that ended is an error', () => {
+    const d = fresh('fail-path-' + HAN);
+    const t = path.join(d, 't'), sub = path.join(t, 'sub');
+    fs.mkdirSync(sub, { recursive: true });
+    if (isWin) {
+      // Whether fs.rmSync ends the child here depends on the whole path (this arena may sit below a temp directory
+      //   whose name the code page cannot hold); either way the error names the target as given.
+      const child = hold(sub, 6000);
+      try {
+        assert.throws(() => safe().removeSync(t, { recursive: true, force: true }, { isolate: true }),
+          e => ['EBUSY', 'EPERM'].includes(e.code) && e.path === t);
+      } finally { child.kill(); }
+      // A held file as the target fails at unlink, with its path.
+      const locked = path.join(d, 'locked.txt');
+      fs.writeFileSync(locked, 'x');
+      const locker = lockFile(locked, 4000);
+      try {
+        assert.throws(() => safe().removeSync(locked, { force: true }, { isolate: true }), e => ['EBUSY', 'EPERM'].includes(e.code) && e.path === locked);
+      } finally { locker.kill(); }
+      if (bugHere) {
+        // Outside the code page fs.rmSync ends its process: here only the child's.
+        const t3 = path.join(fresh('ended-' + EMOJI), 't'), sub3 = path.join(t3, 'sub');
+        fs.mkdirSync(sub3, { recursive: true });
+        const child3 = hold(sub3, 6000);
+        try {
+          assert.throws(() => safe().removeSync(t3, { recursive: true, force: true }, { isolate: true }),
+            e => e.code === 'EPERM' && e.path === t3 && e.removalProcessEnded === true && /EPERM/.test(e.message));
+        } finally { child3.kill(); }
+      } else note();
+    } else {
+      if (process.getuid && process.getuid() === 0) { console.log('  skipped: running as root, permissions do not fail'); return; }
+      fs.writeFileSync(path.join(sub, 'f'), 'f'); fs.chmodSync(sub, 0o555);
+      try {
+        assert.throws(() => safe().removeSync(t, { recursive: true, force: true }, { isolate: true }),
+          e => ['EACCES', 'EPERM'].includes(e.code) && e.path === t);
+      } finally { fs.chmodSync(sub, 0o755); }
+    }
+  });
+
+  test('isolated removal of a file: maxRetries waits out a hold that ends, and without it the hold fails at once', () => {
+    if (!isWin) { console.log('  skipped: a held file does not block removal here'); return; }
+    const { removeSync } = safe();
+    const a = path.join(fresh('retry'), 'a.txt'); fs.writeFileSync(a, 'a');
+    const lockA = lockFile(a, 800);
+    removeSync(a, { force: true, maxRetries: 20, retryDelay: 100 }, { isolate: true });
+    assert.strictEqual(fs.existsSync(a), false);
+    lockA.kill();
+    const b = path.join(fresh('no-retry'), 'b.txt'); fs.writeFileSync(b, 'b');
+    const lockB = lockFile(b, 4000);
+    try { assert.throws(() => removeSync(b, { force: true }, { isolate: true }), e => ['EBUSY', 'EPERM'].includes(e.code)); }
+    finally { lockB.kill(); }
+  });
+
+  test('the removal sites use removeSync: lib, the three bin commands, the recovery cleanup and removeTree', () => {
+    for (const f of fs.readdirSync(path.join(PKG, 'lib')).filter(n => n.endsWith('.js') && n !== 'safe-remove.js')) {
+      const src = fs.readFileSync(path.join(PKG, 'lib', f), 'utf8');
+      const calls = src.split('\n').filter(l => /\.rmSync\(/.test(l));
+      assert.deepStrictEqual(calls, [], `lib/${f} still calls rmSync`);
+    }
+    const bin = fs.readFileSync(CLI, 'utf8');
+    for (const fn of ['skillRemove', '_pruneArchives', '_cleanupNpmTempDir']) {
+      const start = bin.indexOf(`function ${fn}(`);
+      assert.ok(start >= 0, fn);
+      const body = bin.slice(start, bin.indexOf('\nfunction ', start + 10));
+      assert.ok(!/fs\.rmSync\(/.test(body) && /_removeSync\(/.test(body), `${fn} does not use _removeSync`);
+    }
+    const rw = fs.readFileSync(path.join(PKG, 'lib', 'runtime-writes.js'), 'utf8');
+    for (const name of ['lstatSync', 'unlinkSync', 'rmdirSync']) assert.ok(new RegExp(`\\n  ${name}: fs\\.${name}\\.bind\\(fs\\),`).test(rw), `recoveryFs does not capture ${name}`);
+    assert.ok(/removeSync\(dir, \{ recursive: true, force: true \}, \{ fsImpl: recoveryFs \}\)/.test(rw), 'the recovery cleanup does not pass the captured primitives');
+    const tc = fs.readFileSync(path.join(__dirname, 'temp-cleanup.js'), 'utf8');
+    const body = tc.slice(tc.indexOf('function removeTree('), tc.indexOf('\nfunction ownTree('));
+    assert.ok(!/fs\.rmSync\(/.test(body) && /removeSync\(/.test(body), 'removeTree does not use removeSync');
+  });
+
+  if (isWin) {
+    test('leerness skill remove with a held folder under a path with an emoji ends with an error, not a crash', () => {
+      note();
+      const proj = path.join(fresh('skill-' + EMOJI), 'proj');
+      fs.mkdirSync(proj);
+      const init = runNode([CLI, 'init', proj], { cwd: proj });
+      assert.strictEqual(init.status, 0, init.stdout + init.stderr);
+      const skill = path.join(proj, '.leerness', 'skills', 'held-skill');
+      fs.mkdirSync(path.join(skill, 'sub'), { recursive: true });
+      fs.writeFileSync(path.join(skill, 'SKILL.md'), '# held\n');
+      const child = hold(path.join(skill, 'sub'), 6000);
+      let r;
+      try { r = runNode([CLI, 'skill', 'remove', 'held-skill', '--path', proj], { cwd: proj }); }
+      finally { child.kill(); }
+      assert.notStrictEqual(r.status, CRASH, 'the process was ended (0xC0000409)');
+      assert.strictEqual(r.signal, null);
+      assert.ok(r.status === 0 || r.status === 1, `exit ${r.status}: ${r.stdout}${r.stderr}`);
+      if (r.status === 1) assert.ok(/EBUSY|EPERM/.test(r.stdout + r.stderr), r.stdout + r.stderr);
+    });
+
+    test('_cleanupNpmTempDir reports a held temp folder under an emoji path as not cleaned, not a crash', () => {
+      note();
+      const tmp = path.join(fresh('npm-' + EMOJI), 'leerness-npm-lifecycle-x');
+      fs.mkdirSync(path.join(tmp, 'sub'), { recursive: true });
+      fs.writeFileSync(path.join(tmp, '.npmrc'), 'token-shaped-but-fake');
+      const child = hold(path.join(tmp, 'sub'), 6000);
+      let r;
+      try {
+        r = runNode(['-e', `const L = require(${JSON.stringify(CLI)}); const ok = L._cleanupNpmTempDir(${JSON.stringify(tmp)}, ${JSON.stringify(path.join(tmp, '.npmrc'))}); console.log('CLEANED ' + ok);`]);
+      } finally { child.kill(); }
+      assert.notStrictEqual(r.status, CRASH, 'the process was ended (0xC0000409)');
+      assert.strictEqual(r.status, 0, r.stdout + r.stderr);
+      assert.ok(/CLEANED false/.test(r.stdout), r.stdout);
+      // fs.rmSync in the child may remove some entries before the held folder fails it; the credential file is emptied
+      //   first, so it is gone or empty.
+      const npmrc = path.join(tmp, '.npmrc');
+      assert.ok(!fs.existsSync(npmrc) || fs.readFileSync(npmrc, 'utf8') === '', 'the credential file is left with its contents');
+    });
+
+    test('scripts/temp-cleanup.js removeTree on a held tree under an emoji path fails with the code, not a crash, and waits a short hold out', () => {
+      note();
+      const t = path.join(fresh('tree-' + EMOJI), 't');
+      fs.mkdirSync(path.join(t, 'sub'), { recursive: true });
+      const child = hold(path.join(t, 'sub'), 6000);
+      let r;
+      try {
+        r = runNode(['-e', `const T = require(${JSON.stringify(path.join(__dirname, 'temp-cleanup.js'))}); try { T.removeTree(${JSON.stringify(t)}, { recursive: true, force: true }, { timeoutMs: 400 }); console.log('REMOVED'); } catch (e) { console.log('CODE ' + e.code); }`]);
+      } finally { child.kill(); }
+      assert.notStrictEqual(r.status, CRASH, 'the process was ended (0xC0000409)');
+      assert.strictEqual(r.status, 0, r.stdout + r.stderr);
+      assert.ok(/CODE (EBUSY|EPERM)/.test(r.stdout), r.stdout);
+      const t2 = path.join(fresh('tree2-' + EMOJI), 't');
+      fs.mkdirSync(path.join(t2, 'sub'), { recursive: true });
+      hold(path.join(t2, 'sub'), 1000);
+      require('./temp-cleanup').removeTree(t2, { recursive: true, force: true }, { timeoutMs: 15000 });
+      assert.strictEqual(fs.existsSync(t2), false, 'removeTree did not wait out a hold of one second');
+    });
+  }
+
+  test('env summary --json says whether this Node has the bug, and the advisory is English in English mode', () => {
+    const L = require(CLI);
+    assert.strictEqual(typeof L._rmSyncAdvisory, 'function', '_rmSyncAdvisory is not exported');
+    const en = L._rmSyncAdvisory('en', '26.3.0', 'win32'), ko = L._rmSyncAdvisory('ko', '26.3.0', 'win32');
+    assert.ok(en && /26\.9\.0/.test(en) && /24\.22\.0/.test(en) && /26\.3\.0/.test(en), en);
+    assert.ok(!/[ㄱ-ㆎ가-힣]/.test(en), 'Korean text in the English advisory');
+    assert.ok(ko && /[가-힣]/.test(ko) && /26\.9\.0/.test(ko), ko);
+    assert.strictEqual(L._rmSyncAdvisory('en', '26.9.0', 'win32'), null);
+    assert.strictEqual(L._rmSyncAdvisory('en', '26.3.0', 'linux'), null);
+    const r = runNode([CLI, 'env', 'summary', '--json'], { cwd: arena });
+    assert.strictEqual(r.status, 0, r.stderr);
+    assert.strictEqual(JSON.parse(r.stdout).node.rmSyncPathBug, bugHere);
+  });
+
+  // 1.36.305 review round 1: selftest drops LEERNESS_LANG while it runs (a user's setting must not change the cases) and
+  //   chose the advisory's language after that, so English mode printed it in Korean. The advisory is printed before
+  //   the cases run (about four minutes on Windows), so this reads it from the output file and ends the run.
+  test('selftest prints the advisory in the language chosen before it controls its environment', () => {
+    if (!bugHere) { console.log(`  skipped: Node ${process.version} on ${process.platform} prints no advisory`); return; }
+    for (const [lang, korean] of [['en', false], ['ko', true]]) {
+      const dir = fresh('selftest-' + lang), outFile = path.join(dir, 'out.txt'), temp = path.join(dir, 'temp');
+      fs.mkdirSync(temp);
+      const fd = fs.openSync(outFile, 'w');
+      // The run is ended mid-case, so the folders its cases make go to a temp directory inside this probe's arena.
+      const env = { ...process.env, LEERNESS_LANG: lang, TEMP: temp, TMP: temp, TMPDIR: temp };
+      const child = cp.spawn(process.execPath, [CLI, 'selftest'], { cwd: arena, env, stdio: ['ignore', fd, fd], windowsHide: true });
+      children.push(child);
+      let line = null;
+      for (const deadline = Date.now() + 60000; !line && Date.now() < deadline; sleep(200)) {
+        line = fs.readFileSync(outFile, 'utf8').split('\n').find(l => /⚠ .*26\.9\.0/.test(l)) || null;
+      }
+      child.kill(); fs.closeSync(fd);
+      assert.ok(line, `${lang}: no advisory within 60 s`);
+      assert.strictEqual(/[가-힣]/.test(line), korean, `${lang}: ${line}`);
+    }
+  });
+
+  test('selftest has a passing case for the rmSync version check', () => {
+    const L = require(CLI);
+    const c = L._selfTestCases().filter(x => /T-0365/.test(x.name));
+    assert.strictEqual(c.length, 1, 'no T-0365 selftest case');
+    assert.strictEqual(c[0].run(), true);
+  });
+} finally {
+  for (const c of children) { try { c.kill(); } catch {} }
+  sleep(isWin ? 700 : 0);
+  try { require('./temp-cleanup').removeTree(arena, { recursive: true, force: true }); } catch (e) { console.error(`arena left: ${arena} (${e.code})`); }
+}
+console.log(`safe remove: ${passed}/${passed + failed} passed`);
+if (failed) process.exitCode = 1;

package/scripts/temp-cleanup-probe.js

@@ -35,7 +35,10 @@ try {
     try {
       // What the probes used before: on Windows this fails at once despite maxRetries (reported, not asserted).
       let before = 'removed';
-      try { fs.rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }); } catch (error) { before = error.code; }
+      // T-0365: on a Windows Node whose failed fs.rmSync ends the process, a temp path with a character outside the
+      //   code page would end this probe here; the report is skipped on any non-ASCII temp path there.
+      if (require('../lib/safe-remove').rmSyncPathBug() && /[^\x00-\x7f]/.test(root)) before = 'not run (T-0365)';
+      else try { fs.rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }); } catch (error) { before = error.code; }
       console.log(`  rmSync with maxRetries on a held tree (${process.platform}, ${process.version}): ${before}`);
       if (fs.existsSync(root)) {
         const started = Date.now();

package/scripts/temp-cleanup.js

@@ -12,9 +12,12 @@ const path = require('path');
 const RETRY_CODES = new Set(['EBUSY', 'EMFILE', 'ENFILE', 'ENOTEMPTY', 'EPERM']);
 
 function removeTree(target, rmOptions = {}, { timeoutMs = 5000, intervalMs = 100 } = {}) {
+  // T-0365: removeSync is fs.rmSync except on the Windows Node versions whose failed fs.rmSync ends the process. It is
+  //   loaded at first use, so requiring this file loads nothing from lib/ before trackTemp runs.
+  const { removeSync } = require('../lib/safe-remove');
   const deadline = Date.now() + timeoutMs;
   for (;;) {
-    try { return fs.rmSync(target, rmOptions); }
+    try { return removeSync(target, rmOptions); }
     catch (error) {
       if (!RETRY_CODES.has(error && error.code) || Date.now() >= deadline) throw error;
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, intervalMs);

package/scripts/test-node-runner-probe.js

@@ -164,21 +164,25 @@ fixture('nested.test.cjs', "require('node:test')('beta',async t=>{await t.test('
     await test('a briefly held selector fixture is waited out, not reported as an unavailable selector', async () => {
       // Windows can refuse the fixture delete while the last child test process exits, and Node 26
       // rmSync does not retry EPERM. Two refusals must not turn into runtime-selector-unavailable.
-      const original = fs.rmSync;
+      // T-0365: on a Windows Node whose failed fs.rmSync ends the process, lib/safe-remove.js removes the fixture
+      //   with unlink and rmdir, so the refusals go to the fixture folder's rmdirSync as well.
+      const original = fs.rmSync, originalRmdir = fs.rmdirSync;
       let refused = 0;
-      fs.rmSync = function (target, ...rest) {
+      const refuse = (impl, self, target, rest) => {
         if (refused < 2 && path.basename(String(target)).startsWith('leerness-node-selector-')) {
           refused++;
           throw Object.assign(new Error('injected hold'), { code: 'EPERM' });
         }
-        return original.call(this, target, ...rest);
+        return impl.call(self, target, ...rest);
       };
+      fs.rmSync = function (target, ...rest) { return refuse(original, this, target, rest); };
+      fs.rmdirSync = function (target, ...rest) { return refuse(originalRmdir, this, target, rest); };
       try {
         const result = await runNodeSelection(request('cases.test.cjs', 'beta'), arena);
         assert.equal(refused, 2, `fixture cleanup stopped after ${refused} refusal(s) instead of waiting`);
         assert.equal(result.fixtureSelectionVerified, true, JSON.stringify(result));
         assert.equal(result.selectedTestPassed, true);
-      } finally { fs.rmSync = original; }
+      } finally { fs.rmSync = original; fs.rmdirSync = originalRmdir; }
     });
   } finally {
     const actual = fs.realpathSync(arena);