enhance(#3906): two terminators over one registry, with a versioned exit projection (#3924)

* feat(#3906): two terminators over one registry, with a versioned projection

Adds terminateNow (write-then-terminate, for callers that cannot wait for the event loop) beside runMain (drain-then-exit), both projecting through one shared function so they cannot disagree - the parity the ADR makes mandatory. A failed write does not change the exit code: letting it propagate would fail a hook open, which is what the fail-closed branches exist to prevent.

The projection is versioned. v1 reproduces today's integers, including keeping a payload-carried degraded result at exit 0 - ADR-2980 ratified that across 60 sites and declined normalizing it on measured blast radius. v2 applies the registry. --exit-contract=v2 or GSD_EXIT_CONTRACT=v2 selects it; an unrecognized version throws rather than silently defaulting.

The registry is now emitted beside both copies of the exit module, so it resolves as a sibling in the built tree and in the committed scripts/ copy that must load on an unbuilt clone.

* fix(#3906): actually restrict code 2 to terminateNow, and generate the registry's type

The claim that terminateNow is the only place 2 can be produced was false: runMain's outcome arm applied no guard, so runMain(()=>'HOOK_DENY') set exitCode 2 through the drain path - and the parity matrix demonstrated it while calling it parity. runMain now refuses any outcome projecting to the hook-protocol code, gated on the code rather than the name so an alias cannot slip past, and the matrix asserts the restriction instead of contradicting it.

The ambient type for the generated registry was hand-written with no gate against the generator's actual output - the declared-surface-diverges-from-runtime defect class this epic exists to close, reintroduced inside it. It is now a third generated artifact covered by the same --check. Also converts every test-body try/finally to t.after().

* test(#3906): derive the glossary fixture's dependencies instead of hand-listing them

Adding a require to scripts/lib/cli-exit.cjs broke 31 tests in one suite that built its fixture from a hand-written dependency list, so the new sibling was absent and the copied script could not load. copyScriptWithDeps walks the require graph and exists for exactly this class - #3412 paid the same bill when one new require broke 82 tests across two suites. Migrating rather than adding another copyFileSync line keeps the class closed. The other nine suites referencing that path were triaged; none copies-and-spawns, so none needed migrating.

* fix(#3906): enumerate the new shipped file, drop a vendor name from shipped data, and fix three test defects

install: scripts/lib/exit-code-registry.cjs was missing from GSD_SCRIPTS_LIB_FILES, so it shipped to every install and orphaned on uninstall.

The registry gave HOOK_DENY a meaning naming one harness, and that string ships into every runtime's tree - a guard correctly caught it leaking into the hermes and qwen installs. The registry is runtime-neutral infrastructure; the vendor name belongs in the ADR, not in shipped data.

Two more fixture harnesses built their trees from hand-listed dependencies and broke on the new require; both migrated to the derived helper, and all 23 copy-and-spawn candidates were enumerated so the class is closed rather than patched. One generator test used a fixture code that collided with a real allocation, so the generator correctly reported a duplicate where the test expected drift. The large-payload test embedded a 256KB literal in the child's argv, exceeding Linux's 128KiB MAX_ARG_STRLEN so the child never started - it now builds the payload inside the child.

* chore(#3906): backfill changeset pr number

* docs(#3906): document the exit-code contract selector

P2 is the first phase of this epic with a user-invocable surface, so the flag and env var owe a reference entry. Records what actually differs between v1 and v2 today (one outcome), that an unrecognized value is rejected rather than silently defaulted, and the fail-safe property that makes switching safe.

---------

Co-authored-by: sim <sim@local>

tests/exit-code-registry.test.cjs

@@ -52,8 +52,32 @@ function makeEntry(overrides) {
   };
 }
 
+/**
+ * #3906 (ADR-3889 Phase 2): the generator now emits THREE artifacts — a
+ * primary (gsd-core/bin/lib), a secondary (scripts/lib), and the ambient
+ * `.d.cts` type declaration (src/exit-code-registry.d.cts). Every existing
+ * call site below only overrides the PRIMARY path via `--out`; without
+ * matching `--scripts-out`/`--dts-out` overrides, a `--write` here would
+ * clobber the real committed `scripts/lib/exit-code-registry.cjs` and
+ * `src/exit-code-registry.d.cts` — dangerous since test files in this repo
+ * run in parallel. Rather than touch every call site, this single seam
+ * derives co-located, per-call-unique secondary/dts paths from whatever
+ * `--out` value the test already supplies, whenever the caller has not
+ * already supplied its own `--scripts-out`/`--dts-out`. Calls with no
+ * explicit `--out` (the "real committed set" checks) are left untouched.
+ */
+function ensureScriptsOut(args) {
+  const outIdx = args.indexOf('--out');
+  if (outIdx === -1) return args;
+  const outValue = args[outIdx + 1];
+  const extra = [];
+  if (!args.includes('--scripts-out')) extra.push('--scripts-out', `${outValue}.secondary.cjs`);
+  if (!args.includes('--dts-out')) extra.push('--dts-out', `${outValue}.d.cts`);
+  return extra.length === 0 ? args : [...args, ...extra];
+}
+
 function runGen(args, opts = {}) {
-  return runNode([GEN_SCRIPT, ...args], { timeoutMs: PROBE_TIMEOUT_MS, ...opts });
+  return runNode([GEN_SCRIPT, ...ensureScriptsOut(args)], { timeoutMs: PROBE_TIMEOUT_MS, ...opts });
 }
 
 /**
@@ -366,7 +390,7 @@ describe('gen-exit-code-registry: CLI', () => {
     return p;
   }
 
-  test('--check is in sync against the real committed pair', () => {
+  test('--check is in sync against the real committed set (both .cjs artifacts and the .d.cts)', () => {
     const result = runGen(['--check']);
     assert.equal(result.exitCode, 0, result.stderr);
   });
@@ -403,12 +427,60 @@ describe('gen-exit-code-registry: CLI', () => {
     assert.equal(report.reason, generator.REASON.DRIFTED);
   });
 
+  // Review finding (#3906 follow-up): the ambient .d.cts was hand-maintained
+  // with no gate verifying it against serializeRegistry()'s actual shape.
+  // These pin the SAME write/check/drift contract already proven for the two
+  // .cjs artifacts above, but for the .d.cts specifically.
+  test('--write emits a matching .d.cts artifact', () => {
+    const decl = validDeclarationPath(tmpDir, 'dts-decl.json');
+    const out = path.join(tmpDir, 'dts-out.cjs');
+    const dtsOut = path.join(tmpDir, 'dts-out.d.cts');
+    const write = runGen(['--write', '--declaration', decl, '--out', out, '--dts-out', dtsOut]);
+    assert.equal(write.exitCode, 0, write.stderr);
+    assert.ok(fs.existsSync(dtsOut), 'expected the .d.cts artifact to be written');
+    const dtsContent = fs.readFileSync(dtsOut, 'utf8');
+    assert.ok(dtsContent.includes('export interface ExitCodeEntry'));
+    assert.ok(dtsContent.includes('export = exitCodeRegistry;'));
+
+    const check = runGen(['--check', '--declaration', decl, '--out', out, '--dts-out', dtsOut]);
+    assert.equal(check.exitCode, 0, check.stderr);
+  });
+
+  test('--check on a hand-edited .d.cts artifact -> DRIFTED', () => {
+    const decl = validDeclarationPath(tmpDir, 'dts-drift-decl.json');
+    const out = path.join(tmpDir, 'dts-drift-out.cjs');
+    const dtsOut = path.join(tmpDir, 'dts-drift-out.d.cts');
+    assert.equal(runGen(['--write', '--declaration', decl, '--out', out, '--dts-out', dtsOut]).exitCode, 0);
+    fs.appendFileSync(dtsOut, '\n// hand-edited, drifts from generated content\n');
+    const { result, report } = runGenJson(['--check', '--declaration', decl, '--out', out, '--dts-out', dtsOut]);
+    assert.equal(result.exitCode, 1);
+    assert.equal(report.ok, false);
+    assert.equal(report.reason, generator.REASON.DRIFTED);
+    assert.equal(report.context.artifact, 'dts');
+  });
+
+  test('--check with the .d.cts artifact absent -> MISSING_ARTIFACT', () => {
+    const decl = validDeclarationPath(tmpDir, 'dts-missing-decl.json');
+    const out = path.join(tmpDir, 'dts-missing-out.cjs');
+    const dtsOut = path.join(tmpDir, 'dts-missing-out.d.cts');
+    const { result, report } = runGenJson(['--check', '--declaration', decl, '--out', out, '--dts-out', dtsOut]);
+    assert.equal(result.exitCode, 1);
+    assert.equal(report.ok, false);
+    assert.equal(report.reason, generator.REASON.MISSING_ARTIFACT);
+    assert.equal(fs.existsSync(dtsOut), false);
+  });
+
   test('--check with a stale artifact (declaration changed after write) -> DRIFTED', () => {
     const decl = validDeclarationPath(tmpDir, 'd-decl.json');
     const out = path.join(tmpDir, 'd-out.cjs');
     assert.equal(runGen(['--write', '--declaration', decl, '--out', out]).exitCode, 0);
     const entries = JSON.parse(fs.readFileSync(decl, 'utf8'));
-    entries.push({ code: 80, name: 'DOMAIN_X', meaning: 'm', owner: 'domain-x', authorizedBy: 'ADR-3889' });
+    // 81, not 80: the real declaration already allocates 80 to DEGRADED, and
+    // this fixture copies the REAL declaration (validDeclarationPath) — an
+    // appended entry must pick a code neither of the two committed entries
+    // already own, or the generator correctly reports fail_duplicate_code
+    // instead of the DRIFTED this test means to exercise.
+    entries.push({ code: 81, name: 'DOMAIN_X', meaning: 'm', owner: 'domain-x', authorizedBy: 'ADR-3889' });
     fs.writeFileSync(decl, JSON.stringify(entries, null, 2), 'utf8');
     const { result, report } = runGenJson(['--check', '--declaration', decl, '--out', out]);
     assert.equal(result.exitCode, 1);