diff --git a/package.json b/package.json
index 1378ba8..97b4025 100644
--- a/package.json
+++ b/package.json
@@ -28,6 +28,7 @@
     "bin",
     "dist",
     "scripts/apply-cloud-migrations.mjs",
+    "scripts/lib/remote-temp-dir.mjs",
     "scripts/smoke-machine-sync-release.mjs",
     "scripts/smoke-machines-adapter.mjs",
     "scripts/smoke-open-files-installed-boundary.mjs",
diff --git a/scripts/lib/remote-temp-dir.mjs b/scripts/lib/remote-temp-dir.mjs
new file mode 100644
index 0000000..10c4939
--- /dev/null
+++ b/scripts/lib/remote-temp-dir.mjs
@@ -0,0 +1,156 @@
+import { posix } from 'node:path';
+
+/**
+ * Validate a path that will later be handed to `rm -rf` on a remote host.
+ *
+ * What this actually defends against - stated precisely, because an earlier version of this
+ * comment described an unreachable code path:
+ *
+ * `runRemote` goes through `runChecked`, which throws on a non-zero remote exit. A *failing*
+ * `mktemp -d` exits 1, so it aborts the run and never yields an empty string. The reachable
+ * hole is the remote exiting **zero** with stdout that is not the path: an ssh `Banner`, a
+ * chatty login profile, or a `ForceCommand` wrapper prepends lines, and a wrapper can mask
+ * the real exit status entirely. Whatever lands in that variable is then passed as a
+ * `--peer-workspace` argv element and, more importantly, interpolated into the remote shell
+ * strings `cd <value> && knowledge ...` and `rm -rf <value>`.
+ *
+ * That is the same class as the 2026-07-24 incident - a delete target taken on faith from a
+ * command's output - which is why the check belongs at the assignment rather than relying on
+ * `shellQuote` downstream to neutralise a value that should never have been accepted.
+ *
+ * Accepts only what this exact template could have produced: `mktemp` replaces the trailing
+ * run of `X` in place, so the result is the template's fixed prefix followed by a single
+ * non-empty path component. Checking against the template's parent directory alone is not
+ * enough - it would accept any unrelated directory sitting beside the temp dir - so a
+ * template whose final component is nothing but `X` (`/tmp/XXXXXX`) is refused outright:
+ * its prefix is a bare directory, which would silently degrade this into exactly that
+ * parent-only check. The bound is derived from the template, so it stays correct if the
+ * template moves.
+ *
+ * @param {string} remote Remote host, used in the error message only.
+ * @param {unknown} dir Trimmed stdout of the remote `mktemp -d`.
+ * @param {string} template Absolute template passed to `mktemp -d`, ending in `XXX...`.
+ * @returns {string} The validated directory.
+ * @throws {Error} If the value is anything other than a directory that template could create.
+ */
+export function assertRemoteTempDir(remote, dir, template) {
+  const fail = (why) => {
+    throw new Error(
+      `Refusing to use remote temp dir from ${remote}: ${why}. `
+      + `Template ${template}, got ${JSON.stringify(dir)}. `
+      + 'This value is used as an `rm -rf` target on the remote host.'
+    );
+  };
+
+  if (typeof template !== 'string' || !template.startsWith('/')) {
+    throw new Error(`Remote temp dir template must be an absolute path, got ${JSON.stringify(template)}.`);
+  }
+  // A template containing `.` or `..` makes the derived bound meaningless, and the template
+  // is built from a caller-supplied version string. Require it to be already normalized
+  // rather than normalizing silently, so a surprising template is loud instead of accepted.
+  if (posix.normalize(template) !== template) {
+    throw new Error(
+      `Remote temp dir template must be normalized (no "." or ".." segments), got ${JSON.stringify(template)}.`
+    );
+  }
+  // POSIX mktemp requires at least three trailing X in the final component.
+  const match = template.match(/^(.*[^X])(X{3,})$/);
+  if (!match) {
+    throw new Error(`Remote temp dir template must end in at least three X, got ${JSON.stringify(template)}.`);
+  }
+  const [, prefix, xRun] = match;
+  // Without a fixed part in the final component, `prefix` is a bare directory and every
+  // sibling under it would validate - the parent-only check this function exists to avoid.
+  if (prefix.endsWith('/')) {
+    throw new Error(
+      'Remote temp dir template must have a fixed prefix in its final component '
+      + `(e.g. /tmp/knowledge-XXXXXX, not /tmp/XXXXXX), got ${JSON.stringify(template)}.`
+    );
+  }
+
+  if (typeof dir !== 'string' || dir === '') fail('mktemp -d produced no path');
+  if (/[\r\n]/.test(dir)) fail('path spans multiple lines');
+  // Redundant while the template is absolute and normalized (prefix then starts with `/`),
+  // kept as a cheap invariant so a future change to the template rules cannot quietly admit
+  // a relative delete target.
+  if (!dir.startsWith('/')) fail('path is not absolute');
+  if (!dir.startsWith(prefix)) fail(`path does not start with the template prefix ${prefix}`);
+
+  const suffix = dir.slice(prefix.length);
+  if (suffix === '') fail('path is the bare template prefix, so mktemp created nothing');
+  if (suffix.includes('/')) fail('path descends below the directory the template would create');
+  // mktemp replaces the X run with exactly that many characters from [A-Za-z0-9]. Requiring
+  // the same shape is what makes "only what this template could have produced" literally
+  // true, rather than "anything under the prefix without a slash in it".
+  if (suffix.length !== xRun.length) {
+    fail(`path suffix is ${suffix.length} characters, but the template's X run is ${xRun.length}`);
+  }
+  if (!/^[A-Za-z0-9]+$/.test(suffix)) fail('path suffix contains characters mktemp never generates');
+
+  return dir;
+}
+
+/**
+ * Create a remote temp dir, returning only a path this exact template could have produced.
+ *
+ * `makeTempDir` is injected rather than imported so this module never spawns a process - the
+ * published script stays the only thing that talks to ssh - and, more to the point, so a test
+ * can drive THIS function, the one that decides whether the validator runs at all. Exercising
+ * `assertRemoteTempDir` on its own proves the validator works but pins nothing about it being
+ * wired in: deleting the call below used to leave the entire suite green.
+ *
+ * @param {string} remote Remote host.
+ * @param {string} template Absolute template passed to `mktemp -d`, ending in `XXX...`.
+ * @param {(remote: string, template: string) => string} makeTempDir Runs `mktemp -d <template>`
+ *   on `remote` and returns its stdout. Expected to throw on a non-zero remote exit.
+ * @returns {string} The validated directory.
+ * @throws {Error} If the value is anything other than a directory that template could create.
+ */
+export function createRemoteTempDir(remote, template, makeTempDir) {
+  const raw = makeTempDir(remote, template);
+  // A non-string reaches the guard as-is rather than dying on `.trim()`, so a wrapper returning
+  // something unexpected produces the explanatory refusal instead of a bare TypeError.
+  const dir = typeof raw === 'string' ? raw.trim() : raw;
+  return assertRemoteTempDir(remote, dir, template);
+}
+
+/**
+ * Delete a remote temp dir, but only after re-checking that the value is still something
+ * `template` could have produced, and without ever throwing.
+ *
+ * That re-check is the last gate in front of a recursive delete on another machine, which is
+ * why it lives here rather than inline in the caller's `finally`: the property worth pinning is
+ * a negative - `deleteDir` must NOT be called when the value does not validate - and a negative
+ * is unobservable while the gate sits in a cleanup block no test can drive.
+ *
+ * Callers use this from `finally`, where a throw would replace the in-flight exception and skip
+ * the remaining cleanup, so every step is contained and problems are handed to `report`.
+ *
+ * @param {string} remote Remote host.
+ * @param {string|null|undefined} dir Candidate delete target; nullish means there is nothing to
+ *   clean up, which is normal when creation itself failed.
+ * @param {string} template The template `dir` was created from.
+ * @param {{
+ *   deleteDir: (dir: string) => void,
+ *   report: (what: string, error: unknown) => void,
+ * }} io `deleteDir` performs the remote delete; `report` records a cleanup problem and must not
+ *   throw.
+ * @returns {boolean} Whether the delete was attempted.
+ */
+export function removeRemoteTempDir(remote, dir, template, { deleteDir, report }) {
+  if (dir === null || dir === undefined) return false;
+
+  try {
+    assertRemoteTempDir(remote, dir, template);
+  } catch (error) {
+    report('refusing remote cleanup, temp dir no longer validates', error);
+    return false;
+  }
+
+  try {
+    deleteDir(dir);
+  } catch (error) {
+    report(`remote cleanup of ${dir} could not be spawned`, error);
+  }
+  return true;
+}
diff --git a/scripts/smoke-machine-sync-release.mjs b/scripts/smoke-machine-sync-release.mjs
index 0dda0b2..70dfe92 100644
--- a/scripts/smoke-machine-sync-release.mjs
+++ b/scripts/smoke-machine-sync-release.mjs
@@ -1,10 +1,11 @@
 #!/usr/bin/env bun
 
 import { spawnSync } from 'node:child_process';
-import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRemoteTempDir, removeRemoteTempDir } from './lib/remote-temp-dir.mjs';
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const packageJson = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf8'));
@@ -122,6 +123,55 @@ function runRemote(remote, command, options = {}) {
   return runChecked('ssh', [remote, command], options);
 }
 
+/**
+ * Report a cleanup problem without ever throwing.
+ *
+ * Used only from `finally` blocks, where a throw REPLACES the in-flight exception from the
+ * try block and skips the remaining cleanup, so the reporter itself is contained rather than
+ * only the statements it reports on.
+ *
+ * The try/catch covers a synchronous throw (a non-string argument, a closed fd). It does NOT
+ * cover EPIPE: measured on Linux, writing to a stderr pipe whose reader has exited raises an
+ * asynchronous 'error' event that terminates the process, and no catch here can intercept
+ * that. An earlier version of this comment claimed otherwise; the residual risk of the
+ * process dying mid-cleanup is real and is not addressed by this function.
+ */
+function reportCleanupProblem(what, error) {
+  try {
+    process.stderr.write(`[smoke] ${what}: ${error instanceof Error ? error.message : String(error)}\n`);
+  } catch {
+    // Nothing can be done about a failed diagnostic, and it must not mask the real error.
+  }
+}
+
+/** Remove a directory from a `finally` block without ever throwing. */
+function removeTempDirSafely(dir, label) {
+  if (dir === null || dir === undefined) return;
+  try {
+    rmSync(dir, { recursive: true, force: true });
+  } catch (error) {
+    reportCleanupProblem(`could not remove ${label} ${dir}`, error);
+  }
+}
+
+/** `mktemp -d <template>` on the remote host; throws on a non-zero remote exit. */
+function remoteMktemp(remote, template) {
+  return runRemote(remote, `mktemp -d ${shellQuote(template)}`);
+}
+
+/** `rm -rf <dir>` on the remote host, reporting a non-zero exit rather than discarding it. */
+function remoteRemoveDir(remote, dir) {
+  // A failed remote delete leaves the temp dir behind; `run` swallows the exit status, so it is
+  // surfaced here rather than discarded.
+  const cleanup = run('ssh', [remote, `rm -rf ${shellQuote(dir)}`]);
+  if (cleanup.status !== 0) {
+    reportCleanupProblem(
+      `remote cleanup of ${dir} on ${remote} exited ${cleanup.status}; it may still exist`,
+      cleanup.stderr.trim() || 'no stderr'
+    );
+  }
+}
+
 function parseJsonOutput(label, raw) {
   try {
     return JSON.parse(raw);
@@ -410,11 +460,18 @@ function syncMachineArgs(options, remoteDir, runOptions = {}) {
 }
 
 function runSyncSmoke(options, runOptions = {}) {
-  const localDir = mkdtempSync(join(tmpdir(), `knowledge-linux-node-b-${options.knowledgeVersion}-`));
-  const remoteDir = runRemote(options.remote, `mktemp -d ${shellQuote(`/tmp/knowledge-linux-node-a-${options.knowledgeVersion}-XXXXXX`)}`).trim();
+  // Both temp dirs are created INSIDE the try, with the finally null-guarding each one, so
+  // whichever creation succeeds is always cleaned up. Creating either one outside only moves
+  // the leak around: remote-first leaks a remote dir when mkdtempSync fails, local-first
+  // leaks a local dir when the remote dir is refused.
+  const remoteTemplate = `/tmp/knowledge-linux-node-a-${options.knowledgeVersion}-XXXXXX`;
+  let remoteDir = null;
+  let localDir = null;
   const localCommandOptions = runOptions.localCommandOptions ?? {};
   const learnCommandOptions = runOptions.learnCommandOptions ?? {};
   try {
+    remoteDir = createRemoteTempDir(options.remote, remoteTemplate, remoteMktemp);
+    localDir = mkdtempSync(join(tmpdir(), `knowledge-linux-node-b-${options.knowledgeVersion}-`));
     knowledgeJson(localDir, ['db', 'init', '--scope', 'project', '--json'], localCommandOptions);
     remoteKnowledgeJson(options.remote, remoteDir, ['db', 'init', '--scope', 'project', '--json']);
 
@@ -575,8 +632,19 @@ function runSyncSmoke(options, runOptions = {}) {
     return summary;
   } finally {
     if (!options.keepTemp) {
-      rmSync(localDir, { recursive: true, force: true });
-      run('ssh', [options.remote, `rm -rf ${shellQuote(remoteDir)}`]);
+      // EVERY statement in this finally is individually contained, including `report` itself.
+      // A throw here would replace the in-flight exception from the try block - turning a real
+      // smoke failure into a confusing cleanup error - and would skip the remaining cleanup.
+
+      removeTempDirSafely(localDir, 'local temp dir');
+      // Null-guarded, re-validated and contained inside the helper, which is what makes the
+      // re-check reachable by a test. remoteDir is assigned once from an already-validated
+      // value, so the re-check cannot currently fail; it exists so a future refactor that makes
+      // the value reassignable is caught there rather than at the `rm -rf`.
+      removeRemoteTempDir(options.remote, remoteDir, remoteTemplate, {
+        deleteDir: (dir) => remoteRemoveDir(options.remote, dir),
+        report: reportCleanupProblem,
+      });
     }
   }
 }
@@ -589,7 +657,7 @@ function runNoMachinesSyncSmoke(options, dirs) {
     try {
       probe = knowledgeJson(probeDir, ['machines', 'topology', '--no-tailscale', '--json'], { env: runner.env });
     } finally {
-      if (!options.keepTemp) rmSync(probeDir, { recursive: true, force: true });
+      if (!options.keepTemp) removeTempDirSafely(probeDir, 'probe dir');
     }
     if (probe.adapter?.implementation !== 'disabled' || probe.adapter?.available !== false) {
       throw new Error(`no-machines probe did not disable adapter: ${JSON.stringify(probe.adapter)}`);
@@ -619,7 +687,7 @@ function runNoMachinesSyncSmoke(options, dirs) {
       sync,
     };
   } finally {
-    if (!options.keepTemp) rmSync(runner.app_dir, { recursive: true, force: true });
+    if (!options.keepTemp) removeTempDirSafely(runner.app_dir, 'runner app dir');
   }
 }
 
@@ -631,7 +699,7 @@ function runNoMachinesRegistrySyncSmoke(options, dirs) {
     try {
       probe = knowledgeJson(probeDir, ['machines', 'topology', '--no-tailscale', '--json'], { env: runner.env });
     } finally {
-      if (!options.keepTemp) rmSync(probeDir, { recursive: true, force: true });
+      if (!options.keepTemp) removeTempDirSafely(probeDir, 'probe dir');
     }
     if (probe.adapter?.implementation !== 'disabled' || probe.adapter?.available !== false) {
       throw new Error(`no-machines registry probe did not disable adapter: ${JSON.stringify(probe.adapter)}`);
@@ -674,7 +742,7 @@ function runNoMachinesRegistrySyncSmoke(options, dirs) {
       sync,
     };
   } finally {
-    if (!options.keepTemp) rmSync(runner.app_dir, { recursive: true, force: true });
+    if (!options.keepTemp) removeTempDirSafely(runner.app_dir, 'runner app dir');
   }
 }
 
@@ -793,4 +861,49 @@ function main() {
   outputSummary(summary, options);
 }
 
-main();
+/**
+ * Same file on disk, following symlinks on both sides.
+ *
+ * A lexical `resolve()` comparison is NOT enough, and getting this wrong fails in the silent
+ * direction. Node resolves the main module through symlinks before deriving
+ * `import.meta.url`, so under any symlinked layout - a pnpm-style
+ * `node_modules/@hasna/knowledge -> <store>/package`, or macOS `/tmp -> /private/tmp` in the
+ * documented `npm pack && tar xzf` evidence procedure - argv[1] is the link path while
+ * `import.meta.url` is the real path. They never compare equal, the script does nothing, and
+ * it exits 0: a caller checking only the exit status records a green release smoke that never
+ * ran. Bun keeps the link path on both sides, which is why a bun-only test cannot see it.
+ *
+ * When a path cannot be resolved at all - a virtual filesystem, a file deleted out from under a
+ * running process - this falls back to the lexical comparison rather than returning false. The
+ * defect being fixed is a script that silently does nothing, so the fallback is the pre-existing
+ * behaviour rather than a new way to skip the run, and it can never make `import` execute
+ * `main()`: on import argv[1] is a different file under either comparison.
+ */
+function isSameFile(a, b) {
+  try {
+    return realpathSync(a) === realpathSync(b);
+  } catch {
+    return a === b;
+  }
+}
+
+/**
+ * Run only when invoked directly, never on import.
+ *
+ * `main()` at module scope means merely importing this file performs `bun install -g` locally
+ * AND `ssh <remote> bun install -g` on a fleet host, before any argument is inspected. That is
+ * not hypothetical: it fired during review of this very PR, when the file was imported to test
+ * import resolution, and it installed a package on the reviewer's machine and attempted a
+ * remote install. A published script must not mutate a machine as a side effect of being
+ * loaded. Compared against argv rather than `import.meta.main`, which is a recent addition and
+ * is simply `undefined` on older Node releases - reading it there would turn this script into
+ * exactly the silent no-op described above. (An earlier version of this comment said Node had
+ * no support until v24; measured, v22.22.3 defines it as a boolean. The reason to avoid it is
+ * older runtimes, not v24.)
+ */
+const invokedDirectly = process.argv[1] !== undefined
+  && isSameFile(resolve(process.argv[1]), fileURLToPath(import.meta.url));
+
+if (invokedDirectly) {
+  main();
+}
diff --git a/scripts/validate-public-package.mjs b/scripts/validate-public-package.mjs
index 0d2e1e5..bd46e86 100644
--- a/scripts/validate-public-package.mjs
+++ b/scripts/validate-public-package.mjs
@@ -20,6 +20,7 @@ const publicDocs = [
 
 const publicScripts = [
   'scripts/apply-cloud-migrations.mjs',
+  'scripts/lib/remote-temp-dir.mjs',
   'scripts/smoke-machine-sync-release.mjs',
   'scripts/smoke-machines-adapter.mjs',
   'scripts/smoke-open-files-installed-boundary.mjs',
diff --git a/tests/machine-smoke-script.test.ts b/tests/machine-smoke-script.test.ts
index 4d721eb..53b656d 100644
--- a/tests/machine-smoke-script.test.ts
+++ b/tests/machine-smoke-script.test.ts
@@ -1,11 +1,36 @@
 import { describe, expect, test } from 'bun:test';
 import { spawnSync } from 'node:child_process';
-import { join, resolve } from 'node:path';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import {
+  assertRemoteTempDir,
+  createRemoteTempDir,
+  removeRemoteTempDir,
+} from '../scripts/lib/remote-temp-dir.mjs';
 
 const repoRoot = resolve(import.meta.dir, '..');
 const script = join(repoRoot, 'scripts', 'smoke-machine-sync-release.mjs');
 const openFilesBoundaryScript = join(repoRoot, 'scripts', 'smoke-open-files-installed-boundary.mjs');
 
+/**
+ * `node` as well as `process.execPath`.
+ *
+ * Under `bun test` `process.execPath` is always bun, so a suite that only ever spawns it has no
+ * way to observe node-only behaviour - which is how a node-only silent no-op shipped past a
+ * four-leg `runtime: [bun, node]` matrix whose only test step is `bun test`. `node` is already a
+ * hard requirement of this suite (tests/package-release.test.ts spawns it directly).
+ */
+const runtimes = [...new Set(['node', process.execPath])];
+
+/**
+ * Symlinks and `#!/bin/sh` PATH stubs are POSIX mechanisms; the defects they pin (pnpm-style
+ * symlinked installs, macOS `/tmp -> /private/tmp`) are POSIX defects. Windows is in the
+ * `test-matrix` job, so these skip there rather than failing for an unrelated reason.
+ */
+const posixOnly = test.skipIf(process.platform === 'win32');
+
 describe('machine sync release smoke script', () => {
   test('prints help without requiring ssh or installed packages', () => {
     const result = spawnSync(process.execPath, [script, '--help'], {
@@ -58,6 +83,145 @@ describe('machine sync release smoke script', () => {
     expect(output.checks).toContain('run isolated installed-package sync with @hasna/machines and machines CLI hidden');
     expect(output.checks).toContain('learn registry fallback then run isolated hidden-machines sync with --peer-workspace omitted');
   });
+
+  /**
+   * Regression for a silent no-op this script's own direct-invocation guard introduced.
+   *
+   * The guard compared `resolve(process.argv[1])` with `fileURLToPath(import.meta.url)`. Node
+   * resolves the main module through symlinks before deriving `import.meta.url` while
+   * `resolve()` is purely lexical, so through ANY symlinked path the two never matched: `main()`
+   * never ran, nothing was printed, and the process exited 0. A caller checking only the exit
+   * status - which is what a release gate does - recorded a green smoke that had done nothing.
+   *
+   * Measured at the broken commit against the packed tarball, and reproduced here:
+   *   node node_modules/@hasna/knowledge/scripts/smoke-machine-sync-release.mjs --dry-run --json
+   *     -> empty stdout, exit 0
+   *   node <symlink>/scripts/smoke-machine-sync-release.mjs --totally-bogus
+   *     -> exit 0, instead of raising "Unknown argument"
+   *
+   * Both real-world shapes are covered: a symlinked checkout, and the pnpm-style
+   * `node_modules/@hasna/knowledge -> <store>/package` layout a real install produces. macOS is
+   * the same shape via `/tmp -> /private/tmp`, which is where the PR's own documented
+   * `npm pack && tar xzf && node scripts/...` evidence procedure would have silently "passed".
+   *
+   * Bun keeps the link path on both sides and is unaffected, which is exactly why this must run
+   * under `node` and not `process.execPath`.
+   */
+  posixOnly('runs when invoked through a symlinked path, under every runtime', () => {
+    const sandbox = mkdtempSync(join(tmpdir(), 'knowledge-smoke-symlink-'));
+    try {
+      const plainLink = join(sandbox, 'checkout-link');
+      symlinkSync(repoRoot, plainLink, 'dir');
+      const installedLink = join(sandbox, 'node_modules', '@hasna', 'knowledge');
+      mkdirSync(dirname(installedLink), { recursive: true });
+      symlinkSync(repoRoot, installedLink, 'dir');
+
+      for (const runtime of runtimes) {
+        // The real path is the control: it passed even while every symlinked path was a no-op,
+        // so without it "help printed" would not distinguish the fix from the defect.
+        for (const root of [repoRoot, plainLink, installedLink]) {
+          const where = `${runtime} via ${root}`;
+          const linked = join(root, 'scripts', 'smoke-machine-sync-release.mjs');
+
+          const help = spawnSync(runtime, [linked, '--help'], { cwd: sandbox, encoding: 'utf8' });
+          expect(help.status, where).toBe(0);
+          expect(help.stdout, where).toContain('smoke-machine-sync-release.mjs');
+
+          // Exit 0 with no output is precisely what the defect produced, so a successful exit
+          // proves nothing on its own: an unknown argument must still be a real failure.
+          const bogus = spawnSync(runtime, [linked, '--totally-bogus'], { cwd: sandbox, encoding: 'utf8' });
+          expect(bogus.status, where).not.toBe(0);
+          expect(bogus.stderr, where).toContain('Unknown argument');
+        }
+      }
+
+      // The reviewer's verbatim reproduction: a pnpm-style install invoked under node.
+      const dryRun = spawnSync('node', [
+        join(installedLink, 'scripts', 'smoke-machine-sync-release.mjs'),
+        '--dry-run',
+        '--json',
+      ], { cwd: sandbox, encoding: 'utf8' });
+      expect(dryRun.status, dryRun.stderr).toBe(0);
+      expect(dryRun.stdout).not.toBe('');
+      expect(JSON.parse(dryRun.stdout)).toMatchObject({ ok: true, dry_run: true });
+    } finally {
+      rmSync(sandbox, { recursive: true, force: true });
+    }
+  });
+
+  /**
+   * Regression for the defect this PR is named after on the import side: `main()` at module
+   * scope meant merely importing the file ran `bun install -g` locally and
+   * `ssh <remote> bun install -g` on a fleet host before any argument was inspected. It fired
+   * for real during review.
+   *
+   * Reverting the guard to a bare `main();` left the whole suite green, because nothing loaded
+   * the module. This test loads it - in a child process whose PATH puts recorders in front of
+   * `bash`, `bun` and `ssh`, so the mutation is caught by an assertion rather than by installing
+   * a package on whoever runs the suite.
+   *
+   * Both argv shapes are covered: `node -e`, where `process.argv[1]` is undefined (the case the
+   * `!== undefined` check exists for), and an ordinary importer module, where argv[1] is defined
+   * but is a different file.
+   */
+  posixOnly('importing the script installs nothing and never reaches the remote', () => {
+    const sandbox = mkdtempSync(join(tmpdir(), 'knowledge-smoke-import-'));
+    try {
+      const binDir = join(sandbox, 'bin');
+      mkdirSync(binDir, { recursive: true });
+      const marker = join(sandbox, 'side-effects.log');
+      // `bash` is stubbed alongside `bun` and `ssh` because the script shells out via
+      // `bash -lc`, and a real login shell would put the real bun back on PATH ahead of a stub.
+      for (const name of ['bash', 'bun', 'ssh']) {
+        const shim = join(binDir, name);
+        writeFileSync(shim, `#!/bin/sh\necho "$0 $*" >> ${JSON.stringify(marker)}\nexit 0\n`);
+        chmodSync(shim, 0o755);
+      }
+      // Stubs first, real PATH behind it so the runtimes themselves still resolve.
+      const env = { ...process.env, PATH: `${binDir}:${process.env.PATH ?? ''}` };
+      const scriptUrl = pathToFileURL(script).href;
+
+      // Control. Without it, "no marker" could equally mean the stubs were never reachable and
+      // the test would pass against any implementation at all.
+      const probe = join(sandbox, 'probe.mjs');
+      writeFileSync(probe, [
+        "import { spawnSync } from 'node:child_process';",
+        "spawnSync('bash', ['-lc', \"bun install -g '@hasna/knowledge@0.0.0-test'\"], { env: process.env });",
+        "spawnSync('ssh', ['linux-node-a', \"bun install -g '@hasna/knowledge@0.0.0-test'\"], { env: process.env });",
+        '',
+      ].join('\n'));
+      spawnSync('node', [probe], { cwd: sandbox, encoding: 'utf8', env });
+      expect(existsSync(marker), 'the PATH stubs must be reachable or this test proves nothing').toBe(true);
+      expect(readFileSync(marker, 'utf8')).toContain('ssh');
+      rmSync(marker);
+
+      const evaluated = spawnSync('node', [
+        '-e',
+        'import(process.env.SMOKE_SCRIPT_URL).catch((error) => { console.error(error); process.exit(1); });',
+      ], { cwd: sandbox, encoding: 'utf8', env: { ...env, SMOKE_SCRIPT_URL: scriptUrl } });
+      // The marker first: it is the assertion that names the defect. A bare `main();` also
+      // exits non-zero here once the stubs break it, but "it installed something" is what the
+      // failure should say.
+      expect(existsSync(marker), 'node -e import must not install anything').toBe(false);
+      expect(evaluated.status, evaluated.stderr).toBe(0);
+      expect(evaluated.stdout).toBe('');
+
+      const importer = join(sandbox, 'importer.mjs');
+      writeFileSync(importer, 'await import(process.env.SMOKE_SCRIPT_URL);\n');
+      for (const runtime of runtimes) {
+        const imported = spawnSync(runtime, [importer], {
+          cwd: sandbox,
+          encoding: 'utf8',
+          env: { ...env, SMOKE_SCRIPT_URL: scriptUrl },
+        });
+        expect(existsSync(marker), `import under ${runtime} must not install anything`).toBe(false);
+        expect(imported.status, `${runtime}: ${imported.stderr}`).toBe(0);
+        expect(imported.stdout, runtime).toBe('');
+      }
+    } finally {
+      rmSync(sandbox, { recursive: true, force: true });
+    }
+  });
 });
 
 describe('installed open-files boundary smoke script', () => {
@@ -102,3 +266,323 @@ describe('installed open-files boundary smoke script', () => {
     expect(output.checks).toContain('scan source and peer knowledge SQLite/artifacts for raw sentinel and base64');
   });
 });
+
+/**
+ * `runSyncSmoke` sends `rm -rf <remoteDir>` over ssh, where remoteDir came from a remote
+ * `mktemp -d`. Taking a delete target on faith from a command's output is the same class of
+ * defect as the 2026-07-24 incident, where an empty `$(bun pm cache)` turned
+ * `rm -rf "$(cmd)"/*` into `rm -rf /*`.
+ *
+ * Precisely which case is live: `runRemote` goes through `runChecked`, which throws on a
+ * non-zero remote exit, so a *failing* `mktemp -d` (exit 1) aborts the run and never assigns
+ * an empty string. The reachable hole is the remote exiting **zero** with stdout that is not
+ * the path - an ssh `Banner`, a chatty login profile, or a `ForceCommand` wrapper prepending
+ * lines or masking the status. Measured verbatim:
+ *
+ *     $ echo "Welcome to linux-node-a"; mktemp -d /tmp/knowledge-banner-XXXXXX
+ *     Welcome to linux-node-a
+ *     /tmp/knowledge-banner-jjuN3k
+ *
+ * exit 0, so `runChecked` passes it through; the guard rejects it as multi-line.
+ *
+ * Scope, stated exactly rather than implied: these cases exercise `assertRemoteTempDir` ALONE.
+ * They prove it rejects bad input rather than merely accepting good input, and nothing more -
+ * in particular they do not pin that anything calls it. That is the next describe block's job,
+ * and the distinction is not academic: deleting both call sites once left this whole file
+ * green. No `rm` runs anywhere here.
+ */
+describe('remote temp dir guard', () => {
+  const remote = 'linux-node-a';
+  const template = '/tmp/knowledge-linux-node-a-0.0.0-test-XXXXXX';
+
+  test('accepts what a successful mktemp -d actually returns', () => {
+    expect(assertRemoteTempDir(remote, '/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9', template))
+      .toBe('/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9');
+  });
+
+  test('rejects the empty output a failing mktemp -d leaves behind', () => {
+    // Defence in depth rather than the live defect: runChecked aborts on a non-zero remote
+    // exit, so an empty value cannot reach here via a failing mktemp. It can via a wrapper
+    // that exits 0 without printing a path.
+    expect(() => assertRemoteTempDir(remote, '', template)).toThrow(/produced no path/);
+    expect(() => assertRemoteTempDir(remote, '   '.trim(), template)).toThrow(/produced no path/);
+  });
+
+  test('rejects paths that are not a temp dir this template could have created', () => {
+    for (const bad of [
+      '/',
+      '/tmp',
+      '/usr',
+      '/home/hasna',
+      '/tmp/somebody-elses-dir',
+      'knowledge-linux-node-a-0.0.0-test-Ab3De9',
+      './relative',
+      '/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9/../../etc',
+    ]) {
+      expect(() => assertRemoteTempDir(remote, bad, template))
+        .toThrow(/Refusing to use remote temp dir/);
+    }
+  });
+
+  test('rejects multi-line output, so only the first line is never silently used', () => {
+    expect(() => assertRemoteTempDir(
+      remote,
+      '/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9\nmktemp: failed',
+      template,
+    )).toThrow(/multiple lines/);
+  });
+
+  test('the failure names the path and says why it matters', () => {
+    expect(() => assertRemoteTempDir(remote, '', template))
+      .toThrow(/used as an `rm -rf` target on the remote host/);
+  });
+
+  test('rejects a sibling directory that merely shares the temp parent', () => {
+    // Checking only the parent directory would accept this, and `rm -rf` would then delete
+    // somebody else's directory.
+    expect(() => assertRemoteTempDir(remote, '/tmp/somebody-elses-dir', template))
+      .toThrow(/does not start with the template prefix/);
+  });
+
+  test('rejects a malformed template rather than deriving a bogus bound from it', () => {
+    expect(() => assertRemoteTempDir(remote, '/tmp/x', 'relative-XXXXXX'))
+      .toThrow(/must be an absolute path/);
+    expect(() => assertRemoteTempDir(remote, '/tmp/x', '/tmp/no-placeholder'))
+      .toThrow(/must end in at least three X/);
+  });
+
+  /**
+   * Regression for the review finding that this guard silently degraded into the
+   * parent-directory-only check it exists to avoid. With a template like `/tmp/XXXXXX` the
+   * derived prefix is a bare directory, so every sibling under it validated:
+   * `/tmp/XXXXXX` accepted `/tmp/somebody-elses-dir`, and `/XXXXXX` accepted `/etc`.
+   */
+  test('refuses a template whose final component is only X, which would accept any sibling', () => {
+    for (const badTemplate of ['/tmp/XXXXXX', '/XXXXXX', '/home/hasna/XXXXXXXX']) {
+      expect(() => assertRemoteTempDir(remote, '/tmp/anything', badTemplate))
+        .toThrow(/must have a fixed prefix in its final component/);
+    }
+  });
+
+  test('refuses a template containing . or .., which makes the derived bound meaningless', () => {
+    // The template is built from a caller-supplied version string.
+    expect(() => assertRemoteTempDir(
+      remote,
+      '/tmp/knowledge-x/../../../home/hasna-AbCdEf',
+      '/tmp/knowledge-x/../../../home/hasna-XXXXXX',
+    )).toThrow(/must be normalized/);
+    expect(() => assertRemoteTempDir(remote, '/tmp/k-AbCdEf', '/tmp/./k-XXXXXX'))
+      .toThrow(/must be normalized/);
+  });
+
+  test('rejects the bare template prefix, which means mktemp created nothing', () => {
+    expect(() => assertRemoteTempDir(remote, '/tmp/knowledge-linux-node-a-0.0.0-test-', template))
+      .toThrow(/mktemp created nothing/);
+  });
+
+  test('rejects the banner-first shape the docstring calls the live case', () => {
+    // Documented as the reachable hole but previously untested: only path-then-junk was
+    // covered, never junk-then-path.
+    expect(() => assertRemoteTempDir(
+      remote,
+      'Welcome to linux-node-a\n/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9',
+      template,
+    )).toThrow(/multiple lines/);
+  });
+
+  test('rejects a suffix mktemp could not have generated', () => {
+    const base = '/tmp/knowledge-linux-node-a-0.0.0-test-';
+    // mktemp replaces the X run with exactly that many [A-Za-z0-9] characters.
+    expect(() => assertRemoteTempDir(remote, `${base}Z`, template)).toThrow(/X run is 6/);
+    expect(() => assertRemoteTempDir(remote, `${base}ZZZZZZZZZZ`, template)).toThrow(/X run is 6/);
+    expect(() => assertRemoteTempDir(remote, `${base}A B123`, template))
+      .toThrow(/characters mktemp never generates/);
+    expect(() => assertRemoteTempDir(remote, `${base}$(id)`, template)).toThrow();
+    expect(assertRemoteTempDir(remote, `${base}Ab3De9`, template)).toBe(`${base}Ab3De9`);
+  });
+
+  test('a suffix containing a separator reports descent, not a charset complaint', () => {
+    // The charset rule below would also reject this, but the descent message is the useful
+    // one. Asserting the message pins the ordering so the clearer diagnostic cannot be lost.
+    expect(() => assertRemoteTempDir(
+      remote,
+      '/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9/nested',
+      template,
+    )).toThrow(/descends below the directory the template would create/);
+  });
+
+  test('rejects a lone carriage return, not just a newline', () => {
+    // The multi-line check is /[\r\n]/; a fixture using only \n would let it be narrowed to
+    // /\n/ unnoticed.
+    expect(() => assertRemoteTempDir(
+      remote,
+      '/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9\rjunk',
+      template,
+    )).toThrow(/multiple lines/);
+  });
+
+  test('rejects shell metacharacters and separators in the suffix by charset, not by length', () => {
+    // Each of these is exactly 6 characters, so only the charset rule can reject them. The
+    // earlier fixtures were all the wrong length, leaving the charset check - the
+    // shell-metacharacter backstop - pinned by nothing.
+    const base = '/tmp/knowledge-linux-node-a-0.0.0-test-';
+    for (const suffix of ['Ab3De.', 'Ab3De-', 'Ab3De_', 'Ab3De$', 'Ab3De;', 'Ab3De*', 'Ab3De ']) {
+      expect(() => assertRemoteTempDir(remote, `${base}${suffix}`, template))
+        .toThrow(/characters mktemp never generates/);
+    }
+    expect(assertRemoteTempDir(remote, `${base}Ab3De9`, template)).toBe(`${base}Ab3De9`);
+  });
+
+  test('requires at least three X, the POSIX minimum the template rule cites', () => {
+    // Pins the documented boundary: without this, X{3,} could be relaxed to X{1,} unnoticed.
+    expect(() => assertRemoteTempDir(remote, '/tmp/k-A', '/tmp/k-X')).toThrow(/at least three X/);
+    expect(() => assertRemoteTempDir(remote, '/tmp/k-AB', '/tmp/k-XX')).toThrow(/at least three X/);
+    expect(assertRemoteTempDir(remote, '/tmp/k-ABC', '/tmp/k-XXX')).toBe('/tmp/k-ABC');
+  });
+
+  test('rejects a relative path even though the template bound implies absoluteness', () => {
+    expect(() => assertRemoteTempDir(remote, 'tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9', template))
+      .toThrow(/not absolute/);
+  });
+});
+
+/**
+ * The validator above is only worth anything if it is on the path that creates the temp dir and
+ * on the path that deletes it. Nothing pinned that: removing both calls reverted the fix this
+ * PR exists to make and left every test in this file passing.
+ *
+ * `createRemoteTempDir` and `removeRemoteTempDir` therefore take their ssh work as a parameter,
+ * so these tests drive the real functions - the ones that decide whether the validator runs -
+ * with stubs, instead of a private re-implementation of them. Deleting either validation call
+ * now fails here.
+ *
+ * The negative in the delete case is the one that matters: when the value does not validate, the
+ * remote delete must not be ATTEMPTED at all. Asserting only that a throw happened would still
+ * pass if the `rm -rf` had already been sent.
+ *
+ * They live in `scripts/lib/`, not in the smoke script, deliberately: importing the smoke script
+ * into this suite is what installed a package on a reviewer's machine, and a test file that
+ * imports it would re-arm exactly that trap the moment the direct-invocation guard regressed.
+ */
+describe('remote temp dir guard wiring', () => {
+  const remote = 'linux-node-a';
+  const template = '/tmp/knowledge-linux-node-a-0.0.0-test-XXXXXX';
+  const good = '/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9';
+
+  // Everything a wrapper can hand back while still exiting 0, which is the reachable hole:
+  // runChecked already aborts on a non-zero remote exit.
+  const rejectedValues = [
+    '',
+    'Welcome to linux-node-a\n/tmp/knowledge-linux-node-a-0.0.0-test-Ab3De9',
+    `${good}\nmktemp: failed`,
+    '/tmp/somebody-elses-dir',
+    `${good}/nested`,
+    '/',
+    '/home/hasna',
+  ];
+
+  test('createRemoteTempDir validates what mktemp returned before returning it', () => {
+    // `undefined` is a create-only case - a wrapper that returned nothing at all. On the delete
+    // side a nullish value means creation never happened, which is a separate test below.
+    for (const bad of [...rejectedValues, undefined]) {
+      expect(() => createRemoteTempDir(remote, template, () => bad), JSON.stringify(bad))
+        .toThrow(/Refusing to use remote temp dir/);
+    }
+  });
+
+  test('createRemoteTempDir trims and returns a path the template could have produced', () => {
+    expect(createRemoteTempDir(remote, template, () => `${good}\n`)).toBe(good);
+  });
+
+  test('createRemoteTempDir validates against the same template it asked mktemp for', () => {
+    // A guard checking a different template than the one that created the directory would be
+    // no guard at all.
+    const asked: Array<[string, string]> = [];
+    createRemoteTempDir(remote, template, (host, requested) => {
+      asked.push([host, requested]);
+      return good;
+    });
+    expect(asked).toEqual([[remote, template]]);
+  });
+
+  test('removeRemoteTempDir never attempts a delete for a value that does not validate', () => {
+    const deleted: string[] = [];
+    const reported: string[] = [];
+    const io = {
+      deleteDir: (dir: string) => { deleted.push(dir); },
+      report: (what: string) => { reported.push(what); },
+    };
+
+    for (const bad of rejectedValues) {
+      expect(removeRemoteTempDir(remote, bad, template, io), JSON.stringify(bad)).toBe(false);
+    }
+
+    expect(deleted).toEqual([]);
+    expect(reported).toHaveLength(rejectedValues.length);
+    for (const what of reported) expect(what).toContain('refusing remote cleanup');
+  });
+
+  test('removeRemoteTempDir deletes exactly the validated directory', () => {
+    const deleted: string[] = [];
+    const reported: string[] = [];
+    const result = removeRemoteTempDir(remote, good, template, {
+      deleteDir: (dir: string) => { deleted.push(dir); },
+      report: (what: string) => { reported.push(what); },
+    });
+
+    expect(result).toBe(true);
+    expect(deleted).toEqual([good]);
+    expect(reported).toEqual([]);
+  });
+
+  test('removeRemoteTempDir does nothing, and reports nothing, when creation never happened', () => {
+    // runSyncSmoke calls this from `finally` with remoteDir still null whenever creation threw.
+    const deleted: string[] = [];
+    const reported: string[] = [];
+    const io = {
+      deleteDir: (dir: string) => { deleted.push(dir); },
+      report: (what: string) => { reported.push(what); },
+    };
+
+    expect(removeRemoteTempDir(remote, null, template, io)).toBe(false);
+    expect(removeRemoteTempDir(remote, undefined, template, io)).toBe(false);
+    expect(deleted).toEqual([]);
+    expect(reported).toEqual([]);
+  });
+
+  test('removeRemoteTempDir reports a failed delete instead of throwing out of a finally', () => {
+    // A throw here would replace the in-flight smoke failure with a cleanup error and skip the
+    // rest of the cleanup.
+    const reported: string[] = [];
+    expect(() => removeRemoteTempDir(remote, good, template, {
+      deleteDir: () => { throw new Error('ssh: command not found'); },
+      report: (what: string) => { reported.push(what); },
+    })).not.toThrow();
+    expect(reported).toHaveLength(1);
+    expect(reported[0]).toContain(good);
+  });
+
+  /**
+   * The behavioural tests above pin the gate; this pins that the gate is on the path.
+   * `mktemp -d` and `rm -rf` may each appear exactly once in the smoke script, inside the helper
+   * handed to the guarded function - so an inlined, unvalidated delete cannot quietly grow
+   * beside it.
+   *
+   * Read through the transpiler rather than the raw file, for the same reason the published
+   * import check does: the docstrings around these helpers quote the very commands being
+   * counted, and stripping comments with anything less than a parser is a guess that fails
+   * silently.
+   */
+  test('the smoke script reaches remote mktemp and rm -rf only through the guarded helpers', () => {
+    const code = new Bun.Transpiler({ loader: 'js' })
+      .transformSync(readFileSync(script, 'utf8'))
+      .replace(/\s+/g, ' ');
+
+    expect([...code.matchAll(/mktemp -d/g)]).toHaveLength(1);
+    expect([...code.matchAll(/rm -rf/g)]).toHaveLength(1);
+    expect(code).toMatch(/import \{ createRemoteTempDir, removeRemoteTempDir \} from ['"]\.\/lib\/remote-temp-dir\.mjs['"]/);
+    expect(code).toMatch(/createRemoteTempDir\(options\.remote, remoteTemplate, remoteMktemp\)/);
+    expect(code).toMatch(/removeRemoteTempDir\(options\.remote, remoteDir, remoteTemplate, \{/);
+    expect(code).toMatch(/deleteDir: \(?dir\)? => remoteRemoveDir\(options\.remote, dir\)/);
+  });
+});
diff --git a/tests/package-release.test.ts b/tests/package-release.test.ts
index 3b0df20..377cf97 100644
--- a/tests/package-release.test.ts
+++ b/tests/package-release.test.ts
@@ -6,7 +6,7 @@
 import { describe, expect, test } from 'bun:test';
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { dirname, join, posix } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
@@ -27,6 +27,9 @@ const publicDocs = [
 
 const publicScripts = [
   'scripts/apply-cloud-migrations.mjs',
+  // Imported by scripts/smoke-machine-sync-release.mjs, so it must ship with it or the
+  // published script fails to resolve at runtime.
+  'scripts/lib/remote-temp-dir.mjs',
   'scripts/smoke-machine-sync-release.mjs',
   'scripts/smoke-machines-adapter.mjs',
   'scripts/smoke-open-files-installed-boundary.mjs',
@@ -40,6 +43,41 @@ const forbiddenPackagePaths = [
 ].sort();
 
 describe('public package release safety', () => {
+  // Node's builtin list, hardcoded on purpose. `builtinModules` under `bun test` returns BUN's
+  // list, which includes `ws`, `undici` and `bun` - real npm package names that are NOT Node
+  // builtins, so using it would bless imports that throw for every node installer.
+  const NODE_BUILTINS = new Set([
+    'assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants',
+    'crypto', 'dgram', 'diagnostics_channel', 'dns', 'domain', 'events', 'fs', 'http', 'http2',
+    'https', 'inspector', 'module', 'net', 'os', 'path', 'perf_hooks', 'process', 'punycode',
+    'querystring', 'readline', 'repl', 'stream', 'string_decoder', 'timers', 'tls', 'trace_events',
+    'tty', 'url', 'util', 'v8', 'vm', 'wasi', 'worker_threads', 'zlib',
+  ]);
+
+  /** Does the published package ship this repo-relative path? */
+  const isShippedPath = (repoRelativePath: string): boolean => {
+    // npm always includes package.json regardless of `files`, and a version string read from
+    // it is an ordinary thing for a published script to do.
+    if (repoRelativePath === 'package.json') return true;
+    const shipped = (packageJson as unknown as { files?: string[] }).files ?? [];
+    return shipped.some((entry) => {
+      const normalized = entry.replace(/\/+$/, '');
+      return repoRelativePath === normalized || repoRelativePath.startsWith(`${normalized}/`);
+    });
+  };
+
+  // Pre-existing breakage, each verified against a packed tarball and tracked in todos.
+  // Every entry must be removed by its task; removing one and not the others leaves the
+  // published script still throwing, so they are listed individually.
+  const knownUnresolvedImports = new Set([
+    // task 1eb481d5 - src/ is not in `files`
+    'scripts/apply-cloud-migrations.mjs -> ../src/storage.ts',
+    // task 1eb481d5 - @hasna/contracts is a devDependency only
+    'scripts/apply-cloud-migrations.mjs -> @hasna/contracts/auth',
+    // task 104f993d - bun:sqlite throws ERR_UNSUPPORTED_ESM_URL_SCHEME under node
+    'scripts/smoke-open-files-installed-boundary.mjs -> bun:sqlite',
+  ]);
+
   test('package files list public docs explicitly', () => {
     expect(packageJson.files).not.toContain('docs');
     expect(packageJson.files).not.toContain('docs/*');
@@ -61,6 +99,185 @@ describe('public package release safety', () => {
     }
   });
 
+  /**
+   * Imports of a published script that would NOT resolve for someone who installed the
+   * package. Returns the offending specifiers, so both the enforcement test and the tests
+   * that pin it call THIS function - if it stops reporting, both fail.
+   *
+   * That structure is the point. Three previous versions of this check could each be replaced
+   * with something that reports nothing while the whole suite stayed green, because the tests
+   * that were supposed to pin them exercised a private copy of the logic instead of the logic
+   * itself. Silent-green was the defect; moving the implementation never fixed it.
+   *
+   * Scope limit, stated rather than implied by the name: the transpiler reports `import`,
+   * `import()` and `export … from`. It does NOT report `require()`, `import.meta.resolve()`,
+   * or `new URL('./x', import.meta.url)`. No published script uses those today, and the last
+   * is the plausible one to appear, since it is how you reference a sibling that must be in
+   * `files`. A file the transpiler cannot parse throws, so that path is loud, not silent.
+   *
+   * Imports are extracted with the real transpiler, NOT by stripping comments and matching a
+   * regex. Two hand-written strippers were tried and both had the same defect: a `/*` inside
+   * an ordinary string opened a phantom comment and silently deleted real imports. The second
+   * only moved the trigger - a regex literal containing a quote (`/['"]/`) shifted it into
+   * string state and everything after it vanished. Extracting imports is a parsing problem;
+   * anything short of a parser is a guess that fails silently.
+   */
+  function unresolvableImportsIn(script: string, source: string): string[] {
+    const transpiler = new Bun.Transpiler({ loader: 'ts' });
+    const runtimeDeps = new Set(Object.keys(
+      (packageJson as unknown as { dependencies?: Record<string, string> }).dependencies ?? {},
+    ));
+
+    /**
+     * Only `node:`-prefixed builtins are unconditionally resolvable.
+     *
+     * Deliberately NOT allowed, each verified against this repo rather than assumed:
+     *  - unprefixed builtins. `builtinModules` under `bun test` is BUN's list, which contains
+     *    `ws`, `undici` and `bun` - real npm package names that are NOT Node builtins, so a
+     *    published script importing `ws` would pass here and throw for every node installer.
+     *  - the package's own name. No published script imports it; that allowance existed only
+     *    to mask a phantom the old regex stripper invented from a template literal, which a
+     *    real parser does not report at all.
+     *  - `#`-prefixed subpaths. package.json has no `imports` map, so every one is guaranteed
+     *    to fail with ERR_PACKAGE_IMPORT_NOT_DEFINED.
+     *  - `bun:` builtins. They resolve under Bun and throw ERR_UNSUPPORTED_ESM_URL_SCHEME
+     *    under node, so they are exempted by name below, never blessed as a class.
+     */
+    // `node:`-prefixed builtins, unprefixed NODE builtins, and self-reference through the
+    // package's own `exports` map all resolve from a real install - each verified against an
+    // extracted tarball under node, not assumed. Deleting these outright was a false positive:
+    // `import { sep } from 'path'` and `@hasna/knowledge/storage` both resolve.
+    //
+    // Still NOT allowed, also verified: `@hasna/knowledge/<undeclared>`
+    // (ERR_PACKAGE_PATH_NOT_EXPORTED), `#`-prefixed (ERR_PACKAGE_IMPORT_NOT_DEFINED, no
+    // `imports` map), and `ws`/`undici`/`bun` (ERR_MODULE_NOT_FOUND - they are in BUN's
+    // builtinModules, not Node's, which is why NODE_BUILTINS is hardcoded).
+    const exportsMap = (packageJson as unknown as { exports?: Record<string, unknown> }).exports ?? {};
+    const ownName = (packageJson as unknown as { name?: string }).name ?? '';
+    const exportedSubpaths = new Set(
+      Object.keys(exportsMap).map((key) => (key === '.' ? ownName : `${ownName}/${key.replace(/^\.\//, '')}`)),
+    );
+
+    const isAlwaysResolvable = (specifier: string): boolean => {
+      if (specifier.startsWith('node:')) return true;
+      if (NODE_BUILTINS.has(specifier)) return true;
+      return ownName !== '' && exportedSubpaths.has(specifier);
+    };
+
+    const unresolvable: string[] = [];
+    for (const { path: specifier } of transpiler.scan(source).imports) {
+      if (knownUnresolvedImports.has(`${script} -> ${specifier}`)) continue;
+      if (isAlwaysResolvable(specifier)) continue;
+
+      if (specifier.startsWith('.')) {
+        const resolved = posix.normalize(posix.join(posix.dirname(script), specifier));
+        // Checked against everything the package SHIPS, not just the scripts allowlist:
+        // `../package.json` and `../dist/index.js` are published and resolve from a real
+        // install, and both were reported as breakage by the scripts-only check.
+        if (!isShippedPath(resolved)) unresolvable.push(specifier);
+        continue;
+      }
+
+      const pkg = specifier.startsWith('@')
+        ? specifier.split('/').slice(0, 2).join('/')
+        : specifier.split('/')[0];
+      if (!runtimeDeps.has(pkg)) unresolvable.push(specifier);
+    }
+    return unresolvable;
+  }
+
+  /**
+   * A published script that imports something the package does not ship resolves fine in the
+   * repo and throws ERR_MODULE_NOT_FOUND for everyone who installs it. The allowlists above
+   * only catch the opposite mistake (shipping something unreviewed), so this closes the gap.
+   */
+  test('every import in a published script resolves from the published package', () => {
+    for (const script of publicScripts) {
+      const source = readFileSync(join(repoRoot, script), 'utf8');
+      expect(unresolvableImportsIn(script, source), `unresolvable imports in ${script}`).toEqual([]);
+    }
+  });
+
+  /**
+   * Pins the function above against the mutation that kept slipping through: every previous
+   * version could be replaced with something that reports nothing while the suite stayed
+   * green. Each case below drives the REAL function, so disabling the extractor, widening the
+   * exemptions, or making everything "always resolvable" fails here.
+   */
+  test('the published-import check reports real breakage, in every shape', () => {
+    const check = (source: string) => unresolvableImportsIn('scripts/probe.mjs', source);
+
+    // The two shapes that defeated both hand-written strippers.
+    expect(check(`const g = '**/*.ts';\nimport bad from 'ghost-a';`)).toContain('ghost-a');
+    expect(check(`const q = /['"]/g;\nconst g = '**/*.json';\nconst m = import('ghost-b');`)).toContain('ghost-b');
+    expect(check(`const re = /[a\\/*]/;\nimport bad from 'ghost-c';`)).toContain('ghost-c');
+    // Every import form the check claims to cover.
+    expect(check(`import './not-shipped.mjs';`)).toContain('./not-shipped.mjs');
+    expect(check(`export { a } from './not-shipped2.mjs';`)).toContain('./not-shipped2.mjs');
+    expect(check(`export * from './not-shipped3.mjs';`)).toContain('./not-shipped3.mjs');
+    expect(check(`const m = await import('ghost-d');`)).toContain('ghost-d');
+    // The allowances are exactly as narrow as documented.
+    expect(check(`import x from 'ws';`)).toContain('ws');
+    expect(check(`import x from 'undici';`)).toContain('undici');
+    expect(check(`import x from '#internal/x.js';`)).toContain('#internal/x.js');
+    expect(check(`import x from '@hasna/knowledge/not-in-exports';`)).toContain('@hasna/knowledge/not-in-exports');
+    expect(check(`import { Database } from 'bun:sqlite';`)).toContain('bun:sqlite');
+
+    // ...and legitimate code is not reported, or the check false-positives and gets widened.
+    // Every entry below was verified to RESOLVE from an extracted tarball under node.
+    expect(check(`import { readFileSync } from 'node:fs';`)).toEqual([]);
+    expect(check(`import { z } from 'zod';`)).toEqual([]);
+    // Unprefixed Node builtins resolve; nothing in this repo forces the node: prefix.
+    expect(check(`import { sep } from 'path';`)).toEqual([]);
+    expect(check(`import { readFileSync as r } from 'fs';`)).toEqual([]);
+    expect(check(`import { spawnSync } from 'child_process';`)).toEqual([]);
+    // Self-reference resolves for subpaths the exports map declares - and only those.
+    expect(check(`import x from '@hasna/knowledge';`)).toEqual([]);
+    expect(check(`import x from '@hasna/knowledge/storage';`)).toEqual([]);
+    // Shipped non-script files are published and resolve.
+    expect(check(`import pkg from '../package.json' with { type: 'json' };`)).toEqual([]);
+    expect(check(`// import dead from 'ghost-e';`)).toEqual([]);
+    expect(check(`/* import dead from 'ghost-f'; */`)).toEqual([]);
+    expect(check(`const s = "import x from 'ghost-g'";`)).toEqual([]);
+    // A child script emitted as a template literal is data, not an import of this file.
+    expect(check("const child = `import { k } from '@hasna/knowledge';`;")).toEqual([]);
+  });
+
+  test('the exemptions stay narrow, and each names real breakage', () => {
+    const transpiler = new Bun.Transpiler({ loader: 'ts' });
+    const importsOf = (script: string) =>
+      transpiler.scan(readFileSync(join(repoRoot, script), 'utf8')).imports.map((i) => i.path);
+
+    // Each exempted import must still exist; a stale exemption invites the next one to be
+    // added without evidence.
+    expect(importsOf('scripts/apply-cloud-migrations.mjs')).toContain('../src/storage.ts');
+    expect(importsOf('scripts/apply-cloud-migrations.mjs')).toContain('@hasna/contracts/auth');
+    expect(importsOf('scripts/smoke-open-files-installed-boundary.mjs')).toContain('bun:sqlite');
+
+    // ...and each is genuinely unresolvable, not merely unfamiliar.
+    expect(packageJson.files).not.toContain('src');
+    const deps = (packageJson as unknown as { dependencies?: Record<string, string> }).dependencies ?? {};
+    expect(Object.keys(deps)).not.toContain('@hasna/contracts');
+
+    // Derived from the Set, never restated. A hardcoded copy meant ADDING an exemption was
+    // pinned by nothing: a genuinely broken import plus a matching entry left the file green.
+    expect(knownUnresolvedImports.size).toBeGreaterThan(0);
+    for (const key of [...knownUnresolvedImports]) {
+      const separator = key.indexOf(' -> ');
+      const script = key.slice(0, separator);
+      const specifier = key.slice(separator + 4);
+      // Every exemption must name a script that is actually published...
+      expect(publicScripts, `exemption names an unpublished script: ${key}`).toContain(script);
+      knownUnresolvedImports.delete(key);
+      try {
+        expect(unresolvableImportsIn(script, readFileSync(join(repoRoot, script), 'utf8')))
+          .toContain(specifier);
+      } finally {
+        knownUnresolvedImports.add(key);
+      }
+    }
+  });
+
   test('npm pack dry-run includes only public docs', () => {
     const result = spawnSync('node', ['scripts/validate-public-package.mjs', '--json'], {
       cwd: repoRoot,