chore(memory): record junction-symlink testing and fire-test ordering

Two non-obvious lessons from the readYAML/checkCase work:

- Directory symlinks in tests should use symlinkSync(target, path, "junction").
  The type arg is ignored on POSIX but on Windows creates a junction, which
  needs no admin rights and which lstat reports as a symlink — so the test
  runs everywhere instead of silently skipping, as the pre-existing
  leaf-symlink test had been doing.
- Commit before fire-testing a rule or guard: the mutate/verify/restore loop
  restores with git checkout, which discards all uncommitted work in that
  file, including the fix under test.

Signed-off-by: Rhuan Barreto <rhuan@barreto.work>

Author: rhuanbarreto

.claude/agent-memory/archgate-developer/project_rules_engine_internals.md

@@ -5,6 +5,8 @@ metadata:
   type: project
 ---
 
+- **Commit BEFORE fire-testing a rule or guard.** The fire-test loop (mutate a file → confirm the check fails → restore) restores with `git checkout <file>`, which discards ALL uncommitted work in that file — including the fix being tested. Cost a full re-apply of the safePath fix on 2026-07-25. Either commit first, or restore from an explicit `cp` backup rather than git.
+
 - **`Bun.Glob.scan()` silently fails for brace patterns with path separators.** `new Bun.Glob("svc/{src/env.ts,env.ts}").scan(...)` returns zero results (no error) while `.match()` works — the scanner wasn't updated when the match engine's brace expansion was rewritten in Bun 1.2.3. Filed upstream: [oven-sh/bun#32596](https://github.com/oven-sh/bun/issues/32596). Workaround: `expandBracePattern()` (now in `src/engine/glob-utils.ts`) pre-expands `/`-containing brace groups before scanning; only the scan fallback needs it.
 - **`Bun.Glob.match()` semantics (verified 2026-07-13, Bun 1.3.14):** matches dot-prefixed path segments WITHOUT any option (`**/*.yml` matches `.github/workflows/ci.yml` — scan needs `dot: true` for the same), handles `/`-containing brace groups correctly, `*` does not cross `/`. This is why in-memory matching (ARCH-023) is both faster and simpler than scanning: engine file listing matches patterns against the `git ls-files` set (minus `--deleted`) in memory; scan is fallback-only (non-git / `respectGitignore: false`), confined to `glob-utils.ts`/`git-files.ts`. Measured 7.2× engine speedup (1147ms→160ms) on a 333-tracked/43k-entry project.
 - **Pending follow-up (fix 3): `.rules.ts` load phase re-transpiles + meriyah-parses every rules file per invocation** (~700ms of remaining wall clock incl. Bun startup on the akerbp project). Plan: content-hash cache under `~/.archgate/`. User approved deferring to a separate PR (2026-07-13).

.claude/agent-memory/archgate-developer/project_test_isolation_gotchas.md

@@ -12,5 +12,6 @@ metadata:
 - **GCM prompt suppression needs 5 env vars**, not just `GIT_TERMINAL_PROMPT=0`: also `GCM_INTERACTIVE=never`, `GCM_GUI_PROMPT=false`, `GIT_ASKPASS=""`, `SSH_ASKPASS=""` (see `gitCredentialEnv()` in `src/helpers/credential-store.ts`).
 - **`bun:sqlite` file handles persist after `db.close()` on Windows.** `rmSync` on the temp dir in `afterEach` can throw `EBUSY`. Set `PRAGMA journal_mode = DELETE` to avoid WAL/SHM files, and wrap `rmSync` in try/catch.
 - **macOS `/var` → `/private/var` symlink breaks temp dir path comparisons.** `mkdtempSync` returns `/var/folders/...` but `process.cwd()` after `chdir()` resolves to `/private/var/...`. Always wrap with `realpathSync`. Invisible on ubuntu-only PR CI — only surfaces in release builds.
+- **Test DIRECTORY symlinks with `symlinkSync(target, path, "junction")` so the test runs on Windows instead of skipping.** The type arg is ignored on POSIX (plain symlink), but on Windows it creates a junction, which needs no admin rights and which `lstatSync().isSymbolicLink()` reports as `true`. FILE symlinks still need elevation/Developer Mode, so those keep the try/catch-and-return skip. Verified 2026-07-25 on the ARCH-024 ancestor-symlink fix (PR #499) — the existing leaf-symlink test in `check-security.test.ts` had been silently skipping on Windows for its whole life.
 - **Don't test that well-known tools exist on PATH** (e.g. `expect(resolveCommand("bun")).toBe("bun")`) — asserts CI environment state, not logic, and fails when tools are installed via shims. Delete such tests; the null-return and `.exe`-fallback tests already cover the real logic.
 - **Attach `.catch()` at promise creation, not at `await`.** When firing an async call in parallel (`const p = asyncFn()`) and awaiting later, Bun reports an unhandled rejection in the window between creation and the later `await p.catch(...)`. Fix: `const p = asyncFn().catch(() => null)` then `await p`.