From 56de5bc9534ac6df2523909cd2108a02b63ac110 Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Tue, 16 Jun 2026 22:51:34 -0700
Subject: [PATCH] fix(sources): route harden exit code through
 setCliExitVerdict

A raw process.exitCode write is zeroed by the owned-verdict flush-exit
(#2084 PGLite-Emscripten pollution defense); cli-exit-verdict-pin guard
caught it. Use setCliExitVerdict(3) so 'sources harden' actually reports
needs-attention to cron/automation.
---
 src/commands/sources-harden.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/commands/sources-harden.ts b/src/commands/sources-harden.ts
index d9691d862..60bc91d21 100644
--- a/src/commands/sources-harden.ts
+++ b/src/commands/sources-harden.ts
@@ -18,6 +18,7 @@ import {
   type DurabilityReport,
 } from '../core/brain-repo-durability.ts';
 import { divergenceSafePull, detectDefaultBranch } from '../core/git-remote.ts';
+import { setCliExitVerdict } from '../core/cli-force-exit.ts';
 import { existsSync } from 'fs';
 import { join } from 'path';
 
@@ -96,7 +97,9 @@ export async function runHarden(engine: BrainEngine, args: string[]): Promise<vo
   if (json) console.log(JSON.stringify({ reports }, null, 2));
 
   // Non-zero exit if any source needs attention, so cron/automation notices.
-  if (reports.some(r => r.needs_attention.length > 0)) process.exitCode = 3;
+  // Route through setCliExitVerdict — a raw process.exitCode write is zeroed by
+  // the owned-verdict flush-exit (#2084 / PGLite-Emscripten pollution defense).
+  if (reports.some(r => r.needs_attention.length > 0)) setCliExitVerdict(3);
 }
 
 function renderReport(r: DurabilityReport): void {