From 0251acdad9b8e177d58aa4b44e70d39c24fb94f2 Mon Sep 17 00:00:00 2001
From: Jason Woltje <jason@diversecanvas.com>
Date: Thu, 12 Nov 2026 19:54:07 -0600
Subject: [PATCH] fix(packs): SP8 re-check, close before unlink cannot skip it;
 check the whole reason before the cut (#1873)

---
 packages/bus/src/broker.mjs                 | 5 +++--
 packages/organization/src/template-save.mjs | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
index 4df950a9a..0a8d48cb6 100644
--- a/packages/bus/src/broker.mjs
+++ b/packages/bus/src/broker.mjs
@@ -7048,8 +7048,9 @@ export class Broker {
   #templateFail(e) {
     if (e?.name === 'TemplateError' && TEMPLATE_CODES.includes(e.code)) {
       // A reason names a field path or a definition name; one that would quote a held value is dropped.
-      let reason = typeof e.reason === 'string' ? e.reason.slice(0, 300) : undefined;
-      if (reason !== undefined) try { this.#secretCheck(reason); } catch { reason = undefined; }
+      // The check reads the whole reason before the cut, so a held value cut short is still found.
+      let reason = typeof e.reason === 'string' ? e.reason : undefined;
+      if (reason !== undefined) try { this.#secretCheck(reason); reason = reason.slice(0, 300); } catch { reason = undefined; }
       throw new BusError(e.code, reason);
     }
     this.#packFail(e);
diff --git a/packages/organization/src/template-save.mjs b/packages/organization/src/template-save.mjs
index 4214fa1c9..a252b774d 100644
--- a/packages/organization/src/template-save.mjs
+++ b/packages/organization/src/template-save.mjs
@@ -440,8 +440,9 @@ export function templateSave({ document, name, project, digest, rolesDir, assert
     fsyncSync(fd);
   } catch (error) {
     // A partial file would hold the name: remove the file this call created, then report the failure.
-    closeSync(fd);
+    const open = fd;
     fd = undefined;
+    try { closeSync(open); } catch { /* the write failure is the one reported */ }
     try { unlinkSync(file); } catch { /* already gone */ }
     throw error;
   } finally {