From 1b739a95c949cbbfa52de7bd7e217854ef1aaa6a Mon Sep 17 00:00:00 2001
From: m4air <m4air@Mac.localdomain>
Date: Wed, 16 Sep 2026 00:56:32 -0700
Subject: [PATCH] test: load audit fixtures as modules and verify combined
 mobile payload

---
 .../structured-hold-retention/README.md       |  3 ++-
 .../structured-hold-retention/reproduce.mjs   | 25 +++++++++++++------
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/docs/audits/structured-hold-retention/README.md b/docs/audits/structured-hold-retention/README.md
index 030db63a9c6..c0076813f6c 100644
--- a/docs/audits/structured-hold-retention/README.md
+++ b/docs/audits/structured-hold-retention/README.md
@@ -6,7 +6,8 @@ Run from the repository root:
 ORCA_BACKGROUND_LAUNCH=1 node docs/audits/structured-hold-retention/reproduce.mjs
 ```
 
-The script bundles the actual `StructuredAgentSessionHolds` implementation in memory. It runs it
+The script bundles the actual `StructuredAgentSessionHolds` implementation into temporary CommonJS
+modules, loads them normally, and removes their files and module-cache entries. It runs the code
 once without the post-resume holder check and once with the current source. It uses a deferred
 provider acquisition, an isolated fake child, and a 5 ms release grace. It launches no application,
 provider, or terminal and reads no user profile.
diff --git a/docs/audits/structured-hold-retention/reproduce.mjs b/docs/audits/structured-hold-retention/reproduce.mjs
index 68658113a52..b1e6ed5c32c 100644
--- a/docs/audits/structured-hold-retention/reproduce.mjs
+++ b/docs/audits/structured-hold-retention/reproduce.mjs
@@ -1,6 +1,8 @@
 import { createHash } from 'node:crypto'
-import { readFile } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { build } from 'esbuild'
 
@@ -46,13 +48,20 @@ async function loadHolds(withPostResumeCheck) {
       }
     ]
   })
-  const loaded = { exports: {} }
-  new Function('module', 'exports', 'require', result.outputFiles[0].text)(
-    loaded,
-    loaded.exports,
-    createRequire(import.meta.url)
-  )
-  return loaded.exports.StructuredAgentSessionHolds
+  const scratch = await mkdtemp(join(tmpdir(), 'orca-structured-hold-proof-'))
+  const require = createRequire(import.meta.url)
+  let moduleId
+  try {
+    const bundlePath = join(scratch, 'holds.cjs')
+    await writeFile(bundlePath, result.outputFiles[0].text)
+    moduleId = require.resolve(bundlePath)
+    return require(moduleId).StructuredAgentSessionHolds
+  } finally {
+    if (moduleId) {
+      delete require.cache[moduleId]
+    }
+    await rm(scratch, { recursive: true, force: true })
+  }
 }
 
 async function reproduce(Holds) {