fix(test-runner): finish guarded execution and environment hygiene

[pacphi]

Scope

V5 of the approved remediation program, targeting develop. The aggregate develop → main PR remains for human review.

• Guard focused test runs, record run ownership, retain interrupted/unknown sibling roots, and report cleanup failures honestly.
• Let participating tests hold a run directory until their owned processes are confirmed stopped; retain uncertain roots.
• Prove interruption, cancellation, and Windows smoke-child cleanup behavior with bounded process fixtures.
• Restrict Chrome's environment and give it private state/temp paths.
• Preserve developer tool-selector propagation, refine exact concurrent-writer exceptions, and test the actual About renderer.
• Archive the completed runner plan/research after handing over the reviewed, read-only backlog inventory.

Evidence

Independent task reviews, one whole-branch review, and the scoped final correction review passed. Full local gate at e0fcc2eb:

• Unit: 5,947 passed, 0 failed, 6 native-Windows-only skips.
• Coverage: 94.33% lines, 83.27% branches, 93.47% functions.
• UI: 495 dashboard checks and 15 Node tests passed using installed Chrome.
• Typecheck, lint, complexity ceiling, Markdown, build/pack validation and offline links passed.
• Normal-home real-state tripwire reported no changes; completed suite roots were removed and existing unknown siblings retained.

Final documentation commit c9baf6a4 changes only the two completed plan/research records and archive index. The relocation was independently reviewed; 17 documentation tests, Markdown and internal links passed. The immutable private backlog snapshot was independently reconciled: 34,034 entries total; manual-review sections A 33,978 / B 4 / C 3, with 49 entries retained by the stated exclusions. These are historical counts, not deletion authorization.

Actions validated the final head 36d78caf2fca6a61b7fd924499da9541ae85060c in three consecutive complete 13-job runs, including native Windows and Linux Chrome. This PR does not claim universal descendant discovery: sibling reclamation remains list-only on every platform, and holds protect participating callers.

Operational boundaries

The temporary backlog inventory is a private, point-in-time manual review artifact containing literal machine paths. No backlog removal was performed. Releases, global installation and the final main merge remain deferred under the approved plan.

Unit commits

• b2d7a3ad docs(plan): map runner hygiene tasks and evidence gates
• 0027ad26 docs(research): how test temp folders leak and how a run root is proven abandoned
• 55f444b6 docs(research): complete test creator lifecycle census
• 17833652 docs(research): account for parent cleanup in credential census
• 3cb5a1e2 test(about): render the Ruflo install-edit line on the About card
• 705bd5ff test(tripwire): list the live Ruflo session's .claude-flow folder and proven-config files as concurrent writers
• dd663f6b fix(test-runner): guard owner roots and keep sibling cleanup list-only
• 3365429e fix(test-runner): fail hygiene on own-root cleanup errors
• d3b09a85 feat(test-runner): guard focused runs and prove interrupted retention
• 0cc5c11d test(test-runner): observe orphan exit before retention check
• 9b5b3a43 test(runner): preserve tool selector propagation
• a50223fa fix(ui): isolate Chrome launch environment
• 5d322f8e test(status): await owned spawn guard child before cleanup
• 6f716f85 test(runner): verify owned fork exits before sandbox cleanup
• 1fe3e61e test(runner): retain own root for unresolved child holds
• e0fcc2eb test(runner): await owned process cleanup on cancellation
• c9baf6a4 docs(archive): record completed runner hygiene work

CI compatibility corrections

The first matrix run found a Node 22 event-loop difference in the intentional timeout fixture and a Windows-specific self-termination result. Test-only commits 5afaa4bb and dea09999 retain the exact 500 ms timeout assertion and exercise native parent-owned signal termination without fabricating a result. Node 22.22.3 and Node 26.4.0 focused gates each passed 55/55; independent Node 22 verification passed 29/29 with a strict tripwire. Production code is unchanged. The final revision subsequently passed the complete native CI matrix three consecutive times.

• 5afaa4bb test(runner): keep cancellation timeout fixture alive on Node 22
• dea09999 test(runner): use owned native termination for signal retention

Final Windows cleanup correction and CI

A later repetition exposed native Windows EBUSY after the fixture had already confirmed process exit. Commit 36d78caf adds bounded test-fixture removal retries (four attempts, 100/200/300 ms waits), preserves an original assertion failure alongside cleanup failure, and tests transient and exhausted removal behavior. The kernel cause was not established. Production code is unchanged. Node 22 and Node 26 focused runs passed 57/57 each; independent fault-injection and strict-tripwire checks passed.

• 36d78caf test(runner): retry fixture removal after confirmed child exit

All results below bind the same final source revision. Earlier failed attempts remain part of the evidence; they were not counted as successful runs.

CI attempt	Result	Windows Node 22	Windows Node 24	Windows Node 26
1	13/13 successful	217 s	222 s	175 s
2	13/13 successful	209 s	246 s	210 s
3	13/13 successful	278 s	264 s	208 s

This meets the three-consecutive-run timing criterion at the current revision. It does not rewrite the historical V1 record or guarantee every future Windows run will take less than five minutes.

Final private inventory handoff

After the last code changes and CI, a fresh source-bound inventory at 36d78caf recorded 34,039 entries: A 33,978 / B 4 / C 3, plus 54 retained exclusions. An independent reviewer reconciled every section, literal path, current test attribution and 456 source hashes. Snapshot digest: d34711f58ea88bfc749ded636c819d586fcba16100f9ee4fd8b790fb6d505805. Original evidence remains preserved separately. A scratch JSON-parser difference is disclosed; none of the four suite roots had an owner record, so it affected no classification. The final list is private and remains a point-in-time review aid, not permission or proof to delete any folder.