test: review-army + adversarial test hardening

- Tripwire scans execFileSync too (ceiling 8: two more grep-needle string
  exemptions); merge-introduced timeout-less spawnSync in
  question-preference-hook fixed — the tripwire caught a site that landed
  on main AFTER the sweep, on its first day.
- gstack-detach gains TWO watchdog kill regression tests: TERM-immune
  grandchild (the killpg-after-grace escalation) and the leader-dies
  variant (the pgid-at-spawn fix — the case the first test cannot see).
- eval-flake-rank gets its unit suite (final-attempt accounting, artifact
  exclusion, shard recursion, recency bound).
- Groupkill/startup-grace shim markers are per-run unique (pid-suffixed
  sleep durations): sibling Conductor worktrees run free suites with no
  machine lock, and fixed markers let one run pgrep/pkill the other's
  shims — a cross-run flake inside the anti-flake tests.
- flake-ledger test pins the project-scoped local default; stale empty
  section headers in touchfiles-data deleted (they invited entries under
  deliberately retired categories).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/gstack-detach.test.ts

@@ -69,6 +69,59 @@ describe('gstack-detach', () => {
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   }, 16000);
 
+  test('watchdog group-SIGKILLs TERM-immune grandchildren (no orphan survives)', () => {
+    // Regression pin for the 2026-08 escalation change: the watchdog used to
+    // follow its killpg(SIGTERM) + 5s grace with a DIRECT proc.kill() — a
+    // grandchild that ignores TERM survived and burned cores/API for hours
+    // (the observed 15-hour-orphan class). Now the grace escalates to
+    // killpg(SIGKILL). The child here traps TERM and spawns a TERM-immune
+    // grandchild; only a GROUP SIGKILL clears both. Markers are per-run
+    // unique (pid) so concurrent worktree suites can't cross-kill.
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gd-'));
+    const log = path.join(dir, 'run.log');
+    const g1 = `6091.${process.pid}`;
+    const g2 = `6092.${process.pid}`;
+    const alive = (m: string) => spawnSync('pgrep', ['-f', `sleep ${m.replace('.', '\\.')}`], { stdio: 'pipe', timeout: 5_000 }).status === 0;
+    try {
+      spawnSync(DETACH, ['--log', log, '--timeout', '1', '--', 'bash', '-c',
+        `trap '' TERM; (trap '' TERM; sleep ${g1}) & exec sleep ${g2}`],
+        { encoding: 'utf-8', timeout: 10000 });
+      expect(waitFor(() => logHas(log, '### gstack-detach EXIT=timeout ###'), 15000)).toBe(true);
+      // Grace is 5s after the TERM that both processes ignore — the SIGKILL
+      // escalation must clear the whole group shortly after the sentinel.
+      expect(waitFor(() => !alive(g1) && !alive(g2), 10000),
+        'TERM-immune child/grandchild survived the watchdog — killpg(SIGKILL) escalation regressed').toBe(true);
+    } finally {
+      spawnSync('pkill', ['-9', '-f', `sleep 609[12]\\.${process.pid}`], { stdio: 'ignore', timeout: 5_000 });
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30000);
+
+  test('watchdog kills the grandchild even when the LEADER dies on the SIGTERM', () => {
+    // The pgid-after-grace bug: killpg(getpgid(proc.pid), SIGKILL) raised
+    // ESRCH once the leader had honored the TERM, and the except fell back
+    // to proc.kill() on a corpse — the TERM-immune grandchild lived forever.
+    // The fix captures the pgid AT SPAWN. This variant is the one the
+    // TERM-immune-leader test above cannot see.
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gd-'));
+    const log = path.join(dir, 'run.log');
+    const g = `6093.${process.pid}`;
+    const alive = () => spawnSync('pgrep', ['-f', `sleep ${g.replace('.', '\\.')}`], { stdio: 'pipe', timeout: 5_000 }).status === 0;
+    try {
+      // Leader: no trap — dies on the watchdog's SIGTERM. Grandchild:
+      // TERM-immune, same group — only a saved-pgid SIGKILL reaches it.
+      spawnSync(DETACH, ['--log', log, '--timeout', '1', '--', 'bash', '-c',
+        `(trap '' TERM; sleep ${g}) & sleep 60`],
+        { encoding: 'utf-8', timeout: 10000 });
+      expect(waitFor(() => logHas(log, '### gstack-detach EXIT=timeout ###'), 15000)).toBe(true);
+      expect(waitFor(() => !alive(), 10000),
+        'grandchild survived a dead leader — the pgid must be captured at spawn, not resolved after the grace').toBe(true);
+    } finally {
+      spawnSync('pkill', ['-9', '-f', `sleep 6093\\.${process.pid}`], { stdio: 'ignore', timeout: 5_000 });
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30000);
+
   test('machine --lock serializes concurrent runs (second WAITS for the first)', () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gd-'));
     const lock = `gstack-detach-test-${process.pid}`;