- Tripwire scans execFileSync too (ceiling 8: two more grep-needle string
exemptions); merge-introduced timeout-less spawnSync in
question-preference-hook fixed — the tripwire caught a site that landed
on main AFTER the sweep, on its first day.
- gstack-detach gains TWO watchdog kill regression tests: TERM-immune
grandchild (the killpg-after-grace escalation) and the leader-dies
variant (the pgid-at-spawn fix — the case the first test cannot see).
- eval-flake-rank gets its unit suite (final-attempt accounting, artifact
exclusion, shard recursion, recency bound).
- Groupkill/startup-grace shim markers are per-run unique (pid-suffixed
sleep durations): sibling Conductor worktrees run free suites with no
machine lock, and fixed markers let one run pgrep/pkill the other's
shims — a cross-run flake inside the anti-flake tests.
- flake-ledger test pins the project-scoped local default; stale empty
section headers in touchfiles-data deleted (they invited entries under
deliberately retired categories).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Free scanner over all test trees (test/, browse/test/, design/test/,
make-pdf/test/, ios-qa, browser-skills): every spawnSync/execSync/
Bun.spawnSync call site must carry a timeout within a 30-line options
window, or an explicit '// tripwire-exempt: <reason>' marker. Comment
lines are skipped; exemptions are counted and ratcheted shrink-only
(ceiling 6 = the 6 string-fixture/grep-needle sites where the pattern is
CONTENT, not a call — marked in this commit). A scan-sanity test pins that
the scanner still sees >100 real call sites so it can never rot to a
vacuous green. Companion to the 436-site sweep in the previous commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
