test(runner): publish sibling pids atomically in the cancellation case

[apackeer]

Summary

Fixes a rare race in t-e2e-isolated-runner's "an initial log-write failure cancels admitted siblings and stops the queue" case. Each waiting sibling recorded its pid in a witness file with writeFileSync. A sibling cancelled between creating the file and writing its pid left an empty witness; Number("") is 0, and the Windows native-identity check added in #1393 throws on pid 0 (native process identity requires a positive DWORD PID; got 0). The earlier signal-0 check would have failed too: process.kill(0, 0) probes the process group and succeeds. Seen once on Windows, in run 36100028193 for #1399.

Changes

• The waiting fixture writes its pid to <witness>.tmp and renames it into place, so a witness is never half written. The patched runner's wait for witness 1 now also waits for a complete pid.
• The check skips any .tmp left by a sibling cancelled mid-write, which has no pid to look for, and still requires at least one complete witness.

User experience

Test-only. No product behavior changes.

Checklist

If an item does not apply, leave it unchecked.

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented
• If this change adds an input to any fingerprint, epoch, or receipt identity, the description names the human-visible change it detects

Test plan

• Linux, locally: tests/integration/t-e2e-isolated-runner.test.ts (47 pass, 0 fail), typecheck, and bun scripts/package.ts.
• Windows: a cross-OS ci.yml dispatch on this branch (run 36102974411). The race is timing-dependent, so one green run shows the fix doesn't regress the case; it can't prove the race is gone.

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[github-actions]

AIDA findings ledger

No findings recorded yet.

Open blocking findings (P0/P1): 0. Accepted and rejected findings never count toward the next action.

Maintainer commands (repository write access) — put them on the first lines of a comment, one per line, several ids per line allowed:
/aida accept F# [F#…] <reason> · /aida reject F# [F#…] <reason> · /aida reopen F# [F#…] · /aida status · /aida full (next review covers the whole head)
P0 and P1 findings can be accepted (visible, risk owned by the maintainer) but not rejected. A comment is applied all-or-nothing.
Do not edit this comment: AIDA verifies its digest and refuses to run on an edited ledger. To start over, delete it.

ledger.json

{
  "version": 4,
  "pullRequest": 1400,
  "nextId": 1,
  "findings": [],
  "events": [],
  "review": {
    "head": "982fe5572cdc272f1624df7e1217a5adbe7b009e",
    "readiness": 5,
    "risk": 1,
    "decision": "merge"
  }
}

[github-actions]

Reviewed 982fe5572cdc272f1624df7e1217a5adbe7b009e against 44d0f38af6038a42f47fc95ce1e70e74a57ea728 and current repository behavior.

Inspection: 1 changed file. Scope: full head (first review of this pull request).

Final Assessment

Human decision aid only: Readiness 5/5 is best; Risk 1/5 is best. These scores inform the maintainer; the next action below follows finding severity (any open P0/P1 → author/change) and does not approve or merge the PR.

Readiness: 5/5 — The atomic witness publication directly removes the empty-file race while preserving the cancellation, queue-stoppage, and sibling-retirement assertions. No material gap was identified.

Risk: 1/5 — The change affects only one synthetic integration-test fixture, is narrow and reversible, and does not modify shipped runtime behavior or public contracts.

Decision required: Maintainer — decide whether to merge this PR. No surviving finding requires author correction; the test-only race fix preserves the intended cancellation coverage.

Validation performed:

• Classified as a test-only bug fix.
• Inspected repository instructions, PR metadata, full diff, changed-file manifest, head snapshot, scope, ledger, discussion, prior reviews, and all specialist outputs.
• Verified the sole head snapshot matches the immutable head commit and inspected the entire changed file.
• Traced the fixture through runner dispatch, abort propagation, scheduler draining, process-tree retirement, native PID checks, and testing documentation.
• Confirmed the final witness appears only after a same-directory rename, while incomplete temporary witnesses are excluded and at least one completed sibling PID remains required.
• Verified diff integrity with git diff --check.

Findings: 0 blocking, 0 advisory.

Ledger: 0 open, 0 retained blocking, 0 accepted, 0 suppressed as rejected by a maintainer. Maintainers act on findings with /aida commands in the ledger comment.

No findings.

User Experience

User experience change: The change only stabilizes an integration-test fixture that verifies runner cancellation; product commands and AI-DLC workflows are unchanged.

Assessment: There is no direct user interaction change. Contributors and CI operators indirectly benefit from avoiding a rare false Windows failure.

Residual risk: Repository tests were not executed because the review contract prohibits running repository code; validation was static and source-based.

Reviewed by AIDA (AI-DLC Developer Agent).

[AI-PR-REVIEWED] 982fe55

[apackeer]

Closing as superseded by #1369, which landed first and fixes the same race the same way: waiting siblings publish their pid by renaming it out of a pending directory, and the case now always plants an empty, unpublished witness to prove the check never reads one. This PR now conflicts with that version.