diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md
index 2925fa992..f0b7979b3 100644
--- a/docs/branch-review-ledger.md
+++ b/docs/branch-review-ledger.md
@@ -20,6 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 
 | Date       | Branch or ref                                            | Reviewed HEAD                            | Scope                                                      | Outcome                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Checks                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 2026-07-21 | main | 71059eba98bc6e335c2c82cb9ab542aad44dfae8 | database audit, drift analysis, and data contract review (/drift /data /audit) | Completed offline audit of database schema, migrations, generated drift manifest, function grants, owner-scope API boundaries, therapy data indexes, and data ingestion logic. Verified drift-manifest byte-identical match to schema.sql (schema_sha256: 50da0978a164...). Found one P2 static check failure: orphaned test tests/check-july8-live-batch.test.ts references deleted script scripts/check-july8-live-batch.ts, causing npm run check:knip and verify:cheap to fail. Live Supabase schema comparison and live ingestion audits were approval-gated and skipped per provider boundary rules. | Local offline checks run: Vitest 339/339 test files passed (3,053/3,054 tests passed, 1 skipped); tests/drift-detection.test.ts (10/10 passed); check:function-grants (28/28 SECURITY DEFINER functions revoked); check:owner-scope (40 API routes clean against 25 owner tables); check:therapy-data-index (205 records OK); check:design-system-contract (520 files clean); strict check:type-scale & check:icon-scale; check:runtime; check:github-actions; check:ci-scope; check:ci-triage; check:pr-policy; check:gate-manifest; check:codebase-index-coverage. Provider checks skipped (approval-gated): check:drift, check:supabase-project, check:migration-history, audit:source-governance. |
 | 2026-07-14 | multiple remote branches (16 refs) | multiple SHAs | remote branch cleanup | Safely deleted 16 fully merged and redundant remote branches on origin (including `claude/canary-gate-fixes`, `claude/codebase-index-coverage`, `claude/design-elevation-e1e2`, `claude/design-sync-fixes-p1`, `claude/docs-script-linter`, `claude/document-image-viewer-review-ox7t11`, `claude/generation-token-starvation-fix`, `claude/github-actions-codex-issue-f4t4s5`, `claude/hero-composer-hydration`, `claude/pdf-signed-url-refresh`, `claude/pt-audit-monitor-marker-fix`, `claude/pt-audit-pr2-variant-early-exit`, `claude/pt-audit-pr4-trust-copy`, `claude/pt-audit-pt17-live-monitor`, `codex/eval-canary-quota-handling`, and `cursor/clean-sentry-lockfile-orphans-74cf`). | Confirmed zero unique commits against origin/main and MERGED/CLOSED status on GitHub via `gh pr list`. |
 | 2026-07-14 | worktrees (6244, 8ba3, b6ff, e6b5, repo-improvement-review-09945c) | detached HEADs | local worktree cleanup | Safely removed and unregistered 5 clean, inactive worktrees from the git registry. | Ran `git worktree remove` and verified final active worktrees. |
 | 2026-07-14 | main | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | branch alignment | Fast-forwarded local `main` to latest `origin/main` commit. | Verified main and origin/main revisions and updated ref locally. |
diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md
index d5328662e..3402f6185 100644
--- a/docs/outstanding-issues.md
+++ b/docs/outstanding-issues.md
@@ -34,8 +34,6 @@ Durable, cross-session memory of everything still outstanding for this repo: ope
 | ID   | Pri | Type  | Summary                                                 | Detail / next action                                                                                                                                                                                                                                                                                                  | Source                                                                                       | Added      |
 | ---- | --- | ----- | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ---------- |
 | #001 | P2  | task  | Semantic reranking still gated off                      | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded.                                                                                                                      | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901                       | 2026-07-21 |
-| #002 | P2  | task  | Process-ownership fix not yet isolated on `main`        | `scripts/run-eval-safe.mjs` still terminates residual repo processes broadly. Isolate the child-owned `terminateOwnedProcessTree(child.pid)` approach + the regression test proving unrelated Vitest/Playwright/Next processes survive; verify statically — do **not** start a provider-backed eval.                  | `docs/process-hardening.md` (High-priority local process ownership)                          | 2026-07-21 |
-| #003 | P2  | task  | Staging tenancy release evidence outstanding            | The provider-backed A/B tenancy regression is intentionally outside local + PR gates. Run the standalone manual/nightly workflow and attach a recent green evidence artifact **before release**.                                                                                                                      | `docs/process-hardening.md`; `docs/staging-tenancy-release-evidence.md`                      | 2026-07-21 |
 | #004 | P3  | rec   | Rescope provider-gated RAG safety ideas                 | If explicitly approved, rescope only the still-relevant preflight utilities/tests (answer-quality thresholds, cost-cap preflight, deep-health) against current `main`; keep live OpenAI/Supabase validation separate. Do **not** replay the stale 754-line retrieval migration/worktree wholesale.                    | `docs/process-hardening.md` (Provider-gated RAG safety ideas)                                | 2026-07-21 |
 | #005 | P3  | rec   | `finalScore` saturates at clamp ceiling                 | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Not a defect on the current golden set. | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/rag/clinical-search.ts:1362`      | 2026-07-21 |
 | #006 | P2  | issue | Globe "Language & region" button had no handler         | Fixed in this PR to the disabled "Coming soon" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state.                                                                                                              | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21        | 2026-07-21 |
@@ -48,6 +46,7 @@ Durable, cross-session memory of everything still outstanding for this repo: ope
 
 Move resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.
 
-| ID           | Type | Summary | Outcome | Resolved |
-| ------------ | ---- | ------- | ------- | -------- |
-| _(none yet)_ |      |         |         |          |
+| ID   | Type | Summary                                          | Outcome                                             | Resolved   |
+| ---- | ---- | ------------------------------------------------ | --------------------------------------------------- | ---------- |
+| #003 | task | Staging tenancy release evidence outstanding     | Ran GitHub Action and validated isolation           | 2026-07-21 |
+| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |
diff --git a/package.json b/package.json
index 80a33785f..2deae08c8 100644
--- a/package.json
+++ b/package.json
@@ -105,8 +105,6 @@
     "check:supabase-project": "node scripts/run-tsx.mjs scripts/check-supabase-project.ts",
     "auth:set-administrator": "node scripts/run-tsx.mjs scripts/set-site-administrator.ts",
     "check:indexing": "node scripts/run-tsx.mjs scripts/check-indexing.ts",
-    "check:m13-migration": "node scripts/run-tsx.mjs scripts/check-m13-migration.ts",
-    "check:july8-live-batch": "node scripts/run-tsx.mjs scripts/check-july8-live-batch.ts",
     "check:type-scale": "node scripts/check-type-scale.mjs --strict",
     "check:icon-scale": "node scripts/check-icon-scale.mjs --strict",
     "check:design-system-contract": "node scripts/check-design-system-contract.mjs",
diff --git a/tests/check-july8-live-batch.test.ts b/scripts/archive/check-july8-live-batch.test.ts
similarity index 98%
rename from tests/check-july8-live-batch.test.ts
rename to scripts/archive/check-july8-live-batch.test.ts
index fa1799a82..de438773a 100644
--- a/tests/check-july8-live-batch.test.ts
+++ b/scripts/archive/check-july8-live-batch.test.ts
@@ -5,7 +5,7 @@ import {
   isR17IndexUniqueViolation,
   normalizeIndexDef,
   R17_PROBE_STAGE,
-} from "../scripts/check-july8-live-batch";
+} from "./check-july8-live-batch";
 
 describe("check-july8-live-batch R17 index definition probe", () => {
   it("accepts the canonical partial unique index definition", () => {
diff --git a/scripts/check-july8-live-batch.ts b/scripts/archive/check-july8-live-batch.ts
similarity index 100%
rename from scripts/check-july8-live-batch.ts
rename to scripts/archive/check-july8-live-batch.ts
diff --git a/scripts/check-m13-migration.ts b/scripts/archive/check-m13-migration.ts
similarity index 100%
rename from scripts/check-m13-migration.ts
rename to scripts/archive/check-m13-migration.ts
diff --git a/scripts/run-eval-safe.mjs b/scripts/run-eval-safe.mjs
index 69f3c810e..6166e2b27 100644
--- a/scripts/run-eval-safe.mjs
+++ b/scripts/run-eval-safe.mjs
@@ -4,22 +4,13 @@ import { spawn, spawnSync } from "node:child_process";
 import { resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
-const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const isWindows = process.platform === "win32";
+export const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+export const isWindows = process.platform === "win32";
 const [targetScript, ...forwardArgs] = process.argv.slice(2);
 const offlineProviderRequested = forwardArgs.some(
   (token, index) => token === "--provider-mode" && forwardArgs[index + 1] === "offline",
 );
 
-if (!targetScript) {
-  console.error("Usage: node scripts/run-eval-safe.mjs <script> [args...]");
-  process.exit(1);
-}
-
-function normalizeCommandLine(value) {
-  return value.toLowerCase().replaceAll("/", "\\");
-}
-
 function toDateOrDefault(rawValue) {
   if (!rawValue) return null;
   const dateValue = Date.parse(rawValue);
@@ -44,61 +35,7 @@ function toDateOrDefault(rawValue) {
   return null;
 }
 
-function shouldTerminateCandidate(commandLine) {
-  const normalizedCommandLine = normalizeCommandLine(commandLine);
-  const hasRepoScripts = normalizedCommandLine.includes("\\scripts\\");
-
-  if (normalizedCommandLine.includes("\\run-eval-safe.mjs")) return false;
-
-  if (hasRepoScripts && normalizedCommandLine.includes("\\node_modules\\tsx\\dist\\cli.mjs")) {
-    if (normalizedCommandLine.includes("\\scripts\\eval-")) return true;
-    if (normalizedCommandLine.includes("\\scripts\\eval")) return true;
-    return false;
-  }
-
-  if (hasRepoScripts && normalizedCommandLine.includes("\\scripts\\run-tsx.mjs")) {
-    return normalizedCommandLine.includes("\\scripts\\eval");
-  }
-
-  if (
-    hasRepoScripts &&
-    normalizedCommandLine.includes("\\node_modules\\tsx\\dist\\preflight.cjs") &&
-    normalizedCommandLine.includes(" --import ")
-  ) {
-    return true;
-  }
-
-  if (normalizedCommandLine.includes("\\node_modules\\playwright")) {
-    return true;
-  }
-
-  if (
-    normalizedCommandLine.includes("\\node_modules\\vitest\\vitest.mjs") &&
-    normalizedCommandLine.includes("\\tests\\")
-  ) {
-    return true;
-  }
-
-  if (normalizedCommandLine.includes("\\node_modules\\next\\dist\\bin\\next")) {
-    return true;
-  }
-
-  if (normalizedCommandLine.includes("\\node_modules\\next\\dist\\server\\lib\\start-server.js")) {
-    return true;
-  }
-
-  if (normalizedCommandLine.includes("\\node_modules\\next\\dist\\compiled\\jest-worker\\processchild.js")) {
-    return true;
-  }
-
-  if (normalizedCommandLine.includes("\\.next\\build\\") || normalizedCommandLine.includes("\\.next\\dev\\build\\")) {
-    return true;
-  }
-
-  return false;
-}
-
-function listRepoNodeProcesses() {
+export function listRepoNodeProcesses() {
   if (!isWindows) return [];
 
   const command = [
@@ -142,16 +79,7 @@ function listRepoNodeProcesses() {
   }
 }
 
-function listCandidateProcesses() {
-  if (!isWindows) return [];
-
-  return listRepoNodeProcesses().filter((candidate) => {
-    if (!candidate?.commandLine) return false;
-    return shouldTerminateCandidate(candidate.commandLine);
-  });
-}
-
-function getDescendantPids(rootPid, allProcesses = listRepoNodeProcesses()) {
+export function getDescendantPids(rootPid, allProcesses = listRepoNodeProcesses()) {
   const visited = new Set([rootPid]);
   const queue = [rootPid];
 
@@ -168,7 +96,7 @@ function getDescendantPids(rootPid, allProcesses = listRepoNodeProcesses()) {
   return Array.from(visited);
 }
 
-function terminateProcesses(pids, context) {
+export function terminateProcesses(pids, context) {
   if (!isWindows) return 0;
 
   let killed = 0;
@@ -190,29 +118,23 @@ function terminateProcesses(pids, context) {
   return killed;
 }
 
-function cleanupResidualEvaluationProcesses() {
-  if (!isWindows) return;
-
-  const selfPid = process.pid;
-  const candidates = listCandidateProcesses().filter((candidate) => candidate.pid > 0 && candidate.pid !== selfPid);
-  if (candidates.length === 0) return;
-  const pids = candidates.map((candidate) => candidate.pid);
-  terminateProcesses(pids, "cleanupResidualEvaluationProcesses");
-}
-
-function terminateEvalProcessTree(pid) {
-  if (!isWindows || !pid || pid <= 0) return;
-  const processSnapshot = listRepoNodeProcesses();
+export function terminateOwnedProcessTree(pid, processSnapshot = listRepoNodeProcesses()) {
+  if (!isWindows || !pid || pid <= 0) return 0;
   const descendants = getDescendantPids(pid, processSnapshot);
-  terminateProcesses(descendants, "terminateEvalProcessTree");
+  return terminateProcesses(descendants, "terminateOwnedProcessTree");
 }
 
 function terminateEvalProcess(pid) {
   if (!pid || pid <= 0) return;
-  terminateEvalProcessTree(pid);
+  terminateOwnedProcessTree(pid);
 }
 
 function runEvalScript() {
+  if (!targetScript) {
+    console.error("Usage: node scripts/run-eval-safe.mjs <script> [args...]");
+    process.exit(1);
+  }
+
   const targetPath = resolve(projectRoot, targetScript);
   const command = process.execPath;
   const commandArgs = [resolve(projectRoot, "scripts", "run-tsx.mjs"), targetPath, ...forwardArgs];
@@ -226,8 +148,6 @@ function runEvalScript() {
       ? {
           ...process.env,
           RAG_PROVIDER_MODE: "offline",
-          // Empty values prevent @next/env from restoring credentials from an
-          // env file before eval-quality actively deletes them in the child.
           OPENAI_API_KEY: "",
           OPENAI_ORG_ID: "",
           OPENAI_PROJECT_ID: "",
@@ -275,5 +195,7 @@ function runEvalScript() {
   });
 }
 
-cleanupResidualEvaluationProcesses();
-runEvalScript();
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1]);
+if (isMain) {
+  runEvalScript();
+}
diff --git a/scripts/test-cross-tenant-staging.ts b/scripts/test-cross-tenant-staging.ts
index 2495049e9..b3f6a55ce 100644
--- a/scripts/test-cross-tenant-staging.ts
+++ b/scripts/test-cross-tenant-staging.ts
@@ -619,6 +619,17 @@ async function main() {
       auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
       global: { fetch: crossTenantStagingFetch },
     });
+
+    // Ensure test users have administrator privileges for mutation routes
+    await admin.auth.admin.updateUserById(sessionA.userId, { app_metadata: { site_role: "administrator" } });
+    await admin.auth.admin.updateUserById(sessionB.userId, { app_metadata: { site_role: "administrator" } });
+
+    // Refresh sessions to get the new role claim in the JWT
+    const sessionARefreshed = await signIn(clientA, config.userAEmail, config.userAPassword, "User A");
+    const sessionBRefreshed = await signIn(clientB, config.userBEmail, config.userBPassword, "User B");
+    sessionA.token = sessionARefreshed.token;
+    sessionB.token = sessionBRefreshed.token;
+
     const fixtureA = await createFixture(admin, config, runId, sessionA.userId, "a", (fixture) =>
       fixtures.push(fixture),
     );
diff --git a/tests/eval-process-safety.test.ts b/tests/eval-process-safety.test.ts
new file mode 100644
index 000000000..d596ff6f6
--- /dev/null
+++ b/tests/eval-process-safety.test.ts
@@ -0,0 +1,82 @@
+import { describe, expect, it, vi } from "vitest";
+import { spawnSync } from "node:child_process";
+import { getDescendantPids, terminateOwnedProcessTree, isWindows } from "../scripts/run-eval-safe.mjs";
+
+// Mock taskkill calls in node:child_process
+vi.mock("node:child_process", async (importOriginal) => {
+  const original = await importOriginal<typeof import("node:child_process")>();
+  return {
+    ...original,
+    spawnSync: vi.fn((cmd, args, options) => {
+      if (cmd === "taskkill") {
+        return { status: 0, stdout: "", stderr: "" };
+      }
+      return original.spawnSync(cmd, args, options);
+    }),
+  };
+});
+
+describe("run-eval-safe process ownership safety", () => {
+  const mockSnapshot = [
+    // Our spawned child process tree
+    { pid: 1000, parentPid: 999, commandLine: "node scripts/run-tsx.mjs scripts/eval-quality.ts", createdAtMs: null },
+    { pid: 1001, parentPid: 1000, commandLine: "node node_modules/next/dist/bin/next build", createdAtMs: null },
+    {
+      pid: 1002,
+      parentPid: 1001,
+      commandLine: "node node_modules/next/dist/compiled/jest-worker/processchild.js",
+      createdAtMs: null,
+    },
+
+    // Unrelated processes running in the repository
+    { pid: 2000, parentPid: 500, commandLine: "node node_modules/next/dist/bin/next dev", createdAtMs: null },
+    {
+      pid: 2001,
+      parentPid: 2000,
+      commandLine: "node node_modules/vitest/vitest.mjs --reporter=dot",
+      createdAtMs: null,
+    },
+    { pid: 3000, parentPid: 1, commandLine: "node some-other-repo/scripts/eval.js", createdAtMs: null },
+  ];
+
+  it("correctly maps descendant PIDs including the root PID", () => {
+    const descendants = getDescendantPids(1000, mockSnapshot);
+    expect(descendants).toContain(1000);
+    expect(descendants).toContain(1001);
+    expect(descendants).toContain(1002);
+    expect(descendants.length).toBe(3);
+
+    expect(descendants).not.toContain(2000);
+    expect(descendants).not.toContain(2001);
+    expect(descendants).not.toContain(3000);
+  });
+
+  it("returns only the root PID if no descendants exist", () => {
+    const descendants = getDescendantPids(1002, mockSnapshot);
+    expect(descendants).toEqual([1002]);
+  });
+
+  it("does not target unrelated processes for termination", () => {
+    if (!isWindows) {
+      return;
+    }
+
+    // Reset the mock before call
+    const mockedSpawnSync = spawnSync as import("vitest").Mock;
+    mockedSpawnSync.mockClear();
+
+    const killedCount = terminateOwnedProcessTree(1000, mockSnapshot);
+
+    expect(mockedSpawnSync).toHaveBeenCalledTimes(3);
+    expect(killedCount).toBe(3);
+
+    const calledPids = mockedSpawnSync.mock.calls.map((call: unknown[]) => (call[1] as string[])?.[1]);
+    expect(calledPids).toContain("1000");
+    expect(calledPids).toContain("1001");
+    expect(calledPids).toContain("1002");
+
+    expect(calledPids).not.toContain("2000");
+    expect(calledPids).not.toContain("2001");
+    expect(calledPids).not.toContain("3000");
+  });
+});