Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/process-hardening.md`:
- Around line 141-142: Update the exhaustive dependency list in the CI aggregate
description to include the RAG fixture validation workflow job, using its exact
job ID from the workflow and preserving the existing scope-enforcement wording.

In `@docs/testing.md`:
- Line 5: Update the lock-recovery guarantee in the testing documentation to
state that ownerless locks are also reclaimed after the initialization grace
period, while retaining the existing behavior for locks whose recorded process
is demonstrably dead. Ensure the wording accurately reflects the recovery logic
implemented by test-run-lock.mjs.

In `@scripts/ci-change-scope.mjs`:
- Line 157: Update the coveragePatterns regular expression near the existing
run-* script entries to include scripts/run-playwright.mjs, preserving the
current matching behavior for all other scripts so the coverage self-test
recognizes this runner as coverage-related.

In `@scripts/classify-playwright-failures.mjs`:
- Around line 24-28: Update failedTestcasesFromJunit so failure detection
removes CDATA sections and XML comments from each testcase body before testing
for failure or error elements. Preserve detection of actual JUnit failure/error
nodes, and add a fixture covering a passing testcase whose system-out contains a
CDATA-wrapped failure string.

In `@scripts/eval-rag-offline.mjs`:
- Around line 5-9: Update the child-process invocation in the script loop to run
from the repository root rather than inheriting the caller’s working directory.
Derive the root from the launcher script’s location and pass it as the spawnSync
working-directory option, preserving the existing script paths and argument
forwarding.

In `@scripts/flake-ledger.mjs`:
- Around line 22-25: Update dateValue to round-trip the parsed UTC date into
YYYY-MM-DD and compare it with the original value before accepting it; throw the
existing invalid-date error when they differ, so calendar-invalid values such as
2026-02-30 are rejected. Add a regression test covering this case.

In `@scripts/playwright-base-url.ts`:
- Around line 94-100: Update the URL resolution flow around
findExistingLocalProjectUrl and allowEnsure so the !allowEnsure guard runs
before any existing-server discovery, requiring explicit PLAYWRIGHT_BASE_URL in
that mode. Only perform existing-server fallback or server ensuring when
allowEnsure is true.

In `@scripts/run-playwright.mjs`:
- Around line 94-99: Update findFreePort to scan the configured port range
circularly, starting at startPort and wrapping from projectPortEnd back to the
range’s lower bound. Preserve the existing isReservedDevPort and canListen
checks, and only throw after every configured port has been examined.
- Around line 38-42: Update the mockup-project detection in the playwright
argument parsing flow so mockups are enabled when no --project filter is
supplied, since Playwright then runs all projects. Preserve the existing
detection for explicit --project=chromium-mockups and --project chromium-mockups
arguments, and ensure the corresponding mockup route/build configuration uses
the resulting flag.

In `@tests/flake-ledger.test.ts`:
- Around line 60-66: Update the expiry-boundary test in
validateFlakeLedgerEntries to capture a single current time before constructing
the expiry date and validating the entry, then derive isoDate(31) from that
captured clock. Ensure both date generation and validation use the same
timestamp so the 31-day rejection remains deterministic, while preserving the
existing isoDate(30) acceptance assertion.

In `@tests/property-seed.ts`:
- Around line 4-6: Update the parsedSeed validation in tests/property-seed.ts to
validate the raw FAST_CHECK_SEED text before calling Number.parseInt, rejecting
malformed values such as 123junk, 1.9, and 1e3 while preserving the
defaultPropertySeed fallback and safe-integer requirement.

In `@tests/universal-search.test.ts`:
- Around line 3-15: Update the test teardown in afterEach to unmock every module
specifier registered by vi.doMock in this test file, using matching vi.doUnmock
calls or a shared cleanup helper. Keep the existing module-reset behavior and
ensure mocked factories cannot affect later tests.

In `@tests/worker-bundle.test.ts`:
- Line 23: Update the child-process invocation within the test “keeps every
external import resolvable under plain node with prod-only deps” to enforce a
subprocess-level timeout, or replace the blocking execFileSync call with an
awaited child-process API that supports timeout handling. Preserve the existing
60-second test timeout and probe behavior.

---

Nitpick comments:
In `@tests/ui-smoke.spec.ts`:
- Around line 1685-1686: Restore deterministic keyboard-focus coverage in the
privacy-link flow around page.goto by asserting the privacy link is focused with
toBeFocused() before navigation. Replace the flaky focus assertion sequence
without removing the accessibility check, and retain the existing navigation
behavior.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@scripts/test-run-lock.mjs`:
- Around line 78-147: Make stale-lock recovery in acquireHeavyRunLock atomic so
a contender cannot delete a replacement lock created by another process after
the stale check. Replace the separate readOwner/lockIsOldEnoughToRecover and
rmSync sequence with an atomic compare-and-recover or proven lock primitive that
verifies the same stale lock before removal, then retries acquisition safely.
Add a regression test exercising two simultaneous stale-lock recoverers and
assert only one acquires the lock while the other cannot invalidate it.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/local-server-utils.test.ts`:
- Around line 42-48: Add focused tests for circularProjectPortRange covering
non-integer and out-of-range preferred ports, asserting each invalid input is
rejected according to the function’s validation behavior. Keep the existing
valid circular-order and full-range assertions unchanged.