Bumps [jsdom](https://github.com/jsdom/jsdom) from 27.4.0 to 29.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jsdom/jsdom/releases">jsdom's
releases</a>.</em></p>
<blockquote>
<h2>v29.1.1</h2>
<ul>
<li>Fixed <code>'border-radius'</code> computed style serialization. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
<li>Fixed computed style computation when using
<code>'background-origin'</code> and <code>'background-clip'</code> CSS
properties. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
<li>Significantly optimized initial calls to
<code>getComputedStyle()</code>, before the cache warms up. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
</ul>
<h2>v29.1.0</h2>
<ul>
<li>Added basic support for the ratio CSS type. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
<li>Fixed <code>getComputedStyle()</code> sometimes returning outdated
results after CSS was modified. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
</ul>
<h2>v29.0.2</h2>
<ul>
<li>Significantly improved and sped up <code>getComputedStyle()</code>.
Computed value rules are now applied across a broader set of properties,
and include fixes related to inheritance, defaulting keywords, custom
properties, and color-related values such as <code>currentcolor</code>
and system colors. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
<li>Fixed CSS <code>'background</code>' and <code>'border'</code>
shorthand parsing. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
</ul>
<h2>v29.0.1</h2>
<ul>
<li>Fixed CSS parsing of <code>'border'</code>,
<code>'background'</code>, and their sub-shorthands containing keywords
or <code>var()</code>. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
<li>Fixed <code>getComputedStyle()</code> to return a more functional
<code>CSSStyleDeclaration</code> object, including indexed access
support, which regressed in v29.0.0.</li>
</ul>
<h2>v29.0.0</h2>
<p>Breaking changes:</p>
<ul>
<li>Node.js v22.13.0+ is now the minimum supported v22 version (was
v22.12.0+).</li>
</ul>
<p>Other changes:</p>
<ul>
<li>Overhauled the CSSOM implementation, replacing the <a
href="https://www.npmjs.com/package/@acemir/cssom"><code>@acemir/cssom</code></a>
and <a
href="https://github.com/jsdom/cssstyle"><code>cssstyle</code></a>
dependencies with fresh internal implementations built on webidl2js
wrappers and the <a
href="https://www.npmjs.com/package/css-tree"><code>css-tree</code></a>
parser. Serialization, parsing, and API behavior is improved in various
ways, especially around edge cases.</li>
<li>Added <code>CSSCounterStyleRule</code> and
<code>CSSNamespaceRule</code> to jsdom <code>Window</code>s.</li>
<li>Added <code>cssMediaRule.matches</code> and
<code>cssSupportsRule.matches</code> getters.</li>
<li>Added proper media query parsing in <code>MediaList</code>, using
<code>css-tree</code> instead of naive comma-splitting. Invalid queries
become <code>"not all"</code> per spec.</li>
<li>Added <code>cssKeyframeRule.keyText</code> getter/setter
validation.</li>
<li>Added <code>cssStyleRule.selectorText</code> setter validation:
invalid selectors are now rejected.</li>
<li>Added <code>styleSheet.ownerNode</code>,
<code>styleSheet.href</code>, and <code>styleSheet.title</code>.</li>
<li>Added bad port blocking per the <a
href="https://fetch.spec.whatwg.org/#bad-port">fetch specification</a>,
preventing fetches to commonly-abused ports.</li>
<li>Improved <code>Document</code> initialization performance by lazily
initializing the CSS selector engine, avoiding ~0.5 ms of overhead per
<code>Document</code>. (<a
href="https://github.com/thypon"><code>@thypon</code></a>)</li>
<li>Fixed a memory leak when stylesheets were removed from the
document.</li>
<li>Fixed <code>CSSStyleDeclaration</code> modifications to properly
trigger custom element reactions.</li>
<li>Fixed nested <code>@media</code> rule parsing.</li>
<li>Fixed <code>CSSStyleSheet</code>'s "disallow modification"
flag not being checked in all mutation methods.</li>
<li>Fixed <code>XMLHttpRequest</code>'s <code>response</code> getter
returning parsed JSON during the <code>LOADING</code> state instead of
<code>null</code>.</li>
<li>Fixed <code>getComputedStyle()</code> crashing in XHTML documents
when stylesheets contained at-rules such as <code>@page</code> or
<code>@font-face</code>.</li>
<li>Fixed a potential hang in synchronous <code>XMLHttpRequest</code>
caused by a race condition with the worker thread's idle timeout.</li>
</ul>
<h2>v28.1.0</h2>
<ul>
<li>Added <code>blob.text()</code>, <code>blob.arrayBuffer()</code>, and
<code>blob.bytes()</code> methods.</li>
<li>Improved <code>getComputedStyle()</code> to account for CSS
specificity when multiple rules apply. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
<li>Improved synchronous <code>XMLHttpRequest</code> performance by
using a persistent worker thread, avoiding ~400ms of setup overhead on
every synchronous request after the first one.</li>
<li>Improved performance of <code>node.getRootNode()</code>,
<code>node.isConnected</code>, and <code>event.dispatchEvent()</code> by
caching the root node of document-connected trees.</li>
<li>Fixed <code>getComputedStyle()</code> to correctly handle
<code>!important</code> priority. (<a
href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li>
<li>Fixed <code>document.getElementById()</code> to return the first
element in tree order when multiple elements share the same ID.</li>
<li>Fixed <code><svg></code> elements to no longer incorrectly
proxy event handlers to the <code>Window</code>.</li>
<li>Fixed <code>FileReader</code> event timing and
<code>fileReader.result</code> state to more closely follow the
spec.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9b9ea7e10b"><code>9b9ea7e</code></a>
29.1.1</li>
<li><a
href="07efb7821c"><code>07efb78</code></a>
Optimize computed style comparison</li>
<li><a
href="5f66329902"><code>5f66329</code></a>
Fix background-origin/background-clip in background shorthand</li>
<li><a
href="ad8af77ecc"><code>ad8af77</code></a>
Fix border shorthand handling</li>
<li><a
href="5a3e88ea9b"><code>5a3e88e</code></a>
29.1.0</li>
<li><a
href="73db204172"><code>73db204</code></a>
Update dependencies and dev dependencies</li>
<li><a
href="a7168a579d"><code>a7168a5</code></a>
Support ratio CSS unit type</li>
<li><a
href="15346e055b"><code>15346e0</code></a>
Fix style cache invalidation</li>
<li><a
href="2a1e2cdb44"><code>2a1e2cd</code></a>
29.0.2</li>
<li><a
href="4097d66ba1"><code>4097d66</code></a>
Resolve computed CSS values lazily in CSSStyleDeclaration</li>
<li>Additional commits viewable in <a
href="https://github.com/jsdom/jsdom/compare/v27.4.0...v29.1.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for jsdom since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version modifies <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
The shared pg-test-harness pays the golden schema-template cold start inside
the first PG test of each vitest invocation and is budgeted against core's 15s
testTimeout, but the six PG-consuming plugin packages ran at vitest's 5s
default — on saturated CI runners the first PG test (e.g. whatsapp-chat
persistence.pg) timed out before its assertions ran. Propagate the 15s budget
to all six plugin configs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port the planning turn-admission invariant (FNXC:PlanningTurnAdmission,
2026-07-22) into the Compound Engineering orchestrator: at most one turn
(opening/answer/resume-rehydration) is admitted per CE session, reserved
synchronously and held until the turn settles — a re-entered mobile view
re-submitting a turn now gets CeTurnInProgressError (HTTP 409) instead of
displacing the in-flight turn's live agent, which surfaced as "Failed to
parse agent response: AI returned no valid JSON". cancel()/discard()
force-clear the reservation; releases are token-scoped so a stale release
can't drop a newer turn's slot.
In the engine interactive-ai-session seam: bump the reformat retry from
one to two attempts (non-Anthropic default models comply less reliably
with the JSON-only protocol), and log every failed parse with a bounded
raw-response snippet plus resolved provider/model — including a distinct
empty-assistant-message marker — so support can diagnose these reports
without a repro.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
## Summary
Windows installs with slow native dependencies now get five minutes to
finish, and a real timeout is reported as an actionable terminal retry
instead of a wall of preceding npm deprecation warnings. Registry
`ETIMEDOUT` errors keep their network diagnosis, including after the
legacy-bin `--force` retry.
Compound Engineering personas are now included in the published CLI
bundle, with complete source-to-staged coverage for all persona
definitions and a clear startup error if the bundled assets are missing
or empty.
The PostgreSQL statement visible in the report was validated by the
existing real-Postgres schema reapply test. Its actual `caused by`
detail was truncated, so this PR deliberately makes no speculative
database change.
## Validation
- Dashboard updater tests: 22 passed
- CLI updater tests: 16 passed
- CE persona installer tests: 7 passed
- Published bundle persona assertion: passed against every source
persona
- CLI and CE plugin typechecks: passed
- Changed production/config lint and strict changeset validation: passed
- Real PostgreSQL schema reapply integration test: passed
---
[](https://github.com/EveryInc/compound-engineering-plugin)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Windows CLI and dashboard updates now allow up to five minutes for
installation and restore Compound Engineering agent personas during npm
installs.
* Update failures now surface clearer, terminal timeout guidance (while
preserving specific network connection diagnostics) and avoid misleading
“deprecated”/generic timeout text.
* Persona assets are reliably included in plugin builds and bunded
persona installation now errors clearly when definitions are missing or
empty.
* **Tests**
* Expanded update and bundling coverage for the new 5-minute timeout and
error-handling scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Main Full Suite shards have been red after recent landings. Root causes:
1. **Executor tests** — `execute()` now polls
`getTaskVerificationRequestAsync` (chat-enqueued verification). Shared
`createMockStore()` (and soft-delete inline store) lacked the method, so
nearly every execute-path suite failed with `is not a function`.
2. **TaskDetailModal suites** — `NativeStructurePreview` imports `Map` /
`Lightbulb` / `BarChart3` / `Target` / `CircleAlert` from lucide; the
shared TaskDetail lucide mock omitted them, so suites failed at import.
3. **Grok process-lifecycle** — 15s bound stress timed out under
full-suite load without product-bug evidence → quarantined on sight per
AGENTS.md.
## Test plan
- [x] `executor-task-done-blocked`, `executor-fast-mode-workflows`,
concurrent-execute race
- [x] `executor-step-session`, plan-only scope leak, review-step
indexing
- [x] `TaskDetailModal.create-pr` + `TaskDetail.mobile-transition`
- [ ] Full Suite CI on this PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Added `html2canvas` support in the dashboard to enable HTML-to-canvas
rendering needed for visual structure previews.
* **Tests**
* Updated task execution test mocks to handle task verification-request
flows reliably.
* Improved task deletion safeguard coverage and related execution
behavior checks.
* Enhanced test stubs to support structure preview rendering elements
during modal-related tests.
* **Chores**
* Quarantined a timing-sensitive process lifecycle test and refreshed
quarantine tracking to improve full-suite stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
OMP session/new was dying with opaque "Internal error" when fusion-custom-tools
MCP pointed at a missing schema server, or when bare models hit unauthenticated
providers. Prefer data.details in diagnostics, resolve mcp-schema-server.cjs
from multiple package layouts, skip the tool bridge when the asset is missing,
drop stdio MCP entries whose command path does not exist, and forward common
provider env keys (ZAI/MiniMax/Kimi) into the ACP subprocess.
Bare picker ids like MiniMax-M2.5 were ambiguous across omp providers and landed on unauthenticated plan aliases, which broke ACP with Internal error. Prefer `omp models --json` selectors, resolve bare ids before spawn, and copy mcp-schema-server.cjs into dist so the Fusion tool bridge can start.
## Summary
- Align heartbeat `customTools` expectations with FN-8294 mission
hierarchy tools (43→58).
- Refresh `COORDINATION_EXEMPT_TOOLS` snapshot for `fn_mission_list` /
`fn_mission_show`.
- Backfill `commandCenter.portability.*` for non-en locales and map
`reportMode` / `reportModeByAction` / `embeddedPostgresMaxConnections`
into settings default-description inventory with i18n help text.
- Realign FN-8064 skip-narration unit test with store-owned proactive
chat (no tool-side `appendAgentLog`).
- Quarantine load-sensitive `async-quality-store.pg.test.ts` (5s timeout
+ leftover psql under full-suite shard load; run 29657633544).
## Test plan
- [x] `pnpm --filter @fusion/engine exec vitest run`
gating-classifications + executor-prompt + heartbeat expected-tools case
- [x] `pnpm --filter @fusion/i18n exec vitest run` i18n-gate-coverage +
parity
- [x] `pnpm --filter @fusion/dashboard exec vitest run`
settings-default-descriptions
- [ ] Full Suite all 4 shards green on main after merge
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Settings**
* Added clearer, localized help text for report modes and per-action
overrides, including inheritance behavior.
* Added advanced embedded database connection-limit settings and
validation guidance.
* **Localization**
* Expanded translations for report settings, database tuning, and
organization configuration import/export workflows across supported
languages.
* **Tests & Maintenance**
* Updated test coverage and expectations for expanded tools and
reporting behavior.
* Quarantined a flaky database-related test.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Full Suite after #2291: shards 1–3 green; shard 4 failed CLI suites
with:
`Failed to resolve entry for package
"@fusion-plugin-examples/claude-runtime"`
from `dashboard/src/runtime-provider-probes.ts` under the CLI vitest
package lane.
- Add `plugins/fusion-plugin-claude-runtime/src/probes-entry.ts` (probe
+ model discovery only)
- Alias `@fusion-plugin-examples/claude-runtime` to that entry in CLI
vitest config (same class as Cursor/Grok/OMP source aliases, but avoids
ACP index load)
## Test plan
- [x] Local: vitest-workspace-resolution, task-steer,
extension-task-tools
- [ ] PR gate
- [ ] Post-merge Full Suite green
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved CLI resolution for Claude runtime diagnostics and provider
model discovery.
* Prevented unnecessary runtime dependencies from affecting CLI test
execution.
* **Refactor**
* Added a lightweight entry point for accessing Claude binary checks and
provider model discovery.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
After #2289, Full Suite shard 4 still failed on the **OMP** twin of the
Grok process-lifecycle stress test (`import("../index.js")` × 15 under
shard transform load → 5s timeout).
Apply the same fix class as grok-runtime:
- Symbol.for exit reaper on `process-manager`
- Stress test reimports that module
- 15s timeout for cold transform
## Test plan
- [x] Local OMP process-lifecycle green
- [ ] PR gate
- [ ] Post-merge Full Suite
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved cleanup of OMP ACP processes when the application exits.
- Prevented duplicate exit handlers and excess listener growth during
runtime reloads.
- Preserved reliable process lifecycle behavior under repeated module
loading.
- **Tests**
- Added lifecycle coverage for repeated process-manager reloads.
- Optimized the stress test to complete more efficiently while retaining
cleanup assertions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Full Suite after #2288 still red on shard 4: `process-lifecycle.test.ts`
times out at 5s under shard transform load even after reducing
reimports.
- Move Symbol.for `process.exit` reaper onto `process-manager`
(lifecycle owner)
- Stress test reimports that module (not the full plugin graph)
- Explicit 15s timeout for the cold-transform bound stress test
## Test plan
- [x] Local process-lifecycle green (~2s)
- [ ] PR merge gate
- [ ] Post-merge Full Suite green
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved Grok runtime process cleanup during application shutdown.
- Prevented duplicate cleanup handlers from accumulating during repeated
module loading.
- Ensured managed processes are reliably terminated when the process
exits.
- **Tests**
- Expanded lifecycle coverage to validate repeated loading scenarios.
- Increased test timeouts for more reliable stress-test execution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
#2287 cleared most of Full Suite run 29633869887 / post-merge
29634793317. Shards 1 and 2 went green; remaining floaters:
- **TaskDetailModal.css FN-8154** — assert FN-8166 zeroed mobile
`.detail-activity` inset (`padding-inline-end: 0`), not the pre-8166
`var(--space-md)` residual
- **QuickEntryBox** — wait for cleared input / priority button after
create under shard load (not only `onCreate` mock call)
- **grok process-lifecycle** — prove Symbol.for exit-hook bound with 2
reimports so transform cost stays under 5s on full-suite shards
## Test plan
- [x] Local: FN-8154, QuickEntry clear/priority, process-lifecycle
- [ ] PR merge gate green
- [ ] Post-merge Full Suite on `main` green
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved Quick Entry tests to wait for textarea clearing and verify
priority resets to normal after task creation.
* Updated CSS contract assertions for mobile task-detail activity
spacing to match the latest overlay/inset behavior.
* Streamlined the Grok plugin process lifecycle test loop to run fewer
module-evaluation iterations while keeping existing lifecycle and
warning checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Restacks onto latest main after #2285 and clears the remaining Full
Suite red classes from run
[29633869887](https://github.com/Runfusion/Fusion/actions/runs/29633869887)
(post-#2285):
- **Shard 1:** `agent-skills-flow` vitest TDZ — hoist `mockFiles` via
`vi.hoisted` (same class as skill-resolver in #2285)
- **Shard 2/3:** incomplete mocks after product drift
- `isFullScreenSheetViewport` / `isShortViewport` on viewport mocks
(without overriding dynamic mobile helpers)
- `fetchCodebaseMetrics` on Command Center `api/legacy` mocks
- `fetchSettings` on `agent-modals-mobile` api mock
- **Shard 3:** PlanningMode `ui-interactions` race — sync-settle
`fetchGlobalSettings` (FN-8245 pattern from planning-flow)
- **Shard 3:** settings search drift guard — inventory
`SettingsFieldRow` `htmlFor` keys (`mobileNavPrimaryItems`)
- **Shard 2:** FloatingWindow shared-stack product bug — only reclaim
z-index on hidden→visible (not every mount effect), so last-mounted
utility stays on top
- **Shard 4:** grok process-lifecycle timeout under shard load — prove
bound with 5 reimports instead of 15
## Test plan
- [x] `agent-skills-flow.test.ts` green
- [x] `process-lifecycle.test.ts` green
- [x] FileBrowserModal, FloatingWindowStack.cross-type,
agent-modals-mobile, settings-search-index, SystemControlsArea,
PlanningModeModal.ui-interactions + planning-flow (210 tests) green
- [ ] PR merge gate (Lint/Typecheck/Build/Gate)
- [ ] Post-merge Full Suite on `main` green
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved floating-window stacking so reopened or interacted windows
appear in the correct order.
* Restored consistent layering between floating windows and expanded
dock modals.
* **Tests**
* Updated automated coverage for viewport behavior, codebase metrics,
settings search indexing, and process lifecycle scenarios.
* Improved test reliability and consistency across responsive layouts
and modal interactions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Main Full Suite was red again after release/desktop workflow drift,
engine mock gaps, mission landed-SHA gating, and compound-engineering PG
admin auth on GHA (`USER=runner`).
## Fixes
| Area | Failure | Fix |
|------|---------|-----|
| desktop `release-workflow` | expected old `find artifacts -type f` |
assert pruned collect + `release-files/*` |
| `step-session-executor` | missing
`resolveExecutorFallbackThinkingLevel` | mock export |
| tool-availability tests | empty tools (cascade from above) | fixed by
mock |
| `skill-resolver` | TDZ on `mockFiles` during import | `vi.hoisted`
filesystem state |
| `merge-error-recovery` | enqueue no-op when not started | set
`started=true` |
| mission behavioral posture | `blocked` (no landed SHA / git probe) |
`mergeDetails.commitSha` + staleness stub |
| GraphTaskNode | missing `useOptionalToast` | mock both toast exports |
| CE `pipeline-store.pg` | psql as `runner` | admin via
`FUSION_PG_TEST_URL_BASE` |
## Test plan
- [x] step-session-executor, skill-resolver, merge-error-recovery,
mission-validator-behavioral-posture (203)
- [x] release-workflow (10)
- [x] `pnpm --filter @fusion/engine test:core` (294)
- [ ] Full Suite (non-blocking) after merge
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved desktop release artifact collection by pruning nested
`runtime` and `migrations` directories and consistently staging release
uploads via a dedicated `release-files` mapping.
- **Tests**
- Enhanced engine merge error-recovery coverage and mission validator
behavioral posture setup.
- Improved test reliability by synchronizing mocked filesystem state,
executor fallbacks, and toast hook variants.
- Updated Postgres test harness/admin commands to use a configurable
base URL; refined related Windows changeset description.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
WhatsApp rejects handshakes advertising Baileys' baked-in stale protocol
version with a 405 close, so the plugin cycled starting->disconnected and
never issued a QR. connect() now fetches the current WA Web version per
socket build. /status also exposes lastError so this failure mode is
diagnosable from the documented troubleshooting surface.
The published bundled.js also failed to load entirely ("Dynamic require
of 'crypto' is not supported"): plugin bundles are ESM but Baileys is
CJS. bundlePluginEntry now injects the same createRequire banner as
dist/bin.js.
Verified end-to-end against an isolated fn serve: bundled.js loads,
status reaches awaiting-qr, /qr serves a scannable QR data URL,
/pair-code validates input, /logout clears auth state.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
## Summary
Follow-up after **#2164** and main’s **FN-8103 / FN-8104**
(Postgres-only data access / SQLite retirement).
Main already routes Quality through `AsyncQualityStore` +
`getAsyncLayer()`. This PR keeps the **review hardening** that was still
missing:
- **Project binding** — reject request `projectId` mismatches vs bound
AsyncDataLayer; all SQL uses bound project
- **`createRunIfNoActive`** — advisory lock so concurrent starts cannot
double-queue
- **Cancel-safe runner** — cancel slot registered before the running
write; pre-spawn cancel skips process
- **`finalizeRun`** — never overwrites a `cancelled` terminal status
- **Detached execute** — catch only execution failures; prune fail-soft
in `finally`
- Guardrail tests + Quality v2 plan doc
## Test plan
- [ ] Task QA loads under PostgreSQL (no SQLite/backend-mode error)
- [ ] Concurrent start for same task → 409 second start
- [ ] Cancel during start does not leave a live orphan process
- [ ] Cancelled run stays cancelled after process exit
- [ ] `pnpm --filter @fusion-plugin-examples/quality test` (37 tests)
