[ThopterBot]

Persistent Blaxel workers accumulate generated source-CLI and web-bundle runtimes. The worker lock also expires without proving that descendants stopped and releases before report downloads finish, allowing the next checkout to overwrite results. This PR gives generated builds a worker lifetime and protects each Blaxel attempt through cleanup and verified retrieval.

Reusable CLI and versioned web builds publish only after preparation succeeds. Playwright and Vitest worker teardown stop servers, wait for pending builds, and remove their outputs while preserving reuse across cases. Failed preparation and per-launch copies clean themselves up. Five browser acceptances—two theme lifecycle walks and three demo-mode cases—load built application assets while retaining their authentication, restart, navigation and rendering assertions. Their request inventories establish the shipped-asset boundary; incremental memory savings after Vite's full-response correction are unmeasured.

The Blaxel lifecycle uses one worker-local lease, serialized by a short flock guard. Dispatch registers ownership before checkout, and only the coordinator renews. Normal release follows attributed-process teardown and validated report download. After 20 minutes without renewal by default, the next acquisition stops the abandoned attempt's processes by owner token and PID/start identity, audits, clears its state and takes the lease. Recovery can discard undownloaded reports and retains a receipt describing that loss. Uncertain or unreadable ownership holds the worker. Pool provisioning publishes workers only after verification; deletion reserves them and removes dispatch eligibility before calling the provider.

Each attempt has private scratch and an inherited TMPDIR. Under the lease and a clean owner audit, pre-run cleanup removes only direct /tmp/television-source-cli-e2e-*, /tmp/television-web-bundle-* directories and stale runner scratch. Post-run cleanup removes the attempt's scratch after processes stop. Persistent caches and unrelated temporary files are preserved. This also reclaims known residue from test revisions without the helper fixes.

Surface parents retain available RAM, shared memory, temporary free space and OOM-counter observations at start/end, plus bounded kernel OOM lines for failed or recovered native attempts. Diagnostic links survive normalization, retry aggregation and download. Limits are 64 KiB of kernel lines, 128 KiB per sidecar and 8 MiB per shard attempt; unavailable probes stay explicit and do not change native outcomes.

The governing changes are in Blaxel shards, reporting, testing policy, and the runner/registry placement rules, with mirrored proofs. The scope is test infrastructure and acceptance setup. The archived proposal and plan preserve rationale and validation structure.

Validation:

• Red/green contracts and real Playwright/Vitest worker teardown passed on Blaxel. The live qualification passed on disposable private workers: competing acquisition and deletion, delayed retrieval, active and quiet coordinator crashes, recovery receipts, diagnostic transport, and actual Node/Chromium temporary-file placement. Its two experiment surfaces require explicit selection and are excluded from ordinary all/CI.
• npm run verify -- blaxel --pool poc passed at 7c66d160, containing main a8e73fbf: all 36 shards and 22 surfaces; 3,705 tests passed, eight skipped, zero failed/recovered tests, process leaks or infrastructure failures. Lint, type checking and package manifests passed. The gate retained 231 linked resource sidecars with complete start/end observations and zero OOM deltas. Normal cleanup reclaimed 1,510 runtime directories totaling 5,003,157,504 allocated bytes. Peak memory and long-term renewal-loss frequency remain unmeasured.
• The worker-lease and lease-contract files passed all 20 cases on private Blaxel workers at 2156f266. Process-permission coverage runs the real command unprivileged and proves that unreadable production audits preserve the lease and leftovers. A root-only case checks a same-user nondumpable child; fixture process enumeration is explicitly supplied, while production audits the whole worker. Both runs retained their results and reported zero failures, leaks or infrastructure failures. A renewal already in flight at release can produce a closing warning after its lease is gone. All private workers and the coordinator were deleted after artifact retrieval.
• GitHub CI passed all 26 jobs at 9787188d, including the full unit suite, desktop tests, all 16 e2e shards, static checks and attestation publication. The unprivileged unit job passed all nine applicable lease-fixture cases; the root-only permission case passed on Blaxel.

[ThopterBot]

Superseded by #53, which integrates this change with the test-runner spec rewrite.