Await plugin worker shutdown before settling

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes are documented here. RealDone follows semantic versioning wh
 
 ### Added
 
+- Fresh fingerprint-bound qualification for the Windows plugin-worker cleanup across TodoMVC, Actual Budget, Conduit SQLite/PostgreSQL 17/Supabase CRUD, and Pocket Ledger Level 7 plus Codex RD901 regression/repair evidence.
 - Configured classic branch protection for `main` with the strict/up-to-date GitHub Actions check `normative release gates (15/15)`, administrator enforcement, required conversation resolution, and disabled force-push/deletion; the aggregate now fails closed when a prerequisite fails, is cancelled, or is skipped.
 - Fresh Phase L qualification at fingerprint `3663ff0c…` across TodoMVC, Actual Budget, Conduit SQLite/PostgreSQL 17/Supabase Data API and Pocket Ledger, including PostgreSQL CRUD cleanup, authenticated Level 7 visual suppression and a new Codex RD901 regression/repair cycle.
 - Pre-capture visual privacy for automatic scans and contract/role verification: known-sensitive inputs, `secretEnv` and auth-state contexts now suppress screenshot/video binaries while safe controls retain them, with additive value-free report metadata.
@@ -22,6 +23,7 @@ All notable changes are documented here. RealDone follows semantic versioning wh
 
 ### Fixed
 
+- Plugin timeout/error/success paths now settle only after the isolated worker has terminated, preventing locked plugin files and `ENOTEMPTY` cleanup failures on Windows.
 - MCP and CLI managed scans now use a dedicated configurable startup-health timeout (30 seconds by default), emit bounded process-state/PID/restart diagnostics, and exercise delayed startup plus dynamic-port cleanup instead of relying on a fixed CI port and a 10-second shared render budget.
 - Playwright traces containing known sensitive field values, generic credential/token material, invalid ZIP data, or bounded-inspection limit failures are removed immediately instead of surviving until the aggregate release artifact gate.
 - Report timelines and environment summaries now render arrows and separators as UTF-8 instead of mojibake.

release/evidence/actual-budget.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0",
-  "generatedAt": "2026-07-26T14:00:00.000Z",
-  "engineFingerprint": "3663ff0c5e291f6a54b335d5d33fb9035e4e4495785dd15d2f1923e97b4e9d74",
+  "generatedAt": "2026-07-26T16:40:00.000Z",
+  "engineFingerprint": "44fc30ce7bbf3da7b5ab4e17fb59cfeec8948c97f08d106a57d206ab8a8b9114",
   "case": {
     "name": "Actual Budget",
     "repository": "actualbudget/actual",
@@ -12,9 +12,9 @@
     "capabilities": []
   },
   "scan": {
-    "scanId": "20260726T135032Z-94f7",
+    "scanId": "20260726T160858Z-9f53",
     "sourceArtifact": "release/evidence/raw/actual-budget.scan.json",
-    "sourceSha256": "0338aad8bdeb2654b1050fb5467eaa131c0361e54813db437d02a125376072ff",
+    "sourceSha256": "7aaa3833e1b9793cdb7620224bcf6046de65a150d70202e36a8985677914460f",
     "environmentStatus": "VALID",
     "truncated": false,
     "pagesDiscovered": 2,

release/evidence/ai-agent-cycle.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0",
-  "generatedAt": "2026-07-26T14:00:00.000Z",
-  "engineFingerprint": "3663ff0c5e291f6a54b335d5d33fb9035e4e4495785dd15d2f1923e97b4e9d74",
+  "generatedAt": "2026-07-26T16:40:00.000Z",
+  "engineFingerprint": "44fc30ce7bbf3da7b5ab4e17fb59cfeec8948c97f08d106a57d206ab8a8b9114",
   "case": {
     "name": "Pocket Ledger (Codex-generated)",
     "repository": "local/Pocket-Ledger",
@@ -18,9 +18,9 @@
     ]
   },
   "scan": {
-    "scanId": "20260726T135405Z-d811",
+    "scanId": "20260726T161344Z-27cd",
     "sourceArtifact": "release/evidence/raw/ai-agent-cycle.scan.json",
-    "sourceSha256": "7509843ce59b318faa0868171be2b35681596564d7fa508d2d6422e2dd6226e3",
+    "sourceSha256": "b8b1712e19a24f3f7122b8dcdd36556358083017ac956b954bc7f4fcb0b3aa13",
     "environmentStatus": "VALID",
     "truncated": false,
     "pagesDiscovered": 1,
@@ -43,37 +43,37 @@
       "id": "codex-session",
       "kind": "agent-session",
       "sourceArtifact": "release/evidence/raw/ai-agent-cycle/codex-session.json",
-      "sourceSha256": "20f3770f49423ea89e4d3d03a66ad655f404213387d346cd06efa8d9b4228a96"
+      "sourceSha256": "7c9831ca094537558888da576a91d0f9931b5860243eb1cd97e0b26f50aa2e86"
     },
     {
       "id": "agent-baseline",
       "kind": "agent-baseline",
       "sourceArtifact": "release/evidence/raw/ai-agent-cycle/baseline.json",
-      "sourceSha256": "f4e02ce4d3e2a539ce7d5d87d13f5756a182a3e0065f86b681131ae4855a669a"
+      "sourceSha256": "69c2f2c7fb3bf1cc5256b5779098633b93983cd99d5ddfbe768c4816f2bc0672"
     },
     {
       "id": "agent-regression",
       "kind": "agent-regression",
       "sourceArtifact": "release/evidence/raw/ai-agent-cycle/regression.json",
-      "sourceSha256": "f1b9793d6af2d05812218bb925882bed68aee46761ef0eef662a585b4dcfa2e1"
+      "sourceSha256": "ad05ef4c59bc0a001c512ab68a4bea740c198e3c9ea597b79f5c3596a7eafce9"
     },
     {
       "id": "failed-verification",
       "kind": "contract-verification",
       "sourceArtifact": "release/evidence/raw/ai-agent-cycle/failed-verification.json",
-      "sourceSha256": "5c1c63099bf73829889a3a0c83b2f9eba59fd557a11c92a519b20d892e45bdd8"
+      "sourceSha256": "5e81a2b690614ca40f61c5905efb71652794243dace2794abd7610697a314661"
     },
     {
       "id": "agent-repair",
       "kind": "agent-repair",
       "sourceArtifact": "release/evidence/raw/ai-agent-cycle/repair.json",
-      "sourceSha256": "d56f04f4965be5df9c5f4007998ce016d18dca1bbe0f9fc0a0b77c0e11608743"
+      "sourceSha256": "8a45658f5aecc3264e5167f2216ec796697d4c97be08af77a6828b65e49123ca"
     },
     {
       "id": "role-verification",
       "kind": "contract-verification",
       "sourceArtifact": "release/evidence/raw/ai-agent-cycle/role-verification.json",
-      "sourceSha256": "4d3aac0e9ee5debd999a5cbda8042426ff236809b662f731a2f4a73ec792ac9b"
+      "sourceSha256": "b6841e2f785b959a94b12f08e5ea0e507cb0bae06447034db7694279a693b727"
     }
   ],
   "qualification": {

release/evidence/conduit-sources.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0",
-  "generatedAt": "2026-07-26T14:14:00.000Z",
-  "engineFingerprint": "3663ff0c5e291f6a54b335d5d33fb9035e4e4495785dd15d2f1923e97b4e9d74",
+  "generatedAt": "2026-07-26T16:40:00.000Z",
+  "engineFingerprint": "44fc30ce7bbf3da7b5ab4e17fb59cfeec8948c97f08d106a57d206ab8a8b9114",
   "case": {
     "name": "Conduit RealWorld (PostgreSQL + Supabase Data API)",
     "repository": "TonyMckes/conduit-realworld-example-app",
@@ -17,9 +17,9 @@
     ]
   },
   "scan": {
-    "scanId": "20260726T140645Z-88ef",
+    "scanId": "20260726T162645Z-58b4",
     "sourceArtifact": "release/evidence/raw/conduit-sources.scan.json",
-    "sourceSha256": "b2b4e47bbc4a5d1476becd3d9cd78e9796791b9f967dce74c757349d90eb5f85",
+    "sourceSha256": "dbc28d24d5c44b924aed342eba9b5d6e6ba09ecf817cb97321519d4fb8478cd7",
     "environmentStatus": "VALID",
     "truncated": false,
     "pagesDiscovered": 3,
@@ -42,25 +42,25 @@
       "id": "postgres-create",
       "kind": "external-scan",
       "sourceArtifact": "release/evidence/raw/conduit-postgres-create.scan.json",
-      "sourceSha256": "7c9bdcccc8525b7de22d738e87b9b9e71059189ea79997d0b59397edc15f0d04"
+      "sourceSha256": "3c79db51dc5e90b96448e848789848cf6fcc83cbb6562337f5006c728aceab04"
     },
     {
       "id": "postgres-update",
       "kind": "external-scan",
       "sourceArtifact": "release/evidence/raw/conduit-postgres-update.scan.json",
-      "sourceSha256": "52bb6e3256abe41888edbb1f2ee8227000e59d05bbf9dcd274ac2541fbac366e"
+      "sourceSha256": "6023f3fd1d12c2490e9c549147a8547165df7078b24f06ee62e297c80a0d6bd0"
     },
     {
       "id": "postgres-delete",
       "kind": "external-scan",
       "sourceArtifact": "release/evidence/raw/conduit-postgres-delete.scan.json",
-      "sourceSha256": "28267871506509bd1882a2b202f1de5fcef84ce6aa9e78564d9e43cf62450507"
+      "sourceSha256": "10c5a8a5d44bf3aaf9cd6aa5f624d57543e774f22b99e1b14ddfbb636eac7b9a"
     },
     {
       "id": "postgres-cleanup",
       "kind": "test-result",
       "sourceArtifact": "release/evidence/raw/conduit-postgres-cleanup.json",
-      "sourceSha256": "040e6eec0008282851b81d08875512accce9211567f9d8347c6c5d4b373bf224"
+      "sourceSha256": "15c1823fdc31a6bc89754128b641df38703912fe72bc15a0cff2f5cb106c4c31"
     }
   ],
   "assertions": [
@@ -74,7 +74,7 @@
       "id": "capability:backend-crud",
       "passed": true,
       "expected": "create/update/delete plus cleanup",
-      "observed": "PostgreSQL row hashes added=1, changed=1, removed=1; cleanup removed 5 rows across 4 qualification resources",
+      "observed": "PostgreSQL row hashes added=1, changed=1, removed=1; cleanup removed 8 rows across 4 qualification resources",
       "evidenceArtifacts": [
         "postgres-create",
         "postgres-update",

release/evidence/conduit.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0",
-  "generatedAt": "2026-07-26T14:14:00.000Z",
-  "engineFingerprint": "3663ff0c5e291f6a54b335d5d33fb9035e4e4495785dd15d2f1923e97b4e9d74",
+  "generatedAt": "2026-07-26T16:40:00.000Z",
+  "engineFingerprint": "44fc30ce7bbf3da7b5ab4e17fb59cfeec8948c97f08d106a57d206ab8a8b9114",
   "case": {
     "name": "Conduit RealWorld (SQLite)",
     "repository": "TonyMckes/conduit-realworld-example-app",
@@ -14,9 +14,9 @@
     ]
   },
   "scan": {
-    "scanId": "20260726T140120Z-f665",
+    "scanId": "20260726T161945Z-2e90",
     "sourceArtifact": "release/evidence/raw/conduit.scan.json",
-    "sourceSha256": "b473995eab21583ca8149565e0b787d691f49c249505e290a88fa525dd33aee6",
+    "sourceSha256": "0c55996742c7811a844f3292d6356005265f0adc1ca2cb3f6da417dca1bbdef2",
     "environmentStatus": "VALID",
     "truncated": false,
     "pagesDiscovered": 3,