[mblua]

Closes #3227
Closes #3228

Continues batch 10 (#3225, PR #3226, merged as 820750c).

Batch 11 of the Rust sanitizing campaign. It implements the first approved step of four batch 10 design proposals (symptoms 04, 07, 08 and 09) and fixes one flaky test. The user approved two new owner modules: filesystem and process. No security, authority, ordering, cfg or public API change. It does not touch files reserved by #3198, #3199 or the cut issues.

Changes

• 04, Attempts container (room-30): cli::role_experiment::storage owns attempts.jsonl. It has a private file name, a private reader codec and a typed API by run_dir (load_attempts, create_attempts, replace_attempts). New gate sanitizing:containers (scripts/containers.json, scripts/sanitizing_containers.mjs), scoped to this container. Unknown containers only warn.
• 07, disk access (room-32): new pub(crate) owner src-tauri/src/filesystem.rs. Catalog::load reads through crate::filesystem::read_capture_catalog with the same errors. New gate sanitizing:disk_access, also wired into pr-regression-gates.yml.
• 08, global state (room-33): 7 exposed static items are now private behind their owners: NAMING_MIGRATION_SUMMARY, INSTALLS_IN_FLIGHT, Settings SAVE_OP_ID (now next_settings_save_op_id) and four SETTINGS_LOCK_DEBUG_*. Tests use cfg(test) accessors. This encapsulates the state; it does not remove it. A new concurrency test checks save op id uniqueness (8×128).
• 09, processes and environment (room-34): new config/environment.rs reads AC_TEST_WINDOW_PLACEMENT at the same moment as before. New pub(crate) owner src-tauri/src/process.rs with is_running(pid), moved byte for byte (3 cfg variants) from config/agency_cache.rs.
• test: native_rename_failure_keeps_epoch_checkpoint_and_own_pending_payload fails under parallel lib suite #3228, flaky test (room-31), test only: native_rename_failure_keeps_epoch_checkpoint_and_own_pending_payload got Retry when another test held SAVE_SESSIONS_LOCK or the settings registry lock. The test now forces that contention once, asserts Retry → Recapture, and then retries only Retry with a 10 s bound. All original assertions are kept. Positive control: losing the pending payload still fails the test.
• Census (room-30): c4_state_key_census 1276 → 1281 (5 new files); spawn_search_path_inventory 85 → 86 rows, with the agency_cache.rs row moved to process.rs.

Measurements (66c2cf1 → 0176550)

Symptom	Measure	Before	After
04	attempts.jsonl mentions outside storage (files/literals)	4 / 10	0 / 0 (1 test fixture kept)
04	External attempts reader codec	1	0
07	Production files touching disk outside owners	236	235
08	Exposed static items in scope	7	0 (globals 117 → 117)
09	Command outside process/PTY (uses/files)	18 / 11	16 / 10
09	Env reads outside config/main/lib (uses/files)	25 / 17	24 / 16
09	Gate 09 sites (launch/env read/env write)	21 / 27 / 0	19 / 26 / 0

No file over 1000 lines and no line over 100 chars added.

Verification (room-33, Windows, 0176550)

• cargo fmt --check, cargo clippy --all-targets -- -D warnings: pass.
• cargo test --lib: 6603 passed, 0 failed, 30 ignored.
• cargo test --test '*' --no-fail-fast: 339 passed, 0 failed, 6 ignored (48 suites, census included).
• The eight sanitizing:* gates (--base-ref 66c2cf1), sanitizing:self (68/0/0), test:debt, check:arcs, check:cycles, check:served-paths, cog:scan, cog:baseline: pass.
• test: native_rename_failure_keeps_epoch_checkpoint_and_own_pending_payload fails under parallel lib suite #3228: three consecutive full cargo test --lib runs (room-31): 6593 passed, 0 failed each.

Known red gates

None known.

Known warnings (not blocking, deferred)

• Gate 09: two stale allowlist entries (config/agency_cache.rs, config/agency_cache/git.rs).
• Gates 05/07/04: scanner ambiguity warnings (glob imports, untyped receivers, unclassified writers).

Rooms

• room-30: 04 (Attempts) and census
• room-31: test: native_rename_failure_keeps_epoch_checkpoint_and_own_pending_payload fails under parallel lib suite #3228
• room-32: 07 (filesystem)
• room-33: 08 (static encapsulation) and full verification
• room-34: 09 (process, config/environment)

Files modified

• .github/workflows/pr-regression-gates.yml
• package.json
• scripts/containers.json
• scripts/sanitizing_baseline.mjs
• scripts/sanitizing_containers.mjs
• scripts/sanitizing_disk_access.mjs
• scripts/sanitizing_tests.mjs
• src-tauri/module-arcs.txt
• src-tauri/src/agent_update.rs
• src-tauri/src/agent_update/install.rs
• src-tauri/src/agent_update/tests/agent_install.rs
• src-tauri/src/capture/catalog.rs
• src-tauri/src/capture/catalog/tests.rs
• src-tauri/src/cli/role_experiment/commands.rs
• src-tauri/src/cli/role_experiment/fake_run.rs
• src-tauri/src/cli/role_experiment/report.rs
• src-tauri/src/cli/role_experiment/resume.rs
• src-tauri/src/cli/role_experiment/storage.rs
• src-tauri/src/cli/role_experiment/tests.rs
• src-tauri/src/config.rs
• src-tauri/src/config/agency_cache.rs
• src-tauri/src/config/environment.rs
• src-tauri/src/config/sessions_persistence/tests/replacement.rs
• src-tauri/src/config/settings.rs
• src-tauri/src/config/settings/agent/instance.rs
• src-tauri/src/config/settings/project_path/migration.rs
• src-tauri/src/config/settings/save.rs
• src-tauri/src/config/settings/save/lock.rs
• src-tauri/src/config/settings/tests/lock_debug_and_id_hash_schema.rs
• src-tauri/src/config/settings/tests/save_backups_and_diagnostics.rs
• src-tauri/src/filesystem.rs
• src-tauri/src/filesystem/tests.rs
• src-tauri/src/lib.rs
• src-tauri/src/process.rs
• src-tauri/src/process/tests.rs
• src-tauri/src/startup.rs
• src-tauri/src/testability/window_placement.rs
• src-tauri/tests/c4_state_key_census.rs
• src-tauri/tests/spawn_search_path_inventory.rs

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud