refactor(providers): finalize apktool and shared artifact resources through runOwned (#10653)

* refactor(providers): finalize apktool and shared artifact resources through runOwned

runOwned moves to the provider layer so provider sites can use it without depending on application workflows. It gains a completed-value projection (partial) for values that are not themselves partial observations, an optional signal, and cleanupLeases that bind a close failure to the exact leases whose confirmed release resolves it.

ArtifactAnalysisResources.finish is removed; TShark and sigrok finalize through runOwned with the shared release as close. Apktool's hand-written release, cancellation and lease-group composition is replaced by runOwned. A failed primary now keeps a cancellation observed during final cleanup as a secondary failure, as the documented precedence requires.

A counted architecture guard refuses new hand-written completed-result abort reclassification outside runOwned.

* refactor(adb): finalize runtime-root work through runOwned (#10660)

* refactor(adb): finalize runtime-root work through runOwned

The ADB runtime-root finalizer re-derived the precedence by hand and kept its own cancellation-with-cleanup combiner. It now runs through runOwned: the work body maps snapshot failures, close releases the root lease and binds its own cleanup error, and partial projects the completed execution. A cancellation whose cleanup fails is now the shared cleanup composite with the cancellation as its primary, as runOwned produces for every other owner.

* refactor(providers): keep completed values as diagnostics in runOwned and migrate four finalizers (#10691)

* refactor(providers): keep completed values as diagnostics in runOwned and migrate signature, Ghidra, bundle and LLDB finalization

* test(providers): run the lifecycle scenarios over every runOwned adopter shape (#10707)

One table of testing.md lifecycle rows runs over partial, diagnostics, publishing and lease adopters, replacing the hand-written precedence cases it covers.

* chore(lint): move runOwned's classifier baseline entry with the file

scripts/lint/rules/provider-failure-classifier-baseline.json

@@ -20,7 +20,6 @@
     "src/application/managed/ManagedMemberComparisonService.ts": 1,
     "src/application/ntfs/NtfsJournalService.ts": 1,
     "src/application/process/ProcessCli.ts": 1,
-    "src/application/runOwned.ts": 1,
     "src/artifacts/ArtifactOperationFailure.ts": 1,
     "src/artifacts/ReleaseExposureReader.ts": 1,
     "src/artifacts/StableArtifactFailure.ts": 2,
@@ -75,6 +74,7 @@
     "src/process/privateWorkspaceFailure.ts": 1,
     "src/providers/AnalysisClientFailure.ts": 1,
     "src/providers/OwnedCommandCleanup.ts": 2,
+    "src/providers/runOwned.ts": 1,
     "src/rust/RustBinaryProvider.ts": 1,
     "src/signals/SigrokRecordingProvider.ts": 1,
     "src/sqlite/SqliteDatabaseFailures.ts": 1,

scripts/verify/architecture-guard-baselines.json

@@ -11,7 +11,7 @@
     "src/application/Doctor.ts": 4,
     "src/application/EnhancedLiteralTracing.ts": 1,
     "src/application/EnhancedTools.ts": 2,
-    "src/application/EvidenceBundleCommands.ts": 3,
+    "src/application/EvidenceBundleCommands.ts": 1,
     "src/application/EvidenceBundleFiles.ts": 3,
     "src/application/EvidenceInputResolver.ts": 2,
     "src/application/JsonFiles.ts": 8,
@@ -121,7 +121,7 @@
     "src/javascript/sourceMaps/SourceMapCommand.ts": 4,
     "src/javascript/sourceMaps/SourceMapDecoder.ts": 3,
     "src/native/AppleDispatchMetadata.ts": 3,
-    "src/native/LldbCallTracer.ts": 4,
+    "src/native/LldbCallTracer.ts": 2,
     "src/native/NativeCallObservation.ts": 2,
     "src/native/NativeCallTarget.ts": 2,
     "src/native/NativeCommandAnalysisError.ts": 1,
@@ -129,7 +129,6 @@
     "src/native/NativePlistSource.ts": 2,
     "src/native/NativeUiInterruptionControl.ts": 1,
     "src/native/NativeUiObservation.ts": 1,
-    "src/native/SignatureTargetBinding.ts": 5,
     "src/native/pe/PeBinaryFailure.ts": 1,
     "src/native/pwndbg/PwndbgCoreContext.ts": 3,
     "src/native/pwntools/PwntoolsDecoder.ts": 8,
@@ -381,7 +380,7 @@
     "src/android/JadxJavaProbe.ts": 1,
     "src/android/JadxProvider.ts": 2,
     "src/apktool/ApktoolCommandCleanup.ts": 1,
-    "src/apktool/ApktoolProvider.ts": 3,
+    "src/apktool/ApktoolProvider.ts": 2,
     "src/application/AnalysisContextQueries.ts": 1,
     "src/application/DirectAnalysisCleanup.ts": 2,
     "src/application/Doctor.ts": 1,
@@ -414,7 +413,6 @@
     "src/application/native/NativeUiActionTrace.ts": 1,
     "src/application/process/ProcessCli.ts": 1,
     "src/application/releaseExposure/ReleaseExposureService.ts": 1,
-    "src/application/runOwned.ts": 1,
     "src/artifacts/apple/AppleAssetCatalogAnalysis.ts": 2,
     "src/artifacts/apple/KeyedArchiveReader.ts": 1,
     "src/browser/BrowserScenarioPartialObservation.ts": 1,
@@ -471,7 +469,7 @@
     "src/kuna/KunaProjectReader.ts": 2,
     "src/kuna/KunaSessionClient.ts": 1,
     "src/kuna/KunaTargetCommands.ts": 2,
-    "src/native/LldbCallTracer.ts": 6,
+    "src/native/LldbCallTracer.ts": 4,
     "src/native/NativeCommandAnalysisError.ts": 1,
     "src/native/NativeMacOSProvider.ts": 5,
     "src/native/NativeUiObservation.ts": 1,
@@ -480,7 +478,7 @@
     "src/native/pwntools/PwntoolsDecoder.ts": 6,
     "src/pcap/PcapProvider.ts": 7,
     "src/pcap/PcapSnapshot.ts": 1,
-    "src/process/ArtifactAnalysisResources.ts": 4,
+    "src/process/ArtifactAnalysisResources.ts": 3,
     "src/process/DarwinProcessRunTokenReader.ts": 2,
     "src/process/capture/FilesystemSnapshot.ts": 1,
     "src/process/capture/ProcessCaptureError.ts": 3,
@@ -489,6 +487,7 @@
     "src/providers/AnalysisClientCreation.ts": 3,
     "src/providers/AnalysisClientFailure.ts": 1,
     "src/providers/OwnedCommandCleanup.ts": 1,
+    "src/providers/runOwned.ts": 1,
     "src/rizin/RizinDebugSessionManager.ts": 1,
     "src/server/registerCloseLifecycleTool.ts": 1,
     "src/server/registerResetInvestigationTool.ts": 1,
@@ -645,5 +644,24 @@
     "src/native/MachoArchitectureSelection.ts": 2,
     "src/native/NativeMachoInspection.ts": 1
   },
-  "abort-without-reason": {}
+  "abort-without-reason": {},
+  "completed-abort-reclassification": {
+    "src/application/EvidenceInputResolver.ts": 1,
+    "src/application/binary/BinarySession.ts": 1,
+    "src/application/desktop/DesktopApplicationState.ts": 1,
+    "src/application/frida/FridaInstrumentationService.ts": 1,
+    "src/browser/CdpBrowserProvider.ts": 1,
+    "src/browser/CdpElectronProvider.ts": 1,
+    "src/browser/PlaywrightBrowserScenarioProvider.ts": 1,
+    "src/browser/execution/CdpWebRuntimeProvider.ts": 1,
+    "src/browser/history/HistoricalCaptureDecoder.ts": 1,
+    "src/cliJsonInput.ts": 1,
+    "src/evm/EvmoleInterfaceProvider.ts": 1,
+    "src/ghidra/GhidraClient.ts": 1,
+    "src/hopper/HopperClient.ts": 2,
+    "src/hopper/HopperMachOImage.ts": 1,
+    "src/native/pwntools/PwntoolsDecoder.ts": 1,
+    "src/reference/ReferenceSourceReaderEntries.ts": 1,
+    "src/sqlite/SqliteDatabaseProvider.ts": 1
+  }
 }

scripts/verify/architecture-guards.mjs

@@ -330,6 +330,16 @@ checkCounted(
   ["src/pcap/TsharkJsonPackets.ts"],
 );
 
+// Turning a completed result into a cancellation after cleanup is the
+// finalization precedence that runOwned owns (src/providers/runOwned.ts).
+checkCounted(
+  "completed result reclassified by a hand-read abort signal (finalize through runOwned in src/providers/runOwned)",
+  "completed-abort-reclassification",
+  files,
+  /\.ok\s*&&\s*(?:isAborted\(|[\w.?]*signal\??\.aborted)/gu,
+  ["src/providers/runOwned.ts"],
+);
+
 // An abort reason names who ended the work: a typed `CallerAbort` at the CLI,
 // MCP and HTTP adapters, or an `OwnerCancellation` when REA closes an owner.
 // A bare `.abort()` leaves an anonymous platform AbortError as the cause.