fix(verifiers): centralize failure and cleanup ownership

Own operation results and exact rejections in withVerifierCleanup, including
undefined, null and independent cleanup failures. Remove the optional-primary
cleanup contract and migrate every caller, preserving returns, annotations,
signal restoration and dependent cleanup order.

Make Frida/JEB reporters fail on reasonless rejections and retain JEB fixture
files while provider cleanup is incomplete. Own the nested packaged WASM
verifier and expose its composite process/root cleanup capability for retry.
Update runnable docs and isolated fixture dependencies.

Validation: 547 focused cases in 20 files, eight isolated boundary unit checks,
static/build/docs/discovery gates and duplication check (3.58%). Node process,
SDK and descriptor cleanup are exercised; provider and packaging results in
orchestration tests are simulated. Pack/install subprocess ownership remains
with the existing shared package runner outside the nested-command change.

scripts/verify/javascript/module-references.mjs

@@ -10,7 +10,7 @@ import { parseArgs } from "node:util";
 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { artifactCliEvidence } from "../../lib/artifact-e2e.mjs";
-import { closeVerifierResources } from "../../lib/verifier-cleanup.mjs";
+import { withVerifierCleanup } from "../../lib/verifier-cleanup.mjs";
 import { PrivateRuntimeRoot } from "../../../dist/process/PrivateRuntimeRoot.js";
 import {
   OwnedCommandFailure,
@@ -82,9 +82,8 @@ const normalize = (rows) =>
     ),
   }));
 let temporary;
-let primaryError;
 let retainTemporary = false;
-try {
+await withVerifierCleanup(async () => {
   await client.connect(transport);
   transport.stderr?.resume();
   const tools = (await client.listTools()).tools;
@@ -393,23 +392,15 @@ print(json.dumps(dict(tokenizer='cl100k_base',tiktoken_version=tiktoken.__versio
         "First query is after shared artifact analysis; subsequent queries share one MCP session. Legacy item reads are serial; a concurrent legacy baseline is unmeasured. Filesystem/build warmness uncontrolled. Token costs count one post-change catalog, preparation request/summary and each request/structured reply once; client rendering, replay, reasoning, final answer and model latency are unmeasured. Preparation and parity/tokenization overhead are outside per-query elapsed times; external family-resource receipts include the complete verifier and children.",
     })}\n`,
   );
-} catch (cause) {
-  primaryError = cause;
-  throw cause;
-} finally {
-  await closeVerifierResources(
-    [
-      () => client.close(),
-      () => transport.close(),
-      async () => {
-        if (temporary === undefined) return;
-        if (retainTemporary)
-          throw new Error(
-            `Command cleanup is incomplete; retaining its private input/Evidence files at ${temporary.path}.`,
-          );
-        await temporary.close();
-      },
-    ],
-    primaryError,
-  );
-}
+}, [
+  () => client.close(),
+  () => transport.close(),
+  async () => {
+    if (temporary === undefined) return;
+    if (retainTemporary)
+      throw new Error(
+        `Command cleanup is incomplete; retaining its private input/Evidence files at ${temporary.path}.`,
+      );
+    await temporary.close();
+  },
+]);

scripts/verify/javascript/native-handoffs.mjs

@@ -16,7 +16,7 @@ import {
   OwnedCommandFailure,
   runOwnedCommand,
 } from "../../../dist/process/OwnedCommand.js";
-import { closeVerifierResources } from "../../lib/verifier-cleanup.mjs";
+import { withVerifierCleanup } from "../../lib/verifier-cleanup.mjs";
 import {
   matchesStructuredScopeExpectation,
   structuredScopeExpectationsSchema,
@@ -122,7 +122,6 @@ const simulatedNativeEvidence = (path, sha256) =>
     },
   );
 let temporary;
-let primaryError;
 let retainTemporary = false;
 let report;
 const ownedCommand = async (command, arguments_, timeoutMs = 60_000) => {
@@ -145,7 +144,7 @@ const ownedCommand = async (command, arguments_, timeoutMs = 60_000) => {
     throw cause;
   }
 };
-try {
+await withVerifierCleanup(async () => {
   const archiveSha256 = await fileDigest(values.artifact);
   const companion = join(`${values.artifact}.unpacked`, values["addon-path"]);
   let companionSha256 = null;
@@ -460,23 +459,15 @@ print(json.dumps(dict(tokenizer='cl100k_base',tiktoken_version=tiktoken.__versio
     assert.ok(safeIdentity, "Native identity/linkage oracle failed");
     assert.ok(safeApplicability, "File analysis applicability oracle failed");
   }
-} catch (cause) {
-  primaryError = cause;
-  throw cause;
-} finally {
-  await closeVerifierResources(
-    [
-      () => client.close(),
-      () => transport.close(),
-      async () => {
-        if (retainTemporary)
-          throw new Error(
-            `Command cleanup incomplete; retaining owned inputs at ${temporary?.path}.`,
-          );
-        await temporary?.close();
-      },
-    ],
-    primaryError,
-  );
-}
+}, [
+  () => client.close(),
+  () => transport.close(),
+  async () => {
+    if (retainTemporary)
+      throw new Error(
+        `Command cleanup incomplete; retaining owned inputs at ${temporary?.path}.`,
+      );
+    await temporary?.close();
+  },
+]);
 console.log(serialize(report));

scripts/verify/javascript/retained-facts.mjs

@@ -15,7 +15,7 @@ import {
   OwnedCommandFailure,
   runOwnedCommand,
 } from "../../../dist/process/OwnedCommand.js";
-import { closeVerifierResources } from "../../lib/verifier-cleanup.mjs";
+import { withVerifierCleanup } from "../../lib/verifier-cleanup.mjs";
 import { selectExportedJavaScriptFacts } from "../../lib/javascript-facts-reference.mjs";
 
 const { values } = parseArgs({
@@ -56,7 +56,6 @@ const client = new Client({
   version: "1",
 });
 let temporary;
-let primaryError;
 let retainTemporary = false;
 let report;
 const serialize = (value) => JSON.stringify(value);
@@ -106,7 +105,7 @@ const resourceSnapshot = async () => {
   };
 };
 
-try {
+await withVerifierCleanup(async () => {
   const start = performance.now();
   const artifactHash = createHash("sha256");
   for await (const chunk of createReadStream(values.artifact))
@@ -344,23 +343,15 @@ try {
     conditions:
       "Fresh MCP and input hashing (file cache warmed); build/OS caches uncontrolled. First export sample includes export plus caller projection code, later samples reuse that immutable export. View samples precede diagnostic export. Task token projections include preparation, first answer, selected/full name/description/inputSchema catalog and the exact baseline program; exec tool schema, host rendering, output schemas, reasoning and billing unmeasured. At-answer cgroup counters include observer/startup overhead, before repeats/export diagnostics/parity/tokenization; final external observer measures all validation work. No application or native provider executes.",
   };
-} catch (cause) {
-  primaryError = cause;
-  throw cause;
-} finally {
-  await closeVerifierResources(
-    [
-      () => client.close(),
-      () => transport.close(),
-      async () => {
-        if (retainTemporary)
-          throw new Error(
-            `Command cleanup incomplete; retaining owned inputs at ${temporary?.path}.`,
-          );
-        await temporary?.close();
-      },
-    ],
-    primaryError,
-  );
-}
+}, [
+  () => client.close(),
+  () => transport.close(),
+  async () => {
+    if (retainTemporary)
+      throw new Error(
+        `Command cleanup incomplete; retaining owned inputs at ${temporary?.path}.`,
+      );
+    await temporary?.close();
+  },
+]);
 console.log(serialize(report));