fix(reports): complete finding-bound HTML repairs

[sxyseo]

Summary

• Complete the portable HTML finding-bound fix flow introduced by fix(reports): bind copied fixes to findings and route manual fixes without callbacks #39 without requiring Qoder Canvas artifacts.
• Validate the correct report family, regenerate report.md and report.html, then commit findings.json as the final revision marker.
• Keep Qoder split reports fail-closed on canvas.json, and keep temporary fix results outside renderer-owned report directories.
• Normalize delegated root CLI spawn and signal failures into one stable machine-mode JSON envelope while preserving normal child output ownership.

Why

• Issue/Story: follow-up to fix(reports): bind copied fixes to findings and route manual fixes without callbacks #39 and its maintainer review.
• User or maintainer outcome: a valid Codex HTML run contains findings.json, report.md, and report.html. The recorder previously treated every compact finding document as a Qoder split report and unconditionally opened canvas.json. The reported ENOENT was therefore a recorder mode-selection bug, not a missing report artifact. Fabricating canvas.json would fail the split contract and leave the HTML callback revision stale.

Maintainer confirmation requested: please confirm that the durable sibling artifact signature is the intended backward-compatible discriminator for v1 callbacks, and that publishing Markdown/HTML before findings.json is the preferred commit-marker order.

Traceability and Scope

• Spec/ADR: docs/specs/2026-08-01-html-finding-fix-recording.md; docs/specs/2026-08-01-root-cli-machine-failure-contract.md
• Acceptance criteria addressed: HFR-AC-1 through HFR-AC-6; RCM-AC-1 through RCM-AC-4
• Canonical owners changed: root CLI delegation boundary, fix-output recorder, finding-bound-fix reference, focused tests, changelog
• Explicit non-goals: score changes, callback transport redesign, Qoder Canvas schema changes, or cross-file atomicity across process/OS failure

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
node --test --test-name-pattern="record-fix-output" test/task-loop-report.test.mjs	16/16 pass
node --test test/better-harness-cli.test.mjs test/scripts-refactor-contract.test.mjs	43 pass, 1 supported Windows symlink-permission skip
node --test test/better-harness-skill.test.mjs test/doc-link-graph.test.mjs	19/19 pass
combined report/renderer/Skill/CLI/compatibility run	166 pass, 1 skip; one local EPERM symlink failure reproduced unchanged on the baseline
npm test	1,044 pass, 6 skip; four pre-existing Windows EPERM symlink-creation failures outside the changed paths
npm run pack:verify	pass: 369 npm entries, 392 runtime-zip entries
git diff --check	pass

Manual evidence: the original three-artifact Codex report was exercised without mutation using a deliberately stale revision and now returns STALE_FIX_OUTPUT_REVISION, not canvas.json ENOENT.

Risk and Recovery

• Compatibility and cross-platform impact: argv-array dispatch is retained; normal child bytes/status remain owned by the delegated command; path handling uses Node APIs on Windows/macOS/Linux.
• Package, plugin, schema, or generated-file impact: shipped recorder, CLI, Skill reference, and package contents change; no schema version changes and no generated artifacts are committed.
• Rollback or recovery path: revert this commit; failed pre-publish validation leaves all durable HTML artifacts byte-identical and preserves the result payload.
• Residual risk or unverified boundary: a process/OS interruption during multi-file replacement can leave prepared views ahead of the old findings revision; findings.json is deliberately published last as the authoritative commit marker. Local Windows cannot create four unguarded test symlinks; upstream CI must validate those cases.

AI Involvement

• Level: Generated by Codex (GPT 5.6 Sol)
• Human review and validation: maintainer review is pending; exact automated and manual acceptance evidence is listed above.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md.
• I have the right to contribute this work under the repository's MIT License.