fix(install): arm rollback before legacy sync

tests/ci/packed-artifact-lifecycle.js

@@ -419,7 +419,18 @@ function runLifecycle(options) {
       ],
     };
   } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true });
+    try {
+      fs.rmSync(tempRoot, {
+        recursive: true,
+        force: true,
+        maxRetries: 10,
+        retryDelay: 100,
+      });
+    } catch (cleanupError) {
+      process.stderr.write(
+        `Could not remove lifecycle temp root ${tempRoot}: ${cleanupError.message}\n`
+      );
+    }
   }
 }
 

tests/ci/packed-artifact-lifecycle.test.js

@@ -125,6 +125,16 @@ test('public CLI invocations use npm exec instead of internal package paths', ()
   assert.ok(!unixInvocation.args.some(argument => argument.includes('node_modules')));
 });
 
+test('lifecycle cleanup retries Windows file locks without masking results', () => {
+  const source = fs.readFileSync(
+    path.join(__dirname, 'packed-artifact-lifecycle.js'),
+    'utf8'
+  );
+  assert.match(source, /maxRetries:\s*10/);
+  assert.match(source, /retryDelay:\s*100/);
+  assert.match(source, /Could not remove lifecycle temp root/);
+});
+
 console.log(`\nPassed: ${passed}`);
 console.log(`Failed: ${failed}`);
 process.exit(failed > 0 ? 1 : 0);

tests/scripts/sync-ecc-to-codex.test.js

@@ -119,6 +119,11 @@ function runTests() {
     assert.match(source, /^set -Eeuo pipefail$/m);
     assert.ok(source.includes("trap 'rollback_legacy_sync $?' ERR"));
     assert.ok(source.includes('node "$LEGACY_STATE_HELPER" rollback --state "$LEGACY_STATE_PATH"'));
+    assert.ok(
+      source.indexOf("trap 'rollback_legacy_sync $?' ERR")
+        < source.indexOf('record_managed_path "$CONFIG_FILE"'),
+      'rollback trap must be active before the first ownership record'
+    );
   })) passed++; else failed++;
 
   console.log(`\nResults: Passed: ${passed}, Failed: ${failed}`);