Summary

Adds focused regression coverage for residual high-risk seams that open coverage PRs #298–#302 do not claim, plus CI stabilizers for the unchanged main tip.

Risky behavior now covered

• Runtime integrity watcher start failure leaves the in-process memo armed (distinct from invalidateRuntimeTrust(..., false)), does not retry watch(), and only fail-closes after explicit invalidation
• Runtime integrity watcher error event clears the memo so subsequent uses re-fingerprint and catch mid-process tree edits
• Concurrent first-use verifyRuntimeIntegrityForUse calls coalesce onto one tree walk
• Desktop product analytics captures app_started once after successful init and app_updated once on version bump
• setConfig rejects clear+set mutual exclusion for memory/skill/tool-output model fields (validation_failed, no persist)

Test files added/updated

• test/coworkRuntime.test.ts (+ tiny __internal watch/coalesce hooks in src/coworkRuntime/integrity.ts)
• apps/desktop/test/product-analytics-apply.test.ts (+ injectable captureProductEventImpl in productAnalytics.ts)
• test/session/agentSession.settings.test.ts
• CI stabilizers: apps/desktop/test/research-readiness.test.tsx desktop bridge/persistence reset; apps/mobile/bun.lock canary refresh

Why these tests materially reduce regression risk

These paths gate runtime trust fail-closed behavior, analytics lifecycle correctness under idle desktop state churn, and config-patch validation that previously only had happy-path coverage. A silent break would allow tampered runtimes to stay trusted in-process, double-fire lifecycle analytics, or accept contradictory config clears.

Validation

• Targeted suites green
• Touched files Biome-clean (biome check)
• bun run lint, bun run typecheck, bun run docs:check clean
• Full bun run test: all 672 files passed (Bun 1.4.0-canary)

Notes

• Deliberately avoided duplicating open #298–#302 seams
• No production behavior changes beyond tiny testability hooks