findings(E-10..E-22): fix the defects a code review found in the E-1..E-9 work

A review of the group-E fixes found 13 further defects; ten were introduced by
those fixes, two pre-existed and were merely relocated, one is deferred.

Services / transport
  E-10  retireWorker synthesized no bg/exit frame, so sharedspice's s_bgRunning
        mirror stayed latched true after a mid-run worker death: Run stayed
        disabled and the promised fresh-worker restart was unreachable for the
        whole session. Retirement now dispatches a synthetic controlled-exit
        straight to the installed handler (never through dispatchEvt — a
        fabricated frame must not touch the credit ledger). Driving the repro
        exposed two further defects, both fixed here: a replacement worker
        trapped on pre-init engine reads, and the rerun's cm_input_path/circ hit
        that uninitialized engine before KiCad's validate() re-init (the native
        flow assumes a crashed engine survives in-process — true for the dll,
        false for a dead worker). Reads now answer their empty shapes pre-init,
        writes lazy-init, and init is idempotent per worker engine.
  E-19  dispatchEvt acked only AFTER handler(evt) returned, and the sharedspice
        client deliberately rethrows non-trap errors — so each throw leaked one
        unit of the 64-frame credit window until the stream died with a
        misattributed "transport exceeded". The ack moves to a finally in both
        service copies; the throw still propagates (the trap machinery needs it).
  E-20  the oversize-line path promises to transfer the accepted prefix, but
        with the window full that flush only DEFERS, and stopEventStream wiped
        the deferred queue — losing the diagnostics that explain the failure.
        The terminal notice now carries them as pendingEvents; both hosts
        deliver them in order, unacked (the fatal frame is outside the credit
        protocol).
  E-21  the 30s prefetch deadline discarded every model already collected and
        reported nothing. A caller-owned progress sink ships the partials and
        the omission reaches the export report. (Awaiting the aborted collection
        was rejected: an in-flight source fetch is not abortable — E-4's
        original disease.) Plus a serving-candidate memo, so a .wrl ref served
        by its .step fallback stops re-probing the miss on every export.

Scheduler
  E-14  _terminalizeNativeTrap classified by message substring, so any plain JS
        error QUOTING 'Aborted(' or 'out of bounds' permanently bricked a
        healthy instance. Now structural only: instanceof RuntimeError plus a
        duck-typed name check (verified in this build's glue that abort() throws
        a genuine RuntimeError both pre- and post-runtime-init). Module.onAbort
        now latches the gate — the authoritative notification, previously
        ignored.
  E-15  the shim half: _pumpResume gates on terminal (catching wakes already
        queued at latch time) and resolveWait refuses on terminal WITHOUT
        consuming the entry, so a frame stays visibly parked rather than
        resuming inside a trapped module.
  E-16  the E-5 handler read the realm-global scheduler at dispatch instead of
        its installing module's; also frees the per-line buffer on the non-trap
        rethrow path.
  E-11  get_vec trusted the worker's res.length over the transferred arrays.
        Observed death shape: a 4 GiB std::vector threw an unhandled
        std::length_error that exited the editor's main loop. Now clamped, with
        the buffers freed on every failure path.

Guardrails (replacing two deferred refactors: e2e→production-code injection and
collapsing the four copies of the worker-lifecycle machinery)
  E-18  the source contract asserted comment-string counts — rewording failed
        CI while moving a guard outside its #ifdef passed. It now parses the
        #ifdef regions and asserts on code.
        service-stub-parity.ts pins what the four lifecycle copies must share:
        credit-window equality parsed from source, the finally-ack, boot
        deadlines, terminal-notice consumption. The transport numbers are now
        single-sourced from the worker.
        CI actually runs the gates: the web/standalone vitest suites (which had
        NEVER run in CI), the reducer, the source contract and the parity tool —
        with a NON_PLAYWRIGHT_GATES check so deleting a step re-fails the lint.
  E-22  the e2e occ stub's 60s boot watchdog, deleted in a66e109, is restored in
        the ngspice-stub shape with a wedgeNextBoot() repro hook.

Every behavioral fix has red-then-green evidence (the reds were captured first).
E-17 (a stale RUNNING cross-stamping the next run's generation under E-6's
transport deferral) is DEFERRED with its analysis recorded — a real fix needs
run identity on the bg frames.

Test hygiene: the dwell lint now requires the mandated ": <why>" and all 47 bare
markers carry their reason; three export-report dwells became modal-lease polls;
exact-ledger assertions became relative deltas; the dead data-wx-dom-id branch,
an unused fault hook and unused receipt plumbing are gone; abort scans, wx
dialog drivers, the sim harness and the vitest FakeWorker are each one copy now.

Bumps kicad and wxwidgets to their findings-group-e tips.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/common/shims/jspi-scheduler.js

@@ -250,6 +250,16 @@
     resolveWait: function (token, result) {
       var entry = this.waits.get(token);
       if (!entry || entry.resolved) return false;
+      if (this.terminal) {
+        // Resolving would resume the parked frame INSIDE the trapped module
+        // (the runWaitCompletion invariant, which the bare finishers used to
+        // bypass). Refuse WITHOUT consuming the entry — the frame stays
+        // visibly parked in dump() and the ring says why.
+        this._note("resolveRefused", entry.kind, token);
+        console.warn("[wx-scheduler] resolveWait(" + token + ", " + entry.kind
+          + ") refused: instance is terminal");
+        return false;
+      }
       entry.resolved = true;
       this.waitsResolved++;
       var stack = this.waitStacks[entry.kind];
@@ -282,27 +292,36 @@
 
     dead: false,
     // --- E-8: admission gate for delayed worker/MEMFS completions -----------
-    // `terminal` means the wasm instance TRAPPED (WebAssembly.RuntimeError or
-    // its cross-realm string equivalent): the heap may be mid-mutation, so no
-    // further native work (malloc / heap stores / FS writes) may run and no
-    // parked frame may be resumed into it. Distinct from `dead` (orderly
-    // shutdown). One-way.
+    // `terminal` means the wasm instance TRAPPED (WebAssembly.RuntimeError,
+    // or emscripten's abort — which throws a RuntimeError itself and is also
+    // latched authoritatively via Module.onAbort → terminalize): the heap may
+    // be mid-mutation, so no further native work (malloc / heap stores / FS
+    // writes) may run and no parked frame may be resumed into it. Distinct
+    // from `dead` (orderly shutdown). One-way.
     terminal: false,
     canTouchNative: function () { return !this.dead && !this.terminal; },
+    // Public one-way latch (also wired from boot's Module.onAbort — the
+    // authoritative abort notification).
+    terminalize: function (site, e) {
+      if (this.terminal) return;
+      this.terminal = true;
+      this._note("terminal", site, 0);
+      console.error("[wx-scheduler] instance is terminal (" + site
+        + ") — all further native completions are inert: " + (e || ""));
+    },
     _terminalizeNativeTrap: function (site, e) {
+      // Structural signals only: a genuine engine trap in this same-realm
+      // prepare/entry IS a WebAssembly.RuntimeError instance; the duck-typed
+      // name fallback survives realm loss on a relayed error object. The old
+      // message-substring sniff ('Aborted(', 'index out of bounds', …) only
+      // added false positives — any plain JS error QUOTING such text bricked
+      // a healthy instance permanently.
       var isTrap = (typeof WebAssembly !== "undefined"
             && WebAssembly.RuntimeError
             && e instanceof WebAssembly.RuntimeError)
-        || /unreachable|memory access out of bounds|index out of bounds|null function or function signature mismatch|Aborted\(/i
-            .test(String((e && e.message) || e));
+        || !!(e && e.name === "RuntimeError");
       if (!isTrap) return false;
-      if (!this.terminal) {
-        this.terminal = true;
-        this._note("terminal", site, 0);
-        console.error("[wx-scheduler] native trap in " + site
-          + " — instance is terminal; all further native completions are inert: "
-          + e);
-      }
+      this.terminalize(site, e);
       return true;
     },
     // The one admission boundary for delayed completions that both touch
@@ -550,7 +569,11 @@
     },
 
     _pumpResume: function () {
-      if (this.dead) return;
+      // `terminal` too: a queued wake must never re-enter a trapped module —
+      // resuming swaps SP into (and runs wasm on) a heap that may be
+      // mid-mutation. Freezing the pump on a terminal instance is by design:
+      // the fatal overlay owns the page from here.
+      if (this.dead || this.terminal) return;
       if (this._windowLive) {
         // Self-heal: an activation that suspended RAW (bypassing the shim)
         // or completed untracked never ends its window here; without this