fix(xtask): reconcile live sweep plans with compiled tests

[ractive]

Summary

The live sweep previously counted only names found by its source scanner, so an omitted test could disappear from both the run and its totals. Reconcile each target with its compiled ignored-test inventory before planning either dry-run or real execution; fail with the names of compiled tests missing source metadata. Use the compiled inventory for host-specific inclusion, and propagate directory-entry errors.

Production-path regressions cover a dropped name, host exclusions, and agreement between reported counts and actual --exact arguments. Both filtering and command-omission mutations fail their regressions. The historical 319/320 cause remains unproved; the plan records the permitted unsuccessful-investigation disposition and the evidence needed to reopen it.

Validation

• Rust stable 1.98.1; ordered cargo fmt, strict workspace clippy, and workspace tests passed on the final source.
• 74 sweep-runner tests passed after both expected-failure mutations were restored.
• All nine current xtask commands succeeded; dogfood-script explicitly skipped because this plan has no script. The dry-run and real sweep execute its dogfood path.
• No Windows runtime execution is claimed; host exclusion is exercised by a controlled regression.

Final dependency-state sweep used FF_RDP_LIVE_TESTS=1 FF_RDP_LIVE_NETWORK_TESTS=1 and Firefox 156.0. Dry-run and real sweep both qualified 344 tests. Exact-name reconciliation across all five tiers: 341 passed, 3 failed, with no missing, extra or duplicate verdicts (CLI332/3; core9/0).

LIVE_SWEEP_SUMMARY executed=344 skipped=0 preexisting=0 vanished=0 launch_timeout=0 timed_out=0 total=344
LIVE_SWEEP_PROFILES leaked=0 unattributed=0 root=/Users/james/Library/Application Support/ff-rdp/profiles

Every per-target profile scan was clean. Owned raw Firefox stopped/reaped; port6000 free.

Carry-over

• Iteration262: final live_137_consent_accept_via_daemon failed target readiness after15,194ms/47polls. The preceding repair sweep failed after15,257ms; earlier attempts separately failed ready-target Sourcepoint action. Preserve both shapes; this runner change fixes neither.
• Iteration267: final live_165_scope_behaviour_table failed eval typeof c1 with the existing “timeout after auth” greeting-wait envelope (proxy52636). This does not prove server-side authentication succeeded; attributable timing remains unavailable.
• Iteration268: final repeated-hop240 test failed hop3/40 with auth-stage EOF (proxy55319), zero reconnects. The preceding repair failed hop20/40 with connection reset. Failed-occurrence auth timing remains unavailable; no shared cause is asserted.
• Earlier sweep records retained:343pass/1Sourcepoint failure;344pass/0fail after empty-corpus ordering repair;343pass/1Sourcepoint failure after cfg repair;342pass/2fail after regression repair. Final341/3 supersedes these for the final dependency state. Reruns followed source/dependency repairs, not green-chasing.
• Historical omission mechanism remains unidentified; named compiled/source discrepancies now provide a concrete investigation trigger. Original investigation tasks remain unticked under the plan's expressly permitted closure outcome.

Review

Independent full review found the host-cfg mismatch; scoped review verified the runtime repair and required stronger regression tests. The final scoped review covers the production-helper/test repair and both mutation proofs. Supervisor verifies final status and evidence transcription separately.

CI prerequisite

The first PR head passed nine checks but failed supply-chain on existing rustls 0.23.40 (RUSTSEC-2026-0285). Following the repository's patch-upgrade procedure, update only rustls to0.23.45 and its required webpki to0.103.15. Independent security review found no issues; features/provider remain unchanged. Local cargo audit and cargo deny pass. Final-dependency sweep and ordered gates are recorded separately from the two completed implementation repair batches.

Evidence retained locally under .git/ralph-loop/20260919-queue/iter263*, including each attempt's logs, mutation failures, final exact-name reconciliation, gate command timestamps and browser cleanup. Actual token usage is unavailable.