fix(runs): close findings from the session-wide review (M-1 + L-1/L-2/L-3)

Four findings from the final ~5-hour holistic review (zero CRITICAL/HIGH overall):
- M-1 (latent corruption): boot's fresh-number branch left a stale activeDbRunId
  restored from the snapshot, so a later Save would updateRunOnFinish the WRONG
  SQLite row. Null it when minting a fresh number (the reused branch keeps it —
  the content-key match proves it belongs to that run).
- L-1: runRetestSkips now clears state.loadedReadonly — a retest mutates the
  loaded run in place, so it's no longer read-only; an interrupted retest stays
  resumable (and the run keeps its own number/dbRunId, so resume can't duplicate).
  Makes loadRunIntoState's "cleared by Retest" contract true.
- L-2: boot run-number fallback uses Math.max(...numbers) instead of the last
  array element — robust to index.runs reordering after delete+find-or-update,
  matching latestRunNumber().
- L-3: /api/clear resets status='idle' so the wiped view isn't shown under a
  stale stopped/error overlay.

Reviewed: safe to commit, no CRITICAL/HIGH/MEDIUM. Test suite green (188/31/45/35).

Author: Sentinel-Bluebuilder

audit/pipeline.js

@@ -1260,6 +1260,11 @@ export async function runRetestSkips(skipAddrs, state, broadcast) {
   state.errorMessage = null;
   state.retryCount = 0;
   state.retestMode = true;
+  // A retest actively works the run in place (persistActiveRun writes fresh rows),
+  // so it's no longer a pristine read-only snapshot — clear loadedReadonly so an
+  // interrupted retest can be resumed (matches loadRunIntoState's documented
+  // "cleared by Retest" contract).
+  state.loadedReadonly = false;
   state.retestTotal = skipAddrs.length;
   state.retestTested = 0;
   state.retestPassed = 0;

server.js

@@ -1140,7 +1140,7 @@ function rehydrateState(results) {
     // overwrite — a real saved run (the bug that corrupted Test #11).
     if (state.activeRunNumber == null) {
       const cand = index.activeRun != null ? index.activeRun
-                 : (index.runs.length > 0 ? index.runs[index.runs.length - 1].number : null);
+                 : (index.runs.length > 0 ? Math.max(...index.runs.map(r => r.number)) : null);
       const candData = cand != null ? loadRun(cand) : null;
       // Strengthen "is the working set the SAME run as `cand`?" beyond length:
       // two DIFFERENT audits of the same chain set have identical length but
@@ -1160,6 +1160,12 @@ function rehydrateState(results) {
       // could overwrite a different run. Forcing a snapshot now means the next
       // boot restores this number instead of recomputing it.
       if (!reused) {
+        // Fresh number → a NEW unsaved run with no SQLite row of its own. Drop any
+        // activeDbRunId the snapshot restored: it points at a DIFFERENT run, and
+        // keeping it would make a later Save updateRunOnFinish the wrong row
+        // (clobbering that run's counts/spend). Same intent as startFreshRun,
+        // which overwrites it via insertRun — here there's no insertRun, so null.
+        state.activeDbRunId = null;
         try { flushStateSnapshot(); }
         catch (e) { console.error('[boot] reserve run-number snapshot failed:', e.message); }
       }
@@ -2744,6 +2750,9 @@ app.post('/api/clear', adminOnly, (req, res) => {
   state.currentNode = null;
   state.resumeHeadAddr = null;
   state.activeBatchId = 0;
+  // Drop a stale 'stopped'/'error' status so the wiped view isn't shown under a
+  // paused/error overlay with zero rows.
+  state.status = 'idle';
   saveResults(state);
   broadcastStateFresh();
   res.json({ ok: true });