research: define the macOS lock holder and visibility contract #127

Problem

#100 / #115 measured a macOS foreign-UID holder omitted from lsof while a same-user nonlocking opener remained visible, with exit zero and no stderr. The optional lsof lock field was also blank for a genuine fixture holder. The current stable-opener correlation is therefore not proof of actual flock ownership. A real Codex wrong-target termination has not been reproduced.

Scope and decision to produce

Establish an explicit macOS holder/visibility contract before adopting stronger attribution or changing recovery support. Keep this separate from the Linux fdinfo adapter: Linux evidence cannot silently become a universal requirement.

Acceptance criteria

• Pin the Codex acquisition/failure/drop implementation and account for its handle lifetimes, including what source inspection does and does not exclude about observation interleavings.
• Evaluate a documented OS holder primitive or owner-cooperative release protocol with real macOS flock fixtures. Do not assume F_GETLK, an open handle, optional lsof fields, or empty stderr proves the holder.
• Specify a concrete, reviewed choice: retain an accurately documented correlation contract with explicit assumptions/limitations, or introduce a separately reviewed stronger recovery mode/support restriction when holder evidence cannot be established. Do not silently change the default supported-platform contract.
• Cover real holder/nonholder, hidden UID, inherited descriptors, process/file identity changes, permission failures, and unsupported OS/filesystem cases. Treat skipped cases as unverified.
• Preserve the independent nonblocking guarded probe, no native-file creation/deletion, and zero signals in research. Any future signal path requires exact revalidated same-user owner and stable completed transcript evidence.
• Document how the chosen contract would transfer to the Rust experiment (research: evaluate a Rust prototype for native Windows support #122) without claiming Rust resolves holder attribution automatically.

Priority: P2 safety research/design. Parent: #100. This issue does not authorize force termination, privileged production inspection, automatic support removal, or a new native dependency.