docs: record guard liveness and macOS refusal-filter evidence

[abruption]

Current integration: isolated F2 observer and Linux measurement

Head e700770 adds separate-process F2 product inspection with explicit stage framing, bounded stdout/stderr collection, validated stage shapes, independent holder-instance samples and a recorded trusted research build. F2_DIST remains refused; F2_BUILD now enables isolated inspection. F4 remains an unapplied proposal artifact, not a production change. This is a follow-up to the historical measurements below, not a claim that their checks certify this head.

• US Linux measurement of unpatched fix: prototype Linux descriptor-level flock attribution #137 b483cd587c62329243366e64aaaac477edd36adc: actual exit 1, collection true, expectations false, no incomplete waits. Direct prepare/guarded participation passed at dumpable=1, but incomplete-visibility lsof warnings and the Python fixture's unsupported executable/arguments prevented a passing control. Dumpable=0 prepare returned EACCES and inspection refused with the participation blocker; without a passing control, refusalCounted remains false. No warning suppression or identity-rule relaxation was used.
• Injected stall:prepare: actual exit 1, both inspectors incomplete at the stage bound, open stage prepare; both later exited 4 without signals. Holders exited 0. This measures an injected finite stall, not a real procfs hang or cancellation guarantee.
• Raw reports remain private. Remote/downloaded SHA-256 values match and sanitized evidence, build identity and exact input hashes are in evidence.md. No actual Codex process or home was used. No privilege, host-policy or operations change occurred; dependencies were installed only inside private staging.
• Root validation: npm ci/check/lint/test (263 pass, 3 platform skips)/smoke:package passed; all 38 focused research tests passed without skips. Whitespace checks passed outside the stored unified patch: its five blank context lines necessarily contain the unified-diff space marker. That unchanged proposal separately passed git apply --check against the pinned unpatched source.
• Parallel read-only independent review of frozen A2/B2 used Claude Code 2.1.301 (response metadata claude-opus-5-5) and Codex CLI 0.163.0 (default selection, actual model not independently reported). Source-checked fixes address stderr EOF, malformed result evaluation, decimal instance ticks, manifest scope and evidence wording. These pre-correction reviews do not certify this head; repository CI/current-head automatic reviews are separate gates.
• The manifest compares dist and native-addon bytes, not dependency JavaScript/package metadata or native Codex identity. R2 requires the participation blocker but allows other blockers; it does not establish the sole refusal cause.

Keep Draft. #126/#127 and both #137 readiness gates remain open; no merge/release/publication is requested.

---

Historical integration record (through 56dc50d)

Findings and research scope

Holding native coordination during slow inspection delays other writers that need the same coordinator. The synthetic macOS measurements show that injected guard delays increase a cooperating waiter's delay. A separate lsof +fg experiment excludes never-locked and failed-acquirer descriptors, but cannot distinguish a former holder that released its lock while retaining its descriptor. Under injected omission of the actual holder, that former holder remains a wrong eligible target. The sticky bit is therefore refusal-side evidence only, not positive ownership evidence.

This Draft records those results and adds unpublished, hardened research fixtures under experimental/126-guard-liveness/. It does not change production TypeScript, eligibility, platform support, dependencies, JSON, workflows or releases. Refs #126 and #127; neither issue is closed by this PR.

Implementation and open gates

• Retain child exit results, handle readiness/spawn/stdin failures, record incomplete cleanup, and preserve evidence. No fixture-owner force termination is added. Diagnostic subprocess timeout signals remain distinct from owner signaling.
• Reject invalid repetitions, shell substitutions in wrapper paths, malformed/truncated flag fields and duplicate fields. Aggregate all target-path descriptors for a PID, fail closed on scan errors, and validate barrier setup. Clean whole-record omissions remain undetectable.
• Store private scratch with exclusive result writes. Publish sanitized outcome summaries and SHA-256 identifiers, rather than raw paths/PIDs.
• F2's access matrix ran once on an unprivileged Linux 7.0.0-1013-oracle/aarch64 test host. Dumpable=0 denied FD/fdinfo/executable reads with EACCES while cmdline and start ticks remained readable; dumpable=1 allowed the reads and showed one exclusive FLOCK row. Both holders exited normally, collection had no incomplete results, and the downloaded raw result matched its remote hash. In-process product inspection remains removed and F2_DIST is refused: a synchronous syscall would prevent its timer and cleanup from running. Separate-process inspection, native candidate controls, and actual native-access evidence remain required.
• No actual /proc hang was reproduced. No actual Codex process or Windows recovery was tested. Default macOS recovery policy and Draft fix: prototype Linux descriptor-level flock attribution #137 are unchanged by this PR.

Validation

• npm ci, type check, lint, existing tests and package smoke passed. Existing suite: 266 total, 263 passed, three platform skips, zero failures. Research files remain excluded from the npm artifact.
• Eleven focused lifecycle/parser/multi-FD/quoting/reentrant-lock tests passed. F1 nominal and M2 nominal/fault cases use real advisory locks on same-user macOS/APFS synthetic files. Successful and intentionally failing outcomes are reported separately in the research evidence.
• F2 measured source cfa2eba9e3809afa060d85c15ff487f811c925e4; source archive SHA-256 cac2171ba9424d229a204b32a140321795fad000b6bef9fbbc709192a154ec4a, raw result SHA-256 656c1d08d816303dfac870a87e426f4ace0f6972698a46f491a81a4c3b1900fc. Runner exit 0, failures/incomplete 0. Stage/result directories were 0700 and result 0600. Owned remote scratch was removed after confirming holder exits and preserving evidence. No dependency installation, privilege or host-policy change was needed. This does not run fix: prototype Linux descriptor-level flock attribution #137 or measure deployed native Codex dumpability.
• Corrected a source interpretation: fdinfo directory ownership stays with the user at dumpable=0 because its 0555 mode has an exception in the pinned v6.17 source; file access still fails the ptrace check. This is not evidence of kernel-version drift. The corrected source references and measured table are in the research README.
• Independent read-only CLI reviews ran in parallel on e782e396df3f5feebb556bfe2f371d101176e03f, with input SHA-256 70db601c2d878f86621c2f153758b89ea1fbe2973ee60f7cee6deda1ff0fa6da. Claude Code 2.1.296 requested and returned claude-opus-5-5; Codex CLI 0.162.1 used an isolated default selection, actual model unconfirmed. Both exited zero with complete responses and did not execute tests. Subsequent corrections were checked by the integrating Codex; those earlier CLI responses do not certify the final commit.

All 39 checks passed at e5cf6dd7af5f61542a842527a216fa5eec918e61, including repository CI and all five CodeQL language analyses. A cooperating read-only review of that integration requested actual final-script validation and correction of an incomplete-count claim. Both are addressed: one F1/M2 nominal run each and the five documented fault cases returned the expected exit statuses and report fields. The ignored-EOF case records incomplete 1, then child exit 3. The raw result hashes and revision are recorded in evidence.md.

Previous head cfa2eba9e3809afa060d85c15ff487f811c925e4 passed all 39 checks, including CI and CodeQL. It narrows the incomplete: 0 statement to nominal runs, documents the 11-test command and adds missing original result hashes. The cooperating review's two publication-blocking candidates are addressed by actual script execution and the corrected scope. Barrier contention can invalidate a scenario; successful finite runs are not a guarantee for every schedule. No automatic review comments were visible when those results were checked.

Historical head 56dc50d5f610d3356228aacee743cbd22a6706eb records the approved Linux measurement and corrects the fdinfo ownership table. Only documentation and stale preparation labels in script comments/docstrings changed. Diff check, type check, lint, F2 syntax and package smoke passed. All 39 checks also passed for this commit, including CI and CodeQL. No merge or publication was performed.

Keep this PR Draft until the final review and research scope are assessed. Production adoption, merging and package publication are separate decisions.