[DreamchaserLG]

Summary

write_file_chunk() copied the whole accumulated prefix into a fresh temporary file for every chunk, so writing an N-byte output moved O(N²/4000) bytes — the issue's 4 MiB reproduction recopied about 524× the final file size across 1,048 copy operations. This appends chunks in place and keeps total file I/O linear.

What changes

• Chunks append through an O_APPEND descriptor and are fsynced per chunk; no per-chunk temp file, prefix recopy, or rename.
• The directory fsync now happens only when a chunk creates the file, since appends no longer change directory entries.
• Owner-edit detection is an fstat of the same descriptor the chunk is written through, taken before any bytes land — the same detect-and-abort semantics as the previous stat-before-rename check, over a smaller window.
• The replay protocol gains torn-tail repair (explicit tradeoff below).

Crash-safety tradeoff (explicit)

Previously a crash could never leave partial content in the target: the rename published only complete prefixes. With in-place appends, a process death between the chunk write and its fsync can leave a truncated final chunk. The replay protocol repairs that deterministically: a replayed call compares the stored tail against its own chunk prefix, truncates back to the chunk offset and rewrites. A tail that does not match is refused (Replayed chunk does not match the durable tail; read the file before retrying), so a concurrent edit is never silently overwritten. Serial replay=False behavior is unchanged: any size/offset mismatch still errors and asks for a fresh read.

How verified

• Environment mirrors CI: pip install -r requirements.lock.txt && pip install --no-deps -e . (via uv).
• Baseline pinned at ed62f2c before edits: python -m pytest -q tests/test_agent_output_recovery.py tests/test_agent_progress_recovery.py tests/test_agent_goal_provenance.py → 20 passed; identical result on this branch.
• New tests/test_agent_code_writes.py (12 tests): chunk reassembly, parent creation, mode preservation, multibyte byte-exact round-trip, offset/validation errors, replay skip of durable chunks, clean torn-tail repair, refused mismatching tail, torn tail without replay still rejected, owner-edit-between-calls detection, and an instrumented run asserting the writer never reopens the growing file for reading.
• Issue reproduction (4 MiB via 1,049 ≤4,000-char chunks): baseline 1.04 s with ~2.2 GB of prefix recopying; this branch 0.02 s with no prefix reads.

Fixes #413 (serial-path I/O only; the concurrent owner-edit window tracked as #368 is intentionally untouched).

Co-authored-by: ZCode Scout noreply@zcode.local (commit)