fix: recover native first-fsync lock crashes before TTL expiry

.agents/pm/features/pm-rust-crash-harness.toon

@@ -0,0 +1,50 @@
+id: pm-rust-crash-harness
+title: Compare native and published crash recovery with a reusable kill corpus
+description: "Reusable TypeScript process-kill/restart differential SDK and command against the locked published oracle; compare acknowledged durable bytes, append-only histories and restart receipts on disposable plain-directory trackers."
+type: Feature
+status: in_progress
+priority: 2
+tags[3]: conformance,crash-consistency,harness
+created_at: "2026-10-21T21:59:35.474Z"
+updated_at: "2026-10-22T16:47:30.014Z"
+author: codex-agent
+acceptance_criteria: Every declared crash boundary preserves acknowledged writes; failures retain minimized synthetic reproductions and never rewrite original history.; Typed SDK and CLI with bounded TOON/JSON receipts and actionable refusals; documented example; public tracker read-copy validation with measured counts; exact-head CI release-check passes.
+comments[14]{created_at,author,text}:
+  "2026-10-21T21:59:37.843Z",codex-agent,"Overlap recheck: published CLI 2026.10.21 matches the locked oracle. Native tests cover normal command differentials and manually reconstructed durable journals; they do not run a reusable live kill/restart corpus. pm-ops assurance reports measurements; pm-vcs writer publication is backend-specific. This feature adds cross-implementation crash evidence beyond lock/parity work. Reconciliation PR 103 closures and performance PR 102 items are excluded. TypeScript-only SDK/command; synthetic failures; targeted local checks; full gate in CI."
+  "2026-10-21T22:16:09.535Z",codex-agent,"Implemented the typed TypeScript SDK and standalone just crash CLI. Declared boundaries are all observed rename/fsync task-local ordinals: event-loop write calls were rejected as unstable storage boundaries after real tracing. Two mutation families run on disposable non-git clones; same-family restart checks exact durable bytes and raw per-runtime restart receipts, with explicit shared cross-runtime acknowledgement projections. Synthetic probing measured 20 real kills, 20 preserved acknowledged writes/history prefixes, two successful baseline byte/acknowledgement comparisons and two early native lock-initialization restart refusals. Those refusals are retained as minimal one-item synthetic cases; no original stream is repaired. Full runtime crash conformance is not claimed. Adding independent replay/no-git regressions and public-copy measurements before CI."
+  "2026-10-21T22:19:48.804Z",codex-agent,"Read-only public-copy validation: public main c0154dbd7cd8071ac52b891be13f956f7a0f21fd, 74 items and 154 authoritative files in a non-git copy with read-only permissions. Measured 20 injected kills, 20 acknowledged-write preservations, 20 exact retained-history prefixes, two cross-runtime baseline byte/acknowledgement matches, 18 successful restart state/receipt checks, two independently reproduced native incomplete-lock restart refusals. Source fingerprint unchanged. Retained evidence is synthetic only. Follow-up pm-rust-crash-lock-restart covers the safe recovery policy, outside this harness change. Behavioral controls disabling history-prefix checking, exact inventory comparison and injected-kill admission each fail their targeted regression with exit 1 and pass after exact byte restoration."
+  "2026-10-21T22:21:46.519Z",codex-agent,"Final targeted checks: pinned PM linked runner passes 14/14 Node regressions with no skips, including real native/published kills, read-only source-output guards, a PATH with no git executable, and independent one-case replay. Strict erasable TypeScript typecheck, ESLint, Rust fmt and targeted binary Clippy pass. Four behavioral negative controls now fail independently and pass after byte restoration, including rejecting a successful restart that lost its own history. Full unchanged-threshold Rust release-check is reserved for CI; no local full release suite was run. Local health retains existing guidance/provenance/stale-item advisories and shared configuration drift; history was not repaired. CI uses its existing clone-local configuration setup. Full CI run results and exact counts will be linked in the PR."
+  "2026-10-22T10:38:52.442Z",codex-agent,"PR 104 review round: pulled remote head and merged origin/main. PRRT_kwDOTwgMRs6vBg8Y is valid: oracle metadata read/parse errors bypass oracle_version. Adding public SDK/CLI regressions for missing, unreadable, malformed, invalid-shape and wrong-version metadata. Full-diff self-review found the same parse-before-typed-refusal pattern in mutation acknowledgements: malformed successful stdout bypasses baseline_failed. Covering and correcting that instance too. Replay-manifest parsing already has its typed invalid_options catch. Latest substantive CodeRabbit review has no Outside diff range findings. No thread replies or resolutions."
+  "2026-10-22T10:42:18.350Z",codex-agent,"Full-diff validation review also found malformed source settings JSON bypassed its unsafe_source guard. Corrected all three parse-before-validation paths: oracle metadata maps to oracle_version, source settings to unsafe_source, and malformed successful mutation stdout to baseline_failed. Added ten SDK oracle metadata cases, bounded JSON/default CLI refusal checks, source immutability checks and a real published-CLI baseline with an incompatible executable. No PM SDK mocks; all fixtures are disposable non-git directories. Replay-manifest parsing already preserves invalid_options. Original histories and all gate thresholds remain unchanged."
+  "2026-10-22T10:43:02.665Z",codex-agent,"Independent revert proofs complete with exact source-byte restoration. Oracle metadata: replacing only its guarded read/parse with the original statement makes both SDK and CLI regressions fail (2/2, io_error); restored both pass. Source settings: reverting only its guarded parse fails 1/1 with io_error; restored passes 1/1. Mutation acknowledgement: reverting only its guarded parse fails 1/1 with io_error; restored passes 1/1 using real published init/create processes and an incompatible native executable. Exact commands: node --test --test-name-pattern=\"oracle metadata\" scripts/crash-harness.test.mts; node --test --test-name-pattern=\"malformed source settings\" scripts/crash-harness.test.mts; node --test --test-name-pattern=\"malformed mutation acknowledgements\" scripts/crash-harness.test.mts. Each negative run exits 1 from the intended assertion; each restored run exits 0."
+  "2026-10-22T10:44:51.308Z",codex-agent,"Final local targeted validation passed: strict erasable TypeScript compiler and ESLint checks; full crash harness 18/18 with zero skips; linked new regressions 4/4. All three independent behavior reverts failed exactly their intended assertions (2+1+1), then passed restored (2+1+1). Isolated pinned-PM health passed. Starting unchanged-threshold just release-check with the existing 35-minute release CI budget as the local wall-time bound."
+  "2026-10-22T10:56:48.191Z",codex-agent,"Local full release attempt is incomplete, not failed: dependency install, fmt, strict Clippy and private-item rustdoc passed; the cold Rust test build was stopped under shared-host contention (main compiler about 7 percent CPU over six minutes). No compiler or test assertion failed. Using exact-head CI for the full unchanged-threshold release gate; this PR remains the active round until that gate passes. Targeted TypeScript compiler/lint checks, full Linux crash harness 18/18, linked new controls 4/4 and all independent revert proofs already pass."
+  "2026-10-22T11:23:46.735Z",codex-agent,"Full CI release evidence at code head 5b84803625d18e3ab3b7fdb4454a49448a628bf6: Linux just release-check passed (https://github.com/unbraind/pm-rust/actions/runs/39767043319/job/119784971422). Ordinary and instrumented Rust tests each passed 578 across 22 suites, zero failed or ignored; Rust lines 14025/14025, functions 1466/1466, regions 23438/23438, branches 3296/3296, all 100 percent. TypeScript compiler, ESLint and Linux crash harness 18/18 with zero skips also passed inside the gate. Audit, changelog and strict tracker health passed; only the pre-existing allowed RUSTSEC-2024-0449 advisory remains. macOS full release gate also passed: 567 ordinary and 567 instrumented Rust tests; all four required Rust metrics 100 percent; Node harness 11 passed with 7 declared Linux-only skips. The stopped local cold-build attempt is incomplete evidence; CI supplies the full pass. Releasing the claim and retaining in_progress for orchestrator verification. Final receipt-head CI evidence will be linked from PR 104; no thread replies/resolutions, PR merge or release."
+  "2026-10-22T16:37:02.495Z",codex-agent,"New PR 104 review round: pulled remote head 328ff00, then merged origin/main a600bd8 because the branch was one commit behind. Thread PRRT_kwDOTwgMRs6vRw2E is valid: the retained-case example claims every replay selects one implementation/syscall/ordinal, but baseline_parity evidence reruns its scenario across both implementations and all observed boundaries. The public SDK replay docstring has the same overstatement. Will correct both descriptions and add a regression tied to the replay contract with a documentation revert proof. Latest CodeRabbit review has no Outside diff range findings. Existing implementation, completed review fixes and append-only histories remain intact."
+  "2026-10-22T16:41:16.374Z",codex-agent,"Documentation revert proof for PRRT_kwDOTwgMRs6vRw2E: node --test --test-name-pattern=\"replay guidance\" scripts/crash-harness.test.mts checks the public guide and SDK docstring. Reverting only docs/CRASH_HARNESS.md yields one intended missing-baseline_parity-exception failure and one unaffected pass. Restoring it and reverting only the replay API docstring yields the other intended failure and one unaffected pass. Both exact byte sequences restored: 2/2 pass. These are documentation-contract controls; runtime replay behavior was already correct and was not changed. The complete just crash-check passes strict erasable TypeScript, ESLint and 20/20 Linux tests with zero failed/canceled/skipped; current native build also passes. Pinned-PM linked controls pass 2/2; result storage remains disabled by project policy, so results are retained here."
+  "2026-10-22T16:41:17.977Z",codex-agent,"Self-review of the whole PR confirms the only overstatements were the retained-case guide and public replay docstring; README, CLI help, manifest validation and the single-boundary selection type do not claim that every replay selects one case. Original histories, stored commands and implementation behavior remain untouched. Releasing the implementation claim with status retained in_progress. Final exact-head unchanged just release-check CI receipts and counts will be recorded in PR https://github.com/unbraind/pm-rust/pull/104; pending CI is not approval. The original stacked-PR instruction still requires merging this completed update and main into PR 105 after PR 104 has passed and been pushed. No review replies/resolutions, PR merge or release."
+  "2026-10-22T16:47:29.332Z",codex-agent,"Additional self-review caught an LF-only assumption in the new guide regression. The matcher now accepts both LF and CRLF and exercises both spellings using the real guide contents. Reverting only the optional carriage-return matcher makes the CRLF assertion fail; restoring it passes both guidance tests 2/2. Strict TypeScript and ESLint pass. No documentation, runtime function, input fixture or gate threshold changed in this follow-up. Superseded pending CI at 84ddc56 is not used as approval; the corrected final head needs fresh full release CI."
+files[5]:
+  - path: scripts/crash-cli.mts
+    scope: project
+    note: Compact TOON and JSON command
+  - path: scripts/crash-harness.mts
+    scope: project
+    note: Typed reusable crash corpus SDK
+  - path: scripts/crash-harness.test.mts
+    scope: project
+  - path: scripts/crash-process.mts
+    scope: project
+    note: Real bounded syscall kill adapters
+  - path: scripts/crash-storage.mts
+    scope: project
+    note: Byte inventories and immutable history checks
+tests[3]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  node --test scripts/crash-harness.test.mts,project,codex-agent,"2026-10-21T22:17:14.334Z",local_mutation,feat/crash-consistency-harness
+  "node --test --test-name-pattern=\"oracle metadata|malformed source settings|malformed mutation acknowledgements\" scripts/crash-harness.test.mts",project,codex-agent,"2026-10-22T10:42:11.763Z",local_mutation,feat/crash-consistency-harness
+  "node --test --test-name-pattern=\"replay guidance\" scripts/crash-harness.test.mts",project,codex-agent,"2026-10-22T16:40:13.066Z",local_mutation,feat/crash-consistency-harness
+docs[3]{path,scope,note}:
+  docs/CRASH_HARNESS.md,project,SDK CLI replay and no-git examples
+  docs/CRASH_PUBLIC_COPY_2026_10_22.json,project,Measured public tracker copy receipt
+  docs/CRASH_REVERT_PROOF_2026_10_22.json,project,Independent behavioral negative controls
+body: ""

.agents/pm/history/pm-rust-comment-lock-receipt.jsonl

@@ -0,0 +1 @@
+{"hash_algorithm":"sha256","ts":"2026-10-21T23:26:23.084Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"066c6d55f017007f41e896af","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"xhigh","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"replace","path":"/body","value":"Found while verifying pm-rust-crash-lock-restart. Reproduce in a disposable non-git tracker with one sample-probe Task, a fresh locks/sample-probe.lock.stale-cleanup directory and a sample-probe.lock JSON receipt containing id, a live fixture PID, owner test-holder, token test-held, ttl_seconds 1800 and a current created_at, without host/start identity. Set PM_LOCK_WAIT_MS=0. Compare native comment sample-probe \"refused note\" --author test-agent with the oracle invocation plus --json. Normalize only that encoding flag in retry metadata. Both refuse safely; detail, required and refusal.surface differ. The ownership JSON refusal comparison on the shared gate path passes exactly and is retained with the recovery regression."},{"op":"add","path":"/metadata/id","value":"pm-rust-comment-lock-receipt"},{"op":"add","path":"/metadata/title","value":"Match native comment lock-conflict JSON diagnostics to the oracle"},{"op":"add","path":"/metadata/description","value":"A fresh initialization gate and a valid unverified owner receipt cause both native comment and oracle 2026.10.21 comment to refuse with exit 4 and code lock_conflict, preserving item and history bytes. After removing the oracle-only --json encoding switch, native detail and required guidance remain generic and refusal.surface is comment instead of comments. The generic formatter predates and is unchanged by the crash restart fix. This differs from pm-rust-4jq3, which covers text output for direct claim/release. Add a dedicated complete-receipt regression and repair the native diagnostic surface separately."},{"op":"add","path":"/metadata/type","value":"Task"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":3},{"op":"add","path":"/metadata/tags","value":["conformance","follow-up","locks"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-21T23:26:23.084Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-21T23:26:23.084Z"},{"op":"add","path":"/metadata/author","value":"codex-agent"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"59d4bbe0652e38a4cb3351a57f574d9650dbb2f04df2fa1613c2e1f04cc39bfc","item_hash_version":3,"message":"","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"79339ee4649710e53329a4c5e072a269a3b84e8ebca6774e422eb29dc0151105"}