fix(storage): isolate macOS nested directory scan cursors (COD-52)

docs/specs/CBG-COPY-01/approvals/process-identity-test.md

@@ -0,0 +1,11 @@
+# CBG-COPY-01 — process-identity verification follow-up
+
+- **Decision:** 2026-10-27, exact-scope implementation approved. This is a verification fix, not a product/loading contract revision.
+- **Existing canonical contract:** [CBG-COPY-01/spec.md](https://github.com/rabii-chaarani/codebaseGraph/blob/75a99c840aa53e75a3f14df8dab41979c9efa19c/docs/specs/CBG-COPY-01/spec.md), revision0.2 at full Git SHA `75a99c840aa53e75a3f14df8dab41979c9efa19c`, especially A3/A9 separate-process sequential loading and exact reopen/PK/connector/search/control verification. Its existing [Scope A approval](https://github.com/rabii-chaarani/codebaseGraph/blob/75a99c840aa53e75a3f14df8dab41979c9efa19c/docs/specs/CBG-COPY-01/approval.md) and [resource-ceiling amendment approval](https://github.com/rabii-chaarani/codebaseGraph/blob/75a99c840aa53e75a3f14df8dab41979c9efa19c/docs/specs/CBG-COPY-01/resource-ceilings-approval.md) remain unchanged. The merged SHA republishes those approved historical contracts; it does not replace their originally approved SHAs.
+- **User decision reference:** this conversation,2026-10-27. Assistant asked: “**Approve investigating and fixing that separate test**, while preserving process-isolation and data checks? Otherwise, I’ll leave the PR blocked.” The user replied **“approved”**. This is distinct from the earlier COD-52-only approval.
+- **Baseline/evidence:** PR157 head `9e7645028013555cc78529a552e3ce0b0468c20f` (evidence-only follow-up to source `d2a442faaf4ca59dc5fe33f082b2072f49b97aa5`), failed CI40449278177, Windows integration shard3. `tests/copy_phase_process.rs:417` sees55unique numeric PIDs across56COPY trace records. Specific PID reuse is plausible, not proven from retained logs; diagnostic artifacts omit phases.jsonl. Preserve failed evidence.
+- **Authorized outcome:** investigate and correct only the test/instrumentation's process-identity oracle so valid reuse of a terminated numeric PID does not fail, while repeated COPY execution in one process still fails verification. Preserve real process launch/isolation, all existing native chunk/index/thread/no-replay/Managed+Direct preservation and exact reopen/PK/connector/search/clean-control checks. Missing or malformed process evidence must not pass.
+- **Scope/constraints:** narrow debug/test trace and fixture correction; use a process-lifetime identity that stays constant for multiple trace records from one helper, never a per-event/request identifier that masks same-process reuse. Add deterministic same-PID/distinct-incarnation acceptance and same-incarnation rejection coverage, plus identity stability and real native process regressions. Do not remove/weaken assertions, add retries/timeouts, change product protocol, loading, containment, native dependencies, resources or public CLI/MCP/data contracts. No merge/deployment/service restart or aggregate closure.
+- **Acceptance:** final test detects genuine same-process reuse despite distinct events; accepts different process instances with reused numeric PID; actual chunked/reopen/PK/connectors/search/control test executes to completion; existing failure-preservation cases stay valid; native Mac/Windows CI actually executes the cases and aggregate results remain honest. Runner reports identify exact source/binary/native environment; configuration alone is not passing evidence.
+- **Architecture/delivery:** proportional Scryer `chg-k66bxx`, existing claims only; no invented responsibilities/topology. Separate Maintenance issue links this record and the existing CBG-COPY-01 contracts. Detailed execution/ownership stays in Scryer. Prior COD-52 cursor source and approval remain unchanged.
+- **State:** approved scope; implementation/verification/review/closure are separate, not implied by this record.

docs/specs/CBG-COPY-01/process-identity-evidence/clippy.log

@@ -0,0 +1,3 @@
+    Checking codebase-graph v4.0.0 (/private/tmp/codebasegraph-cod52-macos-scans)
+    Checking k-wiki v4.0.0 (/private/tmp/codebasegraph-cod52-macos-scans/crates/k-wiki)
+    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.02s

docs/specs/CBG-COPY-01/process-identity-evidence/deterministic-tests.junit.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<testsuites name="nextest-run" tests="3" failures="0" errors="0" uuid="b52b6dc5-841f-4f5c-92f1-e84f791f460a" timestamp="2026-10-27T15:08:43.274+09:30" time="0.063">
+    <testsuite name="codebase-graph" tests="1" disabled="0" errors="0" failures="0">
+        <testcase name="db_writer::phase::tests::phase_trace_process_instance_is_stable_across_calls_and_threads" classname="codebase-graph" timestamp="2026-10-27T15:08:43.275+09:30" time="0.025">
+            <system-out>
+running 1 test
+test db_writer::phase::tests::phase_trace_process_instance_is_stable_across_calls_and_threads ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 845 filtered out; finished in 0.00s
+
+</system-out>
+            <system-err></system-err>
+        </testcase>
+    </testsuite>
+    <testsuite name="codebase-graph::copy_phase_process" tests="2" disabled="0" errors="0" failures="0">
+        <testcase name="phase_process_oracle_accepts_reused_pid_but_rejects_reused_process" classname="codebase-graph::copy_phase_process" timestamp="2026-10-27T15:08:43.301+09:30" time="0.019">
+            <system-out>
+running 1 test
+test phase_process_oracle_accepts_reused_pid_but_rejects_reused_process ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 4 filtered out; finished in 0.00s
+
+</system-out>
+            <system-err></system-err>
+        </testcase>
+        <testcase name="phase_process_oracle_rejects_missing_or_invalid_evidence" classname="codebase-graph::copy_phase_process" timestamp="2026-10-27T15:08:43.320+09:30" time="0.017">
+            <system-out>
+running 1 test
+test phase_process_oracle_rejects_missing_or_invalid_evidence ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 4 filtered out; finished in 0.00s
+
+</system-out>
+            <system-err></system-err>
+        </testcase>
+    </testsuite>
+</testsuites>

docs/specs/CBG-COPY-01/process-identity-evidence/deterministic-tests.log

@@ -0,0 +1,10 @@
+   Compiling codebase-graph v4.0.0 (/private/tmp/codebasegraph-cod52-macos-scans)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 8.39s
+────────────
+ Nextest run ID b52b6dc5-841f-4f5c-92f1-e84f791f460a with nextest profile: copy-pid
+    Starting 3 tests across 2 binaries (848 tests skipped)
+        PASS [   0.025s] (1/3) codebase-graph db_writer::phase::tests::phase_trace_process_instance_is_stable_across_calls_and_threads
+        PASS [   0.019s] (2/3) codebase-graph::copy_phase_process phase_process_oracle_accepts_reused_pid_but_rejects_reused_process
+        PASS [   0.017s] (3/3) codebase-graph::copy_phase_process phase_process_oracle_rejects_missing_or_invalid_evidence
+────────────
+     Summary [   0.063s] 3 tests run: 3 passed, 848 skipped

docs/specs/CBG-COPY-01/process-identity-evidence/final-review.md

@@ -0,0 +1,50 @@
+# COD-98 / CBG-COPY-01 process-identity fix — final adversarial review
+
+## Outcome
+
+**No confirmed P0–P3 defect found in the reviewed change.** Proceed within the approved verification-fix scope. This source-review verdict is not native Windows qualification, aggregate CI completion, merge permission, or closure approval.
+
+Fresh, read-only reviewer: **GPT-6.1 Sol / Max**, using `/Users/rabii/.codex/skills/adversarial-review-engineer/SKILL.md`. The coordinator attested that `rlm.spawn(model="openai-codex/gpt-6.1-sol", thinking="max")` resolved to `openai-codex/gpt-6.1-sol`. This reviewer did not implement the change.
+
+## Reviewed snapshot and authority
+
+- Worktree: `/private/tmp/codebasegraph-cod52-macos-scans`.
+- Baseline/approval commit: `931c3ddaeccba9c3f94f75e3ae58be9e3016a4ef`.
+- Approval: `docs/specs/CBG-COPY-01/approvals/process-identity-test.md`; existing CBG-COPY-01 A3/A9 and historical approvals remain unchanged. Linear **COD-98**, Scryer **chg-k66bxx**. No new responsibility, public contract, or resource policy is required.
+- Reviewed patch: `implementation-diff.patch`, SHA-256 `a86248348434b968a8bddd979d35ab0dee6f903edac7064add881bd24f2f846a`.
+- Actual source SHA-256, independently matched to `implementation-snapshot.json`:
+  - `src/db_writer/phase.rs`: `889b005587d1ce59a63ae35fdcbb1d799ae5248cc910e65cb102e23b80ffa9fa`.
+  - `tests/copy_phase_process.rs`: `bd6d263acba7364a2846b9cb52a669a5281026adadd7b347689e3a5bc0fdbf94`.
+- Reverse-applying the supplied hunks in memory reconstructed baseline Git blobs `0e9a9b92aa5fc13ac34f39313f032aee9223804b` and `f47449443e185598bd0273ababd7f64198cfdffc`, matching the patch headers. No source was modified.
+
+## Adversarial checks
+
+1. **Per-event randomness cannot hide same-process execution.** `phase.rs:402–415` contains one process-global, function-static `OnceLock<Result<String,String>>`. Only its initializer obtains the 32 random bytes and constructs the 64-character lowercase-hex value. There is no reset, request field, sequence number, PID fallback, or alternate producer. `record_test_phase_result` uses that exact singleton at `:463–466`, after executing the real phase (`:366–368`). Repeated requests or threads in one helper therefore emit the same token. The new unit test checks repeated calls and a second thread (`:1190–1205`). The existing launch path creates a fresh executable (`:142–146,190`; guarded Unix `process_lifecycle/unix.rs:329–332`, Windows `process_lifecycle/windows.rs:357–368`), not a fork-only child retaining an initialized singleton.
+2. **Missing or malformed evidence fails closed.** `copy_phase_process.rs:172–190` requires a numeric PID in `1..=u32::MAX`, a string token of exactly 64 bytes, and only ASCII digits/lowercase `a..f`. Missing/null/wrong-type fields, nonpositive/out-of-range PIDs, empty/wrong-length/non-ASCII/nonhex/uppercase tokens cannot pass. `:192–203` rejects fewer than two records, validates every event before set insertion, and compares token contents, not numeric PIDs or reference addresses. Equal PID/different valid token passes; equal token with equal or different PID fails. Deterministic tests exercise the intended distinction and malformed evidence (`:205–231`). Not every malformed input variant has its own test; the remaining predicate branches were traced statically.
+3. **Adjacent process checks retain the same property.** The schema/COPY assertion (`:300`), recovery/failed-schema assertion (`:319–323`), and all-COPY assertion (`:479`) use the same validated oracle. A missing recovery record still fails indexing; an empty/single COPY set fails the oracle rather than passing vacuously. No PID-only process-identity comparison remains in this fixture.
+4. **Instrumentation failures do not manufacture success.** With no trace environment variable, the existing early return occurs before token initialization (`phase.rs:419–420`). Entropy failure is stored as `Err` in the singleton, cloned back to callers, and propagated by `?` before opening/appending a trace (`:408–414,465,469–475`). There is no fallback token or partial success record. Existing create/serialize/open/append failures still propagate. The real post-COPY acknowledgement failure remains after the completed trace (`:476–483`); the new field does not replace the native operation or the failure fixture.
+5. **The data and failure oracles were not weakened.** Relative to the baseline patch, the only replaced assertions concern process identity. The full fixture still checks thread count and bounded real staging files, repeated tables and early PK index order, connector ordering (`:423–478`); exact 1,400 labels/IDs, all keyed lookups, the actual `PRIMARY_KEY_SCAN_NODE_TABLE` plan, all connector endpoints, logical rows/JSON, search and clean-control equality (`:490–605`); and Managed plus Direct acknowledgement-failure/no-replay/publication preservation, bundle hashes, old/new search and later recovery (`:253–324`). The jumbo real-COPY/reopen case remains unchanged (`:343–381`).
+6. **Compatibility and boundaries remain intact.** `Cargo.toml` still declares MSRV 1.82 and existing `getrandom = "0.3.4"`; no dependency or profile changed. Added standard-library APIs are available by 1.82 (`OnceLock` and `Option::is_some_and` since 1.70; the other used APIs are older). This is a static MSRV assessment, not an executed Rust 1.82 build. Identity generation is `cfg(debug_assertions)` and trace-opt-in; it changes neither phase protocol version/request, CLI/MCP/data contracts, loading, containment, resource controls, nor release behavior. The 32-byte/64-hex debug identity is a probabilistic test oracle, not a production process-authentication guarantee.
+
+## Executed evidence examined
+
+The coordinator owns serialized builds and tests. This reviewer ran no build, test, Git operation, reproduction, or external mutation.
+
+- `deterministic-tests.log` and `deterministic-tests.junit.xml`: **3/3 pass**, zero failures/errors; the log names compilation from the reviewed worktree. The singleton stability and both actual oracle tests executed in a debug-enabled test build on macOS.
+- `native-copy-process-tests.log` and `native-copy-process-tests.junit.xml`, run ID `c2454682-b32f-485d-81d6-a9c7e6c6cc75`: **5/5 pass**, zero skipped/failures/errors, 301.558 s total. The previously failing `bounded_production_chunks_reopen_with_primary_keys_connectors_and_search` **passed in 121.218 s**, so its downstream PK/connector/search/control assertions executed to the end. `jumbo_staged_row_survives_real_copy_and_fresh_process_read` **passed in 26.980 s**. `native_copy_acknowledgement_failure_preserves_managed_and_direct_bundles` **passed in 153.320 s**, executing both storage modes and their preservation/recovery checks. Both deterministic oracle cases also passed. Inspected final log and parsed the matching final JUnit; not a partial-run inference.
+- `phase-unit-tests.log` and `phase-unit-tests.junit.xml`, run ID `d548c202-96ad-4f3e-830b-09a527a7bddb`: **13/13 pass**, zero failures/errors, 833 filtered out; includes the singleton stability, trace metadata, protocol, error-boundary, and surrounding phase fixtures.
+- `provenance.json` records exact commands/environment: macOS 26.6.2 (25G83), aarch64-apple-darwin, rustc 1.96.0, normal debug CLI/test profiles, shared `CARGO_TARGET_DIR`, and `CARGO_BIN_EXE_codebase-graph` explicitly targeting the frozen CLI. Independently hashed frozen CLI: `e189db48a699a276019674f93c8698e59805ff80f0e1f7c9260089069ce7a25f`, matching that manifest. The manifest records native Ladybug SHA-256 `a840ea7c538e67a8b9fc0d58495b5226dc9c0a5f2f144ff0c48c0f6ca1193ae6`.
+- Final `cargo fmt --all --check`: **pass** (`format-final.log`, empty). Strict `cargo clippy --locked --workspace --all-targets --all-features -- -D warnings`: **pass** (`clippy.log`, successful 8.02 s compiler summary, no warnings). Exact exit results and commands are recorded in the updated `provenance.json`.
+
+## Remaining gates and limits
+
+- The complete native five-case and nearby 13-case reports, strict Clippy, and formatting have now passed locally. Native Windows follow-up CI is **pending**; local Mac/deterministic execution is not Windows qualification. Broader/aggregate delivery and release gates remain separate.
+- The prior broad local debug run is **incomplete**, not a passing 1,110-case result: 606 pass records and one fixture-prerequisite failure requiring a captured shipping executable, followed by termination. `prior-local-full-run-incomplete.json`/`.md` preserve that distinction. Historical hosted Mac 843-pass/2-ignored evidence is not execution of this new instrumentation.
+- The old Windows failure establishes 55 numeric PIDs across 56 COPY events. Without its raw `phases.jsonl`, specific numeric PID reuse remains **unproven**. This repair corrects the oracle's known invalid all-time uniqueness premise; it does not retrospectively diagnose that run.
+- No conditional defect or unresolved product/architecture decision was identified in this bounded patch. Native-platform/aggregate evidence and delivery/closure remain coordinator/owner gates.
+
+Repository workflow: used supplied target-worktree graph discovery/change-impact evidence before source inspection; no graph MCP was exposed in this reviewer session. Recalled repository memory, read canonical approval/contracts and pipeline wiki, and fetched governing Scryer rules/scoped intent. Live Linear was not available here. Memory assessment: no new reusable knowledge claim beyond the existing approved process-identity decision and retained evidence warrants a memory write. Only this requested report was written; no constants or source files were changed by the reviewer.
+
+## Final evidence checkpoint — 2026-10-27
+
+After the completed native/unit/lint/format reports arrived, independently re-hashed both reviewed source files and the frozen CLI: all still match the identities above. The final JUnit case counts and zero failure/error results agree with the actual logs. Recommendation is unchanged: **no confirmed P0–P3 defect in the reviewed patch; proceed within the authorized scope, with native Windows/aggregate qualification pending**.