[zzwong]

Summary

• Record bounded, call-correlated Pi cr_read and cr_diff execution evidence: exact safe identities, requested ranges, explicit outcomes, missing/ambiguous observations, and collection/transport truncation.
• Distinguish ordinary file reads from pinned symlink-metadata reads. Keep cr_diff pathless; successful calls do not establish complete or meaningful inspection. Retain detached snapshots through durable task metadata and cache reload.
• Advance durable task metadata to schema 4 and reject schema 1/2/3 reuse. The structured model-output schema remains 1. Existing symlink artifacts, diff gates, coverage/approval behavior, and unsupported-adapter behavior stay unchanged.

Type of Change

• Bug fix
• New feature
• Documentation update
• Repo scaffolding / maintenance

Validation

Hosted CI run 37733561467 passed on publication head 982341589d5c3db76ac260626faa325df4ff0dc1. All 10 checks succeeded: Linux/macOS/Windows builds, the build aggregate, standard and opt-out tests, static smoke, lint, title, and identity. The local verification qualifications below remain applicable.

Tested locally with Go 1.26.8 in an offline, credential-free environment.

• Final focused race run: 22 top-level cases, 62 total passing test events, no skips or race reports. Covers file/symlink views, case-fold aliases, exact identity validation, bounded traces, lifecycle/cache/schema checks, and installed-Node transport truncation.
• Final standard make build with VCS stamping, repository-wide go vet ./..., and go mod verify passed. Tidy, formatting, and lint passed with no source/module changes and 0 lint issues.
• Literal make check reached the full test suite, then failed in three pipeline source-trust groups affected by the host's /tmp/.git marker. Pristine 999e59dd reproduced the same six failed test/subtest names. The final log has 67 package-pass lines, 2,063 top-level / 3,571 total test-pass lines, six explicit skips, and no cached package-result lines. Build was not reached inside make check; the separate standard build passed.
• Eight domain packages ran normally and with race before the final names-only lint correction. Their failing fixture-name sets match targeted pristine-main controls, but the timeout symptoms differ: the candidate lacked records.jsonl; main had a start record and failed with stopSeen=false. The separate duration fixture reported 1,258 ms on candidate and 1,186 ms on main against a <350 ms limit. Neither race log contains a race report. No source from test(claude): isolate background polling timeout fixture #660 was included.

Preserved failures and limits

The first focused run exposed a test-double error: setting WaitErr on the fake adapter discards its response. A test-only wrapper now returns the unchanged response plus a terminal error, retaining all persistence/cache/no-replay assertions. The first lint run rejected two local names shadowing copy; only those names changed. A linked-worktree VCS-discovery build failure was retained, and the identical source tree passed ordinary build from a standalone checkout without a buildvcs override. Original failed logs and corrective diffs remain preserved in local verification evidence.

The aggregate's six skips cover two Node tests, installed Pi, opt-in provider integration, Windows cross-volume behavior, and an alternative keyring-tag test. Separate Node-enabled checks passed transport truncation and process-group behavior. Full-repository race and installed-Pi/provider integration remain unestablished by these runs. Cross-platform builds and the alternative keyring-tag job subsequently passed in hosted CI, as recorded above. The final broad-domain race was not rerun after the names-only change; final focused race rechecked the affected evidence paths.

Checklist

• I have read the contributing guide
• My change follows the project structure and conventions
• make tidy passes
• make lint passes
• make test passes
• make build passes

Scope

Collection-only foundation for #597. Per-file reconciliation remains a separate opt-in follow-up. This does not claim that tool invocation proves semantic review or make approval stricter. Subprocess adapters still provide no comparable trace. No review posting, merge, or deployment is part of this change.

Reviewed/tested local commit: 7ffb0109f2eaac23a3d663beccc0c49022f2c254.
Exact source tree: 5aa9b52593aed05d63a956682d5d633263ecb581.
Base: 999e59ddfc74a67ffeef3c4b4a78a8528365afe6.

Refs #597.

Publication commit: 982341589d5c3db76ac260626faa325df4ff0dc1 reproduces that exact tested tree on the stated base.