fix: Guard transcript path probes and sanitize parser errors

[buildingjoshbetter]

Scope

Fix the reproduced recurrence of #306, stacked on the detailed parser-outcome foundation in #798. This draft covers transcript source classification and parser diagnostics. Codex native grammar (#762) and durable ingestion completion (#768) remain separate.

Reproduction and correction

On macOS Python 3.13, the legacy parser raises ENAMETOOLONG for a long inline transcript because filesystem probes occur outside its guard. Both the exception filename and rendered exception contain the complete inline input. The closed issue's prior resolution did not cover this runtime behavior. The reproduction used a generated JSON message with a 600-character payload; no real transcript was read.

A first candidate caught the probes, but additional review identified a cross-version gap: Python 3.14 makes exists/is_file return false on all operating-system errors. Catching those methods therefore cannot reliably distinguish an inaccessible source from inline content. The first candidate and its passing suite remain preserved as insufficient evidence.

• Share one stat-based resolver between the list API and detailed outcome API. It identifies regular files with one filesystem probe and preserves access/I/O errors.
• Keep explicit Path arguments file-only, with no classification probe. Once a string resolves to a file, read failures return no messages rather than ingesting the pathname.
• Preserve inline handling for missing path components, overlong names, invalid syntax and Windows invalid-name error 123. Other probe failures produce the legacy empty list or detailed unreadable status.
• Emit only a fixed error message and categorical source_unreadable field. Parser read/probe logs include no source, path, raw exception or traceback.
• Preserve message parsing, roles, timestamps, coverage counters, file-identity capture and the public return types.

The existing detailed-outcome test changes only its denied-probe injection from exists to stat. Its assertions remain intact. A new suite tests both public APIs, Python 3.14 suppression, real synthetic files, missing/read-race behavior and sentinel-free diagnostics.

Validation

• Root: 10 focused stdlib tests passed; no native imports or local database writes.
• Independent review: no blocker; the same 10 tests plus 12 additional error/privacy probes passed.
• Negative controls: the original source fails with one assertion failure and three expected uncaught-error cases; the first candidate fails the Python 3.14 suppression control with one assertion failure. Neither is treated as release evidence.
• Integration-based author candidate: 2,914 passed, 22 skipped, 3 deselected; 2,194 subtests passed, with actual sqlite-vec. Log SHA256: 613c3820323a3b4045c07d2b78e2306ab7aa547508e3503309356265821f57af.
• Exact isolated publication branch: 2,308 passed, 22 skipped, 3 deselected; 553 subtests passed, with actual sqlite-vec. Log SHA256: c0af6173bba2b27a86c5f9d73e0c831a33f2efc76cc96ec4513d7e8b8eaad0e9.
• All three publication files match the independently reviewed candidate byte-for-byte. Ruff, Python 3.10 grammar, whitespace, scoped privacy and public commit-identity checks passed. Hosted checks exposed a diagnostic compatibility failure, corrected in the follow-up below. All 34 hosted checks pass at follow-up head f0813a3f5165aeade5b2a8b83d77373939e1a91b.

Compatibility and limits

A nonexistent string or a string naming a nonregular object can still be inline under the existing API contract; callers requiring file-only interpretation use Path. This draft does not authenticate source identity or prove that any real transcript was logged or transmitted. It removes the demonstrated parser diagnostic exposure path.

Only synthetic data was used. No personal memories, transcripts or credentials were exported. No main merge, package publication, release or issue closure.

Reference: Python 3.14 pathlib error behavior.

Hosted diagnostic compatibility follow-up

The initial head 061eb0a31f495a0ed13ec97d646f532111e85a2f failed the existing real unreadable-file test on nonroot hosted runners. Its assertion requires the fixed phrase “Cannot read transcript”; the candidate used a different fixed phrase. The GPUBox root suite skipped this chmod test because root bypasses mode 000. The retained Ubuntu Python 3.12 job is 113582779433; log SHA256 is d29c843169f0fe99b0e230f2b51c53a724f25bc6a8feec2e89c762b59adac7c8.

Follow-up f0813a3f5165aeade5b2a8b83d77373939e1a91b restores the expected fixed phrase at both logging sites, without source text, path, exception arguments or traceback. The existing permission test remains unchanged. The portable privacy cases now also assert the existing diagnostic phrase. All 10 focused stdlib tests pass.

An unprivileged GPUBox container ran the unchanged chmod test, the full new parser-boundary module and the detailed-outcome module: 43 passed, 64 subtests passed, zero skips. Effective nonroot identity was asserted before pytest. Log SHA256: 314da972ba62cd9fd51e5c54c337953907382cfc54c71092f2a3015aa5c49366. Whitespace, Ruff and scoped privacy checks pass. The earlier full suites belong to the earlier exact head; this bounded follow-up changes only two fixed log strings and adds one assertion.